chore: update development channel 02.26.01-dev [skip ci]

chore(version): auto-bump 02.26.01-dev [skip ci]
feat(demo): multi-select list for tables, formatted next-reset with timezone
2026-05-31 00:38:52 +00:00 · 2026-05-31 00:38:51 +00:00 · 2026-05-30 19:38:29 -05:00 · 2026-05-30 19:11:14 -05:00 · 2026-05-30 23:38:06 +00:00 · 2026-05-30 23:37:37 +00:00
83 changed files with 8195 additions and 2014 deletions
@@ -0,0 +1,251 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+# SPDX-License-Identifier: GPL-3.0-or-later
+# FILE INFORMATION
+# DEFGROUP: Gitea.Workflow
+# INGROUP: moko-platform.Automation
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
+# PATH: /.gitea/workflows/branch-protection.yml
+# BRIEF: Apply standardised branch protection rules to all governed repositories
+#
+# +========================================================================+
+# |                   BRANCH PROTECTION SETUP                              |
+# +========================================================================+
+# |                                                                        |
+# |  Applies protection rules for: main, dev, rc, beta, alpha       |
+# |                                                                        |
+# |  main  — Require PR, block rejected reviews, no force push             |
+# |  dev   — Allow push, no force push, no delete                          |
+# |  rc  — Allow push, no force push, no delete                          |
+# |  beta — Allow push, no force push, no delete                         |
+# |  alpha — Allow push, no force push, no delete                        |
+# |                                                                        |
+# |  jmiller has override authority on all branches.                       |
+# |                                                                        |
+# +========================================================================+
+
+name: Branch Protection Setup
+
+on:
+  schedule:
+    - cron: '0 2 * * 1'  # Weekly Monday 02:00 UTC
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: 'Preview mode (no changes)'
+        required: false
+        type: boolean
+        default: false
+      repos:
+        description: 'Comma-separated repo names (empty = all governed repos)'
+        required: false
+        type: string
+        default: ''
+
+env:
+  GITEA_URL: https://git.mokoconsulting.tech
+  GITEA_ORG: MokoConsulting
+
+permissions:
+  contents: read
+
+jobs:
+  protect:
+    name: Apply Branch Protection Rules
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Determine target repos
+        id: repos
+        env:
+          GA_TOKEN: ${{ secrets.GA_TOKEN }}
+        run: |
+          API="${GITEA_URL}/api/v1"
+
+          # Platform/standards/infra repos to exclude
+          EXCLUDE="gitea-org-config org-profile gitea-private .mokogitea-private MokoStandards moko-platform MokoTesting"
+          EXCLUDE="$EXCLUDE MokoStandards-Template-Client MokoStandards-Template-Dolibarr MokoStandards-Template-Generic MokoStandards-Template-Joomla MokoDoliProjTemplate"
+
+          if [ -n "${{ inputs.repos }}" ]; then
+            # User-specified repos
+            REPOS=$(echo "${{ inputs.repos }}" | tr ',' ' ')
+          else
+            # Fetch all org repos
+            PAGE=1
+            REPOS=""
+            while true; do
+              BATCH=$(curl -sS \
+                -H "Authorization: token ${GA_TOKEN}" \
+                "${API}/orgs/${GITEA_ORG}/repos?page=${PAGE}&limit=50" \
+                | jq -r '.[].name // empty')
+              [ -z "$BATCH" ] && break
+              REPOS="$REPOS $BATCH"
+              PAGE=$((PAGE + 1))
+            done
+
+            # Filter out excluded repos
+            FILTERED=""
+            for REPO in $REPOS; do
+              SKIP=false
+              for EX in $EXCLUDE; do
+                if [ "$REPO" = "$EX" ]; then
+                  SKIP=true
+                  break
+                fi
+              done
+              if [ "$SKIP" = "false" ]; then
+                FILTERED="$FILTERED $REPO"
+              fi
+            done
+            REPOS="$FILTERED"
+          fi
+
+          echo "repos=$REPOS" >> "$GITHUB_OUTPUT"
+          COUNT=$(echo "$REPOS" | wc -w)
+          echo "📋 Target repos (${COUNT}): $REPOS"
+
+      - name: Apply protection rules
+        env:
+          GA_TOKEN: ${{ secrets.GA_TOKEN }}
+          DRY_RUN: ${{ inputs.dry_run || 'false' }}
+        run: |
+          API="${GITEA_URL}/api/v1"
+          REPOS="${{ steps.repos.outputs.repos }}"
+
+          SUCCESS=0
+          FAILED=0
+          SKIPPED=0
+
+          # ── Rule definitions ──────────────────────────────────────
+          # Only the CI bot (jmiller token) can push directly.
+          # All human contributors must use PRs.
+          # Force push disabled on all branches.
+
+          RULE_MAIN='{
+            "rule_name": "main",
+            "enable_push": true,
+            "enable_push_whitelist": true,
+            "push_whitelist_usernames": ["jmiller"],
+            "enable_force_push": false,
+            "enable_force_push_allowlist": false,
+            "force_push_allowlist_usernames": [],
+            "enable_merge_whitelist": false,
+            "required_approvals": 0,
+            "dismiss_stale_approvals": true,
+            "block_on_rejected_reviews": true,
+            "block_on_outdated_branch": false,
+            "priority": 1
+          }'
+
+          RULE_DEV='{
+            "rule_name": "dev",
+            "enable_push": true,
+            "enable_push_whitelist": true,
+            "push_whitelist_usernames": ["jmiller"],
+            "enable_force_push": false,
+            "enable_force_push_allowlist": false,
+            "force_push_allowlist_usernames": [],
+            "enable_merge_whitelist": false,
+            "required_approvals": 0,
+            "block_on_rejected_reviews": false,
+            "priority": 2
+          }'
+
+          RULE_RC='{
+            "rule_name": "rc",
+            "enable_push": true,
+            "enable_push_whitelist": true,
+            "push_whitelist_usernames": ["jmiller"],
+            "enable_force_push": false,
+            "enable_force_push_allowlist": false,
+            "force_push_allowlist_usernames": [],
+            "enable_merge_whitelist": false,
+            "required_approvals": 0,
+            "block_on_rejected_reviews": false,
+            "priority": 3
+          }'
+
+          RULE_BETA='{
+            "rule_name": "beta",
+            "enable_push": true,
+            "enable_push_whitelist": true,
+            "push_whitelist_usernames": ["jmiller"],
+            "enable_force_push": false,
+            "enable_force_push_allowlist": false,
+            "force_push_allowlist_usernames": [],
+            "enable_merge_whitelist": false,
+            "required_approvals": 0,
+            "block_on_rejected_reviews": false,
+            "priority": 4
+          }'
+
+          RULE_ALPHA='{
+            "rule_name": "alpha",
+            "enable_push": true,
+            "enable_push_whitelist": true,
+            "push_whitelist_usernames": ["jmiller"],
+            "enable_force_push": false,
+            "enable_force_push_allowlist": false,
+            "force_push_allowlist_usernames": [],
+            "enable_merge_whitelist": false,
+            "required_approvals": 0,
+            "block_on_rejected_reviews": false,
+            "priority": 5
+          }'
+
+          RULES=("$RULE_MAIN" "$RULE_DEV" "$RULE_RC" "$RULE_BETA" "$RULE_ALPHA")
+          RULE_NAMES=("main" "dev" "rc" "beta" "alpha")
+
+          # ── Apply rules to each repo ──────────────────────────────
+          for REPO in $REPOS; do
+            echo ""
+            echo "═══ ${REPO} ═══"
+
+            for i in "${!RULES[@]}"; do
+              RULE="${RULES[$i]}"
+              NAME="${RULE_NAMES[$i]}"
+
+              if [ "$DRY_RUN" = "true" ]; then
+                echo "  [DRY RUN] Would apply rule: ${NAME}"
+                SKIPPED=$((SKIPPED + 1))
+                continue
+              fi
+
+              # Delete existing rule if present (idempotent recreate)
+              ENCODED_NAME=$(echo "$NAME" | sed 's|/|%2F|g')
+              curl -sS -o /dev/null -w "" \
+                -X DELETE \
+                -H "Authorization: token ${GA_TOKEN}" \
+                "${API}/repos/${GITEA_ORG}/${REPO}/branch_protections/${ENCODED_NAME}" 2>/dev/null || true
+
+              # Create rule
+              RESPONSE=$(curl -sS -w "\n%{http_code}" \
+                -X POST \
+                -H "Authorization: token ${GA_TOKEN}" \
+                -H "Content-Type: application/json" \
+                -d "$RULE" \
+                "${API}/repos/${GITEA_ORG}/${REPO}/branch_protections")
+
+              HTTP=$(echo "$RESPONSE" | tail -1)
+              BODY=$(echo "$RESPONSE" | sed '$d')
+
+              if [ "$HTTP" = "201" ]; then
+                echo "  ✅ ${NAME}"
+                SUCCESS=$((SUCCESS + 1))
+              else
+                echo "  ❌ ${NAME} (HTTP ${HTTP}): $(echo "$BODY" | jq -r '.message // .' 2>/dev/null | head -1)"
+                FAILED=$((FAILED + 1))
+              fi
+            done
+          done
+
+          # ── Summary ───────────────────────────────────────────────
+          echo ""
+          echo "════════════════════════════════════════"
+          echo "  ✅ Success: ${SUCCESS}"
+          echo "  ❌ Failed:  ${FAILED}"
+          echo "  ⏭️  Skipped: ${SKIPPED}"
+          echo "════════════════════════════════════════"
+
+          if [ "$FAILED" -gt 0 ]; then
+            echo "::warning::${FAILED} rule(s) failed to apply"
+          fi
@@ -6,15 +6,17 @@
 <moko-platform xmlns="https://standards.mokoconsulting.tech/moko-platform/1.0" schema-version="1.0">
  <identity>
    <name>MokoWaaS</name>
+    <display-name>Package - MokoWaaS</display-name>
    <org>MokoConsulting</org>
    <description>White-label identity, security hardening, and tenant restriction layer for WaaS-managed Joomla environments</description>
+    <version>02.26.01</version>
    <license spdx="GPL-3.0-or-later">GNU General Public License v3</license>
  </identity>
  <governance>
    <platform>joomla</platform>
    <standards-version>05.00.00</standards-version>
    <standards-source>https://git.mokoconsulting.tech/MokoConsulting/moko-platform</standards-source>
-    <last-synced>2026-05-21T20:48:00+00:00</last-synced>
+    <last-synced>2026-05-28T20:00:00+00:00</last-synced>
  </governance>
  <build>
    <language>PHP</language>
@@ -0,0 +1,66 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# FILE INFORMATION
+# DEFGROUP: Gitea.Workflow
+# INGROUP: moko-platform.Release
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
+# PATH: /.mokogitea/workflows/auto-bump.yml
+# VERSION: 09.02.00
+# BRIEF: Auto patch-bump version on every push to dev (skips merge commits)
+
+name: "Universal: Auto Version Bump"
+
+on:
+  push:
+    branches:
+      - dev
+      - rc
+      - 'feature/**'
+      - 'patch/**'
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+  GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+
+permissions:
+  contents: write
+
+jobs:
+  bump:
+    name: Version Bump
+    runs-on: release
+    if: >-
+      !contains(github.event.head_commit.message, '[skip ci]') &&
+      !contains(github.event.head_commit.message, '[skip bump]') &&
+      !startsWith(github.event.head_commit.message, 'Merge pull request')
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          token: ${{ secrets.MOKOGITEA_TOKEN }}
+          fetch-depth: 1
+
+      - name: Setup moko-platform tools
+        run: |
+          if ! command -v composer &> /dev/null; then
+            sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer >/dev/null 2>&1
+          fi
+          if [ -d "/opt/moko-platform/cli" ]; then
+            echo "MOKO_CLI=/opt/moko-platform/cli" >> "$GITHUB_ENV"
+          else
+            git clone --depth 1 --branch main --quiet \
+              "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/MokoConsulting/moko-platform.git" \
+              /tmp/moko-platform-api
+            cd /tmp/moko-platform-api && composer install --no-dev --no-interaction --quiet
+            echo "MOKO_CLI=/tmp/moko-platform-api/cli" >> "$GITHUB_ENV"
+          fi
+
+      - name: Bump version
+        run: |
+          php ${MOKO_CLI}/version_auto_bump.php \
+            --path . --branch "${GITHUB_REF_NAME}" \
+            --token "${{ secrets.MOKOGITEA_TOKEN }}" \
+            --repo-url "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"
@@ -0,0 +1,48 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# FILE INFORMATION
+# DEFGROUP: Gitea.Workflow
+# INGROUP: MokoStandards.Universal
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
+# PATH: /.mokogitea/workflows/branch-cleanup.yml
+# VERSION: 01.00.00
+# BRIEF: Delete feature branches after PR merge
+
+name: "Branch Cleanup"
+
+on:
+  pull_request:
+    types: [closed]
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+jobs:
+  cleanup:
+    name: Delete merged branch
+    runs-on: ubuntu-latest
+    if: >-
+      github.event.pull_request.merged == true &&
+      github.event.pull_request.head.ref != 'dev' &&
+      github.event.pull_request.head.ref != 'main'
+
+    steps:
+      - name: Delete source branch
+        run: |
+          BRANCH="${{ github.event.pull_request.head.ref }}"
+          API="${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}/api/v1/repos/${{ github.repository }}/branches"
+          ENCODED=$(php -r "echo rawurlencode('${BRANCH}');")
+
+          STATUS=$(curl -sf -o /dev/null -w "%{http_code}" -X DELETE \
+            -H "Authorization: token ${{ secrets.MOKOGITEA_TOKEN }}" \
+            "${API}/${ENCODED}" 2>/dev/null || true)
+
+          if [ "$STATUS" = "204" ]; then
+            echo "Deleted branch: ${BRANCH}" >> $GITHUB_STEP_SUMMARY
+          elif [ "$STATUS" = "404" ]; then
+            echo "Branch already deleted: ${BRANCH}" >> $GITHUB_STEP_SUMMARY
+          else
+            echo "::warning::Failed to delete branch ${BRANCH} (HTTP ${STATUS})"
+          fi
@@ -4,8 +4,8 @@
 #
 # FILE INFORMATION
 # DEFGROUP: Gitea.Workflow
-# INGROUP: MokoStandards.Maintenance
-# REPO: https://git.mokoconsulting.tech/mokoconsulting-tech/MokoStandards-API
+# INGROUP: moko-platform.Maintenance
+# REPO: https://git.mokoconsulting.tech/mokoconsulting-tech/moko-platform
 # PATH: /templates/workflows/cascade-dev.yml.template
 # VERSION: 02.00.00
 # BRIEF: Forward-merge main → all open branches after every push to main
@@ -52,7 +52,7 @@ jobs:
      - name: Discover target branches
        id: branches
        env:
-          GA_TOKEN: ${{ secrets.GA_TOKEN }}
+          GA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
        run: |
          API="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"

@@ -61,7 +61,7 @@ jobs:
          ALL_BRANCHES=""
          while true; do
            BATCH=$(curl -sS \
-              -H "Authorization: token ${GA_TOKEN}" \
+              -H "Authorization: token ${GITEA_TOKEN}" \
              "${API}/branches?page=${PAGE}&limit=50" \
              | jq -r '.[].name // empty')
            [ -z "$BATCH" ] && break
@@ -93,7 +93,7 @@ jobs:
      - name: Cascade to all target branches
        if: steps.branches.outputs.targets != ''
        env:
-          GA_TOKEN: ${{ secrets.GA_TOKEN }}
+          GA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
        run: |
          API="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
          SHORT_SHA="${GITHUB_SHA:0:7}"
@@ -111,7 +111,7 @@ jobs:
            # Check if branch is already up to date
            ENCODED_BRANCH=$(echo "$BRANCH" | sed 's|/|%2F|g')
            RESPONSE=$(curl -sS \
-              -H "Authorization: token ${GA_TOKEN}" \
+              -H "Authorization: token ${GITEA_TOKEN}" \
              "${API}/compare/${ENCODED_BRANCH}...main")

            AHEAD=$(echo "$RESPONSE" | jq '.total_commits // 0')
@@ -126,7 +126,7 @@ jobs:

            # Check for existing cascade PR
            EXISTING=$(curl -sS \
-              -H "Authorization: token ${GA_TOKEN}" \
+              -H "Authorization: token ${GITEA_TOKEN}" \
              "${API}/pulls?state=open&head=${GITEA_ORG}:main&base=${ENCODED_BRANCH}&limit=1")

            EXISTING_COUNT=$(echo "$EXISTING" | jq 'length')
@@ -139,7 +139,7 @@ jobs:
              # Create cascade PR
              PR_RESPONSE=$(curl -sS -w "\n%{http_code}" \
                -X POST \
-                -H "Authorization: token ${GA_TOKEN}" \
+                -H "Authorization: token ${GITEA_TOKEN}" \
                -H "Content-Type: application/json" \
                -d "{
                  \"title\": \"chore: cascade main → ${BRANCH} (${SHORT_SHA}) [skip ci]\",
@@ -165,7 +165,7 @@ jobs:

            # Try auto-merge
            PR_DATA=$(curl -sS \
-              -H "Authorization: token ${GA_TOKEN}" \
+              -H "Authorization: token ${GITEA_TOKEN}" \
              "${API}/pulls/${PR_NUMBER}")

            MERGEABLE=$(echo "$PR_DATA" | jq -r '.mergeable // false')
@@ -178,7 +178,7 @@ jobs:

            MERGE_RESPONSE=$(curl -sS -w "\n%{http_code}" \
              -X POST \
-              -H "Authorization: token ${GA_TOKEN}" \
+              -H "Authorization: token ${GITEA_TOKEN}" \
              -H "Content-Type: application/json" \
              -d "{
                \"Do\": \"merge\",
@@ -43,9 +43,9 @@ jobs:

      - name: Clone MokoStandards
        env:
-          GA_TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
-          MOKO_CLONE_TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
-          MOKO_CLONE_HOST: ${{ secrets.GA_TOKEN && 'git.mokoconsulting.tech/MokoConsulting' || 'github.com/mokoconsulting-tech' }}
+          GA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN || secrets.MOKOGITEA_TOKEN || github.token }}
+          MOKO_CLONE_TOKEN: ${{ secrets.MOKOGITEA_TOKEN || secrets.MOKOGITEA_TOKEN || github.token }}
+          MOKO_CLONE_HOST: ${{ secrets.MOKOGITEA_TOKEN && 'git.mokoconsulting.tech/MokoConsulting' || 'github.com/mokoconsulting-tech' }}
        run: |
          git clone --depth 1 --branch main --quiet \
            "https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/MokoStandards-API.git" \
@@ -53,7 +53,7 @@ jobs:

      - name: Install dependencies
        env:
-          COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.GA_TOKEN || github.token }}"}}'
+          COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.MOKOGITEA_TOKEN || github.token }}"}}'
        run: |
          if [ -f "composer.json" ]; then
            composer install \
@@ -346,7 +346,7 @@ jobs:

      - name: Install dependencies
        env:
-          COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.GA_TOKEN || github.token }}"}}'
+          COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.MOKOGITEA_TOKEN || github.token }}"}}'
        run: |
          if [ -f "composer.json" ]; then
            composer install \
@@ -391,7 +391,7 @@ jobs:

      - name: Install dependencies
        env:
-          COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.GA_TOKEN || github.token }}"}}'
+          COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.MOKOGITEA_TOKEN || github.token }}"}}'
        run: |
          if [ -f "composer.json" ]; then
            composer install --no-interaction --prefer-dist --optimize-autoloader
@@ -458,10 +458,10 @@ jobs:
    steps:
      - name: Trigger pre-release build
        env:
-          GA_TOKEN: ${{ secrets.GA_TOKEN }}
+          GA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
          REPO: ${{ github.repository }}
          BRANCH: ${{ github.head_ref }}
        run: |
-          curl -s -X POST             "${GITEA_URL:-https://git.mokoconsulting.tech}/api/v1/repos/${REPO}/actions/workflows/pre-release.yml/dispatches"             -H "Authorization: token ${GA_TOKEN}"             -H "Content-Type: application/json"             -d "{\"ref\":\"${BRANCH}\",\"inputs\":{\"stability\":\"release-candidate\"}}"
+          curl -s -X POST             "${GITEA_URL:-https://git.mokoconsulting.tech}/api/v1/repos/${REPO}/actions/workflows/pre-release.yml/dispatches"             -H "Authorization: token ${GITEA_TOKEN}"             -H "Content-Type: application/json"             -d "{\"ref\":\"${BRANCH}\",\"inputs\":{\"stability\":\"release-candidate\"}}"
          echo "### Pre-Release" >> $GITHUB_STEP_SUMMARY
          echo "Triggered RC build on branch \`${BRANCH}\`" >> $GITHUB_STEP_SUMMARY
@@ -4,8 +4,8 @@
 #
 # FILE INFORMATION
 # DEFGROUP: Gitea.Workflow
-# INGROUP: MokoStandards.Maintenance
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/MokoStandards
+# INGROUP: moko-platform.Maintenance
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
 # PATH: /.gitea/workflows/cleanup.yml
 # VERSION: 01.00.00
 # BRIEF: Scheduled cleanup — delete merged branches and old workflow runs
@@ -33,17 +33,17 @@ jobs:
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
-          token: ${{ secrets.GA_TOKEN }}
+          token: ${{ secrets.MOKOGITEA_TOKEN }}

      - name: Delete merged branches
        env:
-          GA_TOKEN: ${{ secrets.GA_TOKEN }}
+          GA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
        run: |
          echo "=== Merged Branch Cleanup ==="
          API="${GITEA_URL}/api/v1/repos/${{ github.repository }}"

          # List branches via API
-          BRANCHES=$(curl -sS -H "Authorization: token ${GA_TOKEN}" \
+          BRANCHES=$(curl -sS -H "Authorization: token ${GITEA_TOKEN}" \
            "${API}/branches?limit=50" | jq -r '.[].name')

          DELETED=0
@@ -56,7 +56,7 @@ jobs:
            # Check if branch is merged into main
            if git merge-base --is-ancestor "origin/${BRANCH}" origin/main 2>/dev/null; then
              echo "  Deleting merged branch: ${BRANCH}"
-              curl -sS -X DELETE -H "Authorization: token ${GA_TOKEN}" \
+              curl -sS -X DELETE -H "Authorization: token ${GITEA_TOKEN}" \
                "${API}/branches/${BRANCH}" 2>/dev/null || true
              DELETED=$((DELETED + 1))
            fi
@@ -66,20 +66,20 @@ jobs:

      - name: Clean old workflow runs
        env:
-          GA_TOKEN: ${{ secrets.GA_TOKEN }}
+          GA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
        run: |
          echo "=== Workflow Run Cleanup ==="
          API="${GITEA_URL}/api/v1/repos/${{ github.repository }}"
          CUTOFF=$(date -d "30 days ago" +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || date -v-30d +%Y-%m-%dT%H:%M:%SZ)

          # Get old completed runs
-          RUNS=$(curl -sS -H "Authorization: token ${GA_TOKEN}" \
+          RUNS=$(curl -sS -H "Authorization: token ${GITEA_TOKEN}" \
            "${API}/actions/runs?status=completed&limit=50" | \
            jq -r ".workflow_runs[] | select(.created_at < \"${CUTOFF}\") | .id" 2>/dev/null)

          DELETED=0
          for RUN_ID in $RUNS; do
-            curl -sS -X DELETE -H "Authorization: token ${GA_TOKEN}" \
+            curl -sS -X DELETE -H "Authorization: token ${GITEA_TOKEN}" \
              "${API}/actions/runs/${RUN_ID}" 2>/dev/null || true
            DELETED=$((DELETED + 1))
          done
@@ -4,8 +4,8 @@
 #
 # FILE INFORMATION
 # DEFGROUP: Gitea.Workflow
-# INGROUP: MokoStandards.Security
-# REPO: https://git.mokoconsulting.tech/mokoconsulting-tech/MokoStandards-API
+# INGROUP: moko-platform.Security
+# REPO: https://git.mokoconsulting.tech/mokoconsulting-tech/moko-platform
 # PATH: /templates/workflows/gitleaks.yml.template
 # VERSION: 01.00.00
 # BRIEF: Secret scanning — detect leaked credentials, API keys, and tokens
@@ -5,7 +5,7 @@
 # FILE INFORMATION
 # DEFGROUP: Gitea.Workflow
 # INGROUP: moko-platform.Automation
-# VERSION: 01.00.00
+# VERSION: 02.26.01
 # BRIEF: Auto-create feature branch when an issue is opened

 name: "Universal: Issue Branch"
@@ -28,7 +28,7 @@ jobs:
    steps:
      - name: Create branch and comment
        run: |
-          TOKEN="${{ secrets.GA_TOKEN }}"
+          TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
          API="${GITEA_URL}/api/v1/repos/${{ github.repository }}"
          ISSUE_NUM="${{ github.event.issue.number }}"
          ISSUE_TITLE="${{ github.event.issue.title }}"
@@ -4,8 +4,8 @@
 #
 # FILE INFORMATION
 # DEFGROUP: Gitea.Workflow
-# INGROUP: MokoStandards.Notifications
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/MokoStandards
+# INGROUP: moko-platform.Notifications
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
 # PATH: /.gitea/workflows/notify.yml
 # VERSION: 01.00.00
 # BRIEF: Push notifications via ntfy on release success or workflow failure
@@ -18,7 +18,6 @@ on:
      - "Joomla Build & Release"
      - "Joomla Extension CI"
      - "Deploy"
-      - "Cascade Main → Dev"
    types:
      - completed

@@ -4,8 +4,8 @@
 #
 # FILE INFORMATION
 # DEFGROUP: Gitea.Workflow
-# INGROUP: MokoStandards.CI
-# REPO: https://git.mokoconsulting.tech/mokoconsulting-tech/MokoStandards-API
+# INGROUP: moko-platform.CI
+# REPO: https://git.mokoconsulting.tech/mokoconsulting-tech/moko-platform
 # PATH: /templates/workflows/universal/pr-check.yml.template
 # VERSION: 05.00.00
 # BRIEF: PR gate — branch policy + code validation before merge
@@ -52,22 +52,22 @@ jobs:
                REASON="Fix branches must target 'dev', not '${BASE}'"
              fi
              ;;
+            patch/*)
+              if [ "$BASE" != "dev" ] && [ "$BASE" != "rc" ]; then
+                ALLOWED=false
+                REASON="Patch branches must target 'dev' or 'rc', not '${BASE}'"
+              fi
+              ;;
            hotfix/*)
              if [ "$BASE" != "dev" ] && [ "$BASE" != "main" ]; then
                ALLOWED=false
                REASON="Hotfix branches can only target 'dev' or 'main', not '${BASE}'"
              fi
              ;;
-            alpha/*|beta/*)
-              if [ "$BASE" != "dev" ]; then
-                ALLOWED=false
-                REASON="Pre-release branches must target 'dev', not '${BASE}'"
-              fi
-              ;;
-            rc/*)
+            rc)
              if [ "$BASE" != "main" ]; then
                ALLOWED=false
-                REASON="Release candidate branches must target 'main', not '${BASE}'"
+                REASON="RC branch can only merge into 'main', not '${BASE}'"
              fi
              ;;
            dev)
@@ -108,8 +108,9 @@ jobs:
      - name: Detect platform
        id: platform
        run: |
-          # Parse manifest for platform detection
-          PLATFORM=$(php /tmp/mokostandards-api/cli/manifest_read.php --path . --field platform 2>/dev/null)
+          # Read platform from XML manifest (<platform> tag) or plain text fallback
+          PLATFORM=$(sed -n 's/.*<platform>\([^<]*\)<\/platform>.*/\1/p' .mokogitea/manifest.xml 2>/dev/null | head -1)
+          [ -z "$PLATFORM" ] && PLATFORM=$(cat .mokogitea/manifest.xml 2>/dev/null | tr -d '[:space:]')
          [ -z "$PLATFORM" ] && PLATFORM="generic"
          echo "platform=$PLATFORM" >> "$GITHUB_OUTPUT"

@@ -182,6 +183,28 @@ jobs:
              ;;
          esac

+      - name: Check changelog has unreleased entry
+        run: |
+          if [ ! -f "CHANGELOG.md" ]; then
+            echo "::warning::No CHANGELOG.md found"
+            exit 0
+          fi
+          # Check for content under [Unreleased] section
+          if ! grep -q "## \[Unreleased\]" CHANGELOG.md; then
+            echo "::error::CHANGELOG.md missing [Unreleased] section"
+            exit 1
+          fi
+          # Check there's at least one entry (Added/Changed/Fixed/Removed) under Unreleased
+          UNRELEASED_CONTENT=$(sed -n '/## \[Unreleased\]/,/## \[/p' CHANGELOG.md | grep -cE '^\s*-\s' || true)
+          if [ "$UNRELEASED_CONTENT" -eq 0 ]; then
+            echo "::error::CHANGELOG.md [Unreleased] section has no entries. Add a changelog entry describing your changes."
+            echo "## Changelog Check: Failed" >> $GITHUB_STEP_SUMMARY
+            echo "The \`[Unreleased]\` section in CHANGELOG.md has no entries." >> $GITHUB_STEP_SUMMARY
+            echo "Add a line like \`- Description of your change\` under a heading (\`### Added\`, \`### Changed\`, \`### Fixed\`, etc.)" >> $GITHUB_STEP_SUMMARY
+            exit 1
+          fi
+          echo "Changelog: ${UNRELEASED_CONTENT} entry/entries in [Unreleased]"
+
      - name: Verify package source
        run: |
          SOURCE_DIR="src"
@@ -194,35 +217,6 @@ jobs:
          echo "Source: ${FILE_COUNT} files"
          [ "$FILE_COUNT" -gt 0 ] || { echo "::error::Source directory is empty"; exit 1; }

-  # ── Changelog Gate ────────────────────────────────────────────────────
-  changelog:
-    name: Changelog Updated
-    runs-on: ubuntu-latest
-    if: github.base_ref == 'main'
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Check CHANGELOG.md was updated
-        run: |
-          BASE="${{ github.event.pull_request.base.sha }}"
-          HEAD="${{ github.event.pull_request.head.sha }}"
-
-          if git diff --name-only "$BASE" "$HEAD" | grep -q "^CHANGELOG.md$"; then
-            echo "CHANGELOG.md updated"
-          else
-            # Allow [skip changelog] in PR title or body
-            PR_TITLE="${{ github.event.pull_request.title }}"
-            PR_BODY="${{ github.event.pull_request.body }}"
-            if echo "$PR_TITLE $PR_BODY" | grep -qi "\[skip changelog\]"; then
-              echo "::warning::Changelog skip requested via [skip changelog]"
-              exit 0
-            fi
-            echo "::error::CHANGELOG.md must be updated before merging to main. Add [skip changelog] to the PR title to bypass."
-            exit 1
-          fi
-
  # ── Pre-Release RC Build ─────────────────────────────────────────────────
  pre-release:
    name: Build RC Package
@@ -232,11 +226,11 @@ jobs:
    steps:
      - name: Trigger RC pre-release
        env:
-          GA_TOKEN: ${{ secrets.GA_TOKEN }}
+          GA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
          REPO: ${{ github.repository }}
          BRANCH: ${{ github.head_ref }}
          GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
        run: |
-          curl -s -X POST             "${GITEA_URL}/api/v1/repos/${REPO}/actions/workflows/pre-release.yml/dispatches"             -H "Authorization: token ${GA_TOKEN}"             -H "Content-Type: application/json"             -d "{\"ref\":\"${BRANCH}\",\"inputs\":{\"stability\":\"release-candidate\"}}"
+          curl -s -X POST             "${GITEA_URL}/api/v1/repos/${REPO}/actions/workflows/pre-release.yml/dispatches"             -H "Authorization: token ${GITEA_TOKEN}"             -H "Content-Type: application/json"             -d "{\"ref\":\"${BRANCH}\",\"inputs\":{\"stability\":\"release-candidate\"}}"
          echo "### Pre-Release" >> $GITHUB_STEP_SUMMARY
          echo "Triggered RC build on branch \`${BRANCH}\`" >> $GITHUB_STEP_SUMMARY
@@ -13,6 +13,10 @@
 name: "Universal: Pre-Release"

 on:
+  pull_request:
+    types: [closed]
+    branches:
+      - dev
  workflow_dispatch:
    inputs:
      stability:
@@ -35,56 +39,44 @@ env:

 jobs:
  build:
-    name: "Build Pre-Release (${{ inputs.stability }})"
+    name: "Build Pre-Release (${{ inputs.stability || 'development' }})"
    runs-on: release
+    if: >-
+      github.event_name == 'workflow_dispatch' ||
+      (github.event.pull_request.merged == true && github.event.pull_request.base.ref == 'dev')

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
-          token: ${{ secrets.GA_TOKEN }}
+          token: ${{ secrets.MOKOGITEA_TOKEN }}

-      - name: Setup tools
+      - name: Setup moko-platform tools
+        env:
+          MOKO_CLONE_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+          MOKO_CLONE_HOST: git.mokoconsulting.tech/MokoConsulting
        run: |
-          # Update moko-platform CLI tools if available; install PHP if missing
-          if command -v moko-platform-update &> /dev/null; then
-            moko-platform-update
-          elif [ -d "/opt/moko-platform" ]; then
-            cd /opt/moko-platform && git pull origin main --quiet 2>/dev/null || true
-          else
-            if ! command -v php &> /dev/null; then
-              sudo apt-get update -qq
-              sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl >/dev/null 2>&1
-            fi
-            git clone --depth 1 --branch main --quiet \
-              "https://x-access-token:${{ secrets.GA_TOKEN }}@git.mokoconsulting.tech/MokoConsulting/moko-platform.git" \
-              /tmp/moko-platform-api
-          fi
-          # Set MOKO_CLI to whichever path exists
-          if [ -d "/opt/moko-platform/cli" ]; then
-            echo "MOKO_CLI=/opt/moko-platform/cli" >> "$GITHUB_ENV"
-          else
-            echo "MOKO_CLI=/tmp/moko-platform-api/cli" >> "$GITHUB_ENV"
+          if ! command -v composer &> /dev/null; then
+            sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer >/dev/null 2>&1
          fi
+          # Always fetch latest CLI tools — never use stale cache from previous runs
+          rm -rf /tmp/moko-platform-api
+          git clone --depth 1 --branch main --quiet \
+            "https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/moko-platform.git" \
+            /tmp/moko-platform-api
+          cd /tmp/moko-platform-api && composer install --no-dev --no-interaction --quiet
+          echo "MOKO_CLI=/tmp/moko-platform-api/cli" >> "$GITHUB_ENV"

      - name: Detect platform
        id: platform
        run: |
-          PLATFORM=$(sed -n 's/.*<platform>\([^<]*\)<\/platform>.*/\1/p' .mokogitea/manifest.xml 2>/dev/null | head -1 | tr -d '[:space:]')
-          [ -z "$PLATFORM" ] && PLATFORM="generic"
-          echo "platform=$PLATFORM" >> "$GITHUB_OUTPUT"
-          MANIFEST=$(find ./src -maxdepth 1 -name "pkg_*.xml" -exec grep -l '<extension' {} \; 2>/dev/null | head -1)
-          [ -z "$MANIFEST" ] && MANIFEST=$(find . -maxdepth 3 -name "*.xml" ! -path "./.git/*" ! -path "*/packages/*" -exec grep -l '<extension' {} \; 2>/dev/null | head -1)
-          [ -z "$MANIFEST" ] && MANIFEST=$(find . -maxdepth 3 -name "*.xml" ! -path "./.git/*" -exec grep -l '<extension' {} \; 2>/dev/null | head -1)
-          MOD_FILE=$(find . -maxdepth 4 -name "mod*.class.php" ! -path "./.git/*" -exec grep -l 'extends DolibarrModules' {} \; 2>/dev/null | head -1)
-          echo "manifest=${MANIFEST}" >> "$GITHUB_OUTPUT"
-          echo "mod_file=${MOD_FILE}" >> "$GITHUB_OUTPUT"
+          php ${MOKO_CLI}/manifest_read.php --path . --github-output

      - name: Resolve metadata and bump version
        id: meta
        run: |
-          STABILITY="${{ inputs.stability }}"
+          STABILITY="${{ inputs.stability || 'development' }}"

          case "$STABILITY" in
            development)        SUFFIX="-dev";   TAG="development" ;;
@@ -93,60 +85,44 @@ jobs:
            release-candidate)  SUFFIX="-rc";    TAG="release-candidate" ;;
          esac

-          # Patch bump via CLI tool
-          php ${MOKO_CLI}/version_bump.php --path .
+          # Read current version (bump already handled by push workflow)
          VERSION=$(php ${MOKO_CLI}/version_read.php --path . 2>/dev/null)
          [ -z "$VERSION" ] && VERSION="00.00.01"
-          TODAY=$(date +%Y-%m-%d)

-          # Update platform-specific manifest
-          PLATFORM="${{ steps.platform.outputs.platform }}"
-          MANIFEST="${{ steps.platform.outputs.manifest }}"
-          MOD_FILE="${{ steps.platform.outputs.mod_file }}"
+          # Strip any existing suffix from version before applying stability
+          VERSION=$(echo "$VERSION" | sed 's/-\(dev\|alpha\|beta\|rc\)$//')

          php ${MOKO_CLI}/version_set_platform.php \
-            --path . --version "$VERSION" --branch "${{ github.ref_name }}" 2>/dev/null || true
+            --path . --version "$VERSION" --branch "${{ github.ref_name }}" --stability "$STABILITY" 2>/dev/null || true
+
+          # Verify version consistency across all files
+          php ${MOKO_CLI}/version_check.php --path . --fix 2>/dev/null || true
+
+          # Update VERSION variable with suffix
+          if [ -n "$SUFFIX" ]; then
+            VERSION="${VERSION}${SUFFIX}"
+          fi

          # Commit version bump
          git config --local user.email "gitea-actions[bot]@mokoconsulting.tech"
          git config --local user.name "gitea-actions[bot]"
-          git remote set-url origin "https://jmiller:${{ secrets.GA_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"
+          git remote set-url origin "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"
          git add -A
          git diff --cached --quiet || {
            git commit -m "chore(version): pre-release bump to ${VERSION} [skip ci]"
            git push origin HEAD 2>&1
          }

-          # Auto-detect element (platform-aware)
-          EXT_ELEMENT=""
-          case "$PLATFORM" in
-            joomla)
-              if [ -n "$MANIFEST" ]; then
-                EXT_ELEMENT=$(sed -n 's/.*<element>\([^<]*\)<\/element>.*/\1/p' "$MANIFEST" 2>/dev/null | head -1)
-                if [ -z "$EXT_ELEMENT" ]; then
-                  EXT_ELEMENT=$(basename "$MANIFEST" .xml | tr '[:upper:]' '[:lower:]')
-                  case "$EXT_ELEMENT" in
-                    templatedetails|manifest) EXT_ELEMENT=$(echo "${GITEA_REPO}" | tr '[:upper:]' '[:lower:]' | tr -d ' -') ;;
-                  esac
-                fi
-              else
-                EXT_ELEMENT=$(echo "${GITEA_REPO}" | tr '[:upper:]' '[:lower:]' | tr -d ' -')
-              fi
-              ;;
-            dolibarr)
-              if [ -n "$MOD_FILE" ]; then
-                MOD_BASENAME=$(basename "$MOD_FILE" .class.php)
-                EXT_ELEMENT=$(echo "$MOD_BASENAME" | sed 's/^mod//' | tr '[:upper:]' '[:lower:]')
-              else
-                EXT_ELEMENT=$(echo "${GITEA_REPO}" | tr '[:upper:]' '[:lower:]' | tr -d ' -')
-              fi
-              ;;
-            *)
-              EXT_ELEMENT=$(echo "${GITEA_REPO}" | tr '[:upper:]' '[:lower:]' | tr -d ' -')
-              ;;
-          esac
+          # Auto-detect element via manifest_element.php
+          php ${MOKO_CLI}/manifest_element.php \
+            --path . --version "$VERSION" --stability "$STABILITY" \
+            --repo "${GITEA_REPO}" --github-output

-          ZIP_NAME="${EXT_ELEMENT}-${VERSION}${SUFFIX}.zip"
+          # Read back element outputs
+          EXT_ELEMENT=$(grep '^ext_element=' "$GITHUB_OUTPUT" | tail -1 | cut -d= -f2)
+          ZIP_NAME=$(grep '^zip_name=' "$GITHUB_OUTPUT" | tail -1 | cut -d= -f2)
+          [ -z "$EXT_ELEMENT" ] && EXT_ELEMENT=$(echo "${GITEA_REPO}" | tr '[:upper:]' '[:lower:]' | tr -d ' -')
+          [ -z "$ZIP_NAME" ] && ZIP_NAME="${EXT_ELEMENT}-${VERSION}.zip"

          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
          echo "stability=${STABILITY}" >> "$GITHUB_OUTPUT"
@@ -154,168 +130,50 @@ jobs:
          echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
          echo "zip_name=${ZIP_NAME}" >> "$GITHUB_OUTPUT"
          echo "ext_element=${EXT_ELEMENT}" >> "$GITHUB_OUTPUT"
-          echo "manifest=${MANIFEST}" >> "$GITHUB_OUTPUT"

          echo "=== Pre-Release: ${EXT_ELEMENT} ${VERSION}${SUFFIX} ==="

-      - name: Build package
-        run: |
-          SOURCE_DIR="src"
-          [ ! -d "$SOURCE_DIR" ] && SOURCE_DIR="htdocs"
-          if [ ! -d "$SOURCE_DIR" ]; then
-            echo "::error::No src/ or htdocs/ directory"
-            exit 1
-          fi
-
-          MANIFEST="${{ steps.meta.outputs.manifest }}"
-          EXT_TYPE=""
-          if [ -n "$MANIFEST" ]; then
-            EXT_TYPE=$(sed -n 's/.*<extension[^>]*type="\([^"]*\)".*/\1/p' "$MANIFEST" | head -1)
-          fi
-
-          EXCLUDES="sftp-config* .ftpignore *.ppk *.pem *.key .env* *.local .build-trigger"
-
-          mkdir -p build/package
-
-          if [ "$EXT_TYPE" = "package" ] && [ -d "${SOURCE_DIR}/packages" ]; then
-            echo "=== Building Joomla PACKAGE (multi-extension) ==="
-            for ext_dir in "${SOURCE_DIR}"/packages/*/; do
-              [ ! -d "$ext_dir" ] && continue
-              EXT_NAME=$(basename "$ext_dir")
-              echo "  Packaging sub-extension: ${EXT_NAME}"
-              cd "$ext_dir"
-              zip -r "../../build/package/${EXT_NAME}.zip" . -x $EXCLUDES
-              cd "$OLDPWD"
-            done
-            for f in "${SOURCE_DIR}"/*.xml "${SOURCE_DIR}"/*.php; do
-              [ -f "$f" ] && cp "$f" build/package/
-            done
-          else
-            echo "=== Building standard extension ==="
-            rsync -a \
-              --exclude='sftp-config*' \
-              --exclude='.ftpignore' \
-              --exclude='*.ppk' \
-              --exclude='*.pem' \
-              --exclude='*.key' \
-              --exclude='.env*' \
-              --exclude='*.local' \
-              --exclude='.build-trigger' \
-              "${SOURCE_DIR}/" build/package/
-          fi
-
-      - name: Create ZIP
-        id: zip
-        run: |
-          ZIP_NAME="${{ steps.meta.outputs.zip_name }}"
-          cd build/package
-          zip -r "../${ZIP_NAME}" .
-          cd ..
-
-          SHA256=$(sha256sum "${ZIP_NAME}" | cut -d' ' -f1)
-          echo "sha256=${SHA256}" >> "$GITHUB_OUTPUT"
-          echo "ZIP: ${ZIP_NAME} (SHA: ${SHA256:0:16}...)"
-
-      - name: Create or replace Gitea release
+      - name: Create release
        id: release
        run: |
          TAG="${{ steps.meta.outputs.tag }}"
          VERSION="${{ steps.meta.outputs.version }}"
-          STABILITY="${{ steps.meta.outputs.stability }}"
-          SHA256="${{ steps.zip.outputs.sha256 }}"
-          ZIP_NAME="${{ steps.meta.outputs.zip_name }}"
-          EXT_ELEMENT="${{ steps.meta.outputs.ext_element }}"
-          TOKEN="${{ secrets.GA_TOKEN }}"
-          API="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
-          BRANCH=$(git branch --show-current)
+          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+          php ${MOKO_CLI}/release_create.php \
+            --path . --version "$VERSION" --tag "$TAG" \
+            --token "${{ secrets.MOKOGITEA_TOKEN }}" --api-base "$API_BASE" \
+            --repo "${GITEA_REPO}" --branch dev --prerelease

-          BODY="## ${VERSION} ($(date +%Y-%m-%d))
-          **Channel:** ${STABILITY}
-          **SHA-256:** \`${SHA256}\`"
-
-          # Delete existing release
-          EXISTING_ID=$(curl -sS -H "Authorization: token ${TOKEN}" \
-            "${API}/releases/tags/${TAG}" | jq -r '.id // empty' 2>/dev/null)
-          if [ -n "$EXISTING_ID" ]; then
-            curl -sS -X DELETE -H "Authorization: token ${TOKEN}" \
-              "${API}/releases/${EXISTING_ID}" 2>/dev/null || true
-            curl -sS -X DELETE -H "Authorization: token ${TOKEN}" \
-              "${API}/tags/${TAG}" 2>/dev/null || true
-          fi
-
-          # Create release
-          RELEASE_ID=$(curl -sS -X POST -H "Authorization: token ${TOKEN}" \
-            -H "Content-Type: application/json" \
-            "${API}/releases" \
-            -d "$(jq -n \
-              --arg tag "$TAG" \
-              --arg target "$BRANCH" \
-              --arg name "${EXT_ELEMENT} ${VERSION} (${STABILITY})" \
-              --arg body "$BODY" \
-              '{tag_name: $tag, target_commitish: $target, name: $name, body: $body, prerelease: true}'
-            )" | jq -r '.id')
-
-          echo "release_id=${RELEASE_ID}" >> "$GITHUB_OUTPUT"
-
-          # Upload ZIP
-          curl -sS -X POST -H "Authorization: token ${TOKEN}" \
-            -H "Content-Type: application/octet-stream" \
-            "${API}/releases/${RELEASE_ID}/assets?name=${ZIP_NAME}" \
-            --data-binary "@build/${ZIP_NAME}"
-
-          echo "Released: ${EXT_ELEMENT} ${VERSION} (${STABILITY})"
+      - name: Build package and upload
+        id: package
+        run: |
+          VERSION="${{ steps.meta.outputs.version }}"
+          TAG="${{ steps.meta.outputs.tag }}"
+          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+          php ${MOKO_CLI}/release_package.php \
+            --path . --version "$VERSION" --tag "$TAG" \
+            --token "${{ secrets.MOKOGITEA_TOKEN }}" --api-base "$API_BASE" \
+            --repo "${GITEA_REPO}" --output /tmp || true

      - name: Update updates.xml
        if: steps.platform.outputs.platform == 'joomla'
        run: |
-          STABILITY="${{ steps.meta.outputs.stability }}"
          VERSION="${{ steps.meta.outputs.version }}"
-          SHA256="${{ steps.zip.outputs.sha256 }}"
-          ZIP_NAME="${{ steps.meta.outputs.zip_name }}"
-          TAG="${{ steps.meta.outputs.tag }}"
+          STABILITY="${{ steps.meta.outputs.stability }}"
+          SHA256="${{ steps.package.outputs.sha256_zip }}"

          if [ ! -f "updates.xml" ]; then
            echo "No updates.xml -- skipping"
            exit 0
          fi

-          # Map stability to XML tag name
-          case "$STABILITY" in
-            development)        XML_TAG="development" ;;
-            alpha)              XML_TAG="alpha" ;;
-            beta)               XML_TAG="beta" ;;
-            release-candidate)  XML_TAG="rc" ;;
-            *)                  XML_TAG="$STABILITY" ;;
-          esac
+          SHA_FLAG=""
+          [ -n "$SHA256" ] && SHA_FLAG="--sha ${SHA256}"

-          DOWNLOAD_URL="${GITEA_URL}/${GITEA_ORG}/${GITEA_REPO}/releases/download/${TAG}/${ZIP_NAME}"
-
-          # Use PHP to update the channel in updates.xml
-          php -r '
-            $xml_tag = $argv[1];
-            $version = $argv[2];
-            $sha256 = $argv[3];
-            $url = $argv[4];
-            $date = date("Y-m-d");
-
-            $content = file_get_contents("updates.xml");
-            $pattern = "/(<update>(?:(?!<\/update>).)*?<tag>" . preg_quote($xml_tag) . "<\/tag>.*?<\/update>)/s";
-
-            $content = preg_replace_callback($pattern, function($m) use ($version, $sha256, $url, $date) {
-              $block = $m[0];
-              $block = preg_replace("/<version>[^<]*<\/version>/", "<version>{$version}</version>", $block);
-              if (strpos($block, "<sha256>") !== false) {
-                $block = preg_replace("/<sha256>[^<]*<\/sha256>/", "<sha256>{$sha256}</sha256>", $block);
-              } else {
-                $block = str_replace("</downloads>", "</downloads>\n    <sha256>{$sha256}</sha256>", $block);
-              }
-              $block = preg_replace("/(<downloadurl[^>]*>)[^<]*(<\/downloadurl>)/", "\${1}{$url}\${2}", $block);
-              return $block;
-            }, $content);
-
-            file_put_contents("updates.xml", $content);
-            echo "Updated {$xml_tag} channel: version={$version}\n";
-          ' "$XML_TAG" "$VERSION" "$SHA256" "$DOWNLOAD_URL"
+          php ${MOKO_CLI}/updates_xml_build.php \
+            --path . --version "${VERSION}" --stability "${STABILITY}" \
+            --gitea-url "${GITEA_URL}" --org "${GITEA_ORG}" --repo "${GITEA_REPO}" \
+            ${SHA_FLAG}

          # Commit and push
          if ! git diff --quiet updates.xml 2>/dev/null; then
@@ -337,7 +195,7 @@ jobs:
            [ "$BRANCH" = "$CURRENT_BRANCH" ] && continue
            echo "Syncing updates.xml -> ${BRANCH}"
            git fetch origin "${BRANCH}" 2>/dev/null || continue
-            git checkout "origin/${BRANCH}" -- . 2>/dev/null || continue
+            git checkout "origin/${BRANCH}" -- updates.xml 2>/dev/null || continue
            git checkout "${CURRENT_BRANCH}" -- updates.xml
            if ! git diff --quiet updates.xml 2>/dev/null; then
              git add updates.xml
@@ -351,7 +209,7 @@ jobs:
        continue-on-error: true
        run: |
          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
-          TOKEN="${{ secrets.GA_TOKEN }}"
+          TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"

          php ${MOKO_CLI}/release_cascade.php \
            --stability "${{ steps.meta.outputs.stability }}" \
@@ -364,7 +222,7 @@ jobs:
          VERSION="${{ steps.meta.outputs.version }}"
          STABILITY="${{ steps.meta.outputs.stability }}"
          ZIP_NAME="${{ steps.meta.outputs.zip_name }}"
-          SHA256="${{ steps.zip.outputs.sha256 }}"
+          SHA256="${{ steps.package.outputs.sha256_zip }}"
          echo "## Pre-Release Complete" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "| Field | Value |" >> $GITHUB_STEP_SUMMARY
@@ -7,18 +7,14 @@
 #
 # FILE INFORMATION
 # DEFGROUP: Gitea.Workflow
-# INGROUP: MokoStandards.Validation
-# REPO: https://git.mokoconsulting.tech/mokoconsulting-tech/MokoStandards-API
+# INGROUP: moko-platform.Validation
+# REPO: https://git.mokoconsulting.tech/mokoconsulting-tech/moko-platform
 # PATH: /templates/workflows/joomla/repo_health.yml.template
 # VERSION: 04.06.00
 # BRIEF: Enforces repository guardrails by validating release configuration, scripts governance, tooling availability, and core repository health artifacts.
 # ============================================================================

-name: "Joomla: Repo Health"
-
-concurrency:
-  group: repo-health-${{ github.repository }}-${{ github.ref }}
-  cancel-in-progress: true
+name: "Generic: Repo Health"

 defaults:
  run:
@@ -53,7 +49,7 @@ env:
  SCRIPTS_ALLOWED_DIRS: scripts,scripts/fix,scripts/lib,scripts/release,scripts/run,scripts/validate

  # Repo health policy
-  REPO_REQUIRED_ARTIFACTS: README.md,LICENSE,CHANGELOG.md,CONTRIBUTING.md,CODE_OF_CONDUCT.md,.gitea/workflows/
+  REPO_REQUIRED_ARTIFACTS: README.md,LICENSE,CHANGELOG.md,CONTRIBUTING.md,CODE_OF_CONDUCT.md,.mokogitea/workflows/
  REPO_OPTIONAL_FILES: SECURITY.md,GOVERNANCE.md,.editorconfig,.gitattributes,.gitignore,README.md,docs/
  REPO_DISALLOWED_DIRS:
  REPO_DISALLOWED_FILES: TODO.md,todo.md
@@ -64,7 +60,7 @@ env:
  # File / directory variables
  DOCS_INDEX: docs/docs-index.md
  SCRIPT_DIR: scripts
-  WORKFLOWS_DIR: .gitea/workflows
+  WORKFLOWS_DIR: .mokogitea/workflows
  SHELLCHECK_PATTERN: '*.sh'
  SPDX_FILE_GLOBS: '*.sh,*.php,*.js,*.ts,*.css,*.xml,*.yml,*.yaml'
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
@@ -85,7 +81,7 @@ jobs:
      - name: Check actor permission (admin only)
        id: perm
        env:
-          TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
+          TOKEN: ${{ secrets.MOKOGITEA_TOKEN || secrets.MOKOGITEA_TOKEN || github.token }}
          REPO: ${{ github.repository }}
          ACTOR: ${{ github.actor }}
        run: |
@@ -288,7 +284,7 @@ jobs:
            exit 0
          fi

-          IFS=',' read -r -a required_dirs <<< "${SCRIPTS_REQUIRED_DIRS}"
+          if [ -n "${SCRIPTS_REQUIRED_DIRS:-}" ]; then IFS=',' read -r -a required_dirs <<< "${SCRIPTS_REQUIRED_DIRS}"; else required_dirs=(); fi
          IFS=',' read -r -a allowed_dirs <<< "${SCRIPTS_ALLOWED_DIRS}"

          missing_dirs=()
@@ -392,23 +388,27 @@ jobs:
            exit 0
          fi

-          # Source directory: src/ or htdocs/ (either is valid)
+          IFS=',' read -r -a required_artifacts <<< "${REPO_REQUIRED_ARTIFACTS}"
+          IFS=',' read -r -a optional_files <<< "${REPO_OPTIONAL_FILES}"
+          if [ -n "${REPO_DISALLOWED_DIRS:-}" ]; then IFS=',' read -r -a disallowed_dirs <<< "${REPO_DISALLOWED_DIRS}"; else disallowed_dirs=(); fi
+          IFS=',' read -r -a disallowed_files <<< "${REPO_DISALLOWED_FILES:-}"
+
+          missing_required=()
+          missing_optional=()
+
+          # Source directory: src/ or htdocs/ (either is valid for extension repos)
+          SOURCE_DIR=""
          if [ -d "src" ]; then
            SOURCE_DIR="src"
          elif [ -d "htdocs" ]; then
            SOURCE_DIR="htdocs"
+          elif [ -d "deploy" ] || [ -d "cli" ] || [ -d "monitoring" ]; then
+            # Platform/tooling repos don't need src/
+            SOURCE_DIR=""
          else
            missing_required+=("src/ or htdocs/ (source directory required)")
          fi

-          IFS=',' read -r -a required_artifacts <<< "${REPO_REQUIRED_ARTIFACTS}"
-          IFS=',' read -r -a optional_files <<< "${REPO_OPTIONAL_FILES}"
-          IFS=',' read -r -a disallowed_dirs <<< "${REPO_DISALLOWED_DIRS}"
-          IFS=',' read -r -a disallowed_files <<< "${REPO_DISALLOWED_FILES}"
-
-          missing_required=()
-          missing_optional=()
-
          for item in "${required_artifacts[@]}"; do
            if printf '%s' "${item}" | grep -q '/$'; then
              d="${item%/}"
@@ -450,12 +450,8 @@ jobs:
            fi
          done < <(git branch -r --list 'origin/dev*' | sed 's/^ *//')

-          if [ "${#dev_paths[@]}" -eq 0 ]; then
-            missing_required+=("dev/* branch (e.g. dev/01.00.00)")
-          fi
-
-          if [ "${#dev_branches[@]}" -gt 0 ]; then
-            missing_required+=("invalid branch dev (must be dev/<version>)")
+          if [ "${#dev_paths[@]}" -eq 0 ] && [ "${#dev_branches[@]}" -eq 0 ]; then
+            missing_required+=("dev or dev/* branch")
          fi

          content_warnings=()
@@ -481,26 +477,7 @@ jobs:
          export MISSING_OPTIONAL="$(printf '%s\n' "${missing_optional[@]:-}")"
          export CONTENT_WARNINGS="$(printf '%s\n' "${content_warnings[@]:-}")"

-          report_json="$(python3 - <<'PY'
-          import json
-          import os
-
-          profile = os.environ.get('PROFILE_RAW') or 'all'
-
-          missing_required = os.environ.get('MISSING_REQUIRED', '').splitlines() if os.environ.get('MISSING_REQUIRED') else []
-          missing_optional = os.environ.get('MISSING_OPTIONAL', '').splitlines() if os.environ.get('MISSING_OPTIONAL') else []
-          content_warnings = os.environ.get('CONTENT_WARNINGS', '').splitlines() if os.environ.get('CONTENT_WARNINGS') else []
-
-          out = {
-            'profile': profile,
-            'missing_required': [x for x in missing_required if x],
-            'missing_optional': [x for x in missing_optional if x],
-            'content_warnings': [x for x in content_warnings if x],
-          }
-
-          print(json.dumps(out, indent=2))
-          PY
-          )"
+          report_json=$(printf '{"profile":"%s","missing_required":%d,"missing_optional":%d,"content_warnings":%d}'             "$profile" "${#missing_required[@]}" "${#missing_optional[@]}" "${#content_warnings[@]}")

          {
            printf '%s\n' '### Repository health'
@@ -578,12 +555,14 @@ jobs:
            joomla_findings+=("updates.xml missing in root (required for Joomla update server)")
          fi

-          INDEX_DIRS=("${SOURCE_DIR}" "${SOURCE_DIR}/admin" "${SOURCE_DIR}/site")
-          for dir in "${INDEX_DIRS[@]}"; do
-            if [ -d "${dir}" ] && [ ! -f "${dir}/index.html" ]; then
-              joomla_findings+=("${dir}/index.html missing (directory listing protection)")
-            fi
-          done
+          if [ -n "${SOURCE_DIR}" ]; then
+            INDEX_DIRS=("${SOURCE_DIR}" "${SOURCE_DIR}/admin" "${SOURCE_DIR}/site")
+            for dir in "${INDEX_DIRS[@]}"; do
+              if [ -d "${dir}" ] && [ ! -f "${dir}/index.html" ]; then
+                joomla_findings+=("${dir}/index.html missing (directory listing protection)")
+              fi
+            done
+          fi

          if [ "${#joomla_findings[@]}" -gt 0 ]; then
            {
@@ -629,43 +608,29 @@ jobs:
            fi

            if [ -f "${DOCS_INDEX}" ]; then
-              missing_links="$(python3 - <<'PY'
-              import os
-              import re
-
-              idx = os.environ.get('DOCS_INDEX', 'docs/docs-index.md')
-              base = os.getcwd()
-
-              bad = []
-              pat = re.compile(r'\[[^\]]+\]\(([^)]+)\)')
-
-              with open(idx, 'r', encoding='utf-8') as f:
-                for line in f:
-                  for m in pat.findall(line):
-                    link = m.strip()
-                    if link.startswith('http://') or link.startswith('https://') or link.startswith('#') or link.startswith('mailto:'):
-                      continue
-                    if link.startswith('/'):
-                      rel = link.lstrip('/')
-                    else:
-                      rel = os.path.normpath(os.path.join(os.path.dirname(idx), link))
-                    rel = rel.split('#', 1)[0]
-                    rel = rel.split('?', 1)[0]
-                    if not rel:
-                      continue
-                    p = os.path.join(base, rel)
-                    if not os.path.exists(p):
-                      bad.append(rel)
-
-              print('\n'.join(sorted(set(bad))))
-              PY
-              )"
+              missing_links=""
+              while IFS= read -r docline; do
+                for link in $(echo "$docline" | grep -oE '\]\([^)]+\)' | sed 's/\](//' | sed 's/)$//' || true); do
+                  case "$link" in http://*|https://*|"#"*|mailto:*) continue ;; esac
+                  linkpath="${link%%#*}"
+                  linkpath="${linkpath%%\?*}"
+                  [ -z "$linkpath" ] && continue
+                  if [ "${linkpath:0:1}" = "/" ]; then
+                    testpath="${linkpath#/}"
+                  else
+                    testpath="$(dirname "${DOCS_INDEX}")/${linkpath}"
+                  fi
+                  [ ! -e "$testpath" ] && missing_links="${missing_links}${testpath} "
+                done
+              done < "${DOCS_INDEX}"
              if [ -n "${missing_links}" ]; then
                extended_findings+=("docs/docs-index.md contains broken relative links")
                {
                  printf '%s\n' '### Docs index link integrity'
                  printf '%s\n' 'Broken relative links:'
-                  while IFS= read -r l; do [ -n "${l}" ] && printf '%s\n' "- ${l}"; done <<< "${missing_links}"
+                  for bl in ${missing_links}; do
+                    printf '%s\n' "- ${bl}"
+                  done
                  printf '\n'
                } >> "${GITHUB_STEP_SUMMARY}"
              fi
@@ -764,3 +729,41 @@ jobs:
          fi

          printf '%s\n' 'Repository health guardrails passed.' >> "${GITHUB_STEP_SUMMARY}"
+
+
+  site-health:
+    name: Site Health
+    runs-on: ubuntu-latest
+    if: github.event_name == 'workflow_dispatch'
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: '8.3'
+
+      - name: Uptime check
+        if: env.URLS != ''
+        run: |
+          echo "$URLS" > /tmp/urls.txt
+          php monitoring/uptime-probe.php --urls /tmp/urls.txt --timeout 15 || echo "::warning::Some sites are down"
+          rm -f /tmp/urls.txt
+        env:
+          URLS: ${{ vars.MONITORED_URLS }}
+
+      - name: SSL certificate check
+        if: env.DOMAINS != ''
+        run: |
+          echo "$DOMAINS" > /tmp/domains.txt
+          php monitoring/ssl-check.php --domains /tmp/domains.txt --warn-days 30 || echo "::warning::SSL certificates expiring soon"
+          rm -f /tmp/domains.txt
+        env:
+          DOMAINS: ${{ vars.MONITORED_DOMAINS }}
+
+      - name: Summary
+        if: always()
+        run: |
+          echo "### Site Health" >> $GITHUB_STEP_SUMMARY
+          echo "Uptime and SSL checks completed." >> $GITHUB_STEP_SUMMARY
+
@@ -4,8 +4,8 @@
 #
 # FILE INFORMATION
 # DEFGROUP: Gitea.Workflow
-# INGROUP: MokoStandards.Security
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/MokoStandards
+# INGROUP: moko-platform.Security
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
 # PATH: /.gitea/workflows/security-audit.yml
 # VERSION: 01.00.00
 # BRIEF: Dependency vulnerability scanning for composer and npm packages
@@ -80,3 +80,19 @@ jobs:
            -H "Priority: high" \
            -d "Security audit found vulnerabilities. Review dependency updates." \
            "${NTFY_URL}/${NTFY_TOPIC}" || true
+
+
+      - name: Joomla version audit
+        if: always()
+        run: |
+          if [ -f "monitoring/joomla-version-audit.php" ] && [ -n "$JOOMLA_SITES" ]; then
+            echo "$JOOMLA_SITES" > /tmp/sites.json
+            php monitoring/joomla-version-audit.php --sites /tmp/sites.json || true
+            echo "### Joomla Version Audit" >> $GITHUB_STEP_SUMMARY
+            rm -f /tmp/sites.json
+          else
+            echo "Joomla audit skipped (no script or JOOMLA_SITES_JSON not configured)"
+          fi
+        env:
+          JOOMLA_SITES: ${{ vars.JOOMLA_SITES_JSON }}
+
@@ -4,20 +4,18 @@
 #
 # FILE INFORMATION
 # DEFGROUP: Gitea.Workflow
-# INGROUP: MokoStandards.Joomla
-# REPO: https://git.mokoconsulting.tech/mokoconsulting-tech/MokoStandards-API
-# PATH: /templates/workflows/joomla/update-server.yml.template
-# VERSION: 04.06.00
-# BRIEF: Update Joomla update server XML feed with stable/rc/dev entries
+# INGROUP: moko-platform.Universal
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
+# PATH: /templates/workflows/update-server.yml
+# VERSION: 05.00.00
+# BRIEF: Pre-release build + update server XML for dev/alpha/beta/rc branches
 #
-# Writes updates.xml with multiple <update> entries:
-#   - <tag>stable</tag>     on push to main (from auto-release)
-#   - <tag>rc</tag>         on push to rc/**
-#   - <tag>development</tag> on push to dev or dev/**
+# Thin wrapper around moko-platform CLI tools.
+# Builds packages, updates updates.xml, and optionally deploys via SFTP.
 #
-# Joomla filters by user's "Minimum Stability" setting.
+# Joomla filters update entries by the user's "Minimum Stability" setting.

-name: "Joomla: Update Server"
+name: "Update Server"

 on:
  push:
@@ -66,55 +64,60 @@ permissions:

 jobs:
  update-xml:
-    name: Update updates.xml
+    name: Update Server
    runs-on: release
    if: >-
      github.event.pull_request.merged == true || github.event_name == 'workflow_dispatch' || github.event_name == 'push'

    steps:
      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@v4
        with:
-          token: ${{ secrets.GA_TOKEN }}
+          token: ${{ secrets.MOKOGITEA_TOKEN }}
          fetch-depth: 0

-      - name: Setup MokoStandards tools
+      - name: Setup moko-platform tools
        env:
-          MOKO_CLONE_TOKEN: ${{ secrets.GA_TOKEN }}
+          MOKO_CLONE_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
          MOKO_CLONE_HOST: git.mokoconsulting.tech/MokoConsulting
-          COMPOSER_AUTH: '{"http-basic":{"git.mokoconsulting.tech":{"username":"token","password":"${{ secrets.GA_TOKEN }}"}}}'
+          COMPOSER_AUTH: '{"http-basic":{"git.mokoconsulting.tech":{"username":"token","password":"${{ secrets.MOKOGITEA_TOKEN }}"}}}'
        run: |
          if ! command -v composer &> /dev/null; then
            sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer >/dev/null 2>&1
          fi
+          # Always fetch latest CLI tools — never use stale cache from previous runs
+          rm -rf /tmp/moko-platform
          git clone --depth 1 --branch main --quiet \
-            "https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/MokoStandards-API.git" \
-            /tmp/mokostandards-api 2>/dev/null || true
-          if [ -d "/tmp/mokostandards-api" ] && [ -f "/tmp/mokostandards-api/composer.json" ]; then
-            cd /tmp/mokostandards-api && composer install --no-dev --no-interaction --quiet 2>/dev/null || true
+            "https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/moko-platform.git" \
+            /tmp/moko-platform 2>/dev/null || true
+          if [ -d "/tmp/moko-platform" ] && [ -f "/tmp/moko-platform/composer.json" ]; then
+            cd /tmp/moko-platform && composer install --no-dev --no-interaction --quiet 2>/dev/null || true
          fi
+          echo "MOKO_CLI=/tmp/moko-platform/cli" >> "$GITHUB_ENV"

-      - name: Generate updates.xml entry
-        id: update
+      - name: Detect platform
+        id: platform
+        run: php ${MOKO_CLI}/manifest_read.php --path . --github-output
+
+      - name: Resolve stability and bump version
+        id: meta
        run: |
          BRANCH="${{ github.ref_name }}"
-          REPO="${{ github.repository }}"
-          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
-          VERSION=$(php /tmp/mokostandards-api/cli/version_read.php --path . 2>/dev/null || echo "0.0.0")

-          # Auto-bump patch on all branches (dev, alpha, beta, rc)
+          # Configure git for bot pushes
          git config --local user.email "gitea-actions[bot]@mokoconsulting.tech"
          git config --local user.name "gitea-actions[bot]"
-          BUMPED=$(php /tmp/mokostandards-api/cli/version_bump.php --path . 2>/dev/null || true)
-          if [ -n "$BUMPED" ]; then
-            VERSION=$(php /tmp/mokostandards-api/cli/version_read.php --path . 2>/dev/null || echo "$VERSION")
-            git add -A
-            git commit -m "chore(version): auto-bump patch ${VERSION} [skip ci]" \
-              --author="gitea-actions[bot] <gitea-actions[bot]@mokoconsulting.tech>" 2>/dev/null || true
-            git push 2>/dev/null || true
-          fi
+          git remote set-url origin "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"

-          # Determine stability from branch or input
+          # Auto-bump patch version
+          php ${MOKO_CLI}/version_bump.php --path . 2>/dev/null || true
+
+          VERSION=$(php ${MOKO_CLI}/version_read.php --path . 2>/dev/null || echo "0.0.0")
+
+          # Strip any existing suffix before applying stability
+          VERSION=$(echo "$VERSION" | sed 's/-\(dev\|alpha\|beta\|rc\)$//')
+
+          # Determine stability from branch or manual input
          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            STABILITY="${{ inputs.stability }}"
          elif [[ "$BRANCH" == rc/* ]]; then
@@ -123,277 +126,122 @@ jobs:
            STABILITY="beta"
          elif [[ "$BRANCH" == alpha/* ]]; then
            STABILITY="alpha"
-          elif [[ "$BRANCH" == dev/* ]] || [[ "$BRANCH" == "dev" ]]; then
+          else
            STABILITY="development"
-          else
-            STABILITY="stable"
          fi

+          # Version suffix per stability stream
+          case "$STABILITY" in
+            development) SUFFIX="-dev";  TAG="development" ;;
+            alpha)       SUFFIX="-alpha"; TAG="alpha" ;;
+            beta)        SUFFIX="-beta";  TAG="beta" ;;
+            rc)          SUFFIX="-rc";    TAG="release-candidate" ;;
+            *)           SUFFIX="";       TAG="stable" ;;
+          esac
+
+          # Propagate version with stability suffix to all manifest files
+          php ${MOKO_CLI}/version_set_platform.php \
+            --path . --version "$VERSION" --branch "$BRANCH" --stability "$STABILITY" 2>/dev/null || true
+          php ${MOKO_CLI}/version_check.php --path . --fix 2>/dev/null || true
+
+          # Re-read version (now includes suffix from version_set_platform)
+          if [ -n "$SUFFIX" ]; then
+            VERSION="${VERSION}${SUFFIX}"
+          fi
+
+          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
          echo "stability=${STABILITY}" >> "$GITHUB_OUTPUT"
+          echo "suffix=${SUFFIX}" >> "$GITHUB_OUTPUT"
+          echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
+          echo "display_version=${VERSION}" >> "$GITHUB_OUTPUT"

-          # Parse manifest (portable — no grep -P)
-          MANIFEST=$(find . -maxdepth 3 -name "*.xml" ! -path "./.git/*" ! -path "./build/*" -exec grep -l '<extension' {} \; 2>/dev/null | head -1)
-          if [ -z "$MANIFEST" ]; then
-            echo "No Joomla manifest found — skipping"
-            exit 0
-          fi
-
-          # Extract fields using sed (works on all runners)
-          EXT_NAME=$(sed -n 's/.*<name>\([^<]*\)<\/name>.*/\1/p' "$MANIFEST" | head -1)
-          EXT_TYPE=$(sed -n 's/.*<extension[^>]*type="\([^"]*\)".*/\1/p' "$MANIFEST" | head -1)
-          EXT_ELEMENT=$(sed -n 's/.*<element>\([^<]*\)<\/element>.*/\1/p' "$MANIFEST" | head -1)
-          EXT_CLIENT=$(sed -n 's/.*<extension[^>]*client="\([^"]*\)".*/\1/p' "$MANIFEST" | head -1)
-          EXT_FOLDER=$(sed -n 's/.*<extension[^>]*group="\([^"]*\)".*/\1/p' "$MANIFEST" | head -1)
-          EXT_VERSION=$(sed -n 's/.*<version>\([^<]*\)<\/version>.*/\1/p' "$MANIFEST" | head -1)
-          TARGET_PLATFORM=$(sed -n 's/.*\(<targetplatform[^/]*\/>\).*/\1/p' "$MANIFEST" | head -1)
-          PHP_MINIMUM=$(sed -n 's/.*<php_minimum>\([^<]*\)<\/php_minimum>.*/\1/p' "$MANIFEST" | head -1)
-
-          # Fallbacks
-          [ -z "$EXT_NAME" ] && EXT_NAME="${{ github.event.repository.name }}"
-          [ -z "$EXT_TYPE" ] && EXT_TYPE="component"
-
-          # Derive element if not in manifest: try XML filename, then repo name
-          if [ -z "$EXT_ELEMENT" ]; then
-            EXT_ELEMENT=$(basename "$MANIFEST" .xml | tr '[:upper:]' '[:lower:]')
-            case "$EXT_ELEMENT" in
-              templatedetails|manifest|*.xml) EXT_ELEMENT=$(echo "${{ github.event.repository.name }}" | tr '[:upper:]' '[:lower:]' | tr -d ' -') ;;
-            esac
-          fi
-
-          # Use manifest version if README version is empty
-          [ "$VERSION" = "0.0.0" ] && [ -n "$EXT_VERSION" ] && VERSION="$EXT_VERSION"
-
-          [ -z "$TARGET_PLATFORM" ] && TARGET_PLATFORM=$(printf '<targetplatform name="joomla" version="((5.[0-9])|(6.[0-9]))" %s>' "/")
-
-          CLIENT_TAG=""
-          [ -n "$EXT_CLIENT" ] && CLIENT_TAG="<client>${EXT_CLIENT}</client>"
-          [ -z "$CLIENT_TAG" ] && ([ "$EXT_TYPE" = "module" ] || [ "$EXT_TYPE" = "plugin" ]) && CLIENT_TAG="<client>site</client>"
-
-          FOLDER_TAG=""
-          [ -n "$EXT_FOLDER" ] && [ "$EXT_TYPE" = "plugin" ] && FOLDER_TAG="<folder>${EXT_FOLDER}</folder>"
-
-          PHP_TAG=""
-          [ -n "$PHP_MINIMUM" ] && PHP_TAG="<php_minimum>${PHP_MINIMUM}</php_minimum>"
-
-          # Version suffix for non-stable
-          DISPLAY_VERSION="$VERSION"
-          case "$STABILITY" in
-            development) DISPLAY_VERSION="${VERSION}-dev" ;;
-            alpha)       DISPLAY_VERSION="${VERSION}-alpha" ;;
-            beta)        DISPLAY_VERSION="${VERSION}-beta" ;;
-            rc)          DISPLAY_VERSION="${VERSION}-rc" ;;
-          esac
-
-          MAJOR=$(echo "$VERSION" | awk -F. '{print $1}')
-
-          # Each stability level has its own release tag
-          case "$STABILITY" in
-            development) RELEASE_TAG="development" ;;
-            alpha)       RELEASE_TAG="alpha" ;;
-            beta)        RELEASE_TAG="beta" ;;
-            rc)          RELEASE_TAG="release-candidate" ;;
-            *)           RELEASE_TAG="v${MAJOR}" ;;
-          esac
-
-          PACKAGE_NAME="${EXT_ELEMENT}-${DISPLAY_VERSION}.zip"
-          DOWNLOAD_URL="${GITEA_URL}/${GITEA_ORG}/${GITEA_REPO}/releases/download/${RELEASE_TAG}/${PACKAGE_NAME}"
-          INFO_URL="${GITEA_URL}/${GITEA_ORG}/${GITEA_REPO}"
-
-          # -- Build install packages (ZIP + tar.gz) --------------------
-          SOURCE_DIR="src"
-          [ ! -d "$SOURCE_DIR" ] && SOURCE_DIR="htdocs"
-          if [ -d "$SOURCE_DIR" ]; then
-            EXCLUDES=".ftpignore sftp-config* *.ppk *.pem *.key .env*"
-            TAR_NAME="${EXT_ELEMENT}-${DISPLAY_VERSION}.tar.gz"
-
-            cd "$SOURCE_DIR"
-            zip -r "/tmp/${PACKAGE_NAME}" . -x $EXCLUDES
-            cd ..
-            tar -czf "/tmp/${TAR_NAME}" -C "$SOURCE_DIR" \
-              --exclude='.ftpignore' --exclude='sftp-config*' \
-              --exclude='*.ppk' --exclude='*.pem' --exclude='*.key' --exclude='.env*' .
-
-            SHA256=$(sha256sum "/tmp/${PACKAGE_NAME}" | cut -d' ' -f1)
-
-            # Ensure release exists on Gitea
-            RELEASE_JSON=$(curl -sf -H "Authorization: token ${{ secrets.GA_TOKEN }}" \
-              "${API_BASE}/releases/tags/${RELEASE_TAG}" 2>/dev/null || true)
-            RELEASE_ID=$(echo "$RELEASE_JSON" | python3 -c "import sys,json; print(json.load(sys.stdin).get('id',''))" 2>/dev/null || true)
-
-            if [ -z "$RELEASE_ID" ]; then
-              # Create release
-              RELEASE_JSON=$(curl -sf -X POST -H "Authorization: token ${{ secrets.GA_TOKEN }}" \
-                -H "Content-Type: application/json" \
-                "${API_BASE}/releases" \
-                -d "$(python3 -c "import json; print(json.dumps({
-                  'tag_name': '${RELEASE_TAG}',
-                  'name': '${RELEASE_TAG} (${DISPLAY_VERSION})',
-                  'body': '${STABILITY} release',
-                  'prerelease': True,
-                  'target_commitish': 'main'
-                }))")" 2>/dev/null || true)
-              RELEASE_ID=$(echo "$RELEASE_JSON" | python3 -c "import sys,json; print(json.load(sys.stdin).get('id',''))" 2>/dev/null || true)
-            fi
-
-            if [ -n "$RELEASE_ID" ]; then
-              # Delete existing assets with same name before uploading
-              ASSETS=$(curl -sf -H "Authorization: token ${{ secrets.GA_TOKEN }}" \
-                "${API_BASE}/releases/${RELEASE_ID}/assets" 2>/dev/null || echo "[]")
-              for ASSET_FILE in "$PACKAGE_NAME" "$TAR_NAME"; do
-                ASSET_ID=$(echo "$ASSETS" | python3 -c "
-          import sys,json
-          assets = json.load(sys.stdin)
-          for a in assets:
-              if a['name'] == '${ASSET_FILE}':
-                  print(a['id']); break
-          " 2>/dev/null || true)
-                if [ -n "$ASSET_ID" ]; then
-                  curl -sf -X DELETE -H "Authorization: token ${{ secrets.GA_TOKEN }}" \
-                    "${API_BASE}/releases/${RELEASE_ID}/assets/${ASSET_ID}" 2>/dev/null || true
-                fi
-              done
-
-              # Upload both formats
-              curl -sf -X POST -H "Authorization: token ${{ secrets.GA_TOKEN }}" \
-                -H "Content-Type: application/octet-stream" \
-                --data-binary @"/tmp/${PACKAGE_NAME}" \
-                "${API_BASE}/releases/${RELEASE_ID}/assets?name=${PACKAGE_NAME}" > /dev/null 2>&1 || true
-
-              curl -sf -X POST -H "Authorization: token ${{ secrets.GA_TOKEN }}" \
-                -H "Content-Type: application/octet-stream" \
-                --data-binary @"/tmp/${TAR_NAME}" \
-                "${API_BASE}/releases/${RELEASE_ID}/assets?name=${TAR_NAME}" > /dev/null 2>&1 || true
-            fi
-
-            echo "Packages: ${PACKAGE_NAME} + ${TAR_NAME} (SHA: ${SHA256})" >> $GITHUB_STEP_SUMMARY
-          else
-            SHA256=""
-          fi
-
-          # -- Build the new entry (canonical format matching release.yml) --
-          NEW_ENTRY=""
-          NEW_ENTRY="${NEW_ENTRY}  <update>\n"
-          NEW_ENTRY="${NEW_ENTRY}    <name>${EXT_NAME}</name>\n"
-          NEW_ENTRY="${NEW_ENTRY}    <description>${EXT_NAME} ${STABILITY} build.</description>\n"
-          NEW_ENTRY="${NEW_ENTRY}    <element>${EXT_ELEMENT}</element>\n"
-          NEW_ENTRY="${NEW_ENTRY}    <type>${EXT_TYPE}</type>\n"
-          [ -n "$CLIENT_TAG" ] && NEW_ENTRY="${NEW_ENTRY}    ${CLIENT_TAG}\n"
-          [ -n "$FOLDER_TAG" ] && NEW_ENTRY="${NEW_ENTRY}    ${FOLDER_TAG}\n"
-          NEW_ENTRY="${NEW_ENTRY}    <version>${VERSION}</version>\n"
-          NEW_ENTRY="${NEW_ENTRY}    <creationDate>$(date +%Y-%m-%d)</creationDate>\n"
-          NEW_ENTRY="${NEW_ENTRY}    <infourl title='${EXT_NAME}'>https://git.mokoconsulting.tech/${GITEA_ORG}/${GITEA_REPO}/releases/tag/${RELEASE_TAG}</infourl>\n"
-          NEW_ENTRY="${NEW_ENTRY}    <downloads>\n"
-          NEW_ENTRY="${NEW_ENTRY}      <downloadurl type='full' format='zip'>${DOWNLOAD_URL}</downloadurl>\n"
-          NEW_ENTRY="${NEW_ENTRY}    </downloads>\n"
-          [ -n "$SHA256" ] && NEW_ENTRY="${NEW_ENTRY}    <sha256>${SHA256}</sha256>\n"
-          NEW_ENTRY="${NEW_ENTRY}    <tags><tag>${STABILITY}</tag></tags>\n"
-          NEW_ENTRY="${NEW_ENTRY}    <maintainer>Moko Consulting</maintainer>\n"
-          NEW_ENTRY="${NEW_ENTRY}    <maintainerurl>https://mokoconsulting.tech</maintainerurl>\n"
-          NEW_ENTRY="${NEW_ENTRY}    <targetplatform name='joomla' version='(5|6).*'/>\n"
-          [ -n "$PHP_MINIMUM" ] && NEW_ENTRY="${NEW_ENTRY}    <php_minimum>${PHP_MINIMUM}</php_minimum>\n"
-          NEW_ENTRY="${NEW_ENTRY}  </update>"
-
-          # -- Write new entry to temp file --------------------------------
-          printf '%b' "$NEW_ENTRY" > /tmp/new_entry.xml
-
-          # -- Merge into updates.xml ----------------------------------------
-          # Cascade: stable→all | rc→rc+lower | beta→beta+lower | alpha→alpha+dev | dev→dev
-          CASCADE_MAP="stable:development,alpha,beta,rc,stable rc:development,alpha,beta,rc beta:development,alpha,beta alpha:development,alpha development:development"
-          TARGETS=""
-          for entry in $CASCADE_MAP; do
-            key="${entry%%:*}"
-            vals="${entry#*:}"
-            if [ "$key" = "${STABILITY}" ]; then
-              TARGETS="$vals"
-              break
-            fi
-          done
-          [ -z "$TARGETS" ] && TARGETS="${STABILITY}"
-
-          echo "Cascade: ${STABILITY} → ${TARGETS}"
-
-          # Create updates.xml if missing
-          if [ ! -f "updates.xml" ]; then
-            printf '%s\n' "<?xml version='1.0' encoding='UTF-8'?>" > updates.xml
-            printf '%s\n' "<!-- Copyright (C) $(date +%Y) Moko Consulting -->" >> updates.xml
-            printf '%s\n' "<updates>" >> updates.xml
-            printf '%s\n' "</updates>" >> updates.xml
-          fi
-
-          # Update existing blocks or create missing ones
-          export PY_TARGETS="$TARGETS" PY_VERSION="$VERSION" PY_DATE="$(date +%Y-%m-%d)"
-          python3 << 'PYEOF'
-          import re, os
-
-          targets = os.environ["PY_TARGETS"].split(",")
-          version = os.environ["PY_VERSION"]
-          date = os.environ["PY_DATE"]
-
-          with open("updates.xml") as f:
-              content = f.read()
-          with open("/tmp/new_entry.xml") as f:
-              new_entry_template = f.read()
-
-          for tag in targets:
-              tag = tag.strip()
-              # Build entry with this tag's name
-              new_entry = re.sub(r"<tag>[^<]*</tag>", f"<tag>{tag}</tag>", new_entry_template)
-
-              # Try to find existing block (handles both single-line and multi-line <tags>)
-              block_pattern = r"(<update>(?:(?!</update>).)*?<tag>" + re.escape(tag) + r"</tag>.*?</update>)"
-              match = re.search(block_pattern, content, re.DOTALL)
-
-              if match:
-                  # Update in place — replace entire block
-                  content = content.replace(match.group(1), new_entry.strip())
-                  print(f"  UPDATED: <tag>{tag}</tag> → {version}")
-              else:
-                  # Create — insert before </updates>
-                  content = content.replace("</updates>", "\n" + new_entry.strip() + "\n\n</updates>")
-                  print(f"  CREATED: <tag>{tag}</tag> → {version}")
-
-          # Clean up excessive blank lines
-          content = re.sub(r"\n{3,}", "\n\n", content)
-
-          with open("updates.xml", "w") as f:
-              f.write(content)
-          PYEOF
-
-          # Commit
-          git config --local user.email "gitea-actions[bot]@mokoconsulting.tech"
-          git config --local user.name "gitea-actions[bot]"
-          git add updates.xml
+          # Commit version bump if changed
+          git add -A
          git diff --cached --quiet || {
-            git commit -m "chore: update updates.xml (${STABILITY}: ${DISPLAY_VERSION}) [skip ci]" \
+            git commit -m "chore(version): auto-bump ${VERSION} [skip ci]" \
              --author="gitea-actions[bot] <gitea-actions[bot]@mokoconsulting.tech>"
            git push
          }

-      # -- Sync updates.xml to main (for non-main branches) ----------------------
+      - name: Create release and upload package
+        id: package
+        run: |
+          VERSION="${{ steps.meta.outputs.version }}"
+          TAG="${{ steps.meta.outputs.tag }}"
+          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+
+          # Create or update Gitea release
+          php ${MOKO_CLI}/release_create.php \
+            --path . --version "$VERSION" --tag "$TAG" \
+            --token "${{ secrets.MOKOGITEA_TOKEN }}" --api-base "$API_BASE" \
+            --repo "${GITEA_REPO}" --branch "${{ github.ref_name }}" --prerelease
+
+          # Build package and upload
+          php ${MOKO_CLI}/release_package.php \
+            --path . --version "$VERSION" --tag "$TAG" \
+            --token "${{ secrets.MOKOGITEA_TOKEN }}" --api-base "$API_BASE" \
+            --repo "${GITEA_REPO}" --output /tmp || true
+
+      - name: Update updates.xml
+        if: steps.platform.outputs.platform == 'joomla'
+        run: |
+          VERSION="${{ steps.meta.outputs.version }}"
+          STABILITY="${{ steps.meta.outputs.stability }}"
+          SHA256="${{ steps.package.outputs.sha256_zip }}"
+
+          if [ ! -f "updates.xml" ]; then
+            echo "No updates.xml — skipping"
+            exit 0
+          fi
+
+          SHA_FLAG=""
+          [ -n "$SHA256" ] && SHA_FLAG="--sha ${SHA256}"
+
+          php ${MOKO_CLI}/updates_xml_build.php \
+            --path . --version "${VERSION}" --stability "${STABILITY}" \
+            --gitea-url "${GITEA_URL}" --org "${GITEA_ORG}" --repo "${GITEA_REPO}" \
+            ${SHA_FLAG}
+
+          # Commit and push updates.xml
+          git add updates.xml
+          git diff --cached --quiet || {
+            git commit -m "chore: update ${STABILITY} channel ${VERSION} [skip ci]"
+            git push
+          }
+
      - name: Sync updates.xml to main
-        if: github.ref_name != 'main'
+        if: github.ref_name != 'main' && steps.platform.outputs.platform == 'joomla'
        run: |
          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
-          GA_TOKEN="${{ secrets.GA_TOKEN }}"
+          GITEA_TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"

-          FILE_SHA=$(curl -sf -H "Authorization: token ${GA_TOKEN}" \
+          FILE_SHA=$(curl -sf -H "Authorization: token ${GITEA_TOKEN}" \
            "${API_BASE}/contents/updates.xml?ref=main" | python3 -c "import sys,json; print(json.load(sys.stdin).get('sha',''))" 2>/dev/null || true)

          if [ -n "$FILE_SHA" ] && [ -f "updates.xml" ]; then
-            CONTENT=$(base64 -w0 updates.xml)
-            curl -sf -X PUT -H "Authorization: token ${GA_TOKEN}" \
-              -H "Content-Type: application/json" \
-              "${API_BASE}/contents/updates.xml" \
-              -d "$(python3 -c "import json; print(json.dumps({
-                'content': '${CONTENT}',
-                'sha': '${FILE_SHA}',
-                'message': 'chore: sync updates.xml from ${STABILITY} [skip ci]',
-                'branch': 'main'
-              }))")" > /dev/null 2>&1 \
-              && echo "updates.xml synced to main (${STABILITY})" >> $GITHUB_STEP_SUMMARY \
-              || echo "WARNING: failed to sync updates.xml to main" >> $GITHUB_STEP_SUMMARY
-          else
-            echo "WARNING: could not get updates.xml SHA from main" >> $GITHUB_STEP_SUMMARY
+            python3 -c "
+          import base64, json, urllib.request, sys
+          with open('updates.xml', 'rb') as f:
+              content = base64.b64encode(f.read()).decode()
+          payload = json.dumps({
+              'content': content,
+              'sha': '${FILE_SHA}',
+              'message': 'chore: sync updates.xml from ${{ steps.meta.outputs.stability }} [skip ci]',
+              'branch': 'main'
+          }).encode()
+          req = urllib.request.Request(
+              '${API_BASE}/contents/updates.xml',
+              data=payload, method='PUT',
+              headers={
+                  'Authorization': 'token ${GITEA_TOKEN}',
+                  'Content-Type': 'application/json'
+              })
+          try:
+              urllib.request.urlopen(req)
+              print('updates.xml synced to main')
+          except Exception as e:
+              print(f'WARNING: sync to main failed: {e}', file=sys.stderr)
+          "
          fi

      - name: SFTP deploy to dev server
@@ -407,12 +255,11 @@ jobs:
          DEV_KEY: ${{ secrets.DEV_FTP_KEY }}
          DEV_PASS: ${{ secrets.DEV_FTP_PASSWORD }}
        run: |
-          # -- Permission check: admin or maintain role required --------
+          # Permission check: admin or maintain role required
          ACTOR="${{ github.actor }}"
-          REPO="${{ github.repository }}"
          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"

-          PERMISSION=$(curl -sf -H "Authorization: token ${{ secrets.GA_TOKEN }}" \
+          PERMISSION=$(curl -sf -H "Authorization: token ${{ secrets.MOKOGITEA_TOKEN }}" \
            "${API_BASE}/collaborators/${ACTOR}/permission" 2>/dev/null | \
            python3 -c "import sys,json; print(json.load(sys.stdin).get('permission','read'))" 2>/dev/null || echo "read")
          case "$PERMISSION" in
@@ -442,11 +289,11 @@ jobs:
            printf ',"password":"%s"}' "$DEV_PASS" >> /tmp/sftp-config.json
          fi

-          PLATFORM=$(php /tmp/mokostandards-api/cli/platform_detect.php --path . 2>/dev/null || true)
-          if [ "$PLATFORM" = "waas-component" ] && [ -f "/tmp/mokostandards-api/deploy/deploy-joomla.php" ]; then
-            php /tmp/mokostandards-api/deploy/deploy-joomla.php --path . --src-dir "$SOURCE_DIR" --config /tmp/sftp-config.json
-          elif [ -f "/tmp/mokostandards-api/deploy/deploy-sftp.php" ]; then
-            php /tmp/mokostandards-api/deploy/deploy-sftp.php --path . --src-dir "$SOURCE_DIR" --config /tmp/sftp-config.json
+          PLATFORM=$(php ${MOKO_CLI}/platform_detect.php --path . 2>/dev/null || true)
+          if [ "$PLATFORM" = "waas-component" ] && [ -f "${MOKO_CLI}/../deploy/deploy-joomla.php" ]; then
+            php ${MOKO_CLI}/../deploy/deploy-joomla.php --path . --src-dir "$SOURCE_DIR" --config /tmp/sftp-config.json
+          elif [ -f "${MOKO_CLI}/../deploy/deploy-sftp.php" ]; then
+            php ${MOKO_CLI}/../deploy/deploy-sftp.php --path . --src-dir "$SOURCE_DIR" --config /tmp/sftp-config.json
          fi
          rm -f /tmp/deploy_key /tmp/sftp-config.json
          echo "SFTP deploy to dev complete" >> $GITHUB_STEP_SUMMARY
@@ -454,11 +301,12 @@ jobs:
      - name: Summary
        if: always()
        run: |
-          echo "## Joomla Update Server" >> $GITHUB_STEP_SUMMARY
+          VERSION="${{ steps.meta.outputs.version }}"
+          STABILITY="${{ steps.meta.outputs.stability }}"
+          DISPLAY="${{ steps.meta.outputs.display_version }}"
+          echo "## Update Server" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "| Field | Value |" >> $GITHUB_STEP_SUMMARY
          echo "|-------|-------|" >> $GITHUB_STEP_SUMMARY
          echo "| Stability | \`${STABILITY}\` |" >> $GITHUB_STEP_SUMMARY
-          echo "| Version | \`${DISPLAY_VERSION}\` |" >> $GITHUB_STEP_SUMMARY
-          echo "| Element | \`${EXT_ELEMENT}\` |" >> $GITHUB_STEP_SUMMARY
-          echo "| Download | [ZIP](${DOWNLOAD_URL}) |" >> $GITHUB_STEP_SUMMARY
+          echo "| Version | \`${DISPLAY}\` |" >> $GITHUB_STEP_SUMMARY
@@ -14,386 +14,65 @@
 INGROUP: MokoWaaS.Documentation
 REPO: https://github.com/mokoconsulting-tech/mokowaas
 PATH: ./CHANGELOG.md
- VERSION: 02.01.08
+ VERSION: 02.26.01
 BRIEF: Version history using `Keep a Changelog`
 -->

 # Changelog
+## [Unreleased]
+### Added
+- API endpoint `POST /api/index.php/v1/mokowaas/install` — install extensions from a remote ZIP URL
+- Demo Mode with configurable warning banner on frontend when enabled
+- `DemoResetService` — baseline snapshot and restore for DB tables + media files
+- API endpoints `POST /?mokowaas=reset` and `POST /?mokowaas=snapshot` (query-string)
+- REST endpoints `POST /api/v1/mokowaas/reset` and `GET/POST /api/v1/mokowaas/snapshot`
+- `plg_task_mokowaasdemo` — Joomla Scheduled Task plugin for automatic demo site reset
+- Admin toggles: Take Snapshot Now and Restore Baseline Now in plugin config
+- Content Sync: one-way push of articles, categories, menus, and modules to remote MokoWaaS sites
+- Content Sync: API endpoints `POST /?mokowaas=sync` (sender) and `POST /?mokowaas=sync-receive` (receiver)
+- Content Sync: REST endpoints `POST /api/v1/mokowaas/sync` and `POST /api/v1/mokowaas/sync-receive`
+- Content Sync: configurable sync targets with URL + API token in plugin settings
+- Package installer: protect all MokoWaaS extensions (not just system plugin) and ensure update server stays enabled
+- Package installer: clean up legacy `mokowaasbrand` extension entries and files on install/update
+- API endpoint `GET /?mokowaas=extensions` and `GET /api/v1/mokowaas/extensions` — list installed extensions with version, status, and update server info
+
+## [02.20.00] --- 2026-05-28
+
+## [02.20.00] --- 2026-05-28
+
+## [02.19.00] --- 2026-05-28
+
+## [02.18.00] --- 2026-05-28
+

 All notable changes to the MokoWaaS plugin will be documented in this file.

 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

-## [Unreleased]
+## [02.17.00] --- 2026-05-28
+
+### Changed
+- Migrated all workflow and template paths from `.github/` to `.mokogitea/`
+- Template source paths updated: `templates/gitea/` to `templates/mokogitea/`
+- HCL definition files removed -- Template repos are now the canonical source
+
+### Added
+- `branch-cleanup.yml`: auto-delete merged feature branches after PR merge
+- `plg_webservices_perfectpublisher`: REST API for Perfect Publisher (com_autotweet) — channels, posts, requests, rules, feeds, and stats

 ### Planned
 - License/subscription check
 - System email template branding (DB approach)

-## [02.06.00] - 2026-05-25
-
 ### Added
- Alias offline bypass: aliases with offline=No override Joomla's global offline setting, allowing access via alias domain while main site is down
+- Trusted IPs: configurable repeatable rows of IP addresses, CIDR ranges, and wildcards that bypass admin session timeout
+- Supports exact IPs (192.168.1.100), CIDR (10.0.0.0/24), and wildcards (192.168.1.*)
+- Each entry has a label and enabled toggle for easy management
+- Current IP display above trusted IPs table so admins can easily add their own IP

 ### Fixed
- Install API endpoint: extract ZIP to temp directory before passing to Joomla Installer (was passing ZIP path directly)
- Clean up extracted temp directory on success or failure
-
-### Changed
- CI: auto-release uses stream tag `stable` instead of version tag `vXX`
-
-## [02.05.00] - 2026-05-24
-
-### Added
- Joomla `protected=1` flag on all MokoWaaS extensions (framework-level disable/uninstall prevention)
- Self-healing protected flag — restored each admin session if cleared
- Block non-master disable via plugin list toggle (`plugins.publish`)
- Package script sets `protected=1, locked=0` on every install/update
- Legacy plugin entry in updates.xml for sites upgrading from standalone plugin
-
-### Fixed
- CI: auto-release workflow `pkg_pkg_` duplication in release names, ZIP filenames, and SHA256 paths
- CI: auto-release now strips existing type prefix and uses `<packagename>` for packages
- CI: `updates_xml_build` was cascading entries for all lower channels on stable release — now writes only current channel
- CI: `targetplatform` regex `((5.[0-9])|(6.[0-9]))` caused Gitea 500 on XML render — simplified to `(5|6)\..*`
- updates.xml stable entry now has correct `<tag>stable</tag>` and download URL
- README slimmed to overview, detailed content moved to wiki
-
-## [02.03.10] - 2026-05-24
-
-### Added
- Canonical URL injection for alias domains (prevents SEO duplication)
- Primary Domain config field in Site Aliases tab
- Heartbeat registration for alias domains (each alias gets Grafana datasource)
- Plugin protection: hidden from non-master users, disable/uninstall blocked
- Dynamic plugin version read from manifest XML (no more hardcoded strings)
- Package structure: `pkg_mokowaas` with system plugin, webservices plugin, and component
-
-### Changed
- Alias offline mode uses Joomla's native template offline.php (not custom HTML)
- Alias detection simplified: direct lookup in aliases list (no primary host comparison)
- handleSiteAlias() moved to onAfterRoute (client type resolved at that point)
- Package script.php enables plugins on every install/update and sends heartbeat
-
-### Fixed
- Alias domain matching: strip trailing slashes, handle Joomla subform stdClass format
- Backend redirect: use primary_domain setting instead of Uri::root() (returned alias domain on mirrors)
- CI: version_bump reads manifest XML with priority over README.md VERSION header
- CI: version bump occurs after release build, not before
- CI: pipefail disabled during element detection (SIGPIPE on find|head)
- CI: pkg_pkg_ prefix duplication in zip names and updates.xml URLs
- CI: updates_xml_build preserves existing channel entries (stable not wiped by dev releases)
-
-### Removed
- deploy-manual.yml workflow — using Joomla update server for distribution
- Accidentally committed profile.ps1 and TODO.md
-
-## [02.01.43] - 2026-05-23
-
-### Added
- Site Aliases tab with Joomla subform repeatable-table UI
- Per-alias offline toggle with custom maintenance message (503 response)
- Per-alias robots meta directive (index/noindex/follow/nofollow/none)
- Per-alias backend redirect (admin panel redirects to primary domain)
- 6 MokoWaaS API endpoints: health, install, update, cache, backup, info
- Remote plugin install via `/?mokowaas=install` endpoint
- Remote update trigger via `/?mokowaas=update` endpoint
- Remote cache clear via `/?mokowaas=cache` endpoint (site + admin + opcache)
- Remote Akeeba Backup trigger via `/?mokowaas=backup` endpoint
- Compact site info via `/?mokowaas=info` endpoint
-
-### Changed
- Site aliases moved from comma-separated text field to structured subform
- Each alias now stores domain, offline, offline_message, robots, redirect_backend
- Heartbeat provisioning updated for subform alias format
- Grafana datasource names use domain-only (removed "MokoWaaS - " prefix)
-
-### Fixed
- Heartbeat receiver accepts any 200 status (registered/updated/ok)
- script.php uses heartbeat receiver instead of Grafana API (fixes 403 RBAC)
-
-## [02.01.37] - 2026-05-23
-
-### Added
- Health check endpoint at `/?mokowaas=health` with 16 diagnostic checks (#54)
- Core checks: database latency, filesystem writability/size, cache, extensions
- Backup checks: Akeeba Backup last backup date/status/size, days since, frequency
- Security checks: Admin Tools WAF status, blocked requests 24h/7d
- SSL certificate: expiry date, days left, issuer (degraded <30d, error <7d)
- Scheduled tasks: Joomla task scheduler status, failed tasks 24h
- Error log: PHP error log size, recent errors, last error message
- Database size: total MB, table count, top 5 largest tables
- Content stats: articles, categories, menu items, modules
- User activity: total users, active sessions, failed logins 24h, last login
- Mail system: mailer type, from address, SMTP host, queue count
- SEO health: robots.txt, sitemap, htaccess, SEF status
- Template info: site/admin template names, override count
- Configuration drift: debug mode, error reporting, force SSL, caching
- Human-readable `reason` field explaining degraded/error status
- Site size reporting (images, media, tmp, cache, logs directories)
- Heartbeat provisioning via receiver at bench.mokoconsulting.tech
- Grafana datasource auto-provisioning via YAML (no API token needed)
- ntfy notifications on heartbeat registration (mokowaas-heartbeat topic)
- Grafana dashboard with 9 rows covering all 16 health checks
- Auto-generated health API token (separate from Joomla user tokens)
-
-### Changed
- Health endpoint always enabled — no config toggle needed
- Grafana provisioning uses heartbeat receiver pattern (replaces direct API)
- Removed config fields: enable_health_endpoint, grafana_url, grafana_api_key
- Migrated .gitea/ to .mokogitea/ directory standard
- Updated all references from MokoStandards to moko-platform
- Renamed Gitea references to MokoGitea in docs
-
-### Fixed
- SSL verification disabled for Grafana cURL calls (shared hosting)
- cURL follow redirects enabled
- updates.xml download URL uses correct `development` tag
-
-### Security
- Plugin hidden from plugin list for non-master users
- Plugin settings restricted to master user only
- Self-healing lock (enforceLocked) runs every page load
- Uninstall blocked in preflight
- Health endpoint requires HTTPS + bearer token
- Heartbeat shared secret for receiver authentication
-
-## [02.01.08] - 2026-04-07
-
-### Added
- Template-based language overrides with `{{BRAND_NAME}}`, `{{COMPANY_NAME}}`, `{{SUPPORT_URL}}` placeholders
- Configurable brand name, company name, and support URL via plugin params
- Sentinel-block merge pattern that preserves existing site overrides
- Install respects user-defined overrides (non-overwrite)
- ~50 override keys across admin and frontend
- Powered by links with anchor tag to support URL
- Login support URL enforcement (mokoconsulting.tech/support, /kb, /news)
- Atum template branding via params (logoBrandLarge, logoBrandSmall, loginLogo)
- Shipped media assets: logo.png, favicon.ico, favicon.svg, favicon_256.png
- Favicon injection (SVG + ICO + Apple touch icon)
- Admin color scheme via Atum template style params (hue, link-color, special-color)
- Custom CSS textarea injection
- Master user enforcement (persistent super admin — "Webmaster")
- Emergency access (DB password + file verification two-factor)
- IP whitelist via configuration.php (empty blocks access)
- IP whitelist display in plugin config (shows current IPs + your IP)
- All emergency access attempts logged to Joomla Action Logs
- Email notification on successful emergency login
- Tenant restrictions: Extension Installer, System Info, Global Configuration, Template code editor
- Dynamic admin menu hiding via onPreprocessMenuItems
- Disable install-from-URL for all users
- Force HTTPS redirect (supports reverse proxy)
- Admin session idle timeout (default 60 min, master user exempt)
- Password policy (min length, uppercase, number, special character)
- Upload type and size restrictions (default 100MB)
- Maintenance actions: reset all hits, delete all versions
- Auto-enable plugin on first install
- Action log extension registration in #__action_logs_extensions and #__action_log_config
- Custom AllowedIpsField form field for IP whitelist display
- Joomla 5.x and 6.x compatibility
-
-### Fixed
- Column heading overrides removed (broke module/plugin list views)
- RegularLabs Position column workaround
- Nested `<a>` tags in login support overrides
- Emergency access moved from onUserAuthenticate to onAfterInitialise (Joomla uses isolated auth dispatcher)
- Session created directly for emergency login (bypasses auth dispatcher)
- Auto-complete emergency login after verify file deletion (no re-entering credentials)
-
-### Changed
- Version bumped to 02.01.08 across all files
- Configuration guide fully rewritten with all fieldsets documented
- Testing guide with 17 test suites
- README updated with Usage section, new features, Joomla 5/6 badges
-
-## [01.04.00] - 2026-02-22
-
-### Added
- Complete Joomla 5.x system plugin implementation with modern architecture
- Main plugin class (`src/mokowaas.php`) with event handlers:
-  - `onAfterInitialise` event hook for framework initialization
-  - `onAfterRoute` event hook for routing integration
- Plugin manifest (`src/mokowaas.xml`) with Joomla 5.x namespace support
-  - Namespace: `Moko\Plugin\System\MokoWaaS`
-  - Configuration parameter for enabling/disabling branding
- Dependency injection service provider (`src/services/provider.php`)
-  - DI container registration for Joomla 5.x compatibility
- Plugin language files in `src/language/en-GB/`:
-  - `plg_system_mokowaas.ini` - Plugin UI strings
-  - `plg_system_mokowaas.sys.ini` - System/installation strings
- Enhanced language overrides (57+ strings):
-  - Installation sample data branding
-  - Site name labels
-  - Admin-specific UI elements
-  - Version and About sections
- Security `index.html` files throughout directory structure
- Comprehensive README.md with:
-  - Badges for version, license, Joomla, and PHP compatibility
-  - Table of contents with 12+ major sections
-  - Detailed installation instructions (2 methods)
-  - Technical implementation documentation
-  - Repository structure overview
-  - Development and build instructions
-
-### Changed
- Updated all documentation to version 01.04.00
- Enhanced language overrides with more comprehensive coverage
- Improved plugin configuration options
-
-### Fixed
- Typo in language override: "ERROR OCCURED" → "ERROR OCCURRED"
- Repository references updated from placeholders to actual GitHub URLs
-
-### Technical
- Integrates with Joomla's native language override system
- No programmatic string loading (performance optimization)
- Event-driven architecture for minimal overhead
- PSR-4 autoloading through service provider
-
-## [01.03.00] - 2025-12-11
-
-### Changed
- General cleanup and code organization
- Documentation structure improvements
-
-## [01.02.01] - 2025-12-11
-
-### Changed
- Version bump for release alignment
-
-## [01.02.00] - 2025-12-11
-
-### Added
- Documentation directory (`/docs/`) with comprehensive guides:
-  - Installation guide
-  - Configuration guide
-  - Build guide
-  - Operations guide
-  - Troubleshooting guide
-  - Upgrade and versioning guide
-  - Rollback and recovery guide
- GitHub workflow for automated builds (`.github/workflows/build.yml`)
- Image and favicon replacement feature for complete branding
-
-### Changed
- Improved documentation structure and organization
-
-## [01.01.05] - 2025-12-11
-
-### Changed
- Version bump for release coordination
-
-## [01.01.04] - 2025-12-11
-
-### Fixed
- Plugin manifest corrections and validation fixes
-
-## [01.01.03] - 2025-12-11
-
-### Fixed
- Administrator language file location corrected
- Language override path alignment with Joomla standards
-
-## [01.01.02] - 2025-12-11
-
-### Changed
- Moved plugin code to `/src/` directory for better organization
- Aligned repository structure with release deployment pipeline
- Improved packaging workflow
-
-### Added
- Release deployment pipeline integration
- Automated build and validation scripts
-
-## [1.0.0] - 2025-12-11
-
-### Added
- Initial release of MokoWaaS plugin
- Basic language override system for Joomla rebranding
- Frontend language overrides (en-GB, en-US)
- Administrator language overrides (en-GB, en-US)
- Core branding replacements:
-  - Footer "Powered by" text
-  - Control panel welcome messages
-  - Help and documentation links
-  - Generic Joomla→MokoWaaS replacements
- Basic plugin structure and manifest
- License (GPL-3.0-or-later)
- Contributing guidelines
- Code of conduct
-
-### Technical Details
- Joomla 5.x compatible
- PHP 8.1+ requirement
- Language override mechanism using Joomla's native system
-
---
-
-## Version History Summary
-
-| Version    | Date       | Type      | Summary                                    |
-|------------|------------|-----------|-------------------------------------------|
-| 01.04.00   | 2026-02-22 | Major     | Complete plugin implementation & enhanced docs |
-| 01.03.00   | 2025-12-11 | Minor     | Cleanup and organization                  |
-| 01.02.01   | 2025-12-11 | Patch     | Version alignment                         |
-| 01.02.00   | 2025-12-11 | Minor     | Documentation and build system            |
-| 01.01.05   | 2025-12-11 | Patch     | Version coordination                      |
-| 01.01.04   | 2025-12-11 | Patch     | Manifest fixes                            |
-| 01.01.03   | 2025-12-11 | Patch     | Language location fix                     |
-| 01.01.02   | 2025-12-11 | Patch     | Repository restructuring                  |
-| 1.0.0      | 2025-12-11 | Major     | Initial release                           |
-
---
-
-## Upgrade Notes
-
-### Upgrading to 01.04.00
-
-**Breaking Changes:** None
-
-**New Features:**
- Complete Joomla 5.x plugin implementation
- Dependency injection support
- Enhanced language overrides (14+ new strings)
-
-**Installation:**
-1. Backup your current installation
-2. Download the latest release package
-3. Install via Joomla Extension Manager
-4. Clear Joomla cache
-5. Verify branding appears correctly
-
-### Upgrading to 01.02.00
-
-**New Features:**
- Comprehensive documentation in `/docs/`
- Automated build workflows
-
-**Notes:**
- Review new documentation for operational guidance
- Check GitHub workflows for automated builds
-
---
-
-## Contributing
-
-Please read [CONTRIBUTING.md](CONTRIBUTING.md) for details on our code of conduct and the process for submitting pull requests.
-
-When adding entries to this changelog:
-1. Add new changes under `[Unreleased]` section
-2. Use categories: Added, Changed, Deprecated, Removed, Fixed, Security
-3. Include clear, concise descriptions
-4. Reference issue numbers where applicable
-5. Move items from Unreleased to versioned section upon release
-
-## Links
-
- [MokoStandards](https://github.com/mokoconsulting-tech/MokoStandards) - Coding and documentation standards
- [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) - Changelog format specification
- [Semantic Versioning](https://semver.org/spec/v2.0.0.html) - Version numbering specification
- [Repository](https://github.com/mokoconsulting-tech/mokowaas) - Project repository
-
---
-
-**Note:** For detailed technical documentation, see the `/docs/` directory and [README.md](README.md).
+- Trusted IP session bypass: moved from `onAfterInitialise` to `boot()` so Joomla's session lifetime is extended before the session handler validates it (was too late, Joomla expired the session first)
+- updates.xml: removed stale pre-release entries pointing to non-existent dev artifacts, legacy plugin update entry that caused stable sites to attempt dev downloads
+- Removed duplicate `<updateservers>` from inner plugin manifest — only the package-level manifest should register the update server
+- Auto-cleanup of stale plugin-level update site entries on install/update (cleans `#__update_sites` and `#__update_sites_extensions`)
@@ -14,7 +14,7 @@
 	DEFGROUP: Joomla.Plugin
 	INGROUP: MokoWaaS.Documentation
 	REPO: https://github.com/mokoconsulting-tech/mokowaas
-	VERSION: 02.01.08
+	VERSION: 02.26.01
 	PATH: ./CODE_OF_CONDUCT.md
 	BRIEF: Reference + packaging repo for Moko Consulting Developer GPT Other Default
 -->
@@ -1,93 +1,161 @@
-<!--
- Copyright (C) 2025 Moko Consulting <hello@mokoconsulting.tech>
- This file is part of a Moko Consulting project.
- SPDX-LICENSE-IDENTIFIER: GPL-3.0-or-later
- This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3 of the License, or (at your option) any later version.
- This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the IMPLIED WARRANTY of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
- You should have received a copy of the GNU General Public License (./LICENSE.md).
+# Contributing to Moko Consulting Projects

- # FILE INFORMATION
- DEFGROUP: Joomla.Plugin
- INGROUP: MokoWaaS.Contributing
- REPO: https://github.com/mokoconsulting-tech/mokowaas
- VERSION: 02.01.08
- PATH: /CONTRIBUTING.md
- BRIEF: Contribution guidelines for the MokoWaaS plugin
-->
+Thank you for your interest in contributing. All Moko Consulting repositories follow this universal workflow and version policy.

-# Contributing to MokoWaaS (VERSION: 02.01.08)
+## Branching Workflow

-## Overview
-Contributions to the MokoWaaS plugin follow standardized development, governance, and quality control expectations defined by Moko Consulting. This document outlines contribution requirements, acceptable change types, branch management, testing expectations, and release readiness standards.
+```
+feature/* ──PR──> dev ──draft PR──> (renamed to rc) ──merge──> main
+```

-## 1. Contribution Workflow
-All contributions must follow the established workflow:
-1. Fork the repository or create a feature branch (if internal).
-2. Ensure your environment matches the supported Joomla and PHP versions.
-3. Implement changes following coding, documentation, and metadata standards.
-4. Validate plugin functionality locally.
-5. Submit a Pull Request (PR) for review.
+### Step by step

-## 2. Branching Model
- `main`: Production stable branch.
- `develop`: Aggregates work for the next minor release.
- `feature/*`: New enhancements or changes.
- `bugfix/*`: Hotfixes and corrections.
+1. **Create a feature branch** from `dev`:
+   ```bash
+   git checkout dev && git pull
+   git checkout -b feature/my-change
+   ```

-Internal teams must coordinate with governance before creating major feature branches.
+2. **Work and commit** on your feature branch. Push to origin.

-## 3. Coding and Documentation Standards
-All code must:
- Follow [MokoStandards](https://github.com/mokoconsulting-tech/MokoStandards) coding standards
- Include the unified SPDX license header
- Include a FILE INFORMATION metadata block
- Avoid deprecated Joomla APIs
- Preserve load order compatibility with other system plugins
+3. **Open a PR**: `feature/my-change` → `dev`. After review and checks, merge it.

-Documentation must:
- Include metadata
- Maintain revision history
- Use consistent formatting as defined by Moko documentation standards
+4. **When ready for release**, open a **draft PR**: `dev` → `main`.
+   - This automatically renames the source branch to `rc` (release candidate)
+   - An RC pre-release is built and uploaded

-## 4. Testing Requirements
-Before submitting a PR, contributors must verify:
- Plugin installs successfully in Joomla 5.x
- No load errors appear in logs
- Branding replacements appear as expected
- Terminology strings are correct
- No regressions in administrator UI
+5. **Alpha and beta branches** are created by manually renaming the branch before the RC stage:
+   - Rename `dev` to `alpha` for early testing → alpha pre-release is built
+   - Rename `alpha` to `beta` for feature-complete testing → beta pre-release is built
+   - When the draft PR is created, the branch is renamed to `rc`

-Automated testing coverage will expand as part of future roadmap enhancements.
+6. **Once PR checks pass** on the `rc` branch, mark the PR as ready and merge to `main`.

-## 5. Pull Request Requirements
-A PR must include:
- Description of change
- Screenshots for UI related updates
- Version updates when appropriate
- Notes for documentation changes
- Reference to related issues or tasks
+7. **Merging to main** triggers the stable release pipeline:
+   - Minor version bump (e.g., `02.09.xx` → `02.10.00`)
+   - Stability suffix stripped (clean version)
+   - Gitea release created with ZIP/tar.gz packages
+   - `updates.xml` updated (Joomla extensions)
+   - `dev` branch recreated from `main`

-PRs lacking required information may be flagged or delayed.
+### Branch summary

-## 6. Release Versioning
-Changes must follow semantic versioning:
- MAJOR: Structural branding or architectural changes
- MINOR: Feature updates or terminology expansion
- PATCH: Bug fixes or language corrections
+| Branch | Purpose | Created by |
+|--------|---------|-----------|
+| `feature/*` | New features and fixes | Developer |
+| `dev` | Integration branch | Auto-recreated after release |
+| `alpha` | Alpha pre-release testing | Manual rename from `dev` |
+| `beta` | Beta pre-release testing | Manual rename from `alpha` |
+| `rc` | Release candidate | Auto-renamed on draft PR to main |
+| `main` | Stable releases | Protected, merge only |
+| `version/XX.YY.ZZ` | Archived release snapshots | Auto-created by CI |

-Version updates must be reflected in:
- Manifest files
- PHP headers
- Documentation metadata
+### Protected branches

-## 7. Code Review Standards
-Reviewers validate:
- Code quality and clarity
- Compliance with [MokoStandards](https://github.com/mokoconsulting-tech/MokoStandards) coding standards
- Impact to templates and WaaS branding rules
- Backwards compatibility expectations
+| Branch | Direct push | Merge via |
+|--------|------------|-----------|
+| `main` | Blocked (CI bot whitelisted) | PR merge only |
+| `dev` | Blocked (CI bot whitelisted) | PR merge from feature/* |
+| `rc` | Blocked (CI bot whitelisted) | Auto-created on draft PR |
+| `alpha` | Blocked (CI bot whitelisted) | Manual rename |
+| `beta` | Blocked (CI bot whitelisted) | Manual rename |
+| `feature/*` | Open | N/A (source branch) |

-## Revision History
-| Date | Author | Description |
-| ------ | -------- | ----------- |
-| 2025-12-11 | Jonathan Miller (@jmiller-moko) | Initial creation of contribution guidelines |
+## Version Policy
+
+### Format
+
+All versions use `XX.YY.ZZ` — three two-digit segments, zero-padded:
+
+- **XX** — Major version (breaking changes)
+- **YY** — Minor version (new features, bumped on release to main)
+- **ZZ** — Patch version (auto-incremented on every push to dev/feature branches)
+
+Rollover: patch `99` → `00` increments minor; minor `99` → `00` increments major.
+
+### Stability suffixes
+
+Each branch appends a suffix to indicate stability:
+
+| Branch | Suffix | Example |
+|--------|--------|---------|
+| `main` | (none) | `02.09.00` |
+| `dev` | `-dev` | `02.09.01-dev` |
+| `feature/*` | `-dev` | `02.09.01-dev` |
+| `alpha` | `-alpha` | `02.09.01-alpha` |
+| `beta` | `-beta` | `02.09.01-beta` |
+| `rc` | `-rc` | `02.09.01-rc` |
+
+### Auto version bump
+
+On every push to `dev`, `feature/*`, or `patch/*`:
+
+1. Patch version incremented
+2. Stability suffix `-dev` applied
+3. All version-bearing files updated (manifests, CHANGELOG, PHP headers, etc.)
+4. Commit created with `[skip ci]` to avoid loops
+
+### Release version flow
+
+Version bumps happen at specific release events:
+
+| Event | Bump | Example |
+|-------|------|---------|
+| Feature merged to dev | Patch bump after dev release | `02.09.01-dev` → release → `02.09.02-dev` |
+| Dev promoted to RC | Minor bump | `02.09.02-dev` → `02.10.00-rc` |
+| RC merged to main | Minor bump | `02.10.00-rc` → `02.11.00` (stable) |
+| Dev recreated from main | Patch bump | `02.11.00` → `02.11.01-dev` |
+
+### Release stream copies
+
+When a higher-stability release is published, copies are created for all lesser streams with the same base version:
+
+- **RC `02.10.00-rc`** also creates: `02.10.00-dev`, `02.10.00-alpha`, `02.10.00-beta`
+- **Stable `02.11.00`** also creates: `02.11.00-dev`, `02.11.00-alpha`, `02.11.00-beta`, `02.11.00-rc`
+
+This ensures Joomla sites on ANY stability channel see the update (Joomla only shows versions higher than what's installed).
+
+### Version files
+
+The version tools update all files containing version stamps:
+
+- `.mokogitea/manifest.xml` (canonical source)
+- Joomla XML manifests (`<version>` tag)
+- `README.md`, `CHANGELOG.md` (`VERSION:` pattern)
+- `package.json`, `pyproject.toml`
+- Any text file with a `VERSION: XX.YY.ZZ` label
+
+Files synced from other repos (with a `# REPO:` header) are not touched.
+
+## Code Standards
+
+- **PHP**: PSR-12, tabs for indentation
+- **Copyright**: all files must include the Moko Consulting copyright header
+- **License**: SPDX identifier `GPL-3.0-or-later` (or as specified per repo)
+- **Attribution**: use `Authored-by: Moko Consulting` in commits, not individual names
+
+## Commit Messages
+
+Use conventional commit format:
+
+```
+type(scope): short description
+
+Optional body with context.
+
+Authored-by: Moko Consulting
+```
+
+Types: `feat`, `fix`, `chore`, `docs`, `style`, `refactor`, `test`, `ci`
+
+Special flags in commit messages:
+- `[skip ci]` — skip all CI workflows
+- `[skip bump]` — skip auto version bump only
+
+## Reporting Issues
+
+Use the repository's issue tracker with the appropriate template.
+
+---
+
+*Moko Consulting <hello@mokoconsulting.tech>*
@@ -19,7 +19,7 @@
 DEFGROUP: mokoconsulting-tech.MokoWaaSBrand
 INGROUP: MokoStandards.Governance
 REPO: https://github.com/mokoconsulting-tech/MokoWaaSBrand
- VERSION: 02.01.08
+ VERSION: 02.26.01
 PATH: /GOVERNANCE.md
 BRIEF: Project governance rules, roles, and decision process for MokoWaaSBrand
 -->
@@ -15,7 +15,7 @@
 	INGROUP: MokoWaaS.Documentation
  REPO: https://github.com/mokoconsulting-tech/mokowaas
 	PATH: ./LICENSE.md
-	VERSION: 02.01.08
+	VERSION: 02.26.01
 	BRIEF: Project license (GPL-3.0-or-later)
 -->
 										GNU GENERAL PUBLIC LICENSE
@@ -9,7 +9,7 @@
 DEFGROUP: Joomla.Plugin
 INGROUP: MokoWaaS
 REPO: https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS
- VERSION: 02.05.01
+ VERSION: 02.26.01
 PATH: /README.md
 BRIEF: MokoWaaS platform plugin for Joomla
 -->
@@ -23,7 +23,7 @@ DEFGROUP: [PROJECT_NAME]
 INGROUP: [PROJECT_NAME].Documentation
 REPO: [REPOSITORY_URL]
 PATH: /SECURITY.md
-VERSION: 02.01.08
+VERSION: 02.26.01
 BRIEF: Security vulnerability reporting and handling policy
 -->

@@ -11,13 +11,13 @@
 INGROUP: MokoWaaS.Build
 REPO: https://github.com/mokoconsulting-tech/mokowaas
 FILE: build-guide.md
- VERSION: 02.01.08
+ VERSION: 02.26.01
 PATH: /docs/guides/
 BRIEF: Build and packaging guide for the MokoWaaS system plugin
 NOTE: Defines environment setup, repository layout, packaging rules, and release preparation
 -->

-# MokoWaaS Build Guide (VERSION: 02.01.08)
+# MokoWaaS Build Guide (VERSION: 02.26.01)

 ## 1. Purpose

@@ -10,13 +10,13 @@
 DEFGROUP: Joomla.Plugin
 INGROUP: MokoWaaS.Guides
 REPO: https://github.com/mokoconsulting-tech/mokowaas
- VERSION: 02.01.08
+ VERSION: 02.26.01
 PATH: /docs/guides/configuration-guide.md
 BRIEF: Configuration guide for the MokoWaaS system plugin
 NOTE: Defines plugin parameters, expected behaviors, and recommended defaults
 -->

-# MokoWaaS Configuration Guide (VERSION: 02.01.08)
+# MokoWaaS Configuration Guide (VERSION: 02.26.01)

 ## 1. Objective

@@ -10,13 +10,13 @@
 DEFGROUP: Joomla.Plugin
 INGROUP: MokoWaaS.Guides
 REPO: https://github.com/mokoconsulting-tech/mokowaas
- VERSION: 02.01.08
+ VERSION: 02.26.01
 PATH: /docs/guides/installation-guide.md
 BRIEF: Installation guide for the MokoWaaS system plugin
 NOTE: First document in the guide set
 -->

-# MokoWaaS Installation Guide (VERSION: 02.01.08)
+# MokoWaaS Installation Guide (VERSION: 02.26.01)

 ## Introduction

@@ -10,13 +10,13 @@
 DEFGROUP: Joomla.Plugin
 INGROUP: MokoWaaS.Guides
 REPO: https://github.com/mokoconsulting-tech/mokowaas
- VERSION: 02.01.08
+ VERSION: 02.26.01
 PATH: /docs/guides/operations-guide.md
 BRIEF: Operational guide for administering and managing the MokoWaaS system plugin
 NOTE: Defines lifecycle, responsibilities, and operational behaviors
 -->

-# MokoWaaS Operations Guide (VERSION: 02.01.08)
+# MokoWaaS Operations Guide (VERSION: 02.26.01)

 ## Introduction

@@ -10,13 +10,13 @@
 DEFGROUP: Joomla.Plugin
 INGROUP: MokoWaaS.Guides
 REPO: https://github.com/mokoconsulting-tech/mokowaas
- VERSION: 02.01.08
+ VERSION: 02.26.01
 PATH: /docs/guides/rollback-and-recovery-guide.md
 BRIEF: Rollback and recovery guide for restoring stable operation after plugin related incidents
 NOTE: Completes the core guide set for WaaS plugin governance
 -->

-# MokoWaaS Rollback and Recovery Guide (VERSION: 02.01.08)
+# MokoWaaS Rollback and Recovery Guide (VERSION: 02.26.01)

 ## Introduction

@@ -7,13 +7,13 @@
 DEFGROUP: Joomla.Plugin
 INGROUP: MokoWaaS.Guides
 REPO: https://github.com/mokoconsulting-tech/mokowaas
- VERSION: 02.01.08
+ VERSION: 02.26.01
 PATH: /docs/guides/testing-guide.md
 BRIEF: Testing guide for MokoWaaS v02.01.08
 NOTE: Covers manual test procedures for language overrides, install/uninstall, and configuration
 -->

-# MokoWaaS Testing Guide (VERSION: 02.01.08)
+# MokoWaaS Testing Guide (VERSION: 02.26.01)

 ## 1. Prerequisites

@@ -10,13 +10,13 @@
 DEFGROUP: Joomla.Plugin
 INGROUP: MokoWaaS.Guides
 REPO: https://github.com/mokoconsulting-tech/mokowaas
- VERSION: 02.01.08
+ VERSION: 02.26.01
 PATH: /docs/guides/troubleshooting-guide.md
 BRIEF: Troubleshooting guide for diagnosing and resolving issues related to the MokoWaaS plugin
 NOTE: Designed for administrators and WaaS operations teams
 -->

-# MokoWaaS Troubleshooting Guide (VERSION: 02.01.08)
+# MokoWaaS Troubleshooting Guide (VERSION: 02.26.01)

 ## Introduction

@@ -10,13 +10,13 @@
 DEFGROUP: Joomla.Plugin
 INGROUP: MokoWaaS.Guides
 REPO: https://github.com/mokoconsulting-tech/mokowaas
- VERSION: 02.01.08
+ VERSION: 02.26.01
 PATH: /docs/guides/upgrade-and-versioning-guide.md
 BRIEF: Guide for updating, versioning, and maintaining the MokoWaaS plugin
 NOTE: Defines release flow, version rules, and upgrade validation
 -->

-# MokoWaaS Upgrade and Versioning Guide (VERSION: 02.01.08)
+# MokoWaaS Upgrade and Versioning Guide (VERSION: 02.26.01)

 ## Introduction

@@ -10,13 +10,13 @@
 DEFGROUP: Joomla.Plugin
 INGROUP: MokoWaaS.Documentation
 REPO: https://github.com/mokoconsulting-tech/mokowaas
- VERSION: 02.01.08
+ VERSION: 02.26.01
 PATH: /docs/index.md
 BRIEF: Master index of all documentation for the MokoWaaS plugin
 NOTE: Automatically maintained index for all guide canvases
 -->

-# MokoWaaS Documentation Index (VERSION: 02.01.08)
+# MokoWaaS Documentation Index (VERSION: 02.26.01)

 ## Introduction

@@ -11,12 +11,12 @@
 INGROUP: MokoWaaS
 REPO: https://github.com/mokoconsulting-tech/mokowaas
 PATH: /docs/plugin-basic.md
- VERSION: 02.01.08
+ VERSION: 02.26.01
 BRIEF: Baseline documentation for the MokoWaaS system plugin
 NOTE: Foundational reference for internal and external stakeholders
 -->

-# MokoWaaS Plugin Overview (VERSION: 02.01.08)
+# MokoWaaS Plugin Overview (VERSION: 02.26.01)

 ## Introduction

@@ -10,7 +10,7 @@ DEFGROUP: MokoWaaS.Documentation
 INGROUP: MokoStandards.Templates
 REPO: https://github.com/mokoconsulting-tech/MokoWaaS
 PATH: /docs/update-server.md
-VERSION: 02.01.08
+VERSION: 02.26.01
 BRIEF: How this extension's Joomla update server file (update.xml) is managed
 -->

@@ -0,0 +1,187 @@
+<?php
+/**
+ * @package     MokoWaaS
+ * @subpackage  com_mokowaas
+ * @copyright   Copyright (C) 2026 Moko Consulting. All rights reserved.
+ * @license     GNU General Public License version 3 or later; see LICENSE
+ */
+
+namespace Moko\Component\MokoWaaS\Api\Controller;
+
+defined('_JEXEC') or die;
+
+use Joomla\CMS\Factory;
+use Joomla\CMS\MVC\Controller\BaseController;
+
+/**
+ * Extensions list API controller.
+ *
+ * GET /api/index.php/v1/mokowaas/extensions
+ *
+ * Returns all installed extensions with type, element, folder, version,
+ * enabled/protected/locked status, and update server info.
+ *
+ * Optional filters via query params:
+ *   ?type=plugin          — filter by extension type
+ *   ?search=moko          — search name or element
+ *   ?enabled=1            — only enabled/disabled
+ *
+ * @since  02.21.00
+ */
+class ExtensionsController extends BaseController
+{
+	/**
+	 * List installed extensions.
+	 *
+	 * @return  void
+	 *
+	 * @since   02.21.00
+	 */
+	public function displayList(): void
+	{
+		$app  = Factory::getApplication();
+		$user = $app->getIdentity();
+
+		if (!$user->authorise('core.manage', 'com_installer'))
+		{
+			$this->sendJson(403, ['error' => 'Not authorized — requires core.manage on com_installer']);
+			return;
+		}
+
+		try
+		{
+			$db    = Factory::getDbo();
+			$query = $db->getQuery(true)
+				->select([
+					$db->quoteName('e.extension_id'),
+					$db->quoteName('e.name'),
+					$db->quoteName('e.type'),
+					$db->quoteName('e.element'),
+					$db->quoteName('e.folder'),
+					$db->quoteName('e.client_id'),
+					$db->quoteName('e.enabled'),
+					$db->quoteName('e.protected'),
+					$db->quoteName('e.locked'),
+					$db->quoteName('e.manifest_cache'),
+				])
+				->from($db->quoteName('#__extensions', 'e'))
+				->order($db->quoteName('e.type') . ' ASC, ' . $db->quoteName('e.name') . ' ASC');
+
+			// Filter by type
+			$typeFilter = $app->input->get('type', '', 'CMD');
+
+			if ($typeFilter !== '')
+			{
+				$query->where($db->quoteName('e.type') . ' = ' . $db->quote($typeFilter));
+			}
+
+			// Filter by enabled
+			$enabledFilter = $app->input->get('enabled', '', 'CMD');
+
+			if ($enabledFilter !== '')
+			{
+				$query->where($db->quoteName('e.enabled') . ' = ' . (int) $enabledFilter);
+			}
+
+			// Search name or element
+			$search = $app->input->get('search', '', 'STRING');
+
+			if ($search !== '')
+			{
+				$searchQuoted = $db->quote('%' . $db->escape($search, true) . '%');
+				$query->where(
+					'(' . $db->quoteName('e.name') . ' LIKE ' . $searchQuoted
+					. ' OR ' . $db->quoteName('e.element') . ' LIKE ' . $searchQuoted . ')'
+				);
+			}
+
+			$db->setQuery($query);
+			$rows = $db->loadAssocList();
+
+			// Get update sites for cross-reference
+			$usQuery = $db->getQuery(true)
+				->select([
+					$db->quoteName('us.update_site_id'),
+					$db->quoteName('us.name', 'site_name'),
+					$db->quoteName('us.location'),
+					$db->quoteName('us.enabled', 'site_enabled'),
+					$db->quoteName('usm.extension_id'),
+				])
+				->from($db->quoteName('#__update_sites', 'us'))
+				->innerJoin(
+					$db->quoteName('#__update_sites_extensions', 'usm')
+					. ' ON ' . $db->quoteName('us.update_site_id')
+					. ' = ' . $db->quoteName('usm.update_site_id')
+				);
+			$db->setQuery($usQuery);
+			$updateSites = [];
+
+			foreach ($db->loadAssocList() ?: [] as $us)
+			{
+				$updateSites[(int) $us['extension_id']] = [
+					'name'     => $us['site_name'],
+					'location' => $us['location'],
+					'enabled'  => (bool) $us['site_enabled'],
+				];
+			}
+
+			// Build response
+			$extensions = [];
+
+			foreach ($rows as $row)
+			{
+				$manifest = json_decode($row['manifest_cache'] ?: '{}', true);
+				$extId    = (int) $row['extension_id'];
+
+				$ext = [
+					'extension_id' => $extId,
+					'name'         => $row['name'],
+					'type'         => $row['type'],
+					'element'      => $row['element'],
+					'folder'       => $row['folder'] ?: null,
+					'client_id'    => (int) $row['client_id'],
+					'enabled'      => (bool) $row['enabled'],
+					'protected'    => (bool) $row['protected'],
+					'locked'       => (bool) $row['locked'],
+					'version'      => $manifest['version'] ?? null,
+					'author'       => $manifest['author'] ?? null,
+					'description'  => $manifest['description'] ?? null,
+				];
+
+				if (isset($updateSites[$extId]))
+				{
+					$ext['update_server'] = $updateSites[$extId];
+				}
+
+				$extensions[] = $ext;
+			}
+
+			$this->sendJson(200, [
+				'status' => 'ok',
+				'count'  => count($extensions),
+				'extensions' => $extensions,
+			]);
+		}
+		catch (\Throwable $e)
+		{
+			$this->sendJson(500, [
+				'error'   => 'Failed to list extensions',
+				'message' => $e->getMessage(),
+			]);
+		}
+	}
+
+	/**
+	 * @param   int    $code     HTTP status code
+	 * @param   array  $payload  Response data
+	 * @return  void
+	 */
+	private function sendJson(int $code, array $payload): void
+	{
+		$app = Factory::getApplication();
+		$app->setHeader('Content-Type', 'application/json', true);
+		$app->setHeader('Status', (string) $code, true);
+		echo json_encode($payload, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES | JSON_PRETTY_PRINT);
+		$app->close();
+	}
+}
@@ -0,0 +1,283 @@
+<?php
+/**
+ * @package     MokoWaaS
+ * @subpackage  com_mokowaas
+ * @copyright   Copyright (C) 2026 Moko Consulting. All rights reserved.
+ * @license     GNU General Public License version 3 or later; see LICENSE
+ */
+
+namespace Moko\Component\MokoWaaS\Api\Controller;
+
+defined('_JEXEC') or die;
+
+use Joomla\CMS\Factory;
+use Joomla\CMS\Installer\Installer;
+use Joomla\CMS\MVC\Controller\BaseController;
+
+/**
+ * Extension install-from-URL API controller.
+ *
+ * POST /api/index.php/v1/mokowaas/install
+ * Body: {"url": "https://example.com/path/to/extension.zip"}
+ *
+ * Downloads a ZIP from the given URL and installs it via Joomla's Installer.
+ * Requires a Joomla API token with core.manage on com_installer.
+ *
+ * @since  02.21.00
+ */
+class InstallController extends BaseController
+{
+	/**
+	 * Maximum allowed download size in bytes (64 MB).
+	 *
+	 * @var    int
+	 * @since  02.21.00
+	 */
+	private const MAX_DOWNLOAD_BYTES = 67108864;
+
+	/**
+	 * Install an extension from a remote ZIP URL.
+	 *
+	 * @return  void
+	 *
+	 * @since   02.21.00
+	 */
+	public function execute(): void
+	{
+		$app = Factory::getApplication();
+
+		if ($app->input->getMethod() !== 'POST')
+		{
+			$this->sendJson(405, ['error' => 'POST required']);
+			return;
+		}
+
+		$user = $app->getIdentity();
+
+		if (!$user->authorise('core.manage', 'com_installer'))
+		{
+			$this->sendJson(403, ['error' => 'Not authorized — requires core.manage on com_installer']);
+			return;
+		}
+
+		// Parse JSON body
+		$body = json_decode($app->input->json->getRaw(), true);
+		$url  = $body['url'] ?? '';
+
+		if ($url === '')
+		{
+			$this->sendJson(400, ['error' => 'Missing "url" in request body']);
+			return;
+		}
+
+		// Validate URL scheme
+		if (!preg_match('#^https?://#i', $url))
+		{
+			$this->sendJson(400, ['error' => 'URL must use http or https scheme']);
+			return;
+		}
+
+		// Must point to a .zip file
+		$path = parse_url($url, PHP_URL_PATH);
+
+		if (!$path || !str_ends_with(strtolower($path), '.zip'))
+		{
+			$this->sendJson(400, ['error' => 'URL must point to a .zip file']);
+			return;
+		}
+
+		try
+		{
+			$result = $this->downloadAndInstall($url);
+			$this->sendJson(200, $result);
+		}
+		catch (\Throwable $e)
+		{
+			$this->sendJson(500, [
+				'error'   => 'Installation failed',
+				'message' => $e->getMessage(),
+			]);
+		}
+	}
+
+	/**
+	 * Download ZIP from URL, extract, and install via Joomla Installer.
+	 *
+	 * @param   string  $url  The remote ZIP URL
+	 *
+	 * @return  array  Result payload
+	 *
+	 * @throws  \RuntimeException on failure
+	 *
+	 * @since   02.21.00
+	 */
+	private function downloadAndInstall(string $url): array
+	{
+		$config  = Factory::getConfig();
+		$tmpPath = $config->get('tmp_path', JPATH_ROOT . '/tmp');
+		$zipFile = $tmpPath . '/mokowaas_install_' . bin2hex(random_bytes(8)) . '.zip';
+
+		// Download
+		$this->downloadFile($url, $zipFile);
+
+		try
+		{
+			// Extract
+			$extractDir = $tmpPath . '/mokowaas_extract_' . bin2hex(random_bytes(8));
+
+			if (!mkdir($extractDir, 0755, true))
+			{
+				throw new \RuntimeException('Failed to create extraction directory');
+			}
+
+			$archive = new \Joomla\Archive\Archive;
+			$archive->extract($zipFile, $extractDir);
+
+			// Install
+			$installer = Installer::getInstance();
+			$result    = $installer->install($extractDir);
+
+			if (!$result)
+			{
+				throw new \RuntimeException('Joomla Installer returned failure — check server logs for details');
+			}
+
+			// Read installed extension info from the installer
+			$manifest = $installer->getManifest();
+			$name     = $manifest ? (string) $manifest->name : 'Unknown';
+			$version  = $manifest ? (string) $manifest->version : 'Unknown';
+			$type     = $installer->get('extension.type', 'Unknown');
+
+			return [
+				'status'  => 'ok',
+				'message' => 'Extension installed successfully',
+				'extension' => [
+					'name'    => $name,
+					'version' => $version,
+					'type'    => $type,
+				],
+				'source_url' => $url,
+			];
+		}
+		finally
+		{
+			// Clean up temp files
+			@unlink($zipFile);
+
+			if (isset($extractDir) && is_dir($extractDir))
+			{
+				$this->removeDirectory($extractDir);
+			}
+		}
+	}
+
+	/**
+	 * Download a file from a URL with size limit enforcement.
+	 *
+	 * @param   string  $url       Remote URL
+	 * @param   string  $destPath  Local destination path
+	 *
+	 * @return  void
+	 *
+	 * @throws  \RuntimeException on failure
+	 *
+	 * @since   02.21.00
+	 */
+	private function downloadFile(string $url, string $destPath): void
+	{
+		$ch = curl_init($url);
+
+		if ($ch === false)
+		{
+			throw new \RuntimeException('Failed to initialise cURL');
+		}
+
+		$fp = fopen($destPath, 'wb');
+
+		if ($fp === false)
+		{
+			curl_close($ch);
+			throw new \RuntimeException('Failed to open temp file for writing');
+		}
+
+		curl_setopt_array($ch, [
+			CURLOPT_FILE           => $fp,
+			CURLOPT_FOLLOWLOCATION => true,
+			CURLOPT_MAXREDIRS      => 5,
+			CURLOPT_TIMEOUT        => 120,
+			CURLOPT_CONNECTTIMEOUT => 15,
+			CURLOPT_FAILONERROR    => true,
+			CURLOPT_USERAGENT      => 'MokoWaaS-Installer/1.0',
+		]);
+
+		$success = curl_exec($ch);
+		$httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
+		$error    = curl_error($ch);
+		$fileSize = curl_getinfo($ch, CURLINFO_SIZE_DOWNLOAD);
+
+		curl_close($ch);
+		fclose($fp);
+
+		if (!$success)
+		{
+			@unlink($destPath);
+			throw new \RuntimeException('Download failed (HTTP ' . $httpCode . '): ' . $error);
+		}
+
+		if ($fileSize > self::MAX_DOWNLOAD_BYTES)
+		{
+			@unlink($destPath);
+			throw new \RuntimeException('Download exceeds maximum size of ' . (self::MAX_DOWNLOAD_BYTES / 1048576) . ' MB');
+		}
+	}
+
+	/**
+	 * Recursively remove a directory and its contents.
+	 *
+	 * @param   string  $dir  Directory path
+	 *
+	 * @return  void
+	 *
+	 * @since   02.21.00
+	 */
+	private function removeDirectory(string $dir): void
+	{
+		$items = new \RecursiveIteratorIterator(
+			new \RecursiveDirectoryIterator($dir, \RecursiveDirectoryIterator::SKIP_DOTS),
+			\RecursiveIteratorIterator::CHILD_FIRST
+		);
+
+		foreach ($items as $item)
+		{
+			if ($item->isDir())
+			{
+				@rmdir($item->getPathname());
+			}
+			else
+			{
+				@unlink($item->getPathname());
+			}
+		}
+
+		@rmdir($dir);
+	}
+
+	/**
+	 * Send a JSON response and close.
+	 *
+	 * @param   int    $code     HTTP status code
+	 * @param   array  $payload  Response data
+	 *
+	 * @return  void
+	 *
+	 * @since   02.21.00
+	 */
+	private function sendJson(int $code, array $payload): void
+	{
+		$app = Factory::getApplication();
+		$app->setHeader('Content-Type', 'application/json', true);
+		$app->setHeader('Status', (string) $code, true);
+		echo json_encode($payload, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES | JSON_PRETTY_PRINT);
+		$app->close();
+	}
+}
@@ -0,0 +1,128 @@
+<?php
+/**
+ * @package     MokoWaaS
+ * @subpackage  com_mokowaas
+ * @copyright   Copyright (C) 2026 Moko Consulting. All rights reserved.
+ * @license     GNU General Public License version 3 or later; see LICENSE
+ */
+
+namespace Moko\Component\MokoWaaS\Api\Controller;
+
+defined('_JEXEC') or die;
+
+use Joomla\CMS\Factory;
+use Joomla\CMS\MVC\Controller\BaseController;
+use Joomla\CMS\Plugin\PluginHelper;
+use Joomla\Registry\Registry;
+
+/**
+ * Demo site reset API controller.
+ *
+ * POST /api/index.php/v1/mokowaas/reset
+ * Body: {"baseline": "default"}
+ *
+ * Restores the site to a named baseline snapshot.
+ * Requires a Joomla API token with core.manage on com_plugins.
+ *
+ * @since  02.21.00
+ */
+class ResetController extends BaseController
+{
+	/**
+	 * Restore site to a baseline snapshot.
+	 *
+	 * @return  void
+	 *
+	 * @since   02.21.00
+	 */
+	public function execute(): void
+	{
+		$app = Factory::getApplication();
+
+		if ($app->input->getMethod() !== 'POST')
+		{
+			$this->sendJson(405, ['error' => 'POST required']);
+			return;
+		}
+
+		$user = $app->getIdentity();
+
+		if (!$user->authorise('core.manage', 'com_plugins'))
+		{
+			$this->sendJson(403, ['error' => 'Not authorized']);
+			return;
+		}
+
+		$plugin = PluginHelper::getPlugin('system', 'mokowaas');
+
+		if (!$plugin)
+		{
+			$this->sendJson(503, ['error' => 'MokoWaaS system plugin not enabled']);
+			return;
+		}
+
+		$params = new Registry($plugin->params);
+
+		try
+		{
+			$body     = json_decode($app->input->json->getRaw(), true);
+			$baseline = $body['baseline']
+				?? $params->get('demo_active_baseline', 'default');
+
+			$service = $this->createService($params);
+			$result  = $service->restoreSnapshot($baseline);
+
+			$this->sendJson(200, $result);
+		}
+		catch (\Throwable $e)
+		{
+			$this->sendJson(500, [
+				'error'   => 'Reset failed',
+				'message' => $e->getMessage(),
+			]);
+		}
+	}
+
+	/**
+	 * Create DemoResetService from plugin params.
+	 *
+	 * @param   Registry  $params  Plugin parameters
+	 *
+	 * @return  \Moko\Plugin\System\MokoWaaS\Service\DemoResetService
+	 *
+	 * @since   02.21.00
+	 */
+	private function createService(Registry $params)
+	{
+		$serviceFile = JPATH_PLUGINS . '/system/mokowaas/Service/DemoResetService.php';
+
+		if (!file_exists($serviceFile))
+		{
+			throw new \RuntimeException('DemoResetService not found — is the MokoWaaS plugin installed?');
+		}
+
+		require_once $serviceFile;
+
+		$tablesParam = $params->get('demo_snapshot_tables', '');
+		$tables = is_array($tablesParam) ? array_filter($tablesParam) : array_filter(array_map('trim', explode("\n", $tablesParam)));
+		$media  = $params->get('demo_snapshot_include_media', ['images']);
+		if ($media === '1' || $media === true) $media = ['images'];
+		if ($media === '0' || $media === false) $media = [];
+
+		return new \Moko\Plugin\System\MokoWaaS\Service\DemoResetService($tables, (array) $media);
+	}
+
+	/**
+	 * @param   int    $code     HTTP status code
+	 * @param   array  $payload  Response data
+	 * @return  void
+	 */
+	private function sendJson(int $code, array $payload): void
+	{
+		$app = Factory::getApplication();
+		$app->setHeader('Content-Type', 'application/json', true);
+		$app->setHeader('Status', (string) $code, true);
+		echo json_encode($payload, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES | JSON_PRETTY_PRINT);
+		$app->close();
+	}
+}
@@ -0,0 +1,155 @@
+<?php
+/**
+ * @package     MokoWaaS
+ * @subpackage  com_mokowaas
+ * @copyright   Copyright (C) 2026 Moko Consulting. All rights reserved.
+ * @license     GNU General Public License version 3 or later; see LICENSE
+ */
+
+namespace Moko\Component\MokoWaaS\Api\Controller;
+
+defined('_JEXEC') or die;
+
+use Joomla\CMS\Factory;
+use Joomla\CMS\MVC\Controller\BaseController;
+use Joomla\CMS\Plugin\PluginHelper;
+use Joomla\Registry\Registry;
+
+/**
+ * Snapshot management API controller.
+ *
+ * GET  /api/index.php/v1/mokowaas/snapshot  — list snapshots
+ * POST /api/index.php/v1/mokowaas/snapshot  — create snapshot
+ *
+ * @since  02.21.00
+ */
+class SnapshotController extends BaseController
+{
+	/**
+	 * List all available snapshots.
+	 *
+	 * @return  void
+	 *
+	 * @since   02.21.00
+	 */
+	public function displayList(): void
+	{
+		$app  = Factory::getApplication();
+		$user = $app->getIdentity();
+
+		if (!$user->authorise('core.manage', 'com_plugins'))
+		{
+			$this->sendJson(403, ['error' => 'Not authorized']);
+			return;
+		}
+
+		try
+		{
+			$service = $this->createService();
+
+			$this->sendJson(200, [
+				'status'    => 'ok',
+				'snapshots' => $service->listSnapshots(),
+			]);
+		}
+		catch (\Throwable $e)
+		{
+			$this->sendJson(500, [
+				'error'   => 'Failed to list snapshots',
+				'message' => $e->getMessage(),
+			]);
+		}
+	}
+
+	/**
+	 * Create a new snapshot.
+	 *
+	 * @return  void
+	 *
+	 * @since   02.21.00
+	 */
+	public function execute(): void
+	{
+		$app = Factory::getApplication();
+
+		if ($app->input->getMethod() !== 'POST')
+		{
+			$this->sendJson(405, ['error' => 'POST required']);
+			return;
+		}
+
+		$user = $app->getIdentity();
+
+		if (!$user->authorise('core.manage', 'com_plugins'))
+		{
+			$this->sendJson(403, ['error' => 'Not authorized']);
+			return;
+		}
+
+		try
+		{
+			$plugin = PluginHelper::getPlugin('system', 'mokowaas');
+			$params = $plugin ? new Registry($plugin->params) : new Registry;
+
+			$body = json_decode($app->input->json->getRaw(), true);
+			$name = $body['name']
+				?? $params->get('demo_active_baseline', 'default');
+
+			$service = $this->createService();
+			$result  = $service->createSnapshot($name);
+
+			$this->sendJson(200, $result);
+		}
+		catch (\Throwable $e)
+		{
+			$this->sendJson(500, [
+				'error'   => 'Snapshot failed',
+				'message' => $e->getMessage(),
+			]);
+		}
+	}
+
+	/**
+	 * Create DemoResetService from plugin params.
+	 *
+	 * @return  \Moko\Plugin\System\MokoWaaS\Service\DemoResetService
+	 *
+	 * @since   02.21.00
+	 */
+	private function createService()
+	{
+		$serviceFile = JPATH_PLUGINS . '/system/mokowaas/Service/DemoResetService.php';
+
+		if (!file_exists($serviceFile))
+		{
+			throw new \RuntimeException('DemoResetService not found');
+		}
+
+		require_once $serviceFile;
+
+		$plugin = PluginHelper::getPlugin('system', 'mokowaas');
+		$params = $plugin ? new Registry($plugin->params) : new Registry;
+
+		$tablesParam = $params->get('demo_snapshot_tables', '');
+		$tables = is_array($tablesParam) ? array_filter($tablesParam) : array_filter(array_map('trim', explode("\n", $tablesParam)));
+		$media  = $params->get('demo_snapshot_include_media', ['images']);
+		if ($media === '1' || $media === true) $media = ['images'];
+		if ($media === '0' || $media === false) $media = [];
+
+		return new \Moko\Plugin\System\MokoWaaS\Service\DemoResetService($tables, (array) $media);
+	}
+
+	/**
+	 * @param   int    $code     HTTP status code
+	 * @param   array  $payload  Response data
+	 * @return  void
+	 */
+	private function sendJson(int $code, array $payload): void
+	{
+		$app = Factory::getApplication();
+		$app->setHeader('Content-Type', 'application/json', true);
+		$app->setHeader('Status', (string) $code, true);
+		echo json_encode($payload, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES | JSON_PRETTY_PRINT);
+		$app->close();
+	}
+}
@@ -0,0 +1,82 @@
+<?php
+/**
+ * @package     MokoWaaS
+ * @subpackage  com_mokowaas
+ * @copyright   Copyright (C) 2026 Moko Consulting. All rights reserved.
+ * @license     GNU General Public License version 3 or later; see LICENSE
+ */
+
+namespace Moko\Component\MokoWaaS\Api\Controller;
+
+defined('_JEXEC') or die;
+
+use Joomla\CMS\Factory;
+use Joomla\CMS\MVC\Controller\BaseController;
+use Joomla\CMS\Plugin\PluginHelper;
+use Joomla\Registry\Registry;
+
+/**
+ * Content sync trigger API controller (sender side).
+ *
+ * POST /api/index.php/v1/mokowaas/sync
+ *
+ * Pushes content to all configured sync targets.
+ *
+ * @since  02.21.00
+ */
+class SyncController extends BaseController
+{
+	public function execute(): void
+	{
+		$app = Factory::getApplication();
+
+		if ($app->input->getMethod() !== 'POST')
+		{
+			$this->sendJson(405, ['error' => 'POST required']);
+			return;
+		}
+
+		$user = $app->getIdentity();
+
+		if (!$user->authorise('core.manage', 'com_plugins'))
+		{
+			$this->sendJson(403, ['error' => 'Not authorized']);
+			return;
+		}
+
+		$plugin = PluginHelper::getPlugin('system', 'mokowaas');
+
+		if (!$plugin)
+		{
+			$this->sendJson(503, ['error' => 'MokoWaaS system plugin not enabled']);
+			return;
+		}
+
+		try
+		{
+			$params = new Registry($plugin->params);
+			$targets = json_decode($params->get('sync_targets', '[]'), true) ?: [];
+
+			$serviceFile = JPATH_PLUGINS . '/system/mokowaas/Service/ContentSyncService.php';
+			require_once $serviceFile;
+
+			$service = new \Moko\Plugin\System\MokoWaaS\Service\ContentSyncService();
+			$result  = $service->syncAllTargets($targets);
+
+			$this->sendJson(200, $result);
+		}
+		catch (\Throwable $e)
+		{
+			$this->sendJson(500, ['error' => 'Sync failed', 'message' => $e->getMessage()]);
+		}
+	}
+
+	private function sendJson(int $code, array $payload): void
+	{
+		$app = Factory::getApplication();
+		$app->setHeader('Content-Type', 'application/json', true);
+		$app->setHeader('Status', (string) $code, true);
+		echo json_encode($payload, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES | JSON_PRETTY_PRINT);
+		$app->close();
+	}
+}
@@ -0,0 +1,77 @@
+<?php
+/**
+ * @package     MokoWaaS
+ * @subpackage  com_mokowaas
+ * @copyright   Copyright (C) 2026 Moko Consulting. All rights reserved.
+ * @license     GNU General Public License version 3 or later; see LICENSE
+ */
+
+namespace Moko\Component\MokoWaaS\Api\Controller;
+
+defined('_JEXEC') or die;
+
+use Joomla\CMS\Factory;
+use Joomla\CMS\MVC\Controller\BaseController;
+
+/**
+ * Content sync receiver API controller (target side).
+ *
+ * POST /api/index.php/v1/mokowaas/sync-receive
+ *
+ * Accepts a JSON payload from a source site and applies the content locally.
+ *
+ * @since  02.21.00
+ */
+class SyncReceiveController extends BaseController
+{
+	public function execute(): void
+	{
+		$app = Factory::getApplication();
+
+		if ($app->input->getMethod() !== 'POST')
+		{
+			$this->sendJson(405, ['error' => 'POST required']);
+			return;
+		}
+
+		$user = $app->getIdentity();
+
+		if (!$user->authorise('core.manage', 'com_plugins'))
+		{
+			$this->sendJson(403, ['error' => 'Not authorized']);
+			return;
+		}
+
+		try
+		{
+			$payload = json_decode($app->input->json->getRaw(), true);
+
+			if (empty($payload['mokowaas_sync']))
+			{
+				$this->sendJson(400, ['error' => 'Invalid payload — missing mokowaas_sync version']);
+				return;
+			}
+
+			$serviceFile = JPATH_PLUGINS . '/system/mokowaas/Service/ContentSyncReceiver.php';
+			require_once $serviceFile;
+
+			$receiver = new \Moko\Plugin\System\MokoWaaS\Service\ContentSyncReceiver();
+			$result   = $receiver->receive($payload);
+
+			$this->sendJson(200, $result);
+		}
+		catch (\Throwable $e)
+		{
+			$this->sendJson(500, ['error' => 'Sync receive failed', 'message' => $e->getMessage()]);
+		}
+	}
+
+	private function sendJson(int $code, array $payload): void
+	{
+		$app = Factory::getApplication();
+		$app->setHeader('Content-Type', 'application/json', true);
+		$app->setHeader('Status', (string) $code, true);
+		echo json_encode($payload, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES | JSON_PRETTY_PRINT);
+		$app->close();
+	}
+}
@@ -7,7 +7,7 @@
 	<license>GPL-3.0-or-later</license>
 	<authorEmail>hello@mokoconsulting.tech</authorEmail>
 	<authorUrl>https://mokoconsulting.tech</authorUrl>
-	<version>02.05.00</version>
+	<version>02.26.01-dev</version>
 	<description>Minimal API-only component for MokoWaaS. Provides REST endpoints for site health, cache, updates, and backups.</description>
 	<namespace path="api/src">Moko\Component\MokoWaaS\Api</namespace>
 	<administration>
@@ -7,7 +7,7 @@
 * FILE INFORMATION
 * DEFGROUP: Joomla.Plugin
 * INGROUP: MokoWaaS
- * VERSION: 02.01.08
+ * VERSION: 02.26.01
 * PATH: /src/Field/AllowedIpsField.php
 * BRIEF: Custom form field that displays the current IP whitelist
 */
@@ -0,0 +1,63 @@
+<?php
+/**
+ * @package     MokoWaaS
+ * @subpackage  plg_system_mokowaas
+ * @copyright   Copyright (C) 2026 Moko Consulting. All rights reserved.
+ * @license     GNU General Public License version 3 or later; see LICENSE
+ *
+ * FILE INFORMATION
+ * DEFGROUP: Joomla.Plugin
+ * INGROUP: MokoWaaS
+ * VERSION: 02.26.01
+ * PATH: /src/Field/CopyableTokenField.php
+ * BRIEF: Read-only token field with a copy-to-clipboard button
+ */
+
+namespace Moko\Plugin\System\MokoWaaS\Field;
+
+defined('_JEXEC') or die;
+
+use Joomla\CMS\Form\FormField;
+
+/**
+ * Renders a read-only text input with a "Copy" button, similar to
+ * Joomla's API token field in the user profile.
+ *
+ * @since  02.25.00
+ */
+class CopyableTokenField extends FormField
+{
+	protected $type = 'CopyableToken';
+
+	protected function getInput()
+	{
+		$value = htmlspecialchars($this->value ?? '', ENT_QUOTES, 'UTF-8');
+		$id    = $this->id;
+
+		if (empty($this->value))
+		{
+			return '<div class="alert alert-warning mb-0 py-2">Token will be generated automatically on first save.</div>';
+		}
+
+		return <<<HTML
+<div class="input-group">
+	<input type="text" id="{$id}" name="{$this->name}" value="{$value}"
+		class="form-control" readonly="readonly" style="font-family:monospace;font-size:0.85em" />
+	<button type="button" class="btn btn-outline-secondary" onclick="
+		var inp = document.getElementById('{$id}');
+		if (navigator.clipboard) {
+			navigator.clipboard.writeText(inp.value).then(function() {
+				var btn = inp.nextElementSibling;
+				var orig = btn.innerHTML;
+				btn.innerHTML = '<span class=&quot;icon-check&quot; aria-hidden=&quot;true&quot;></span> Copied';
+				btn.classList.replace('btn-outline-secondary','btn-success');
+				setTimeout(function(){ btn.innerHTML = orig; btn.classList.replace('btn-success','btn-outline-secondary'); }, 2000);
+			});
+		} else {
+			inp.select(); document.execCommand('copy');
+		}
+	"><span class="icon-copy" aria-hidden="true"></span> Copy</button>
+</div>
+HTML;
+	}
+}
@@ -0,0 +1,40 @@
+<?php
+/**
+ * Copyright (C) 2025 Moko Consulting <hello@mokoconsulting.tech>
+ *
+ * SPDX-LICENSE-IDENTIFIER: GPL-3.0-or-later
+ *
+ * FILE INFORMATION
+ * DEFGROUP: Joomla.Plugin
+ * INGROUP: MokoWaaS
+ * VERSION: 02.26.01
+ * PATH: /src/Field/CurrentIpField.php
+ * BRIEF: Read-only field that displays the current user's IP address
+ */
+
+namespace Moko\Plugin\System\MokoWaaS\Field;
+
+defined('_JEXEC') or die;
+
+use Joomla\CMS\Form\FormField;
+
+class CurrentIpField extends FormField
+{
+	protected $type = 'CurrentIp';
+
+	protected function getInput()
+	{
+		$currentIp = $_SERVER['REMOTE_ADDR'] ?? 'unknown';
+
+		return '<div class="alert alert-info mb-0 py-2">'
+			. '<strong>Your current IP:</strong> '
+			. '<code>' . htmlspecialchars($currentIp) . '</code> '
+			. '<small class="text-muted">&mdash; add this to the table below to keep your session alive.</small>'
+			. '</div>';
+	}
+
+	protected function getLabel()
+	{
+		return '';
+	}
+}
@@ -0,0 +1,93 @@
+<?php
+/**
+ * @package     MokoWaaS
+ * @subpackage  plg_system_mokowaas
+ * @copyright   Copyright (C) 2026 Moko Consulting. All rights reserved.
+ * @license     GNU General Public License version 3 or later; see LICENSE
+ *
+ * FILE INFORMATION
+ * DEFGROUP: Joomla.Plugin
+ * INGROUP: MokoWaaS
+ * VERSION: 02.26.01
+ * PATH: /src/Field/NextResetField.php
+ * BRIEF: Read-only field that displays the next scheduled reset in the site timezone
+ */
+
+namespace Moko\Plugin\System\MokoWaaS\Field;
+
+defined('_JEXEC') or die;
+
+use Joomla\CMS\Factory;
+use Joomla\CMS\Form\FormField;
+
+/**
+ * Displays the next scheduled demo reset as a formatted datetime
+ * in the Joomla site timezone with a relative "in X hours" suffix.
+ *
+ * @since  02.26.00
+ */
+class NextResetField extends FormField
+{
+	protected $type = 'NextReset';
+
+	protected function getInput()
+	{
+		if (empty($this->value))
+		{
+			return '<div class="alert alert-secondary mb-0 py-2">No reset scheduled — save the plugin config to calculate.</div>';
+		}
+
+		$utcTimestamp = strtotime($this->value);
+
+		if ($utcTimestamp === false || $utcTimestamp <= 0)
+		{
+			return '<div class="alert alert-warning mb-0 py-2">Invalid timestamp stored.</div>';
+		}
+
+		// Convert to site timezone
+		$siteTimezone = Factory::getApplication()->get('offset', 'UTC');
+
+		try
+		{
+			$dt = new \DateTime('@' . $utcTimestamp);
+			$dt->setTimezone(new \DateTimeZone($siteTimezone));
+			$formatted = $dt->format('l, F j, Y \a\t g:i A T');
+		}
+		catch (\Throwable $e)
+		{
+			$formatted = gmdate('Y-m-d H:i:s', $utcTimestamp) . ' UTC';
+		}
+
+		// Calculate relative time
+		$diff    = $utcTimestamp - time();
+		$relative = '';
+
+		if ($diff <= 0)
+		{
+			$relative = '<span class="badge bg-warning text-dark">overdue — save to recalculate</span>';
+		}
+		elseif ($diff < 3600)
+		{
+			$mins = (int) ceil($diff / 60);
+			$relative = '<span class="badge bg-info">in ' . $mins . ' minute' . ($mins !== 1 ? 's' : '') . '</span>';
+		}
+		elseif ($diff < 86400)
+		{
+			$hours = round($diff / 3600, 1);
+			$relative = '<span class="badge bg-info">in ' . $hours . ' hour' . ($hours != 1 ? 's' : '') . '</span>';
+		}
+		else
+		{
+			$days = round($diff / 86400, 1);
+			$relative = '<span class="badge bg-secondary">in ' . $days . ' day' . ($days != 1 ? 's' : '') . '</span>';
+		}
+
+		return '<div class="d-flex align-items-center gap-2">'
+			. '<span class="form-control-plaintext" style="font-weight:500">'
+			. '<span class="icon-calendar" aria-hidden="true"></span> '
+			. htmlspecialchars($formatted) . '</span> '
+			. $relative
+			. '<input type="hidden" name="' . $this->name . '" value="' . htmlspecialchars($this->value) . '" />'
+			. '</div>';
+	}
+}
@@ -0,0 +1,156 @@
+<?php
+/**
+ * @package     MokoWaaS
+ * @subpackage  plg_system_mokowaas
+ * @copyright   Copyright (C) 2026 Moko Consulting. All rights reserved.
+ * @license     GNU General Public License version 3 or later; see LICENSE
+ *
+ * FILE INFORMATION
+ * DEFGROUP: Joomla.Plugin
+ * INGROUP: MokoWaaS
+ * VERSION: 02.26.01
+ * PATH: /src/Field/SnapshotTablesField.php
+ * BRIEF: Multi-select list field that loads DB tables with sensible defaults
+ */
+
+namespace Moko\Plugin\System\MokoWaaS\Field;
+
+defined('_JEXEC') or die;
+
+use Joomla\CMS\Factory;
+use Joomla\CMS\Form\Field\ListField;
+use Joomla\CMS\HTML\HTMLHelper;
+
+/**
+ * Renders a multi-select list box of all Joomla database tables, with
+ * content-related tables pre-selected by default.
+ *
+ * @since  02.26.00
+ */
+class SnapshotTablesField extends ListField
+{
+	protected $type = 'SnapshotTables';
+
+	/**
+	 * Tables selected by default when no value is stored yet.
+	 *
+	 * @var    array
+	 * @since  02.25.00
+	 */
+	private const DEFAULT_TABLES = [
+		'#__content',
+		'#__categories',
+		'#__fields',
+		'#__fields_values',
+		'#__fields_groups',
+		'#__menu',
+		'#__menu_types',
+		'#__modules',
+		'#__modules_menu',
+		'#__users',
+		'#__user_usergroup_map',
+		'#__user_profiles',
+		'#__tags',
+		'#__contentitem_tag_map',
+		'#__assets',
+	];
+
+	/**
+	 * Table suffixes grouped by category for optgroup display.
+	 *
+	 * @var    array
+	 * @since  02.25.00
+	 */
+	private const TABLE_GROUPS = [
+		'Content'  => ['content', 'categories', 'fields', 'fields_values', 'fields_groups', 'tags', 'contentitem_tag_map', 'ucm_content', 'ucm_history'],
+		'Users'    => ['users', 'user_usergroup_map', 'user_profiles', 'usergroups', 'user_keys', 'user_mfa'],
+		'Menus'    => ['menu', 'menu_types'],
+		'Modules'  => ['modules', 'modules_menu'],
+		'Assets'   => ['assets'],
+	];
+
+	protected function getOptions()
+	{
+		$db     = Factory::getDbo();
+		$prefix = $db->getPrefix();
+		$tables = $db->getTableList();
+
+		$grouped = [];
+
+		foreach ($tables as $table)
+		{
+			if (strpos($table, $prefix) !== 0)
+			{
+				continue;
+			}
+
+			$suffix  = substr($table, strlen($prefix));
+			$logical = '#__' . $suffix;
+
+			$group = 'Other';
+
+			foreach (self::TABLE_GROUPS as $groupName => $patterns)
+			{
+				if (in_array($suffix, $patterns, true))
+				{
+					$group = $groupName;
+					break;
+				}
+			}
+
+			$grouped[$group][] = HTMLHelper::_('select.option', $logical, $logical);
+		}
+
+		// Build options with optgroups: priority groups first
+		$options  = [];
+		$priority = ['Content', 'Users', 'Menus', 'Modules', 'Assets'];
+
+		foreach ($priority as $g)
+		{
+			if (!empty($grouped[$g]))
+			{
+				$options[] = HTMLHelper::_('select.optgroup', '— ' . $g . ' —');
+
+				foreach ($grouped[$g] as $opt)
+				{
+					$options[] = $opt;
+				}
+
+				$options[] = HTMLHelper::_('select.optgroup', '— ' . $g . ' —');
+				unset($grouped[$g]);
+			}
+		}
+
+		if (!empty($grouped['Other']))
+		{
+			$options[] = HTMLHelper::_('select.optgroup', '— Other —');
+
+			foreach ($grouped['Other'] as $opt)
+			{
+				$options[] = $opt;
+			}
+
+			$options[] = HTMLHelper::_('select.optgroup', '— Other —');
+		}
+
+		return $options;
+	}
+
+	protected function getInput()
+	{
+		// If no value stored yet, use defaults
+		if ($this->value === null || $this->value === '')
+		{
+			$this->value = self::DEFAULT_TABLES;
+		}
+		elseif (is_string($this->value))
+		{
+			$this->value = array_filter(array_map('trim', explode("\n", $this->value)));
+		}
+
+		// Force multiple attribute
+		$this->__set('multiple', true);
+
+		return parent::getInput();
+	}
+}
@@ -0,0 +1,819 @@
+<?php
+/**
+ * @package     MokoWaaS
+ * @subpackage  plg_system_mokowaas
+ * @copyright   Copyright (C) 2026 Moko Consulting. All rights reserved.
+ * @license     GNU General Public License version 3 or later; see LICENSE
+ *
+ * FILE INFORMATION
+ * DEFGROUP: Joomla.Plugin
+ * INGROUP: MokoWaaS
+ * REPO: https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS
+ * PATH: /src/packages/plg_system_mokowaas/Service/ContentSyncReceiver.php
+ * VERSION: 02.26.01
+ * BRIEF: Receiver-side content sync — applies incoming payload to local DB
+ */
+
+namespace Moko\Plugin\System\MokoWaaS\Service;
+
+defined('_JEXEC') or die;
+
+use Joomla\CMS\Factory;
+use Joomla\CMS\Log\Log;
+
+/**
+ * Content Sync Receiver — applies incoming sync payload to the local site.
+ *
+ * Processes categories, articles, menu types, menu items, and modules
+ * from a JSON payload sent by a source MokoWaaS site. Content is matched
+ * by alias (upsert pattern): existing content is updated, new content
+ * is inserted.
+ *
+ * @since  02.21.00
+ */
+class ContentSyncReceiver
+{
+	/**
+	 * @var    \Joomla\Database\DatabaseInterface
+	 * @since  02.21.00
+	 */
+	private $db;
+
+	/**
+	 * Warnings collected during sync.
+	 *
+	 * @var    array
+	 * @since  02.21.00
+	 */
+	private array $warnings = [];
+
+	/**
+	 * Cache of resolved category paths → local IDs.
+	 *
+	 * @var    array
+	 * @since  02.21.00
+	 */
+	private array $catPathCache = [];
+
+	/**
+	 * Constructor.
+	 *
+	 * @param   \Joomla\Database\DatabaseInterface|null  $db  Database driver
+	 *
+	 * @since   02.21.00
+	 */
+	public function __construct($db = null)
+	{
+		$this->db = $db ?: Factory::getDbo();
+	}
+
+	/**
+	 * Process an incoming sync payload.
+	 *
+	 * @param   array  $payload  Decoded JSON payload from the source site
+	 *
+	 * @return  array  Result summary with per-type counts and warnings
+	 *
+	 * @since   02.21.00
+	 */
+	public function receive(array $payload): array
+	{
+		if (empty($payload['mokowaas_sync']))
+		{
+			return ['status' => 'error', 'message' => 'Invalid payload — missing mokowaas_sync version'];
+		}
+
+		$this->warnings = [];
+		$results = [];
+
+		// Apply in dependency order
+		try
+		{
+			$results['categories'] = $this->applyCategories($payload['categories'] ?? []);
+		}
+		catch (\Throwable $e)
+		{
+			$results['categories'] = ['error' => $e->getMessage()];
+			$this->warnings[] = 'Categories failed: ' . $e->getMessage();
+		}
+
+		try
+		{
+			$results['articles'] = $this->applyArticles($payload['articles'] ?? []);
+		}
+		catch (\Throwable $e)
+		{
+			$results['articles'] = ['error' => $e->getMessage()];
+			$this->warnings[] = 'Articles failed: ' . $e->getMessage();
+		}
+
+		try
+		{
+			$results['menu_types'] = $this->applyMenuTypes($payload['menu_types'] ?? []);
+		}
+		catch (\Throwable $e)
+		{
+			$results['menu_types'] = ['error' => $e->getMessage()];
+			$this->warnings[] = 'Menu types failed: ' . $e->getMessage();
+		}
+
+		try
+		{
+			$results['menu_items'] = $this->applyMenuItems($payload['menu_items'] ?? []);
+		}
+		catch (\Throwable $e)
+		{
+			$results['menu_items'] = ['error' => $e->getMessage()];
+			$this->warnings[] = 'Menu items failed: ' . $e->getMessage();
+		}
+
+		try
+		{
+			$results['modules'] = $this->applyModules($payload['modules'] ?? []);
+		}
+		catch (\Throwable $e)
+		{
+			$results['modules'] = ['error' => $e->getMessage()];
+			$this->warnings[] = 'Modules failed: ' . $e->getMessage();
+		}
+
+		Log::add(
+			sprintf('Content sync received from %s', $payload['source_site'] ?? 'unknown'),
+			Log::INFO,
+			'mokowaas'
+		);
+
+		return [
+			'status'      => 'ok',
+			'message'     => 'Sync applied',
+			'source_site' => $payload['source_site'] ?? '',
+			'results'     => $results,
+			'warnings'    => $this->warnings,
+		];
+	}
+
+	/**
+	 * Apply categories — sorted by path depth (shallow first).
+	 *
+	 * @param   array  $categories  Category data from payload
+	 *
+	 * @return  array  ['inserted' => N, 'updated' => N]
+	 *
+	 * @since   02.21.00
+	 */
+	private function applyCategories(array $categories): array
+	{
+		$db = $this->db;
+		$inserted = 0;
+		$updated  = 0;
+
+		// Sort by path depth — parents before children
+		usort($categories, function ($a, $b) {
+			return substr_count($a['path'], '/') - substr_count($b['path'], '/');
+		});
+
+		foreach ($categories as $cat)
+		{
+			$alias = $cat['alias'] ?? '';
+			$path  = $cat['path'] ?? $alias;
+
+			if (empty($alias) || !preg_match('/^[a-z0-9\-\/]+$/i', $path))
+			{
+				$this->warnings[] = 'Skipped category with invalid alias/path: ' . $alias;
+				continue;
+			}
+
+			// Resolve parent ID from path
+			$parentId = 1; // Root
+			$pathParts = explode('/', $path);
+
+			if (count($pathParts) > 1)
+			{
+				$parentPath = implode('/', array_slice($pathParts, 0, -1));
+				$parentId   = $this->resolveCategoryPath($parentPath);
+
+				if ($parentId === 0)
+				{
+					$this->warnings[] = 'Parent category not found for: ' . $path;
+					$parentId = 1;
+				}
+			}
+
+			// Check if category exists
+			$query = $db->getQuery(true)
+				->select($db->quoteName('id'))
+				->from($db->quoteName('#__categories'))
+				->where($db->quoteName('alias') . ' = ' . $db->quote($alias))
+				->where($db->quoteName('extension') . ' = ' . $db->quote('com_content'))
+				->where($db->quoteName('parent_id') . ' = ' . (int) $parentId);
+
+			$db->setQuery($query);
+			$existingId = (int) $db->loadResult();
+
+			$now = Factory::getDate()->toSql();
+
+			if ($existingId)
+			{
+				$query = $db->getQuery(true)
+					->update($db->quoteName('#__categories'))
+					->set($db->quoteName('title') . ' = ' . $db->quote($cat['title']))
+					->set($db->quoteName('description') . ' = ' . $db->quote($cat['description'] ?? ''))
+					->set($db->quoteName('published') . ' = ' . (int) ($cat['published'] ?? 1))
+					->set($db->quoteName('access') . ' = ' . (int) ($cat['access'] ?? 1))
+					->set($db->quoteName('language') . ' = ' . $db->quote($cat['language'] ?? '*'))
+					->set($db->quoteName('params') . ' = ' . $db->quote(json_encode($cat['params'] ?? new \stdClass)))
+					->set($db->quoteName('metadata') . ' = ' . $db->quote(json_encode($cat['metadata'] ?? new \stdClass)))
+					->set($db->quoteName('modified_time') . ' = ' . $db->quote($now))
+					->where($db->quoteName('id') . ' = ' . $existingId);
+
+				$db->setQuery($query);
+				$db->execute();
+				$updated++;
+
+				$this->catPathCache[$path] = $existingId;
+			}
+			else
+			{
+				$obj = (object) [
+					'title'         => $cat['title'],
+					'alias'         => $alias,
+					'path'          => $path,
+					'extension'     => 'com_content',
+					'description'   => $cat['description'] ?? '',
+					'published'     => (int) ($cat['published'] ?? 1),
+					'access'        => (int) ($cat['access'] ?? 1),
+					'language'      => $cat['language'] ?? '*',
+					'params'        => json_encode($cat['params'] ?? new \stdClass),
+					'metadata'      => json_encode($cat['metadata'] ?? new \stdClass),
+					'parent_id'     => $parentId,
+					'level'         => count($pathParts),
+					'lft'           => 0,
+					'rgt'           => 0,
+					'created_time'  => $now,
+					'modified_time' => $now,
+				];
+
+				$db->insertObject('#__categories', $obj, 'id');
+				$inserted++;
+
+				$this->catPathCache[$path] = (int) $obj->id;
+
+				// Rebuild category tree for this extension
+				$this->rebuildCategoryTree();
+			}
+		}
+
+		return ['inserted' => $inserted, 'updated' => $updated];
+	}
+
+	/**
+	 * Apply articles — resolve category by alias path, upsert by alias.
+	 *
+	 * @param   array  $articles  Article data from payload
+	 *
+	 * @return  array  ['inserted' => N, 'updated' => N]
+	 *
+	 * @since   02.21.00
+	 */
+	private function applyArticles(array $articles): array
+	{
+		$db = $this->db;
+		$inserted = 0;
+		$updated  = 0;
+
+		foreach ($articles as $article)
+		{
+			$alias = $article['alias'] ?? '';
+
+			if (empty($alias))
+			{
+				continue;
+			}
+
+			// Resolve category
+			$catPath = $article['catid_alias_path'] ?? 'uncategorised';
+			$catId   = $this->resolveCategoryPath($catPath);
+
+			if ($catId === 0)
+			{
+				$catId = 2; // Joomla's built-in Uncategorised
+				$this->warnings[] = 'Category "' . $catPath . '" not found for article "' . $alias . '" — assigned to Uncategorised';
+			}
+
+			// Check if article exists
+			$query = $db->getQuery(true)
+				->select($db->quoteName('id'))
+				->from($db->quoteName('#__content'))
+				->where($db->quoteName('alias') . ' = ' . $db->quote($alias));
+
+			$db->setQuery($query);
+			$existingId = (int) $db->loadResult();
+
+			$now = Factory::getDate()->toSql();
+
+			if ($existingId)
+			{
+				$query = $db->getQuery(true)
+					->update($db->quoteName('#__content'))
+					->set($db->quoteName('title') . ' = ' . $db->quote($article['title']))
+					->set($db->quoteName('introtext') . ' = ' . $db->quote($article['introtext'] ?? ''))
+					->set($db->quoteName('fulltext') . ' = ' . $db->quote($article['fulltext'] ?? ''))
+					->set($db->quoteName('state') . ' = ' . (int) ($article['state'] ?? 1))
+					->set($db->quoteName('catid') . ' = ' . $catId)
+					->set($db->quoteName('access') . ' = ' . (int) ($article['access'] ?? 1))
+					->set($db->quoteName('language') . ' = ' . $db->quote($article['language'] ?? '*'))
+					->set($db->quoteName('featured') . ' = ' . (int) ($article['featured'] ?? 0))
+					->set($db->quoteName('metadata') . ' = ' . $db->quote(json_encode($article['metadata'] ?? new \stdClass)))
+					->set($db->quoteName('attribs') . ' = ' . $db->quote(json_encode($article['attribs'] ?? new \stdClass)))
+					->set($db->quoteName('images') . ' = ' . $db->quote(json_encode($article['images'] ?? new \stdClass)))
+					->set($db->quoteName('urls') . ' = ' . $db->quote(json_encode($article['urls'] ?? new \stdClass)))
+					->set($db->quoteName('modified') . ' = ' . $db->quote($now))
+					->where($db->quoteName('id') . ' = ' . $existingId);
+
+				$db->setQuery($query);
+				$db->execute();
+				$updated++;
+			}
+			else
+			{
+				$obj = (object) [
+					'title'        => $article['title'],
+					'alias'        => $alias,
+					'introtext'    => $article['introtext'] ?? '',
+					'fulltext'     => $article['fulltext'] ?? '',
+					'state'        => (int) ($article['state'] ?? 1),
+					'catid'        => $catId,
+					'access'       => (int) ($article['access'] ?? 1),
+					'language'     => $article['language'] ?? '*',
+					'featured'     => (int) ($article['featured'] ?? 0),
+					'publish_up'   => $article['publish_up'] ?? $now,
+					'publish_down' => $article['publish_down'],
+					'metadata'     => json_encode($article['metadata'] ?? new \stdClass),
+					'attribs'      => json_encode($article['attribs'] ?? new \stdClass),
+					'images'       => json_encode($article['images'] ?? new \stdClass),
+					'urls'         => json_encode($article['urls'] ?? new \stdClass),
+					'created'      => $now,
+					'modified'     => $now,
+				];
+
+				$db->insertObject('#__content', $obj, 'id');
+				$inserted++;
+			}
+		}
+
+		return ['inserted' => $inserted, 'updated' => $updated];
+	}
+
+	/**
+	 * Apply menu types — insert if not exists.
+	 *
+	 * @param   array  $menuTypes  Menu type data from payload
+	 *
+	 * @return  array  ['inserted' => N, 'updated' => N]
+	 *
+	 * @since   02.21.00
+	 */
+	private function applyMenuTypes(array $menuTypes): array
+	{
+		$db = $this->db;
+		$inserted = 0;
+		$updated  = 0;
+
+		foreach ($menuTypes as $mt)
+		{
+			$menutype = $mt['menutype'] ?? '';
+
+			if (empty($menutype))
+			{
+				continue;
+			}
+
+			$query = $db->getQuery(true)
+				->select($db->quoteName('id'))
+				->from($db->quoteName('#__menu_types'))
+				->where($db->quoteName('menutype') . ' = ' . $db->quote($menutype));
+
+			$db->setQuery($query);
+
+			if ($db->loadResult())
+			{
+				$query = $db->getQuery(true)
+					->update($db->quoteName('#__menu_types'))
+					->set($db->quoteName('title') . ' = ' . $db->quote($mt['title'] ?? $menutype))
+					->set($db->quoteName('description') . ' = ' . $db->quote($mt['description'] ?? ''))
+					->where($db->quoteName('menutype') . ' = ' . $db->quote($menutype));
+
+				$db->setQuery($query);
+				$db->execute();
+				$updated++;
+			}
+			else
+			{
+				$obj = (object) [
+					'title'       => $mt['title'] ?? $menutype,
+					'menutype'    => $menutype,
+					'description' => $mt['description'] ?? '',
+				];
+
+				$db->insertObject('#__menu_types', $obj);
+				$inserted++;
+			}
+		}
+
+		return ['inserted' => $inserted, 'updated' => $updated];
+	}
+
+	/**
+	 * Apply menu items — resolve parent aliases and {catid:path} tokens.
+	 *
+	 * @param   array  $items  Menu item data from payload
+	 *
+	 * @return  array  ['inserted' => N, 'updated' => N]
+	 *
+	 * @since   02.21.00
+	 */
+	private function applyMenuItems(array $items): array
+	{
+		$db = $this->db;
+		$inserted = 0;
+		$updated  = 0;
+
+		// Sort: root items first, then children
+		usort($items, function ($a, $b) {
+			$aIsRoot = empty($a['parent_alias']);
+			$bIsRoot = empty($b['parent_alias']);
+
+			if ($aIsRoot && !$bIsRoot) return -1;
+			if (!$aIsRoot && $bIsRoot) return 1;
+
+			return 0;
+		});
+
+		// Resolve component IDs
+		$compQuery = $db->getQuery(true)
+			->select([$db->quoteName('extension_id'), $db->quoteName('element')])
+			->from($db->quoteName('#__extensions'))
+			->where($db->quoteName('type') . ' = ' . $db->quote('component'));
+		$db->setQuery($compQuery);
+		$compMap = [];
+
+		foreach ($db->loadAssocList() ?: [] as $c)
+		{
+			$compMap[$c['element']] = (int) $c['extension_id'];
+		}
+
+		foreach ($items as $item)
+		{
+			$alias    = $item['alias'] ?? '';
+			$menutype = $item['menutype'] ?? '';
+
+			if (empty($alias) || empty($menutype))
+			{
+				continue;
+			}
+
+			// Resolve parent
+			$parentId = 1; // Root menu item
+
+			if (!empty($item['parent_alias']))
+			{
+				$parentId = $this->resolveMenuAlias($menutype, $item['parent_alias']);
+
+				if ($parentId === 0)
+				{
+					$this->warnings[] = 'Parent menu item "' . $item['parent_alias'] . '" not found for "' . $alias . '"';
+					$parentId = 1;
+				}
+			}
+
+			// Resolve {catid:path} tokens in link
+			$link = $item['link'] ?? '';
+
+			if (preg_match_all('/\{catid:([^}]+)\}/', $link, $matches))
+			{
+				foreach ($matches[1] as $i => $catPath)
+				{
+					$localCatId = $this->resolveCategoryPath($catPath);
+
+					if ($localCatId > 0)
+					{
+						$link = str_replace($matches[0][$i], (string) $localCatId, $link);
+					}
+					else
+					{
+						$this->warnings[] = 'Could not resolve {catid:' . $catPath . '} in menu item "' . $alias . '"';
+						$link = str_replace($matches[0][$i], '0', $link);
+					}
+				}
+			}
+
+			$componentId = $compMap[$item['component_name'] ?? ''] ?? 0;
+
+			// Check if menu item exists
+			$query = $db->getQuery(true)
+				->select($db->quoteName('id'))
+				->from($db->quoteName('#__menu'))
+				->where($db->quoteName('alias') . ' = ' . $db->quote($alias))
+				->where($db->quoteName('menutype') . ' = ' . $db->quote($menutype))
+				->where($db->quoteName('client_id') . ' = 0');
+
+			$db->setQuery($query);
+			$existingId = (int) $db->loadResult();
+
+			if ($existingId)
+			{
+				$query = $db->getQuery(true)
+					->update($db->quoteName('#__menu'))
+					->set($db->quoteName('title') . ' = ' . $db->quote($item['title']))
+					->set($db->quoteName('link') . ' = ' . $db->quote($link))
+					->set($db->quoteName('type') . ' = ' . $db->quote($item['type'] ?? 'component'))
+					->set($db->quoteName('published') . ' = ' . (int) ($item['published'] ?? 1))
+					->set($db->quoteName('access') . ' = ' . (int) ($item['access'] ?? 1))
+					->set($db->quoteName('language') . ' = ' . $db->quote($item['language'] ?? '*'))
+					->set($db->quoteName('params') . ' = ' . $db->quote(json_encode($item['params'] ?? new \stdClass)))
+					->set($db->quoteName('parent_id') . ' = ' . $parentId)
+					->set($db->quoteName('component_id') . ' = ' . $componentId)
+					->set($db->quoteName('home') . ' = ' . (int) ($item['home'] ?? 0))
+					->where($db->quoteName('id') . ' = ' . $existingId);
+
+				$db->setQuery($query);
+				$db->execute();
+				$updated++;
+			}
+			else
+			{
+				$obj = (object) [
+					'menutype'     => $menutype,
+					'title'        => $item['title'],
+					'alias'        => $alias,
+					'path'         => $alias,
+					'link'         => $link,
+					'type'         => $item['type'] ?? 'component',
+					'published'    => (int) ($item['published'] ?? 1),
+					'parent_id'    => $parentId,
+					'level'        => $parentId <= 1 ? 1 : 2,
+					'component_id' => $componentId,
+					'access'       => (int) ($item['access'] ?? 1),
+					'language'     => $item['language'] ?? '*',
+					'params'       => json_encode($item['params'] ?? new \stdClass),
+					'home'         => (int) ($item['home'] ?? 0),
+					'client_id'    => 0,
+					'lft'          => 0,
+					'rgt'          => 0,
+				];
+
+				$db->insertObject('#__menu', $obj, 'id');
+				$inserted++;
+			}
+		}
+
+		// Rebuild menu tree for each affected menutype
+		$affectedMenuTypes = array_unique(array_column($items, 'menutype'));
+
+		foreach ($affectedMenuTypes as $mt)
+		{
+			$this->rebuildMenuTree($mt);
+		}
+
+		return ['inserted' => $inserted, 'updated' => $updated];
+	}
+
+	/**
+	 * Apply modules — upsert by title+position+client_id, rebuild menu assignments.
+	 *
+	 * @param   array  $modules  Module data from payload
+	 *
+	 * @return  array  ['inserted' => N, 'updated' => N]
+	 *
+	 * @since   02.21.00
+	 */
+	private function applyModules(array $modules): array
+	{
+		$db = $this->db;
+		$inserted = 0;
+		$updated  = 0;
+
+		foreach ($modules as $mod)
+		{
+			$title    = $mod['title'] ?? '';
+			$position = $mod['position'] ?? '';
+			$clientId = (int) ($mod['client_id'] ?? 0);
+
+			if (empty($title))
+			{
+				continue;
+			}
+
+			// Check existence by title + position + client_id
+			$query = $db->getQuery(true)
+				->select($db->quoteName('id'))
+				->from($db->quoteName('#__modules'))
+				->where($db->quoteName('title') . ' = ' . $db->quote($title))
+				->where($db->quoteName('position') . ' = ' . $db->quote($position))
+				->where($db->quoteName('client_id') . ' = ' . $clientId);
+
+			$db->setQuery($query);
+			$existingId = (int) $db->loadResult();
+
+			if ($existingId)
+			{
+				$query = $db->getQuery(true)
+					->update($db->quoteName('#__modules'))
+					->set($db->quoteName('module') . ' = ' . $db->quote($mod['module'] ?? ''))
+					->set($db->quoteName('content') . ' = ' . $db->quote($mod['content'] ?? ''))
+					->set($db->quoteName('published') . ' = ' . (int) ($mod['published'] ?? 1))
+					->set($db->quoteName('access') . ' = ' . (int) ($mod['access'] ?? 1))
+					->set($db->quoteName('language') . ' = ' . $db->quote($mod['language'] ?? '*'))
+					->set($db->quoteName('params') . ' = ' . $db->quote(json_encode($mod['params'] ?? new \stdClass)))
+					->where($db->quoteName('id') . ' = ' . $existingId);
+
+				$db->setQuery($query);
+				$db->execute();
+				$updated++;
+
+				$moduleId = $existingId;
+			}
+			else
+			{
+				$obj = (object) [
+					'title'     => $title,
+					'module'    => $mod['module'] ?? '',
+					'position'  => $position,
+					'content'   => $mod['content'] ?? '',
+					'published' => (int) ($mod['published'] ?? 1),
+					'access'    => (int) ($mod['access'] ?? 1),
+					'language'  => $mod['language'] ?? '*',
+					'params'    => json_encode($mod['params'] ?? new \stdClass),
+					'client_id' => $clientId,
+					'ordering'  => 0,
+				];
+
+				$db->insertObject('#__modules', $obj, 'id');
+				$inserted++;
+				$moduleId = (int) $obj->id;
+			}
+
+			// Rebuild menu assignments
+			$query = $db->getQuery(true)
+				->delete($db->quoteName('#__modules_menu'))
+				->where($db->quoteName('moduleid') . ' = ' . $moduleId);
+			$db->setQuery($query);
+			$db->execute();
+
+			$assignment = $mod['menu_assignment'] ?? [];
+			$assignType = (int) ($assignment['assignment'] ?? 0);
+			$aliases    = $assignment['menu_item_aliases'] ?? [];
+
+			if ($assignType === 0 || empty($aliases))
+			{
+				// All pages
+				$obj = (object) ['moduleid' => $moduleId, 'menuid' => 0];
+				$db->insertObject('#__modules_menu', $obj);
+			}
+			else
+			{
+				foreach ($aliases as $aliasRef)
+				{
+					// Format: "menutype:alias"
+					$parts = explode(':', $aliasRef, 2);
+
+					if (count($parts) !== 2)
+					{
+						continue;
+					}
+
+					$menuId = $this->resolveMenuAlias($parts[0], $parts[1]);
+
+					if ($menuId > 0)
+					{
+						$menuidValue = $assignType === -1 ? -$menuId : $menuId;
+						$obj = (object) ['moduleid' => $moduleId, 'menuid' => $menuidValue];
+						$db->insertObject('#__modules_menu', $obj);
+					}
+					else
+					{
+						$this->warnings[] = 'Module "' . $title . '": menu item "' . $aliasRef . '" not found';
+					}
+				}
+			}
+		}
+
+		return ['inserted' => $inserted, 'updated' => $updated];
+	}
+
+	/**
+	 * Resolve a category alias path to a local category ID.
+	 *
+	 * @param   string  $path  Slash-delimited alias path (e.g. "blog/news")
+	 *
+	 * @return  int  Category ID, or 0 if not found
+	 *
+	 * @since   02.21.00
+	 */
+	private function resolveCategoryPath(string $path): int
+	{
+		if (isset($this->catPathCache[$path]))
+		{
+			return $this->catPathCache[$path];
+		}
+
+		$db       = $this->db;
+		$segments = explode('/', $path);
+		$parentId = 1;
+
+		foreach ($segments as $segment)
+		{
+			$query = $db->getQuery(true)
+				->select($db->quoteName('id'))
+				->from($db->quoteName('#__categories'))
+				->where($db->quoteName('alias') . ' = ' . $db->quote($segment))
+				->where($db->quoteName('parent_id') . ' = ' . $parentId)
+				->where($db->quoteName('extension') . ' = ' . $db->quote('com_content'));
+
+			$db->setQuery($query);
+			$id = (int) $db->loadResult();
+
+			if ($id === 0)
+			{
+				$this->catPathCache[$path] = 0;
+
+				return 0;
+			}
+
+			$parentId = $id;
+		}
+
+		$this->catPathCache[$path] = $parentId;
+
+		return $parentId;
+	}
+
+	/**
+	 * Resolve a menu item alias to a local menu ID.
+	 *
+	 * @param   string  $menutype  Menu type key
+	 * @param   string  $alias     Menu item alias
+	 *
+	 * @return  int  Menu item ID, or 0 if not found
+	 *
+	 * @since   02.21.00
+	 */
+	private function resolveMenuAlias(string $menutype, string $alias): int
+	{
+		$db    = $this->db;
+		$query = $db->getQuery(true)
+			->select($db->quoteName('id'))
+			->from($db->quoteName('#__menu'))
+			->where($db->quoteName('alias') . ' = ' . $db->quote($alias))
+			->where($db->quoteName('menutype') . ' = ' . $db->quote($menutype))
+			->where($db->quoteName('client_id') . ' = 0');
+
+		$db->setQuery($query);
+
+		return (int) $db->loadResult();
+	}
+
+	/**
+	 * Rebuild the nested set (lft/rgt) for the category tree.
+	 *
+	 * Uses Joomla's built-in Table rebuild method.
+	 *
+	 * @return  void
+	 *
+	 * @since   02.21.00
+	 */
+	private function rebuildCategoryTree(): void
+	{
+		try
+		{
+			$table = \Joomla\CMS\Table\Table::getInstance('Category');
+			$table->rebuild();
+		}
+		catch (\Throwable $e)
+		{
+			$this->warnings[] = 'Category tree rebuild failed: ' . $e->getMessage();
+		}
+	}
+
+	/**
+	 * Rebuild the nested set (lft/rgt) for a menu type.
+	 *
+	 * @param   string  $menutype  Menu type to rebuild
+	 *
+	 * @return  void
+	 *
+	 * @since   02.21.00
+	 */
+	private function rebuildMenuTree(string $menutype): void
+	{
+		try
+		{
+			$table = \Joomla\CMS\Table\Table::getInstance('Menu');
+			$table->rebuild();
+		}
+		catch (\Throwable $e)
+		{
+			$this->warnings[] = 'Menu tree rebuild failed for "' . $menutype . '": ' . $e->getMessage();
+		}
+	}
+}
@@ -0,0 +1,634 @@
+<?php
+/**
+ * @package     MokoWaaS
+ * @subpackage  plg_system_mokowaas
+ * @copyright   Copyright (C) 2026 Moko Consulting. All rights reserved.
+ * @license     GNU General Public License version 3 or later; see LICENSE
+ *
+ * FILE INFORMATION
+ * DEFGROUP: Joomla.Plugin
+ * INGROUP: MokoWaaS
+ * REPO: https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS
+ * PATH: /src/packages/plg_system_mokowaas/Service/ContentSyncService.php
+ * VERSION: 02.26.01
+ * BRIEF: Sender-side content sync — builds payload and pushes to remote sites
+ */
+
+namespace Moko\Plugin\System\MokoWaaS\Service;
+
+defined('_JEXEC') or die;
+
+use Joomla\CMS\Factory;
+use Joomla\CMS\Log\Log;
+use Joomla\CMS\Uri\Uri;
+
+/**
+ * Content Sync Service — builds a JSON payload of site content and pushes
+ * it to one or more remote MokoWaaS sites.
+ *
+ * Content is matched by alias on the receiving end (upsert-by-alias).
+ * Category IDs in menu item links are encoded as {catid:alias/path} tokens
+ * so the receiver can resolve them to local IDs.
+ *
+ * @since  02.21.00
+ */
+class ContentSyncService
+{
+	/**
+	 * Maximum items per content type to prevent unbounded memory.
+	 *
+	 * @var    int
+	 * @since  02.21.00
+	 */
+	private const MAX_ITEMS = 2000;
+
+	/**
+	 * HTTP timeout for push requests in seconds.
+	 *
+	 * @var    int
+	 * @since  02.21.00
+	 */
+	private const HTTP_TIMEOUT = 60;
+
+	/**
+	 * @var    \Joomla\Database\DatabaseInterface
+	 * @since  02.21.00
+	 */
+	private $db;
+
+	/**
+	 * Category ID → alias path map cache.
+	 *
+	 * @var    array
+	 * @since  02.21.00
+	 */
+	private array $catPathMap = [];
+
+	/**
+	 * Constructor.
+	 *
+	 * @param   \Joomla\Database\DatabaseInterface|null  $db  Database driver
+	 *
+	 * @since   02.21.00
+	 */
+	public function __construct($db = null)
+	{
+		$this->db = $db ?: Factory::getDbo();
+	}
+
+	/**
+	 * Build the full sync payload from local content.
+	 *
+	 * @return  array  Structured payload ready for JSON encoding
+	 *
+	 * @since   02.21.00
+	 */
+	public function buildPayload(): array
+	{
+		$this->catPathMap = $this->buildCategoryPathMap();
+
+		return [
+			'mokowaas_sync' => '1.0',
+			'source_site'   => rtrim(Uri::root(), '/'),
+			'generated_at'  => gmdate('Y-m-d\TH:i:s\Z'),
+			'categories'    => $this->buildCategoryPayload(),
+			'articles'      => $this->buildArticlePayload(),
+			'menu_types'    => $this->buildMenuTypePayload(),
+			'menu_items'    => $this->buildMenuItemPayload(),
+			'modules'       => $this->buildModulePayload(),
+		];
+	}
+
+	/**
+	 * Push the sync payload to a single target site.
+	 *
+	 * @param   string  $targetUrl  Base URL of the target site
+	 * @param   string  $token      health_api_token for the target
+	 *
+	 * @return  array  Result with status, message, and per-type counts
+	 *
+	 * @since   02.21.00
+	 */
+	public function pushToTarget(string $targetUrl, string $token): array
+	{
+		$payload  = $this->buildPayload();
+		$jsonBody = json_encode($payload, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE);
+		$endpoint = rtrim($targetUrl, '/') . '/?mokowaas=sync-receive';
+
+		$context = stream_context_create([
+			'http' => [
+				'method'        => 'POST',
+				'header'        => "Authorization: Bearer {$token}\r\nContent-Type: application/json\r\n",
+				'content'       => $jsonBody,
+				'timeout'       => self::HTTP_TIMEOUT,
+				'ignore_errors' => true,
+			],
+			'ssl' => [
+				'verify_peer'      => false,
+				'verify_peer_name' => false,
+			],
+		]);
+
+		$response = @file_get_contents($endpoint, false, $context);
+
+		if ($response === false)
+		{
+			return [
+				'status'  => 'error',
+				'target'  => $targetUrl,
+				'message' => 'Connection failed — target unreachable',
+			];
+		}
+
+		// Parse HTTP status from response headers
+		$httpCode = 0;
+
+		if (isset($http_response_header[0]))
+		{
+			preg_match('/\d{3}/', $http_response_header[0], $matches);
+			$httpCode = (int) ($matches[0] ?? 0);
+		}
+
+		$result = json_decode($response, true);
+
+		if ($httpCode >= 400 || !$result)
+		{
+			return [
+				'status'    => 'error',
+				'target'    => $targetUrl,
+				'http_code' => $httpCode,
+				'message'   => $result['error'] ?? $result['message'] ?? 'Unknown error from target',
+			];
+		}
+
+		$result['target'] = $targetUrl;
+
+		return $result;
+	}
+
+	/**
+	 * Push content to all configured sync targets.
+	 *
+	 * @param   array  $targets  Array of ['url' => ..., 'token' => ..., 'label' => ...]
+	 *
+	 * @return  array  Per-target results
+	 *
+	 * @since   02.21.00
+	 */
+	public function syncAllTargets(array $targets): array
+	{
+		$results = [];
+
+		foreach ($targets as $target)
+		{
+			$url   = $target['url'] ?? '';
+			$token = $target['token'] ?? '';
+			$label = $target['label'] ?? $url;
+
+			if (empty($url) || empty($token))
+			{
+				$results[] = [
+					'status'  => 'skipped',
+					'target'  => $label,
+					'message' => 'Missing URL or token',
+				];
+				continue;
+			}
+
+			try
+			{
+				$result = $this->pushToTarget($url, $token);
+				$result['label'] = $label;
+				$results[] = $result;
+			}
+			catch (\Throwable $e)
+			{
+				$results[] = [
+					'status'  => 'error',
+					'target'  => $label,
+					'message' => $e->getMessage(),
+				];
+			}
+		}
+
+		Log::add(
+			sprintf('Content sync pushed to %d target(s)', count($targets)),
+			Log::INFO,
+			'mokowaas'
+		);
+
+		return [
+			'status'  => 'ok',
+			'message' => sprintf('Sync completed for %d target(s)', count($results)),
+			'targets' => $results,
+		];
+	}
+
+	/**
+	 * Build category ID → alias path map.
+	 *
+	 * @return  array  [id => 'parent-alias/child-alias']
+	 *
+	 * @since   02.21.00
+	 */
+	private function buildCategoryPathMap(): array
+	{
+		$db    = $this->db;
+		$query = $db->getQuery(true)
+			->select([$db->quoteName('id'), $db->quoteName('alias'), $db->quoteName('parent_id')])
+			->from($db->quoteName('#__categories'))
+			->where($db->quoteName('extension') . ' = ' . $db->quote('com_content'))
+			->where($db->quoteName('published') . ' != -2')
+			->where($db->quoteName('id') . ' > 1');
+
+		$db->setQuery($query);
+		$rows = $db->loadAssocList('id');
+
+		$map = [];
+
+		foreach ($rows as $id => $row)
+		{
+			$map[$id] = $this->resolvePathFromRows($id, $rows);
+		}
+
+		return $map;
+	}
+
+	/**
+	 * Recursively build alias path for a category ID.
+	 *
+	 * @param   int    $id    Category ID
+	 * @param   array  $rows  All category rows keyed by ID
+	 *
+	 * @return  string  Slash-delimited alias path
+	 *
+	 * @since   02.21.00
+	 */
+	private function resolvePathFromRows(int $id, array $rows): string
+	{
+		if (!isset($rows[$id]))
+		{
+			return '';
+		}
+
+		$row = $rows[$id];
+		$parentId = (int) $row['parent_id'];
+
+		if ($parentId <= 1 || !isset($rows[$parentId]))
+		{
+			return $row['alias'];
+		}
+
+		return $this->resolvePathFromRows($parentId, $rows) . '/' . $row['alias'];
+	}
+
+	/**
+	 * Build category payload.
+	 *
+	 * @return  array
+	 *
+	 * @since   02.21.00
+	 */
+	private function buildCategoryPayload(): array
+	{
+		$db    = $this->db;
+		$query = $db->getQuery(true)
+			->select([
+				$db->quoteName('id'),
+				$db->quoteName('title'),
+				$db->quoteName('alias'),
+				$db->quoteName('description'),
+				$db->quoteName('published'),
+				$db->quoteName('access'),
+				$db->quoteName('language'),
+				$db->quoteName('params'),
+				$db->quoteName('metadata'),
+			])
+			->from($db->quoteName('#__categories'))
+			->where($db->quoteName('extension') . ' = ' . $db->quote('com_content'))
+			->where($db->quoteName('published') . ' != -2')
+			->where($db->quoteName('id') . ' > 1')
+			->order($db->quoteName('lft') . ' ASC')
+			->setLimit(self::MAX_ITEMS);
+
+		$db->setQuery($query);
+		$rows = $db->loadAssocList();
+
+		$categories = [];
+
+		foreach ($rows as $row)
+		{
+			$categories[] = [
+				'title'       => $row['title'],
+				'alias'       => $row['alias'],
+				'path'        => $this->catPathMap[(int) $row['id']] ?? $row['alias'],
+				'description' => $row['description'] ?? '',
+				'published'   => (int) $row['published'],
+				'access'      => (int) $row['access'],
+				'language'    => $row['language'],
+				'params'      => json_decode($row['params'] ?: '{}', true),
+				'metadata'    => json_decode($row['metadata'] ?: '{}', true),
+			];
+		}
+
+		return $categories;
+	}
+
+	/**
+	 * Build article payload.
+	 *
+	 * @return  array
+	 *
+	 * @since   02.21.00
+	 */
+	private function buildArticlePayload(): array
+	{
+		$db    = $this->db;
+		$query = $db->getQuery(true)
+			->select([
+				$db->quoteName('title'),
+				$db->quoteName('alias'),
+				$db->quoteName('introtext'),
+				$db->quoteName('fulltext'),
+				$db->quoteName('state'),
+				$db->quoteName('catid'),
+				$db->quoteName('access'),
+				$db->quoteName('language'),
+				$db->quoteName('featured'),
+				$db->quoteName('publish_up'),
+				$db->quoteName('publish_down'),
+				$db->quoteName('metadata'),
+				$db->quoteName('attribs'),
+				$db->quoteName('images'),
+				$db->quoteName('urls'),
+			])
+			->from($db->quoteName('#__content'))
+			->where($db->quoteName('state') . ' != -2')
+			->order($db->quoteName('id') . ' ASC')
+			->setLimit(self::MAX_ITEMS);
+
+		$db->setQuery($query);
+		$rows = $db->loadAssocList();
+
+		$articles = [];
+
+		foreach ($rows as $row)
+		{
+			$articles[] = [
+				'title'            => $row['title'],
+				'alias'            => $row['alias'],
+				'introtext'        => $row['introtext'],
+				'fulltext'         => $row['fulltext'],
+				'state'            => (int) $row['state'],
+				'catid_alias_path' => $this->catPathMap[(int) $row['catid']] ?? 'uncategorised',
+				'access'           => (int) $row['access'],
+				'language'         => $row['language'],
+				'featured'         => (int) $row['featured'],
+				'publish_up'       => $row['publish_up'],
+				'publish_down'     => $row['publish_down'],
+				'metadata'         => json_decode($row['metadata'] ?: '{}', true),
+				'attribs'          => json_decode($row['attribs'] ?: '{}', true),
+				'images'           => json_decode($row['images'] ?: '{}', true),
+				'urls'             => json_decode($row['urls'] ?: '{}', true),
+			];
+		}
+
+		return $articles;
+	}
+
+	/**
+	 * Build menu type payload.
+	 *
+	 * @return  array
+	 *
+	 * @since   02.21.00
+	 */
+	private function buildMenuTypePayload(): array
+	{
+		$db    = $this->db;
+		$query = $db->getQuery(true)
+			->select([
+				$db->quoteName('title'),
+				$db->quoteName('menutype'),
+				$db->quoteName('description'),
+			])
+			->from($db->quoteName('#__menu_types'));
+
+		$db->setQuery($query);
+
+		return $db->loadAssocList() ?: [];
+	}
+
+	/**
+	 * Build menu item payload with {catid:path} tokens in links.
+	 *
+	 * @return  array
+	 *
+	 * @since   02.21.00
+	 */
+	private function buildMenuItemPayload(): array
+	{
+		$db    = $this->db;
+		$query = $db->getQuery(true)
+			->select([
+				$db->quoteName('a.title'),
+				$db->quoteName('a.alias'),
+				$db->quoteName('a.menutype'),
+				$db->quoteName('a.parent_id'),
+				$db->quoteName('a.link'),
+				$db->quoteName('a.type'),
+				$db->quoteName('a.published'),
+				$db->quoteName('a.access'),
+				$db->quoteName('a.language'),
+				$db->quoteName('a.params'),
+				$db->quoteName('a.home'),
+				$db->quoteName('a.component_id'),
+				$db->quoteName('b.alias', 'parent_alias'),
+			])
+			->from($db->quoteName('#__menu', 'a'))
+			->leftJoin(
+				$db->quoteName('#__menu', 'b') . ' ON '
+				. $db->quoteName('a.parent_id') . ' = ' . $db->quoteName('b.id')
+			)
+			->where($db->quoteName('a.published') . ' != -2')
+			->where($db->quoteName('a.client_id') . ' = 0')
+			->where($db->quoteName('a.level') . ' >= 1')
+			->order($db->quoteName('a.lft') . ' ASC')
+			->setLimit(self::MAX_ITEMS);
+
+		$db->setQuery($query);
+		$rows = $db->loadAssocList();
+
+		// Get component name map
+		$compQuery = $db->getQuery(true)
+			->select([$db->quoteName('extension_id'), $db->quoteName('element')])
+			->from($db->quoteName('#__extensions'))
+			->where($db->quoteName('type') . ' = ' . $db->quote('component'));
+		$db->setQuery($compQuery);
+		$components = $db->loadAssocList('extension_id') ?: [];
+
+		$items = [];
+
+		foreach ($rows as $row)
+		{
+			$link = $row['link'];
+
+			// Encode category IDs in com_content links as {catid:path} tokens
+			if (preg_match('/option=com_content/', $link) && preg_match('/&id=(\d+)/', $link, $m))
+			{
+				$catId = (int) $m[1];
+
+				if (isset($this->catPathMap[$catId]))
+				{
+					$link = preg_replace('/&id=\d+/', '&id={catid:' . $this->catPathMap[$catId] . '}', $link);
+				}
+			}
+
+			$compName = '';
+
+			if (!empty($row['component_id']) && isset($components[$row['component_id']]))
+			{
+				$compName = $components[$row['component_id']]['element'];
+			}
+
+			// Root-level items have parent_id=1 (Joomla's root menu item)
+			$parentAlias = ((int) $row['parent_id'] <= 1) ? '' : ($row['parent_alias'] ?? '');
+
+			$items[] = [
+				'title'          => $row['title'],
+				'alias'          => $row['alias'],
+				'menutype'       => $row['menutype'],
+				'parent_alias'   => $parentAlias,
+				'link'           => $link,
+				'type'           => $row['type'],
+				'component_name' => $compName,
+				'published'      => (int) $row['published'],
+				'access'         => (int) $row['access'],
+				'language'       => $row['language'],
+				'params'         => json_decode($row['params'] ?: '{}', true),
+				'home'           => (int) $row['home'],
+			];
+		}
+
+		return $items;
+	}
+
+	/**
+	 * Build module payload with menu assignments.
+	 *
+	 * @return  array
+	 *
+	 * @since   02.21.00
+	 */
+	private function buildModulePayload(): array
+	{
+		$db    = $this->db;
+		$query = $db->getQuery(true)
+			->select([
+				$db->quoteName('id'),
+				$db->quoteName('title'),
+				$db->quoteName('module'),
+				$db->quoteName('position'),
+				$db->quoteName('content'),
+				$db->quoteName('published'),
+				$db->quoteName('access'),
+				$db->quoteName('language'),
+				$db->quoteName('params'),
+				$db->quoteName('client_id'),
+			])
+			->from($db->quoteName('#__modules'))
+			->where($db->quoteName('client_id') . ' = 0')
+			->where($db->quoteName('published') . ' != -2')
+			->order($db->quoteName('ordering') . ' ASC')
+			->setLimit(self::MAX_ITEMS);
+
+		$db->setQuery($query);
+		$rows = $db->loadAssocList();
+
+		// Get all module-menu assignments
+		$mmQuery = $db->getQuery(true)
+			->select([
+				$db->quoteName('mm.moduleid'),
+				$db->quoteName('mm.menuid'),
+				$db->quoteName('m.alias', 'menu_alias'),
+				$db->quoteName('m.menutype'),
+			])
+			->from($db->quoteName('#__modules_menu', 'mm'))
+			->leftJoin(
+				$db->quoteName('#__menu', 'm') . ' ON '
+				. $db->quoteName('mm.menuid') . ' = ' . $db->quoteName('m.id')
+			);
+		$db->setQuery($mmQuery);
+		$allAssignments = $db->loadAssocList();
+
+		// Group assignments by module ID
+		$assignmentsByModule = [];
+
+		foreach ($allAssignments as $a)
+		{
+			$assignmentsByModule[(int) $a['moduleid']][] = $a;
+		}
+
+		$modules = [];
+
+		foreach ($rows as $row)
+		{
+			$moduleId    = (int) $row['id'];
+			$assignments = $assignmentsByModule[$moduleId] ?? [];
+
+			// Determine assignment type: 0 = all pages, positive = selected, negative = excluded
+			$menuAliases  = [];
+			$assignType   = 0;
+
+			if (!empty($assignments))
+			{
+				$firstMenuId = (int) $assignments[0]['menuid'];
+
+				if ($firstMenuId === 0)
+				{
+					$assignType = 0; // All pages
+				}
+				elseif ($firstMenuId < 0)
+				{
+					$assignType = -1; // All except selected
+					foreach ($assignments as $a)
+					{
+						if (!empty($a['menu_alias']))
+						{
+							$menuAliases[] = $a['menutype'] . ':' . $a['menu_alias'];
+						}
+					}
+				}
+				else
+				{
+					$assignType = 1; // Selected only
+					foreach ($assignments as $a)
+					{
+						if (!empty($a['menu_alias']))
+						{
+							$menuAliases[] = $a['menutype'] . ':' . $a['menu_alias'];
+						}
+					}
+				}
+			}
+
+			$modules[] = [
+				'title'           => $row['title'],
+				'module'          => $row['module'],
+				'position'        => $row['position'],
+				'content'         => $row['content'],
+				'published'       => (int) $row['published'],
+				'access'          => (int) $row['access'],
+				'language'        => $row['language'],
+				'params'          => json_decode($row['params'] ?: '{}', true),
+				'client_id'       => (int) $row['client_id'],
+				'menu_assignment' => [
+					'assignment'        => $assignType,
+					'menu_item_aliases' => $menuAliases,
+				],
+			];
+		}
+
+		return $modules;
+	}
+}
@@ -0,0 +1,729 @@
+<?php
+/**
+ * @package     MokoWaaS
+ * @subpackage  plg_system_mokowaas
+ * @copyright   Copyright (C) 2026 Moko Consulting. All rights reserved.
+ * @license     GNU General Public License version 3 or later; see LICENSE
+ *
+ * FILE INFORMATION
+ * DEFGROUP: Joomla.Plugin
+ * INGROUP: MokoWaaS
+ * REPO: https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS
+ * PATH: /src/packages/plg_system_mokowaas/Service/DemoResetService.php
+ * VERSION: 02.26.01
+ * BRIEF: Core snapshot/restore service for demo site reset
+ */
+
+namespace Moko\Plugin\System\MokoWaaS\Service;
+
+defined('_JEXEC') or die;
+
+use Joomla\CMS\Factory;
+use Joomla\CMS\Log\Log;
+
+/**
+ * Demo Reset Service — manages baseline snapshots and restore operations.
+ *
+ * This is the single source of truth for all snapshot logic. Called by:
+ * - Admin one-shot toggles (onExtensionAfterSave)
+ * - Query-string API (?mokowaas=reset / ?mokowaas=snapshot)
+ * - REST API (/api/v1/mokowaas/reset, /api/v1/mokowaas/snapshot)
+ * - Joomla Scheduled Task (plg_task_mokowaasdemo)
+ *
+ * @since  02.21.00
+ */
+class DemoResetService
+{
+	/**
+	 * Maximum snapshot name length.
+	 *
+	 * @var    int
+	 * @since  02.21.00
+	 */
+	private const MAX_NAME_LENGTH = 64;
+
+	/**
+	 * Rows per batch for paginated table dump/restore.
+	 *
+	 * @var    int
+	 * @since  02.21.00
+	 */
+	private const BATCH_SIZE = 500;
+
+	/**
+	 * Default tables to snapshot if none configured.
+	 *
+	 * @var    array
+	 * @since  02.21.00
+	 */
+	private const DEFAULT_TABLES = [
+		'#__content',
+		'#__categories',
+		'#__fields',
+		'#__fields_values',
+		'#__fields_groups',
+		'#__menu',
+		'#__menu_types',
+		'#__modules',
+		'#__modules_menu',
+		'#__users',
+		'#__user_usergroup_map',
+		'#__user_profiles',
+		'#__tags',
+		'#__contentitem_tag_map',
+		'#__assets',
+	];
+
+	/**
+	 * Root directory for all snapshots.
+	 *
+	 * @var    string
+	 * @since  02.21.00
+	 */
+	private string $snapshotDir;
+
+	/**
+	 * Tables to include in snapshots.
+	 *
+	 * @var    array
+	 * @since  02.21.00
+	 */
+	private array $tables;
+
+	/**
+	 * Directories to include in media snapshot (e.g. ['images', 'media']).
+	 *
+	 * @var    array
+	 * @since  02.25.00
+	 */
+	private array $mediaDirs;
+
+	/**
+	 * Constructor.
+	 *
+	 * @param   array       $tables     Table names with #__ prefix
+	 * @param   array|bool  $mediaDirs  Dirs to snapshot: ['images','media'], true (= images), false/[] (= none)
+	 * @param   string      $baseDir    Override snapshot root (for testing)
+	 *
+	 * @since   02.21.00
+	 */
+	public function __construct(array $tables = [], $mediaDirs = ['images'], string $baseDir = '')
+	{
+		$this->tables      = !empty($tables) ? $tables : self::DEFAULT_TABLES;
+		$this->snapshotDir = $baseDir ?: JPATH_ROOT . '/mokowaas-snapshots';
+
+		if ($mediaDirs === true)
+		{
+			$this->mediaDirs = ['images'];
+		}
+		elseif ($mediaDirs === false || empty($mediaDirs))
+		{
+			$this->mediaDirs = [];
+		}
+		else
+		{
+			$this->mediaDirs = (array) $mediaDirs;
+		}
+	}
+
+	/**
+	 * List all available snapshots.
+	 *
+	 * @return  array  Array of manifest data keyed by snapshot name
+	 *
+	 * @since   02.21.00
+	 */
+	public function listSnapshots(): array
+	{
+		$snapshots = [];
+
+		if (!is_dir($this->snapshotDir))
+		{
+			return $snapshots;
+		}
+
+		$dirs = glob($this->snapshotDir . '/*/manifest.json');
+
+		foreach ($dirs as $manifestPath)
+		{
+			$data = json_decode(file_get_contents($manifestPath), true);
+
+			if ($data && isset($data['name']))
+			{
+				$snapshots[$data['name']] = $data;
+			}
+		}
+
+		return $snapshots;
+	}
+
+	/**
+	 * Create a named snapshot of the current site state.
+	 *
+	 * @param   string  $name  Snapshot name (alphanumeric, hyphens, underscores)
+	 *
+	 * @return  array  Result payload with status, tables count, size info
+	 *
+	 * @throws  \InvalidArgumentException  On invalid snapshot name
+	 * @throws  \RuntimeException          On filesystem/database failures
+	 *
+	 * @since   02.21.00
+	 */
+	public function createSnapshot(string $name): array
+	{
+		$this->validateSnapshotName($name);
+		$this->ensureSnapshotDir();
+
+		$path = $this->getSnapshotPath($name);
+
+		// Remove existing snapshot with the same name
+		if (is_dir($path))
+		{
+			$this->removeDirectory($path);
+		}
+
+		if (!mkdir($path, 0755, true))
+		{
+			throw new \RuntimeException('Failed to create snapshot directory: ' . $path);
+		}
+
+		$db     = Factory::getDbo();
+		$prefix = $db->getPrefix();
+		$tables = $db->getTableList();
+		$dumped = 0;
+
+		foreach ($this->tables as $tableName)
+		{
+			$realTable = str_replace('#__', $prefix, $tableName);
+
+			if (!in_array($realTable, $tables))
+			{
+				continue;
+			}
+
+			$this->dumpTable($tableName, $realTable, $path, $db);
+			$dumped++;
+		}
+
+		// Media snapshot — one ZIP per directory
+		$mediaDirs = [];
+
+		foreach ($this->mediaDirs as $dir)
+		{
+			$fullPath = JPATH_ROOT . '/' . $dir;
+
+			if (is_dir($fullPath))
+			{
+				$zipName = 'media_' . $dir . '.zip';
+
+				if ($this->snapshotDirectory($fullPath, $path . '/' . $zipName))
+				{
+					$mediaDirs[] = $dir;
+				}
+			}
+		}
+
+		// Write manifest
+		$manifest = [
+			'name'           => $name,
+			'created_at'     => gmdate('Y-m-d\TH:i:s\Z'),
+			'tables'         => $dumped,
+			'table_list'     => $this->tables,
+			'has_media'      => !empty($mediaDirs),
+			'media_dirs'     => $mediaDirs,
+			'joomla_version' => JVERSION,
+		];
+
+		file_put_contents(
+			$path . '/manifest.json',
+			json_encode($manifest, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES)
+		);
+
+		Log::add(
+			sprintf('Demo snapshot "%s" created (%d tables, media=%s)', $name, $dumped, $hasMedia ? 'yes' : 'no'),
+			Log::INFO,
+			'mokowaas'
+		);
+
+		return [
+			'status'    => 'ok',
+			'message'   => 'Snapshot created',
+			'name'      => $name,
+			'tables'    => $dumped,
+			'has_media' => $hasMedia,
+		];
+	}
+
+	/**
+	 * Restore the site to a named snapshot.
+	 *
+	 * @param   string  $name  Snapshot name to restore
+	 *
+	 * @return  array  Result payload
+	 *
+	 * @throws  \InvalidArgumentException  On invalid name
+	 * @throws  \RuntimeException          On missing snapshot or restore failure
+	 *
+	 * @since   02.21.00
+	 */
+	public function restoreSnapshot(string $name): array
+	{
+		$this->validateSnapshotName($name);
+
+		$path         = $this->getSnapshotPath($name);
+		$manifestFile = $path . '/manifest.json';
+
+		if (!file_exists($manifestFile))
+		{
+			throw new \RuntimeException('Snapshot not found: ' . $name);
+		}
+
+		$manifest = json_decode(file_get_contents($manifestFile), true);
+
+		if (!$manifest)
+		{
+			throw new \RuntimeException('Invalid manifest for snapshot: ' . $name);
+		}
+
+		// Clear Joomla cache before restore
+		try
+		{
+			$cache = Factory::getCache('');
+			$cache->clean('');
+		}
+		catch (\Throwable $e)
+		{
+			// Cache clear is best-effort
+		}
+
+		$db       = Factory::getDbo();
+		$prefix   = $db->getPrefix();
+		$restored = 0;
+
+		// Restore tables — assets first for ACL integrity
+		$sqlFiles = glob($path . '/*.sql');
+
+		// Sort: #__assets first
+		usort($sqlFiles, function ($a, $b) {
+			$aIsAssets = str_contains(basename($a), '__assets');
+			$bIsAssets = str_contains(basename($b), '__assets');
+
+			if ($aIsAssets) return -1;
+			if ($bIsAssets) return 1;
+
+			return strcmp($a, $b);
+		});
+
+		foreach ($sqlFiles as $sqlFile)
+		{
+			try
+			{
+				$this->restoreTable($sqlFile, $db, $prefix);
+				$restored++;
+			}
+			catch (\Throwable $e)
+			{
+				Log::add(
+					sprintf('Demo reset: failed to restore %s: %s', basename($sqlFile), $e->getMessage()),
+					Log::ERROR,
+					'mokowaas'
+				);
+			}
+		}
+
+		// Restore media directories
+		$mediaRestored = false;
+		$restoredDirs  = $manifest['media_dirs'] ?? [];
+
+		// Legacy support: old manifests used has_media=true with a single media.zip for /images/
+		if (empty($restoredDirs) && ($manifest['has_media'] ?? false))
+		{
+			$restoredDirs = ['images'];
+		}
+
+		foreach ($restoredDirs as $dir)
+		{
+			$zipName = 'media_' . $dir . '.zip';
+			$zipPath = $path . '/' . $zipName;
+
+			// Legacy fallback: old snapshots used media.zip for images
+			if (!file_exists($zipPath) && $dir === 'images' && file_exists($path . '/media.zip'))
+			{
+				$zipPath = $path . '/media.zip';
+			}
+
+			if (file_exists($zipPath))
+			{
+				$targetDir = JPATH_ROOT . '/' . $dir;
+				$this->clearDirectory($targetDir);
+
+				$zip = new \ZipArchive();
+
+				if ($zip->open($zipPath) === true)
+				{
+					$zip->extractTo($targetDir);
+					$zip->close();
+					$mediaRestored = true;
+				}
+			}
+		}
+
+		Log::add(
+			sprintf('Demo site reset to baseline "%s" (%d tables, media=%s)', $name, $restored, $mediaRestored ? 'yes' : 'no'),
+			Log::WARNING,
+			'mokowaas'
+		);
+
+		return [
+			'status'          => 'ok',
+			'message'         => 'Site restored to baseline: ' . $name,
+			'baseline'        => $name,
+			'restored_tables' => $restored,
+			'media_restored'  => $mediaRestored,
+		];
+	}
+
+	/**
+	 * Delete a named snapshot.
+	 *
+	 * @param   string  $name  Snapshot name
+	 *
+	 * @return  bool  True on success
+	 *
+	 * @since   02.21.00
+	 */
+	public function deleteSnapshot(string $name): bool
+	{
+		$this->validateSnapshotName($name);
+
+		$path = $this->getSnapshotPath($name);
+
+		if (!is_dir($path))
+		{
+			return false;
+		}
+
+		$this->removeDirectory($path);
+
+		Log::add(
+			sprintf('Demo snapshot "%s" deleted', $name),
+			Log::INFO,
+			'mokowaas'
+		);
+
+		return true;
+	}
+
+	/**
+	 * Dump a single table to a SQL file using paginated reads.
+	 *
+	 * @param   string                                 $logicalName  Table name with #__ prefix
+	 * @param   string                                 $realName     Actual table name with prefix
+	 * @param   string                                 $dir          Snapshot directory
+	 * @param   \Joomla\Database\DatabaseInterface     $db           Database driver
+	 *
+	 * @return  void
+	 *
+	 * @since   02.21.00
+	 */
+	private function dumpTable(string $logicalName, string $realName, string $dir, $db): void
+	{
+		$safeFileName = str_replace('#__', 'jml__', $logicalName);
+		$fp           = fopen($dir . '/' . $safeFileName . '.sql', 'w');
+
+		if ($fp === false)
+		{
+			throw new \RuntimeException('Cannot write dump file for: ' . $logicalName);
+		}
+
+		// Get column names for consistent INSERT statements
+		$columns = $db->getTableColumns($realName, false);
+		$colNames = array_keys($columns);
+		$quotedCols = array_map([$db, 'quoteName'], $colNames);
+		$colList = implode(', ', $quotedCols);
+
+		$offset = 0;
+
+		while (true)
+		{
+			$query = $db->getQuery(true)
+				->select('*')
+				->from($db->quoteName($realName))
+				->setLimit(self::BATCH_SIZE, $offset);
+
+			$db->setQuery($query);
+			$rows = $db->loadAssocList();
+
+			if (empty($rows))
+			{
+				break;
+			}
+
+			// Build multi-value INSERT
+			$values = [];
+
+			foreach ($rows as $row)
+			{
+				$vals = [];
+
+				foreach ($colNames as $col)
+				{
+					$val = $row[$col];
+
+					if ($val === null)
+					{
+						$vals[] = 'NULL';
+					}
+					else
+					{
+						$vals[] = $db->quote($val);
+					}
+				}
+
+				$values[] = '(' . implode(', ', $vals) . ')';
+			}
+
+			fwrite($fp, 'INSERT INTO ' . $db->quoteName($realName)
+				. ' (' . $colList . ') VALUES ' . "\n"
+				. implode(",\n", $values) . ";\n\n");
+
+			$offset += self::BATCH_SIZE;
+
+			if (count($rows) < self::BATCH_SIZE)
+			{
+				break;
+			}
+		}
+
+		fclose($fp);
+	}
+
+	/**
+	 * Restore a table from a SQL dump file.
+	 *
+	 * @param   string                                 $sqlFile  Path to the .sql file
+	 * @param   \Joomla\Database\DatabaseInterface     $db       Database driver
+	 * @param   string                                 $prefix   Table prefix
+	 *
+	 * @return  void
+	 *
+	 * @since   02.21.00
+	 */
+	private function restoreTable(string $sqlFile, $db, string $prefix): void
+	{
+		// Derive table name from filename: jml__content.sql -> {prefix}content
+		$baseName  = basename($sqlFile, '.sql');
+		$realTable = str_replace('jml__', $prefix, $baseName);
+
+		// Truncate the table first
+		$db->setQuery('TRUNCATE TABLE ' . $db->quoteName($realTable));
+		$db->execute();
+
+		$sql = file_get_contents($sqlFile);
+
+		if (empty(trim($sql)))
+		{
+			return;
+		}
+
+		// Split by semicolons and execute each statement
+		$statements = array_filter(
+			array_map('trim', explode(";\n", $sql)),
+			function ($s) { return !empty($s) && $s !== ';'; }
+		);
+
+		foreach ($statements as $statement)
+		{
+			$statement = rtrim($statement, ';');
+
+			if (empty($statement))
+			{
+				continue;
+			}
+
+			$db->setQuery($statement);
+			$db->execute();
+		}
+	}
+
+	/**
+	 * Create a ZIP archive of a directory.
+	 *
+	 * @param   string  $sourceDir  Full path to the directory to archive
+	 * @param   string  $zipPath    Full path for the output ZIP file
+	 *
+	 * @return  bool  True if archived successfully
+	 *
+	 * @since   02.25.00
+	 */
+	private function snapshotDirectory(string $sourceDir, string $zipPath): bool
+	{
+		if (!is_dir($sourceDir))
+		{
+			return false;
+		}
+
+		$zip = new \ZipArchive();
+
+		if ($zip->open($zipPath, \ZipArchive::CREATE | \ZipArchive::OVERWRITE) !== true)
+		{
+			return false;
+		}
+
+		$iterator = new \RecursiveIteratorIterator(
+			new \RecursiveDirectoryIterator($sourceDir, \RecursiveDirectoryIterator::SKIP_DOTS),
+			\RecursiveIteratorIterator::SELF_FIRST
+		);
+
+		foreach ($iterator as $item)
+		{
+			$relativePath = substr($item->getPathname(), strlen($sourceDir) + 1);
+			$relativePath = str_replace('\\', '/', $relativePath);
+
+			if ($item->isDir())
+			{
+				$zip->addEmptyDir($relativePath);
+			}
+			else
+			{
+				$zip->addFile($item->getPathname(), $relativePath);
+			}
+		}
+
+		$zip->close();
+
+		return true;
+	}
+
+	/**
+	 * Ensure the snapshot root directory exists with .htaccess protection.
+	 *
+	 * @return  void
+	 *
+	 * @since   02.21.00
+	 */
+	private function ensureSnapshotDir(): void
+	{
+		if (!is_dir($this->snapshotDir))
+		{
+			if (!mkdir($this->snapshotDir, 0755, true))
+			{
+				throw new \RuntimeException('Cannot create snapshot directory: ' . $this->snapshotDir);
+			}
+		}
+
+		$htaccess = $this->snapshotDir . '/.htaccess';
+
+		if (!file_exists($htaccess))
+		{
+			file_put_contents($htaccess, "Deny from all\n");
+		}
+	}
+
+	/**
+	 * Get the full path for a named snapshot.
+	 *
+	 * @param   string  $name  Snapshot name
+	 *
+	 * @return  string  Full directory path
+	 *
+	 * @since   02.21.00
+	 */
+	private function getSnapshotPath(string $name): string
+	{
+		return $this->snapshotDir . '/' . $name;
+	}
+
+	/**
+	 * Validate a snapshot name to prevent path traversal.
+	 *
+	 * @param   string  $name  Snapshot name to validate
+	 *
+	 * @return  void
+	 *
+	 * @throws  \InvalidArgumentException  On invalid name
+	 *
+	 * @since   02.21.00
+	 */
+	private function validateSnapshotName(string $name): void
+	{
+		if ($name === '' || strlen($name) > self::MAX_NAME_LENGTH)
+		{
+			throw new \InvalidArgumentException(
+				'Snapshot name must be 1-' . self::MAX_NAME_LENGTH . ' characters'
+			);
+		}
+
+		if (!preg_match('/^[a-zA-Z0-9_-]+$/', $name))
+		{
+			throw new \InvalidArgumentException(
+				'Snapshot name must contain only letters, numbers, hyphens, and underscores'
+			);
+		}
+	}
+
+	/**
+	 * Recursively remove a directory and all contents.
+	 *
+	 * @param   string  $dir  Directory to remove
+	 *
+	 * @return  void
+	 *
+	 * @since   02.21.00
+	 */
+	private function removeDirectory(string $dir): void
+	{
+		$items = new \RecursiveIteratorIterator(
+			new \RecursiveDirectoryIterator($dir, \RecursiveDirectoryIterator::SKIP_DOTS),
+			\RecursiveIteratorIterator::CHILD_FIRST
+		);
+
+		foreach ($items as $item)
+		{
+			if ($item->isDir())
+			{
+				@rmdir($item->getPathname());
+			}
+			else
+			{
+				@unlink($item->getPathname());
+			}
+		}
+
+		@rmdir($dir);
+	}
+
+	/**
+	 * Clear all contents of a directory without removing the directory itself.
+	 *
+	 * @param   string  $dir  Directory to clear
+	 *
+	 * @return  void
+	 *
+	 * @since   02.21.00
+	 */
+	private function clearDirectory(string $dir): void
+	{
+		if (!is_dir($dir))
+		{
+			return;
+		}
+
+		$items = new \RecursiveIteratorIterator(
+			new \RecursiveDirectoryIterator($dir, \RecursiveDirectoryIterator::SKIP_DOTS),
+			\RecursiveIteratorIterator::CHILD_FIRST
+		);
+
+		foreach ($items as $item)
+		{
+			if ($item->isDir())
+			{
+				@rmdir($item->getPathname());
+			}
+			else
+			{
+				@unlink($item->getPathname());
+			}
+		}
+	}
+}
@@ -0,0 +1 @@
+<!DOCTYPE html><title></title>
@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<form>
+	<field name="url" type="url"
+		label="PLG_SYSTEM_MOKOWAAS_SYNC_TARGET_URL_LABEL"
+		description="PLG_SYSTEM_MOKOWAAS_SYNC_TARGET_URL_DESC"
+		required="true" hint="https://client.example.com" />
+	<field name="token" type="text"
+		label="PLG_SYSTEM_MOKOWAAS_SYNC_TARGET_TOKEN_LABEL"
+		description="PLG_SYSTEM_MOKOWAAS_SYNC_TARGET_TOKEN_DESC"
+		required="true" hint="health_api_token from target site" />
+	<field name="label" type="text"
+		label="PLG_SYSTEM_MOKOWAAS_SYNC_TARGET_LABEL_LABEL"
+		description="PLG_SYSTEM_MOKOWAAS_SYNC_TARGET_LABEL_DESC"
+		hint="e.g. Client A" />
+</form>
@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<form>
+	<field
+		name="ip"
+		type="text"
+		label="PLG_SYSTEM_MOKOWAAS_TRUSTED_IP_ADDR_LABEL"
+		description="PLG_SYSTEM_MOKOWAAS_TRUSTED_IP_ADDR_DESC"
+		required="true"
+		hint="e.g. 192.168.1.100 or 10.0.0.0/24"
+		/>
+	<field
+		name="label"
+		type="text"
+		label="PLG_SYSTEM_MOKOWAAS_TRUSTED_IP_LABEL_LABEL"
+		description="PLG_SYSTEM_MOKOWAAS_TRUSTED_IP_LABEL_DESC"
+		hint="e.g. Office network"
+		/>
+	<field
+		name="enabled"
+		type="radio"
+		label="PLG_SYSTEM_MOKOWAAS_TRUSTED_IP_ENABLED_LABEL"
+		default="1"
+		class="btn-group btn-group-yesno"
+		>
+		<option value="1">JYES</option>
+		<option value="0">JNO</option>
+	</field>
+</form>
@@ -16,7 +16,7 @@
 ; Variables: (none)
 ; -----------------------------------------------------------------------------

-PLG_SYSTEM_MOKOWAAS="System - Moko WaaS"
+PLG_SYSTEM_MOKOWAAS="System - MokoWaaS"
 PLG_SYSTEM_MOKOWAAS_XML_DESCRIPTION="This plugin rebrands the Joomla system interface with MokoWaaS identity. It applies language overrides and ensures consistent branding across the platform."

 PLG_SYSTEM_MOKOWAAS_ENABLE_BRANDING_LABEL="Enable Branding"
@@ -99,6 +99,20 @@ PLG_SYSTEM_MOKOWAAS_DISABLE_INSTALL_URL_DESC="Block installing extensions from U
 PLG_SYSTEM_MOKOWAAS_HIDDEN_MENUS_LABEL="Hidden Menu Items"
 PLG_SYSTEM_MOKOWAAS_HIDDEN_MENUS_DESC="Components to hide from admin menu for non-master users. One per line (e.g., com_installer)."

+; ===== Content Sync fieldset =====
+PLG_SYSTEM_MOKOWAAS_FIELDSET_SYNC_LABEL="Content Sync"
+PLG_SYSTEM_MOKOWAAS_FIELDSET_SYNC_DESC="One-way content push to remote MokoWaaS sites. Syncs articles, categories, menus, and modules by alias."
+PLG_SYSTEM_MOKOWAAS_SYNC_TARGETS_LABEL="Sync Targets"
+PLG_SYSTEM_MOKOWAAS_SYNC_TARGETS_DESC="Remote sites to push content to. Each target requires the site URL and that site's health API token."
+PLG_SYSTEM_MOKOWAAS_SYNC_PUSH_NOW_LABEL="Push Content Now"
+PLG_SYSTEM_MOKOWAAS_SYNC_PUSH_NOW_DESC="Set to Yes and save to immediately push all content to all configured targets. Resets to No automatically."
+PLG_SYSTEM_MOKOWAAS_SYNC_TARGET_URL_LABEL="Site URL"
+PLG_SYSTEM_MOKOWAAS_SYNC_TARGET_URL_DESC="Full URL of the remote Joomla site (e.g. https://client.example.com)."
+PLG_SYSTEM_MOKOWAAS_SYNC_TARGET_TOKEN_LABEL="API Token"
+PLG_SYSTEM_MOKOWAAS_SYNC_TARGET_TOKEN_DESC="The health_api_token from the remote site's MokoWaaS plugin settings."
+PLG_SYSTEM_MOKOWAAS_SYNC_TARGET_LABEL_LABEL="Label"
+PLG_SYSTEM_MOKOWAAS_SYNC_TARGET_LABEL_DESC="Friendly name for this target (for identification only)."
+
 ; ===== Diagnostics fieldset =====
 PLG_SYSTEM_MOKOWAAS_FIELDSET_DIAGNOSTICS_LABEL="Diagnostics & Monitoring"
 PLG_SYSTEM_MOKOWAAS_FIELDSET_DIAGNOSTICS_DESC="Health check endpoint for external monitoring systems (e.g. Grafana). Exposes system status via a token-authenticated JSON API."
@@ -120,6 +134,13 @@ PLG_SYSTEM_MOKOWAAS_FORCE_HTTPS_LABEL="Force HTTPS"
 PLG_SYSTEM_MOKOWAAS_FORCE_HTTPS_DESC="Redirect all HTTP requests to HTTPS. Supports reverse proxy setups."
 PLG_SYSTEM_MOKOWAAS_SESSION_TIMEOUT_LABEL="Admin Session Timeout"
 PLG_SYSTEM_MOKOWAAS_SESSION_TIMEOUT_DESC="Minutes of idle time before admin sessions expire. 0 uses the Joomla default."
+PLG_SYSTEM_MOKOWAAS_TRUSTED_IPS_LABEL="Trusted IPs (No Session Timeout)"
+PLG_SYSTEM_MOKOWAAS_TRUSTED_IPS_DESC="Sessions from these IP addresses or ranges will never time out. Supports exact IPs, CIDR notation (e.g. 10.0.0.0/24), and wildcards (e.g. 192.168.1.*)."
+PLG_SYSTEM_MOKOWAAS_TRUSTED_IP_ADDR_LABEL="IP / CIDR"
+PLG_SYSTEM_MOKOWAAS_TRUSTED_IP_ADDR_DESC="An IP address, CIDR range, or wildcard pattern."
+PLG_SYSTEM_MOKOWAAS_TRUSTED_IP_LABEL_LABEL="Label"
+PLG_SYSTEM_MOKOWAAS_TRUSTED_IP_LABEL_DESC="A descriptive label for this entry (e.g. Office, VPN)."
+PLG_SYSTEM_MOKOWAAS_TRUSTED_IP_ENABLED_LABEL="Enabled"
 PLG_SYSTEM_MOKOWAAS_PASSWORD_LENGTH_LABEL="Minimum Password Length"
 PLG_SYSTEM_MOKOWAAS_PASSWORD_LENGTH_DESC="Minimum number of characters required for user passwords."
 PLG_SYSTEM_MOKOWAAS_PASSWORD_UPPER_LABEL="Require Uppercase"
@@ -130,6 +151,35 @@ PLG_SYSTEM_MOKOWAAS_UPLOAD_TYPES_DESC="Comma-separated list of allowed file exte
 PLG_SYSTEM_MOKOWAAS_UPLOAD_SIZE_LABEL="Max Upload Size (MB)"
 PLG_SYSTEM_MOKOWAAS_UPLOAD_SIZE_DESC="Maximum file upload size in megabytes."

+; ===== Demo Mode fieldset =====
+PLG_SYSTEM_MOKOWAAS_FIELDSET_DEMO_LABEL="Demo Mode"
+PLG_SYSTEM_MOKOWAAS_FIELDSET_DEMO_DESC="Configure demo site behavior with baseline snapshots and automatic periodic reset. When enabled, a warning banner is shown on the frontend."
+
+PLG_SYSTEM_MOKOWAAS_DEMO_ENABLED_LABEL="Enable Demo Mode"
+PLG_SYSTEM_MOKOWAAS_DEMO_ENABLED_DESC="When enabled, shows a warning banner on the frontend and enables snapshot/restore functionality."
+PLG_SYSTEM_MOKOWAAS_DEMO_BANNER_MSG_LABEL="Banner Message"
+PLG_SYSTEM_MOKOWAAS_DEMO_BANNER_MSG_DESC="Message displayed in the demo warning banner on the frontend."
+PLG_SYSTEM_MOKOWAAS_DEMO_BANNER_COLOR_LABEL="Banner Color"
+PLG_SYSTEM_MOKOWAAS_DEMO_BANNER_COLOR_DESC="Background color for the demo warning banner."
+PLG_SYSTEM_MOKOWAAS_DEMO_COUNTDOWN_LABEL="Show Reset Countdown"
+PLG_SYSTEM_MOKOWAAS_DEMO_COUNTDOWN_DESC="Display a countdown timer in the banner showing time until the next scheduled reset."
+PLG_SYSTEM_MOKOWAAS_DEMO_SCHEDULE_LABEL="Reset Schedule"
+PLG_SYSTEM_MOKOWAAS_DEMO_SCHEDULE_DESC="How often the demo site resets. Select a preset or choose Custom to enter a crontab expression."
+PLG_SYSTEM_MOKOWAAS_DEMO_CRON_LABEL="Custom Crontab"
+PLG_SYSTEM_MOKOWAAS_DEMO_CRON_DESC="Crontab expression for the reset schedule. Format: minute hour day month weekday (e.g. 0 */6 * * * for every 6 hours)."
+PLG_SYSTEM_MOKOWAAS_DEMO_NEXT_RESET_LABEL="Next Scheduled Reset"
+PLG_SYSTEM_MOKOWAAS_DEMO_NEXT_RESET_DESC="Calculated automatically from the reset schedule. The banner countdown uses this timestamp."
+PLG_SYSTEM_MOKOWAAS_DEMO_TABLES_LABEL="Snapshot Tables"
+PLG_SYSTEM_MOKOWAAS_DEMO_TABLES_DESC="Database tables to include in snapshots. One per line, using #__ prefix. These tables will be truncated and restored during a reset."
+PLG_SYSTEM_MOKOWAAS_DEMO_MEDIA_LABEL="Include Directories"
+PLG_SYSTEM_MOKOWAAS_DEMO_MEDIA_DESC="Select which directories to include in the snapshot. Images contains uploaded media, Media contains extension assets."
+PLG_SYSTEM_MOKOWAAS_DEMO_ACTIVE_BASELINE_LABEL="Active Baseline Name"
+PLG_SYSTEM_MOKOWAAS_DEMO_ACTIVE_BASELINE_DESC="Name of the baseline snapshot used by admin toggles and scheduled tasks. Alphanumeric, hyphens, and underscores only."
+PLG_SYSTEM_MOKOWAAS_DEMO_TAKE_SNAPSHOT_LABEL="Take Snapshot Now"
+PLG_SYSTEM_MOKOWAAS_DEMO_TAKE_SNAPSHOT_DESC="Save the current site state as a baseline snapshot. Uses the Active Baseline Name above. Resets to No after execution."
+PLG_SYSTEM_MOKOWAAS_DEMO_RESTORE_NOW_LABEL="Restore Baseline Now"
+PLG_SYSTEM_MOKOWAAS_DEMO_RESTORE_NOW_DESC="Immediately restore the site to the active baseline snapshot. WARNING: This will overwrite current content. Resets to No after execution."
+
 ; ===== Site Aliases fieldset =====
 PLG_SYSTEM_MOKOWAAS_FIELDSET_ALIASES_LABEL="Site Aliases"
 PLG_SYSTEM_MOKOWAAS_FIELDSET_ALIASES_DESC="Configure additional domains that mirror this site. Each alias can have its own offline status, robots directive, and backend redirect behavior."
@@ -15,5 +15,5 @@
 ; Variables: (none)
 ; -----------------------------------------------------------------------------

-PLG_SYSTEM_MOKOWAAS="System - Moko WaaS"
+PLG_SYSTEM_MOKOWAAS="System - MokoWaaS"
 PLG_SYSTEM_MOKOWAAS_XML_DESCRIPTION="This plugin rebrands the Joomla system interface with MokoWaaS identity. It applies language overrides and ensures consistent branding across the platform."
@@ -99,6 +99,20 @@ PLG_SYSTEM_MOKOWAAS_DISABLE_INSTALL_URL_DESC="Block installing extensions from U
 PLG_SYSTEM_MOKOWAAS_HIDDEN_MENUS_LABEL="Hidden Menu Items"
 PLG_SYSTEM_MOKOWAAS_HIDDEN_MENUS_DESC="Components to hide from admin menu for non-master users. One per line (e.g., com_installer)."

+; ===== Content Sync fieldset =====
+PLG_SYSTEM_MOKOWAAS_FIELDSET_SYNC_LABEL="Content Sync"
+PLG_SYSTEM_MOKOWAAS_FIELDSET_SYNC_DESC="One-way content push to remote MokoWaaS sites. Syncs articles, categories, menus, and modules by alias."
+PLG_SYSTEM_MOKOWAAS_SYNC_TARGETS_LABEL="Sync Targets"
+PLG_SYSTEM_MOKOWAAS_SYNC_TARGETS_DESC="Remote sites to push content to. Each target requires the site URL and that site's health API token."
+PLG_SYSTEM_MOKOWAAS_SYNC_PUSH_NOW_LABEL="Push Content Now"
+PLG_SYSTEM_MOKOWAAS_SYNC_PUSH_NOW_DESC="Set to Yes and save to immediately push all content to all configured targets. Resets to No automatically."
+PLG_SYSTEM_MOKOWAAS_SYNC_TARGET_URL_LABEL="Site URL"
+PLG_SYSTEM_MOKOWAAS_SYNC_TARGET_URL_DESC="Full URL of the remote Joomla site (e.g. https://client.example.com)."
+PLG_SYSTEM_MOKOWAAS_SYNC_TARGET_TOKEN_LABEL="API Token"
+PLG_SYSTEM_MOKOWAAS_SYNC_TARGET_TOKEN_DESC="The health_api_token from the remote site's MokoWaaS plugin settings."
+PLG_SYSTEM_MOKOWAAS_SYNC_TARGET_LABEL_LABEL="Label"
+PLG_SYSTEM_MOKOWAAS_SYNC_TARGET_LABEL_DESC="Friendly name for this target (for identification only)."
+
 ; ===== Diagnostics fieldset =====
 PLG_SYSTEM_MOKOWAAS_FIELDSET_DIAGNOSTICS_LABEL="Diagnostics & Monitoring"
 PLG_SYSTEM_MOKOWAAS_FIELDSET_DIAGNOSTICS_DESC="Health check endpoint for external monitoring systems (e.g. Grafana). Exposes system status via a token-authenticated JSON API."
@@ -120,6 +134,13 @@ PLG_SYSTEM_MOKOWAAS_FORCE_HTTPS_LABEL="Force HTTPS"
 PLG_SYSTEM_MOKOWAAS_FORCE_HTTPS_DESC="Redirect all HTTP requests to HTTPS. Supports reverse proxy setups."
 PLG_SYSTEM_MOKOWAAS_SESSION_TIMEOUT_LABEL="Admin Session Timeout"
 PLG_SYSTEM_MOKOWAAS_SESSION_TIMEOUT_DESC="Minutes of idle time before admin sessions expire. 0 uses the Joomla default."
+PLG_SYSTEM_MOKOWAAS_TRUSTED_IPS_LABEL="Trusted IPs (No Session Timeout)"
+PLG_SYSTEM_MOKOWAAS_TRUSTED_IPS_DESC="Sessions from these IP addresses or ranges will never time out. Supports exact IPs, CIDR notation (e.g. 10.0.0.0/24), and wildcards (e.g. 192.168.1.*)."
+PLG_SYSTEM_MOKOWAAS_TRUSTED_IP_ADDR_LABEL="IP / CIDR"
+PLG_SYSTEM_MOKOWAAS_TRUSTED_IP_ADDR_DESC="An IP address, CIDR range, or wildcard pattern."
+PLG_SYSTEM_MOKOWAAS_TRUSTED_IP_LABEL_LABEL="Label"
+PLG_SYSTEM_MOKOWAAS_TRUSTED_IP_LABEL_DESC="A descriptive label for this entry (e.g. Office, VPN)."
+PLG_SYSTEM_MOKOWAAS_TRUSTED_IP_ENABLED_LABEL="Enabled"
 PLG_SYSTEM_MOKOWAAS_PASSWORD_LENGTH_LABEL="Minimum Password Length"
 PLG_SYSTEM_MOKOWAAS_PASSWORD_LENGTH_DESC="Minimum number of characters required for user passwords."
 PLG_SYSTEM_MOKOWAAS_PASSWORD_UPPER_LABEL="Require Uppercase"
@@ -130,6 +151,35 @@ PLG_SYSTEM_MOKOWAAS_UPLOAD_TYPES_DESC="Comma-separated list of allowed file exte
 PLG_SYSTEM_MOKOWAAS_UPLOAD_SIZE_LABEL="Max Upload Size (MB)"
 PLG_SYSTEM_MOKOWAAS_UPLOAD_SIZE_DESC="Maximum file upload size in megabytes."

+; ===== Demo Mode fieldset =====
+PLG_SYSTEM_MOKOWAAS_FIELDSET_DEMO_LABEL="Demo Mode"
+PLG_SYSTEM_MOKOWAAS_FIELDSET_DEMO_DESC="Configure demo site behavior with baseline snapshots and automatic periodic reset. When enabled, a warning banner is shown on the frontend."
+
+PLG_SYSTEM_MOKOWAAS_DEMO_ENABLED_LABEL="Enable Demo Mode"
+PLG_SYSTEM_MOKOWAAS_DEMO_ENABLED_DESC="When enabled, shows a warning banner on the frontend and enables snapshot/restore functionality."
+PLG_SYSTEM_MOKOWAAS_DEMO_BANNER_MSG_LABEL="Banner Message"
+PLG_SYSTEM_MOKOWAAS_DEMO_BANNER_MSG_DESC="Message displayed in the demo warning banner on the frontend."
+PLG_SYSTEM_MOKOWAAS_DEMO_BANNER_COLOR_LABEL="Banner Color"
+PLG_SYSTEM_MOKOWAAS_DEMO_BANNER_COLOR_DESC="Background color for the demo warning banner."
+PLG_SYSTEM_MOKOWAAS_DEMO_COUNTDOWN_LABEL="Show Reset Countdown"
+PLG_SYSTEM_MOKOWAAS_DEMO_COUNTDOWN_DESC="Display a countdown timer in the banner showing time until the next scheduled reset."
+PLG_SYSTEM_MOKOWAAS_DEMO_SCHEDULE_LABEL="Reset Schedule"
+PLG_SYSTEM_MOKOWAAS_DEMO_SCHEDULE_DESC="How often the demo site resets. Select a preset or choose Custom to enter a crontab expression."
+PLG_SYSTEM_MOKOWAAS_DEMO_CRON_LABEL="Custom Crontab"
+PLG_SYSTEM_MOKOWAAS_DEMO_CRON_DESC="Crontab expression for the reset schedule. Format: minute hour day month weekday (e.g. 0 */6 * * * for every 6 hours)."
+PLG_SYSTEM_MOKOWAAS_DEMO_NEXT_RESET_LABEL="Next Scheduled Reset"
+PLG_SYSTEM_MOKOWAAS_DEMO_NEXT_RESET_DESC="Calculated automatically from the reset schedule. The banner countdown uses this timestamp."
+PLG_SYSTEM_MOKOWAAS_DEMO_TABLES_LABEL="Snapshot Tables"
+PLG_SYSTEM_MOKOWAAS_DEMO_TABLES_DESC="Database tables to include in snapshots. One per line, using #__ prefix. These tables will be truncated and restored during a reset."
+PLG_SYSTEM_MOKOWAAS_DEMO_MEDIA_LABEL="Include Directories"
+PLG_SYSTEM_MOKOWAAS_DEMO_MEDIA_DESC="Select which directories to include in the snapshot. Images contains uploaded media, Media contains extension assets."
+PLG_SYSTEM_MOKOWAAS_DEMO_ACTIVE_BASELINE_LABEL="Active Baseline Name"
+PLG_SYSTEM_MOKOWAAS_DEMO_ACTIVE_BASELINE_DESC="Name of the baseline snapshot used by admin toggles and scheduled tasks. Alphanumeric, hyphens, and underscores only."
+PLG_SYSTEM_MOKOWAAS_DEMO_TAKE_SNAPSHOT_LABEL="Take Snapshot Now"
+PLG_SYSTEM_MOKOWAAS_DEMO_TAKE_SNAPSHOT_DESC="Save the current site state as a baseline snapshot. Uses the Active Baseline Name above. Resets to No after execution."
+PLG_SYSTEM_MOKOWAAS_DEMO_RESTORE_NOW_LABEL="Restore Baseline Now"
+PLG_SYSTEM_MOKOWAAS_DEMO_RESTORE_NOW_DESC="Immediately restore the site to the active baseline snapshot. WARNING: This will overwrite current content. Resets to No after execution."
+
 ; ===== Site Aliases fieldset =====
 PLG_SYSTEM_MOKOWAAS_FIELDSET_ALIASES_LABEL="Site Aliases"
 PLG_SYSTEM_MOKOWAAS_FIELDSET_ALIASES_DESC="Configure additional domains that mirror this site. Each alias can have its own offline status, robots directive, and backend redirect behavior."
@@ -15,5 +15,5 @@
 ; Variables: (none)
 ; -----------------------------------------------------------------------------

-PLG_SYSTEM_MOKOWAAS="System - Moko WaaS"
+PLG_SYSTEM_MOKOWAAS="System - MokoWaaS"
 PLG_SYSTEM_MOKOWAAS_XML_DESCRIPTION="This plugin rebrands the Joomla system interface with MokoWaaS identity. It applies language overrides and ensures consistent branding across the platform."
@@ -30,20 +30,16 @@
 	<license>GNU General Public License version 3 or later; see LICENSE.md</license>
 	<authorEmail>hello@mokoconsulting.tech</authorEmail>
 	<authorUrl>https://mokoconsulting.tech</authorUrl>
-	<version>02.05.00</version>
+	<version>02.26.01-dev</version>
 	<description>This plugin rebrands the Joomla system interface with MokoWaaS identity. It applies language overrides and ensures consistent branding across the platform.</description>
 	<namespace path=".">Moko\Plugin\System\MokoWaaS</namespace>
 	<scriptfile>script.php</scriptfile>

-	<!-- Update server configuration -->
-	<updateservers>
-		<server type="extension" priority="1" name="MokoWaaS Update Server (Gitea)">https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS/raw/branch/main/updates.xml</server>
-	</updateservers>
-
 	<files>
 		<filename plugin="mokowaas">script.php</filename>
 		<folder>Extension</folder>
 		<folder>Field</folder>
+		<folder>Service</folder>
 		<folder>forms</folder>
 		<folder>payload</folder>
 		<folder>services</folder>
@@ -108,7 +104,7 @@
 					type="url"
 					label="PLG_SYSTEM_MOKOWAAS_SUPPORT_URL_LABEL"
 					description="PLG_SYSTEM_MOKOWAAS_SUPPORT_URL_DESC"
-					default="https://mokoconsulting.tech"
+					default="https://mokoconsulting.tech/support"
 					/>
 			</fieldset>
 			<fieldset name="waas_access"
@@ -269,7 +265,91 @@
 					description="PLG_SYSTEM_MOKOWAAS_HIDDEN_MENUS_DESC"
 					rows="5" filter="raw" />
 			</fieldset>
-			<fieldset name="site_aliases"
+			<fieldset name="demo_mode"
+			label="PLG_SYSTEM_MOKOWAAS_FIELDSET_DEMO_LABEL"
+			description="PLG_SYSTEM_MOKOWAAS_FIELDSET_DEMO_DESC"
+			addfieldprefix="Moko\Plugin\System\MokoWaaS\Field"
+			>
+			<field name="demo_mode_enabled" type="radio" default="0"
+				label="PLG_SYSTEM_MOKOWAAS_DEMO_ENABLED_LABEL"
+				description="PLG_SYSTEM_MOKOWAAS_DEMO_ENABLED_DESC"
+				class="btn-group btn-group-yesno">
+				<option value="1">JYES</option>
+				<option value="0">JNO</option>
+			</field>
+			<field name="demo_banner_message" type="text"
+				label="PLG_SYSTEM_MOKOWAAS_DEMO_BANNER_MSG_LABEL"
+				description="PLG_SYSTEM_MOKOWAAS_DEMO_BANNER_MSG_DESC"
+				default="This is a demo site. All changes will be reset periodically." />
+			<field name="demo_banner_color" type="color"
+				label="PLG_SYSTEM_MOKOWAAS_DEMO_BANNER_COLOR_LABEL"
+				description="PLG_SYSTEM_MOKOWAAS_DEMO_BANNER_COLOR_DESC"
+				default="#d9534f" />
+			<field name="demo_banner_show_countdown" type="radio" default="0"
+				label="PLG_SYSTEM_MOKOWAAS_DEMO_COUNTDOWN_LABEL"
+				description="PLG_SYSTEM_MOKOWAAS_DEMO_COUNTDOWN_DESC"
+				class="btn-group btn-group-yesno">
+				<option value="1">JYES</option>
+				<option value="0">JNO</option>
+			</field>
+			<field name="demo_reset_schedule" type="list"
+				label="PLG_SYSTEM_MOKOWAAS_DEMO_SCHEDULE_LABEL"
+				description="PLG_SYSTEM_MOKOWAAS_DEMO_SCHEDULE_DESC"
+				default="0 0 * * *">
+				<option value="*/5 * * * *">Every 5 minutes</option>
+				<option value="*/15 * * * *">Every 15 minutes</option>
+				<option value="*/30 * * * *">Every 30 minutes</option>
+				<option value="0 */1 * * *">Every hour</option>
+				<option value="0 */4 * * *">Every 4 hours</option>
+				<option value="0 */6 * * *">Every 6 hours</option>
+				<option value="0 */12 * * *">Every 12 hours</option>
+				<option value="0 0 * * *">Daily at midnight</option>
+				<option value="0 6 * * *">Daily at 6:00 AM</option>
+				<option value="0 0 * * 0">Weekly (Sunday midnight)</option>
+				<option value="0 0 1 * *">Monthly (1st at midnight)</option>
+				<option value="custom">Custom crontab...</option>
+			</field>
+			<field name="demo_reset_cron" type="text"
+				label="PLG_SYSTEM_MOKOWAAS_DEMO_CRON_LABEL"
+				description="PLG_SYSTEM_MOKOWAAS_DEMO_CRON_DESC"
+				default="" hint="min hour day month weekday (e.g. 0 */6 * * *)"
+				showon="demo_reset_schedule:custom" />
+			<field name="demo_next_reset" type="NextReset"
+				label="PLG_SYSTEM_MOKOWAAS_DEMO_NEXT_RESET_LABEL"
+				description="PLG_SYSTEM_MOKOWAAS_DEMO_NEXT_RESET_DESC"
+				/>
+			<field name="demo_snapshot_tables" type="SnapshotTables"
+				label="PLG_SYSTEM_MOKOWAAS_DEMO_TABLES_LABEL"
+				description="PLG_SYSTEM_MOKOWAAS_DEMO_TABLES_DESC"
+				multiple="true"
+				size="15"
+				/>
+			<field name="demo_snapshot_include_media" type="checkboxes"
+				label="PLG_SYSTEM_MOKOWAAS_DEMO_MEDIA_LABEL"
+				description="PLG_SYSTEM_MOKOWAAS_DEMO_MEDIA_DESC">
+				<option value="images">Images (/images/)</option>
+				<option value="media">Media (/media/)</option>
+			</field>
+			<field name="demo_active_baseline" type="text"
+				label="PLG_SYSTEM_MOKOWAAS_DEMO_ACTIVE_BASELINE_LABEL"
+				description="PLG_SYSTEM_MOKOWAAS_DEMO_ACTIVE_BASELINE_DESC"
+				default="default" />
+			<field name="demo_take_snapshot_now" type="radio" default="0"
+				label="PLG_SYSTEM_MOKOWAAS_DEMO_TAKE_SNAPSHOT_LABEL"
+				description="PLG_SYSTEM_MOKOWAAS_DEMO_TAKE_SNAPSHOT_DESC"
+				class="btn-group btn-group-yesno">
+				<option value="1">JYES</option>
+				<option value="0">JNO</option>
+			</field>
+			<field name="demo_restore_now" type="radio" default="0"
+				label="PLG_SYSTEM_MOKOWAAS_DEMO_RESTORE_NOW_LABEL"
+				description="PLG_SYSTEM_MOKOWAAS_DEMO_RESTORE_NOW_DESC"
+				class="btn-group btn-group-yesno">
+				<option value="1">JYES</option>
+				<option value="0">JNO</option>
+			</field>
+		</fieldset>
+		<fieldset name="site_aliases"
 				label="PLG_SYSTEM_MOKOWAAS_FIELDSET_ALIASES_LABEL"
 				description="PLG_SYSTEM_MOKOWAAS_FIELDSET_ALIASES_DESC"
 				>
@@ -293,13 +373,37 @@
 					buttons="add,remove,move"
 					/>
 			</fieldset>
-			<fieldset name="diagnostics"
+			<fieldset name="content_sync"
+			label="PLG_SYSTEM_MOKOWAAS_FIELDSET_SYNC_LABEL"
+			description="PLG_SYSTEM_MOKOWAAS_FIELDSET_SYNC_DESC"
+			>
+			<field
+				name="sync_targets"
+				type="subform"
+				label="PLG_SYSTEM_MOKOWAAS_SYNC_TARGETS_LABEL"
+				description="PLG_SYSTEM_MOKOWAAS_SYNC_TARGETS_DESC"
+				formsource="plugins/system/mokowaas/forms/sync_target_entry.xml"
+				multiple="true"
+				layout="joomla.form.field.subform.repeatable-table"
+				groupByFieldset="false"
+				buttons="add,remove,move"
+				/>
+			<field name="sync_push_now" type="radio" default="0"
+				label="PLG_SYSTEM_MOKOWAAS_SYNC_PUSH_NOW_LABEL"
+				description="PLG_SYSTEM_MOKOWAAS_SYNC_PUSH_NOW_DESC"
+				class="btn-group btn-group-yesno">
+				<option value="1">JYES</option>
+				<option value="0">JNO</option>
+			</field>
+		</fieldset>
+		<fieldset name="diagnostics"
 				label="PLG_SYSTEM_MOKOWAAS_FIELDSET_DIAGNOSTICS_LABEL"
 				description="PLG_SYSTEM_MOKOWAAS_FIELDSET_DIAGNOSTICS_DESC"
+				addfieldprefix="Moko\Plugin\System\MokoWaaS\Field"
 				>
 				<field
 					name="health_api_token"
-					type="text"
+					type="CopyableToken"
 					label="PLG_SYSTEM_MOKOWAAS_HEALTH_TOKEN_LABEL"
 					description="PLG_SYSTEM_MOKOWAAS_HEALTH_TOKEN_DESC"
 					default=""
@@ -310,6 +414,7 @@
 			<fieldset name="security"
 				label="PLG_SYSTEM_MOKOWAAS_FIELDSET_SECURITY_LABEL"
 				description="PLG_SYSTEM_MOKOWAAS_FIELDSET_SECURITY_DESC"
+				addfieldprefix="Moko\Plugin\System\MokoWaaS\Field"
 				>
 				<field name="force_https" type="radio" default="1"
 					label="PLG_SYSTEM_MOKOWAAS_FORCE_HTTPS_LABEL"
@@ -322,6 +427,22 @@
 					label="PLG_SYSTEM_MOKOWAAS_SESSION_TIMEOUT_LABEL"
 					description="PLG_SYSTEM_MOKOWAAS_SESSION_TIMEOUT_DESC"
 					default="60" hint="Minutes (0 = Joomla default)" />
+				<field
+					name="current_ip_display"
+					type="CurrentIp"
+					label=""
+					/>
+				<field
+					name="trusted_ips"
+					type="subform"
+					label="PLG_SYSTEM_MOKOWAAS_TRUSTED_IPS_LABEL"
+					description="PLG_SYSTEM_MOKOWAAS_TRUSTED_IPS_DESC"
+					formsource="plugins/system/mokowaas/forms/trusted_ip_entry.xml"
+					multiple="true"
+					layout="joomla.form.field.subform.repeatable-table"
+					groupByFieldset="false"
+					buttons="add,remove,move"
+					/>
 				<field name="password_min_length" type="number" default="12"
 					label="PLG_SYSTEM_MOKOWAAS_PASSWORD_LENGTH_LABEL"
 					description="PLG_SYSTEM_MOKOWAAS_PASSWORD_LENGTH_DESC" />
@@ -22,7 +22,7 @@
 * DEFGROUP: Joomla.Plugin
 * INGROUP: MokoWaaS
 * REPO: https://github.com/mokoconsulting-tech/mokowaas
- * VERSION: 02.01.08
+ * VERSION: 02.26.01
 * PATH: /src/script.php
 * BRIEF: Installation script for MokoWaaS plugin
 * NOTE: Handles installation, update, and uninstallation tasks including language override deployment
@@ -123,6 +123,7 @@ class plgSystemMokoWaaSInstallerScript implements InstallerScriptInterface
 		if ($type === 'install' || $type === 'update')
 		{
 			$this->enableAndLockPlugin();
+			$this->cleanupPluginUpdateSite();
 			$this->ensureMokoCassiopeia();
 			$this->installLanguageOverrides();
 			$this->updateLoginSupportUrls();
@@ -210,6 +211,77 @@ class plgSystemMokoWaaSInstallerScript implements InstallerScriptInterface
 		$db->execute();
 	}

+	/**
+	 * Remove the plugin-level update site so only the package-level one remains.
+	 *
+	 * Earlier versions registered an update server in the plugin manifest
+	 * (plg_system_mokowaas) in addition to the package manifest (pkg_mokowaas).
+	 * This caused Joomla to check for plugin-level updates that don't exist,
+	 * leading to failed downloads. Only the package update site should exist.
+	 *
+	 * @return  void
+	 *
+	 * @since   02.11.02
+	 */
+	private function cleanupPluginUpdateSite()
+	{
+		$db = Factory::getDbo();
+
+		// Find the extension_id for the plugin
+		$query = $db->getQuery(true)
+			->select($db->quoteName('extension_id'))
+			->from($db->quoteName('#__extensions'))
+			->where($db->quoteName('element') . ' = ' . $db->quote('mokowaas'))
+			->where($db->quoteName('type') . ' = ' . $db->quote('plugin'))
+			->where($db->quoteName('folder') . ' = ' . $db->quote('system'));
+		$db->setQuery($query);
+		$pluginId = (int) $db->loadResult();
+
+		if (!$pluginId)
+		{
+			return;
+		}
+
+		// Find update_site_ids linked to the plugin (not the package)
+		$query = $db->getQuery(true)
+			->select($db->quoteName('update_site_id'))
+			->from($db->quoteName('#__update_sites_extensions'))
+			->where($db->quoteName('extension_id') . ' = ' . $pluginId);
+		$db->setQuery($query);
+		$siteIds = $db->loadColumn();
+
+		if (empty($siteIds))
+		{
+			return;
+		}
+
+		// Delete the link rows
+		$db->setQuery(
+			$db->getQuery(true)
+				->delete($db->quoteName('#__update_sites_extensions'))
+				->where($db->quoteName('extension_id') . ' = ' . $pluginId)
+		)->execute();
+
+		// Delete orphaned update_sites rows (only if no other extension uses them)
+		foreach ($siteIds as $siteId)
+		{
+			$query = $db->getQuery(true)
+				->select('COUNT(*)')
+				->from($db->quoteName('#__update_sites_extensions'))
+				->where($db->quoteName('update_site_id') . ' = ' . (int) $siteId);
+			$db->setQuery($query);
+
+			if ((int) $db->loadResult() === 0)
+			{
+				$db->setQuery(
+					$db->getQuery(true)
+						->delete($db->quoteName('#__update_sites'))
+						->where($db->quoteName('update_site_id') . ' = ' . (int) $siteId)
+				)->execute();
+			}
+		}
+	}
+
 	/**
 	 * Ensure MokoOnyx is installed, locked, and set as default.
 	 *
@@ -482,7 +554,7 @@ class plgSystemMokoWaaSInstallerScript implements InstallerScriptInterface
 		return [
 			'{{BRAND_NAME}}'   => $params->get('brand_name', 'MokoWaaS'),
 			'{{COMPANY_NAME}}' => $params->get('company_name', 'Moko Consulting'),
-			'{{SUPPORT_URL}}'  => $params->get('support_url', 'https://mokoconsulting.tech'),
+			'{{SUPPORT_URL}}'  => $params->get('support_url', 'https://mokoconsulting.tech/support'),
 		];
 	}

@@ -22,7 +22,7 @@
 * DEFGROUP: Joomla.Plugin
 * INGROUP: MokoWaaS
 * REPO: https://github.com/mokoconsulting-tech/mokowaas
- * VERSION: 02.01.08
+ * VERSION: 02.26.01
 * PATH: /src/services/provider.php
 * BRIEF: Service provider for dependency injection in Joomla 5.x
 * NOTE: Registers the plugin with Joomla's DI container
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<form>
+	<fieldset name="reset_params">
+		<field name="baseline" type="text"
+			label="PLG_TASK_MOKOWAASDEMO_BASELINE_LABEL"
+			description="PLG_TASK_MOKOWAASDEMO_BASELINE_DESC"
+			default="default" />
+	</fieldset>
+</form>
@@ -0,0 +1,10 @@
+; MokoWaaS Demo Reset Task Plugin
+; Copyright (C) 2026 Moko Consulting
+; SPDX-License-Identifier: GPL-3.0-or-later
+
+PLG_TASK_MOKOWAASDEMO="Task - MokoWaaS Demo Reset"
+PLG_TASK_MOKOWAASDEMO_DESC="Scheduled task to periodically reset a demo site to a saved baseline snapshot."
+PLG_TASK_MOKOWAASDEMO_RESET_TITLE="MokoWaaS Demo Reset"
+PLG_TASK_MOKOWAASDEMO_RESET_DESC="Restore the site to a named baseline snapshot. Configure the baseline name and schedule interval."
+PLG_TASK_MOKOWAASDEMO_BASELINE_LABEL="Baseline Name"
+PLG_TASK_MOKOWAASDEMO_BASELINE_DESC="Name of the snapshot to restore. Must match a snapshot created via the MokoWaaS Demo Mode settings."
@@ -0,0 +1,6 @@
+; MokoWaaS Demo Reset Task Plugin (sys)
+; Copyright (C) 2026 Moko Consulting
+; SPDX-License-Identifier: GPL-3.0-or-later
+
+PLG_TASK_MOKOWAASDEMO="Task - MokoWaaS Demo Reset"
+PLG_TASK_MOKOWAASDEMO_DESC="Scheduled task to periodically reset a demo site to a saved baseline snapshot."
@@ -0,0 +1,31 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+ SPDX-License-Identifier: GPL-3.0-or-later
+-->
+<extension type="plugin" group="task" method="upgrade">
+	<name>Task - MokoWaaS Demo Reset</name>
+	<element>mokowaasdemo</element>
+	<author>Moko Consulting</author>
+	<creationDate>2026-05-30</creationDate>
+	<copyright>Copyright (C) 2026 Moko Consulting. All rights reserved.</copyright>
+	<license>GNU General Public License version 3 or later; see LICENSE</license>
+	<authorEmail>hello@mokoconsulting.tech</authorEmail>
+	<authorUrl>https://mokoconsulting.tech</authorUrl>
+	<version>02.26.01-dev</version>
+	<description>PLG_TASK_MOKOWAASDEMO_DESC</description>
+	<namespace path="src">Moko\Plugin\Task\MokoWaaSDemo</namespace>
+
+	<files>
+		<filename plugin="mokowaasdemo">mokowaasdemo.xml</filename>
+		<folder>src</folder>
+		<folder>services</folder>
+		<folder>forms</folder>
+		<folder>language</folder>
+	</files>
+
+	<languages folder="language">
+		<language tag="en-GB">en-GB/plg_task_mokowaasdemo.ini</language>
+		<language tag="en-GB">en-GB/plg_task_mokowaasdemo.sys.ini</language>
+	</languages>
+</extension>
@@ -0,0 +1,37 @@
+<?php
+/**
+ * @package     MokoWaaS
+ * @subpackage  plg_task_mokowaasdemo
+ * @copyright   Copyright (C) 2026 Moko Consulting. All rights reserved.
+ * @license     GNU General Public License version 3 or later; see LICENSE
+ */
+
+defined('_JEXEC') or die;
+
+use Joomla\CMS\Extension\PluginInterface;
+use Joomla\CMS\Factory;
+use Joomla\CMS\Plugin\PluginHelper;
+use Joomla\DI\Container;
+use Joomla\DI\ServiceProviderInterface;
+use Joomla\Event\DispatcherInterface;
+use Moko\Plugin\Task\MokoWaaSDemo\Extension\DemoReset;
+
+return new class implements ServiceProviderInterface
+{
+	public function register(Container $container): void
+	{
+		$container->set(
+			PluginInterface::class,
+			function (Container $container) {
+				$dispatcher = $container->get(DispatcherInterface::class);
+				$plugin     = new DemoReset(
+					$dispatcher,
+					(array) PluginHelper::getPlugin('task', 'mokowaasdemo')
+				);
+				$plugin->setApplication(Factory::getApplication());
+
+				return $plugin;
+			}
+		);
+	}
+};
@@ -0,0 +1,127 @@
+<?php
+/**
+ * @package     MokoWaaS
+ * @subpackage  plg_task_mokowaasdemo
+ * @copyright   Copyright (C) 2026 Moko Consulting. All rights reserved.
+ * @license     GNU General Public License version 3 or later; see LICENSE
+ */
+
+namespace Moko\Plugin\Task\MokoWaaSDemo\Extension;
+
+defined('_JEXEC') or die;
+
+use Joomla\CMS\Plugin\CMSPlugin;
+use Joomla\CMS\Plugin\PluginHelper;
+use Joomla\Component\Scheduler\Administrator\Event\ExecuteTaskEvent;
+use Joomla\Component\Scheduler\Administrator\Task\Status;
+use Joomla\Component\Scheduler\Administrator\Traits\TaskPluginTrait;
+use Joomla\Event\DispatcherInterface;
+use Joomla\Event\SubscriberInterface;
+use Joomla\Registry\Registry;
+
+/**
+ * MokoWaaS Demo Reset — Joomla Scheduled Task Plugin.
+ *
+ * Registers a task routine that restores the site to a named baseline
+ * snapshot on a configurable schedule (e.g. every 24 hours).
+ *
+ * @since  02.21.00
+ */
+final class DemoReset extends CMSPlugin implements SubscriberInterface
+{
+	use TaskPluginTrait;
+
+	/**
+	 * Task routine map.
+	 *
+	 * @var    array
+	 * @since  02.21.00
+	 */
+	protected const TASKS_MAP = [
+		'mokowaas.demo.reset' => [
+			'langConstPrefix' => 'PLG_TASK_MOKOWAASDEMO_RESET',
+			'method'          => 'resetDemoSite',
+			'form'            => 'reset_params',
+		],
+	];
+
+	/**
+	 * @return  array
+	 *
+	 * @since   02.21.00
+	 */
+	public static function getSubscribedEvents(): array
+	{
+		return [
+			'onTaskOptionsList'    => 'advertiseRoutines',
+			'onExecuteTask'        => 'standardRoutineHandler',
+			'onContentPrepareForm' => 'enhanceTaskItemForm',
+		];
+	}
+
+	/**
+	 * Reset the demo site to a baseline snapshot.
+	 *
+	 * @param   ExecuteTaskEvent  $event  The task event
+	 *
+	 * @return  int  Status::OK or Status::KNOCKOUT
+	 *
+	 * @since   02.21.00
+	 */
+	private function resetDemoSite(ExecuteTaskEvent $event): int
+	{
+		$params   = $event->getArgument('params');
+		$baseline = $params->baseline ?? 'default';
+
+		// Load system plugin params for table list and media setting
+		$sysPlugin = PluginHelper::getPlugin('system', 'mokowaas');
+
+		if (!$sysPlugin)
+		{
+			$this->logTask('MokoWaaS system plugin not enabled — cannot reset');
+
+			return Status::KNOCKOUT;
+		}
+
+		$sysParams = new Registry($sysPlugin->params);
+
+		// Load the service
+		$serviceFile = JPATH_PLUGINS . '/system/mokowaas/Service/DemoResetService.php';
+
+		if (!file_exists($serviceFile))
+		{
+			$this->logTask('DemoResetService.php not found');
+
+			return Status::KNOCKOUT;
+		}
+
+		require_once $serviceFile;
+
+		$tablesParam = $sysParams->get('demo_snapshot_tables', '');
+		$tables = is_array($tablesParam) ? array_filter($tablesParam) : array_filter(array_map('trim', explode("\n", $tablesParam)));
+		$media  = $sysParams->get('demo_snapshot_include_media', ['images']);
+		if ($media === '1' || $media === true) $media = ['images'];
+		if ($media === '0' || $media === false) $media = [];
+
+		$service = new \Moko\Plugin\System\MokoWaaS\Service\DemoResetService($tables, (array) $media);
+
+		try
+		{
+			$result = $service->restoreSnapshot($baseline);
+			$this->logTask(sprintf(
+				'Demo site reset to "%s" — %d tables restored, media=%s',
+				$baseline,
+				$result['restored_tables'],
+				$result['media_restored'] ? 'yes' : 'no'
+			));
+
+			return Status::OK;
+		}
+		catch (\Throwable $e)
+		{
+			$this->logTask('Demo reset failed: ' . $e->getMessage());
+
+			return Status::KNOCKOUT;
+		}
+	}
+}
@@ -7,7 +7,7 @@
 	<license>GPL-3.0-or-later</license>
 	<authorEmail>hello@mokoconsulting.tech</authorEmail>
 	<authorUrl>https://mokoconsulting.tech</authorUrl>
-	<version>02.05.00</version>
+	<version>02.26.01-dev</version>
 	<description>Joomla Web Services API routes for MokoWaaS site management — health checks, cache, updates, backups, and site info.</description>
 	<namespace path="src">Moko\Plugin\WebServices\MokoWaaS</namespace>
 	<files>
@@ -11,6 +11,7 @@ namespace Moko\Plugin\WebServices\MokoWaaS\Extension;
 defined('_JEXEC') or die;

 use Joomla\CMS\Plugin\CMSPlugin;
+use Joomla\CMS\Event\Application\BeforeApiRouteEvent;
 use Joomla\CMS\Router\ApiRouter;
 use Joomla\Event\SubscriberInterface;

@@ -36,14 +37,16 @@ final class MokoWaaSApi extends CMSPlugin implements SubscriberInterface
 	/**
 	 * Register API routes for MokoWaaS.
 	 *
-	 * @param   ApiRouter  $router  The API router
+	 * @param   BeforeApiRouteEvent  $event  The API route event (Joomla 6 typed event)
 	 *
 	 * @return  void
 	 *
 	 * @since   1.0.0
 	 */
-	public function onBeforeApiRoute(&$router): void
+	public function onBeforeApiRoute(BeforeApiRouteEvent $event): void
 	{
+		$router = $event->getRouter();
+
 		$router->createCRUDRoutes(
 			'v1/mokowaas/health',
 			'health',
@@ -61,5 +64,41 @@ final class MokoWaaSApi extends CMSPlugin implements SubscriberInterface
 			'update',
 			['component' => 'com_mokowaas']
 		);
+
+		$router->createCRUDRoutes(
+			'v1/mokowaas/install',
+			'install',
+			['component' => 'com_mokowaas']
+		);
+
+		$router->createCRUDRoutes(
+			'v1/mokowaas/reset',
+			'reset',
+			['component' => 'com_mokowaas']
+		);
+
+		$router->createCRUDRoutes(
+			'v1/mokowaas/snapshot',
+			'snapshot',
+			['component' => 'com_mokowaas']
+		);
+
+		$router->createCRUDRoutes(
+			'v1/mokowaas/sync',
+			'sync',
+			['component' => 'com_mokowaas']
+		);
+
+		$router->createCRUDRoutes(
+			'v1/mokowaas/sync-receive',
+			'syncreceive',
+			['component' => 'com_mokowaas']
+		);
+
+		$router->createCRUDRoutes(
+			'v1/mokowaas/extensions',
+			'extensions',
+			['component' => 'com_mokowaas']
+		);
 	}
 }
@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="utf-8"?>
+<extension type="plugin" group="webservices" method="upgrade">
+	<name>Web Services - Perfect Publisher</name>
+	<author>Moko Consulting</author>
+	<creationDate>2026-05-28</creationDate>
+	<copyright>Copyright (C) 2026 Moko Consulting. All rights reserved.</copyright>
+	<license>GPL-3.0-or-later</license>
+	<authorEmail>hello@mokoconsulting.tech</authorEmail>
+	<authorUrl>https://mokoconsulting.tech</authorUrl>
+	<version>02.26.01-dev</version>
+	<description>Joomla Web Services API routes for Perfect Publisher (com_autotweet) — channels, posts, requests, rules, and feeds.</description>
+	<namespace path="src">Moko\Plugin\WebServices\PerfectPublisher</namespace>
+	<files>
+		<folder plugin="perfectpublisher">services</folder>
+		<folder>src</folder>
+	</files>
+</extension>
@@ -0,0 +1,42 @@
+<?php
+/* Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+ *
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ *
+ * FILE INFORMATION
+ * DEFGROUP: Joomla.Plugin
+ * INGROUP: MokoWaaS
+ * REPO: https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS
+ * PATH: /src/packages/plg_webservices_perfectpublisher/services/provider.php
+ * VERSION: 02.26.01
+ * BRIEF: DI service provider for Perfect Publisher Web Services plugin
+ */
+
+defined('_JEXEC') or die;
+
+use Joomla\CMS\Extension\PluginInterface;
+use Joomla\CMS\Factory;
+use Joomla\CMS\Plugin\PluginHelper;
+use Joomla\DI\Container;
+use Joomla\DI\ServiceProviderInterface;
+use Joomla\Event\DispatcherInterface;
+use Moko\Plugin\WebServices\PerfectPublisher\Extension\PerfectPublisherApi;
+
+return new class implements ServiceProviderInterface
+{
+	public function register(Container $container): void
+	{
+		$container->set(
+			PluginInterface::class,
+			function (Container $container) {
+				$dispatcher = $container->get(DispatcherInterface::class);
+				$plugin = new PerfectPublisherApi(
+					$dispatcher,
+					(array) PluginHelper::getPlugin('webservices', 'perfectpublisher')
+				);
+				$plugin->setApplication(Factory::getApplication());
+				return $plugin;
+			}
+		);
+	}
+};
@@ -0,0 +1,539 @@
+<?php
+/* Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+ *
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ *
+ * FILE INFORMATION
+ * DEFGROUP: Joomla.Plugin
+ * INGROUP: MokoWaaS
+ * REPO: https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS
+ * PATH: /src/packages/plg_webservices_perfectpublisher/src/Extension/PerfectPublisherApi.php
+ * VERSION: 02.26.01
+ * BRIEF: Web Services API plugin for Perfect Publisher (com_autotweet)
+ */
+
+namespace Moko\Plugin\WebServices\PerfectPublisher\Extension;
+
+defined('_JEXEC') or die;
+
+use Joomla\CMS\Factory;
+use Joomla\CMS\Plugin\CMSPlugin;
+use Joomla\CMS\Event\Application\BeforeApiRouteEvent;
+use Joomla\CMS\Router\ApiRouter;
+use Joomla\Event\SubscriberInterface;
+
+/**
+ * Perfect Publisher Web Services API Plugin
+ *
+ * Registers REST API routes for Perfect Publisher (com_autotweet) data.
+ * Provides read access to channels, posts, requests, rules, and feeds.
+ * Provides write access to create publish requests.
+ *
+ * Routes:
+ *   GET  /v1/perfectpublisher/channels      List social channels
+ *   GET  /v1/perfectpublisher/channels/:id   Get channel detail
+ *   GET  /v1/perfectpublisher/posts          List published posts
+ *   GET  /v1/perfectpublisher/posts/:id      Get post detail
+ *   GET  /v1/perfectpublisher/requests       List pending requests
+ *   POST /v1/perfectpublisher/requests       Create a publish request
+ *   GET  /v1/perfectpublisher/rules          List publishing rules
+ *   GET  /v1/perfectpublisher/feeds          List RSS feeds
+ *   GET  /v1/perfectpublisher/channeltypes   List channel type definitions
+ *   GET  /v1/perfectpublisher/stats          Dashboard statistics
+ *
+ * @since  02.13.01
+ */
+final class PerfectPublisherApi extends CMSPlugin implements SubscriberInterface
+{
+	/**
+	 * @return  array
+	 */
+	public static function getSubscribedEvents(): array
+	{
+		return [
+			'onBeforeApiRoute' => 'onBeforeApiRoute',
+		];
+	}
+
+	/**
+	 * Register API routes.
+	 *
+	 * @param   BeforeApiRouteEvent  $event  The API route event
+	 *
+	 * @return  void
+	 */
+	public function onBeforeApiRoute(BeforeApiRouteEvent $event): void
+	{
+		$router = $event->getRouter();
+
+		// All routes are handled by this plugin directly via custom callbacks
+		// because com_autotweet uses FOF, not standard Joomla MVC
+
+		$router->addRoute(
+			new \Joomla\Router\Route(
+				['GET'],
+				'v1/perfectpublisher/channels',
+				[$this, 'getChannels']
+			)
+		);
+
+		$router->addRoute(
+			new \Joomla\Router\Route(
+				['GET'],
+				'v1/perfectpublisher/channels/:id',
+				[$this, 'getChannel']
+			)
+		);
+
+		$router->addRoute(
+			new \Joomla\Router\Route(
+				['GET'],
+				'v1/perfectpublisher/posts',
+				[$this, 'getPosts']
+			)
+		);
+
+		$router->addRoute(
+			new \Joomla\Router\Route(
+				['GET'],
+				'v1/perfectpublisher/posts/:id',
+				[$this, 'getPost']
+			)
+		);
+
+		$router->addRoute(
+			new \Joomla\Router\Route(
+				['GET'],
+				'v1/perfectpublisher/requests',
+				[$this, 'getRequests']
+			)
+		);
+
+		$router->addRoute(
+			new \Joomla\Router\Route(
+				['POST'],
+				'v1/perfectpublisher/requests',
+				[$this, 'createRequest']
+			)
+		);
+
+		$router->addRoute(
+			new \Joomla\Router\Route(
+				['GET'],
+				'v1/perfectpublisher/rules',
+				[$this, 'getRules']
+			)
+		);
+
+		$router->addRoute(
+			new \Joomla\Router\Route(
+				['GET'],
+				'v1/perfectpublisher/feeds',
+				[$this, 'getFeeds']
+			)
+		);
+
+		$router->addRoute(
+			new \Joomla\Router\Route(
+				['GET'],
+				'v1/perfectpublisher/channeltypes',
+				[$this, 'getChannelTypes']
+			)
+		);
+
+		$router->addRoute(
+			new \Joomla\Router\Route(
+				['GET'],
+				'v1/perfectpublisher/stats',
+				[$this, 'getStats']
+			)
+		);
+	}
+
+	/**
+	 * GET /v1/perfectpublisher/channels
+	 *
+	 * @return  void
+	 */
+	public function getChannels(): void
+	{
+		$db    = Factory::getDbo();
+		$app   = Factory::getApplication();
+		$limit = (int) $app->input->get('limit', 20);
+		$offset = (int) $app->input->get('offset', 0);
+
+		$query = $db->getQuery(true)
+			->select('c.*, ct.name AS channeltype_name, ct.max_chars')
+			->from($db->quoteName('#__autotweet_channels', 'c'))
+			->leftJoin(
+				$db->quoteName('#__autotweet_channeltypes', 'ct')
+				. ' ON ' . $db->quoteName('c.channeltype_id')
+				. ' = ' . $db->quoteName('ct.id')
+			)
+			->order($db->quoteName('c.ordering') . ' ASC');
+
+		$published = $app->input->get('published', null);
+		if ($published !== null) {
+			$query->where($db->quoteName('c.published') . ' = ' . (int) $published);
+		}
+
+		$db->setQuery($query, $offset, $limit);
+
+		$this->sendJsonResponse($db->loadObjectList());
+	}
+
+	/**
+	 * GET /v1/perfectpublisher/channels/:id
+	 *
+	 * @return  void
+	 */
+	public function getChannel(): void
+	{
+		$id = (int) Factory::getApplication()->input->get('id', 0);
+		$db = Factory::getDbo();
+
+		$query = $db->getQuery(true)
+			->select('c.*, ct.name AS channeltype_name, ct.max_chars, ct.description AS channeltype_desc')
+			->from($db->quoteName('#__autotweet_channels', 'c'))
+			->leftJoin(
+				$db->quoteName('#__autotweet_channeltypes', 'ct')
+				. ' ON ' . $db->quoteName('c.channeltype_id')
+				. ' = ' . $db->quoteName('ct.id')
+			)
+			->where($db->quoteName('c.id') . ' = ' . $id);
+
+		$db->setQuery($query);
+		$result = $db->loadObject();
+
+		if (!$result) {
+			$this->sendJsonError('Channel not found', 404);
+			return;
+		}
+
+		// Strip sensitive OAuth params
+		if (isset($result->params)) {
+			$params = json_decode($result->params, true);
+			if (is_array($params)) {
+				foreach (['access_token', 'access_secret', 'client_secret', 'api_secret', 'password'] as $key) {
+					if (isset($params[$key])) {
+						$params[$key] = '***';
+					}
+				}
+				$result->params = json_encode($params);
+			}
+		}
+
+		$this->sendJsonResponse($result);
+	}
+
+	/**
+	 * GET /v1/perfectpublisher/posts
+	 *
+	 * @return  void
+	 */
+	public function getPosts(): void
+	{
+		$db    = Factory::getDbo();
+		$app   = Factory::getApplication();
+		$limit = (int) $app->input->get('limit', 20);
+		$offset = (int) $app->input->get('offset', 0);
+
+		$query = $db->getQuery(true)
+			->select('p.*, c.name AS channel_name')
+			->from($db->quoteName('#__autotweet_posts', 'p'))
+			->leftJoin(
+				$db->quoteName('#__autotweet_channels', 'c')
+				. ' ON ' . $db->quoteName('p.channel_id')
+				. ' = ' . $db->quoteName('c.id')
+			)
+			->order($db->quoteName('p.postdate') . ' DESC');
+
+		$pubstate = $app->input->get('pubstate', '');
+		if ($pubstate !== '') {
+			$query->where($db->quoteName('p.pubstate') . ' = ' . $db->quote($pubstate));
+		}
+
+		$channel = (int) $app->input->get('channel_id', 0);
+		if ($channel > 0) {
+			$query->where($db->quoteName('p.channel_id') . ' = ' . $channel);
+		}
+
+		$db->setQuery($query, $offset, $limit);
+
+		$this->sendJsonResponse($db->loadObjectList());
+	}
+
+	/**
+	 * GET /v1/perfectpublisher/posts/:id
+	 *
+	 * @return  void
+	 */
+	public function getPost(): void
+	{
+		$id = (int) Factory::getApplication()->input->get('id', 0);
+		$db = Factory::getDbo();
+
+		$query = $db->getQuery(true)
+			->select('p.*, c.name AS channel_name, ct.name AS channeltype_name')
+			->from($db->quoteName('#__autotweet_posts', 'p'))
+			->leftJoin(
+				$db->quoteName('#__autotweet_channels', 'c')
+				. ' ON ' . $db->quoteName('p.channel_id')
+				. ' = ' . $db->quoteName('c.id')
+			)
+			->leftJoin(
+				$db->quoteName('#__autotweet_channeltypes', 'ct')
+				. ' ON ' . $db->quoteName('c.channeltype_id')
+				. ' = ' . $db->quoteName('ct.id')
+			)
+			->where($db->quoteName('p.id') . ' = ' . $id);
+
+		$db->setQuery($query);
+		$result = $db->loadObject();
+
+		if (!$result) {
+			$this->sendJsonError('Post not found', 404);
+			return;
+		}
+
+		$this->sendJsonResponse($result);
+	}
+
+	/**
+	 * GET /v1/perfectpublisher/requests
+	 *
+	 * @return  void
+	 */
+	public function getRequests(): void
+	{
+		$db    = Factory::getDbo();
+		$app   = Factory::getApplication();
+		$limit = (int) $app->input->get('limit', 20);
+		$offset = (int) $app->input->get('offset', 0);
+
+		$query = $db->getQuery(true)
+			->select('*')
+			->from($db->quoteName('#__autotweet_requests'))
+			->order($db->quoteName('publish_up') . ' ASC');
+
+		$published = $app->input->get('published', null);
+		if ($published !== null) {
+			$query->where($db->quoteName('published') . ' = ' . (int) $published);
+		}
+
+		$db->setQuery($query, $offset, $limit);
+
+		$this->sendJsonResponse($db->loadObjectList());
+	}
+
+	/**
+	 * POST /v1/perfectpublisher/requests
+	 *
+	 * Create a new publish request. Required fields: description.
+	 * Optional: url, image_url, publish_up, plugin, priority.
+	 *
+	 * @return  void
+	 */
+	public function createRequest(): void
+	{
+		$app  = Factory::getApplication();
+		$db   = Factory::getDbo();
+		$data = json_decode($app->input->json->getRaw(), true);
+
+		if (empty($data['description'])) {
+			$this->sendJsonError('Field "description" is required', 400);
+			return;
+		}
+
+		$now  = Factory::getDate()->toSql();
+		$user = Factory::getUser();
+
+		$row = (object) [
+			'ref_id'      => $data['ref_id'] ?? null,
+			'plugin'      => $data['plugin'] ?? 'manual-api',
+			'priority'    => (int) ($data['priority'] ?? 5),
+			'publish_up'  => $data['publish_up'] ?? $now,
+			'description' => $data['description'],
+			'typeinfo'    => (int) ($data['typeinfo'] ?? 0),
+			'url'         => $data['url'] ?? null,
+			'image_url'   => $data['image_url'] ?? null,
+			'created'     => $now,
+			'created_by'  => $user->id,
+			'params'      => json_encode($data['params'] ?? []),
+			'published'   => (int) ($data['published'] ?? 1),
+		];
+
+		$db->insertObject('#__autotweet_requests', $row, 'id');
+
+		$this->sendJsonResponse(
+			['id' => $row->id, 'status' => 'created'],
+			201
+		);
+	}
+
+	/**
+	 * GET /v1/perfectpublisher/rules
+	 *
+	 * @return  void
+	 */
+	public function getRules(): void
+	{
+		$db = Factory::getDbo();
+
+		$query = $db->getQuery(true)
+			->select('r.*, rt.name AS ruletype_name, rt.description AS ruletype_desc, c.name AS channel_name')
+			->from($db->quoteName('#__autotweet_rules', 'r'))
+			->leftJoin(
+				$db->quoteName('#__autotweet_ruletypes', 'rt')
+				. ' ON ' . $db->quoteName('r.ruletype_id')
+				. ' = ' . $db->quoteName('rt.id')
+			)
+			->leftJoin(
+				$db->quoteName('#__autotweet_channels', 'c')
+				. ' ON ' . $db->quoteName('r.channel_id')
+				. ' = ' . $db->quoteName('c.id')
+			)
+			->order($db->quoteName('r.ordering') . ' ASC');
+
+		$db->setQuery($query);
+
+		$this->sendJsonResponse($db->loadObjectList());
+	}
+
+	/**
+	 * GET /v1/perfectpublisher/feeds
+	 *
+	 * @return  void
+	 */
+	public function getFeeds(): void
+	{
+		$db = Factory::getDbo();
+
+		$query = $db->getQuery(true)
+			->select('*')
+			->from($db->quoteName('#__autotweet_feeds'))
+			->order($db->quoteName('ordering') . ' ASC');
+
+		$db->setQuery($query);
+
+		$this->sendJsonResponse($db->loadObjectList());
+	}
+
+	/**
+	 * GET /v1/perfectpublisher/channeltypes
+	 *
+	 * @return  void
+	 */
+	public function getChannelTypes(): void
+	{
+		$db = Factory::getDbo();
+
+		$query = $db->getQuery(true)
+			->select('*')
+			->from($db->quoteName('#__autotweet_channeltypes'))
+			->order($db->quoteName('id') . ' ASC');
+
+		$db->setQuery($query);
+
+		$this->sendJsonResponse($db->loadObjectList());
+	}
+
+	/**
+	 * GET /v1/perfectpublisher/stats
+	 *
+	 * Dashboard statistics: post counts by status, channel counts, recent activity.
+	 *
+	 * @return  void
+	 */
+	public function getStats(): void
+	{
+		$db = Factory::getDbo();
+
+		// Posts by status
+		$db->setQuery(
+			$db->getQuery(true)
+				->select('pubstate, COUNT(*) AS total')
+				->from($db->quoteName('#__autotweet_posts'))
+				->group($db->quoteName('pubstate'))
+		);
+		$postsByStatus = $db->loadObjectList('pubstate');
+
+		// Active channels
+		$db->setQuery(
+			$db->getQuery(true)
+				->select('COUNT(*) AS total')
+				->from($db->quoteName('#__autotweet_channels'))
+				->where($db->quoteName('published') . ' = 1')
+		);
+		$activeChannels = (int) $db->loadResult();
+
+		// Pending requests
+		$db->setQuery(
+			$db->getQuery(true)
+				->select('COUNT(*) AS total')
+				->from($db->quoteName('#__autotweet_requests'))
+				->where($db->quoteName('published') . ' = 1')
+		);
+		$pendingRequests = (int) $db->loadResult();
+
+		// Posts last 24h
+		$db->setQuery(
+			$db->getQuery(true)
+				->select('COUNT(*) AS total')
+				->from($db->quoteName('#__autotweet_posts'))
+				->where($db->quoteName('postdate') . ' >= DATE_SUB(NOW(), INTERVAL 1 DAY)')
+		);
+		$posts24h = (int) $db->loadResult();
+
+		// Posts last 7d
+		$db->setQuery(
+			$db->getQuery(true)
+				->select('COUNT(*) AS total')
+				->from($db->quoteName('#__autotweet_posts'))
+				->where($db->quoteName('postdate') . ' >= DATE_SUB(NOW(), INTERVAL 7 DAY)')
+		);
+		$posts7d = (int) $db->loadResult();
+
+		$this->sendJsonResponse([
+			'posts_by_status'  => $postsByStatus,
+			'active_channels'  => $activeChannels,
+			'pending_requests' => $pendingRequests,
+			'posts_24h'        => $posts24h,
+			'posts_7d'         => $posts7d,
+		]);
+	}
+
+	/**
+	 * Send a JSON API response.
+	 *
+	 * @param   mixed  $data    Response data
+	 * @param   int    $status  HTTP status code
+	 *
+	 * @return  void
+	 */
+	private function sendJsonResponse($data, int $status = 200): void
+	{
+		$app = Factory::getApplication();
+		$app->setHeader('Content-Type', 'application/json; charset=utf-8');
+		$app->setHeader('Status', (string) $status);
+		echo json_encode(['data' => $data], JSON_UNESCAPED_SLASHES | JSON_PRETTY_PRINT);
+		$app->close();
+	}
+
+	/**
+	 * Send a JSON error response.
+	 *
+	 * @param   string  $message  Error message
+	 * @param   int     $status   HTTP status code
+	 *
+	 * @return  void
+	 */
+	private function sendJsonError(string $message, int $status = 400): void
+	{
+		$app = Factory::getApplication();
+		$app->setHeader('Content-Type', 'application/json; charset=utf-8');
+		$app->setHeader('Status', (string) $status);
+		echo json_encode(['error' => $message], JSON_UNESCAPED_SLASHES);
+		$app->close();
+	}
+}
@@ -1,8 +1,8 @@
 <?xml version="1.0" encoding="utf-8"?>
 <extension type="package" method="upgrade">
-	<name>MokoWaaS</name>
+	<name>Package - MokoWaaS</name>
 	<packagename>mokowaas</packagename>
-	<version>02.05.00</version>
+	<version>02.26.01-dev</version>
 	<creationDate>2026-05-23</creationDate>
 	<author>Moko Consulting</author>
 	<authorEmail>hello@mokoconsulting.tech</authorEmail>
@@ -12,10 +12,12 @@
 	<description>MokoWaaS site management suite — branding, health monitoring, tenant restrictions, and REST API.</description>
 	<scriptfile>script.php</scriptfile>

-	<files>
+	<files folder="packages">
 		<file type="plugin" id="plg_system_mokowaas" group="system">plg_system_mokowaas.zip</file>
 		<file type="component" id="com_mokowaas">com_mokowaas.zip</file>
 		<file type="plugin" id="plg_webservices_mokowaas" group="webservices">plg_webservices_mokowaas.zip</file>
+		<file type="plugin" id="plg_webservices_perfectpublisher" group="webservices">plg_webservices_perfectpublisher.zip</file>
+		<file type="plugin" id="plg_task_mokowaasdemo" group="task">plg_task_mokowaasdemo.zip</file>
 	</files>

 	<updateservers>
@@ -34,8 +34,12 @@ class Pkg_MokowaasInstallerScript
 	 */
 	public function postflight($type, $parent)
 	{
+		// Remove legacy extensions from before the package rewrite
+		$this->cleanupLegacyExtensions();
+
 		$this->enablePlugin('system', 'mokowaas');
 		$this->enablePlugin('webservices', 'mokowaas');
+		$this->enablePlugin('task', 'mokowaasdemo');

 		// Mark MokoWaaS extensions as protected (prevents disable/uninstall at framework level)
 		$this->protectExtensions();
@@ -44,6 +48,101 @@ class Pkg_MokowaasInstallerScript
 		$this->sendHeartbeat();
 	}

+	/**
+	 * Remove legacy/stale extension entries and filesystem remnants.
+	 *
+	 * The old standalone plugin was named "mokowaasbrand" (plg_system_mokowaasbrand).
+	 * After the rewrite into the pkg_mokowaas package, the old entries and files
+	 * may linger — especially on sites restored from old backups.
+	 *
+	 * @return  void
+	 *
+	 * @since   02.21.00
+	 */
+	private function cleanupLegacyExtensions(): void
+	{
+		try
+		{
+			$db = Factory::getDbo();
+
+			// Legacy element names to remove from #__extensions
+			$legacy = [
+				$db->quote('mokowaasbrand'),
+				$db->quote('plg_system_mokowaasbrand'),
+			];
+
+			// Delete from #__extensions
+			$query = $db->getQuery(true)
+				->delete($db->quoteName('#__extensions'))
+				->where($db->quoteName('element') . ' IN (' . implode(',', $legacy) . ')');
+			$db->setQuery($query);
+			$affected = $db->execute();
+			$count    = $db->getAffectedRows();
+
+			// Remove legacy plugin files from the filesystem
+			$legacyDirs = [
+				JPATH_PLUGINS . '/system/mokowaasbrand',
+			];
+
+			foreach ($legacyDirs as $dir)
+			{
+				if (is_dir($dir))
+				{
+					$this->rmdirRecursive($dir);
+				}
+			}
+
+			if ($count > 0)
+			{
+				Factory::getApplication()->enqueueMessage(
+					sprintf('Removed %d legacy MokoWaaS extension(s).', $count),
+					'message'
+				);
+
+				Log::add(
+					sprintf('Cleaned up %d legacy MokoWaaS extension entries', $count),
+					Log::INFO,
+					'mokowaas'
+				);
+			}
+		}
+		catch (\Throwable $e)
+		{
+			Log::add('Legacy cleanup error: ' . $e->getMessage(), Log::WARNING, 'jerror');
+		}
+	}
+
+	/**
+	 * Recursively remove a directory.
+	 *
+	 * @param   string  $dir  Directory path
+	 *
+	 * @return  void
+	 *
+	 * @since   02.21.00
+	 */
+	private function rmdirRecursive(string $dir): void
+	{
+		$items = new \RecursiveIteratorIterator(
+			new \RecursiveDirectoryIterator($dir, \RecursiveDirectoryIterator::SKIP_DOTS),
+			\RecursiveIteratorIterator::CHILD_FIRST
+		);
+
+		foreach ($items as $item)
+		{
+			if ($item->isDir())
+			{
+				@rmdir($item->getPathname());
+			}
+			else
+			{
+				@unlink($item->getPathname());
+			}
+		}
+
+		@rmdir($dir);
+	}
+
 	/**
 	 * Enable a plugin by group and element.
 	 *
@@ -89,18 +188,63 @@ class Pkg_MokowaasInstallerScript
 		try
 		{
 			$db = Factory::getDbo();
+
+			// All MokoWaaS elements: package, system plugin, component,
+			// webservices plugins, task plugin
+			$elements = [
+				$db->quote('pkg_mokowaas'),
+				$db->quote('mokowaas'),
+				$db->quote('com_mokowaas'),
+				$db->quote('mokowaasdemo'),
+				$db->quote('perfectpublisher'),
+			];
+
 			$query = $db->getQuery(true)
 				->update($db->quoteName('#__extensions'))
 				->set($db->quoteName('protected') . ' = 1')
 				->set($db->quoteName('locked') . ' = 0')
-				->where('(' . $db->quoteName('element') . ' = ' . $db->quote('mokowaas')
-					. ' OR ' . $db->quoteName('element') . ' = ' . $db->quote('pkg_mokowaas') . ')');
+				->where($db->quoteName('element') . ' IN (' . implode(',', $elements) . ')');
+			$db->setQuery($query);
+			$db->execute();
+
+			// Ensure update server stays enabled
+			$this->enableUpdateServer();
+		}
+		catch (\Throwable $e)
+		{
+			Log::add('Error protecting MokoWaaS extensions: ' . $e->getMessage(), Log::WARNING, 'jerror');
+		}
+	}
+
+	/**
+	 * Ensure the MokoWaaS update server entry stays enabled.
+	 *
+	 * Joomla stores update server records in #__update_sites. If a tenant
+	 * or automation disables it, the site stops receiving updates. This
+	 * re-enables it on every install/update.
+	 *
+	 * @return  void
+	 *
+	 * @since   02.21.00
+	 */
+	private function enableUpdateServer(): void
+	{
+		try
+		{
+			$db = Factory::getDbo();
+
+			// Find update site by name or URL pattern
+			$query = $db->getQuery(true)
+				->update($db->quoteName('#__update_sites'))
+				->set($db->quoteName('enabled') . ' = 1')
+				->where('(' . $db->quoteName('name') . ' LIKE ' . $db->quote('%MokoWaaS%')
+					. ' OR ' . $db->quoteName('location') . ' LIKE ' . $db->quote('%MokoWaaS%') . ')');
 			$db->setQuery($query);
 			$db->execute();
 		}
 		catch (\Throwable $e)
 		{
-			Log::add('Error protecting MokoWaaS extensions: ' . $e->getMessage(), Log::WARNING, 'jerror');
+			Log::add('Error enabling update server: ' . $e->getMessage(), Log::WARNING, 'jerror');
 		}
 	}

@@ -1,85 +1,103 @@
 <?xml version='1.0' encoding='UTF-8'?>
 <!-- Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
 SPDX-License-Identifier: GPL-3.0-or-later
- VERSION: 02.04.00
+ VERSION: 02.26.01-dev
 -->

 <updates>
  <update>
-    <name>MokoWaaS</name>
-    <description>MokoWaaS development build.</description>
+    <name>Package - MokoWaaS</name>
+    <description>Package - MokoWaaS alpha build.</description>
    <element>pkg_mokowaas</element>
    <type>package</type>
-    <version>02.05.01</version>
-    <creationDate>2026-05-26</creationDate>
-    <infourl title='MokoWaaS'>https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS/releases/tag/development</infourl>
+    <client>site</client>
+    <version>02.26.00-alpha</version>
+    <creationDate>2026-05-30</creationDate>
+    <infourl title="Package - MokoWaaS">https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS/releases/tag/alpha</infourl>
    <downloads>
-      <downloadurl type='full' format='zip'>https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS/releases/download/development/pkg_mokowaas-02.05.01-dev.zip</downloadurl>
+      <downloadurl type="full" format="zip">https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS/releases/download/alpha/pkg_mokowaas-02.26.00-alpha.zip</downloadurl>
    </downloads>
-    <sha256>e336a36a71cf9c42f8bf85cb3c4e250f68019cea581145ce3394f77c22dca79b</sha256>
-    <tags><tag>development</tag></tags>
-    <maintainer>Moko Consulting</maintainer>
-    <maintainerurl>https://mokoconsulting.tech</maintainerurl>
-    <targetplatform name='joomla' version='(5|6).*'/>
-  </update>
-  <update>
-    <name>MokoWaaS</name>
-    <description>MokoWaaS update</description>
-    <element>mokowaas</element>
-    <type>package</type>
-    <version>02.04.00-alpha</version>
+    <sha256>e5b47e71c97e67cb70f14c9c6c559ce1fbc841a60c7d0c75ee00ec150f3d88b7</sha256>
    <tags><tag>alpha</tag></tags>
-    <infourl title="MokoWaaS">https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS/releases/tag/alpha</infourl>
-    <downloads>
-      <downloadurl type="full" format="zip">https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS/releases/download/alpha/pkg_mokowaas-02.04.00-alpha.zip</downloadurl>
-    </downloads>
-    <targetplatform name="joomla" version="(5|6)\..*" />
+    <changelogurl>https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS/raw/branch/main/CHANGELOG.md</changelogurl>
    <maintainer>Moko Consulting</maintainer>
    <maintainerurl>https://mokoconsulting.tech</maintainerurl>
+    <targetplatform name="joomla" version="(5|6)\..*"/>
  </update>
  <update>
-    <name>MokoWaaS</name>
-    <description>MokoWaaS update</description>
-    <element>mokowaas</element>
+    <name>Package - MokoWaaS</name>
+    <description>Package - MokoWaaS beta build.</description>
+    <element>pkg_mokowaas</element>
    <type>package</type>
-    <version>02.04.00-beta</version>
+    <client>site</client>
+    <version>02.26.00-beta</version>
+    <creationDate>2026-05-30</creationDate>
+    <infourl title="Package - MokoWaaS">https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS/releases/tag/beta</infourl>
+    <downloads>
+      <downloadurl type="full" format="zip">https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS/releases/download/beta/pkg_mokowaas-02.26.00-beta.zip</downloadurl>
+    </downloads>
+    <sha256>e5b47e71c97e67cb70f14c9c6c559ce1fbc841a60c7d0c75ee00ec150f3d88b7</sha256>
    <tags><tag>beta</tag></tags>
-    <infourl title="MokoWaaS">https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS/releases/tag/beta</infourl>
-    <downloads>
-      <downloadurl type="full" format="zip">https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS/releases/download/beta/pkg_mokowaas-02.04.00-beta.zip</downloadurl>
-    </downloads>
-    <targetplatform name="joomla" version="(5|6)\..*" />
+    <changelogurl>https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS/raw/branch/main/CHANGELOG.md</changelogurl>
    <maintainer>Moko Consulting</maintainer>
    <maintainerurl>https://mokoconsulting.tech</maintainerurl>
+    <targetplatform name="joomla" version="(5|6)\..*"/>
  </update>
  <update>
-    <name>MokoWaaS</name>
-    <description>MokoWaaS update</description>
-    <element>mokowaas</element>
+    <name>Package - MokoWaaS</name>
+    <description>Package - MokoWaaS rc build.</description>
+    <element>pkg_mokowaas</element>
    <type>package</type>
-    <version>02.04.00-rc</version>
+    <client>site</client>
+    <version>02.26.00-rc</version>
+    <creationDate>2026-05-30</creationDate>
+    <infourl title="Package - MokoWaaS">https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS/releases/tag/release-candidate</infourl>
+    <downloads>
+      <downloadurl type="full" format="zip">https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS/releases/download/release-candidate/pkg_mokowaas-02.26.00-rc.zip</downloadurl>
+    </downloads>
+    <sha256>e5b47e71c97e67cb70f14c9c6c559ce1fbc841a60c7d0c75ee00ec150f3d88b7</sha256>
    <tags><tag>rc</tag></tags>
-    <infourl title="MokoWaaS">https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS/releases/tag/rc</infourl>
-    <downloads>
-      <downloadurl type="full" format="zip">https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS/releases/download/rc/pkg_mokowaas-02.04.00-rc.zip</downloadurl>
-    </downloads>
-    <targetplatform name="joomla" version="(5|6)\..*" />
+    <changelogurl>https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS/raw/branch/main/CHANGELOG.md</changelogurl>
    <maintainer>Moko Consulting</maintainer>
    <maintainerurl>https://mokoconsulting.tech</maintainerurl>
+    <targetplatform name="joomla" version="(5|6)\..*"/>
  </update>
  <update>
-    <name>MokoWaaS</name>
-    <description>MokoWaaS update</description>
-    <element>mokowaas</element>
+    <name>Package - MokoWaaS</name>
+    <description>Package - MokoWaaS stable build.</description>
+    <element>pkg_mokowaas</element>
    <type>package</type>
-    <version>02.04.00</version>
-    <tags><tag>stable</tag></tags>
-    <infourl title="MokoWaaS">https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS/releases/tag/stable</infourl>
+    <client>site</client>
+    <version>02.26.00</version>
+    <creationDate>2026-05-30</creationDate>
+    <infourl title="Package - MokoWaaS">https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS/releases/tag/stable</infourl>
    <downloads>
-      <downloadurl type="full" format="zip">https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS/releases/download/stable/pkg_mokowaas-02.04.00.zip</downloadurl>
+      <downloadurl type="full" format="zip">https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS/releases/download/stable/pkg_mokowaas-02.26.00.zip</downloadurl>
    </downloads>
-    <targetplatform name="joomla" version="(5|6)\..*" />
+    <sha256>e5b47e71c97e67cb70f14c9c6c559ce1fbc841a60c7d0c75ee00ec150f3d88b7</sha256>
+    <tags><tag>stable</tag></tags>
+    <changelogurl>https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS/raw/branch/main/CHANGELOG.md</changelogurl>
    <maintainer>Moko Consulting</maintainer>
    <maintainerurl>https://mokoconsulting.tech</maintainerurl>
+    <targetplatform name="joomla" version="(5|6)\..*"/>
+  </update>
+  <update>
+    <name>Package - MokoWaaS</name>
+    <description>Package - MokoWaaS development build.</description>
+    <element>pkg_mokowaas</element>
+    <type>package</type>
+    <client>site</client>
+    <version>02.26.01-dev</version>
+    <creationDate>2026-05-31</creationDate>
+    <infourl title='Package - MokoWaaS'>https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS/releases/tag/development</infourl>
+    <downloads>
+      <downloadurl type='full' format='zip'>https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS/releases/download/development/pkg_mokowaas-02.26.01-dev.zip</downloadurl>
+    </downloads>
+    <sha256>0649b3d62359dae9d984c7833f442e562b1b453d3d71114432cfb31b880ca670</sha256>
+    <tags><tag>dev</tag></tags>
+    <changelogurl>https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS/raw/branch/main/CHANGELOG.md</changelogurl>
+    <maintainer>Moko Consulting</maintainer>
+    <maintainerurl>https://mokoconsulting.tech</maintainerurl>
+    <targetplatform name="joomla" version="(5|6)\..*" />
  </update>
 </updates>
@@ -0,0 +1,337 @@
+# API Endpoints
+
+MokoWaaS provides 6 remote management endpoints accessible via query string parameter. All endpoints require HTTPS and Bearer token authentication.
+
+## Authentication
+
+All endpoints require the `health_api_token` as a Bearer token in the Authorization header:
+
+```
+Authorization: Bearer <health_api_token>
+```
+
+The token is auto-generated during plugin installation and stored as a read-only parameter in the plugin configuration. It can also be passed as a `token` query parameter as a fallback.
+
+Token validation uses `hash_equals()` for timing-safe comparison. If no token is configured, the endpoint returns HTTP 503. An invalid token returns HTTP 401.
+
+## Endpoints
+
+### 1. Health Check
+
+```
+GET /?mokowaas=health
+```
+
+Runs 16 diagnostic checks and returns a comprehensive health report. See [Health Monitoring](Health-Monitoring) for full documentation of all checks and response format.
+
+**Response**: JSON object with `status` (`ok`/`degraded`/`error`), `reason`, `timestamp`, `checks`, and `meta`.
+
+**HTTP Status**: 200 (ok/degraded), 503 (error).
+
+---
+
+### 2. Site Info
+
+```
+GET /?mokowaas=info
+```
+
+Returns a compact summary of the Joomla site.
+
+**Response**:
+
+| Field | Description |
+|---|---|
+| `site_name` | Joomla site name |
+| `site_url` | Site root URL |
+| `joomla_version` | Joomla CMS version |
+| `php_version` | PHP version |
+| `db_type` | Database driver (e.g. `pdomysql`) |
+| `debug` | Whether debug mode is on |
+| `sef` | Whether SEF URLs are enabled |
+| `caching` | Whether caching is enabled |
+| `articles` | Total article count |
+| `users` | Total user count |
+| `extensions` | Number of enabled extensions |
+| `brand` | Configured brand name |
+| `plugin_version` | MokoWaaS plugin version |
+
+---
+
+### 3. Remote Install
+
+```
+POST /?mokowaas=install
+Content-Type: application/json
+
+{"url": "https://example.com/extension.zip"}
+```
+
+Downloads and installs a Joomla extension from the provided URL. The extension is downloaded to a temporary directory, extracted, and installed using Joomla's installer API.
+
+**Response**: JSON object with `status`, `extension` name, and `message`.
+
+**HTTP Status**: 200 (success), 400 (missing URL), 405 (not POST), 500 (install failed).
+
+---
+
+### 4. Update Check
+
+```
+POST /?mokowaas=update
+```
+
+Clears the Joomla update cache and triggers a fresh update check via `Updater::findUpdates()`.
+
+**Response**:
+
+| Field | Description |
+|---|---|
+| `status` | `ok` |
+| `updates_found` | Number of available updates |
+| `message` | Human-readable summary |
+
+**HTTP Status**: 200 (success), 405 (not POST), 500 (failed).
+
+---
+
+### 5. Cache Clear
+
+```
+POST /?mokowaas=cache
+```
+
+Clears the Joomla site cache, admin cache, and PHP OPcache (if available).
+
+**Response**:
+
+| Field | Description |
+|---|---|
+| `status` | `ok` |
+| `message` | `Cache cleared` |
+
+**HTTP Status**: 200 (success), 405 (not POST), 500 (failed).
+
+---
+
+### 6. Backup (Akeeba)
+
+```
+POST /?mokowaas=backup
+Content-Type: application/json
+
+{"profile": 1}
+```
+
+Triggers an Akeeba Backup using the specified profile (defaults to profile 1). Requires Akeeba Backup to be installed.
+
+**Response**:
+
+| Field | Description |
+|---|---|
+| `status` | `started` |
+| `profile` | Backup profile ID used |
+| `message` | `Backup started` |
+
+**HTTP Status**: 200 (started), 404 (Akeeba not installed), 405 (not POST), 500 (failed), 501 (Akeeba Engine not loadable).
+
+## Error Responses
+
+All endpoints return errors in a consistent format:
+
+```json
+{
+  "error": "Error description",
+  "message": "Additional detail (optional)"
+}
+```
+
+### Common Error Codes
+
+| HTTP Status | Meaning |
+|---|---|
+| 400 | Bad request (unknown action, missing parameters) |
+| 401 | Invalid or missing authentication token |
+| 405 | Wrong HTTP method (e.g. GET when POST is required) |
+| 500 | Server error during operation |
+| 503 | No API token configured |
+
+## Unknown Actions
+
+Requesting an unknown action returns HTTP 400 with the list of available actions:
+
+```json
+{
+  "error": "Unknown action",
+  "action": "invalid",
+  "available": ["health", "install", "update", "cache", "backup", "info", "reset", "snapshot"]
+}
+```
+
+## Joomla REST API Routes
+
+In addition to the query-string endpoints above, MokoWaaS registers standard Joomla API routes via the `plg_webservices_mokowaas` plugin:
+
+| Route | Controller | Description |
+|---|---|---|
+| `GET /api/v1/mokowaas/health` | HealthController | Full site health diagnostics |
+| `POST /api/v1/mokowaas/cache` | CacheController | Clear all caches |
+| `POST /api/v1/mokowaas/update` | UpdateController | Trigger update check |
+| `POST /api/v1/mokowaas/install` | InstallController | Install extension from ZIP URL |
+| `POST /api/v1/mokowaas/reset` | ResetController | Restore site to baseline snapshot |
+| `GET/POST /api/v1/mokowaas/snapshot` | SnapshotController | List or create snapshots |
+| `POST /api/v1/mokowaas/sync` | SyncController | Push content to all sync targets |
+| `POST /api/v1/mokowaas/sync-receive` | SyncReceiveController | Receive content from source site |
+| `GET /api/v1/mokowaas/extensions` | ExtensionsController | List installed extensions |
+
+These routes use Joomla's standard API authentication (API token in `X-Joomla-Token` header) and are useful for integrations that already use the Joomla API framework.
+
+### Install Endpoint (REST API)
+
+```
+POST /api/index.php/v1/mokowaas/install
+X-Joomla-Token: <api-token>
+Content-Type: application/json
+
+{"url": "https://git.mokoconsulting.tech/.../plg_system_mokowaas-02.20.00.zip"}
+```
+
+Downloads the ZIP from the given URL and installs it via Joomla's Installer. Requires a Joomla API token with `core.manage` permission on `com_installer`.
+
+**Constraints:**
+- URL must use `http` or `https` scheme
+- URL path must end in `.zip`
+- Maximum download size: 64 MB
+
+**Success Response** (HTTP 200):
+
+```json
+{
+    "status": "ok",
+    "message": "Extension installed successfully",
+    "extension": {
+        "name": "MokoWaaS",
+        "version": "02.20.00",
+        "type": "plugin"
+    },
+    "source_url": "https://git.mokoconsulting.tech/.../plg_system_mokowaas-02.20.00.zip"
+}
+```
+
+**Error Responses:**
+
+| HTTP Status | Condition |
+|---|---|
+| 400 | Missing `url` field, non-HTTPS URL, or URL not ending in `.zip` |
+| 403 | API token lacks `core.manage` on `com_installer` |
+| 405 | Request method is not POST |
+| 500 | Download or installation failed |
+
+### Reset Endpoint (REST API)
+
+```
+POST /api/index.php/v1/mokowaas/reset
+X-Joomla-Token: <api-token>
+Content-Type: application/json
+
+{"baseline": "default"}
+```
+
+Restores the site to a named baseline snapshot. The `baseline` field is optional and defaults to the active baseline configured in the plugin.
+
+Requires `core.manage` permission on `com_plugins`.
+
+**Success Response** (HTTP 200):
+
+```json
+{
+    "status": "ok",
+    "message": "Site restored to baseline: default",
+    "baseline": "default",
+    "restored_tables": 15,
+    "media_restored": true
+}
+```
+
+### Snapshot Endpoint (REST API)
+
+**List snapshots:**
+
+```
+GET /api/index.php/v1/mokowaas/snapshot
+X-Joomla-Token: <api-token>
+```
+
+**Create snapshot:**
+
+```
+POST /api/index.php/v1/mokowaas/snapshot
+X-Joomla-Token: <api-token>
+Content-Type: application/json
+
+{"name": "my-baseline"}
+```
+
+The `name` field is optional and defaults to the active baseline name.
+
+**Success Response** (HTTP 200):
+
+```json
+{
+    "status": "ok",
+    "message": "Snapshot created",
+    "name": "my-baseline",
+    "tables": 15,
+    "has_media": true
+}
+```
+
+### Extensions Endpoint (REST API)
+
+```
+GET /api/index.php/v1/mokowaas/extensions
+X-Joomla-Token: <api-token>
+```
+
+Lists all installed Joomla extensions with version, enabled/protected/locked status, and update server info.
+
+**Query filters:**
+
+| Parameter | Description | Example |
+|---|---|---|
+| `type` | Filter by extension type | `?type=plugin` |
+| `search` | Search name or element | `?search=moko` |
+| `enabled` | Filter by enabled status | `?enabled=1` |
+
+**Query-string equivalent:** `GET /?mokowaas=extensions&search=moko&type=plugin`
+
+Requires `core.manage` on `com_installer`.
+
+**Success Response** (HTTP 200):
+
+```json
+{
+    "status": "ok",
+    "count": 3,
+    "extensions": [
+        {
+            "extension_id": 456,
+            "name": "System - MokoWaaS",
+            "type": "plugin",
+            "element": "mokowaas",
+            "folder": "system",
+            "client_id": 0,
+            "enabled": true,
+            "protected": true,
+            "locked": false,
+            "version": "02.21.00",
+            "author": "Moko Consulting",
+            "update_server": {
+                "name": "MokoWaaS Update Server",
+                "location": "https://git.mokoconsulting.tech/.../updates.xml",
+                "enabled": true
+            }
+        }
+    ]
+}
+```
@@ -0,0 +1,94 @@
+# Configuration
+
+All MokoWaaS settings are managed in the Joomla plugin configuration under **System > Plugins > System - MokoWaaS**. Settings are organized into tabs (fieldsets).
+
+## Basic (Branding)
+
+| Parameter | Type | Default | Description |
+|---|---|---|---|
+| `enable_branding` | Yes/No | Yes | Enable white-label branding (language overrides, logos, colors) |
+| `brand_name` | Text | `MokoWaaS` | Brand name displayed throughout the admin interface |
+| `company_name` | Text | `Moko Consulting` | Company name used in footers and copyright notices |
+| `support_url` | URL | `https://mokoconsulting.tech` | Support link shown on the admin login page and dashboard |
+
+## WaaS Access
+
+Controls the master user system that designates a single operator account.
+
+| Parameter | Type | Default | Description |
+|---|---|---|---|
+| `enforce_master_user` | Yes/No | Yes | Enable master user enforcement; non-master Super Admins are restricted |
+| `master_username` | Text | `mokoconsulting` | Username of the designated master operator |
+| `master_email` | Email | `webmaster@mokoconsulting.tech` | Email address of the master user (for verification) |
+| `emergency_access` | Yes/No | Yes | Enable emergency access via database password + file-based 2FA |
+| `allowed_ips_display` | Display | -- | Read-only display of whitelisted IP addresses for emergency access |
+
+## Maintenance
+
+| Parameter | Type | Default | Description |
+|---|---|---|---|
+| `dev_mode` | Yes/No | No | Disable Joomla caching at runtime (does not modify `configuration.php`) |
+| `reset_hits` | Yes/No | No | Reset article hit counters on next admin load |
+| `delete_versions` | Yes/No | No | Purge content version history on next admin load |
+
+## Visual Branding
+
+| Parameter | Type | Default | Description |
+|---|---|---|---|
+| `color_primary` | Color | `#1a2744` | Primary brand color (buttons, accents) |
+| `color_sidebar` | Color | `#0f1b2d` | Admin sidebar background color |
+| `color_header` | Color | `#1a2744` | Admin header bar color |
+| `color_link` | Color | `#0051ad` | Link text color |
+| `brand_icon` | Text | -- | FontAwesome unicode code point (e.g. `f6d5`) for the brand icon |
+| `custom_css` | Textarea | -- | Custom CSS injected into every admin page |
+
+## Tenant Restrictions
+
+Controls what non-master Super Admin users can access.
+
+| Parameter | Type | Default | Description |
+|---|---|---|---|
+| `restrict_installer` | Yes/No | Yes | Block access to Extension Manager for non-master users |
+| `hide_sysinfo` | Yes/No | Yes | Hide System Information page from non-master users |
+| `restrict_global_config` | Yes/No | Yes | Block access to Global Configuration for non-master users |
+| `restrict_template_editing` | Yes/No | Yes | Prevent non-master users from editing template files |
+| `disable_install_url` | Yes/No | Yes | Remove the "Install from URL" tab in Extension Manager |
+| `hidden_menu_items` | Textarea | -- | Comma-separated list of admin menu item IDs to hide from non-master users |
+
+## Site Aliases
+
+Multi-domain support. See [Site Aliases](Site-Aliases) for full documentation.
+
+| Parameter | Type | Default | Description |
+|---|---|---|---|
+| `primary_domain` | Text | -- | The canonical domain for the site (e.g. `waas.dev.mokoconsulting.tech`) |
+| `site_aliases` | Subform | -- | Repeatable table of alias domains with per-alias settings |
+
+Each alias entry contains:
+
+| Field | Type | Default | Description |
+|---|---|---|---|
+| `domain` | Text | -- | Alias domain name (e.g. `www.example.com`) |
+| `offline` | Yes/No | No | Show offline page for this alias |
+| `offline_message` | Textarea | -- | Custom offline message (shown when `offline` is Yes) |
+| `robots` | List | `index, follow` | Robots meta directive for this alias |
+| `redirect_backend` | Yes/No | Yes | Redirect admin requests on this alias to the primary domain |
+
+## Diagnostics
+
+| Parameter | Type | Default | Description |
+|---|---|---|---|
+| `health_api_token` | Text (read-only) | -- | Auto-generated Bearer token for API authentication. Provisioned on install/update. Cannot be manually edited. |
+
+## Security
+
+| Parameter | Type | Default | Description |
+|---|---|---|---|
+| `force_https` | Yes/No | Yes | Redirect all HTTP requests to HTTPS (301 redirect) |
+| `admin_session_timeout` | Number | `60` | Idle timeout in minutes for admin sessions (0 = use Joomla default). Master user is exempt. |
+| `password_min_length` | Number | `12` | Minimum password length for user accounts |
+| `password_require_uppercase` | Yes/No | Yes | Require at least one uppercase letter |
+| `password_require_number` | Yes/No | Yes | Require at least one digit |
+| `password_require_special` | Yes/No | Yes | Require at least one special character |
+| `upload_allowed_types` | Text | `jpg,jpeg,png,gif,webp,svg,pdf,doc,docx,xls,xlsx` | Comma-separated list of allowed upload file extensions |
+| `upload_max_size_mb` | Number | `100` | Maximum upload file size in megabytes |
@@ -0,0 +1,127 @@
+# Grafana Integration
+
+MokoWaaS integrates with a Grafana monitoring stack hosted at `bench.mokoconsulting.tech`. The integration is automatic: on install or update, the plugin sends a heartbeat that provisions a Grafana datasource for the site.
+
+## Architecture
+
+```
+MokoWaaS Plugin (Joomla)
+    |
+    | POST /api/waas-heartbeat/register
+    v
+Heartbeat Receiver (bench.mokoconsulting.tech)
+    |
+    |-- Writes Grafana Infinity datasource YAML
+    |-- Restarts Grafana to pick up new datasource
+    |-- Sends ntfy notification (mokowaas-heartbeat topic)
+    v
+Grafana Dashboard
+    |
+    | GET /?mokowaas=health (per site, on schedule)
+    v
+Health JSON from each registered site
+```
+
+## Heartbeat Registration
+
+### When It Fires
+
+The heartbeat is sent automatically during:
+
+- Plugin installation (`postflight` with type `install`)
+- Plugin update (`postflight` with type `update`)
+- Package installation (via `Pkg_MokowaasInstallerScript::sendHeartbeat()`)
+
+### Payload
+
+The plugin sends a POST request to `https://bench.mokoconsulting.tech/api/waas-heartbeat/register` with:
+
+```json
+{
+  "site_url": "https://example.com",
+  "site_name": "Example Site",
+  "health_token": "<health_api_token>",
+  "action": "register"
+}
+```
+
+Authentication uses a shared secret sent in the `X-MokoWaaS-Key` header.
+
+### What the Receiver Does
+
+On receiving a registration request, the heartbeat receiver:
+
+1. Validates the `X-MokoWaaS-Key` header
+2. Generates a unique datasource UID from the site URL
+3. Writes a Grafana Infinity datasource YAML file to the Grafana provisioning directory
+4. Restarts Grafana to load the new datasource
+5. Sends an ntfy notification to the `mokowaas-heartbeat` topic with registration details
+
+The datasource YAML configures a Grafana Infinity datasource that polls `/?mokowaas=health` on the registered site using the provided Bearer token.
+
+### Response
+
+On success (HTTP 200):
+
+```json
+{
+  "status": "ok",
+  "ds_uid": "mokowaas-example-com"
+}
+```
+
+The `ds_uid` is logged in the Joomla admin message queue for reference.
+
+## Grafana Dashboard
+
+The MokoWaaS Grafana dashboard is organized into 9 rows covering all health metrics:
+
+| Row | Panels |
+|---|---|
+| 1. Overview | Overall status, uptime, plugin version, Joomla version |
+| 2. Database | Connectivity, latency, driver, user count |
+| 3. Filesystem | Disk space, writable directories, site size |
+| 4. Extensions | Extension counts by type, pending updates |
+| 5. Backup | Last backup status, age, Akeeba health |
+| 6. Security | Admin Tools WAF, SSL certificate, blocked requests |
+| 7. Content | Article counts, categories, user activity |
+| 8. Infrastructure | Cache status, mail config, scheduled tasks, error log |
+| 9. Configuration | SEO settings, template info, config drift |
+
+Each row contains panels that query the site's Infinity datasource using JSONPath expressions to extract values from the health check response.
+
+## ntfy Notifications
+
+Registration events trigger a notification to the `mokowaas-heartbeat` ntfy topic. Notifications include:
+
+- Site URL
+- Site name
+- Registration action (new or update)
+- Datasource UID
+
+Subscribe to notifications at `https://ntfy.sh/mokowaas-heartbeat` or use the ntfy app.
+
+## Troubleshooting
+
+### Heartbeat failed: connection error
+
+The receiver at `bench.mokoconsulting.tech` may be unreachable. Check:
+
+- DNS resolution for `bench.mokoconsulting.tech`
+- Outbound HTTPS connectivity from the Joomla server
+- Firewall rules allowing outbound port 443
+
+Heartbeat failures are logged as warnings in Joomla's log and displayed in the admin message queue. They do not block plugin installation.
+
+### Datasource not appearing in Grafana
+
+- Verify the heartbeat completed successfully (check Joomla admin messages after install)
+- Check the Grafana provisioning directory on `bench.mokoconsulting.tech`
+- Ensure Grafana was restarted after provisioning
+- Verify the health endpoint is accessible from the Grafana server
+
+### Health data not loading in dashboard
+
+- Confirm the `health_api_token` matches between the plugin configuration and the Grafana datasource
+- Test the health endpoint directly: `curl -sk -H "Authorization: Bearer <token>" "https://example.com/?mokowaas=health"`
+- Check for SSL certificate issues between the Grafana server and the monitored site
@@ -0,0 +1,33 @@
+# Health Endpoint
+
+## Stable Release: 02.01.37
+
+16 diagnostic checks via /?mokowaas=health (token-authenticated, HTTPS-only).
+
+### Checks
+
+Core: database, filesystem, cache, extensions
+Security: backup (Akeeba), security (Admin Tools), SSL certificate
+Operations: scheduled tasks, error log, database size, mail
+Content: articles, categories, users, sessions, failed logins
+Config: SEO, templates, debug mode, force SSL, caching
+
+### Grafana Dashboard (9 rows)
+
+Site Overview | Health Metrics | Infrastructure | Backup | Security | SSL/Cron | Content/Users | Mail/SEO/Config | DB/Errors
+
+### Heartbeat
+
+Auto-registers with Grafana via bench.mokoconsulting.tech/api/waas-heartbeat/register
+ntfy notifications on mokowaas-heartbeat topic
+
+### Plugin Protection
+
+Hidden from non-master users, settings blocked, self-healing lock, uninstall blocked.
+
+---
+
+| Field | Value |
+|---|---|
+| Minimum Version | 02.01.37 |
+| Platform | joomla |
@@ -0,0 +1,267 @@
+# Health Monitoring
+
+MokoWaaS includes a built-in health monitoring system that runs 16 diagnostic checks against the Joomla site. Results are returned as a JSON payload via the `/?mokowaas=health` endpoint.
+
+## Endpoint
+
+```
+GET https://example.com/?mokowaas=health
+Authorization: Bearer <health_api_token>
+```
+
+The `health_api_token` is auto-generated during plugin installation and stored as a read-only plugin parameter. See [API Endpoints](API-Endpoints) for authentication details.
+
+## Response Structure
+
+The response includes an overall status, a human-readable reason string, a UTC timestamp, individual check results, and instance metadata.
+
+| Field | Description |
+|---|---|
+| `status` | Overall status: `ok`, `degraded`, or `error` |
+| `reason` | Human-readable summary of issues (null when status is `ok`) |
+| `timestamp` | ISO 8601 UTC timestamp |
+| `checks` | Object containing all 16 check results |
+| `meta` | Instance metadata (brand, versions, server name) |
+
+### Status Determination
+
+- If any check returns `error`, the overall status is `error` and the HTTP status code is **503**.
+- If any check returns `degraded` (and none are `error`), the overall status is `degraded` with HTTP **200**.
+- Otherwise the overall status is `ok` with HTTP **200**.
+
+## The 16 Checks
+
+### 1. database
+
+Tests database connectivity and query latency.
+
+| Field | Description |
+|---|---|
+| `status` | `ok` or `error` |
+| `latency_ms` | Query round-trip time in milliseconds |
+| `driver` | Database driver name (e.g. `mysqli`, `pdomysql`) |
+| `users` | Total user count (sanity check) |
+
+### 2. filesystem
+
+Checks writable directories and disk space.
+
+| Field | Description |
+|---|---|
+| `status` | `ok`, `degraded` (low disk), or `error` (not writable) |
+| `tmp_writable` | Whether `/tmp` is writable |
+| `log_writable` | Whether `/administrator/logs` is writable |
+| `cache_writable` | Whether `/cache` is writable |
+| `free_disk_mb` | Free disk space in MB |
+| `total_disk_mb` | Total disk space in MB |
+| `site_size_mb` | Estimated site size in MB (images, media, tmp, cache, logs) |
+
+Degraded when free disk is below 100 MB. Error when required directories are not writable.
+
+### 3. cache
+
+Reports Joomla cache configuration.
+
+| Field | Description |
+|---|---|
+| `status` | Always `ok` |
+| `enabled` | Whether Joomla caching is active |
+| `handler` | Cache handler type (e.g. `file`, `redis`) |
+
+### 4. extensions
+
+Counts enabled extensions by type and checks for pending updates.
+
+| Field | Description |
+|---|---|
+| `status` | `ok` or `degraded` (pending updates) |
+| `by_type` | Object with counts per extension type |
+| `pending_updates` | Number of available extension updates |
+
+### 5. backup (Akeeba)
+
+Checks Akeeba Backup status.
+
+| Field | Description |
+|---|---|
+| `status` | `ok`, `degraded`, or `error` |
+| `last_status` | Status of the last backup record (`complete`, `fail`, etc.) |
+| `days_since` | Days since the last backup |
+| `message` | Human-readable backup status |
+
+Degraded when the last backup is older than 7 days or did not complete successfully.
+
+### 6. security (Admin Tools)
+
+Checks Admin Tools WAF status if installed.
+
+| Field | Description |
+|---|---|
+| `status` | `ok`, `degraded`, or `error` |
+| `waf_enabled` | Whether the Web Application Firewall is active |
+| `blocked_24h` | Number of blocked requests in the last 24 hours |
+
+### 7. ssl
+
+Checks SSL certificate validity and expiration.
+
+| Field | Description |
+|---|---|
+| `status` | `ok`, `degraded`, or `error` |
+| `days_left` | Days until certificate expiration |
+| `issuer` | Certificate issuer |
+| `valid_from` | Certificate start date |
+| `valid_to` | Certificate expiration date |
+
+Degraded when the certificate expires within 30 days.
+
+### 8. cron (Scheduled Tasks)
+
+Checks Joomla scheduled task execution.
+
+| Field | Description |
+|---|---|
+| `status` | `ok` or `degraded` |
+| `total_tasks` | Total number of scheduled tasks |
+| `failed_24h` | Tasks that failed in the last 24 hours |
+
+### 9. errors (Error Log)
+
+Analyzes recent Joomla error log entries.
+
+| Field | Description |
+|---|---|
+| `status` | `ok` or `degraded` |
+| `recent_errors` | Count of recent error log entries |
+| `last_error` | Most recent error message |
+
+### 10. db_size
+
+Reports database size metrics.
+
+| Field | Description |
+|---|---|
+| `status` | `ok` or `degraded` |
+| `total_mb` | Total database size in MB |
+| `tables` | Number of database tables |
+
+### 11. content
+
+Reports content statistics.
+
+| Field | Description |
+|---|---|
+| `status` | Always `ok` |
+| `articles` | Total article count |
+| `categories` | Total category count |
+| `published` | Number of published articles |
+| `unpublished` | Number of unpublished articles |
+
+### 12. users (User Activity)
+
+Reports user statistics.
+
+| Field | Description |
+|---|---|
+| `status` | Always `ok` |
+| `total` | Total user count |
+| `active_30d` | Users active in the last 30 days |
+| `blocked` | Number of blocked user accounts |
+
+### 13. mail
+
+Checks Joomla mail configuration.
+
+| Field | Description |
+|---|---|
+| `status` | `ok` or `degraded` |
+| `mailer` | Mail handler type (e.g. `smtp`, `mail`, `sendmail`) |
+| `from` | Configured sender address |
+
+### 14. seo
+
+Checks SEO configuration.
+
+| Field | Description |
+|---|---|
+| `status` | `ok` or `degraded` |
+| `sef` | Whether SEF URLs are enabled |
+| `sef_rewrite` | Whether URL rewriting is enabled |
+| `sitemap` | Whether a sitemap is detected |
+
+### 15. template
+
+Reports active template information.
+
+| Field | Description |
+|---|---|
+| `status` | Always `ok` |
+| `site_template` | Active frontend template name |
+| `admin_template` | Active admin template name |
+
+### 16. config (Config Drift)
+
+Detects configuration anomalies.
+
+| Field | Description |
+|---|---|
+| `status` | `ok` or `degraded` |
+| `issues` | Array of detected configuration problems |
+
+Checks for issues such as debug mode enabled in production, error reporting set too high, or default database prefix still in use.
+
+## Example Response
+
+```json
+{
+  "status": "degraded",
+  "reason": "2 extension updates available; SSL expires in 14 days",
+  "timestamp": "2026-05-24T12:00:00Z",
+  "checks": {
+    "database": {
+      "status": "ok",
+      "latency_ms": 1.23,
+      "driver": "pdomysql",
+      "users": 5
+    },
+    "filesystem": {
+      "status": "ok",
+      "tmp_writable": true,
+      "log_writable": true,
+      "cache_writable": true,
+      "free_disk_mb": 4500,
+      "total_disk_mb": 20000,
+      "site_size_mb": 320
+    },
+    "ssl": {
+      "status": "degraded",
+      "days_left": 14,
+      "issuer": "Let's Encrypt",
+      "valid_to": "2026-06-07"
+    }
+  },
+  "meta": {
+    "brand": "MokoWaaS",
+    "plugin_version": "02.03.11",
+    "joomla_version": "5.2.4",
+    "php_version": "8.2.20",
+    "server_name": "Example Site",
+    "server_time": "2026-05-24T12:00:00Z"
+  }
+}
+```
+
+(Remaining checks omitted for brevity.)
+
+## Metadata
+
+The `meta` object is included in every health response:
+
+| Field | Description |
+|---|---|
+| `brand` | Configured brand name |
+| `plugin_version` | MokoWaaS plugin version |
+| `joomla_version` | Joomla CMS version |
+| `php_version` | PHP version |
+| `server_name` | Joomla site name |
+| `server_time` | Server UTC time |
@@ -0,0 +1,52 @@
+# MokoWaaS
+
+MokoWaaS is a Joomla 5.x / 6.x extension package that provides a configurable white-label identity layer, tenant management, health monitoring, and remote administration API for the MokoWaaS platform.
+
+Developed by [Moko Consulting](https://mokoconsulting.tech). Licensed under GPL-3.0-or-later.
+
+## Features
+
+- **White-label branding** -- customizable brand name, colors, favicon, login page, and admin template theming
+- **Master user enforcement** -- designate a single operator account with elevated privileges; restrict other Super Admins
+- **Tenant restrictions** -- hide system info, block installer access, restrict global config and template editing, hide menu items
+- **Site aliases** -- multi-domain support with per-alias offline mode, robots directives, and backend redirects
+- **Health monitoring** -- 16 diagnostic checks exposed via authenticated JSON API
+- **Remote management API** -- 6 endpoints for health, info, install, update, cache clear, and backup
+- **Grafana integration** -- automatic heartbeat registration with Grafana Infinity datasource provisioning
+- **Plugin protection** -- protected flag, self-healing, hidden from non-master users, blocks disable/uninstall
+- **Security hardening** -- forced HTTPS, session timeouts, password policy, upload restrictions
+- **Emergency access** -- file-based two-factor verification for master user recovery
+- **Automatic updates** -- via Joomla update server hosted on Gitea
+
+## Requirements
+
+| Requirement | Minimum |
+|---|---|
+| Joomla | 5.0.0+ (5.x and 6.x supported) |
+| PHP | 8.1.0+ |
+
+## Package Contents
+
+The `pkg_mokowaas` package installs three extensions:
+
+| Extension | Type | Purpose |
+|---|---|---|
+| `plg_system_mokowaas` | System Plugin | Core branding, restrictions, health checks, API endpoints |
+| `com_mokowaas` | Component | REST API controllers (health, cache, update) |
+| `plg_webservices_mokowaas` | Webservices Plugin | Registers Joomla API routes for `v1/mokowaas/*` |
+
+## Wiki Pages
+
+- [Configuration](Configuration) -- All plugin settings organized by tab
+- [Health Monitoring](Health-Monitoring) -- The 16 diagnostic checks
+- [Site Aliases](Site-Aliases) -- Multi-domain management
+- [API Endpoints](API-Endpoints) -- The 6 remote management endpoints
+- [Grafana Integration](Grafana-Integration) -- Monitoring dashboard setup
+- [Plugin Protection](Plugin-Protection) -- Security measures preventing disable/uninstall
+- [Installation](Installation) -- Step-by-step install and upgrade guide
+
+## Links
+
+- **Repository**: [MokoWaaS on Gitea](https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS)
+- **Update Server**: [updates.xml](https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS/raw/branch/main/updates.xml)
+- **Author**: [Moko Consulting](https://mokoconsulting.tech)
@@ -0,0 +1,100 @@
+# Installation
+
+MokoWaaS is distributed as a Joomla package (`pkg_mokowaas`) containing three extensions. It can be installed via the standard Joomla Extension Manager.
+
+## Requirements
+
+| Requirement | Minimum |
+|---|---|
+| Joomla | 5.0.0+ |
+| PHP | 8.1.0+ |
+
+The installer checks both requirements during `preflight` and aborts with an error message if either is not met.
+
+## Method 1: Upload Package File
+
+1. Download the latest `pkg_mokowaas.zip` from the [Gitea Releases](https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS/releases) page.
+2. In Joomla admin, navigate to **System > Install > Extensions**.
+3. On the **Upload Package File** tab, drag and drop or browse to select `pkg_mokowaas.zip`.
+4. Click **Upload & Install**.
+5. Verify the success message. The package installs three extensions:
+   - `plg_system_mokowaas` (System Plugin)
+   - `com_mokowaas` (Component)
+   - `plg_webservices_mokowaas` (Webservices Plugin)
+
+## Method 2: Install from URL
+
+1. In Joomla admin, navigate to **System > Install > Extensions**.
+2. On the **Install from URL** tab, enter the direct download URL for the package ZIP, e.g.:
+   ```
+   https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS/releases/download/stable/pkg_mokowaas-latest.zip
+   ```
+3. Click **Install**.
+4. Verify the success message.
+
+## Post-Installation Verification
+
+After installation, verify the following:
+
+1. **Plugin enabled**: Navigate to **System > Plugins** and confirm "System - MokoWaaS" is enabled (it is auto-enabled during installation).
+2. **Health token generated**: Open the plugin configuration and check the **Diagnostics** tab. The `health_api_token` field should contain an auto-generated token.
+3. **Branding applied**: The admin login page and dashboard should reflect MokoWaaS branding (logo, colors, footer text).
+4. **Health endpoint**: Test the health endpoint:
+   ```
+   curl -sk -H "Authorization: Bearer <token>" "https://yoursite.com/?mokowaas=health"
+   ```
+5. **Grafana heartbeat**: Check the admin message queue for a Grafana heartbeat confirmation message.
+
+## What the Installer Does
+
+During `postflight`, the installer script performs these operations:
+
+| Step | Description |
+|---|---|
+| Enable and protect plugin | Sets `enabled=1`, `protected=1`, `locked=0` in `#__extensions` |
+| Install MokoOnyx template | Installs the bundled MokoOnyx site template from the plugin payload, sets it as default |
+| Language overrides | Deploys language override files for en-GB and en-US |
+| Login support URLs | Updates `mod_loginsupport` to point to Moko Consulting support/docs/news URLs |
+| Atum branding | Applies brand colors to the Atum admin template |
+| Action log registration | Registers MokoWaaS in the Joomla action log system |
+| Health token provisioning | Generates a random API token if one does not exist |
+| Heartbeat | Sends a registration heartbeat to the Grafana monitoring receiver |
+
+## Automatic Updates
+
+MokoWaaS includes an update server configuration that enables automatic update notifications through Joomla's built-in update system.
+
+The update server URL is:
+```
+https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS/raw/branch/main/updates.xml
+```
+
+When a new version is available:
+
+1. Joomla's update checker detects the new version from `updates.xml`.
+2. A notification appears in the admin dashboard.
+3. Navigate to **System > Update > Extensions** to install the update.
+4. The `postflight` script runs again, re-applying all configuration steps.
+
+## Upgrading from Standalone Plugin to Package
+
+If you previously installed the standalone `plg_system_mokowaas` plugin (before it was packaged as `pkg_mokowaas`), the package installer handles migration automatically:
+
+1. Install the `pkg_mokowaas.zip` package using either method above.
+2. The package installer detects the existing standalone plugin and upgrades it in place.
+3. The additional extensions (`com_mokowaas`, `plg_webservices_mokowaas`) are installed alongside.
+4. All existing plugin settings are preserved.
+5. The `protected` flag is set on all package extensions.
+
+No manual cleanup of the old standalone plugin is required.
+
+## Uninstallation
+
+Uninstallation is restricted to the master user. See [Plugin Protection](Plugin-Protection) for details.
+
+When the master user uninstalls via the Extension Manager:
+
+1. Language override files are removed from Joomla's global override directories.
+2. Action log registration is cleaned up.
+3. An uninstall notification is sent to the monitoring system.
+4. The package and all sub-extensions are removed.
@@ -0,0 +1,89 @@
+# Plugin Protection
+
+MokoWaaS uses multiple layers of protection to prevent accidental or unauthorized disabling and uninstallation. The master user retains full control over the plugin at all times.
+
+## Protection Layers
+
+### 1. Protected Flag (`protected=1`)
+
+During installation and on every admin session, MokoWaaS sets the `protected` column to `1` in the `#__extensions` database table for both `mokowaas` and `pkg_mokowaas` entries.
+
+The Joomla framework itself enforces this flag: protected extensions cannot be disabled or uninstalled through the standard admin interface.
+
+The `locked` column is set to `0` so the extension can still receive updates and configuration changes.
+
+### 2. Self-Healing
+
+The `ensureProtectedFlag()` method runs once per admin session (using a static flag to avoid repeated queries). If the `protected` column has been reset to `0` (e.g., by a database modification), it is automatically restored to `1`.
+
+This runs in the `protectPlugin()` method, which is called from `onBeforeRender()` on every admin page load.
+
+### 3. Hidden from Plugin List
+
+For non-master users, MokoWaaS injects JavaScript on the `com_plugins` and `com_installer` pages that hides any table row containing "mokowaas" or "MokoWaaS". This prevents non-master users from seeing the plugin in the extension list.
+
+The `hidePluginFromList()` method adds an inline script that runs on `DOMContentLoaded`:
+
+```javascript
+document.querySelectorAll('tr').forEach(function(row) {
+    var text = row.textContent || '';
+    if (text.indexOf('mokowaas') !== -1 || text.indexOf('MokoWaaS') !== -1) {
+        row.style.display = 'none';
+    }
+});
+```
+
+### 4. onExtensionBeforeSave Interception
+
+The `onExtensionBeforeSave` event handler intercepts save attempts on the plugin configuration. If a non-master user attempts to save the plugin with `enabled = 0`, the handler:
+
+1. Displays an error message: "MokoWaaS cannot be disabled."
+2. Forces `enabled` back to `1` on the table object
+3. Returns `true` to allow the save to proceed (with the corrected value)
+
+### 5. protectPlugin() -- Uninstall and Disable Blocking
+
+The `protectPlugin()` method runs on every admin page request and checks for active uninstall or disable attempts:
+
+**Uninstall blocking**: If the current request is to `com_installer` with task `manage.remove`, and the extension IDs include any MokoWaaS extension, the request is blocked with an error message and a redirect back to the installer manage view.
+
+**Disable blocking**: If the current request is to `com_plugins` with task `plugins.publish`, and the extension IDs include MokoWaaS, the request is blocked with an error message and a redirect back to the plugins list.
+
+The `isOurExtension()` helper method checks extension IDs against the database to determine if they belong to MokoWaaS (matching on element name `mokowaas` or `pkg_mokowaas`).
+
+## Master User Exemption
+
+All protection checks call `isMasterUser()` first. If the current user is the designated master user (matching the configured `master_username`), all protections are bypassed. The master user can:
+
+- See MokoWaaS in the plugin and extension lists
+- Disable the plugin via the configuration page
+- Uninstall the plugin via the Extension Manager
+- Modify all plugin settings
+
+## Installation-Time Protection
+
+The package installer script (`Pkg_MokowaasInstallerScript`) and the plugin installer script both set `protected=1` during `postflight`:
+
+- `enableAndLockPlugin()` sets `enabled=1`, `locked=1`, `protected=1` on the system plugin
+- `protectExtensions()` sets `protected=1`, `locked=0` on all MokoWaaS extensions (plugin and package)
+
+This ensures protection is active immediately after installation, before the first admin page load triggers the self-healing logic.
+
+## Summary of Protection Flow
+
+```
+Installation
+  -> postflight sets protected=1, enabled=1
+
+Every admin page load (onBeforeRender)
+  -> protectPlugin()
+     -> ensureProtectedFlag() (once per session, restores protected=1 if needed)
+     -> if not master user:
+        -> block uninstall attempts (com_installer manage.remove)
+        -> block disable attempts (com_plugins plugins.publish)
+     -> hidePluginFromList() for non-master users
+
+Plugin config save (onExtensionBeforeSave)
+  -> if not master user and enabled=0:
+     -> force enabled=1, show error
+```
@@ -0,0 +1,69 @@
+# Site Aliases
+
+MokoWaaS supports multi-domain configurations through the Site Aliases system. This allows a single Joomla installation to respond to multiple domain names, each with independent settings for offline mode, robots directives, and backend access.
+
+## Configuration
+
+Site aliases are configured in the plugin settings under the **Site Aliases** tab.
+
+### Primary Domain
+
+Set `primary_domain` to the canonical domain for the site (e.g. `waas.dev.mokoconsulting.tech`). This is the domain that:
+
+- Serves as the canonical URL for SEO purposes
+- Hosts the admin backend (when `redirect_backend` is enabled on aliases)
+- Is used in heartbeat registration with Grafana
+
+### Alias Entries
+
+Add alias domains using the repeatable subform table. Each alias entry has the following options:
+
+| Field | Type | Default | Description |
+|---|---|---|---|
+| `domain` | Text | (required) | The alias domain name, e.g. `www.example.com` |
+| `offline` | Yes/No | No | When Yes, visitors to this alias see the offline page |
+| `offline_message` | Textarea | -- | Custom message displayed when the alias is offline (only shown when `offline` is Yes) |
+| `robots` | List | `index, follow` | Robots meta tag directive for this alias |
+| `redirect_backend` | Yes/No | Yes | When Yes, admin URLs (`/administrator`) on this alias redirect to the primary domain |
+
+### Robots Options
+
+Each alias can have its own robots directive:
+
+| Value | Effect |
+|---|---|
+| `index, follow` | Normal indexing (default) |
+| `noindex, follow` | Do not index pages, but follow links |
+| `index, nofollow` | Index pages, do not follow links |
+| `noindex, nofollow` | Do not index or follow |
+| `none` | Equivalent to `noindex, nofollow` |
+
+## How Canonical URLs Work
+
+When a request arrives on an alias domain, MokoWaaS:
+
+1. Matches the `HTTP_HOST` against configured alias domains
+2. Applies the alias-specific robots meta tag
+3. If the alias is marked offline, renders the offline page with the custom message
+4. If `redirect_backend` is enabled and the request is for `/administrator`, issues a 301 redirect to the primary domain's admin
+5. Sets the canonical URL to the primary domain equivalent of the current page
+
+This prevents duplicate content issues when the same site is accessible from multiple domains.
+
+## Grafana Monitoring for Aliases
+
+When the plugin sends a heartbeat to the Grafana monitoring receiver, it registers both the primary domain and all alias domains. The monitoring dashboard can then track health status for each domain independently.
+
+Each alias appears as a separate entry in the Grafana Infinity datasource, pointing to the same health endpoint but accessed via the alias domain. This ensures SSL certificate checks and DNS resolution are validated per-domain.
+
+## DreamHost Mirror Setup
+
+For sites hosted on DreamHost, alias domains are typically configured as "mirror" domains in the DreamHost panel:
+
+1. In DreamHost panel, add the alias domain as a **Mirror** of the primary domain
+2. Ensure DNS for the alias domain points to the DreamHost server
+3. Add the alias domain to the MokoWaaS Site Aliases configuration
+4. Set `redirect_backend` to Yes (recommended) so admin access always uses the primary domain
+5. Set `robots` to `noindex, nofollow` if the alias is a staging or preview domain
+
+DreamHost mirrors serve the same filesystem, so no additional Joomla configuration is needed beyond the MokoWaaS alias entry.