chore: update updates.xml (development: 02.03.12-dev) [skip ci]

chore(version): auto-bump patch 02.03.12 [skip ci]
security: protected status prevents disable/uninstall
2026-05-24 08:54:00 +00:00 · 2026-05-24 08:53:59 +00:00 · 2026-05-24 03:53:33 -05:00 · 2026-05-24 03:49:16 -05:00 · 2026-05-24 08:47:22 +00:00 · 2026-05-24 08:47:21 +00:00
49 changed files with 2510 additions and 1321 deletions
@@ -203,3 +203,5 @@ venv/
 *.coverage
 hypothesis/

+profile.ps1
+TODO.md
@@ -18,7 +18,7 @@
  </governance>
  <build>
    <language>PHP</language>
-    <package-type>plugin</package-type>
+    <package-type>package</package-type>
    <entry-point>src/</entry-point>
  </build>
 </moko-platform>
@@ -1,126 +0,0 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
-#
-# SPDX-License-Identifier: GPL-3.0-or-later
-#
-# FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
-# INGROUP: MokoStandards.Deploy
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/MokoStandards-API
-# PATH: /templates/workflows/joomla/deploy-manual.yml.template
-# VERSION: 04.07.00
-# BRIEF: Manual SFTP deploy to dev server for Joomla repos
-
-name: "Universal: Deploy to Dev (Manual)"
-
-on:
-  workflow_dispatch:
-    inputs:
-      clear_remote:
-        description: 'Delete all remote files before uploading'
-        required: false
-        default: 'false'
-        type: boolean
-
-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-
-permissions:
-  contents: read
-
-jobs:
-  deploy:
-    name: SFTP Deploy to Dev
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-
-      - name: Setup PHP
-        run: |
-          php -v && composer --version
-
-      - name: Setup MokoStandards tools
-        env:
-          GA_TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
-          MOKO_CLONE_TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
-          MOKO_CLONE_HOST: ${{ secrets.GA_TOKEN && 'git.mokoconsulting.tech/MokoConsulting' || 'github.com/mokoconsulting-tech' }}
-          COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.GA_TOKEN || github.token }}"}}'
-        run: |
-          git clone --depth 1 --branch main --quiet \
-            "https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/MokoStandards-API.git" \
-            /tmp/mokostandards-api 2>/dev/null || true
-          if [ -d "/tmp/mokostandards-api" ] && [ -f "/tmp/mokostandards-api/composer.json" ]; then
-            cd /tmp/mokostandards-api && composer install --no-dev --no-interaction --quiet 2>/dev/null || true
-          fi
-
-      - name: Check FTP configuration
-        id: check
-        env:
-          HOST: ${{ vars.DEV_FTP_HOST }}
-          PATH_VAR: ${{ vars.DEV_FTP_PATH }}
-          PORT: ${{ vars.DEV_FTP_PORT }}
-        run: |
-          if [ -z "$HOST" ] || [ -z "$PATH_VAR" ]; then
-            echo "DEV_FTP_HOST or DEV_FTP_PATH not configured -- cannot deploy"
-            echo "skip=true" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-          echo "skip=false" >> "$GITHUB_OUTPUT"
-          echo "host=$HOST" >> "$GITHUB_OUTPUT"
-
-          REMOTE="${PATH_VAR%/}"
-          echo "remote=$REMOTE" >> "$GITHUB_OUTPUT"
-
-          [ -z "$PORT" ] && PORT="22"
-          echo "port=$PORT" >> "$GITHUB_OUTPUT"
-
-      - name: Deploy via SFTP
-        if: steps.check.outputs.skip != 'true'
-        env:
-          SFTP_KEY: ${{ secrets.DEV_FTP_KEY }}
-          SFTP_PASS: ${{ secrets.DEV_FTP_PASSWORD }}
-          SFTP_USER: ${{ vars.DEV_FTP_USERNAME }}
-        run: |
-          SOURCE_DIR="src"
-          [ ! -d "$SOURCE_DIR" ] && SOURCE_DIR="htdocs"
-          [ ! -d "$SOURCE_DIR" ] && { echo "No src/ or htdocs/ -- nothing to deploy"; exit 0; }
-
-          printf '{"host":"%s","port":%s,"username":"%s","remotePath":"%s"' \
-            "${{ steps.check.outputs.host }}" "${{ steps.check.outputs.port }}" "$SFTP_USER" "${{ steps.check.outputs.remote }}" \
-            > /tmp/sftp-config.json
-
-          if [ -n "$SFTP_KEY" ]; then
-            echo "$SFTP_KEY" > /tmp/deploy_key
-            chmod 600 /tmp/deploy_key
-            printf ',"privateKeyPath":"/tmp/deploy_key"}' >> /tmp/sftp-config.json
-          else
-            printf ',"password":"%s"}' "$SFTP_PASS" >> /tmp/sftp-config.json
-          fi
-
-          DEPLOY_ARGS=(--path . --src-dir "$SOURCE_DIR" --config /tmp/sftp-config.json)
-          [ "${{ inputs.clear_remote }}" = "true" ] && DEPLOY_ARGS+=(--clear-remote)
-
-          PLATFORM=$(php /tmp/mokostandards-api/cli/platform_detect.php --path . 2>/dev/null || true)
-          if [ "$PLATFORM" = "waas-component" ] && [ -f "/tmp/mokostandards-api/deploy/deploy-joomla.php" ]; then
-            php /tmp/mokostandards-api/deploy/deploy-joomla.php "${DEPLOY_ARGS[@]}"
-          else
-            php /tmp/mokostandards-api/deploy/deploy-sftp.php "${DEPLOY_ARGS[@]}"
-          fi
-
-          rm -f /tmp/deploy_key /tmp/sftp-config.json
-
-      - name: Summary
-        if: always()
-        run: |
-          if [ "${{ steps.check.outputs.skip }}" = "true" ]; then
-            echo "### Deploy Skipped -- FTP not configured" >> $GITHUB_STEP_SUMMARY
-          else
-            echo "### Manual Dev Deploy Complete" >> $GITHUB_STEP_SUMMARY
-            echo "" >> $GITHUB_STEP_SUMMARY
-            echo "| Field | Value |" >> $GITHUB_STEP_SUMMARY
-            echo "|-------|-------|" >> $GITHUB_STEP_SUMMARY
-            echo "| Host | \`${{ steps.check.outputs.host }}\` |" >> $GITHUB_STEP_SUMMARY
-            echo "| Remote | \`${{ steps.check.outputs.remote }}\` |" >> $GITHUB_STEP_SUMMARY
-            echo "| Clear | ${{ inputs.clear_remote }} |" >> $GITHUB_STEP_SUMMARY
-          fi
@@ -77,37 +77,32 @@ jobs:
            release-candidate)  SUFFIX="-rc";    TAG="release-candidate" ;;
          esac

-          # Bump patch version
-          BUMP_OUTPUT=$(php ${MOKO_API}/version_bump.php --path .)
-          VERSION=$(echo "$BUMP_OUTPUT" | grep -oP '\d{2}\.\d{2}\.\d{2}$' || true)
-          [ -z "$VERSION" ] && VERSION=$(php ${MOKO_API}/version_read.php --path .)
+          # Read current version from manifest (priority) or README — no bump yet
+          VERSION=$(php ${MOKO_API}/version_read.php --path .)
          echo "Version: ${VERSION}"

-          # Update platform-specific manifest
+          # Ensure platform-specific manifest matches
          php ${MOKO_API}/version_set_platform.php --path . --version "${VERSION}"

-          # Commit version bump
+          # Git setup for later commits
          git config --local user.email "gitea-actions[bot]@mokoconsulting.tech"
          git config --local user.name "gitea-actions[bot]"
          git remote set-url origin "https://jmiller:${{ secrets.GA_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"
-          git add -A
-          git diff --cached --quiet || {
-            git commit -m "chore(version): bump to ${VERSION} [skip ci]"
-            git push origin HEAD 2>&1
-          }

          # Detect element from Joomla/Dolibarr manifest
+          set +o pipefail
          PLATFORM="${{ steps.platform.outputs.platform }}"
          EXT_ELEMENT=$(php ${MOKO_API}/manifest_read.php --path . --field name 2>/dev/null | tr -d ' ' | tr '[:upper:]' '[:lower:]' || true)
          # For Joomla, prefer <element> tag
          if [ "$PLATFORM" = "joomla" ]; then
-            MANIFEST=$(find . -maxdepth 3 -name "*.xml" ! -path "./.git/*" -exec grep -l '<extension' {} \; 2>/dev/null | head -1 || true)
+            MANIFEST=$(find . -maxdepth 4 -name "*.xml" ! -path "./.git/*" -print0 2>/dev/null | xargs -0 grep -l '<extension' 2>/dev/null | head -1 || true)
            if [ -n "$MANIFEST" ]; then
-              ELEM=$(grep -oP "<element>\K[^<]+" "$MANIFEST" 2>/dev/null | head -1)
+              ELEM=$(grep -oP "<element>\K[^<]+" "$MANIFEST" 2>/dev/null | head -1 || true)
              [ -n "$ELEM" ] && EXT_ELEMENT="$ELEM"
            fi
          fi
          [ -z "$EXT_ELEMENT" ] && EXT_ELEMENT=$(echo "${GITEA_REPO}" | tr '[:upper:]' '[:lower:]' | tr -d ' -')
+          set -o pipefail

          ZIP_NAME="${EXT_ELEMENT}-${VERSION}${SUFFIX}.zip"

@@ -244,3 +239,22 @@ jobs:
              echo "Deleted: ${TAG} (id: ${RELEASE_ID})"
            fi
          done
+
+      - name: "Post-release version bump"
+        run: |
+          MOKO_API="/tmp/moko-platform-api/cli"
+          VERSION="${{ steps.meta.outputs.version }}"
+
+          # Bump patch for next dev cycle
+          BUMP_OUTPUT=$(php ${MOKO_API}/version_bump.php --path .)
+          NEXT=$(echo "$BUMP_OUTPUT" | grep -oP '\d{2}\.\d{2}\.\d{2}$' || true)
+          [ -z "$NEXT" ] && exit 0
+
+          # Update platform-specific manifest to next version
+          php ${MOKO_API}/version_set_platform.php --path . --version "${NEXT}"
+
+          git add -A
+          git diff --cached --quiet || {
+            git commit -m "chore: update development channel ${VERSION} [skip ci]"
+            git push origin HEAD 2>&1
+          }
@@ -31,6 +31,59 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - License/subscription check
 - System email template branding (DB approach)

+## [02.03.10] - 2026-05-24
+
+### Added
+- Canonical URL injection for alias domains (prevents SEO duplication)
+- Primary Domain config field in Site Aliases tab
+- Heartbeat registration for alias domains (each alias gets Grafana datasource)
+- Plugin protection: hidden from non-master users, disable/uninstall blocked
+- Dynamic plugin version read from manifest XML (no more hardcoded strings)
+- Package structure: `pkg_mokowaas` with system plugin, webservices plugin, and component
+
+### Changed
+- Alias offline mode uses Joomla's native template offline.php (not custom HTML)
+- Alias detection simplified: direct lookup in aliases list (no primary host comparison)
+- handleSiteAlias() moved to onAfterRoute (client type resolved at that point)
+- Package script.php enables plugins on every install/update and sends heartbeat
+
+### Fixed
+- Alias domain matching: strip trailing slashes, handle Joomla subform stdClass format
+- Backend redirect: use primary_domain setting instead of Uri::root() (returned alias domain on mirrors)
+- CI: version_bump reads manifest XML with priority over README.md VERSION header
+- CI: version bump occurs after release build, not before
+- CI: pipefail disabled during element detection (SIGPIPE on find|head)
+- CI: pkg_pkg_ prefix duplication in zip names and updates.xml URLs
+- CI: updates_xml_build preserves existing channel entries (stable not wiped by dev releases)
+
+### Removed
+- deploy-manual.yml workflow — using Joomla update server for distribution
+- Accidentally committed profile.ps1 and TODO.md
+
+## [02.01.43] - 2026-05-23
+
+### Added
+- Site Aliases tab with Joomla subform repeatable-table UI
+- Per-alias offline toggle with custom maintenance message (503 response)
+- Per-alias robots meta directive (index/noindex/follow/nofollow/none)
+- Per-alias backend redirect (admin panel redirects to primary domain)
+- 6 MokoWaaS API endpoints: health, install, update, cache, backup, info
+- Remote plugin install via `/?mokowaas=install` endpoint
+- Remote update trigger via `/?mokowaas=update` endpoint
+- Remote cache clear via `/?mokowaas=cache` endpoint (site + admin + opcache)
+- Remote Akeeba Backup trigger via `/?mokowaas=backup` endpoint
+- Compact site info via `/?mokowaas=info` endpoint
+
+### Changed
+- Site aliases moved from comma-separated text field to structured subform
+- Each alias now stores domain, offline, offline_message, robots, redirect_backend
+- Heartbeat provisioning updated for subform alias format
+- Grafana datasource names use domain-only (removed "MokoWaaS - " prefix)
+
+### Fixed
+- Heartbeat receiver accepts any 200 status (registered/updated/ok)
+- script.php uses heartbeat receiver instead of Grafana API (fixes 403 RBAC)
+
 ## [02.01.37] - 2026-05-23

 ### Added
@@ -15,7 +15,7 @@
 DEFGROUP: Joomla.Plugin
 INGROUP: MokoWaaS
 REPO: https://github.com/mokoconsulting-tech/mokowaas
- VERSION: 02.01.42
+ VERSION: 02.03.12
 PATH: /README.md
 BRIEF: Rebranding plugin for MokoWaaS platform
 NOTE: Internal WaaS identity abstraction layer
@@ -23,7 +23,7 @@

 # MokoWaaS Plugin

-[![Version](https://img.shields.io/badge/version-02.01.18-blue.svg?logo=v&logoColor=white)](https://github.com/mokoconsulting-tech/MokoWaaS/releases/tag/v02)
+[![Version](https://img.shields.io/badge/version-02.03.00-blue.svg?logo=v&logoColor=white)](https://github.com/mokoconsulting-tech/MokoWaaS/releases/tag/v02)
 [![License](https://img.shields.io/badge/license-GPL--3.0--or--later-green.svg?logo=gnu&logoColor=white)](LICENSE)
 [![Joomla](https://img.shields.io/badge/Joomla-5.x%20%7C%206.x-red.svg?logo=joomla&logoColor=white)](https://www.joomla.org)
 [![PHP](https://img.shields.io/badge/PHP-8.1%2B-777BB4.svg?logo=php&logoColor=white)](https://www.php.net)
@@ -1,12 +0,0 @@
-# TODO
-
-> **Note:** This file is not tracked in version control (.gitignore). It is for local task tracking only.
-
-## Critical
- -
-
-## Normal
- -
-
-## Low
- -
@@ -0,0 +1,38 @@
+<?php
+/**
+ * @package     MokoWaaS
+ * @subpackage  com_mokowaas
+ * @copyright   Copyright (C) 2026 Moko Consulting. All rights reserved.
+ * @license     GNU General Public License version 3 or later; see LICENSE
+ */
+
+defined('_JEXEC') or die;
+
+use Joomla\CMS\Dispatcher\ComponentDispatcherFactoryInterface;
+use Joomla\CMS\Extension\ComponentInterface;
+use Joomla\CMS\Extension\Service\Provider\ComponentDispatcherFactory;
+use Joomla\CMS\Extension\Service\Provider\MVCFactory;
+use Joomla\CMS\MVC\Factory\MVCFactoryInterface;
+use Joomla\DI\Container;
+use Joomla\DI\ServiceProviderInterface;
+
+return new class implements ServiceProviderInterface
+{
+	public function register(Container $container): void
+	{
+		$container->registerServiceProvider(new MVCFactory('\\Moko\\Component\\MokoWaaS'));
+		$container->registerServiceProvider(new ComponentDispatcherFactory('\\Moko\\Component\\MokoWaaS'));
+
+		$container->set(
+			ComponentInterface::class,
+			function (Container $container) {
+				$component = new \Joomla\CMS\Extension\MVCComponent(
+					$container->get(ComponentDispatcherFactoryInterface::class)
+				);
+				$component->setMVCFactory($container->get(MVCFactoryInterface::class));
+
+				return $component;
+			}
+		);
+	}
+};
@@ -0,0 +1,89 @@
+<?php
+/**
+ * @package     MokoWaaS
+ * @subpackage  com_mokowaas
+ * @copyright   Copyright (C) 2026 Moko Consulting. All rights reserved.
+ * @license     GNU General Public License version 3 or later; see LICENSE
+ */
+
+namespace Moko\Component\MokoWaaS\Api\Controller;
+
+defined('_JEXEC') or die;
+
+use Joomla\CMS\Factory;
+use Joomla\CMS\MVC\Controller\BaseController;
+
+/**
+ * Cache management API controller.
+ *
+ * POST /api/index.php/v1/mokowaas/cache
+ *
+ * @since  1.0.0
+ */
+class CacheController extends BaseController
+{
+	/**
+	 * Clear all Joomla caches.
+	 *
+	 * @return  void
+	 *
+	 * @since   1.0.0
+	 */
+	public function execute(): void
+	{
+		$app = Factory::getApplication();
+
+		if ($app->input->getMethod() !== 'POST')
+		{
+			$this->sendJson(405, ['error' => 'POST required']);
+			return;
+		}
+
+		$user = $app->getIdentity();
+		if (!$user->authorise('core.manage', 'com_plugins'))
+		{
+			$this->sendJson(403, ['error' => 'Not authorized']);
+			return;
+		}
+
+		try
+		{
+			$cache = Factory::getCache('');
+			$cache->clean('');
+
+			$adminCache = Factory::getCache('', 'callback', 'administrator');
+			$adminCache->clean('');
+
+			if (function_exists('opcache_reset'))
+			{
+				opcache_reset();
+			}
+
+			$this->sendJson(200, [
+				'status'  => 'ok',
+				'message' => 'Cache cleared',
+			]);
+		}
+		catch (\Throwable $e)
+		{
+			$this->sendJson(500, [
+				'error'   => 'Cache clear failed',
+				'message' => $e->getMessage(),
+			]);
+		}
+	}
+
+	/**
+	 * @param   int    $code     HTTP status code
+	 * @param   array  $payload  Response data
+	 * @return  void
+	 */
+	private function sendJson(int $code, array $payload): void
+	{
+		$app = Factory::getApplication();
+		$app->setHeader('Content-Type', 'application/json', true);
+		$app->setHeader('Status', (string) $code, true);
+		echo json_encode($payload, JSON_UNESCAPED_UNICODE | JSON_PRETTY_PRINT);
+		$app->close();
+	}
+}
@@ -0,0 +1,139 @@
+<?php
+/**
+ * @package     MokoWaaS
+ * @subpackage  com_mokowaas
+ * @copyright   Copyright (C) 2026 Moko Consulting. All rights reserved.
+ * @license     GNU General Public License version 3 or later; see LICENSE
+ */
+
+namespace Moko\Component\MokoWaaS\Api\Controller;
+
+defined('_JEXEC') or die;
+
+use Joomla\CMS\Factory;
+use Joomla\CMS\MVC\Controller\BaseController;
+use Joomla\CMS\Plugin\PluginHelper;
+use Joomla\CMS\Uri\Uri;
+use Joomla\Registry\Registry;
+
+/**
+ * Health check API controller.
+ *
+ * GET /api/index.php/v1/mokowaas/health
+ *
+ * Returns full health diagnostics from the MokoWaaS system plugin.
+ * Requires a Joomla API token with core.manage permissions.
+ *
+ * @since  1.0.0
+ */
+class HealthController extends BaseController
+{
+	/**
+	 * Return full health check data.
+	 *
+	 * @return  void
+	 *
+	 * @since   1.0.0
+	 */
+	public function displayList(): void
+	{
+		$app = Factory::getApplication();
+		$user = $app->getIdentity();
+
+		if (!$user->authorise('core.manage', 'com_plugins'))
+		{
+			$this->sendJson(403, ['error' => 'Not authorized']);
+			return;
+		}
+
+		$plugin = PluginHelper::getPlugin('system', 'mokowaas');
+
+		if (!$plugin)
+		{
+			$this->sendJson(503, ['error' => 'MokoWaaS system plugin not enabled']);
+			return;
+		}
+
+		$params = new Registry($plugin->params);
+		$config = Factory::getConfig();
+		$db = Factory::getDbo();
+
+		// Collect basic health data
+		$payload = [
+			'status'    => 'ok',
+			'timestamp' => gmdate('Y-m-d\TH:i:s\Z'),
+			'site'      => [
+				'name'           => $config->get('sitename', ''),
+				'url'            => rtrim(Uri::root(), '/'),
+				'joomla_version' => JVERSION,
+				'php_version'    => PHP_VERSION,
+				'db_type'        => $db->getName(),
+				'offline'        => (bool) $config->get('offline', 0),
+				'debug'          => (bool) $config->get('debug', 0),
+				'sef'            => (bool) $config->get('sef', 0),
+				'caching'        => (bool) $config->get('caching', 0),
+			],
+			'plugin'    => [
+				'brand'   => $params->get('brand_name', 'MokoWaaS'),
+				'company' => $params->get('company_name', 'Moko Consulting'),
+			],
+		];
+
+		// Database check
+		try
+		{
+			$db->setQuery('SELECT 1');
+			$db->loadResult();
+			$payload['checks']['database'] = ['status' => 'ok'];
+		}
+		catch (\Throwable $e)
+		{
+			$payload['status'] = 'error';
+			$payload['checks']['database'] = ['status' => 'error', 'message' => $e->getMessage()];
+		}
+
+		// Disk space
+		$free = @disk_free_space(JPATH_ROOT);
+		$total = @disk_total_space(JPATH_ROOT);
+		if ($free !== false && $total !== false)
+		{
+			$freeMb = round($free / 1048576);
+			$payload['checks']['filesystem'] = [
+				'status'       => $freeMb < 100 ? 'degraded' : 'ok',
+				'free_disk_mb' => $freeMb,
+				'total_disk_mb' => round($total / 1048576),
+			];
+		}
+
+		// Content counts
+		$db->setQuery($db->getQuery(true)->select('COUNT(*)')->from($db->quoteName('#__content')));
+		$payload['counts']['articles'] = (int) $db->loadResult();
+
+		$db->setQuery($db->getQuery(true)->select('COUNT(*)')->from($db->quoteName('#__users')));
+		$payload['counts']['users'] = (int) $db->loadResult();
+
+		$db->setQuery($db->getQuery(true)->select('COUNT(*)')->from($db->quoteName('#__extensions'))->where($db->quoteName('enabled') . ' = 1'));
+		$payload['counts']['extensions'] = (int) $db->loadResult();
+
+		$this->sendJson(200, $payload);
+	}
+
+	/**
+	 * Send a JSON response and close.
+	 *
+	 * @param   int    $code     HTTP status code
+	 * @param   array  $payload  Response data
+	 *
+	 * @return  void
+	 *
+	 * @since   1.0.0
+	 */
+	private function sendJson(int $code, array $payload): void
+	{
+		$app = Factory::getApplication();
+		$app->setHeader('Content-Type', 'application/json', true);
+		$app->setHeader('Status', (string) $code, true);
+		echo json_encode($payload, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES | JSON_PRETTY_PRINT);
+		$app->close();
+	}
+}
@@ -0,0 +1,94 @@
+<?php
+/**
+ * @package     MokoWaaS
+ * @subpackage  com_mokowaas
+ * @copyright   Copyright (C) 2026 Moko Consulting. All rights reserved.
+ * @license     GNU General Public License version 3 or later; see LICENSE
+ */
+
+namespace Moko\Component\MokoWaaS\Api\Controller;
+
+defined('_JEXEC') or die;
+
+use Joomla\CMS\Factory;
+use Joomla\CMS\MVC\Controller\BaseController;
+
+/**
+ * Update check API controller.
+ *
+ * POST /api/index.php/v1/mokowaas/update
+ *
+ * @since  1.0.0
+ */
+class UpdateController extends BaseController
+{
+	/**
+	 * Trigger Joomla update finder and return count of available updates.
+	 *
+	 * @return  void
+	 *
+	 * @since   1.0.0
+	 */
+	public function execute(): void
+	{
+		$app = Factory::getApplication();
+
+		if ($app->input->getMethod() !== 'POST')
+		{
+			$this->sendJson(405, ['error' => 'POST required']);
+			return;
+		}
+
+		$user = $app->getIdentity();
+		if (!$user->authorise('core.manage', 'com_installer'))
+		{
+			$this->sendJson(403, ['error' => 'Not authorized']);
+			return;
+		}
+
+		try
+		{
+			$db = Factory::getDbo();
+
+			$db->setQuery($db->getQuery(true)->delete($db->quoteName('#__updates')));
+			$db->execute();
+
+			\Joomla\CMS\Updater\Updater::getInstance()->findUpdates();
+
+			$db->setQuery(
+				$db->getQuery(true)
+					->select('COUNT(*)')
+					->from($db->quoteName('#__updates'))
+					->where($db->quoteName('extension_id') . ' != 0')
+			);
+			$count = (int) $db->loadResult();
+
+			$this->sendJson(200, [
+				'status'        => 'ok',
+				'updates_found' => $count,
+				'message'       => $count . ' update(s) available',
+			]);
+		}
+		catch (\Throwable $e)
+		{
+			$this->sendJson(500, [
+				'error'   => 'Update check failed',
+				'message' => $e->getMessage(),
+			]);
+		}
+	}
+
+	/**
+	 * @param   int    $code     HTTP status code
+	 * @param   array  $payload  Response data
+	 * @return  void
+	 */
+	private function sendJson(int $code, array $payload): void
+	{
+		$app = Factory::getApplication();
+		$app->setHeader('Content-Type', 'application/json', true);
+		$app->setHeader('Status', (string) $code, true);
+		echo json_encode($payload, JSON_UNESCAPED_UNICODE | JSON_PRETTY_PRINT);
+		$app->close();
+	}
+}
@@ -0,0 +1,23 @@
+<?xml version="1.0" encoding="utf-8"?>
+<extension type="component" method="upgrade">
+	<name>MokoWaaS API</name>
+	<author>Moko Consulting</author>
+	<creationDate>2026-05-23</creationDate>
+	<copyright>Copyright (C) 2026 Moko Consulting. All rights reserved.</copyright>
+	<license>GPL-3.0-or-later</license>
+	<authorEmail>hello@mokoconsulting.tech</authorEmail>
+	<authorUrl>https://mokoconsulting.tech</authorUrl>
+	<version>02.03.11</version>
+	<description>Minimal API-only component for MokoWaaS. Provides REST endpoints for site health, cache, updates, and backups.</description>
+	<namespace path="api/src">Moko\Component\MokoWaaS\Api</namespace>
+	<administration>
+		<files folder="admin">
+			<folder>services</folder>
+		</files>
+	</administration>
+	<api>
+		<files folder="api">
+			<folder>src</folder>
+		</files>
+	</api>
+</extension>
@@ -65,6 +65,39 @@ class MokoWaaS extends CMSPlugin
 	 */
 	private const HEARTBEAT_KEY = 'moko-waas-hb-2026-x9k4m';

+	/**
+	 * Get the plugin version from the manifest XML.
+	 *
+	 * @return  string  Version string (e.g. '02.03.04')
+	 *
+	 * @since   02.03.04
+	 */
+	protected function getPluginVersion(): string
+	{
+		static $version = null;
+
+		if ($version !== null)
+		{
+			return $version;
+		}
+
+		$manifestFile = JPATH_PLUGINS . '/system/mokowaas/mokowaas.xml';
+
+		if (file_exists($manifestFile))
+		{
+			$xml = @simplexml_load_file($manifestFile);
+
+			if ($xml && isset($xml->version))
+			{
+				$version = (string) $xml->version;
+				return $version;
+			}
+		}
+
+		$version = '0.0.0';
+		return $version;
+	}
+
 	/**
 	 * Load the language file on instantiation.
 	 *
@@ -860,12 +893,16 @@ class MokoWaaS extends CMSPlugin
 	 */
 	public function onAfterRoute()
 	{
+		// Site alias handling: offline page and backend redirect
+		$this->handleSiteAlias();
+
 		if (!$this->app->isClient('administrator'))
 		{
 			return;
 		}

 		$this->enforceAdminRestrictions();
+		$this->protectPlugin();
 	}

 	/**
@@ -880,11 +917,6 @@ class MokoWaaS extends CMSPlugin
 	 */
 	public function onBeforeCompileHead()
 	{
-		if (!$this->app->isClient('administrator'))
-		{
-			return;
-		}
-
 		$doc = $this->app->getDocument();

 		if ($doc->getType() !== 'html')
@@ -892,7 +924,198 @@ class MokoWaaS extends CMSPlugin
 			return;
 		}

+		// Inject robots meta tag for alias domains (frontend only)
+		if ($this->app->isClient('site'))
+		{
+			$this->injectAliasRobots($doc);
+		}
+
+		if (!$this->app->isClient('administrator'))
+		{
+			return;
+		}
+
 		$this->injectFavicon($doc);
+
+		// Hide MokoWaaS from plugin list for non-master users
+		if (!$this->isMasterUser())
+		{
+			$this->hidePluginFromList($doc);
+		}
+	}
+
+	/**
+	 * Hide MokoWaaS plugin and package from the extensions list via JS.
+	 *
+	 * @param   \Joomla\CMS\Document\HtmlDocument  $doc  Document object
+	 *
+	 * @return  void
+	 *
+	 * @since   02.03.04
+	 */
+	protected function hidePluginFromList($doc)
+	{
+		$option = $this->app->input->get('option', '');
+		$view   = $this->app->input->get('view', '');
+
+		if ($option !== 'com_plugins' && $option !== 'com_installer')
+		{
+			return;
+		}
+
+		$doc->addScriptDeclaration("
+			document.addEventListener('DOMContentLoaded', function() {
+				document.querySelectorAll('tr').forEach(function(row) {
+					var text = row.textContent || '';
+					if (text.indexOf('mokowaas') !== -1 || text.indexOf('MokoWaaS') !== -1) {
+						row.style.display = 'none';
+					}
+				});
+			});
+		");
+	}
+
+	/**
+	 * Protect the plugin from being disabled or uninstalled by non-master users.
+	 * Does NOT self-heal (no lock) — master users can still disable if needed.
+	 *
+	 * @return  void
+	 *
+	 * @since   02.03.04
+	 */
+	protected function protectPlugin()
+	{
+		// Ensure protected flag is set (self-healing — runs once per session)
+		static $flagChecked = false;
+
+		if (!$flagChecked)
+		{
+			$flagChecked = true;
+			$this->ensureProtectedFlag();
+		}
+
+		if ($this->isMasterUser())
+		{
+			return;
+		}
+
+		$option = $this->app->input->get('option', '');
+		$task   = $this->app->input->get('task', '');
+
+		// Block non-master from uninstalling MokoWaaS
+		if ($option === 'com_installer' && strpos($task, 'manage.remove') !== false)
+		{
+			$cid = $this->app->input->get('cid', [], 'array');
+
+			if ($this->isOurExtension($cid))
+			{
+				$this->app->enqueueMessage('MokoWaaS cannot be uninstalled.', 'error');
+				$this->app->redirect('index.php?option=com_installer&view=manage');
+			}
+		}
+
+		// Block non-master from disabling via list toggle
+		if ($option === 'com_plugins' && strpos($task, 'plugins.publish') !== false)
+		{
+			$cid = $this->app->input->get('cid', [], 'array');
+
+			if ($this->isOurExtension($cid))
+			{
+				$this->app->enqueueMessage('MokoWaaS cannot be disabled.', 'error');
+				$this->app->redirect('index.php?option=com_plugins');
+			}
+		}
+	}
+
+	/**
+	 * Ensure the protected flag is set on MokoWaaS extensions in the DB.
+	 *
+	 * Sets protected=1, locked=0 so the extension can't be disabled or
+	 * uninstalled but can still receive updates and config changes.
+	 *
+	 * @return  void
+	 *
+	 * @since   02.03.10
+	 */
+	protected function ensureProtectedFlag()
+	{
+		try
+		{
+			$db = Factory::getDbo();
+			$query = $db->getQuery(true)
+				->update($db->quoteName('#__extensions'))
+				->set($db->quoteName('protected') . ' = 1')
+				->set($db->quoteName('locked') . ' = 0')
+				->where('(' . $db->quoteName('element') . ' = ' . $db->quote('mokowaas')
+					. ' OR ' . $db->quoteName('element') . ' = ' . $db->quote('pkg_mokowaas') . ')')
+				->where($db->quoteName('protected') . ' = 0');
+			$db->setQuery($query);
+			$db->execute();
+		}
+		catch (\Throwable $e)
+		{
+			// Non-critical
+		}
+	}
+
+	/**
+	 * Check if any of the given extension IDs belong to MokoWaaS.
+	 *
+	 * @param   array  $ids  Extension IDs to check
+	 *
+	 * @return  bool
+	 *
+	 * @since   02.03.04
+	 */
+	protected function isOurExtension(array $ids): bool
+	{
+		if (empty($ids))
+		{
+			return false;
+		}
+
+		$db    = Factory::getDbo();
+		$query = $db->getQuery(true)
+			->select('COUNT(*)')
+			->from($db->quoteName('#__extensions'))
+			->where($db->quoteName('extension_id') . ' IN (' . implode(',', array_map('intval', $ids)) . ')')
+			->where('(' . $db->quoteName('element') . ' = ' . $db->quote('mokowaas')
+				. ' OR ' . $db->quoteName('element') . ' = ' . $db->quote('pkg_mokowaas') . ')');
+
+		return (int) $db->setQuery($query)->loadResult() > 0;
+	}
+
+	/**
+	 * Prevent non-master users from disabling the plugin via save.
+	 *
+	 * @param   string  $context  Extension context
+	 * @param   object  $table    Extension table row
+	 * @param   bool    $isNew    Whether this is a new record
+	 *
+	 * @return  bool  False to cancel save
+	 *
+	 * @since   02.03.04
+	 */
+	public function onExtensionBeforeSave($context, $table, $isNew)
+	{
+		if ($context !== 'com_plugins.plugin')
+		{
+			return true;
+		}
+
+		if ($table->element !== 'mokowaas' || $table->folder !== 'system')
+		{
+			return true;
+		}
+
+		// Non-master users cannot disable the plugin
+		if (!$this->isMasterUser() && (int) $table->enabled === 0)
+		{
+			$this->app->enqueueMessage('MokoWaaS cannot be disabled.', 'error');
+			$table->enabled = 1;
+		}
+
+		return true;
 	}

 	/**
@@ -1292,7 +1515,7 @@ class MokoWaaS extends CMSPlugin
 			'users'          => $users,
 			'extensions'     => $extensions,
 			'brand'          => $this->params->get('brand_name', 'MokoWaaS'),
-			'plugin_version' => '02.01.39',
+			'plugin_version' => $this->getPluginVersion(),
 		]);
 	}

@@ -1446,7 +1669,7 @@ class MokoWaaS extends CMSPlugin

 		return [
 			'brand'          => $this->params->get('brand_name', 'MokoWaaS'),
-			'plugin_version' => '02.01.22',
+			'plugin_version' => $this->getPluginVersion(),
 			'joomla_version' => JVERSION,
 			'php_version'    => PHP_VERSION,
 			'server_name'    => $config->get('sitename', ''),
@@ -2559,6 +2782,222 @@ class MokoWaaS extends CMSPlugin
 		}
 	}

+	// ------------------------------------------------------------------
+	// Site Alias handling
+	// ------------------------------------------------------------------
+
+	/**
+	 * Get the alias configuration for the current request domain, if any.
+	 *
+	 * @return  object|null  Alias entry object or null if not an alias domain
+	 *
+	 * @since   02.01.43
+	 */
+	/**
+	 * Get the primary domain from Joomla config or by exclusion from aliases.
+	 *
+	 * @return  string  Primary domain hostname
+	 *
+	 * @since   02.03.05
+	 */
+	protected function getPrimaryHost(): string
+	{
+		// Try plugin's primary_domain setting first
+		$primaryDomain = $this->params->get('primary_domain', '');
+
+		if (!empty($primaryDomain))
+		{
+			return trim($primaryDomain);
+		}
+
+		// Try Joomla's $live_site
+		$liveSite = Factory::getConfig()->get('live_site', '');
+
+		if (!empty($liveSite))
+		{
+			$host = parse_url($liveSite, PHP_URL_HOST);
+
+			if ($host)
+			{
+				return $host;
+			}
+		}
+
+		// Fallback: if current host is NOT in the aliases list, it's the primary
+		$currentHost = $_SERVER['HTTP_HOST'] ?? '';
+		$aliases     = $this->params->get('site_aliases', '');
+
+		if (!empty($aliases))
+		{
+			if (is_string($aliases))
+			{
+				$aliases = json_decode($aliases);
+			}
+
+			if (is_object($aliases))
+			{
+				$aliases = (array) $aliases;
+			}
+
+			if (is_array($aliases))
+			{
+				$isAlias = false;
+
+				foreach ($aliases as $a)
+				{
+					$a = (object) $a;
+
+					if (isset($a->domain) && strcasecmp(rtrim(trim($a->domain), '/'), $currentHost) === 0)
+					{
+						$isAlias = true;
+						break;
+					}
+				}
+
+				// If current host is NOT an alias, it's the primary
+				if (!$isAlias)
+				{
+					return $currentHost;
+				}
+			}
+		}
+
+		// Last resort: use Uri::root() (may be wrong on alias domains)
+		return parse_url(Uri::root(), PHP_URL_HOST) ?: $currentHost;
+	}
+
+	protected function getCurrentAlias()
+	{
+		$currentHost = $_SERVER['HTTP_HOST'] ?? '';
+
+		if (empty($currentHost))
+		{
+			return null;
+		}
+
+		$aliases = $this->params->get('site_aliases', '');
+
+		if (empty($aliases))
+		{
+			return null;
+		}
+
+		// Subform returns JSON string, array, or stdClass
+		if (is_string($aliases))
+		{
+			$aliases = json_decode($aliases);
+		}
+
+		// Convert object to array (Joomla subform stores as {"key0":{...},"key1":{...}})
+		if (is_object($aliases))
+		{
+			$aliases = (array) $aliases;
+		}
+
+		if (!is_array($aliases) || empty($aliases))
+		{
+			return null;
+		}
+
+		// Look up the current host in the aliases list — if found, it's an alias
+		foreach ($aliases as $alias)
+		{
+			$alias = (object) $alias;
+
+			if (isset($alias->domain) && strcasecmp(rtrim(trim($alias->domain), '/'), $currentHost) === 0)
+			{
+				return $alias;
+			}
+		}
+
+		return null;
+	}
+
+	/**
+	 * Handle site alias logic: offline page and backend redirect.
+	 *
+	 * Runs early in onAfterInitialise before routing occurs.
+	 *
+	 * @return  void
+	 *
+	 * @since   02.01.43
+	 */
+	protected function handleSiteAlias()
+	{
+		$alias = $this->getCurrentAlias();
+
+		if ($alias === null)
+		{
+			return;
+		}
+
+		// Backend redirect: send admin requests to the primary domain
+		if (!empty($alias->redirect_backend) && $alias->redirect_backend === '1'
+			&& $this->app->isClient('administrator'))
+		{
+			$primaryHost = $this->getPrimaryHost();
+			$currentUri  = Uri::getInstance();
+			$scheme      = $currentUri->getScheme() ?: 'https';
+			$primaryUrl  = $scheme . '://' . $primaryHost . $currentUri->toString(['path', 'query']);
+
+			$this->app->redirect($primaryUrl, 301);
+		}
+
+		// Offline: use Joomla's native offline mode for frontend requests
+		if (!empty($alias->offline) && (string) $alias->offline === '1'
+			&& $this->app->isClient('site'))
+		{
+			// Allow health API to still respond
+			if ($this->app->input->get('mokowaas', '') !== '')
+			{
+				return;
+			}
+
+			// Set custom offline message if provided
+			$message = $alias->offline_message ?? '';
+
+			if (!empty($message))
+			{
+				$this->app->getConfig()->set('offline_message', $message);
+			}
+
+			// Enable Joomla's native offline mode — renders through the template's offline.php
+			$this->app->getConfig()->set('offline', 1);
+		}
+	}
+
+	/**
+	 * Inject robots meta tag for alias domains.
+	 *
+	 * @param   \Joomla\CMS\Document\HtmlDocument  $doc  Document object
+	 *
+	 * @return  void
+	 *
+	 * @since   02.01.43
+	 */
+	protected function injectAliasRobots($doc)
+	{
+		$alias = $this->getCurrentAlias();
+
+		if ($alias === null)
+		{
+			return;
+		}
+
+		$robots = $alias->robots ?? 'index, follow';
+
+		if ($robots !== 'index, follow')
+		{
+			$doc->setMetaData('robots', $robots);
+		}
+
+		// Inject canonical URL pointing to the primary domain
+		$primaryHost = $this->getPrimaryHost();
+		$currentUri  = Uri::getInstance();
+		$canonical   = $currentUri->getScheme() . '://' . $primaryHost . $currentUri->toString(['path', 'query']);
+		$doc->addHeadLink($canonical, 'canonical');
+	}
+
 	// ------------------------------------------------------------------
 	// Heartbeat (called from onExtensionAfterSave)
 	// ------------------------------------------------------------------
@@ -2566,8 +3005,9 @@ class MokoWaaS extends CMSPlugin
 	/**
 	 * Send heartbeat to the MokoWaaS monitoring receiver.
 	 *
-	 * Registers this site (and any aliases) with the Grafana provisioning system.
+	 * Registers this site's primary domain with the Grafana provisioning system.
 	 * The receiver writes a datasource YAML file and restarts Grafana.
+	 * Alias domains are not registered to avoid duplicate datasource UIDs.
 	 *
 	 * @param   \Joomla\Registry\Registry                $params  Plugin params
 	 * @param   \Joomla\CMS\Application\CMSApplication   $app     Application
@@ -2591,16 +3031,34 @@ class MokoWaaS extends CMSPlugin
 		// Register primary domain
 		$this->sendHeartbeat($siteUrl, $siteName, $healthToken, $app);

-		// Register any alias domains
+		// Register alias domains (subform format)
 		$aliases = $params->get('site_aliases', '');

 		if (!empty($aliases))
 		{
-			foreach (array_filter(array_map('trim', explode(',', $aliases))) as $alias)
+			if (is_string($aliases))
 			{
-				$aliasUrl = 'https://' . ltrim($alias, 'https://');
-				$aliasUrl = rtrim($aliasUrl, '/');
-				$this->sendHeartbeat($aliasUrl, $siteName . ' (' . $alias . ')', $healthToken, $app);
+				$aliases = json_decode($aliases);
+			}
+
+			if (is_object($aliases))
+			{
+				$aliases = (array) $aliases;
+			}
+
+			if (is_array($aliases))
+			{
+				foreach ($aliases as $alias)
+				{
+					$alias = (object) $alias;
+
+					if (!empty($alias->domain))
+					{
+						$domain   = rtrim(trim($alias->domain), '/');
+						$aliasUrl = 'https://' . preg_replace('#^https?://#i', '', $domain);
+						$this->sendHeartbeat($aliasUrl, $siteName, $healthToken, $app);
+					}
+				}
 			}
 		}
 	}
@@ -2650,16 +3108,18 @@ class MokoWaaS extends CMSPlugin
 			$app->enqueueMessage('Grafana heartbeat failed (' . $siteUrl . '): ' . $error, 'warning');
 			Log::add('Heartbeat failed: ' . $error, Log::WARNING, 'mokowaas');
 		}
-		elseif ($code === 200 && ($body['status'] ?? '') === 'registered')
+		elseif ($code === 200)
 		{
+			$status = $body['status'] ?? 'ok';
 			$app->enqueueMessage(
-				'Grafana heartbeat: ' . $siteUrl . ' registered (' . ($body['ds_uid'] ?? '') . ')',
+				'Grafana heartbeat: ' . $siteUrl . ' ' . $status . ' (' . ($body['ds_uid'] ?? '') . ')',
 				'message'
 			);
 		}
 		else
 		{
-			$msg = sprintf('Grafana heartbeat failed (%s): HTTP %d', $siteUrl, $code);
+			$msg = sprintf('Grafana heartbeat failed (%s): HTTP %d — %s',
+				$siteUrl, $code, $body['error'] ?? $body['message'] ?? 'Unknown');
 			$app->enqueueMessage($msg, 'warning');
 			Log::add($msg, Log::WARNING, 'mokowaas');
 		}
@@ -0,0 +1,55 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<form>
+	<field
+		name="domain"
+		type="text"
+		label="PLG_SYSTEM_MOKOWAAS_ALIAS_DOMAIN_LABEL"
+		description="PLG_SYSTEM_MOKOWAAS_ALIAS_DOMAIN_DESC"
+		required="true"
+		hint="e.g. www.example.com"
+		/>
+	<field
+		name="offline"
+		type="radio"
+		label="PLG_SYSTEM_MOKOWAAS_ALIAS_OFFLINE_LABEL"
+		description="PLG_SYSTEM_MOKOWAAS_ALIAS_OFFLINE_DESC"
+		default="0"
+		class="btn-group btn-group-yesno"
+		>
+		<option value="1">JYES</option>
+		<option value="0">JNO</option>
+	</field>
+	<field
+		name="offline_message"
+		type="textarea"
+		label="PLG_SYSTEM_MOKOWAAS_ALIAS_OFFLINE_MSG_LABEL"
+		description="PLG_SYSTEM_MOKOWAAS_ALIAS_OFFLINE_MSG_DESC"
+		default=""
+		rows="3"
+		showon="offline:1"
+		/>
+	<field
+		name="robots"
+		type="list"
+		label="PLG_SYSTEM_MOKOWAAS_ALIAS_ROBOTS_LABEL"
+		description="PLG_SYSTEM_MOKOWAAS_ALIAS_ROBOTS_DESC"
+		default="index, follow"
+		>
+		<option value="index, follow">index, follow</option>
+		<option value="noindex, follow">noindex, follow</option>
+		<option value="index, nofollow">index, nofollow</option>
+		<option value="noindex, nofollow">noindex, nofollow</option>
+		<option value="none">none</option>
+	</field>
+	<field
+		name="redirect_backend"
+		type="radio"
+		label="PLG_SYSTEM_MOKOWAAS_ALIAS_REDIRECT_BACKEND_LABEL"
+		description="PLG_SYSTEM_MOKOWAAS_ALIAS_REDIRECT_BACKEND_DESC"
+		default="1"
+		class="btn-group btn-group-yesno"
+		>
+		<option value="1">JYES</option>
+		<option value="0">JNO</option>
+	</field>
+</form>
@@ -130,5 +130,20 @@ PLG_SYSTEM_MOKOWAAS_UPLOAD_TYPES_DESC="Comma-separated list of allowed file exte
 PLG_SYSTEM_MOKOWAAS_UPLOAD_SIZE_LABEL="Max Upload Size (MB)"
 PLG_SYSTEM_MOKOWAAS_UPLOAD_SIZE_DESC="Maximum file upload size in megabytes."

-PLG_SYSTEM_MOKOWAAS_SITE_ALIASES_LABEL="Site Aliases"
-PLG_SYSTEM_MOKOWAAS_SITE_ALIASES_DESC="Comma-separated list of additional domains this site is accessible on (e.g. www.example.com,alias.example.com). Each alias gets its own Grafana datasource for health monitoring."
+; ===== Site Aliases fieldset =====
+PLG_SYSTEM_MOKOWAAS_FIELDSET_ALIASES_LABEL="Site Aliases"
+PLG_SYSTEM_MOKOWAAS_FIELDSET_ALIASES_DESC="Configure additional domains that mirror this site. Each alias can have its own offline status, robots directive, and backend redirect behavior."
+PLG_SYSTEM_MOKOWAAS_PRIMARY_DOMAIN_LABEL="Primary Domain"
+PLG_SYSTEM_MOKOWAAS_PRIMARY_DOMAIN_DESC="The primary domain for this site (e.g. waas.dev.mokoconsulting.tech). Used for backend redirect on alias domains. Do not include https:// prefix."
+PLG_SYSTEM_MOKOWAAS_SITE_ALIASES_LABEL="Domain Aliases"
+PLG_SYSTEM_MOKOWAAS_SITE_ALIASES_DESC="Add domain aliases that serve as mirrors of this site. Each alias gets its own Grafana monitoring datasource."
+PLG_SYSTEM_MOKOWAAS_ALIAS_DOMAIN_LABEL="Domain"
+PLG_SYSTEM_MOKOWAAS_ALIAS_DOMAIN_DESC="The alias domain name (e.g. www.example.com). Do not include https:// prefix."
+PLG_SYSTEM_MOKOWAAS_ALIAS_OFFLINE_LABEL="Offline"
+PLG_SYSTEM_MOKOWAAS_ALIAS_OFFLINE_DESC="Show an offline maintenance page when visitors access the site through this alias domain."
+PLG_SYSTEM_MOKOWAAS_ALIAS_OFFLINE_MSG_LABEL="Offline Message"
+PLG_SYSTEM_MOKOWAAS_ALIAS_OFFLINE_MSG_DESC="Custom message to display when this alias is set to offline."
+PLG_SYSTEM_MOKOWAAS_ALIAS_ROBOTS_LABEL="Robots"
+PLG_SYSTEM_MOKOWAAS_ALIAS_ROBOTS_DESC="Meta robots directive for this alias domain. Use 'noindex, nofollow' to prevent search engines from indexing the alias."
+PLG_SYSTEM_MOKOWAAS_ALIAS_REDIRECT_BACKEND_LABEL="Redirect Backend"
+PLG_SYSTEM_MOKOWAAS_ALIAS_REDIRECT_BACKEND_DESC="Redirect admin panel requests on this alias to the primary domain. Frontend stays on the alias domain."
@@ -130,5 +130,20 @@ PLG_SYSTEM_MOKOWAAS_UPLOAD_TYPES_DESC="Comma-separated list of allowed file exte
 PLG_SYSTEM_MOKOWAAS_UPLOAD_SIZE_LABEL="Max Upload Size (MB)"
 PLG_SYSTEM_MOKOWAAS_UPLOAD_SIZE_DESC="Maximum file upload size in megabytes."

-PLG_SYSTEM_MOKOWAAS_SITE_ALIASES_LABEL="Site Aliases"
-PLG_SYSTEM_MOKOWAAS_SITE_ALIASES_DESC="Comma-separated list of additional domains this site is accessible on (e.g. www.example.com,alias.example.com). Each alias gets its own Grafana datasource for health monitoring."
+; ===== Site Aliases fieldset =====
+PLG_SYSTEM_MOKOWAAS_FIELDSET_ALIASES_LABEL="Site Aliases"
+PLG_SYSTEM_MOKOWAAS_FIELDSET_ALIASES_DESC="Configure additional domains that mirror this site. Each alias can have its own offline status, robots directive, and backend redirect behavior."
+PLG_SYSTEM_MOKOWAAS_PRIMARY_DOMAIN_LABEL="Primary Domain"
+PLG_SYSTEM_MOKOWAAS_PRIMARY_DOMAIN_DESC="The primary domain for this site (e.g. waas.dev.mokoconsulting.tech). Used for backend redirect on alias domains. Do not include https:// prefix."
+PLG_SYSTEM_MOKOWAAS_SITE_ALIASES_LABEL="Domain Aliases"
+PLG_SYSTEM_MOKOWAAS_SITE_ALIASES_DESC="Add domain aliases that serve as mirrors of this site. Each alias gets its own Grafana monitoring datasource."
+PLG_SYSTEM_MOKOWAAS_ALIAS_DOMAIN_LABEL="Domain"
+PLG_SYSTEM_MOKOWAAS_ALIAS_DOMAIN_DESC="The alias domain name (e.g. www.example.com). Do not include https:// prefix."
+PLG_SYSTEM_MOKOWAAS_ALIAS_OFFLINE_LABEL="Offline"
+PLG_SYSTEM_MOKOWAAS_ALIAS_OFFLINE_DESC="Show an offline maintenance page when visitors access the site through this alias domain."
+PLG_SYSTEM_MOKOWAAS_ALIAS_OFFLINE_MSG_LABEL="Offline Message"
+PLG_SYSTEM_MOKOWAAS_ALIAS_OFFLINE_MSG_DESC="Custom message to display when this alias is set to offline."
+PLG_SYSTEM_MOKOWAAS_ALIAS_ROBOTS_LABEL="Robots"
+PLG_SYSTEM_MOKOWAAS_ALIAS_ROBOTS_DESC="Meta robots directive for this alias domain. Use 'noindex, nofollow' to prevent search engines from indexing the alias."
+PLG_SYSTEM_MOKOWAAS_ALIAS_REDIRECT_BACKEND_LABEL="Redirect Backend"
+PLG_SYSTEM_MOKOWAAS_ALIAS_REDIRECT_BACKEND_DESC="Redirect admin panel requests on this alias to the primary domain. Frontend stays on the alias domain."
@@ -30,7 +30,7 @@
 	<license>GNU General Public License version 3 or later; see LICENSE.md</license>
 	<authorEmail>hello@mokoconsulting.tech</authorEmail>
 	<authorUrl>https://mokoconsulting.tech</authorUrl>
-	<version>02.01.42</version>
+	<version>02.03.11</version>
 	<description>This plugin rebrands the Joomla system interface with MokoWaaS identity. It applies language overrides and ensures consistent branding across the platform.</description>
 	<namespace path=".">Moko\Plugin\System\MokoWaaS</namespace>
 	<scriptfile>script.php</scriptfile>
@@ -44,6 +44,7 @@
 		<filename plugin="mokowaas">script.php</filename>
 		<folder>Extension</folder>
 		<folder>Field</folder>
+		<folder>forms</folder>
 		<folder>payload</folder>
 		<folder>services</folder>
 		<folder>language</folder>
@@ -268,6 +269,30 @@
 					description="PLG_SYSTEM_MOKOWAAS_HIDDEN_MENUS_DESC"
 					rows="5" filter="raw" />
 			</fieldset>
+			<fieldset name="site_aliases"
+				label="PLG_SYSTEM_MOKOWAAS_FIELDSET_ALIASES_LABEL"
+				description="PLG_SYSTEM_MOKOWAAS_FIELDSET_ALIASES_DESC"
+				>
+				<field
+					name="primary_domain"
+					type="text"
+					label="PLG_SYSTEM_MOKOWAAS_PRIMARY_DOMAIN_LABEL"
+					description="PLG_SYSTEM_MOKOWAAS_PRIMARY_DOMAIN_DESC"
+					default=""
+					hint="e.g. waas.dev.mokoconsulting.tech"
+					/>
+				<field
+					name="site_aliases"
+					type="subform"
+					label="PLG_SYSTEM_MOKOWAAS_SITE_ALIASES_LABEL"
+					description="PLG_SYSTEM_MOKOWAAS_SITE_ALIASES_DESC"
+					formsource="plugins/system/mokowaas/forms/alias_entry.xml"
+					multiple="true"
+					layout="joomla.form.field.subform.repeatable-table"
+					groupByFieldset="false"
+					buttons="add,remove,move"
+					/>
+			</fieldset>
 			<fieldset name="diagnostics"
 				label="PLG_SYSTEM_MOKOWAAS_FIELDSET_DIAGNOSTICS_LABEL"
 				description="PLG_SYSTEM_MOKOWAAS_FIELDSET_DIAGNOSTICS_DESC"
@@ -281,13 +306,6 @@
 					filter="raw"
 					readonly="true"
 					/>
-				<field
-					name="site_aliases"
-					type="text"
-					label="PLG_SYSTEM_MOKOWAAS_SITE_ALIASES_LABEL"
-					description="PLG_SYSTEM_MOKOWAAS_SITE_ALIASES_DESC"
-					default=""
-					/>
 			</fieldset>
 			<fieldset name="security"
 				label="PLG_SYSTEM_MOKOWAAS_FIELDSET_SECURITY_LABEL"
@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="utf-8"?>
+<extension type="plugin" group="webservices" method="upgrade">
+	<name>Web Services - MokoWaaS</name>
+	<author>Moko Consulting</author>
+	<creationDate>2026-05-23</creationDate>
+	<copyright>Copyright (C) 2026 Moko Consulting. All rights reserved.</copyright>
+	<license>GPL-3.0-or-later</license>
+	<authorEmail>hello@mokoconsulting.tech</authorEmail>
+	<authorUrl>https://mokoconsulting.tech</authorUrl>
+	<version>02.03.11</version>
+	<description>Joomla Web Services API routes for MokoWaaS site management — health checks, cache, updates, backups, and site info.</description>
+	<namespace path="src">Moko\Plugin\WebServices\MokoWaaS</namespace>
+	<files>
+		<folder plugin="mokowaas">services</folder>
+		<folder>src</folder>
+	</files>
+</extension>
@@ -0,0 +1,36 @@
+<?php
+/**
+ * @package     MokoWaaS
+ * @subpackage  plg_webservices_mokowaas
+ * @copyright   Copyright (C) 2026 Moko Consulting. All rights reserved.
+ * @license     GNU General Public License version 3 or later; see LICENSE
+ */
+
+defined('_JEXEC') or die;
+
+use Joomla\CMS\Extension\PluginInterface;
+use Joomla\CMS\Factory;
+use Joomla\CMS\Plugin\PluginHelper;
+use Joomla\DI\Container;
+use Joomla\DI\ServiceProviderInterface;
+use Joomla\Event\DispatcherInterface;
+use Moko\Plugin\WebServices\MokoWaaS\Extension\MokoWaaSApi;
+
+return new class implements ServiceProviderInterface
+{
+	public function register(Container $container): void
+	{
+		$container->set(
+			PluginInterface::class,
+			function (Container $container) {
+				$dispatcher = $container->get(DispatcherInterface::class);
+				$plugin = new MokoWaaSApi(
+					$dispatcher,
+					(array) PluginHelper::getPlugin('webservices', 'mokowaas')
+				);
+				$plugin->setApplication(Factory::getApplication());
+				return $plugin;
+			}
+		);
+	}
+};
@@ -0,0 +1,65 @@
+<?php
+/**
+ * @package     MokoWaaS
+ * @subpackage  plg_webservices_mokowaas
+ * @copyright   Copyright (C) 2026 Moko Consulting. All rights reserved.
+ * @license     GNU General Public License version 3 or later; see LICENSE
+ */
+
+namespace Moko\Plugin\WebServices\MokoWaaS\Extension;
+
+defined('_JEXEC') or die;
+
+use Joomla\CMS\Plugin\CMSPlugin;
+use Joomla\CMS\Router\ApiRouter;
+use Joomla\Event\SubscriberInterface;
+
+/**
+ * MokoWaaS Web Services API Plugin
+ *
+ * Registers REST API routes for MokoWaaS site management endpoints.
+ *
+ * @since  1.0.0
+ */
+final class MokoWaaSApi extends CMSPlugin implements SubscriberInterface
+{
+	/**
+	 * @return  array
+	 */
+	public static function getSubscribedEvents(): array
+	{
+		return [
+			'onBeforeApiRoute' => 'onBeforeApiRoute',
+		];
+	}
+
+	/**
+	 * Register API routes for MokoWaaS.
+	 *
+	 * @param   ApiRouter  $router  The API router
+	 *
+	 * @return  void
+	 *
+	 * @since   1.0.0
+	 */
+	public function onBeforeApiRoute(&$router): void
+	{
+		$router->createCRUDRoutes(
+			'v1/mokowaas/health',
+			'health',
+			['component' => 'com_mokowaas']
+		);
+
+		$router->createCRUDRoutes(
+			'v1/mokowaas/cache',
+			'cache',
+			['component' => 'com_mokowaas']
+		);
+
+		$router->createCRUDRoutes(
+			'v1/mokowaas/update',
+			'update',
+			['component' => 'com_mokowaas']
+		);
+	}
+}
@@ -0,0 +1,24 @@
+<?xml version="1.0" encoding="utf-8"?>
+<extension type="package" method="upgrade">
+	<name>MokoWaaS</name>
+	<packagename>mokowaas</packagename>
+	<version>02.03.11</version>
+	<creationDate>2026-05-23</creationDate>
+	<author>Moko Consulting</author>
+	<authorEmail>hello@mokoconsulting.tech</authorEmail>
+	<authorUrl>https://mokoconsulting.tech</authorUrl>
+	<copyright>Copyright (C) 2026 Moko Consulting. All rights reserved.</copyright>
+	<license>GNU General Public License version 3 or later; see LICENSE</license>
+	<description>MokoWaaS site management suite — branding, health monitoring, tenant restrictions, and REST API.</description>
+	<scriptfile>script.php</scriptfile>
+
+	<files>
+		<file type="plugin" id="plg_system_mokowaas" group="system">plg_system_mokowaas.zip</file>
+		<file type="component" id="com_mokowaas">com_mokowaas.zip</file>
+		<file type="plugin" id="plg_webservices_mokowaas" group="webservices">plg_webservices_mokowaas.zip</file>
+	</files>
+
+	<updateservers>
+		<server type="extension" priority="1" name="MokoWaaS Update Server">https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS/raw/branch/main/updates.xml</server>
+	</updateservers>
+</extension>
@@ -1,26 +1,25 @@
 <?xml version='1.0' encoding='UTF-8'?>
 <!-- Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
 SPDX-License-Identifier: GPL-3.0-or-later
- VERSION: 02.01.41-dev
+ VERSION: 02.03.10-dev
 -->

 <updates>
  <update>
-    <name>System - MokoWaaS</name>
-    <description>System - MokoWaaS update</description>
-    <element>mokowaas</element>
-    <type>plugin</type>
-    <version>02.01.41-dev</version>
-    <client>site</client>
-    <folder>system</folder>
-    <tags><tag>development</tag></tags>
-    <infourl title="System - MokoWaaS">https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS/releases/tag/development</infourl>
+    <name>MokoWaaS</name>
+    <description>MokoWaaS development build.</description>
+    <element>pkg_mokowaas</element>
+    <type>package</type>
+    <version>02.03.12</version>
+    <creationDate>2026-05-24</creationDate>
+    <infourl title='MokoWaaS'>https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS/releases/tag/development</infourl>
    <downloads>
-      <downloadurl type="full" format="zip">https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS/releases/download/development/plg_system_mokowaas-02.01.41-dev.zip</downloadurl>
+      <downloadurl type='full' format='zip'>https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS/releases/download/development/pkg_mokowaas-02.03.12-dev.zip</downloadurl>
    </downloads>
-    <sha256>145f2ebaf62b74e439284d371926ae251866c6fbdb24d1fc5a0b90ac174a4ae8</sha256>
-    <targetplatform name="joomla" version="((5.[0-9])|(6.[0-9]))" />
+    <sha256>14f89c9757f919b5bce3a5313ba74c9974d6474790c97f14eacebd9029a7444f</sha256>
+    <tags><tag>development</tag></tags>
    <maintainer>Moko Consulting</maintainer>
    <maintainerurl>https://mokoconsulting.tech</maintainerurl>
+    <targetplatform name='joomla' version='(5|6).*'/>
  </update>
 </updates>