chore(release): build 09.33.00 [skip ci]

- Add demo and live to ENV_CONFIG_MAP
- Add multi-target deploy via LIVE_TARGETS env var (JSON array of targets)
- Add sftp-config.demo.json.example and sftp-config.live.json.example templates
- Failed targets logged but don't block remaining deploys

.gitmodules

@@ -0,0 +1,12 @@
+[submodule "templates/repos/Template-Client"]
+	path = templates/repos/Template-Client
+	url = https://git.mokoconsulting.tech/MokoConsulting/Template-Client.git
+[submodule "templates/repos/Template-Generic"]
+	path = templates/repos/Template-Generic
+	url = https://git.mokoconsulting.tech/MokoConsulting/Template-Generic.git
+[submodule "templates/repos/Template-Joomla"]
+	path = templates/repos/Template-Joomla
+	url = https://git.mokoconsulting.tech/MokoConsulting/Template-Joomla.git
+[submodule "templates/repos/Template-MCP"]
+	path = templates/repos/Template-MCP
+	url = https://git.mokoconsulting.tech/MokoConsulting/Template-MCP.git

.mokogitea/CLAUDE.md

@@ -44,7 +44,7 @@ composer check                           # Run all checks
 
 ### CLI Framework
 
-All CLI tools extend `MokoEnterprise\CliFramework` (`lib/Enterprise/CliFramework.php`).
+All CLI tools extend `MokoCli\CliFramework` (`lib/Enterprise/CliFramework.php`).
 Built-in flags: `--help`, `--verbose`, `--quiet`, `--dry-run`.
 After adding a CLI tool, register it in `bin/moko` COMMAND_MAP.
 
@@ -73,4 +73,4 @@ PHPStan runs with `--memory-limit=512M`. CI enforces PHPCS errors; PHPStan is `c
 - **Workflow directory**: `.mokogitea/` (not `.gitea/` or `.github/`)
 - **Wiki**: documentation lives in the Gitea wiki, not `docs/` files
 - **New CLI tools**: extend `CliFramework`, not `CLIApp` (legacy)
-- **Standards**: [MokoStandards](https://git.mokoconsulting.tech/MokoConsulting/mokoplatform/wiki/Home)
+- **Standards**: [MokoCli](https://git.mokoconsulting.tech/MokoConsulting/mokoplatform/wiki/Home)

.mokogitea/branch-protection.yml

@@ -57,13 +57,13 @@ jobs:
       - name: Determine target repos
         id: repos
         env:
-          GA_TOKEN: ${{ secrets.GA_TOKEN }}
+          GA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
         run: |
           API="${GITEA_URL}/api/v1"
 
           # Platform/standards/infra repos to exclude
           EXCLUDE="gitea-org-config org-profile gitea-private .mokogitea-private mokoplatform MokoTesting"
-          EXCLUDE="$EXCLUDE MokoStandards-Template-Client MokoStandards-Template-Dolibarr MokoStandards-Template-Generic MokoStandards-Template-Joomla MokoDoliProjTemplate"
+          EXCLUDE="$EXCLUDE MokoCli-Template-Client MokoCli-Template-Dolibarr MokoCli-Template-Generic MokoCli-Template-Joomla MokoDoliProjTemplate"
 
           if [ -n "${{ inputs.repos }}" ]; then
             # User-specified repos
@@ -105,7 +105,7 @@ jobs:
 
       - name: Apply protection rules
         env:
-          GA_TOKEN: ${{ secrets.GA_TOKEN }}
+          GA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
           DRY_RUN: ${{ inputs.dry_run || 'false' }}
         run: |
           API="${GITEA_URL}/api/v1"

.mokogitea/bulk-repo-sync.yml

@@ -84,8 +84,8 @@ jobs:
           echo "Running: php automation/bulk_sync.php ${{ steps.args.outputs.args }}"
           php automation/bulk_sync.php ${{ steps.args.outputs.args }} 2>&1 | tee /tmp/bulk_sync.log
         env:
-          GA_TOKEN: ${{ secrets.GA_TOKEN }}
+          GA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
-          GH_TOKEN: ${{ secrets.GH_TOKEN }}
+          GH_TOKEN: ${{ secrets.GH_PAT }}
           GIT_PLATFORM: gitea
           GITEA_URL: https://git.mokoconsulting.tech
           GITEA_ORG: MokoConsulting
@@ -112,7 +112,7 @@ jobs:
             bash automation/enforce_tags.sh || echo "Tag enforcement had errors (non-fatal)"
           fi
         env:
-          GA_TOKEN: ${{ secrets.GA_TOKEN }}
+          GA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
           GITEA_URL: https://git.mokoconsulting.tech
           GITEA_ORG: MokoConsulting
 

.mokogitea/renovate.yml

@@ -57,12 +57,12 @@ jobs:
       - name: Determine target repos
         id: repos
         env:
-          GA_TOKEN: ${{ secrets.GA_TOKEN }}
+          GA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
         run: |
           API="${GITEA_URL}/api/v1"
 
           EXCLUDE="gitea-org-config org-profile gitea-private .mokogitea-private mokoplatform MokoTesting"
-          EXCLUDE="$EXCLUDE MokoStandards-Template-Client MokoStandards-Template-Dolibarr MokoStandards-Template-Generic MokoStandards-Template-Joomla MokoDoliProjTemplate"
+          EXCLUDE="$EXCLUDE MokoCli-Template-Client MokoCli-Template-Dolibarr MokoCli-Template-Generic MokoCli-Template-Joomla MokoDoliProjTemplate"
 
           if [ -n "${{ inputs.repos }}" ]; then
             REPOS=$(echo "${{ inputs.repos }}" | tr ',' ' ')
@@ -107,7 +107,7 @@ jobs:
       - name: Run Renovate
         if: steps.repos.outputs.repo_list != ''
         env:
-          RENOVATE_TOKEN: ${{ secrets.GA_TOKEN }}
+          RENOVATE_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
           RENOVATE_PLATFORM: gitea
           RENOVATE_ENDPOINT: ${{ env.GITEA_URL }}/api/v1
           RENOVATE_GIT_AUTHOR: 'Renovate Bot <renovate@mokoconsulting.tech>'

.mokogitea/sync-wikis.yml

@@ -31,7 +31,7 @@ jobs:
 
       - name: Sync all wikis
         env:
-          GH_TOKEN: ${{ secrets.GH_TOKEN }}
+          GH_TOKEN: ${{ secrets.GH_PAT }}
           GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
         run: |
           if [ -z "$GH_TOKEN" ]; then

.mokogitea/workflows/auto-bump.yml

@@ -4,10 +4,10 @@
 #
 # FILE INFORMATION
 # DEFGROUP: Gitea.Workflow
-# INGROUP: mokoplatform.Release
+# INGROUP: mokocli.Release
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokoplatform
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 # PATH: /.mokogitea/workflows/auto-bump.yml
-# VERSION: 09.23.00
+# VERSION: 09.02.00
 # BRIEF: Auto patch-bump version on every push to dev (skips merge commits)
 
 name: "Universal: Auto Version Bump"
@@ -43,21 +43,19 @@ jobs:
           token: ${{ secrets.MOKOGITEA_TOKEN }}
           fetch-depth: 1
 
-      - name: Setup mokoplatform tools
+      - name: Setup mokocli tools
         run: |
-          if [ -f "/opt/mokoplatform/cli/version_bump.php" ] && [ -f "/opt/mokoplatform/vendor/autoload.php" ]; then
+          if ! command -v composer &> /dev/null; then
-            echo "Using pre-installed /opt/mokoplatform"
+            sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer >/dev/null 2>&1
-            echo "MOKO_CLI=/opt/mokoplatform/cli" >> "$GITHUB_ENV"
+          fi
+          if [ -d "/opt/mokocli/cli" ]; then
+            echo "MOKO_CLI=/opt/mokocli/cli" >> "$GITHUB_ENV"
           else
-            if ! command -v composer &> /dev/null; then
-              sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer >/dev/null 2>&1
-            fi
-            rm -rf /tmp/mokoplatform-api
             git clone --depth 1 --branch main --quiet \
-              "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/MokoConsulting/mokoplatform.git" \
+              "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/MokoConsulting/mokocli.git" \
-              /tmp/mokoplatform-api
+              /tmp/mokocli
-            cd /tmp/mokoplatform-api && composer install --no-dev --no-interaction --quiet
+            cd /tmp/mokocli && composer install --no-dev --no-interaction --quiet
-            echo "MOKO_CLI=/tmp/mokoplatform-api/cli" >> "$GITHUB_ENV"
+            echo "MOKO_CLI=/tmp/mokocli/cli" >> "$GITHUB_ENV"
           fi
 
       - name: Bump version

.mokogitea/workflows/auto-release.yml

@@ -4,8 +4,8 @@
 #
 # FILE INFORMATION
 # DEFGROUP: Gitea.Workflow
-# INGROUP: mokoplatform.Release
+# INGROUP: mokocli.Release
-# REPO: https://git.mokoconsulting.tech/mokoconsulting-tech/mokoplatform
+# REPO: https://git.mokoconsulting.tech/mokoconsulting-tech/mokocli
 # PATH: /templates/workflows/universal/auto-release.yml.template
 # VERSION: 05.00.00
 # BRIEF: Universal build & release � detects platform from manifest.xml
@@ -66,25 +66,25 @@ jobs:
           token: ${{ secrets.MOKOGITEA_TOKEN }}
           fetch-depth: 1
 
-      - name: Setup mokoplatform tools
+      - name: Setup mokocli tools
         env:
           MOKO_CLONE_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
           MOKO_CLONE_HOST: git.mokoconsulting.tech/MokoConsulting
         run: |
-          if [ -f /opt/mokoplatform/cli/version_bump.php ] && [ -f /opt/mokoplatform/vendor/autoload.php ]; then
+          if [ -f /opt/mokocli/cli/version_bump.php ] && [ -f /opt/mokocli/vendor/autoload.php ]; then
-            echo Using pre-installed /opt/mokoplatform
+            echo Using pre-installed /opt/mokocli
-            echo MOKO_CLI=/opt/mokoplatform/cli >> $GITHUB_ENV
+            echo MOKO_CLI=/opt/mokocli/cli >> $GITHUB_ENV
           else
             echo Falling back to fresh clone
             if ! command -v composer > /dev/null 2>&1; then
               sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer > /dev/null 2>&1
             fi
-            rm -rf /tmp/mokoplatform-api
+            rm -rf /tmp/mokocli
-            CLONE_URL=https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/mokoplatform.git
+            CLONE_URL=https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/mokocli.git
-            git clone --depth 1 --branch main --quiet $CLONE_URL /tmp/mokoplatform-api
+            git clone --depth 1 --branch main --quiet $CLONE_URL /tmp/mokocli
-            cd /tmp/mokoplatform-api
+            cd /tmp/mokocli
             composer install --no-dev --no-interaction --quiet
-            echo MOKO_CLI=/tmp/mokoplatform-api/cli >> $GITHUB_ENV
+            echo MOKO_CLI=/tmp/mokocli/cli >> $GITHUB_ENV
           fi
 
       - name: Rename branch to rc
@@ -109,6 +109,40 @@ jobs:
             --path . --stability rc --bump minor --branch rc \
             --token "${{ secrets.MOKOGITEA_TOKEN }}"
 
+      - name: Update RC release notes from CHANGELOG.md
+        run: |
+          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+          TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
+
+          # Extract [Unreleased] section from changelog
+          NOTES=""
+          if [ -f "CHANGELOG.md" ]; then
+            NOTES=$(awk '/^## \[Unreleased\]/{found=1; next} /^## \[/{if(found) exit} found{print}' CHANGELOG.md)
+          fi
+          [ -z "$NOTES" ] && NOTES="Release candidate"
+
+          # Find the RC release and update its body
+          RELEASE_ID=$(curl -sf -H "Authorization: token ${TOKEN}" \
+            "${API_BASE}/releases/tags/release-candidate" \
+            | python3 -c "import json,sys; print(json.load(sys.stdin).get('id',''))" 2>/dev/null || true)
+
+          if [ -n "$RELEASE_ID" ]; then
+            python3 -c "
+          import json, urllib.request
+          body = open('/dev/stdin').read()
+          payload = json.dumps({'body': body}).encode()
+          req = urllib.request.Request(
+              '${API_BASE}/releases/${RELEASE_ID}',
+              data=payload, method='PATCH',
+              headers={
+                  'Authorization': 'token ${TOKEN}',
+                  'Content-Type': 'application/json'
+              })
+          urllib.request.urlopen(req)
+          " <<< "$NOTES"
+            echo "RC release notes updated from CHANGELOG.md"
+          fi
+
       - name: Summary
         if: always()
         run: |
@@ -149,50 +183,95 @@ jobs:
           fi
           echo "No conflict markers found"
 
-      - name: Setup mokoplatform tools
+      - name: Setup mokocli tools
         env:
           MOKO_CLONE_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
           MOKO_CLONE_HOST: git.mokoconsulting.tech/MokoConsulting
           COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.GH_MIRROR_TOKEN }}"}}'
         run: |
-          if [ -f /opt/mokoplatform/cli/version_bump.php ] && [ -f /opt/mokoplatform/vendor/autoload.php ]; then
+          if [ -f /opt/mokocli/cli/version_bump.php ] && [ -f /opt/mokocli/vendor/autoload.php ]; then
-            echo Using pre-installed /opt/mokoplatform
+            echo Using pre-installed /opt/mokocli
-            echo MOKO_CLI=/opt/mokoplatform/cli >> $GITHUB_ENV
+            echo MOKO_CLI=/opt/mokocli/cli >> $GITHUB_ENV
           else
             echo Falling back to fresh clone
             if ! command -v composer > /dev/null 2>&1; then
               sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer > /dev/null 2>&1
             fi
-            rm -rf /tmp/mokoplatform-api
+            rm -rf /tmp/mokocli
-            CLONE_URL=https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/mokoplatform.git
+            CLONE_URL=https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/mokocli.git
-            git clone --depth 1 --branch main --quiet $CLONE_URL /tmp/mokoplatform-api
+            git clone --depth 1 --branch main --quiet $CLONE_URL /tmp/mokocli
-            cd /tmp/mokoplatform-api
+            cd /tmp/mokocli
             composer install --no-dev --no-interaction --quiet
-            echo MOKO_CLI=/tmp/mokoplatform-api/cli >> $GITHUB_ENV
+            echo MOKO_CLI=/tmp/mokocli/cli >> $GITHUB_ENV
           fi
 
+      - name: "Detect platform"
+        id: platform
+        run: |
+          php ${MOKO_CLI}/platform_detect.php --path . --github-output 2>/dev/null || true
+          php ${MOKO_CLI}/manifest_read.php --path . --github-output 2>/dev/null || true
+
+      - name: "Determine version bump level"
+        id: bump
+        run: |
+          # Fix/patch branches: version was already bumped by pre-release, just strip suffix
+          # Feature/dev branches: bump minor for the new stable release
+          HEAD_REF="${{ github.event.pull_request.head.ref || 'dev' }}"
+          case "$HEAD_REF" in
+            fix/*|patch/*|hotfix/*|bugfix/*) BUMP="none" ;;
+            *)                               BUMP="minor" ;;
+          esac
+          echo "level=${BUMP}" >> "$GITHUB_OUTPUT"
+          echo "Bump level: ${BUMP} (from branch: ${HEAD_REF})"
+
       - name: "Publish stable release"
         run: |
+          BUMP_FLAG=""
+          if [ "${{ steps.bump.outputs.level }}" != "none" ]; then
+            BUMP_FLAG="--bump ${{ steps.bump.outputs.level }}"
+          fi
           php ${MOKO_CLI}/release_publish.php \
-            --path . --stability stable --bump minor --branch main \
+            --path . --stability stable ${BUMP_FLAG} --branch main \
             --token "${{ secrets.MOKOGITEA_TOKEN }}"
 
-      - name: Update release notes from CHANGELOG.md
+      - name: "Read published version"
+        id: version
+        run: |
+          VERSION=$(php ${MOKO_CLI}/version_read.php --path . 2>/dev/null || echo "")
+          VERSION=$(echo "$VERSION" | sed 's/-\(dev\|alpha\|beta\|rc\)$//')
+          [ -z "$VERSION" ] && VERSION="00.00.00" && echo "skip=true" >> "$GITHUB_OUTPUT"
+          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
+          echo "tag=stable" >> "$GITHUB_OUTPUT"
+          echo "release_tag=stable" >> "$GITHUB_OUTPUT"
+          echo "branch=main" >> "$GITHUB_OUTPUT"
+          echo "Published version: ${VERSION}"
+
+      - name: Update release notes and promote changelog
         run: |
           API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+          TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
+
+          # Get the stable release info (version and ID)
+          RELEASE_JSON=$(curl -sf -H "Authorization: token ${TOKEN}" \
+            "${API_BASE}/releases/tags/stable" 2>/dev/null || echo '{}')
+          RELEASE_ID=$(python3 -c "import json,sys; print(json.load(sys.stdin).get('id',''))" <<< "$RELEASE_JSON" 2>/dev/null || true)
+          # Extract version from release name (e.g. "06.17.00" or "v06.17.00")
+          VERSION=$(python3 -c "
+          import json, sys, re
+          r = json.load(sys.stdin)
+          name = r.get('name', '')
+          m = re.search(r'(\d+\.\d+\.\d+)', name)
+          print(m.group(1) if m else '')
+          " <<< "$RELEASE_JSON" 2>/dev/null || true)
 
           # Extract [Unreleased] section from changelog
+          NOTES=""
           if [ -f "CHANGELOG.md" ]; then
             NOTES=$(awk '/^## \[Unreleased\]/{found=1; next} /^## \[/{if(found) exit} found{print}' CHANGELOG.md)
-            [ -z "$NOTES" ] && NOTES="Stable release"
-          else
-            NOTES="Stable release"
           fi
+          [ -z "$NOTES" ] && NOTES="Stable release"
 
           # Update release body via API
-          RELEASE_ID=$(curl -sf -H "Authorization: token ${{ secrets.MOKOGITEA_TOKEN }}" \
-            "${API_BASE}/releases/tags/stable" | python3 -c "import json,sys; print(json.load(sys.stdin).get('id',''))" 2>/dev/null || true)
-
           if [ -n "$RELEASE_ID" ]; then
             python3 -c "
           import json, urllib.request
@@ -202,7 +281,7 @@ jobs:
               '${API_BASE}/releases/${RELEASE_ID}',
               data=payload, method='PATCH',
               headers={
-                  'Authorization': 'token ${{ secrets.MOKOGITEA_TOKEN }}',
+                  'Authorization': 'token ${TOKEN}',
                   'Content-Type': 'application/json'
               })
           urllib.request.urlopen(req)
@@ -210,6 +289,24 @@ jobs:
             echo "Release notes updated from CHANGELOG.md"
           fi
 
+          # Promote [Unreleased] → [version] in CHANGELOG.md and reset
+          if [ -n "$VERSION" ] && [ -f "CHANGELOG.md" ]; then
+            DATE=$(date +%Y-%m-%d)
+            python3 -c "
+          import sys
+          version, date = sys.argv[1], sys.argv[2]
+          content = open('CHANGELOG.md').read()
+          old = '## [Unreleased]'
+          new = f'## [Unreleased]\n\n## [{version}] --- {date}'
+          content = content.replace(old, new, 1)
+          open('CHANGELOG.md', 'w').write(content)
+          " "$VERSION" "$DATE"
+            git add CHANGELOG.md
+            git commit -m "chore: promote changelog [Unreleased] → [${VERSION}]" || true
+            git push origin main || true
+            echo "Changelog promoted: [Unreleased] → [${VERSION}]"
+          fi
+
       # -- STEP 9: Mirror to GitHub (stable only) --------------------------------
       - name: "Step 9: Mirror release to GitHub"
         if: >-

.mokogitea/workflows/branch-cleanup.yml

@@ -4,10 +4,10 @@
 #
 # FILE INFORMATION
 # DEFGROUP: Gitea.Workflow
-# INGROUP: MokoPlatform.Universal
+# INGROUP: MokoStandards.Universal
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokoplatform
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 # PATH: /.mokogitea/workflows/branch-cleanup.yml
-# VERSION: 09.23.00
+# VERSION: 01.00.00
 # BRIEF: Delete feature branches after PR merge
 
 name: "Branch Cleanup"

.mokogitea/workflows/ci-generic.yml

@@ -13,19 +13,6 @@
 name: "Generic: Project CI"
 
 on:
-  push:
-    branches:
-      - main
-      - dev
-      - dev/**
-      - rc/**
-      - version/**
-  pull_request:
-    branches:
-      - main
-      - dev
-      - dev/**
-      - rc/**
   workflow_dispatch:
 
 permissions:

.mokogitea/workflows/cleanup.yml

@@ -4,10 +4,10 @@
 #
 # FILE INFORMATION
 # DEFGROUP: Gitea.Workflow
-# INGROUP: mokoplatform.Maintenance
+# INGROUP: MokoStandards.Maintenance
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokoplatform
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/MokoStandards
-# PATH: /.mokogitea/workflows/cleanup.yml
+# PATH: /.gitea/workflows/cleanup.yml
-# VERSION: 09.23.00
+# VERSION: 01.00.00
 # BRIEF: Scheduled cleanup — delete merged branches and old workflow runs
 
 name: "Universal: Repository Cleanup"
@@ -33,17 +33,17 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
-          token: ${{ secrets.MOKOGITEA_TOKEN }}
+          token: ${{ secrets.GA_TOKEN }}
 
       - name: Delete merged branches
         env:
-          GA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+          GA_TOKEN: ${{ secrets.GA_TOKEN }}
         run: |
           echo "=== Merged Branch Cleanup ==="
           API="${GITEA_URL}/api/v1/repos/${{ github.repository }}"
 
           # List branches via API
-          BRANCHES=$(curl -sS -H "Authorization: token ${GITEA_TOKEN}" \
+          BRANCHES=$(curl -sS -H "Authorization: token ${GA_TOKEN}" \
             "${API}/branches?limit=50" | jq -r '.[].name')
 
           DELETED=0
@@ -56,7 +56,7 @@ jobs:
             # Check if branch is merged into main
             if git merge-base --is-ancestor "origin/${BRANCH}" origin/main 2>/dev/null; then
               echo "  Deleting merged branch: ${BRANCH}"
-              curl -sS -X DELETE -H "Authorization: token ${GITEA_TOKEN}" \
+              curl -sS -X DELETE -H "Authorization: token ${GA_TOKEN}" \
                 "${API}/branches/${BRANCH}" 2>/dev/null || true
               DELETED=$((DELETED + 1))
             fi
@@ -66,20 +66,20 @@ jobs:
 
       - name: Clean old workflow runs
         env:
-          GA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+          GA_TOKEN: ${{ secrets.GA_TOKEN }}
         run: |
           echo "=== Workflow Run Cleanup ==="
           API="${GITEA_URL}/api/v1/repos/${{ github.repository }}"
           CUTOFF=$(date -d "30 days ago" +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || date -v-30d +%Y-%m-%dT%H:%M:%SZ)
 
           # Get old completed runs
-          RUNS=$(curl -sS -H "Authorization: token ${GITEA_TOKEN}" \
+          RUNS=$(curl -sS -H "Authorization: token ${GA_TOKEN}" \
             "${API}/actions/runs?status=completed&limit=50" | \
             jq -r ".workflow_runs[] | select(.created_at < \"${CUTOFF}\") | .id" 2>/dev/null)
 
           DELETED=0
           for RUN_ID in $RUNS; do
-            curl -sS -X DELETE -H "Authorization: token ${GITEA_TOKEN}" \
+            curl -sS -X DELETE -H "Authorization: token ${GA_TOKEN}" \
               "${API}/actions/runs/${RUN_ID}" 2>/dev/null || true
             DELETED=$((DELETED + 1))
           done

.mokogitea/workflows/gitleaks.yml

@@ -4,10 +4,10 @@
 #
 # FILE INFORMATION
 # DEFGROUP: Gitea.Workflow
-# INGROUP: mokoplatform.Security
+# INGROUP: MokoStandards.Security
-# REPO: https://git.mokoconsulting.tech/mokoconsulting-tech/mokoplatform
+# REPO: https://git.mokoconsulting.tech/mokoconsulting-tech/MokoStandards-API
 # PATH: /templates/workflows/gitleaks.yml.template
-# VERSION: 09.23.00
+# VERSION: 01.00.00
 # BRIEF: Secret scanning — detect leaked credentials, API keys, and tokens
 #
 # +========================================================================+
@@ -25,10 +25,6 @@
 name: "Universal: Secret Scanning"
 
 on:
-  pull_request:
-    branches:
-      - main
-      - 'dev/**'
   schedule:
     - cron: '0 5 * * 1'  # Weekly Monday 05:00 UTC
   workflow_dispatch:

.mokogitea/workflows/issue-branch.yml

@@ -4,8 +4,8 @@
 #
 # FILE INFORMATION
 # DEFGROUP: Gitea.Workflow
-# INGROUP: mokoplatform.Automation
+# INGROUP: mokocli.Automation
-# VERSION: 09.26.00
+# VERSION: 09.33.00
 # BRIEF: Auto-create feature branch when an issue is opened
 
 name: "Universal: Issue Branch"
@@ -28,7 +28,7 @@ jobs:
     steps:
       - name: Create branch and comment
         run: |
-          TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
+          TOKEN="${{ secrets.GA_TOKEN }}"
           API="${GITEA_URL}/api/v1/repos/${{ github.repository }}"
           ISSUE_NUM="${{ github.event.issue.number }}"
           ISSUE_TITLE="${{ github.event.issue.title }}"

.mokogitea/workflows/notify.yml

@@ -4,10 +4,10 @@
 #
 # FILE INFORMATION
 # DEFGROUP: Gitea.Workflow
-# INGROUP: mokoplatform.Notifications
+# INGROUP: MokoStandards.Notifications
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokoplatform
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/MokoStandards
-# PATH: /.mokogitea/workflows/notify.yml
+# PATH: /.gitea/workflows/notify.yml
-# VERSION: 09.23.00
+# VERSION: 01.00.00
 # BRIEF: Push notifications via ntfy on release success or workflow failure
 
 name: "Universal: Notifications"

.mokogitea/workflows/pr-check.yml

@@ -4,8 +4,8 @@
 #
 # FILE INFORMATION
 # DEFGROUP: Gitea.Workflow
-# INGROUP: mokoplatform.CI
+# INGROUP: moko-platform.CI
-# REPO: https://git.mokoconsulting.tech/mokoconsulting-tech/mokoplatform
+# REPO: https://git.mokoconsulting.tech/mokoconsulting-tech/moko-platform
 # PATH: /templates/workflows/universal/pr-check.yml.template
 # VERSION: 09.23.00
 # BRIEF: PR gate — branch policy + code validation before merge
@@ -96,6 +96,32 @@ jobs:
           echo "Branch policy: OK (${HEAD} → ${BASE})"
           echo "## Branch Policy: Passed" >> $GITHUB_STEP_SUMMARY
 
+  # ── Secret Scanning ──────────────────────────────────────────────────
+  gitleaks:
+    name: Secret Scan
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Install Gitleaks
+        run: |
+          GITLEAKS_VERSION="8.21.2"
+          curl -sSL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
+            | tar -xz -C /usr/local/bin gitleaks
+
+      - name: Scan PR commits for secrets
+        run: |
+          if gitleaks detect --source . --verbose \
+            --log-opts=${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }} 2>&1; then
+            echo "**No secrets detected.**" >> $GITHUB_STEP_SUMMARY
+          else
+            echo "::error::Potential secrets detected in PR commits"
+            exit 1
+          fi
+
   # ── Code Validation ────────────────────────────────────────────────────
   validate:
     name: Validate PR

.mokogitea/workflows/pre-release.yml

@@ -4,23 +4,26 @@
 #
 # FILE INFORMATION
 # DEFGROUP: Gitea.Workflow
-# INGROUP: mokoplatform.Release
+# INGROUP: mokocli.Release
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokoplatform
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 # PATH: /templates/workflows/universal/pre-release.yml.template
 # VERSION: 05.01.00
-# BRIEF: Manual pre-release -- builds dev/alpha/beta/rc packages from any branch
+# BRIEF: Auto pre-release on push to dev/alpha/beta/rc branches
 
 name: "Universal: Pre-Release"
 
 on:
-  pull_request:
+  push:
-    types: [closed]
     branches:
       - dev
-  pull_request_target:
+      - 'fix/**'
-    types: [synchronize, opened, reopened]
+      - 'patch/**'
-    branches:
+      - 'hotfix/**'
-      - main
+      - 'bugfix/**'
+      - 'chore/**'
+      - alpha
+      - beta
+      - rc
   workflow_dispatch:
     inputs:
       stability:
@@ -43,12 +46,11 @@ env:
 
 jobs:
   build:
-    name: "Build Pre-Release (${{ inputs.stability || 'development' }})"
+    name: "Build Pre-Release (${{ inputs.stability || github.ref_name }})"
     runs-on: release
     if: >-
       github.event_name == 'workflow_dispatch' ||
-      (github.event_name == 'pull_request' && github.event.pull_request.merged == true && github.event.pull_request.base.ref == 'dev') ||
+      github.event_name == 'push'
-      (github.event_name == 'pull_request_target' && github.event.pull_request.base.ref == 'main')
 
     steps:
       - name: Checkout
@@ -56,40 +58,47 @@ jobs:
         with:
           fetch-depth: 0
           token: ${{ secrets.MOKOGITEA_TOKEN }}
-          ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || '' }}
+          ref: ${{ github.ref_name }}
 
-      - name: Setup mokoplatform tools
+      - name: Setup mokocli tools
         env:
           MOKO_CLONE_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
           MOKO_CLONE_HOST: git.mokoconsulting.tech/MokoConsulting
         run: |
-          # Use pre-installed /opt/mokoplatform if available (updated by cron every 6h)
+          # Use pre-installed /opt/mokocli if available (updated by cron every 6h)
-          if [ -f /opt/mokoplatform/cli/version_bump.php ] && [ -f /opt/mokoplatform/cli/manifest_element.php ] && [ -f /opt/mokoplatform/vendor/autoload.php ]; then
+          if [ -f /opt/mokocli/cli/version_bump.php ] && [ -f /opt/mokocli/cli/manifest_element.php ] && [ -f /opt/mokocli/vendor/autoload.php ]; then
-            echo Using pre-installed /opt/mokoplatform
+            echo Using pre-installed /opt/mokocli
-            echo MOKO_CLI=/opt/mokoplatform/cli >> $GITHUB_ENV
+            echo MOKO_CLI=/opt/mokocli/cli >> $GITHUB_ENV
           else
             echo Falling back to fresh clone
             if ! command -v composer > /dev/null 2>&1; then
               sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer > /dev/null 2>&1
             fi
-            rm -rf /tmp/mokoplatform-api
+            rm -rf /tmp/mokocli
-            CLONE_URL=https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/mokoplatform.git
+            CLONE_URL=https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/mokocli.git
-            git clone --depth 1 --branch main --quiet $CLONE_URL /tmp/mokoplatform-api
+            git clone --depth 1 --branch main --quiet $CLONE_URL /tmp/mokocli
-            cd /tmp/mokoplatform-api && composer install --no-dev --no-interaction --quiet
+            cd /tmp/mokocli && composer install --no-dev --no-interaction --quiet
-            echo MOKO_CLI=/tmp/mokoplatform-api/cli >> $GITHUB_ENV
+            echo MOKO_CLI=/tmp/mokocli/cli >> $GITHUB_ENV
           fi
 
       - name: Detect platform
         id: platform
         run: |
+          # Auto-detect and update platform if not set in manifest
+          php ${MOKO_CLI}/platform_detect.php --path . --github-output 2>/dev/null || true
           php ${MOKO_CLI}/manifest_read.php --path . --github-output
 
       - name: Resolve metadata and bump version
         id: meta
         run: |
-          # Auto-detect stability: RC for PRs targeting main, else use input or default to development
+          # Auto-detect stability from branch name on push, or use input on dispatch
-          if [ "${{ github.event_name }}" = "pull_request_target" ] && [ "${{ github.event.pull_request.base.ref }}" = "main" ]; then
+          if [ "${{ github.event_name }}" = "push" ]; then
-            STABILITY="release-candidate"
+            case "${{ github.ref_name }}" in
+              rc)    STABILITY="release-candidate" ;;
+              alpha) STABILITY="alpha" ;;
+              beta)  STABILITY="beta" ;;
+              *)     STABILITY="development" ;;
+            esac
           else
             STABILITY="${{ inputs.stability || 'development' }}"
           fi
@@ -164,7 +173,7 @@ jobs:
           php ${MOKO_CLI}/release_create.php \
             --path . --version "$VERSION" --tag "$TAG" \
             --token "${{ secrets.MOKOGITEA_TOKEN }}" --api-base "$API_BASE" \
-            --repo "${GITEA_REPO}" --branch dev --prerelease
+            --repo "${GITEA_REPO}" --branch "${{ github.ref_name }}" --prerelease
 
       - name: Update release notes from CHANGELOG.md
         run: |

.mokogitea/workflows/rc-revert.yml

@@ -4,8 +4,8 @@
 #
 # FILE INFORMATION
 # DEFGROUP: Gitea.Workflow
-# INGROUP: MokoPlatform.Universal
+# INGROUP: mokocli.Universal
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 # PATH: /.mokogitea/workflows/rc-revert.yml
 # VERSION: 09.23.00
 # BRIEF: Rename rc/ branch back to dev/ when PR is closed without merge

.mokogitea/workflows/repo-health.yml

@@ -7,8 +7,8 @@
 #
 # FILE INFORMATION
 # DEFGROUP: Gitea.Workflow
-# INGROUP: mokoplatform.Validation
+# INGROUP: mokocli.Validation
-# REPO: https://git.mokoconsulting.tech/mokoconsulting-tech/mokoplatform
+# REPO: https://git.mokoconsulting.tech/mokoconsulting-tech/mokocli
 # PATH: /templates/workflows/joomla/repo_health.yml.template
 # VERSION: 09.23.00
 # BRIEF: Enforces repository guardrails by validating scripts governance, tooling availability, and core repository health artifacts.
@@ -33,7 +33,8 @@ on:
           - scripts
           - repo
   pull_request:
-  push:
+    branches:
+      - main
 
 permissions:
   contents: read

.mokogitea/workflows/security-audit.yml

@@ -4,10 +4,10 @@
 #
 # FILE INFORMATION
 # DEFGROUP: Gitea.Workflow
-# INGROUP: mokoplatform.Security
+# INGROUP: MokoStandards.Security
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokoplatform
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/MokoStandards
-# PATH: /.mokogitea/workflows/security-audit.yml
+# PATH: /.gitea/workflows/security-audit.yml
-# VERSION: 09.23.00
+# VERSION: 01.00.00
 # BRIEF: Dependency vulnerability scanning for composer and npm packages
 
 name: "Universal: Security Audit"
@@ -80,19 +80,3 @@ jobs:
             -H "Priority: high" \
             -d "Security audit found vulnerabilities. Review dependency updates." \
             "${NTFY_URL}/${NTFY_TOPIC}" || true
-
-
-      - name: Joomla version audit
-        if: always()
-        run: |
-          if [ -f "monitoring/joomla-version-audit.php" ] && [ -n "$JOOMLA_SITES" ]; then
-            echo "$JOOMLA_SITES" > /tmp/sites.json
-            php monitoring/joomla-version-audit.php --sites /tmp/sites.json || true
-            echo "### Joomla Version Audit" >> $GITHUB_STEP_SUMMARY
-            rm -f /tmp/sites.json
-          else
-            echo "Joomla audit skipped (no script or JOOMLA_SITES_JSON not configured)"
-          fi
-        env:
-          JOOMLA_SITES: ${{ vars.JOOMLA_SITES_JSON }}
-

.mokogitea/workflows/sync-feature-versions.yml

@@ -0,0 +1,103 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# FILE INFORMATION
+# DEFGROUP: Gitea.Workflow
+# INGROUP: mokocli.Automation
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
+# PATH: /.mokogitea/workflows/sync-feature-versions.yml
+# VERSION: 01.00.00
+# BRIEF: Merge dev into open feature branches after version bumps
+
+name: "Universal: Sync Feature Branch Versions"
+
+on:
+  push:
+    branches:
+      - dev
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+env:
+  GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+
+jobs:
+  sync:
+    name: Sync feature branches with dev
+    runs-on: ubuntu-latest
+    if: >-
+      github.event_name == 'workflow_dispatch' ||
+      contains(github.event.head_commit.message, 'chore(version)')
+
+    steps:
+      - name: Checkout dev
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          ref: dev
+          token: ${{ secrets.MOKOGITEA_TOKEN }}
+
+      - name: Configure git
+        run: |
+          git config --local user.email "gitea-actions[bot]@mokoconsulting.tech"
+          git config --local user.name "gitea-actions[bot]"
+          git remote set-url origin "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"
+
+      - name: Merge dev into feature branches
+        run: |
+          echo "=== Syncing feature branches with dev ==="
+
+          # Fetch all remote branches
+          git fetch origin
+
+          # Find feature branches (feature/*, fix/*, patch/*, hotfix/*, bugfix/*, chore/*)
+          BRANCHES=$(git branch -r --list 'origin/feature/*' 'origin/fix/*' 'origin/patch/*' 'origin/hotfix/*' 'origin/bugfix/*' 'origin/chore/*' | sed 's|origin/||; s/^[[:space:]]*//')
+
+          if [ -z "$BRANCHES" ]; then
+            echo "No feature branches found — nothing to sync"
+            exit 0
+          fi
+
+          SYNCED=0
+          SKIPPED=0
+          FAILED=0
+
+          for BRANCH in $BRANCHES; do
+            echo ""
+            echo "--- ${BRANCH} ---"
+
+            # Skip branches that are already up to date with dev
+            if git merge-base --is-ancestor dev "origin/${BRANCH}" 2>/dev/null; then
+              echo "Already up to date"
+              SKIPPED=$((SKIPPED + 1))
+              continue
+            fi
+
+            # Try to merge dev into the branch
+            git checkout "origin/${BRANCH}" -B "$BRANCH" 2>/dev/null
+            if git merge dev --no-edit -m "chore: merge dev into ${BRANCH} (version sync) [skip ci]" 2>/dev/null; then
+              git push origin "$BRANCH" 2>/dev/null
+              echo "Synced successfully"
+              SYNCED=$((SYNCED + 1))
+            else
+              git merge --abort 2>/dev/null || true
+              echo "Merge conflict — skipping (manual rebase needed)"
+              FAILED=$((FAILED + 1))
+            fi
+          done
+
+          # Return to dev
+          git checkout dev 2>/dev/null || true
+
+          echo ""
+          echo "=== Summary ==="
+          echo "Synced: ${SYNCED}"
+          echo "Already current: ${SKIPPED}"
+          echo "Conflicts (skipped): ${FAILED}"
+
+          if [ "$FAILED" -gt 0 ]; then
+            echo "::warning::${FAILED} branch(es) had merge conflicts and need manual rebase"
+          fi

.mokogitea/workflows/workflow-sync-trigger.yml

@@ -0,0 +1,73 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# FILE INFORMATION
+# DEFGROUP: Gitea.Workflow
+# INGROUP: mokocli.Universal
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
+# PATH: /.mokogitea/workflows/workflow-sync-trigger.yml
+# VERSION: 01.01.00
+# BRIEF: Trigger workflow sync to live repos when a PR is merged to main
+
+name: "Universal: Workflow Sync Trigger"
+
+on:
+  pull_request:
+    types: [closed]
+    branches:
+      - main
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+jobs:
+  sync:
+    name: Sync workflows to live repos
+    runs-on: ubuntu-latest
+    if: >-
+      github.event.pull_request.merged == true &&
+      !contains(github.event.pull_request.title, '[skip sync]')
+
+    steps:
+      - name: Determine platform from repo name
+        id: platform
+        run: |
+          REPO="${{ github.event.repository.name }}"
+          case "$REPO" in
+            Template-Joomla)   PLATFORM="joomla" ;;
+            Template-Dolibarr) PLATFORM="dolibarr" ;;
+            Template-Go)       PLATFORM="go" ;;
+            Template-MCP)      PLATFORM="mcp" ;;
+            Template-Generic)  PLATFORM="" ;;
+            *)                 PLATFORM="" ;;
+          esac
+          echo "platform=$PLATFORM" >> "$GITHUB_OUTPUT"
+          echo "Platform: ${PLATFORM:-all}"
+
+      - name: Clone mokocli
+        env:
+          MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+        run: |
+          GITEA_URL="${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}"
+          git clone --depth 1 "${GITEA_URL}/MokoConsulting/mokocli.git" /tmp/mokocli
+
+      - name: Install dependencies
+        run: |
+          cd /tmp/mokocli
+          composer install --no-dev --no-interaction --quiet 2>/dev/null || true
+
+      - name: Run workflow sync
+        env:
+          MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+        run: |
+          ARGS="--token ${MOKOGITEA_TOKEN}"
+          ARGS="${ARGS} --org ${{ vars.GITEA_ORG || github.repository_owner }}"
+          ARGS="${ARGS} --phase repos"
+
+          PLATFORM="${{ steps.platform.outputs.platform }}"
+          if [ -n "$PLATFORM" ]; then
+            ARGS="${ARGS} --platform-filter ${PLATFORM}"
+          fi
+
+          php /tmp/mokocli/cli/workflow_sync.php ${ARGS}

CHANGELOG.md

@@ -2,8 +2,8 @@
 Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
 SPDX-License-Identifier: GPL-3.0-or-later
 FILE INFORMATION
-DEFGROUP: MokoStandards.Root
+DEFGROUP: MokoCli.Root
-INGROUP: MokoStandards
+INGROUP: MokoCli
 REPO: https://git.mokoconsulting.tech/MokoConsulting/mokoplatform
 PATH: /CHANGELOG.md
 BRIEF: Release changelog
@@ -12,42 +12,12 @@ BRIEF: Release changelog
 # Changelog
 ## [Unreleased]
 
-## [09.26.00] --- 2026-06-07
+## [09.33.00] --- 2026-06-21
 
-### Added
+## [09.32.00] --- 2026-06-21
-- `workflow_sync.php` — cascading workflow sync from Generic → platform templates → live repos based on manifest.platform
-- `platform_detect.php` — auto-detect repo platform type (joomla/dolibarr/go/mcp/platform/generic) from file structure, optionally update manifest
-- Version prefix support in `version_read.php` and `version_bump.php` — repos with `<version_prefix>` in manifest (e.g. MokoGitea: `1.26.1+moko.`) get prefix-aware version scanning and bumping
-- Platform types: joomla, dolibarr, go, mcp, platform, generic
-- Template-Go and Template-MCP repos created
 
-### Changed
+## [09.32.00] --- 2026-06-21
-- `auto-release.yml` — patch branches (fix/*, patch/*, hotfix/*, bugfix/*) use `--bump none` (pre-release already bumped); feature/dev branches bump minor
-- `pre-release.yml` — triggers on push to dev, fix/**, patch/**, hotfix/**, bugfix/**, alpha, beta, rc branches
-- Version format standardized: `[prefix]XX.YY.ZZ` in source files, suffix (`-dev`, `-rc`) added by release system only
 
-## [09.26.00] --- 2026-06-07
+## [09.31.00] --- 2026-06-21
 
-### Added
+## [09.31.00] --- 2026-06-21
-- `cli/manifest_detect.php` — auto-detect manifest fields from source files (Joomla, Dolibarr, Go, MCP/Node, generic)
-- Supports `--json`, `--diff`, `--update`, `--github-output` modes
-- Warns on missing core fields (platform, name, version, package_type, language, entry_point)
-
-### Removed
-- `mcp/servers/mokowaas_api/` — consolidated into mcp-mokowaas-api repo
-
-## [09.25.00] --- 2026-06-04
-
-## [09.23] --- 2026-05-31
-
-## [09.22] --- 2026-05-31
-
-### Changed
-- **refactor(cli):** migrate 64 legacy scripts to CliFramework (#235) — all tools in cli/, automation/, maintenance/, deploy/, release/ now extend CliFramework with free --help, --verbose, --quiet, --dry-run, --json, banners, and coloured logging
-
-### Fixed
-- fix: auto-detect org/repo in updates_xml_build from manifest and git remote
-- fix: restore hyphen in version suffixes
-- fix: release names use standardized format
-- fix: remove lesser stream copies, each stream updates independently
-- fix: sort updates.xml entries dev first, stable last

README.md

@@ -6,7 +6,7 @@ DEFGROUP: MokoPlatform.Root
 INGROUP: MokoPlatform
 REPO: https://git.mokoconsulting.tech/MokoConsulting/mokoplatform
 PATH: /README.md
-VERSION: 09.26.00
+VERSION: 09.33.00
 BRIEF: Project overview and documentation
 -->
 
@@ -16,8 +16,8 @@ BRIEF: Project overview and documentation
 
 PHP implementation of mokoplatform — enterprise standards, automation framework, workflow templates, and bulk sync tooling.
 
-> **Primary platform**: [Gitea — git.mokoconsulting.tech](https://git.mokoconsulting.tech/MokoConsulting/MokoStandards-API)
+> **Primary platform**: [Gitea — git.mokoconsulting.tech](https://git.mokoconsulting.tech/MokoConsulting/MokoCli-API)
-> **Backup mirror**: [GitHub](https://github.com/MokoConsulting/MokoStandards-API) *(read-only mirror)*
+> **Backup mirror**: [GitHub](https://github.com/MokoConsulting/MokoCli-API) *(read-only mirror)*
 
 ## What Lives Here
 

automation/bulk_joomla_template.php

@@ -28,7 +28,7 @@ declare(strict_types=1);
 require_once __DIR__ . '/../vendor/autoload.php';
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\{
+use MokoCli\{
     AuditLogger,
     CliFramework,
     Config,

automation/bulk_sync.php

@@ -21,7 +21,7 @@ declare(strict_types=1);
 require_once __DIR__ . '/../vendor/autoload.php';
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\{
+use MokoCli\{
     ApiClient,
     AuditLogger,
     CheckpointManager,

automation/enrich_manifest_xml.php

@@ -21,8 +21,8 @@ declare(strict_types=1);
 require_once __DIR__ . '/../vendor/autoload.php';
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\CliFramework;
+use MokoCli\CliFramework;
-use MokoEnterprise\MokoStandardsParser;
+use MokoCli\ManifestParser;
 
 class EnrichManifestXmlCli extends CliFramework
 {
@@ -43,7 +43,7 @@ class EnrichManifestXmlCli extends CliFramework
         $skipStr    = $this->getArgument('--skip');
         $skipRepos  = $skipStr !== '' ? array_map('trim', explode(',', $skipStr)) : [];
 
-        $parser = new MokoStandardsParser();
+        $parser = new ManifestParser();
         $tmpBase = sys_get_temp_dir() . '/moko-enrich-' . getmypid();
 
         echo "=== mokoplatform XML Manifest Enrichment ===\n";
@@ -113,8 +113,8 @@ class EnrichManifestXmlCli extends CliFramework
             }
             $enrichment['build']['language'] = $enrichment['build']['language']
                 ?? $repo['language']
-                ?? MokoStandardsParser::platformLanguage($platform);
+                ?? ManifestParser::platformLanguage($platform);
-            $enrichment['build']['package_type'] = $enrichment['build']['package_type'] ?? MokoStandardsParser::platformPackageType($platform);
+            $enrichment['build']['package_type'] = $enrichment['build']['package_type'] ?? ManifestParser::platformPackageType($platform);
 
             $enrichedXml = $this->enrichManifestXml($existingXml, $enrichment);
             $dc = count($enrichment['deploy'] ?? []);
@@ -312,7 +312,7 @@ class EnrichManifestXmlCli extends CliFramework
             return $xml;
         }
 
-        $ns = MokoStandardsParser::NAMESPACE_URI;
+        $ns = ManifestParser::NAMESPACE_URI;
         $root = $dom->documentElement;
 
         foreach (['build', 'deploy', 'scripts'] as $tag) {

automation/enrich_mokostandards_xml.php

@@ -21,8 +21,8 @@ declare(strict_types=1);
 require_once __DIR__ . '/../vendor/autoload.php';
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\CliFramework;
+use MokoCli\CliFramework;
-use MokoEnterprise\MokoStandardsParser;
+use MokoCli\ManifestParser;
 
 class EnrichMokostandardsXmlCli extends CliFramework
 {
@@ -43,7 +43,7 @@ class EnrichMokostandardsXmlCli extends CliFramework
         $skipStr    = $this->getArgument('--skip');
         $skipRepos  = $skipStr !== '' ? array_map('trim', explode(',', $skipStr)) : [];
 
-        $parser = new MokoStandardsParser();
+        $parser = new ManifestParser();
         $tmpBase = sys_get_temp_dir() . '/moko-enrich-' . getmypid();
 
         echo "=== mokoplatform XML Manifest Enrichment ===\n";
@@ -113,8 +113,8 @@ class EnrichMokostandardsXmlCli extends CliFramework
             }
             $enrichment['build']['language'] = $enrichment['build']['language']
                 ?? $repo['language']
-                ?? MokoStandardsParser::platformLanguage($platform);
+                ?? ManifestParser::platformLanguage($platform);
-            $enrichment['build']['package_type'] = $enrichment['build']['package_type'] ?? MokoStandardsParser::platformPackageType($platform);
+            $enrichment['build']['package_type'] = $enrichment['build']['package_type'] ?? ManifestParser::platformPackageType($platform);
 
             $enrichedXml = $this->enrichManifestXml($existingXml, $enrichment);
             $dc = count($enrichment['deploy'] ?? []);
@@ -315,7 +315,7 @@ class EnrichMokostandardsXmlCli extends CliFramework
             return $xml;
         }
 
-        $ns = MokoStandardsParser::NAMESPACE_URI;
+        $ns = ManifestParser::NAMESPACE_URI;
         $root = $dom->documentElement;
 
         foreach (['build', 'deploy', 'scripts'] as $tag) {

automation/migrate_to_gitea.php

@@ -25,12 +25,12 @@ declare(strict_types=1);
 
 require_once __DIR__ . '/../vendor/autoload.php';
 
-use MokoEnterprise\CheckpointManager;
+use MokoCli\CheckpointManager;
-use MokoEnterprise\CliFramework;
+use MokoCli\CliFramework;
-use MokoEnterprise\Config;
+use MokoCli\Config;
-use MokoEnterprise\PlatformAdapterFactory;
+use MokoCli\PlatformAdapterFactory;
-use MokoEnterprise\GitHubAdapter;
+use MokoCli\GitHubAdapter;
-use MokoEnterprise\MokoGiteaAdapter;
+use MokoCli\MokoGiteaAdapter;
 
 /**
  * Gitea Migration Script

automation/push_files.php

@@ -21,7 +21,7 @@ declare(strict_types=1);
 require_once __DIR__ . '/../vendor/autoload.php';
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\{
+use MokoCli\{
     ApiClient,
     AuditLogger,
     CliFramework,

automation/push_manifest_xml.php

@@ -18,8 +18,8 @@ declare(strict_types=1);
 require_once __DIR__ . '/../vendor/autoload.php';
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\CliFramework;
+use MokoCli\CliFramework;
-use MokoEnterprise\MokoStandardsParser;
+use MokoCli\ManifestParser;
 
 class PushManifestXmlCli extends CliFramework
 {
@@ -44,7 +44,7 @@ class PushManifestXmlCli extends CliFramework
         $skipStr    = $this->getArgument('--skip');
         $skipRepos  = $skipStr !== '' ? array_map('trim', explode(',', $skipStr)) : [];
 
-        $parser = new MokoStandardsParser();
+        $parser = new ManifestParser();
         $tmpBase = sys_get_temp_dir() . '/moko-manifest-push-' . getmypid();
 
         echo "=== mokoplatform XML Manifest Push ===\n";
@@ -97,8 +97,8 @@ class PushManifestXmlCli extends CliFramework
                 'description'       => $repo['description'] ?? '',
                 'license'           => 'GPL-3.0-or-later',
                 'topics'            => $repo['topics'] ?? [],
-                'language'          => $repo['language'] ?? MokoStandardsParser::platformLanguage($platform),
+                'language'          => $repo['language'] ?? ManifestParser::platformLanguage($platform),
-                'package_type'      => MokoStandardsParser::platformPackageType($platform),
+                'package_type'      => ManifestParser::platformPackageType($platform),
                 'last_synced'       => date('c'),
             ]);
 

automation/push_mokostandards_xml.php

@@ -18,8 +18,8 @@ declare(strict_types=1);
 require_once __DIR__ . '/../vendor/autoload.php';
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\CliFramework;
+use MokoCli\CliFramework;
-use MokoEnterprise\MokoStandardsParser;
+use MokoCli\ManifestParser;
 
 class PushMokostandardsXmlCli extends CliFramework
 {
@@ -44,7 +44,7 @@ class PushMokostandardsXmlCli extends CliFramework
         $skipStr    = $this->getArgument('--skip');
         $skipRepos  = $skipStr !== '' ? array_map('trim', explode(',', $skipStr)) : [];
 
-        $parser = new MokoStandardsParser();
+        $parser = new ManifestParser();
         $tmpBase = sys_get_temp_dir() . '/moko-manifest-push-' . getmypid();
 
         echo "=== mokoplatform XML Manifest Push ===\n";
@@ -97,8 +97,8 @@ class PushMokostandardsXmlCli extends CliFramework
                 'description'       => $repo['description'] ?? '',
                 'license'           => 'GPL-3.0-or-later',
                 'topics'            => $repo['topics'] ?? [],
-                'language'          => $repo['language'] ?? MokoStandardsParser::platformLanguage($platform),
+                'language'          => $repo['language'] ?? ManifestParser::platformLanguage($platform),
-                'package_type'      => MokoStandardsParser::platformPackageType($platform),
+                'package_type'      => ManifestParser::platformPackageType($platform),
                 'last_synced'       => date('c'),
             ]);
 

automation/repo_cleanup.php

@@ -21,7 +21,7 @@ declare(strict_types=1);
 require_once __DIR__ . '/../vendor/autoload.php';
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\{ApiClient, AuditLogger, CliFramework, Config, GitPlatformAdapter, MetricsCollector, PlatformAdapterFactory};
+use MokoCli\{ApiClient, AuditLogger, CliFramework, Config, GitPlatformAdapter, MetricsCollector, PlatformAdapterFactory};
 
 /**
  * Enterprise Repository Cleanup

bin/moko

@@ -9,11 +9,11 @@
  * SPDX-License-Identifier: GPL-3.0-or-later
  *
  * FILE INFORMATION
- * DEFGROUP: MokoStandards.CLI
+ * DEFGROUP: MokoCli.CLI
- * INGROUP: MokoStandards
+ * INGROUP: MokoCli
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /bin/moko
- * BRIEF: Unified CLI dispatcher — run any MokoStandards script without needing GitHub Actions
+ * BRIEF: Unified CLI dispatcher — run any MokoCli script without needing GitHub Actions
  *
  * USAGE
  *   php bin/moko <command> [options]     (all platforms)
@@ -220,6 +220,9 @@ const COMMAND_MAP = [
     // Licensing
     'license'              => 'cli/license_manage.php',
 
+    // Security
+    'security:advisories'  => 'security/advisory_scan.php',
+
     // Shell completion
     'completion'           => 'cli/completion.php',
 
@@ -292,10 +295,10 @@ function printHelp(): void
 {
     echo <<<'HELP'
 ╔══════════════════════════════════════════════════════════╗
-║              MokoStandards CLI  (bin/moko)               ║
+║              MokoCli CLI  (bin/moko)               ║
 ╚══════════════════════════════════════════════════════════╝
 
-Run any MokoStandards script locally without GitHub Actions.
+Run any MokoCli script locally without GitHub Actions.
 
 USAGE
   php bin/moko <command> [options]     (all platforms)
@@ -397,7 +400,7 @@ function loadPluginCommands(): array
     $commands = [];
 
     foreach (glob("{$pluginDir}/*Plugin.php") as $file) {
-        $className = 'MokoEnterprise\\Plugins\\'
+        $className = 'MokoCli\\Plugins\\'
             . pathinfo($file, PATHINFO_FILENAME);
 
         if (!class_exists($className)) {

cli/archive_repo.php

@@ -20,9 +20,9 @@ declare(strict_types=1);
 require_once __DIR__ . '/../vendor/autoload.php';
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\CliFramework;
+use MokoCli\CliFramework;
-use MokoEnterprise\Config;
+use MokoCli\Config;
-use MokoEnterprise\PlatformAdapterFactory;
+use MokoCli\PlatformAdapterFactory;
 
 class ArchiveRepoCli extends CliFramework
 {

cli/audit_query.php

@@ -25,7 +25,7 @@ declare(strict_types=1);
 
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\CliFramework;
+use MokoCli\CliFramework;
 
 /**
  * CLI tool to search, filter, and export audit logs.

cli/badge_update.php

@@ -17,7 +17,7 @@ declare(strict_types=1);
 
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\CliFramework;
+use MokoCli\CliFramework;
 
 class BadgeUpdateCli extends CliFramework
 {

cli/branch_rename.php

@@ -10,7 +10,7 @@
  * INGROUP: mokoplatform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokoplatform
  * PATH: /cli/branch_rename.php
- * VERSION: 09.26.00
+ * VERSION: 09.33.00
  * BRIEF: Rename a git branch via Gitea API (create new, update PR, delete old)
  */
 
@@ -18,7 +18,7 @@ declare(strict_types=1);
 
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\CliFramework;
+use MokoCli\CliFramework;
 
 class BranchRenameCli extends CliFramework
 {

cli/bulk_workflow_push.php

@@ -12,7 +12,7 @@
  * INGROUP: mokoplatform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokoplatform
  * PATH: /cli/bulk_workflow_push.php
- * VERSION: 09.26.00
+ * VERSION: 09.33.00
  * BRIEF: Push a workflow file to all governed repos via the Gitea Contents API
  */
 
@@ -20,7 +20,7 @@ declare(strict_types=1);
 
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\CliFramework;
+use MokoCli\CliFramework;
 
 class BulkWorkflowPushCli extends CliFramework
 {

cli/bulk_workflow_trigger.php

@@ -12,7 +12,7 @@
  * INGROUP: mokoplatform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokoplatform
  * PATH: /cli/bulk_workflow_trigger.php
- * VERSION: 09.26.00
+ * VERSION: 09.33.00
  * BRIEF: Trigger a workflow across multiple repos at once
  */
 
@@ -20,7 +20,7 @@ declare(strict_types=1);
 
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\CliFramework;
+use MokoCli\CliFramework;
 
 class BulkWorkflowTriggerCli extends CliFramework
 {

cli/changelog_promote.php

@@ -17,7 +17,7 @@ declare(strict_types=1);
 
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\CliFramework;
+use MokoCli\CliFramework;
 
 class ChangelogPromoteCli extends CliFramework
 {

cli/changelog_prune.php

@@ -17,7 +17,7 @@ declare(strict_types=1);
 
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\CliFramework;
+use MokoCli\CliFramework;
 
 class ChangelogPruneCli extends CliFramework
 {

cli/client_dashboard.php

@@ -12,7 +12,7 @@
  * INGROUP: mokoplatform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokoplatform
  * PATH: /cli/client_dashboard.php
- * VERSION: 09.26.00
+ * VERSION: 09.33.00
  * BRIEF: Generate unified client dashboard HTML
  */
 
@@ -20,7 +20,7 @@ declare(strict_types=1);
 
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\CliFramework;
+use MokoCli\CliFramework;
 
 class ClientDashboardCli extends CliFramework
 {

cli/client_health_check.php

@@ -17,7 +17,7 @@ declare(strict_types=1);
 
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\CliFramework;
+use MokoCli\CliFramework;
 
 class ClientHealthCheckCli extends CliFramework
 {

cli/client_inventory.php

@@ -12,7 +12,7 @@
  * INGROUP: mokoplatform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokoplatform
  * PATH: /cli/client_inventory.php
- * VERSION: 09.26.00
+ * VERSION: 09.33.00
  * BRIEF: Discover and list all client-waas repos with their server configuration status
  */
 
@@ -20,7 +20,7 @@ declare(strict_types=1);
 
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\CliFramework;
+use MokoCli\CliFramework;
 
 class ClientInventoryCli extends CliFramework
 {

cli/client_provision.php

@@ -12,7 +12,7 @@
  * INGROUP: mokoplatform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokoplatform
  * PATH: /cli/client_provision.php
- * VERSION: 09.26.00
+ * VERSION: 09.33.00
  * BRIEF: Provision a new client environment end-to-end
  */
 
@@ -20,7 +20,7 @@ declare(strict_types=1);
 
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\CliFramework;
+use MokoCli\CliFramework;
 
 class ClientProvisionCli extends CliFramework
 {

cli/completion.php

@@ -17,7 +17,7 @@ declare(strict_types=1);
 
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\CliFramework;
+use MokoCli\CliFramework;
 
 class CompletionCli extends CliFramework
 {

cli/create_project.php

@@ -19,7 +19,7 @@ declare(strict_types=1);
 
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\CliFramework;
+use MokoCli\CliFramework;
 
 class CreateProjectCli extends CliFramework
 {
@@ -80,10 +80,10 @@ class CreateProjectCli extends CliFramework
             return 2;
         }
 
-        $config   = \MokoEnterprise\Config::load();
+        $config   = \MokoCli\Config::load();
         $platformName = $config->getString('platform', 'gitea');
         try {
-            $adapter = \MokoEnterprise\PlatformAdapterFactory::create($config);
+            $adapter = \MokoCli\PlatformAdapterFactory::create($config);
             $api     = $adapter->getApiClient();
         } catch (\Exception $e) {
             $this->log('ERROR', "Platform initialization failed: " . $e->getMessage());
@@ -205,7 +205,7 @@ class CreateProjectCli extends CliFramework
         return $data['data'] ?? [];
     }
 
-    private function restGet(string $path, string $token, ?\MokoEnterprise\ApiClient $apiClient = null): array
+    private function restGet(string $path, string $token, ?\MokoCli\ApiClient $apiClient = null): array
     {
         if ($apiClient !== null) {
             try {
@@ -217,7 +217,7 @@ class CreateProjectCli extends CliFramework
         return [];
     }
 
-    private function detectRepoPlatform(string $org, string $repo, string $token, ?\MokoEnterprise\ApiClient $apiClient = null): string
+    private function detectRepoPlatform(string $org, string $repo, string $token, ?\MokoCli\ApiClient $apiClient = null): string
     {
         foreach (['.github/.mokostandards', '.mokogitea/.mokostandards', '.mokostandards'] as $path) {
             $data = $this->restGet("repos/{$org}/{$repo}/contents/{$path}", $token, $apiClient);

cli/create_repo.php

@@ -20,9 +20,9 @@ declare(strict_types=1);
 require_once __DIR__ . '/../vendor/autoload.php';
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\CliFramework;
+use MokoCli\CliFramework;
-use MokoEnterprise\Config;
+use MokoCli\Config;
-use MokoEnterprise\PlatformAdapterFactory;
+use MokoCli\PlatformAdapterFactory;
 
 class CreateRepoCli extends CliFramework
 {
@@ -138,7 +138,7 @@ class CreateRepoCli extends CliFramework
         echo "Step 4: Creating README.md...\n";
         $baseUrl = $platformName === 'gitea' ? $config->getString('gitea.url', 'https://git.mokoconsulting.tech') : 'https://github.com';
         $repoUrl = "{$baseUrl}/{$org}/{$name}";
-        $standardsUrl = "{$baseUrl}/{$org}/MokoStandards";
+        $standardsUrl = "{$baseUrl}/{$org}/MokoCli";
         $readmeContent = "<!--\n"
             . "Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>\n"
             . "SPDX-License-Identifier: GPL-3.0-or-later\n"

cli/deploy_joomla.php

@@ -31,7 +31,7 @@ require_once __DIR__ . '/../vendor/autoload.php';
 
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\{CliFramework, SourceResolver};
+use MokoCli\{CliFramework, SourceResolver};
 use phpseclib3\Net\SFTP;
 use phpseclib3\Crypt\PublicKeyLoader;
 

cli/dev_branch_reset.php

@@ -17,7 +17,7 @@ declare(strict_types=1);
 
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\CliFramework;
+use MokoCli\CliFramework;
 
 class DevBranchResetCli extends CliFramework
 {

cli/grafana_dashboard.php

@@ -12,7 +12,7 @@
  * INGROUP: mokoplatform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokoplatform
  * PATH: /cli/grafana_dashboard.php
- * VERSION: 09.26.00
+ * VERSION: 09.33.00
  * BRIEF: Manage Grafana dashboards via API
  */
 
@@ -20,7 +20,7 @@ declare(strict_types=1);
 
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\CliFramework;
+use MokoCli\CliFramework;
 
 class GrafanaDashboardCli extends CliFramework
 {

cli/joomla_build.php

@@ -10,7 +10,7 @@
  * INGROUP: mokoplatform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokoplatform
  * PATH: /cli/joomla_build.php
- * VERSION: 09.26.00
+ * VERSION: 09.33.00
  * BRIEF: Build a Joomla extension ZIP from manifest — all types supported
  * NOTE: Called by pre-release and auto-release workflows.
  */
@@ -19,7 +19,7 @@ declare(strict_types=1);
 
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\{CliFramework, SourceResolver};
+use MokoCli\{CliFramework, SourceResolver};
 
 class JoomlaBuildCli extends CliFramework
 {

cli/joomla_compat_check.php

@@ -17,7 +17,7 @@ declare(strict_types=1);
 
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\CliFramework;
+use MokoCli\CliFramework;
 
 class JoomlaCompatCheckCli extends CliFramework
 {

cli/joomla_metadata_validate.php

@@ -0,0 +1,507 @@
+#!/usr/bin/env php
+<?php
+
+/* Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+ *
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ *
+ * FILE INFORMATION
+ * DEFGROUP: mokoplatform.CLI
+ * INGROUP: mokoplatform
+ * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokoplatform
+ * PATH: /cli/joomla_metadata_validate.php
+ * VERSION: 09.33.00
+ * BRIEF: Validate MokoGitea repo metadata against Joomla extension manifest XML
+ */
+
+declare(strict_types=1);
+
+require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
+
+use MokoCli\CliFramework;
+
+class JoomlaMetadataValidateCli extends CliFramework
+{
+    /** Joomla element prefix map — must match MokoGitea's cleanJoomlaElement() */
+    private const JOOMLA_PREFIX = [
+        'package'   => 'pkg_',
+        'component' => 'com_',
+        'module'    => 'mod_',
+        'template'  => 'tpl_',
+        'library'   => 'lib_',
+        'file'      => 'file_',
+    ];
+
+    protected function configure(): void
+    {
+        $this->setDescription('Validate MokoGitea repo metadata against Joomla extension manifest XML');
+        $this->addArgument('--path', 'Repo root path (default: current directory)', '.');
+        $this->addArgument('--token', 'Gitea API token (or GITEA_TOKEN env)', '');
+        $this->addArgument('--org', 'Gitea org', 'MokoConsulting');
+        $this->addArgument('--repo', 'Repo name (auto-detected from git if empty)', '');
+        $this->addArgument('--api-base', 'Gitea API base URL', 'https://git.mokoconsulting.tech/api/v1');
+        $this->addArgument('--ci', 'CI mode: exit 1 on any error', false);
+        $this->addArgument('--json', 'Output as JSON', false);
+    }
+
+    protected function run(): int
+    {
+        $path     = realpath($this->getArgument('--path')) ?: $this->getArgument('--path');
+        $token    = $this->getArgument('--token') ?: getenv('GITEA_TOKEN') ?: '';
+        $org      = $this->getArgument('--org');
+        $repoName = $this->getArgument('--repo');
+        $apiBase  = rtrim($this->getArgument('--api-base'), '/');
+        $ciMode   = (bool) $this->getArgument('--ci');
+        $jsonMode = (bool) $this->getArgument('--json');
+
+        if (!is_dir($path)) {
+            $this->log('ERROR', "Path does not exist: {$path}");
+            return 1;
+        }
+
+        if ($repoName === '') {
+            $repoName = $this->detectRepoName($path);
+        }
+
+        // ── Step 1: Find the Joomla extension manifest XML ──────────
+        $joomlaXml = $this->findJoomlaManifest($path);
+
+        if ($joomlaXml === null) {
+            $this->log('ERROR', 'No Joomla extension manifest XML found');
+            return 1;
+        }
+
+        $this->log('INFO', "Joomla manifest: {$joomlaXml['path']}");
+
+        // ── Step 2: Load MokoGitea metadata ─────────────────────────
+        $metadata = $this->loadMetadata($path, $org, $repoName, $token, $apiBase);
+
+        if ($metadata === null) {
+            $this->log('ERROR', 'Could not load MokoGitea metadata');
+            return 1;
+        }
+
+        // ── Step 3: Compare ─────────────────────────────────────────
+        $results = $this->compare($metadata, $joomlaXml, $path);
+
+        // ── Step 4: Output ──────────────────────────────────────────
+        if ($jsonMode) {
+            echo json_encode([
+                'repo'    => $repoName,
+                'results' => $results,
+            ], JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES) . "\n";
+        } else {
+            $this->printResults($repoName, $results);
+        }
+
+        $errors = count(array_filter($results, fn($r) => $r['status'] === 'error'));
+
+        return ($ciMode && $errors > 0) ? 1 : 0;
+    }
+
+    // =================================================================
+    // Find Joomla manifest XML
+    // =================================================================
+
+    private function findJoomlaManifest(string $root): ?array
+    {
+        // Search common locations for a Joomla extension manifest
+        $candidates = [];
+
+        // Package manifest: source/pkg_*.xml
+        foreach (glob("{$root}/source/pkg_*.xml") as $file) {
+            $candidates[] = $file;
+        }
+
+        // Component manifest: source/packages/com_*/[name].xml
+        foreach (glob("{$root}/source/packages/com_*/*.xml") as $file) {
+            $basename = basename($file);
+            // Skip access.xml, config.xml, etc.
+            if (in_array($basename, ['access.xml', 'config.xml'], true)) {
+                continue;
+            }
+            $candidates[] = $file;
+        }
+
+        // Direct source/*.xml
+        foreach (glob("{$root}/source/*.xml") as $file) {
+            if (basename($file) !== 'pkg_mokosuitebackup.xml') {
+                // Already caught above
+            }
+            $candidates[] = $file;
+        }
+
+        // src/ fallback
+        foreach (glob("{$root}/src/pkg_*.xml") as $file) {
+            $candidates[] = $file;
+        }
+
+        // Find the first one that has <extension type="...">
+        foreach (array_unique($candidates) as $file) {
+            $content = file_get_contents($file);
+            if ($content === false) {
+                continue;
+            }
+
+            if (preg_match('/<extension\s[^>]*type=["\']([^"\']+)["\']/', $content, $typeMatch)) {
+                $xml = @simplexml_load_string($content);
+                if ($xml === false) {
+                    $relPath = str_replace($root . '/', '', $file);
+                    $relPath = str_replace($root . '\\', '', $relPath);
+                    $this->log('WARN', "Skipping {$relPath}: malformed XML");
+                    continue;
+                }
+
+                $type = strtolower($typeMatch[1]);
+                $relPath = str_replace($root . '/', '', $file);
+                $relPath = str_replace($root . '\\', '', $relPath);
+
+                return [
+                    'path' => $relPath,
+                    'type' => $type,
+                    'xml'  => $xml,
+                ];
+            }
+        }
+
+        return null;
+    }
+
+    // =================================================================
+    // Load metadata (from API)
+    // =================================================================
+
+    private function loadMetadata(string $root, string $org, string $repoName, string $token, string $apiBase): ?array
+    {
+        if ($token === '') {
+            $this->log('ERROR', 'No API token provided (use --token or set GITEA_TOKEN env var)');
+            return null;
+        }
+
+        $url = "{$apiBase}/repos/{$org}/{$repoName}/metadata";
+        $ctx = stream_context_create([
+            'http' => [
+                'header'        => "Authorization: token {$token}\r\nAccept: application/json\r\n",
+                'timeout'       => 10,
+                'ignore_errors' => true,
+            ],
+        ]);
+
+        $body = file_get_contents($url, false, $ctx);
+
+        // Extract HTTP status from response headers
+        $httpCode = 0;
+        if (isset($http_response_header[0]) && preg_match('/\d{3}/', $http_response_header[0], $m)) {
+            $httpCode = (int) $m[0];
+        }
+
+        if ($body === false) {
+            $this->log('ERROR', "Failed to connect to {$url} — check network or TLS configuration");
+            return null;
+        }
+
+        if ($httpCode === 404) {
+            $this->log('ERROR', "API endpoint not found: {$url}");
+            $this->log('ERROR', 'Server may need MokoGitea-Fork >= #650 (metadata endpoint rename)');
+            return null;
+        }
+
+        if ($httpCode === 401 || $httpCode === 403) {
+            $this->log('ERROR', "Authentication failed (HTTP {$httpCode}) — check your API token");
+            return null;
+        }
+
+        if ($httpCode >= 400) {
+            $this->log('ERROR', "API returned HTTP {$httpCode}: " . substr($body, 0, 200));
+            return null;
+        }
+
+        $data = json_decode($body, true);
+        if (!is_array($data)) {
+            $this->log('ERROR', "API returned invalid JSON from {$url}");
+            return null;
+        }
+
+        $data['source'] = 'api';
+        return $data;
+    }
+
+    // =================================================================
+    // Compare metadata against Joomla manifest
+    // =================================================================
+
+    private function compare(array $metadata, array $joomlaXml, string $root): array
+    {
+        $results = [];
+        $xml     = $joomlaXml['xml'];
+        $type    = $joomlaXml['type'];
+
+        // 1. Extension type
+        $metaType = $this->normalizeExtensionType(
+            $metadata['extension_type'] ?? $metadata['package_type'] ?? ''
+        );
+        $results[] = [
+            'field'    => 'extension_type',
+            'metadata' => $metaType,
+            'joomla'   => $type,
+            'status'   => ($metaType === $type) ? 'ok' : 'error',
+            'message'  => ($metaType === $type)
+                ? "matches <extension type=\"{$type}\">"
+                : "metadata has \"{$metaType}\" but Joomla manifest has \"{$type}\"",
+        ];
+
+        // 2. Element name
+        $metaName    = strtolower($metadata['name'] ?? '');
+        $metaElement = $this->deriveElement($metaType, $metaName);
+        $joomlaElement = $this->extractJoomlaElement($xml, $type);
+
+        $elementMatch = ($metaElement === $joomlaElement);
+        $results[] = [
+            'field'    => 'element',
+            'metadata' => $metaElement,
+            'joomla'   => $joomlaElement,
+            'status'   => $elementMatch ? 'ok' : 'error',
+            'message'  => $elementMatch
+                ? "derived correctly"
+                : "metadata derives \"{$metaElement}\" but Joomla uses \"{$joomlaElement}\"",
+        ];
+
+        // 3. Version
+        $metaVersion  = $metadata['version'] ?? '';
+        $joomlaVersion = (string) ($xml->version ?? '');
+
+        if ($metaVersion !== '' && $joomlaVersion !== '') {
+            // Strip dev/rc suffixes for comparison (CI bumps these)
+            $metaBase   = preg_replace('/-(dev|rc|alpha|beta)\d*$/', '', $metaVersion);
+            $joomlaBase = preg_replace('/-(dev|rc|alpha|beta)\d*$/', '', $joomlaVersion);
+            $versionMatch = ($metaBase === $joomlaBase);
+
+            $results[] = [
+                'field'    => 'version',
+                'metadata' => $metaVersion,
+                'joomla'   => $joomlaVersion,
+                'status'   => $versionMatch ? 'ok' : 'warn',
+                'message'  => $versionMatch
+                    ? 'matches (base version)'
+                    : "metadata has \"{$metaVersion}\" but Joomla has \"{$joomlaVersion}\"",
+            ];
+        }
+
+        // 4. PHP minimum (from composer.json)
+        $composerPhp = $this->readComposerPhpRequirement($root);
+        $metaPhp     = $metadata['php_minimum'] ?? '';
+
+        if ($composerPhp !== '' && $metaPhp !== '') {
+            $phpMatch = ($metaPhp === $composerPhp);
+            $results[] = [
+                'field'    => 'php_minimum',
+                'metadata' => $metaPhp,
+                'joomla'   => $composerPhp . ' (composer.json)',
+                'status'   => $phpMatch ? 'ok' : 'warn',
+                'message'  => $phpMatch
+                    ? 'matches composer.json'
+                    : "metadata has \"{$metaPhp}\" but composer.json requires \"{$composerPhp}\"",
+            ];
+        }
+
+        // 5. Description
+        $metaDesc   = $metadata['description'] ?? '';
+        $joomlaDesc = (string) ($xml->description ?? '');
+
+        // Joomla descriptions are often language keys, skip those
+        if ($metaDesc !== '' && $joomlaDesc !== '' && !str_starts_with($joomlaDesc, 'COM_') && !str_starts_with($joomlaDesc, 'PKG_')) {
+            $descMatch = ($metaDesc === $joomlaDesc);
+            $results[] = [
+                'field'    => 'description',
+                'metadata' => substr($metaDesc, 0, 60) . (strlen($metaDesc) > 60 ? '...' : ''),
+                'joomla'   => substr($joomlaDesc, 0, 60) . (strlen($joomlaDesc) > 60 ? '...' : ''),
+                'status'   => $descMatch ? 'ok' : 'info',
+                'message'  => $descMatch ? 'matches' : 'descriptions differ (informational)',
+            ];
+        }
+
+        return $results;
+    }
+
+    // =================================================================
+    // Helpers
+    // =================================================================
+
+    /**
+     * Normalize extension_type — map MokoGitea types to Joomla types.
+     */
+    private function normalizeExtensionType(string $type): string
+    {
+        return match (strtolower($type)) {
+            'joomla-extension' => 'package', // legacy mapping
+            default => strtolower($type),
+        };
+    }
+
+    /**
+     * Derive the Joomla element name from type + name.
+     * Replicates MokoGitea's cleanJoomlaElement() + prefix logic.
+     */
+    private function deriveElement(string $type, string $name): string
+    {
+        // Clean: lowercase, strip non-alphanumeric except . _ -
+        $clean = strtolower($name);
+        $clean = preg_replace('/[^a-z0-9._-]/', '', $clean);
+
+        $prefix = self::JOOMLA_PREFIX[$type] ?? '';
+
+        return $prefix . $clean;
+    }
+
+    /**
+     * Extract the element name from a Joomla manifest XML.
+     * Follows the same logic as Joomla's InstallerAdapter::getElement().
+     */
+    private function extractJoomlaElement(\SimpleXMLElement $xml, string $type): string
+    {
+        switch ($type) {
+            case 'package':
+                $packagename = (string) ($xml->packagename ?? '');
+                if ($packagename !== '') {
+                    return 'pkg_' . strtolower(preg_replace('/[^a-zA-Z0-9._-]/', '', $packagename));
+                }
+                break;
+
+            case 'component':
+                $element = (string) ($xml->element ?? '');
+                if ($element !== '') {
+                    $element = strtolower($element);
+                    return str_starts_with($element, 'com_') ? $element : 'com_' . $element;
+                }
+                $name = (string) ($xml->name ?? '');
+                $name = strtolower(preg_replace('/[^a-zA-Z0-9._-]/', '', $name));
+                return str_starts_with($name, 'com_') ? $name : 'com_' . $name;
+
+            case 'module':
+                $element = (string) ($xml->element ?? '');
+                if ($element !== '') {
+                    return strtolower($element);
+                }
+                break;
+
+            case 'plugin':
+                // Plugins derive element from the file attribute
+                if (isset($xml->files)) {
+                    foreach ($xml->files->children() as $file) {
+                        $plugin = (string) ($file->attributes()->plugin ?? '');
+                        if ($plugin !== '') {
+                            return strtolower($plugin);
+                        }
+                    }
+                }
+                break;
+
+            case 'library':
+                $libname = (string) ($xml->libraryname ?? '');
+                if ($libname !== '') {
+                    return strtolower($libname);
+                }
+                break;
+        }
+
+        // Fallback: use <name> tag
+        $name = (string) ($xml->name ?? '');
+        return strtolower(preg_replace('/[^a-zA-Z0-9._-]/', '', $name));
+    }
+
+    /**
+     * Read PHP version requirement from composer.json.
+     */
+    private function readComposerPhpRequirement(string $root): string
+    {
+        $composerFile = "{$root}/composer.json";
+
+        if (!is_file($composerFile)) {
+            return '';
+        }
+
+        $data = json_decode(file_get_contents($composerFile), true);
+
+        if (!is_array($data)) {
+            return '';
+        }
+
+        $phpReq = $data['require']['php'] ?? '';
+
+        // Extract version number from constraint like ">=8.1"
+        if (preg_match('/(\d+\.\d+)/', $phpReq, $m)) {
+            return $m[1];
+        }
+
+        return '';
+    }
+
+    private function detectRepoName(string $root): string
+    {
+        $gitConfig = "{$root}/.git/config";
+
+        if (!file_exists($gitConfig)) {
+            return basename($root);
+        }
+
+        $content = file_get_contents($gitConfig);
+
+        if (preg_match('/url\s*=\s*.*\/([^\/\s]+?)(?:\.git)?\s*$/m', $content, $m)) {
+            return $m[1];
+        }
+
+        return basename($root);
+    }
+
+    // =================================================================
+    // Output
+    // =================================================================
+
+    private function printResults(string $repoName, array $results): void
+    {
+        $errors = count(array_filter($results, fn($r) => $r['status'] === 'error'));
+        $warns  = count(array_filter($results, fn($r) => $r['status'] === 'warn'));
+        $oks    = count(array_filter($results, fn($r) => $r['status'] === 'ok'));
+
+        $this->log('INFO', "Validating {$repoName} Joomla metadata...\n");
+
+        foreach ($results as $r) {
+            $icon = match ($r['status']) {
+                'ok'    => "\xE2\x9C\x93", // ✓
+                'error' => "\xE2\x9C\x97", // ✗
+                'warn'  => "\xE2\x9A\xA0", // ⚠
+                default => "\xE2\x84\xB9", // ℹ
+            };
+
+            $line = sprintf(
+                "  %s %-16s %s",
+                $icon,
+                $r['field'],
+                $r['message']
+            );
+
+            $this->log(
+                match ($r['status']) {
+                    'error' => 'ERROR',
+                    'warn'  => 'WARN',
+                    'ok'    => 'OK',
+                    default => 'INFO',
+                },
+                $line
+            );
+        }
+
+        echo "\n";
+
+        if ($errors > 0) {
+            $this->log('ERROR', "{$errors} error(s) — update delivery will fail");
+        } elseif ($warns > 0) {
+            $this->log('WARN', "All critical checks passed, {$warns} warning(s)");
+        } else {
+            $this->log('OK', "All {$oks} checks passed");
+        }
+    }
+}
+
+$app = new JoomlaMetadataValidateCli();
+exit($app->execute());

cli/joomla_release.php

@@ -25,7 +25,7 @@ declare(strict_types=1);
 
 require_once __DIR__ . '/../vendor/autoload.php';
 
-use MokoEnterprise\{ApiClient, AuditLogger, CliFramework, Config, PlatformAdapterFactory, SourceResolver};
+use MokoCli\{ApiClient, AuditLogger, CliFramework, Config, PlatformAdapterFactory, SourceResolver};
 
 /**
  * Joomla Release Manager
@@ -57,7 +57,7 @@ class JoomlaRelease extends CliFramework
     ];
 
     private ApiClient $api;
-    private \MokoEnterprise\GitPlatformAdapter $adapter;
+    private \MokoCli\GitPlatformAdapter $adapter;
 
     protected function configure(): void
     {

cli/license_manage.php

@@ -28,7 +28,7 @@ declare(strict_types=1);
 require_once __DIR__ . '/../vendor/autoload.php';
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\CliFramework;
+use MokoCli\CliFramework;
 
 class LicenseManage extends CliFramework
 {

cli/manifest_detect.php

@@ -10,7 +10,7 @@
  * INGROUP: mokoplatform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokoplatform
  * PATH: /cli/manifest_detect.php
- * VERSION: 09.26.00
+ * VERSION: 09.33.00
  * BRIEF: Auto-detect manifest fields from source files and optionally push to API
  */
 
@@ -18,7 +18,7 @@ declare(strict_types=1);
 
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\{CliFramework, SourceResolver};
+use MokoCli\{CliFramework, SourceResolver};
 
 class ManifestDetectCli extends CliFramework
 {
@@ -161,15 +161,18 @@ class ManifestDetectCli extends CliFramework
         $platform = $this->detectPlatform($root);
 
         $fields = [
-            'platform'     => $platform,
+            'platform'       => $platform,
-            'name'         => '',
+            'name'           => '',
-            'description'  => '',
+            'description'    => '',
-            'version'      => '',
+            'version'        => '',
-            'element_name' => '',
+            'element_name'   => '',
-            'package_type' => '',
+            'package_type'   => '',
-            'language'     => '',
+            'language'       => '',
-            'entry_point'  => '',
+            'entry_point'    => '',
-            'license_spdx' => '',
+            'license_spdx'   => '',
+            'display_name'   => '',
+            'target_version' => '',
+            'php_minimum'    => '',
         ];
 
         switch ($platform) {
@@ -316,7 +319,13 @@ class ManifestDetectCli extends CliFramework
         ];
         if (isset($prefixMap[$extType])) {
             $prefix = $prefixMap[$extType];
-            if (strpos($element, $prefix) !== 0 && strpos($element, '_') === false) {
+            // Only add prefix if not already present (check all known prefixes)
+            $hasPrefix = false;
+            foreach ($prefixMap as $p) {
+                if (strpos($element, $p) === 0) { $hasPrefix = true; break; }
+            }
+            if (strpos($element, 'plg_') === 0) { $hasPrefix = true; }
+            if (!$hasPrefix) {
                 $element = $prefix . $element;
             }
         } elseif ($extType === 'plugin') {
@@ -349,6 +358,30 @@ class ManifestDetectCli extends CliFramework
             }
         }
 
+        // Display name for update feeds
+        if (!empty($fields['name'])) {
+            $name = $fields['name'];
+            // If name already has "Type - " prefix, use as-is
+            if (preg_match('/^(Package|Component|Module|Plugin|Template|Library)\s*-\s*/i', $name)) {
+                $fields['display_name'] = $name;
+            } elseif (!empty($extType)) {
+                $fields['display_name'] = ucfirst($extType) . ' - ' . $name;
+            }
+        }
+
+        // Target Joomla version
+        if (preg_match('/<targetplatform\s[^>]*version="([^"]+)"/', $xml, $m)) {
+            $fields['target_version'] = trim($m[1]);
+        } else {
+            // Default for Joomla 5/6
+            $fields['target_version'] = '(5|6)\..*';
+        }
+
+        // PHP minimum
+        if (preg_match('/<php_minimum>([^<]+)<\/php_minimum>/', $xml, $m)) {
+            $fields['php_minimum'] = trim($m[1]);
+        }
+
         // License
         if (preg_match('/<license>([^<]+)<\/license>/', $xml, $m)) {
             $fields['license_spdx'] = $this->normalizeLicense(trim($m[1]));

cli/manifest_element.php

@@ -17,7 +17,7 @@ declare(strict_types=1);
 
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\{CliFramework, SourceResolver};
+use MokoCli\{CliFramework, SourceResolver};
 
 class ManifestElementCli extends CliFramework
 {

cli/manifest_integrity.php

@@ -0,0 +1,564 @@
+#!/usr/bin/env php
+<?php
+
+/* Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+ *
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ *
+ * FILE INFORMATION
+ * DEFGROUP: mokoplatform.CLI
+ * INGROUP: mokoplatform
+ * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokoplatform
+ * PATH: /cli/manifest_integrity.php
+ * VERSION: 09.33.00
+ * BRIEF: Cross-check manifest API fields against repo contents across the org
+ */
+
+declare(strict_types=1);
+
+require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
+
+use MokoCli\CliFramework;
+
+class ManifestIntegrityCli extends CliFramework
+{
+    protected function configure(): void
+    {
+        $this->setDescription('Cross-check manifest fields against repo contents across the org');
+        $this->addArgument('--path', 'Single repo path (local mode)', '');
+        $this->addArgument('--org', 'Gitea org (bulk mode)', 'MokoConsulting');
+        $this->addArgument('--repo', 'Single repo name (remote mode)', '');
+        $this->addArgument('--token', 'Gitea API token (or GITEA_TOKEN env)', '');
+        $this->addArgument('--api-base', 'Gitea API base URL', 'https://git.mokoconsulting.tech/api/v1');
+        $this->addArgument('--fix', 'Push fixes for detected drift', false);
+        $this->addArgument('--json', 'Output as JSON', false);
+        $this->addArgument('--quiet', 'Only show repos with issues', false);
+    }
+
+    protected function run(): int
+    {
+        $path     = $this->getArgument('--path');
+        $org      = $this->getArgument('--org');
+        $repoName = $this->getArgument('--repo');
+        $token    = $this->getArgument('--token') ?: getenv('GITEA_TOKEN') ?: '';
+        $apiBase  = rtrim($this->getArgument('--api-base'), '/');
+        $fixMode  = (bool) $this->getArgument('--fix');
+        $jsonMode = (bool) $this->getArgument('--json');
+        $quiet    = (bool) $this->getArgument('--quiet');
+
+        if ($token === '') {
+            $this->log('ERROR', 'API token required (use --token or GITEA_TOKEN env)');
+            return 1;
+        }
+
+        // ── Mode selection ──────────────────────────────────────────
+        if ($path !== '') {
+            // Local mode: detect from source + compare to API
+            return $this->checkLocal($path, $org, $repoName, $token, $apiBase, $fixMode, $jsonMode);
+        }
+
+        if ($repoName !== '') {
+            // Single remote repo
+            return $this->checkRemoteRepo($org, $repoName, $token, $apiBase, $fixMode, $jsonMode);
+        }
+
+        // Bulk mode: all repos in org
+        return $this->checkOrg($org, $token, $apiBase, $fixMode, $jsonMode, $quiet);
+    }
+
+    // =====================================================================
+    // Local mode — detect from source, compare to API
+    // =====================================================================
+
+    private function checkLocal(string $path, string $org, string $repoName, string $token, string $apiBase, bool $fix, bool $json): int
+    {
+        $root = realpath($path) ?: $path;
+        if (!is_dir($root)) {
+            $this->log('ERROR', "Path does not exist: {$path}");
+            return 1;
+        }
+
+        if ($repoName === '') {
+            $repoName = $this->detectRepoName($root);
+        }
+
+        // Run manifest_detect logic
+        $detected = $this->runDetect($root, $repoName);
+        $current = $this->fetchManifest($apiBase, $org, $repoName, $token);
+
+        if ($current === null) {
+            $this->log('ERROR', "Failed to fetch manifest for {$org}/{$repoName}");
+            return 1;
+        }
+
+        $issues = $this->validate($current, $detected, $repoName);
+
+        if ($json) {
+            echo json_encode(['repo' => $repoName, 'issues' => $issues], JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES) . "\n";
+        } else {
+            $this->printIssues($repoName, $issues);
+        }
+
+        if ($fix && !empty($issues)) {
+            return $this->applyFixes($apiBase, $org, $repoName, $token, $current, $issues);
+        }
+
+        return empty($issues) ? 0 : 1;
+    }
+
+    // =====================================================================
+    // Remote single repo mode — fetch source files via API
+    // =====================================================================
+
+    private function checkRemoteRepo(string $org, string $repoName, string $token, string $apiBase, bool $fix, bool $json): int
+    {
+        $current = $this->fetchManifest($apiBase, $org, $repoName, $token);
+        if ($current === null) {
+            $this->log('ERROR', "Failed to fetch manifest for {$org}/{$repoName}");
+            return 1;
+        }
+
+        $issues = $this->validateManifestOnly($current, $repoName);
+
+        if ($json) {
+            echo json_encode(['repo' => $repoName, 'issues' => $issues], JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES) . "\n";
+        } else {
+            $this->printIssues($repoName, $issues);
+        }
+
+        if ($fix && !empty($issues)) {
+            return $this->applyFixes($apiBase, $org, $repoName, $token, $current, $issues);
+        }
+
+        return empty($issues) ? 0 : 1;
+    }
+
+    // =====================================================================
+    // Bulk org mode — check all repos
+    // =====================================================================
+
+    private function checkOrg(string $org, string $token, string $apiBase, bool $fix, bool $json, bool $quiet): int
+    {
+        $repos = $this->fetchOrgRepos($apiBase, $org, $token);
+        if ($repos === null) {
+            $this->log('ERROR', "Failed to fetch repos for org {$org}");
+            return 1;
+        }
+
+        $this->log('INFO', "Manifest Integrity Check — {$org} (" . count($repos) . " repos)");
+
+        $allResults = [];
+        $totalIssues = 0;
+        $reposWithIssues = 0;
+
+        foreach ($repos as $repo) {
+            $name = $repo['name'];
+            $manifest = $this->fetchManifest($apiBase, $org, $name, $token);
+
+            if ($manifest === null) {
+                if (!$quiet) {
+                    $this->log('WARN', "{$name}: no manifest");
+                }
+                continue;
+            }
+
+            $issues = $this->validateManifestOnly($manifest, $name);
+
+            if (!empty($issues)) {
+                $reposWithIssues++;
+                $totalIssues += count($issues);
+
+                if ($json) {
+                    $allResults[] = ['repo' => $name, 'issues' => $issues];
+                } else {
+                    $this->printIssues($name, $issues);
+                }
+
+                if ($fix) {
+                    $this->applyFixes($apiBase, $org, $name, $token, $manifest, $issues);
+                }
+            } elseif (!$quiet && !$json) {
+                $this->log('OK', "{$name}: clean");
+            }
+        }
+
+        if ($json) {
+            echo json_encode($allResults, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES) . "\n";
+        } else {
+            echo "\n";
+            $level = $reposWithIssues > 0 ? 'WARN' : 'OK';
+            $this->log($level, sprintf(
+                'Summary: %d repos checked, %d with issues (%d total issues)',
+                count($repos),
+                $reposWithIssues,
+                $totalIssues
+            ));
+        }
+
+        return $reposWithIssues > 0 ? 1 : 0;
+    }
+
+    // =====================================================================
+    // Validation rules
+    // =====================================================================
+
+    /**
+     * Full validation: compare API manifest against locally-detected fields.
+     */
+    private function validate(array $current, array $detected, string $repoName): array
+    {
+        $issues = [];
+
+        // Required fields that should never be empty
+        $required = ['platform', 'name', 'version', 'package_type', 'language', 'entry_point'];
+        foreach ($required as $field) {
+            if (empty($current[$field])) {
+                $fix = $detected[$field] ?? null;
+                $issues[] = [
+                    'field'    => $field,
+                    'severity' => 'error',
+                    'message'  => 'Missing required field',
+                    'current'  => '',
+                    'fix'      => $fix,
+                ];
+            }
+        }
+
+        // Drift detection: detected value differs from API
+        foreach ($detected as $field => $detectedValue) {
+            $currentValue = $current[$field] ?? '';
+            if ($detectedValue !== '' && $currentValue !== '' && $detectedValue !== $currentValue) {
+                // Version drift is expected on dev branches (suffix)
+                if ($field === 'version' && strpos($detectedValue, $currentValue) === 0) {
+                    continue; // e.g., detected "02.34.50-dev" vs API "02.34.50"
+                }
+                if ($field === 'version' && strpos($currentValue, $detectedValue) === 0) {
+                    continue;
+                }
+
+                $issues[] = [
+                    'field'    => $field,
+                    'severity' => 'warn',
+                    'message'  => 'Drift: source differs from manifest',
+                    'current'  => $currentValue,
+                    'fix'      => $detectedValue,
+                ];
+            }
+        }
+
+        // Platform-specific structure validation
+        $platform = $current['platform'] ?? '';
+        $issues = array_merge($issues, $this->validatePlatformStructure($platform, $current, $repoName));
+
+        return $issues;
+    }
+
+    /**
+     * API-only validation: check manifest fields for completeness and consistency
+     * without access to source files.
+     */
+    private function validateManifestOnly(array $manifest, string $repoName): array
+    {
+        $issues = [];
+
+        // Required fields
+        $required = ['platform', 'name', 'version', 'language'];
+        foreach ($required as $field) {
+            if (empty($manifest[$field])) {
+                $issues[] = [
+                    'field'    => $field,
+                    'severity' => 'error',
+                    'message'  => 'Missing required field',
+                    'current'  => '',
+                    'fix'      => null,
+                ];
+            }
+        }
+
+        // Recommended fields
+        $recommended = ['package_type', 'entry_point', 'license_spdx', 'description'];
+        foreach ($recommended as $field) {
+            if (empty($manifest[$field])) {
+                $issues[] = [
+                    'field'    => $field,
+                    'severity' => 'info',
+                    'message'  => 'Recommended field is empty',
+                    'current'  => '',
+                    'fix'      => null,
+                ];
+            }
+        }
+
+        // Platform-specific checks
+        $platform = $manifest['platform'] ?? '';
+        $issues = array_merge($issues, $this->validatePlatformStructure($platform, $manifest, $repoName));
+
+        return $issues;
+    }
+
+    /**
+     * Platform-specific validation rules.
+     */
+    private function validatePlatformStructure(string $platform, array $manifest, string $repoName): array
+    {
+        $issues = [];
+
+        switch ($platform) {
+            case 'joomla':
+            case 'waas-component':
+                // Joomla repos must have element_name
+                if (empty($manifest['element_name'])) {
+                    $issues[] = [
+                        'field'    => 'element_name',
+                        'severity' => 'error',
+                        'message'  => 'Joomla repos require element_name',
+                        'current'  => '',
+                        'fix'      => null,
+                    ];
+                }
+                // Language should be PHP
+                if (!empty($manifest['language']) && $manifest['language'] !== 'PHP') {
+                    $issues[] = [
+                        'field'    => 'language',
+                        'severity' => 'warn',
+                        'message'  => 'Joomla repos should have language=PHP',
+                        'current'  => $manifest['language'],
+                        'fix'      => 'PHP',
+                    ];
+                }
+                break;
+
+            case 'dolibarr':
+            case 'crm-module':
+                if (!empty($manifest['language']) && $manifest['language'] !== 'PHP') {
+                    $issues[] = [
+                        'field'    => 'language',
+                        'severity' => 'warn',
+                        'message'  => 'Dolibarr repos should have language=PHP',
+                        'current'  => $manifest['language'],
+                        'fix'      => 'PHP',
+                    ];
+                }
+                break;
+
+            case 'go':
+                if (!empty($manifest['language']) && $manifest['language'] !== 'Go') {
+                    $issues[] = [
+                        'field'    => 'language',
+                        'severity' => 'warn',
+                        'message'  => 'Go repos should have language=Go',
+                        'current'  => $manifest['language'],
+                        'fix'      => 'Go',
+                    ];
+                }
+                break;
+
+            case 'mcp':
+                if (!empty($manifest['language']) && !in_array($manifest['language'], ['TypeScript', 'JavaScript'], true)) {
+                    $issues[] = [
+                        'field'    => 'language',
+                        'severity' => 'warn',
+                        'message'  => 'MCP repos should have language=TypeScript or JavaScript',
+                        'current'  => $manifest['language'],
+                        'fix'      => null,
+                    ];
+                }
+                break;
+        }
+
+        // Version format check: should be XX.YY.ZZ
+        $version = $manifest['version'] ?? '';
+        if ($version !== '' && !preg_match('/^\d{2}\.\d{2}\.\d{2}/', $version)) {
+            // Allow semver for node/go repos
+            if (!in_array($platform, ['mcp', 'node', 'go'], true)) {
+                $issues[] = [
+                    'field'    => 'version',
+                    'severity' => 'info',
+                    'message'  => 'Version does not match XX.YY.ZZ format',
+                    'current'  => $version,
+                    'fix'      => null,
+                ];
+            }
+        }
+
+        return $issues;
+    }
+
+    // =====================================================================
+    // Output
+    // =====================================================================
+
+    private function printIssues(string $repoName, array $issues): void
+    {
+        if (empty($issues)) {
+            return;
+        }
+
+        $errors = count(array_filter($issues, fn($i) => $i['severity'] === 'error'));
+        $warns  = count(array_filter($issues, fn($i) => $i['severity'] === 'warn'));
+        $infos  = count($issues) - $errors - $warns;
+
+        echo "\n";
+        $summary = [];
+        if ($errors > 0) $summary[] = "{$errors} error(s)";
+        if ($warns > 0) $summary[] = "{$warns} warning(s)";
+        if ($infos > 0) $summary[] = "{$infos} info";
+        $this->log($errors > 0 ? 'ERROR' : 'WARN', "{$repoName} — " . implode(', ', $summary));
+
+        foreach ($issues as $issue) {
+            $icon = match ($issue['severity']) {
+                'error' => 'ERROR',
+                'warn'  => 'WARN',
+                default => 'INFO',
+            };
+            $msg = sprintf('  %-18s %s', $issue['field'], $issue['message']);
+            if ($issue['current'] !== '') {
+                $msg .= " (current: {$issue['current']})";
+            }
+            if ($issue['fix'] !== null) {
+                $msg .= " → fix: {$issue['fix']}";
+            }
+            $this->log($icon, $msg);
+        }
+    }
+
+    // =====================================================================
+    // Fix application
+    // =====================================================================
+
+    private function applyFixes(string $apiBase, string $org, string $repo, string $token, array $current, array $issues): int
+    {
+        $fixes = [];
+        foreach ($issues as $issue) {
+            if ($issue['fix'] !== null && $issue['fix'] !== '') {
+                $fixes[$issue['field']] = $issue['fix'];
+            }
+        }
+
+        if (empty($fixes)) {
+            $this->log('INFO', "{$repo}: no auto-fixable issues");
+            return 0;
+        }
+
+        $merged = array_merge($current, $fixes);
+        $url = "{$apiBase}/repos/{$org}/{$repo}/manifest";
+        $payload = json_encode($merged);
+
+        $ctx = stream_context_create([
+            'http' => [
+                'method'  => 'PUT',
+                'header'  => "Authorization: token {$token}\r\nContent-Type: application/json\r\nAccept: application/json\r\n",
+                'content' => $payload,
+                'timeout' => 10,
+            ],
+        ]);
+
+        $body = @file_get_contents($url, false, $ctx);
+        if ($body === false) {
+            $this->log('ERROR', "{$repo}: failed to push fixes");
+            return 1;
+        }
+
+        $this->log('OK', "{$repo}: fixed " . implode(', ', array_keys($fixes)));
+        return 0;
+    }
+
+    // =====================================================================
+    // API helpers
+    // =====================================================================
+
+    private function fetchManifest(string $apiBase, string $org, string $repo, string $token): ?array
+    {
+        $url = "{$apiBase}/repos/{$org}/{$repo}/manifest";
+        $ctx = stream_context_create([
+            'http' => [
+                'header'  => "Authorization: token {$token}\r\nAccept: application/json\r\n",
+                'timeout' => 10,
+            ],
+        ]);
+
+        $body = @file_get_contents($url, false, $ctx);
+        if ($body === false) return null;
+
+        $data = json_decode($body, true);
+        return is_array($data) ? $data : null;
+    }
+
+    private function fetchOrgRepos(string $apiBase, string $org, string $token): ?array
+    {
+        $allRepos = [];
+        $page = 1;
+        $limit = 50;
+
+        while (true) {
+            $url = "{$apiBase}/orgs/{$org}/repos?page={$page}&limit={$limit}";
+            $ctx = stream_context_create([
+                'http' => [
+                    'header'  => "Authorization: token {$token}\r\nAccept: application/json\r\n",
+                    'timeout' => 15,
+                ],
+            ]);
+
+            $body = @file_get_contents($url, false, $ctx);
+            if ($body === false) return null;
+
+            $repos = json_decode($body, true);
+            if (!is_array($repos) || empty($repos)) break;
+
+            $allRepos = array_merge($allRepos, $repos);
+
+            if (count($repos) < $limit) break;
+            $page++;
+        }
+
+        // Filter out archived and empty repos
+        return array_filter($allRepos, fn($r) => !($r['archived'] ?? false) && !($r['empty'] ?? false));
+    }
+
+    // =====================================================================
+    // Detection (delegates to manifest_detect logic)
+    // =====================================================================
+
+    private function runDetect(string $root, string $repoName): array
+    {
+        $script = __DIR__ . '/manifest_detect.php';
+        $redirect = PHP_OS_FAMILY === 'Windows' ? '2>NUL' : '2>/dev/null';
+        $cmd = sprintf(
+            'php %s --path %s --repo %s --json --quiet %s',
+            escapeshellarg($script),
+            escapeshellarg($root),
+            escapeshellarg($repoName),
+            $redirect
+        );
+
+        $output = shell_exec($cmd) ?? '';
+
+        // Extract JSON object from output (skip banner/log lines)
+        if (preg_match('/\{[^{}]*(?:\{[^{}]*\}[^{}]*)*\}/s', $output, $m)) {
+            $data = json_decode($m[0], true);
+            if (is_array($data)) {
+                return $data;
+            }
+        }
+
+        return [];
+    }
+
+    private function detectRepoName(string $root): string
+    {
+        $gitConfig = "{$root}/.git/config";
+        if (!file_exists($gitConfig)) {
+            return basename($root);
+        }
+
+        $content = file_get_contents($gitConfig);
+        if (preg_match('/url\s*=\s*.*\/([^\/\s]+?)(?:\.git)?\s*$/m', $content, $m)) {
+            return $m[1];
+        }
+
+        return basename($root);
+    }
+}
+
+$app = new ManifestIntegrityCli();
+exit($app->execute());

cli/manifest_licensing.php

@@ -10,7 +10,7 @@
  * INGROUP: mokoplatform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokoplatform
  * PATH: /cli/manifest_licensing.php
- * VERSION: 09.26.00
+ * VERSION: 09.33.00
  * BRIEF: Ensure licensing tags (updateservers, dlid) in Joomla extension manifests
  */
 
@@ -18,7 +18,7 @@ declare(strict_types=1);
 
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\{CliFramework, SourceResolver};
+use MokoCli\{CliFramework, SourceResolver};
 
 /**
  * Reads the <licensing> block from .mokogitea/manifest.xml and ensures that the

cli/manifest_read.php

@@ -6,126 +6,431 @@
  * SPDX-License-Identifier: GPL-3.0-or-later
  *
  * FILE INFORMATION
- * DEFGROUP: mokoplatform.CLI
+ * DEFGROUP: mokocli.CLI
- * INGROUP: mokoplatform
+ * INGROUP: mokocli
- * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokoplatform
+ * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
  * PATH: /cli/manifest_read.php
- * VERSION: 09.26.00
+ * VERSION: 09.33.00
- * BRIEF: Parse .manifest.xml and output requested field(s) for CI consumption
+ * BRIEF: Read repo metadata from Gitea manifest API, auto-detect the rest
  */
 
 declare(strict_types=1);
 
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\CliFramework;
+use MokoCli\CliFramework;
 
 class ManifestReadCli extends CliFramework
 {
+    /** Joomla extension XML element names searched in root and source/ dirs. */
+    private const JOOMLA_XML_ROOTS = ['extension', 'install'];
+
     protected function configure(): void
     {
-        $this->setDescription('Parse manifest.xml and output requested field(s) for CI consumption');
+        $this->setDescription('Read repo metadata from Gitea API with auto-detection fallback');
-        $this->addArgument('--path', 'Repository root path', '.');
+        $this->addArgument('--path',          'Repository root path',                     '.');
-        $this->addArgument('--field', 'Single field name to output', '');
+        $this->addArgument('--field',         'Single field name to output',              '');
-        $this->addArgument('--all', 'Print all fields as KEY=VALUE lines', false);
+        $this->addArgument('--all',           'Print all fields as KEY=VALUE lines',      false);
-        $this->addArgument('--github-output', 'Append all fields to $GITHUB_OUTPUT', false);
+        $this->addArgument('--github-output', 'Append all fields to $GITHUB_OUTPUT',      false);
-        $this->addArgument('--json', 'Output all fields as JSON', false);
+        $this->addArgument('--json',          'Output all fields as JSON',                false);
     }
 
     protected function run(): int
     {
-        $path = $this->getArgument('--path');
+        $path    = $this->getArgument('--path');
-        $field = $this->getArgument('--field');
+        $field   = $this->getArgument('--field');
         $showAll = $this->getArgument('--all');
-        $ghOutput = $this->getArgument('--github-output');
+        $ghOut   = $this->getArgument('--github-output');
         $jsonMode = $this->getArgument('--json');
 
-        // Determine mode
+        $mode = match (true) {
-        if ($ghOutput) {
+            (bool) $ghOut   => 'github-output',
-            $mode = 'github-output';
+            (bool) $showAll => 'all',
-        } elseif ($showAll) {
+            (bool) $jsonMode => 'json',
-            $mode = 'all';
+            default         => 'field',
-        } elseif ($jsonMode) {
+        };
-            $mode = 'json';
+
-        } else {
+        $root = realpath($path) ?: $path;
-            $mode = 'field';
+
+        // ── 1. Resolve org/repo ──────────────────────────────────────────
+        [$org, $repo] = $this->resolveOrgRepo($root);
+
+        // ── 2. Primary: Gitea manifest API ───────────────────────────────
+        $fields = null;
+        if ($org !== '' && $repo !== '') {
+            $fields = $this->fetchFromApi($org, $repo);
         }
 
-        // -- Locate manifest --
+        // ── 3. Fallback: auto-detect from source tree ────────────────────
-        $root = realpath($path) ?: $path;
+        if ($fields === null) {
-        $manifestFile = null;
+            $this->log('INFO', 'API unavailable — falling back to source-tree detection');
+            $fields = $this->autoDetect($root, $repo);
+        }
 
-        // Priority: manifest.xml (current standard)
+        if (empty($fields)) {
-        $candidates = [
+            $this->log('ERROR', "Could not resolve metadata for {$root}");
-            "{$root}/.mokogitea/manifest.xml",
+            return 1;
-            "{$root}/.mokogitea/.manifest.xml",    // legacy (dot-prefixed)
+        }
-            "{$root}/.mokogitea/.mokoplatform",  // legacy v4
+
+        // Provide backward-compatible aliases (hyphenated → underscore)
+        $fields = $this->addAliases($fields);
+
+        // Strip empty values
+        $fields = array_filter($fields, fn($v) => $v !== '' && $v !== null);
+
+        // ── 4. Output ────────────────────────────────────────────────────
+        return $this->outputFields($fields, $mode, $field);
+    }
+
+    // ── Gitea manifest API ───────────────────────────────────────────────
+
+    private function fetchFromApi(string $org, string $repo): ?array
+    {
+        $token   = getenv('GA_TOKEN') ?: getenv('GITEA_TOKEN') ?: '';
+        $baseUrl = getenv('GITEA_URL') ?: 'https://git.mokoconsulting.tech';
+        $baseUrl = rtrim($baseUrl, '/');
+
+        if ($token === '') {
+            return null;
+        }
+
+        $url = "{$baseUrl}/api/v1/repos/{$org}/{$repo}/manifest";
+        $ctx = stream_context_create([
+            'http' => [
+                'header'  => "Authorization: token {$token}\r\nAccept: application/json\r\n",
+                'timeout' => 10,
+                'ignore_errors' => true,
+            ],
+        ]);
+
+        $body = @file_get_contents($url, false, $ctx);
+        if ($body === false) {
+            return null;
+        }
+
+        // Check HTTP status from response headers
+        $status = 0;
+        if (isset($http_response_header[0])) {
+            preg_match('/\d{3}/', $http_response_header[0], $m);
+            $status = (int) ($m[0] ?? 0);
+        }
+        if ($status < 200 || $status >= 300) {
+            return null;
+        }
+
+        $data = json_decode($body, true);
+        if (!is_array($data) || empty($data)) {
+            return null;
+        }
+
+        $this->log('INFO', "Loaded metadata from Gitea manifest API ({$org}/{$repo})");
+        return $data;
+    }
+
+    // ── Auto-detection fallback ──────────────────────────────────────────
+
+    private function autoDetect(string $root, string $repoName): array
+    {
+        $fields = [
+            'name' => $repoName ?: basename($root),
+            'org'  => 'MokoConsulting',
         ];
 
-        foreach ($candidates as $candidate) {
+        // Resolve source directory (source/ or src/)
-            if (file_exists($candidate)) {
+        $srcDir = null;
-                $manifestFile = $candidate;
+        foreach (['source', 'src'] as $candidate) {
+            if (is_dir("{$root}/{$candidate}")) {
+                $srcDir = $candidate;
                 break;
             }
         }
 
-        if ($manifestFile === null) {
+        // ── Try Joomla detection ─────────────────────────────────────
-            $this->log('ERROR', "No manifest found in {$root}");
+        $joomlaResult = $this->detectJoomla($root, $srcDir);
-            return 1;
+        if ($joomlaResult !== null) {
+            $fields = array_merge($fields, $joomlaResult);
+            $this->log('INFO', "Auto-detected platform: joomla ({$fields['extension_type']} — {$fields['element_name']})");
+            return $fields;
         }
 
-        // -- Parse XML --
+        // ── Try Dolibarr detection ───────────────────────────────────
-        $xml = @simplexml_load_file($manifestFile);
+        $dolibarrResult = $this->detectDolibarr($root);
+        if ($dolibarrResult !== null) {
+            $fields = array_merge($fields, $dolibarrResult);
+            $this->log('INFO', "Auto-detected platform: dolibarr");
+            return $fields;
+        }
 
-        if ($xml === false) {
+        // ── Generic fallback ─────────────────────────────────────────
-            // Fallback: try YAML format (.mokostandards legacy)
+        $fields['platform'] = $this->detectGenericPlatform($root);
-            $content = file_get_contents($manifestFile);
+        $fields['element_name'] = strtolower($fields['name']);
-            $fields = [];
+        $fields['extension_type'] = 'application';
-            if (preg_match('/^platform:\s*(.+)/m', $content, $m)) {
+        $fields['language'] = $this->detectLanguage($root);
-                $fields['platform'] = trim($m[1], " \t\n\r\"'");
+        if ($srcDir !== null) {
+            $fields['entry_point'] = "{$srcDir}/";
+        }
+
+        $this->log('INFO', "Auto-detected platform: {$fields['platform']}");
+        return $fields;
+    }
+
+    /**
+     * Detect Joomla platform by scanning for extension XML manifests.
+     *
+     * Searches root and source/ dirs for XML files containing <extension type="...">.
+     * Extracts element name from the filename (pkg_*, com_*, mod_*, plg_*, tpl_*) or
+     * from the <element> tag inside the manifest.
+     */
+    private function detectJoomla(string $root, ?string $srcDir): ?array
+    {
+        $searchDirs = [$root];
+        if ($srcDir !== null) {
+            $searchDirs[] = "{$root}/{$srcDir}";
+        }
+
+        foreach ($searchDirs as $dir) {
+            $xmlFiles = glob("{$dir}/*.xml") ?: [];
+            foreach ($xmlFiles as $xmlFile) {
+                $content = @file_get_contents($xmlFile);
+                if ($content === false) {
+                    continue;
+                }
+
+                // Match <extension type="component|module|plugin|package|template|file|library">
+                if (!preg_match('/<extension\s+[^>]*type="([^"]+)"/', $content, $typeMatch)) {
+                    // Also try legacy <install type="...">
+                    if (!preg_match('/<install\s+[^>]*type="([^"]+)"/', $content, $typeMatch)) {
+                        continue;
+                    }
+                }
+
+                $extType = strtolower($typeMatch[1]);
+                $basename = pathinfo($xmlFile, PATHINFO_FILENAME);
+
+                // Try to extract element name from XML <element> tag
+                $xml = @simplexml_load_string($content);
+                $element = '';
+                if ($xml !== false) {
+                    // Package manifests have <files><file ...>element</file></files>
+                    // Component/module manifests have <element> or use filename
+                    $element = (string) ($xml->element ?? '');
+                    if ($element === '') {
+                        $element = strtolower($basename);
+                    }
+                } else {
+                    $element = strtolower($basename);
+                }
+
+                // Derive display name
+                $displayName = (string) ($xml->name ?? ucfirst(str_replace('_', ' ', $basename)));
+
+                return [
+                    'platform'       => 'joomla',
+                    'extension_type' => $extType,
+                    'element_name'   => $element,
+                    'display_name'   => $displayName,
+                    'language'       => 'PHP',
+                    'entry_point'    => ($srcDir ?? '.') . '/',
+                ];
             }
-            if (preg_match('/^standards_version:\s*(.+)/m', $content, $m)) {
+
-                $fields['standards-version'] = trim($m[1], " \t\n\r\"'");
+            // Also check for pkg_*.xml pattern specifically
+            $pkgFiles = glob("{$dir}/pkg_*.xml") ?: [];
+            if (!empty($pkgFiles)) {
+                $basename = pathinfo($pkgFiles[0], PATHINFO_FILENAME);
+                return [
+                    'platform'       => 'joomla',
+                    'extension_type' => 'package',
+                    'element_name'   => strtolower($basename),
+                    'display_name'   => ucfirst(str_replace('_', ' ', $basename)),
+                    'language'       => 'PHP',
+                    'entry_point'    => ($srcDir ?? '.') . '/',
+                ];
             }
-            if (preg_match('/^governed_repo:\s*(.+)/m', $content, $m)) {
+        }
-                $fields['name'] = trim($m[1], " \t\n\r\"'");
+
+        // Check for com_*/manifest.xml pattern (component subdirectory)
+        $comDirs = glob("{$root}/com_*", GLOB_ONLYDIR) ?: [];
+        foreach ($comDirs as $comDir) {
+            $comManifest = glob("{$comDir}/*.xml") ?: [];
+            foreach ($comManifest as $xmlFile) {
+                $content = @file_get_contents($xmlFile);
+                if ($content && preg_match('/<extension\s+[^>]*type="component"/', $content)) {
+                    return [
+                        'platform'       => 'joomla',
+                        'extension_type' => 'component',
+                        'element_name'   => strtolower(basename($comDir)),
+                        'display_name'   => ucfirst(str_replace('com_', '', basename($comDir))),
+                        'language'       => 'PHP',
+                        'entry_point'    => ($srcDir ?? '.') . '/',
+                    ];
+                }
             }
-        } else {
+        }
-            // Register namespace for XPath (optional, simple path works without)
+
-            $fields = [
+        return null;
-                'name'              => (string)($xml->identity->name ?? ''),
+    }
-                'display-name'      => (string)($xml->identity->{"display-name"} ?? ''),
+
-                'org'               => (string)($xml->identity->org ?? ''),
+    /**
-                'description'       => (string)($xml->identity->description ?? ''),
+     * Detect Dolibarr platform by scanning for module descriptor files.
-                'license'           => (string)($xml->identity->license ?? ''),
+     */
-                'license-spdx'      => (string)($xml->identity->license['spdx'] ?? ''),
+    private function detectDolibarr(string $root): ?array
-                'platform'          => (string)($xml->governance->platform ?? ''),
+    {
-                'standards-version' => (string)($xml->governance->{"standards-version"} ?? ''),
+        // Look for mod*.class.php containing DolibarrModules
-                'standards-source'  => (string)($xml->governance->{"standards-source"} ?? ''),
+        $searchPaths = [
-                'language'          => (string)($xml->build->language ?? ''),
+            "{$root}/core/modules/mod*.class.php",
-                'package-type'      => (string)($xml->build->{"package-type"} ?? ''),
+            "{$root}/*/core/modules/mod*.class.php",
-                'entry-point'       => (string)($xml->build->{"entry-point"} ?? ''),
+        ];
-                'version'           => (string)($xml->identity->version ?? ''),
+
-                'source-dir'        => (string)($xml->deploy->{"source-dir"} ?? ''),
+        foreach ($searchPaths as $pattern) {
-                'remote-subdir'     => (string)($xml->deploy->{"remote-subdir"} ?? ''),
+            $files = glob($pattern) ?: [];
-                'excludes'          => (string)($xml->deploy->excludes ?? ''),
+            foreach ($files as $file) {
-                'dev-host'          => (string)($xml->deploy->{"dev-host"} ?? ''),
+                $content = @file_get_contents($file);
-                'demo-host'         => (string)($xml->deploy->{"demo-host"} ?? ''),
+                if ($content && str_contains($content, 'DolibarrModules')) {
-                'manifest-file'     => $manifestFile,
+                    $modName = pathinfo($file, PATHINFO_FILENAME);
+                    // modMyModule.class → mymodule
+                    $element = strtolower(preg_replace('/^mod/', '', str_replace('.class', '', $modName)));
+
+                    return [
+                        'platform'       => 'dolibarr',
+                        'extension_type' => 'module',
+                        'element_name'   => $element,
+                        'display_name'   => ucfirst($element),
+                        'language'       => 'PHP',
+                        'entry_point'    => './',
+                    ];
+                }
+            }
+        }
+
+        // Secondary: check for update.txt (Dolibarr marker)
+        if (file_exists("{$root}/update.txt")) {
+            return [
+                'platform'       => 'dolibarr',
+                'extension_type' => 'module',
+                'element_name'   => strtolower(basename($root)),
+                'display_name'   => basename($root),
+                'language'       => 'PHP',
+                'entry_point'    => './',
             ];
         }
 
-        // Strip empty values for cleaner output
+        return null;
-        $fields = array_filter($fields, fn($v) => $v !== '');
+    }
 
-        // -- Output --
+    /**
+     * Detect generic platform type (php, nodejs, python, etc.) from project files.
+     */
+    private function detectGenericPlatform(string $root): string
+    {
+        if (file_exists("{$root}/composer.json")) {
+            return 'php';
+        }
+        if (file_exists("{$root}/package.json")) {
+            return 'nodejs';
+        }
+        if (file_exists("{$root}/pyproject.toml") || file_exists("{$root}/setup.py")) {
+            return 'python';
+        }
+        if (file_exists("{$root}/go.mod")) {
+            return 'go';
+        }
+        if (file_exists("{$root}/Cargo.toml")) {
+            return 'rust';
+        }
+        return 'generic';
+    }
+
+    /**
+     * Detect primary language from project files.
+     */
+    private function detectLanguage(string $root): string
+    {
+        if (file_exists("{$root}/composer.json")) {
+            return 'PHP';
+        }
+        if (file_exists("{$root}/tsconfig.json")) {
+            return 'TypeScript';
+        }
+        if (file_exists("{$root}/package.json")) {
+            return 'JavaScript';
+        }
+        if (file_exists("{$root}/pyproject.toml") || file_exists("{$root}/setup.py")) {
+            return 'Python';
+        }
+        return '';
+    }
+
+    // ── Org/repo resolution ──────────────────────────────────────────────
+
+    /**
+     * Resolve org and repo name from environment or git remote.
+     *
+     * @return array{0: string, 1: string}  [org, repo]
+     */
+    private function resolveOrgRepo(string $root): array
+    {
+        // 1. GITHUB_REPOSITORY env (set in Gitea Actions / GitHub Actions)
+        $envRepo = getenv('GITHUB_REPOSITORY') ?: '';
+        if ($envRepo !== '' && str_contains($envRepo, '/')) {
+            return explode('/', $envRepo, 2);
+        }
+
+        // 2. Parse git remote origin URL
+        $remoteUrl = trim((string) shell_exec(
+            'git -C ' . escapeshellarg($root) . ' remote get-url origin 2>/dev/null'
+        ));
+
+        if ($remoteUrl !== '') {
+            // SSH: git@host:Org/Repo.git  or  HTTPS: https://host/Org/Repo.git
+            if (preg_match('#[/:]([^/]+)/([^/]+?)(?:\.git)?$#', $remoteUrl, $m)) {
+                return [$m[1], $m[2]];
+            }
+        }
+
+        return ['', basename($root)];
+    }
+
+    // ── Backward-compatible aliases ──────────────────────────────────────
+
+    /**
+     * Add hyphenated aliases for underscore fields (backward compat with old manifest.xml consumers).
+     * Also map old field names to new ones.
+     */
+    private function addAliases(array $fields): array
+    {
+        // Map API field names → old manifest.xml hyphenated names
+        $aliases = [
+            'display_name'       => 'display-name',
+            'license_spdx'       => 'license-spdx',
+            'license_name'       => 'license',
+            'standards_version'  => 'standards-version',
+            'standards_source'   => 'standards-source',
+            'extension_type'     => 'package-type',
+            'entry_point'        => 'entry-point',
+            'element_name'       => 'name',
+        ];
+
+        foreach ($aliases as $newKey => $oldKey) {
+            if (isset($fields[$newKey]) && !isset($fields[$oldKey])) {
+                $fields[$oldKey] = $fields[$newKey];
+            }
+        }
+
+        return $fields;
+    }
+
+    // ── Output ───────────────────────────────────────────────────────────
+
+    private function outputFields(array $fields, string $mode, string $field): int
+    {
         switch ($mode) {
             case 'field':
                 if ($field === '') {
-                    $this->log('ERROR', "Usage: manifest_read.php --path <dir> --field <name>");
+                    $this->log('ERROR', "Usage: manifest:read --path <dir> --field <name>");
-                    $this->log('ERROR', "       manifest_read.php --path <dir> --all");
+                    $this->log('ERROR', "       manifest:read --path <dir> --all");
-                    $this->log('ERROR', "       manifest_read.php --path <dir> --json");
+                    $this->log('ERROR', "       manifest:read --path <dir> --json");
-                    $this->log('ERROR', "       manifest_read.php --path <dir> --github-output");
+                    $this->log('ERROR', "       manifest:read --path <dir> --github-output");
                     return 2;
                 }
                 echo ($fields[$field] ?? '') . "\n";
@@ -142,22 +447,21 @@ class ManifestReadCli extends CliFramework
                 break;
 
             case 'github-output':
-                $outputFile = getenv('GITHUB_OUTPUT');
+                $outputFile = getenv('GITHUB_OUTPUT') ?: getenv('GITEA_OUTPUT') ?: '';
-                if ($outputFile === false || $outputFile === '') {
+                $lines = [];
-                    $this->log('ERROR', 'GITHUB_OUTPUT not set — printing to stdout instead');
+                foreach ($fields as $k => $v) {
-                    foreach ($fields as $k => $v) {
+                    $envKey = str_replace('-', '_', $k);
-                        // Convert field-name to FIELD_NAME for env var style
+                    $lines[$envKey] = "{$envKey}={$v}\n";
-                        $envKey = str_replace('-', '_', $k);
+                }
-                        echo "{$envKey}={$v}\n";
+                // Deduplicate (aliases may collide after underscore conversion)
-                    }
+                $output = implode('', $lines);
+
+                if ($outputFile === '') {
+                    $this->log('WARNING', 'GITHUB_OUTPUT not set — printing to stdout');
+                    echo $output;
                 } else {
-                    $fh = fopen($outputFile, 'a');
+                    file_put_contents($outputFile, $output, FILE_APPEND);
-                    foreach ($fields as $k => $v) {
+                    $this->log('INFO', "Wrote " . count($lines) . " fields to GITHUB_OUTPUT");
-                        $envKey = str_replace('-', '_', $k);
-                        fwrite($fh, "{$envKey}={$v}\n");
-                    }
-                    fclose($fh);
-                    $this->log('INFO', "Wrote " . count($fields) . " fields to GITHUB_OUTPUT");
                 }
                 break;
         }

cli/package_build.php

@@ -19,7 +19,7 @@ declare(strict_types=1);
 
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\{CliFramework, SourceResolver};
+use MokoCli\{CliFramework, SourceResolver};
 
 class PackageBuildCli extends CliFramework
 {

cli/platform_detect.php

@@ -10,7 +10,7 @@
  * INGROUP: mokoplatform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokoplatform
  * PATH: /cli/platform_detect.php
- * VERSION: 09.26.00
+ * VERSION: 09.33.00
  * BRIEF: Auto-detect repository platform type and optionally update manifest
  */
 
@@ -18,7 +18,7 @@ declare(strict_types=1);
 
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\CliFramework;
+use MokoCli\CliFramework;
 
 class PlatformDetectCli extends CliFramework
 {
@@ -82,7 +82,7 @@ class PlatformDetectCli extends CliFramework
                 $giteaUrl,
                 $token,
                 'PATCH',
-                "/api/v1/repos/{$owner}/{$repo}/manifest",
+                "/api/v1/repos/{$owner}/{$repo}/metadata",
                 json_encode(['platform' => $platform])
             );
 

cli/release.php

@@ -17,7 +17,7 @@ declare(strict_types=1);
 
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\CliFramework;
+use MokoCli\CliFramework;
 
 class ReleaseCli extends CliFramework
 {

cli/release_body_update.php

@@ -17,7 +17,7 @@ declare(strict_types=1);
 
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\CliFramework;
+use MokoCli\CliFramework;
 
 class ReleaseBodyUpdateCli extends CliFramework
 {

cli/release_cascade.php

@@ -6,31 +6,336 @@
  * SPDX-License-Identifier: GPL-3.0-or-later
  *
  * FILE INFORMATION
- * DEFGROUP: mokoplatform.CLI
+ * DEFGROUP: mokocli.CLI
- * INGROUP: mokoplatform
+ * INGROUP: mokocli
- * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokoplatform
+ * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
  * PATH: /cli/release_cascade.php
- * VERSION: 09.26.00
+ * VERSION: 09.33.00
- * BRIEF: DEPRECATED — cascade behavior removed. Each release stream is independent.
+ * BRIEF: Cascade release zip to all lower stability channels
  */
 
 declare(strict_types=1);
 
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\CliFramework;
+use MokoCli\CliFramework;
 
 class ReleaseCascadeCli extends CliFramework
 {
+    /** Channel hierarchy: highest stability first. */
+    private const CHANNELS = ['stable', 'release-candidate', 'beta', 'alpha', 'development'];
+
+    /** Map stability input names to canonical tag names. */
+    private const TAG_MAP = [
+        'stable'            => 'stable',
+        'release-candidate' => 'release-candidate',
+        'rc'                => 'release-candidate',
+        'beta'              => 'beta',
+        'alpha'             => 'alpha',
+        'development'       => 'development',
+        'dev'               => 'development',
+    ];
+
     protected function configure(): void
     {
-        $this->setDescription('DEPRECATED — cascade behavior removed');
+        $this->setDescription('Cascade release zip to all lower stability channels');
+        $this->addArgument('--stability', 'Source stability channel (required)', '');
+        $this->addArgument('--token', 'Gitea API token (required)', '');
+        $this->addArgument('--api-base', 'Gitea API base URL for the repo (required)', '');
     }
 
     protected function run(): int
     {
-        $this->log('INFO', 'No-op (cascade behavior removed — each stream is independent)');
+        $stability = strtolower($this->getArgument('--stability'));
-        return 0;
+        $token     = $this->getArgument('--token');
+        $apiBase   = rtrim($this->getArgument('--api-base'), '/');
+
+        if ($token === '') {
+            $envToken = getenv('MOKOGITEA_TOKEN');
+            if ($envToken === false || $envToken === '') {
+                $envToken = getenv('GITEA_TOKEN');
+            }
+            if ($envToken !== false && $envToken !== '') {
+                $token = $envToken;
+            }
+        }
+
+        if ($stability === '' || $token === '' || $apiBase === '') {
+            $this->log('ERROR', 'Usage: release_cascade.php --stability CHANNEL --token TOKEN --api-base URL');
+            return 1;
+        }
+
+        $sourceTag = self::TAG_MAP[$stability] ?? null;
+        if ($sourceTag === null) {
+            $this->log('ERROR', "Unknown stability: {$stability}");
+            return 1;
+        }
+
+        // Find lower channels to cascade to
+        $lowerChannels = $this->getLowerChannels($sourceTag);
+        if (count($lowerChannels) === 0) {
+            $this->log('INFO', "No lower channels for '{$stability}' — nothing to cascade.");
+            return 0;
+        }
+
+        $this->log('INFO', "Cascading from '{$sourceTag}' to: " . implode(', ', $lowerChannels));
+
+        if ($this->dryRun) {
+            $this->log('INFO', '[DRY RUN] No changes will be made.');
+        }
+
+        // 1. Get source release
+        $sourceRelease = $this->giteaApi("{$apiBase}/releases/tags/{$sourceTag}", $token);
+        if ($sourceRelease === null) {
+            $this->log('WARN', "No release found at tag '{$sourceTag}' — nothing to cascade.");
+            return 0;
+        }
+
+        $sourceVersion = $sourceRelease['name'] ?? $sourceTag;
+        $sourceBody    = $sourceRelease['body'] ?? '';
+        $sourceAssets  = $sourceRelease['assets'] ?? [];
+
+        // Find zip assets (exclude .sha256 sidecars)
+        $zipAssets = array_filter($sourceAssets, function (array $asset): bool {
+            $name = strtolower($asset['name'] ?? '');
+            return str_ends_with($name, '.zip') && !str_ends_with($name, '.sha256');
+        });
+
+        // Also grab sha256 sidecars
+        $sha256Assets = array_filter($sourceAssets, function (array $asset): bool {
+            return str_ends_with(strtolower($asset['name'] ?? ''), '.zip.sha256');
+        });
+
+        if (count($zipAssets) === 0) {
+            $this->log('WARN', "Source release '{$sourceTag}' has no zip assets — nothing to cascade.");
+            return 0;
+        }
+
+        $this->log('INFO', "Source: {$sourceVersion} — " . count($zipAssets) . " zip(s)");
+        echo "\n";
+
+        // 2. Download source assets to temp files
+        $downloads = [];
+        foreach (array_merge($zipAssets, $sha256Assets) as $asset) {
+            $url = $asset['browser_download_url'] ?? '';
+            if ($url === '') {
+                continue;
+            }
+            $tmpFile = tempnam(sys_get_temp_dir(), 'cascade_');
+            if ($this->downloadFile($url, $token, $tmpFile)) {
+                $downloads[] = ['name' => $asset['name'], 'path' => $tmpFile];
+                $this->log('INFO', "Downloaded: {$asset['name']}");
+            } else {
+                $this->log('ERROR', "Failed to download: {$asset['name']}");
+            }
+        }
+
+        if (count($downloads) === 0) {
+            $this->log('ERROR', 'Could not download any source assets.');
+            return 1;
+        }
+
+        // 3. Cascade to each lower channel
+        $errors = 0;
+        foreach ($lowerChannels as $targetTag) {
+            echo "\n";
+            $result = $this->cascadeToChannel(
+                $apiBase, $token, $targetTag,
+                $sourceVersion, $sourceBody, $downloads
+            );
+            if (!$result) {
+                $errors++;
+            }
+        }
+
+        // 4. Cleanup temp files
+        foreach ($downloads as $dl) {
+            @unlink($dl['path']);
+        }
+
+        echo "\n";
+        $this->log('INFO', "Cascade complete. " . (count($lowerChannels) - $errors)
+            . "/" . count($lowerChannels) . " channels updated.");
+
+        return $errors > 0 ? 1 : 0;
+    }
+
+    /**
+     * Cascade assets to a single target channel.
+     */
+    private function cascadeToChannel(
+        string $apiBase,
+        string $token,
+        string $targetTag,
+        string $sourceVersion,
+        string $sourceBody,
+        array $downloads
+    ): bool {
+        $this->log('INFO', "→ {$targetTag}");
+
+        if ($this->dryRun) {
+            $this->log('INFO', "  [DRY RUN] Would cascade to {$targetTag}");
+            return true;
+        }
+
+        // Find existing release at target tag
+        $existing = $this->giteaApi("{$apiBase}/releases/tags/{$targetTag}", $token);
+
+        if ($existing !== null && !empty($existing['id'])) {
+            $releaseId = (int) $existing['id'];
+
+            // Delete existing assets
+            $existingAssets = $existing['assets'] ?? [];
+            foreach ($existingAssets as $asset) {
+                $assetId = $asset['id'] ?? 0;
+                if ($assetId > 0) {
+                    $this->giteaApi(
+                        "{$apiBase}/releases/{$releaseId}/assets/{$assetId}",
+                        $token, 'DELETE'
+                    );
+                }
+            }
+
+            // Update release metadata
+            $updatePayload = json_encode([
+                'name' => $sourceVersion,
+                'body' => $sourceBody,
+            ]);
+            $this->giteaApi(
+                "{$apiBase}/releases/{$releaseId}",
+                $token, 'PATCH', $updatePayload
+            );
+
+            $this->log('INFO', "  Updated release metadata (id: {$releaseId})");
+        } else {
+            // Create new release at target tag
+            // Use the source release's target commitish so the tag points to the same commit
+            $createPayload = json_encode([
+                'tag_name'          => $targetTag,
+                'target_commitish'  => 'main',
+                'name'              => $sourceVersion,
+                'body'              => $sourceBody,
+                'prerelease'        => ($targetTag !== 'stable'),
+            ]);
+            $newRelease = $this->giteaApi("{$apiBase}/releases", $token, 'POST', $createPayload);
+            if ($newRelease === null || empty($newRelease['id'])) {
+                $this->log('ERROR', "  Failed to create release at tag '{$targetTag}'");
+                return false;
+            }
+            $releaseId = (int) $newRelease['id'];
+            $this->log('INFO', "  Created release (id: {$releaseId})");
+        }
+
+        // Upload assets
+        foreach ($downloads as $dl) {
+            $uploadUrl = "{$apiBase}/releases/{$releaseId}/assets?name=" . rawurlencode($dl['name']);
+            $success = $this->uploadAsset($uploadUrl, $token, $dl['path'], $dl['name']);
+            if ($success) {
+                $this->log('INFO', "  Uploaded: {$dl['name']}");
+            } else {
+                $this->log('ERROR', "  Failed to upload: {$dl['name']}");
+            }
+        }
+
+        return true;
+    }
+
+    /**
+     * Get all channels below the given source channel.
+     */
+    private function getLowerChannels(string $sourceTag): array
+    {
+        $idx = array_search($sourceTag, self::CHANNELS, true);
+        if ($idx === false) {
+            return [];
+        }
+        return array_slice(self::CHANNELS, $idx + 1);
+    }
+
+    /**
+     * Download a file via HTTP.
+     */
+    private function downloadFile(string $url, string $token, string $destPath): bool
+    {
+        $ch = curl_init($url);
+        if ($ch === false) {
+            return false;
+        }
+        $fp = fopen($destPath, 'wb');
+        if ($fp === false) {
+            return false;
+        }
+        curl_setopt_array($ch, [
+            CURLOPT_FOLLOWLOCATION => true,
+            CURLOPT_FILE           => $fp,
+            CURLOPT_HTTPHEADER     => ["Authorization: token {$token}"],
+            CURLOPT_TIMEOUT        => 120,
+        ]);
+        curl_exec($ch);
+        $code = (int) curl_getinfo($ch, CURLINFO_HTTP_CODE);
+        curl_close($ch);
+        fclose($fp);
+        return $code >= 200 && $code < 300;
+    }
+
+    /**
+     * Upload a file as a release asset via multipart form.
+     */
+    private function uploadAsset(string $url, string $token, string $filePath, string $fileName): bool
+    {
+        $ch = curl_init($url);
+        if ($ch === false) {
+            return false;
+        }
+        $cfile = new CURLFile($filePath, 'application/octet-stream', $fileName);
+        curl_setopt_array($ch, [
+            CURLOPT_RETURNTRANSFER => true,
+            CURLOPT_POST           => true,
+            CURLOPT_POSTFIELDS     => ['attachment' => $cfile],
+            CURLOPT_HTTPHEADER     => ["Authorization: token {$token}"],
+            CURLOPT_TIMEOUT        => 120,
+        ]);
+        $response = curl_exec($ch);
+        $code = (int) curl_getinfo($ch, CURLINFO_HTTP_CODE);
+        curl_close($ch);
+        return $code >= 200 && $code < 300;
+    }
+
+    /**
+     * Make an HTTP request to the Gitea API.
+     */
+    private function giteaApi(
+        string $url,
+        string $token,
+        string $method = 'GET',
+        ?string $body = null
+    ): ?array {
+        $ch = curl_init($url);
+        if ($ch === false) {
+            return null;
+        }
+        curl_setopt_array($ch, [
+            CURLOPT_RETURNTRANSFER => true,
+            CURLOPT_HTTPHEADER     => [
+                "Authorization: token {$token}",
+                'Content-Type: application/json',
+            ],
+            CURLOPT_TIMEOUT        => 30,
+            CURLOPT_CUSTOMREQUEST  => $method,
+        ]);
+        if ($body !== null) {
+            curl_setopt($ch, CURLOPT_POSTFIELDS, $body);
+        }
+        $response = curl_exec($ch);
+        $httpCode = (int) curl_getinfo($ch, CURLINFO_HTTP_CODE);
+        curl_close($ch);
+
+        if ($httpCode < 200 || $httpCode >= 300 || empty($response) || !is_string($response)) {
+            return null;
+        }
+
+        $decoded = json_decode($response, true);
+        return is_array($decoded) ? $decoded : null;
     }
 }
 

cli/release_create.php

@@ -17,7 +17,7 @@ declare(strict_types=1);
 
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\{CliFramework, SourceResolver};
+use MokoCli\{CliFramework, SourceResolver};
 
 class ReleaseCreateCli extends CliFramework
 {

cli/release_manage.php

@@ -17,7 +17,7 @@ declare(strict_types=1);
 
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\CliFramework;
+use MokoCli\CliFramework;
 
 class ReleaseManageCli extends CliFramework
 {

cli/release_mirror.php

@@ -17,7 +17,7 @@ declare(strict_types=1);
 
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\CliFramework;
+use MokoCli\CliFramework;
 
 class ReleaseMirrorCli extends CliFramework
 {

cli/release_notes.php

@@ -17,7 +17,7 @@ declare(strict_types=1);
 
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\CliFramework;
+use MokoCli\CliFramework;
 
 class ReleaseNotesCli extends CliFramework
 {

cli/release_package.php

@@ -17,7 +17,7 @@ declare(strict_types=1);
 
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\{CliFramework, SourceResolver};
+use MokoCli\{CliFramework, SourceResolver};
 
 class ReleasePackageCli extends CliFramework
 {

cli/release_promote.php

@@ -17,7 +17,7 @@ declare(strict_types=1);
 
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\{CliFramework, SourceResolver};
+use MokoCli\{CliFramework, SourceResolver};
 
 class ReleasePromoteCli extends CliFramework
 {

cli/release_publish.php

@@ -10,7 +10,7 @@
  * INGROUP: mokoplatform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokoplatform
  * PATH: /cli/release_publish.php
- * VERSION: 09.26.00
+ * VERSION: 09.33.00
  * BRIEF: Publish a release and create copies for all lesser stability streams.
  */
 
@@ -18,7 +18,7 @@ declare(strict_types=1);
 
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\CliFramework;
+use MokoCli\CliFramework;
 
 class ReleasePublishCli extends CliFramework
 {

cli/release_validate.php

@@ -17,7 +17,7 @@ declare(strict_types=1);
 
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\{CliFramework, SourceResolver};
+use MokoCli\{CliFramework, SourceResolver};
 
 class ReleaseValidateCli extends CliFramework
 {

cli/release_verify.php

@@ -17,7 +17,7 @@ declare(strict_types=1);
 
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\CliFramework;
+use MokoCli\CliFramework;
 
 class ReleaseVerifyCli extends CliFramework
 {

cli/scaffold_client.php

@@ -12,7 +12,7 @@
  * INGROUP: mokoplatform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokoplatform
  * PATH: /cli/scaffold_client.php
- * VERSION: 09.26.00
+ * VERSION: 09.33.00
  * BRIEF: Scaffold a new client-waas repo from Template-Client-WaaS with pre-configured settings
  */
 
@@ -20,7 +20,7 @@ declare(strict_types=1);
 
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\CliFramework;
+use MokoCli\CliFramework;
 
 class ScaffoldClientCli extends CliFramework
 {

cli/sync_rulesets.php

@@ -20,9 +20,9 @@ declare(strict_types=1);
 require_once __DIR__ . '/../vendor/autoload.php';
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\CliFramework;
+use MokoCli\CliFramework;
-use MokoEnterprise\Config;
+use MokoCli\Config;
-use MokoEnterprise\PlatformAdapterFactory;
+use MokoCli\PlatformAdapterFactory;
 
 class SyncRulesetsCli extends CliFramework
 {

cli/theme_lint.php

@@ -17,7 +17,7 @@ declare(strict_types=1);
 
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\{CliFramework, SourceResolver};
+use MokoCli\{CliFramework, SourceResolver};
 
 class ThemeLintCli extends CliFramework
 {

cli/updates_xml_build.php

@@ -17,7 +17,7 @@ declare(strict_types=1);
 
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\{CliFramework, SourceResolver};
+use MokoCli\{CliFramework, SourceResolver};
 
 class UpdatesXmlBuildCli extends CliFramework
 {

cli/updates_xml_sync.php

@@ -10,7 +10,7 @@
  * INGROUP: mokoplatform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokoplatform
  * PATH: /cli/updates_xml_sync.php
- * VERSION: 09.26.00
+ * VERSION: 09.33.00
  * BRIEF: Sync updates.xml to target branches via Gitea API
  * NOTE: Called by pre-release and auto-release workflows after updates.xml
  *       is modified on the current branch. Pushes the file to other branches
@@ -21,7 +21,7 @@ declare(strict_types=1);
 
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\CliFramework;
+use MokoCli\CliFramework;
 
 class UpdatesXmlSyncCli extends CliFramework
 {

cli/version_auto_bump.php

@@ -10,7 +10,7 @@
  * INGROUP: mokoplatform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokoplatform
  * PATH: /cli/version_auto_bump.php
- * VERSION: 09.26.00
+ * VERSION: 09.33.00
  * BRIEF: Auto patch-bump, set stability suffix, and commit — single CLI replacing inline workflow bash
  */
 
@@ -18,7 +18,7 @@ declare(strict_types=1);
 
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\CliFramework;
+use MokoCli\CliFramework;
 
 class VersionAutoBumpCli extends CliFramework
 {

cli/version_bump.php

@@ -17,7 +17,7 @@ declare(strict_types=1);
 
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\{CliFramework, SourceResolver};
+use MokoCli\{CliFramework, SourceResolver};
 
 class VersionBumpCli extends CliFramework
 {
@@ -232,9 +232,25 @@ class VersionBumpCli extends CliFramework
                     $pkgContent
                 );
             }
-            if ($updatedPkg !== $pkgContent) {
+            if ($updatedPkg !== $pkgContent && $updatedPkg !== null) {
                 file_put_contents($packageJsonFile, $updatedPkg);
                 fwrite(STDERR, "Updated package.json\n");
+            } elseif (preg_match('/("version"\s*:\s*")(\d+)\.(\d+)\.(\d+)(")/m', $pkgContent, $semM)) {
+                // Semver fallback: bump standard x.y.z version when XX.YY.ZZ pattern didn't match
+                $sMajor = (int)$semM[2];
+                $sMinor = (int)$semM[3];
+                $sPatch = (int)$semM[4];
+                switch ($type) {
+                    case 'major': $sMajor++; $sMinor = 0; $sPatch = 0; break;
+                    case 'minor': $sMinor++; $sPatch = 0; break;
+                    default: $sPatch++; break;
+                }
+                $semNew = "{$sMajor}.{$sMinor}.{$sPatch}";
+                $semUpdated = preg_replace('/("version"\s*:\s*")\d+\.\d+\.\d+(")/m', '${1}' . $semNew . '${2}', $pkgContent);
+                if ($semUpdated !== $pkgContent) {
+                    file_put_contents($packageJsonFile, $semUpdated);
+                    fwrite(STDERR, "Updated package.json (semver: {$semM[2]}.{$semM[3]}.{$semM[4]} -> $semNew)\n");
+                }
             }
         }
         $pyprojectFile = "{$root}/pyproject.toml";

cli/version_bump_remote.php

@@ -17,7 +17,7 @@ declare(strict_types=1);
 
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\{CliFramework, SourceResolver};
+use MokoCli\{CliFramework, SourceResolver};
 
 class VersionBumpRemoteCli extends CliFramework
 {

cli/version_check.php

@@ -10,7 +10,7 @@
  * INGROUP: mokoplatform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokoplatform
  * PATH: /cli/version_check.php
- * VERSION: 09.26.00
+ * VERSION: 09.33.00
  * BRIEF: Validate version consistency across README, manifests, and sub-packages
  */
 
@@ -18,7 +18,7 @@ declare(strict_types=1);
 
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\{CliFramework, SourceResolver};
+use MokoCli\{CliFramework, SourceResolver};
 
 class VersionCheckCli extends CliFramework
 {

cli/version_read.php

@@ -17,7 +17,7 @@ declare(strict_types=1);
 
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\{CliFramework, SourceResolver};
+use MokoCli\{CliFramework, SourceResolver};
 
 class VersionReadCli extends CliFramework
 {

cli/version_reset_dev.php

@@ -17,7 +17,7 @@ declare(strict_types=1);
 
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\CliFramework;
+use MokoCli\CliFramework;
 
 class VersionResetDevCli extends CliFramework
 {

cli/version_set_platform.php

@@ -17,7 +17,7 @@ declare(strict_types=1);
 
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\{CliFramework, SourceResolver};
+use MokoCli\{CliFramework, SourceResolver};
 
 class VersionSetPlatformCli extends CliFramework
 {

cli/wiki_sync.php

@@ -10,7 +10,7 @@
  * INGROUP: mokoplatform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokoplatform
  * PATH: /cli/wiki_sync.php
- * VERSION: 09.26.00
+ * VERSION: 09.33.00
  * BRIEF: Sync select wiki pages from mokoplatform to all template repos
  */
 
@@ -18,7 +18,7 @@ declare(strict_types=1);
 
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\CliFramework;
+use MokoCli\CliFramework;
 
 class WikiSyncCli extends CliFramework
 {

cli/workflow_sync.php

@@ -10,7 +10,7 @@
  * INGROUP: moko-platform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /cli/workflow_sync.php
- * VERSION: 09.26.00
+ * VERSION: 09.33.00
  * BRIEF: Sync workflows from Generic → platform templates → live repos based on manifest.platform
  */
 
@@ -18,7 +18,7 @@ declare(strict_types=1);
 
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\CliFramework;
+use MokoCli\CliFramework;
 
 class WorkflowSyncCli extends CliFramework
 {
@@ -34,6 +34,14 @@ class WorkflowSyncCli extends CliFramework
     private const DEFAULT_TEMPLATE = 'Template-Generic';
     private const GENERIC_TEMPLATE = 'Template-Generic';
 
+    /**
+     * Workflows to exclude per platform during sync.
+     * Key = platform name (matching PLATFORM_TEMPLATES keys), Value = array of workflow filenames to skip.
+     */
+    private const PLATFORM_EXCLUDES = [
+        'joomla' => ['deploy-manual.yml'],
+    ];
+
     private int $updated = 0;
     private int $created = 0;
     private int $skipped = 0;
@@ -165,6 +173,13 @@ class WorkflowSyncCli extends CliFramework
         foreach ($platformTemplates as $templateRepo) {
             foreach ($genericWorkflows as $workflow) {
                 $filename = $workflow['name'];
+                // Skip platform-excluded workflows
+                $templatePlatform = array_search($templateRepo, self::PLATFORM_TEMPLATES, true);
+                if ($templatePlatform !== false && in_array($filename, self::PLATFORM_EXCLUDES[$templatePlatform] ?? [], true)) {
+                    fprintf(STDERR, "%-45s | %s\n", "{$templateRepo}/{$filename}", 'EXCLUDED (platform)');
+                    $this->skipped++;
+                    continue;
+                }
                 $destPath = '.mokogitea/workflows/' . $filename;
                 $label = "{$templateRepo}/{$filename}";
 
@@ -260,6 +275,12 @@ class WorkflowSyncCli extends CliFramework
 
             foreach ($workflows as $workflow) {
                 $filename = $workflow['name'];
+                // Skip platform-excluded workflows
+                if (in_array($filename, self::PLATFORM_EXCLUDES[$platform] ?? [], true)) {
+                    fprintf(STDERR, "%-45s | %s\n", $label, 'EXCLUDED (platform)');
+                    $this->skipped++;
+                    continue;
+                }
                 $destPath = '.mokogitea/workflows/' . $filename;
                 $label = "{$repoFullName}/{$filename}";
 

composer.json

@@ -43,15 +43,14 @@
     },
     "autoload": {
         "psr-4": {
-            "MokoStandards\\": "src/",
+            "MokoCli\\": ["source/", "lib/Enterprise/"],
-            "MokoEnterprise\\": "lib/Enterprise/",
+            "MokoCli\\Plugins\\Joomla\\": "lib/plugins/Joomla/"
-            "MokoStandards\\Plugins\\Joomla\\": "lib/plugins/Joomla/"
         },
         "classmap": [
             "lib/Enterprise/CliFramework.php"
         ],
         "files": [
-            "src/functions.php"
+            "source/functions.php"
         ]
     },
     "archive": {
@@ -64,7 +63,7 @@
     },
     "autoload-dev": {
         "psr-4": {
-            "MokoStandards\\Tests\\": "tests/"
+            "MokoCli\\Tests\\": "tests/"
         }
     },
     "bin": [
@@ -93,7 +92,8 @@
         "check:headers": "php bin/moko check:headers -- --path .",
         "check:secrets": "php bin/moko check:secrets -- --path .",
         "check:enterprise": "php bin/moko check:enterprise -- --path .",
-        "drift": "php bin/moko drift"
+        "drift": "php bin/moko drift",
+        "security:advisories": "php bin/moko security:advisories"
     },
     "config": {
         "sort-packages": true,

deploy/backup-before-deploy.php

@@ -12,7 +12,7 @@
  * INGROUP: MokoPlatform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokoplatform
  * PATH: /deploy/backup-before-deploy.php
- * VERSION: 09.26.00
+ * VERSION: 09.33.00
  * BRIEF: Snapshot Joomla directories before deployment for rollback capability
  */
 
@@ -20,7 +20,7 @@ declare(strict_types=1);
 
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\CliFramework;
+use MokoCli\CliFramework;
 
 class BackupBeforeDeployCli extends CliFramework
 {

deploy/deploy-dolibarr.php

@@ -12,7 +12,7 @@
  * INGROUP: MokoPlatform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokoplatform
  * PATH: /deploy/deploy-dolibarr.php
- * VERSION: 09.26.00
+ * VERSION: 09.33.00
  * BRIEF: Deploy Dolibarr module files to a remote server via SFTP/rsync
  */
 
@@ -20,7 +20,7 @@ declare(strict_types=1);
 
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\CliFramework;
+use MokoCli\CliFramework;
 
 class DeployDolibarrCli extends CliFramework
 {

deploy/deploy-joomla.php

@@ -30,7 +30,7 @@ declare(strict_types=1);
 require_once __DIR__ . '/../vendor/autoload.php';
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\CliFramework;
+use MokoCli\CliFramework;
 use phpseclib3\Net\SFTP;
 use phpseclib3\Crypt\PublicKeyLoader;
 

deploy/deploy-sftp.php

@@ -21,7 +21,7 @@ require_once __DIR__ . '/../vendor/autoload.php';
 
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\{CliFramework, SourceResolver};
+use MokoCli\{CliFramework, SourceResolver};
 use phpseclib3\Net\SFTP;
 use phpseclib3\Crypt\PublicKeyLoader;
 
@@ -66,8 +66,16 @@ class DeploySftp extends CliFramework
      */
     protected function run(): int
     {
-        $repoPath  = $this->resolveRepoPath();
+        $repoPath = $this->resolveRepoPath();
-        $srcDir    = $this->resolveSrcDir($repoPath);
+        $srcDir   = $this->resolveSrcDir($repoPath);
+        $env      = strtolower($this->getArgument('--env', '') ?: '');
+
+        // Multi-target: LIVE_TARGETS env var overrides config file for live deploys
+        $liveTargets = getenv('LIVE_TARGETS') ?: '';
+        if ($liveTargets !== '' && ($env === 'live' || $env === '')) {
+            return $this->deployMultiTarget($repoPath, $srcDir, $liveTargets);
+        }
+
         $configPath = $this->resolveConfigPath($repoPath);
 
         $this->log("Repository : {$repoPath}");
@@ -130,6 +138,103 @@ class DeploySftp extends CliFramework
         return $exitCode;
     }
 
+    // ─── Multi-target deploy ────────────────────────────────────────────────
+
+    /**
+     * Deploy to multiple live targets from LIVE_TARGETS JSON.
+     *
+     * LIVE_TARGETS format (JSON array of objects):
+     *   [
+     *     {"host": "web1.example.com", "user": "deploy", "remote_path": "/var/www/module/", "ssh_key_file": "~/.ssh/id_rsa"},
+     *     {"host": "web2.example.com", "user": "deploy", "remote_path": "/var/www/module/", "ssh_key_file": "~/.ssh/id_rsa"}
+     *   ]
+     *
+     * @return int POSIX exit code (0 if all targets succeed)
+     */
+    private function deployMultiTarget(string $repoPath, string $srcDir, string $liveTargetsJson): int
+    {
+        $targets = json_decode($liveTargetsJson, true);
+        if (!is_array($targets) || empty($targets)) {
+            $this->log('ERROR', 'LIVE_TARGETS is not a valid JSON array');
+            return self::EXIT_USAGE;
+        }
+
+        $this->section("Multi-target live deploy ({$this->count($targets)} targets)");
+
+        $succeeded = 0;
+        $failed    = 0;
+
+        foreach ($targets as $i => $target) {
+            $host = $target['host'] ?? 'unknown';
+            $this->section("Target " . ($i + 1) . ": {$host}");
+
+            // Merge target config into $this->config for this iteration
+            $this->config = $target;
+
+            if (!$this->validateConfig()) {
+                $this->log('ERROR', "Skipping target {$host} — invalid config");
+                $failed++;
+                continue;
+            }
+
+            $remotePath = rtrim((string) $this->config['remote_path'], '/');
+            $ignores    = array_merge(
+                $this->buildIgnorePatterns(),
+                $this->loadFtpIgnorePatterns($srcDir),
+                $this->loadFtpIgnorePatterns($repoPath)
+            );
+
+            $user = (string) $this->config['user'];
+            $port = (int) ($this->config['port'] ?? 22);
+
+            if ($this->dryRun) {
+                $this->log("[DRY RUN] Would deploy to {$user}@{$host}:{$port} → {$remotePath}");
+                $succeeded++;
+                continue;
+            }
+
+            $sftp = $this->connect($host, $port, $user, $repoPath);
+            if ($sftp === null) {
+                $this->log('ERROR', "Failed to connect to {$host}");
+                $failed++;
+                continue;
+            }
+
+            // Reset counters per target
+            $this->uploaded  = 0;
+            $this->skipped   = 0;
+            $this->unchanged = 0;
+            $this->deleted   = 0;
+
+            $dirCheck = @$sftp->nlist(dirname($remotePath));
+            $baseName = basename($remotePath);
+            $dirExists = is_array($dirCheck) && in_array($baseName, $dirCheck, true);
+            if (!$dirExists) {
+                $sftp->mkdir($remotePath, -1, true);
+            }
+
+            $exitCode = $this->uploadDirectory($sftp, $srcDir, $remotePath, $srcDir, $ignores);
+
+            $this->log("  {$host}: Uploaded={$this->uploaded} Unchanged={$this->unchanged} Deleted={$this->deleted} Skipped={$this->skipped}");
+
+            if ($exitCode === 0) {
+                $succeeded++;
+            } else {
+                $failed++;
+            }
+        }
+
+        $this->section('Multi-target summary');
+        $this->log("Succeeded: {$succeeded}, Failed: {$failed}");
+
+        return $failed > 0 ? self::EXIT_FAILURE : self::EXIT_SUCCESS;
+    }
+
+    private function count(array $arr): int
+    {
+        return \count($arr);
+    }
+
     // ─── Private helpers ──────────────────────────────────────────────────────
 
     /**
@@ -171,8 +276,10 @@ class DeploySftp extends CliFramework
 
     /** Map of --env values to their sftp-config filename. */
     private const ENV_CONFIG_MAP = [
-        'dev' => 'sftp-config.dev.json',
+        'dev'  => 'sftp-config.dev.json',
-        'rs'  => 'sftp-config.rs.json',
+        'rs'   => 'sftp-config.rs.json',
+        'demo' => 'sftp-config.demo.json',
+        'live' => 'sftp-config.live.json',
     ];
 
     /**

deploy/health-check.php

@@ -12,7 +12,7 @@
  * INGROUP: MokoPlatform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokoplatform
  * PATH: /deploy/health-check.php
- * VERSION: 09.26.00
+ * VERSION: 09.33.00
  * BRIEF: Post-deploy health check — verify a Joomla site is responding correctly
  */
 
@@ -20,7 +20,7 @@ declare(strict_types=1);
 
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\CliFramework;
+use MokoCli\CliFramework;
 
 class HealthCheckCli extends CliFramework
 {

deploy/rollback-joomla.php

@@ -12,7 +12,7 @@
  * INGROUP: MokoPlatform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokoplatform
  * PATH: /deploy/rollback-joomla.php
- * VERSION: 09.26.00
+ * VERSION: 09.33.00
  * BRIEF: Rollback a Joomla deployment by restoring from a pre-deploy snapshot
  */
 
@@ -20,7 +20,7 @@ declare(strict_types=1);
 
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\CliFramework;
+use MokoCli\CliFramework;
 
 class RollbackJoomlaCli extends CliFramework
 {

deploy/sync-joomla.php

@@ -12,7 +12,7 @@
  * INGROUP: MokoPlatform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokoplatform
  * PATH: /deploy/sync-joomla.php
- * VERSION: 09.26.00
+ * VERSION: 09.33.00
  * BRIEF: Sync Joomla site directories between two servers via rsync over SSH
  */
 
@@ -20,7 +20,7 @@ declare(strict_types=1);
 
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\CliFramework;
+use MokoCli\CliFramework;
 
 class SyncJoomlaCli extends CliFramework
 {

fix/fix_line_endings.php

@@ -19,8 +19,8 @@ declare(strict_types=1);
 require_once __DIR__ . '/../vendor/autoload.php';
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\CliFramework;
+use MokoCli\CliFramework;
-use MokoEnterprise\FileFixUtility;
+use MokoCli\FileFixUtility;
 
 class FixLineEndings extends CliFramework
 {

fix/fix_permissions.php

@@ -19,8 +19,8 @@ declare(strict_types=1);
 require_once __DIR__ . '/../vendor/autoload.php';
 require_once __DIR__ . '/../lib/Enterprise/CliFramework.php';
 
-use MokoEnterprise\CliFramework;
+use MokoCli\CliFramework;
-use MokoEnterprise\FileFixUtility;
+use MokoCli\FileFixUtility;
 
 class FixPermissions extends CliFramework
 {