Changelog

[Unreleased]

API endpoint POST /api/index.php/v1/mokowaas/install — install extensions from a remote ZIP URL
Demo Mode with configurable warning banner on frontend when enabled
DemoResetService — baseline snapshot and restore for DB tables + media files
API endpoints POST /?mokowaas=reset and POST /?mokowaas=snapshot (query-string)
REST endpoints POST /api/v1/mokowaas/reset and GET/POST /api/v1/mokowaas/snapshot
plg_task_mokowaasdemo — Joomla Scheduled Task plugin for automatic demo site reset
Admin toggles: Take Snapshot Now and Restore Baseline Now in plugin config
Content Sync: one-way push of articles, categories, menus, and modules to remote MokoWaaS sites
Content Sync: API endpoints POST /?mokowaas=sync (sender) and POST /?mokowaas=sync-receive (receiver)
Content Sync: REST endpoints POST /api/v1/mokowaas/sync and POST /api/v1/mokowaas/sync-receive
Content Sync: configurable sync targets with URL + API token in plugin settings
Package installer: protect all MokoWaaS extensions (not just system plugin) and ensure update server stays enabled
Package installer: clean up legacy mokowaasbrand extension entries and files on install/update
API endpoint GET /?mokowaas=extensions and GET /api/v1/mokowaas/extensions — list installed extensions with version, status, and update server info

All notable changes to the MokoWaaS plugin will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

branch-cleanup.yml: auto-delete merged feature branches after PR merge
plg_webservices_perfectpublisher: REST API for Perfect Publisher (com_autotweet) — channels, posts, requests, rules, feeds, and stats

Trusted IPs: configurable repeatable rows of IP addresses, CIDR ranges, and wildcards that bypass admin session timeout
Supports exact IPs (192.168.1.100), CIDR (10.0.0.0/24), and wildcards (192.168.1.*)
Each entry has a label and enabled toggle for easy management
Current IP display above trusted IPs table so admins can easily add their own IP

Trusted IP session bypass: moved from onAfterInitialise to boot() so Joomla's session lifetime is extended before the session handler validates it (was too late, Joomla expired the session first)
updates.xml: removed stale pre-release entries pointing to non-existent dev artifacts, legacy plugin update entry that caused stable sites to attempt dev downloads
Removed duplicate <updateservers> from inner plugin manifest — only the package-level manifest should register the update server
Auto-cleanup of stale plugin-level update site entries on install/update (cleans #__update_sites and #__update_sites_extensions)