feat: scripture protection plugin, package install script, and library bump to v1.1.6

[bcordis]

Problem

lib_cwmscripture ≤ 1.1.4 declared <uninstall><sql> pointing at DROP TABLE statements. Joomla's LibraryAdapter uninstalls the installed library before writing the new one, so that SQL ran on every update and destroyed every locally downloaded translation.

1.1.6 removed the block — but that only protects the upgrade after this one. The uninstall SQL Joomla executes during an update is the one already in JPATH_LIBRARIES, belonging to the installed version. A site on 1.1.4 is destroyed by the very update that fixes it.

Nothing in the incoming package can prevent it

InstallerAdapter::install() runs in this order (verified against Joomla 5.4.7):

1. setupInstallPaths()
2. checkExtensionInFilesystem() ← triggers the old library's uninstall, executing its DROP TABLEs
3. setupScriptfile()
4. triggerManifestScript('preflight')

The incoming script file is not loaded until step 4. A library-side preflight disarm is impossible. The only place to intervene is code already resident on the site, running before the installer.

What this PR contains

plg_system_cwmscripture — new system plugin that blanks the legacy SQL on onAfterRoute while the admin is on com_installer, before they click Update. plg_system_proclaim does this for Proclaim sites; this covers stacks that ship the library without Proclaim (Living Word, third-party consumers), which is the case a library-only update leaves completely unprotected.

Detection distinguishes executable statements from mentions inside -- comments, so the already-disarmed 1.1.5/1.1.6 files — which describe the problem in prose and therefore contain the words "DROP TABLE" — are left alone:

Version	Detected as armed
v1.1.4	yes → disarmed
v1.1.5	no (comment only)
v1.1.6	no (comment only)

build/script.install.php — the package install script, wired via <scriptfile> and package.installer. Blanks the installed library's legacy SQL in preflight() before the library child installs, and dropScriptureTablesIfLastConsumer() asks ConsumerRegistry::installedExcluding() whether anything outside this package still uses the shared tables before removing them.

enablePlugin('cwmscripture', 'system') in postflight — Joomla installs plugins disabled, and a disabled protection plugin never fires. Shipping it off by default would leave the protection absent on exactly the sites least recently touched — the ones most likely to still carry a destructive 1.1.4 library. Only flips a plugin that is currently disabled, so an admin who deliberately turned it off is not overridden.

blockChildUninstall in build/pkg_cwmscripture.xml, matching pkg_proclaim.xml, so the library cannot be pulled out from under the plugins shipped alongside it.

Library submodule → v1.1.6. Until this moved, the package shipped a pre-fix library and re-armed the destructive SQL on every site it touched — observed directly in Joomla-Bible-Study/lib_cwmscripture#17 run 3. Supersedes #11, which targeted v1.1.5; that version still declares <uninstall><sql> and has neither ConsumerRegistry nor the uninstall guard that this install script now calls.

Verification

• php -l clean on all PHP; xmllint clean on the package manifest; cwm-build.config.json parses
• Disarm detection checked against all three released SQL files (table above)

Not runtime-tested. The plugin has not been installed and exercised on a site, and the enablePlugin path has not been run. The test that matters is a 1.1.4 → 1.1.6 library-only update on a site with seeded translations, confirming the plugin disarms before the update and the translations survive. Proclaim's composer test:upgrade covers the package path but not this one.

Related: Joomla-Bible-Study/lib_cwmscripture#21, Joomla-Bible-Study/CWMLivingWord#85, #12.

🤖 Generated with Claude Code

[bcordis]

Added d25a3db: both plugins now register themselves with the library's consumer registry, closing #12.

Uses the entry point added in lib_cwmscripture 1.1.7 (Joomla-Bible-Study/lib_cwmscripture#26), so each plugin needs four lines rather than the ~50 that hand-rolled autoloading, guards and error handling would take:

if (!is_file($helper = JPATH_LIBRARIES . '/cwmscripture/src/consumer.php')) {
    return;
}

$registry = require $helper;
$registry->register('scripturelinks', 'plugin', 'content', 'Scripture Links (plg_content_scripturelinks)');

The group is passed explicitly — it is part of the registry's unique key, and a plugin registered without it never matches on lookup. register and unregister are branched rather than called dynamically, because unregister() takes no display name.

Verified in Proclaim's upgrade harness on a real 10.4.0 → 10.4.1 upgrade: OK scripturelinks (content) registered itself as a consumer. The task plugin is not shipped by pkg_proclaim, so that harness reports it as "not installed here, nothing to register" — its registration path is the same code.

Note: this branch's nested libraries/lib_cwmscripture pointer is still at v1.1.6, which has no entry point. The is_file() guard means the calls no-op harmlessly until the pointer moves to 1.1.7, so nothing breaks — but registration does not actually happen until then, and the plugins stay covered only by the library's FIRST_PARTY fallback.

[bcordis]

Added a5c504f: nested libraries/lib_cwmscripture bumped from 1980675 (v1.1.7) to addc517 — lib main after Joomla-Bible-Study/lib_cwmscripture#27.

That PR added the library's verifyMediaSources config, so cwm-package now runs the stale-artifact check on the library while building this package instead of trusting whatever sits in its media/. lib_cwmscripture#25 is the case it exists for, and this package is one of the two that bundles the library.

Nothing shipped changes. The previous pointer was already v1.1.7, so the bundled library carried src/consumer.php and ConsumerScanner before this — the plugins' registration calls were already live. The library's cwm-build.config.json and composer.json are build-time only and are not in the manifest's <files>.

Verified by rebuilding: pkg_cwmscripture assembles with all four children, and the bundled lib_cwmscripture.zip is 89 files before and after.

Proclaim's equivalent bump is Joomla-Bible-Study/Proclaim#1373.