v4.0.0 - Alt-chain payments + batch mints + wallet network gate

Cardano Easy Mint v4.0.0 — major release.

This is the alt-chain payments + batch mints + wallet-network gate cut. Drop-in installable to any WordPress site.

Install

1. Download cardano-easy-mint-v4.0.0.zip from Assets below.
2. WordPress admin → Plugins → Add New → Upload Plugin → select the zip → Install Now → Activate.
3. Configure under Cardano Mint → Plugin Setup, then optionally Alt-Chain Payments.

Existing installs upgrade in place; no schema migration needed at activation (alt-pay tables are created lazily on first activation of the alt-chain feature).

What's new

Added

• Alt-chain payments. Customers pay for a Cardano NFT with BTC, ETH, or SOL. Per-mint deterministic deposit addresses, server-side watcher, price-locked invoices, refund + sweep tooling per chain.
• Batch mints. 1-5 NFTs per Cardano transaction, one wallet signature.
• Wallet network gate. Four layers refuse to proceed when the customer's Cardano wallet is on a different network than the site (catches the "paid in BTC, can't sign because wallet was on mainnet" failure mode).
• Resume banners for in-flight alt-chain payments. Per-chain localStorage sessions survive page reloads.
• Refund + sweep admin tooling per chain. Real on-chain txs, signed by the same pure-PHP crypto stack.
• filemtime() asset cache busting so any future plugin update auto-busts every browser cache.

Changed

• AnvilAPI::buildMintTransaction signature: added $quantity = 1. Default behavior is unchanged.
• Step 2 modal: tighter spacing so the receipt fits without scrolling.
• Wallet picker no longer lists Nami (defunct).

Fixed

• Receipt info note unreadable on dark theme (duplicate light-theme !important rule removed).
• After a successful alt-pay mint, reopening the modal could leave the receipt in alt-pay state with stale totals. New kg:mint-completed event wipes the overlay between mints.
• Quantity stepper no longer interferes with the alt-pay overlay.

Security

• All signing keys (Cardano + alt-chain) AES-256-CBC at rest, key derived from WP salts.
• Decrypted xprvs scrubbed via sodium_memzero + unset in try/finally.
• Alt-pay quote endpoint rate-limited 5/IP/min, 50/IP/day.
• HD address reuse: never. Cancelled invoices do not free the index.

See CHANGELOG.md for the full changelog and README.md for full feature docs.