fchub-multi-currency v1.1.5

The price projection engine was architecturally deaf. Every dynamic price update — cart changes, variant switches, modal opens — was broken in production. Hat tip to @ManniGH for the bug reports in #20 that exposed the full extent of the carnage. 🍻

---

Critical

• Price projection engine was deaf to FluentCart — all event listeners were attached to document, but FluentCart dispatches every custom event on window. Custom events don't bubble across event targets. The projection engine never received cart updates, variant changes, or modal opens. Fixed by moving all listeners to window.

High — user-reported bugs from #20

• Variant switching left prices in base currency — missing fluentCartSingleProductVariationChanged listener
• "View Options" modal prices stuck in base currency — missing fluentCartSingleProductModalOpened listener
• Checkout subscription renewal line not converted — .fct_item_payment_info wasn't in the price selector list
• Subscription text destroyed during projection — "per month, until cancel" was getting obliterated because the projection replaced entire text nodes. Now uses regex to surgically replace only the price portion.
• Pricing table elements destroyed — <sup> currency signs and <span class="repeat-interval"> were being vaporised by textContent replacement. Now detects mixed content and modifies only the text node.
• fchub_mc_format_price() fatal error — $optionStore was undefined when the currency context was already cached

Security

• Rate limiting on public POST /context — 30 requests/minute per IP
• Provider names removed from public /rates response — info leak
• Checkout disclosure text sanitised — wp_kses() on output

Features

• SVG flag icons — 50 bundled country flags (MIT licensed). Windows users no longer see mysterious two-letter codes.
• Shortcode label attribute — [fchub_currency_switcher label="Select currency:"]
• Shortcode align attribute — [fchub_currency_switcher align="right"]
• Per-currency decimal/thousand separators — explicit config instead of position-based heuristic

Code quality

• Resolver chain cached, duplicated isAllowedCurrency() extracted to trait, race condition in stale lock fixed, current_time('mysql') replaced with wp_date()

Tests

• 174 PHP tests (327 assertions) — all pass
• 41 JS tests — all pass