BLT Fluent WP Registry grade A-. Low-severity findings · 1 findingWP RegistryLow-severity findings · 1 findingOpen the reportA-

A series of extensions for FluentCart & FluentCRM.

BLT Fluent lets an administrator pick which FluentCRM custom contact fields are collected during FluentCart checkout, order them by drag-and-drop, and enable that field set per product. Submitted values are written straight to the customer's FluentCRM contact record.

FluentCRM owns the schema; this plugin stores configuration only. No ACF bridge, no user-meta duplication, no Fluent Forms dependency.

Requirements

Dependencies are enforced in three layers: the Requires Plugins header, an activation guard that blocks direct/WP-CLI activation, and a runtime guard that shows a notice and registers nothing — but never self-deactivates, so configuration is never silently destroyed.

Install for development

git clone git@github.com:s-fx-com/blt-fluent.git wp-content/plugins/blt-fluent
cd wp-content/plugins/blt-fluent
bin/install-puc.sh          # fetches Plugin Update Checker into vendor/

Plugin Update Checker is not committed. The plugin works without it — only the self-update mechanism is inert, and the Diagnostics panel says so.

For the private-repo updater, add a fine-grained read-only PAT to wp-config.php:

define( 'BLT_FLUENT_GH_TOKEN', 'github_pat_...' );

Release

1. Bump Version: in blt-fluent.php and Stable tag: in readme.txt.
2. bin/build-zip.sh
3. Tag vX.Y.Z and attach build/blt-fluent-X.Y.Z.zip as a release asset.

The site checks for updates once a day at local midnight: PUC's own scheduler is disabled ($checkPeriod = 0) and a WP-Cron event anchored to wp_timezone() drives checkForUpdates() instead. Note that WP-Cron is lazy — on a low-traffic site the event fires on the first page load after midnight. The Plugins screen "Check for updates" link and the Diagnostics tab button both still work for manual checks.

Data lifecycle

The uninstall opt-in covers this plugin's configuration only. FluentCRM contacts, field definitions and values, FluentCart orders and products, and anything written by the profile-edit form are never deleted.

Company selection

[blt_fluent_company] renders a company picker for the signed-in member. Typing searches FluentCRM's existing companies; picking one and pressing Save writes it to that member's contact record. A name matching nothing offers + Add a new company, so members land on an existing record wherever one exists and only create a company deliberately.

allow_create controls the interface only. The enforcement point is the blt_fluent/company_allow_create filter, because an attribute cannot be trusted to survive the round trip to the REST endpoint:

add_filter( 'blt_fluent/company_allow_create', '__return_false' );

Whose record gets written. The contact is resolved server-side from the signed-in user's email. No contact identifier is accepted from the request, so a member can only ever change their own company. Both endpoints require a signed-in user, and REST cookie authentication additionally requires the wp_rest nonce the script sends.

Duplicate companies. A submitted name is matched case-insensitively against existing companies before anything is created, so "acme ltd" attaches to the existing "Acme Ltd". Creation is also rate limited per member (5 an hour by default, blt_fluent/company_create_limit).

REST endpoints, namespace blt-fluent/v1:

FluentCart hooks used

fluent_cart/checkout/customer_data_saved was removed in FluentCart 1.4.0 and is deliberately not used — a callback on it never runs, silently.

The render hook defaults to fluent_cart/before_payment_methods because it fires in the standard, modal and block renderers. fluent_cart/checkout/b2b_extra_fields fires in the full-page renderer only.

Filters

Every assumption about FluentCart's payload shapes is overridable without a code change:

Actions: blt_fluent/booted, blt_fluent/after_render, blt_fluent/values_written, blt_fluent/captured, blt_fluent/company_created, blt_fluent/company_saved.

Tests

php tests/smoke-test.php
php tests/company-test.php

tests/bootstrap.php is a small WordPress shim — enough of the API for the sanitisation, normalisation, validation and render code to run from the CLI. The FluentCRM readers are swapped for stubs, so the tests never need FluentCart or FluentCRM installed. CI runs both files plus php -l on 7.4, 8.2 and 8.4.

Build status

docs/VERIFY.md lists the assumptions that can only be settled against equinephotographers.org, each with the filter that fixes it if the assumption turns out wrong. Turn on Advanced → Record a diagnostic log before starting: the log names the cart-detection strategy, the FluentCRM read path, and every skipped or aborted write.