diff --git a/includes/class-psa-admin.php b/includes/class-psa-admin.php
new file mode 100755
index 0000000..bded3db
--- /dev/null
+++ b/includes/class-psa-admin.php
@@ -0,0 +1,264 @@
+<?php
+/**
+ * Admin settings page for Peptide Search AI.
+ * Configured for OpenRouter API access.
+ *
+ * @package PeptideSearchAI
+ */
+
+if ( ! defined( 'ABSPATH' ) ) {
+	exit;
+}
+
+class PSA_Admin {
+
+	public static function init() {
+		add_action( 'admin_menu', array( __CLASS__, 'add_menu_pages' ) );
+		add_action( 'admin_init', array( __CLASS__, 'register_settings' ) );
+	}
+
+	/**
+	 * Add settings page under Settings menu.
+	 */
+	public static function add_menu_pages() {
+		add_options_page(
+			__( 'Peptide Search AI', 'peptide-search-ai' ),
+			__( 'Peptide Search AI', 'peptide-search-ai' ),
+			'manage_options',
+			'peptide-search-ai',
+			array( __CLASS__, 'render_settings_page' )
+		);
+	}
+
+	/**
+	 * Register settings fields.
+	 */
+	public static function register_settings() {
+		register_setting(
+			'psa_settings_group',
+			'psa_settings',
+			array(
+				'sanitize_callback' => array( __CLASS__, 'sanitize_settings' ),
+			)
+		);
+
+		// OpenRouter Section.
+		add_settings_section(
+			'psa_ai_section',
+			__( 'OpenRouter API Settings', 'peptide-search-ai' ),
+			array( __CLASS__, 'render_section_description' ),
+			'peptide-search-ai'
+		);
+		add_settings_field(
+			'api_key',
+			__( 'API Key', 'peptide-search-ai' ),
+			array( __CLASS__, 'render_api_key_field' ),
+			'peptide-search-ai',
+			'psa_ai_section'
+		);
+		add_settings_field(
+			'ai_model',
+			__( 'Generation Model', 'peptide-search-ai' ),
+			array( __CLASS__, 'render_model_field' ),
+			'peptide-search-ai',
+			'psa_ai_section'
+		);
+		add_settings_field(
+			'validation_model',
+			__( 'Validation Model', 'peptide-search-ai' ),
+			array( __CLASS__, 'render_validation_model_field' ),
+			'peptide-search-ai',
+			'psa_ai_section'
+		);
+
+		// Behavior Section.
+		add_settings_section(
+			'psa_behavior_section',
+			__( 'Behavior Settings', 'peptide-search-ai' ),
+			null,
+			'peptide-search-ai'
+		);
+		add_settings_field(
+			'auto_publish',
+			__( 'Auto-Publish', 'peptide-search-ai' ),
+			array( __CLASS__, 'render_publish_field' ),
+			'peptide-search-ai',
+			'psa_behavior_section'
+		);
+		add_settings_field(
+			'use_pubchem',
+			__( 'PubChem Enrichment', 'peptide-search-ai' ),
+			array( __CLASS__, 'render_pubchem_field' ),
+			'peptide-search-ai',
+			'psa_behavior_section'
+		);
+	}
+
+	/**
+	 * Sanitize settings input.
+	 *
+	 * @param array $input Raw input from the form.
+	 * @return array Sanitized settings.
+	 */
+	public static function sanitize_settings( $input ) {
+		// Handle API key: encrypt new values, preserve existing on empty/mask.
+		$api_key_input = $input['api_key'] ?? '';
+		$api_key_value = '';
+
+		if ( ! empty( $api_key_input ) && '••••••••' !== $api_key_input ) {
+			// New key provided: encrypt it.
+			$sanitized = sanitize_text_field( $api_key_input );
+			$encrypted = PSA_Encryption::encrypt( $sanitized );
+			$api_key_value = ( false !== $encrypted ) ? $encrypted : '';
+		} else {
+			// Empty or mask string: preserve existing value.
+			$existing = self::get_setting( 'api_key', '' );
+			$api_key_value = $existing;
+		}
+
+		return array(
+			'api_key'          => $api_key_value,
+			'ai_model'         => sanitize_text_field( $input['ai_model'] ?? '' ),
+			'validation_model' => sanitize_text_field( $input['validation_model'] ?? '' ),
+			'auto_publish'     => sanitize_text_field( $input['auto_publish'] ?? 'draft' ),
+			// Checkbox: if key is absent in POST, it was unchecked → '0'.
+			'use_pubchem'      => ! empty( $input['use_pubchem'] ) ? '1' : '0',
+		);
+	}
+
+	// -------------------------------------------------------------------------
+	// Field renderers
+	// -------------------------------------------------------------------------
+
+	public static function render_section_description() {
+		?>
+		<p>
+			<?php
+			printf(
+				__( 'This plugin uses <a href="%s" target="_blank" rel="noopener">OpenRouter</a> to access AI models. OpenRouter provides a unified API for hundreds of models including open-source options like Gemini Flash, Llama, Mistral, Qwen, and DeepSeek, as well as commercial models.', 'peptide-search-ai' ),
+				esc_url( 'https://openrouter.ai/' )
+			);
+			?>
+		</p>
+		<?php
+	}
+
+	public static function render_api_key_field() {
+		if ( defined( 'PSA_OPENROUTER_KEY' ) && PSA_OPENROUTER_KEY ) {
+			?>
+			<span class="dashicons dashicons-yes-alt" style="color:#46b450;"></span>
+			<strong><?php esc_html_e( 'Configured via wp-config.php', 'peptide-search-ai' ); ?></strong>
+			<p class="description"><?php esc_html_e( 'The API key is securely set using the PSA_OPENROUTER_KEY constant in wp-config.php. This is the recommended approach.', 'peptide-search-ai' ); ?></p>
+			<?php
+		} else {
+			$value = self::get_setting( 'api_key', '' );
+			// Show mask if key exists, empty if not.
+			$display_value = ! empty( $value ) ? '••••••••' : '';
+			?>
+			<input type="password" name="psa_settings[api_key]" value="<?php echo esc_attr( $display_value ); ?>" class="regular-text" autocomplete="off" />
+			<p class="description">
+				<?php esc_html_e( 'Your OpenRouter API key. Get one at', 'peptide-search-ai' ); ?>
+				<a href="https://openrouter.ai/settings/keys" target="_blank" rel="noopener">openrouter.ai/settings/keys</a>.<br />
+				<strong><?php esc_html_e( 'Recommended:', 'peptide-search-ai' ); ?></strong> <?php esc_html_e( 'For better security, add', 'peptide-search-ai' ); ?> <code>define( 'PSA_OPENROUTER_KEY', 'your-key-here' );</code> <?php esc_html_e( 'to your wp-config.php instead.', 'peptide-search-ai' ); ?>
+			</p>
+			<?php
+		}
+	}
+
+	public static function render_model_field() {
+		$value = self::get_setting( 'ai_model', '' );
+		?>
+		<input type="text" name="psa_settings[ai_model]" value="<?php echo esc_attr( $value ); ?>" class="regular-text" placeholder="<?php esc_attr_e( 'Leave blank for default', 'peptide-search-ai' ); ?>" />
+		<p class="description">
+			<?php esc_html_e( 'Model for full content generation. Default:', 'peptide-search-ai' ); ?> <code>google/gemini-2.5-flash</code>.<br />
+			<?php esc_html_e( 'Browse models at', 'peptide-search-ai' ); ?> <a href="https://openrouter.ai/models" target="_blank" rel="noopener">openrouter.ai/models</a>.
+			<?php esc_html_e( 'Examples:', 'peptide-search-ai' ); ?> <code>meta-llama/llama-4-maverick</code>, <code>deepseek/deepseek-chat-v3-0324</code>, <code>qwen/qwen-2.5-72b-instruct</code>.
+		</p>
+		<?php
+	}
+
+	public static function render_validation_model_field() {
+		$value = self::get_setting( 'validation_model', '' );
+		?>
+		<input type="text" name="psa_settings[validation_model]" value="<?php echo esc_attr( $value ); ?>" class="regular-text" placeholder="<?php esc_attr_e( 'Leave blank for default (fast/cheap model)', 'peptide-search-ai' ); ?>" />
+		<p class="description">
+			<?php esc_html_e( 'Lighter model for peptide name validation. Default:', 'peptide-search-ai' ); ?> <code>google/gemini-2.0-flash-001</code>.<br />
+			<?php esc_html_e( 'Use a fast, cheap model here to keep validation quick. Examples:', 'peptide-search-ai' ); ?> <code>meta-llama/llama-4-scout</code>, <code>mistralai/mistral-small-3.1-24b-instruct</code>.
+		</p>
+		<?php
+	}
+
+	public static function render_publish_field() {
+		$value = self::get_setting( 'auto_publish', 'draft' );
+		?>
+		<select name="psa_settings[auto_publish]">
+			<option value="draft" <?php selected( $value, 'draft' ); ?>><?php esc_html_e( 'Save as Draft (review before publishing)', 'peptide-search-ai' ); ?></option>
+			<option value="publish" <?php selected( $value, 'publish' ); ?>><?php esc_html_e( 'Publish Immediately', 'peptide-search-ai' ); ?></option>
+		</select>
+		<p class="description"><?php esc_html_e( 'Whether AI-generated peptides are published immediately or saved as drafts for review.', 'peptide-search-ai' ); ?></p>
+		<?php
+	}
+
+	public static function render_pubchem_field() {
+		$value = self::get_setting( 'use_pubchem', '1' );
+		?>
+		<label>
+			<input type="checkbox" name="psa_settings[use_pubchem]" value="1" <?php checked( $value, '1' ); ?> />
+			<?php esc_html_e( 'Cross-reference with PubChem for verified molecular data', 'peptide-search-ai' ); ?>
+		</label>
+		<p class="description"><?php esc_html_e( 'When enabled, the plugin queries PubChem\'s free API to validate molecular weight, formula, and other properties.', 'peptide-search-ai' ); ?></p>
+		<?php
+	}
+
+	// -------------------------------------------------------------------------
+	// Settings page
+	// -------------------------------------------------------------------------
+
+	public static function render_settings_page() {
+		?>
+		<div class="wrap">
+			<h1><?php esc_html_e( 'Peptide Search AI Settings', 'peptide-search-ai' ); ?></h1>
+
+			<form method="post" action="options.php">
+				<?php
+				settings_fields( 'psa_settings_group' );
+				do_settings_sections( 'peptide-search-ai' );
+				submit_button();
+				?>
+			</form>
+
+			<hr />
+			<h2><?php esc_html_e( 'How It Works', 'peptide-search-ai' ); ?></h2>
+			<ol style="max-width:600px; line-height:1.8;">
+				<li><?php esc_html_e( 'Add the shortcode [peptide_search] to any page.', 'peptide-search-ai' ); ?></li>
+				<li><?php esc_html_e( 'Visitors search for a peptide name.', 'peptide-search-ai' ); ?></li>
+				<li><?php esc_html_e( 'If found, results appear instantly.', 'peptide-search-ai' ); ?></li>
+				<li><?php esc_html_e( 'If not found, the system automatically validates the name, creates a placeholder, and generates content in the background.', 'peptide-search-ai' ); ?></li>
+				<li><?php esc_html_e( 'The visitor sees a "being added" message and can check back later.', 'peptide-search-ai' ); ?></li>
+			</ol>
+
+			<hr />
+			<h2><?php esc_html_e( 'Shortcode', 'peptide-search-ai' ); ?></h2>
+			<p><code>[peptide_search]</code></p>
+			<p><?php esc_html_e( 'Customize placeholder:', 'peptide-search-ai' ); ?> <code>[peptide_search placeholder="Search peptides..."]</code></p>
+
+			<hr />
+			<h2><?php esc_html_e( 'REST API', 'peptide-search-ai' ); ?></h2>
+			<p><code>GET /wp-json/peptides/v1/search?q=BPC-157</code></p>
+			<p class="description"><?php esc_html_e( 'The REST endpoint returns published peptides only — it does not trigger auto-generation.', 'peptide-search-ai' ); ?></p>
+		</div>
+		<?php
+	}
+
+	/**
+	 * Helper to get a single setting with a default.
+	 *
+	 * @param string $key     Setting key.
+	 * @param mixed  $default Default value.
+	 * @return mixed
+	 */
+	private static function get_setting( $key, $default = '' ) {
+		$options = get_option( 'psa_settings', array() );
+		return $options[ $key ] ?? $default;
+	}
+}
diff --git a/includes/class-psa-ai-generator.php b/includes/class-psa-ai-generator.php
new file mode 100755
index 0000000..8402e82
--- /dev/null
+++ b/includes/class-psa-ai-generator.php
@@ -0,0 +1,745 @@
+<?php
+/**
+ * Handles AI content generation for new peptide entries.
+ * Uses OpenRouter API to access a wide range of open-source and commercial models.
+ * Includes peptide name validation and background generation.
+ *
+ * @package PeptideSearchAI
+ */
+
+if ( ! defined( 'ABSPATH' ) ) {
+	exit;
+}
+
+class PSA_AI_Generator {
+
+	/**
+	 * OpenRouter API base URL.
+	 */
+	const API_URL = 'https://openrouter.ai/api/v1/chat/completions';
+
+	public static function init() {
+		add_action( 'psa_generate_peptide_background', array( __CLASS__, 'background_generate' ), 10, 2 );
+	}
+
+	/**
+	 * Validate whether a search term is a legitimate peptide name.
+	 * Uses a lightweight AI call to check before committing to full generation.
+	 *
+	 * @param string $name The name to validate.
+	 * @return array|WP_Error { is_valid: bool, canonical_name: string, reason: string }
+	 */
+	public static function validate_peptide_name( $name ) {
+		// Input character validation — block injection attempts before API call.
+		if ( ! self::validate_peptide_input( $name ) ) {
+			return array(
+				'is_valid'       => false,
+				'canonical_name' => $name,
+				'reason'         => 'Invalid characters in peptide name.',
+			);
+		}
+
+		$options = self::get_settings();
+		$api_key = $options['api_key'];
+		$model   = $options['validation_model'];
+
+		if ( empty( $api_key ) ) {
+			return new WP_Error( 'no_api_key', 'OpenRouter API key is not configured.' );
+		}
+
+		// Check transient cache first (avoid repeated API calls for same term).
+		$cache_key = 'psa_validate_' . md5( strtolower( trim( $name ) ) );
+		$cached    = get_transient( $cache_key );
+		if ( false !== $cached ) {
+			return $cached;
+		}
+
+		$prompt   = self::build_validation_prompt( $name );
+		// Allow filtering of validation prompt before sending.
+		$prompt = apply_filters( 'psa_validation_prompt', $prompt, $name );
+		$response = self::call_openrouter(
+			$api_key,
+			$model ? $model : 'google/gemini-2.0-flash-001',
+			$prompt,
+			PSA_Config::VALIDATION_MAX_TOKENS
+		);
+
+		if ( is_wp_error( $response ) ) {
+			return $response;
+		}
+
+		$data = self::parse_ai_response( $response );
+		if ( is_wp_error( $data ) ) {
+			return array(
+				'is_valid'       => false,
+				'canonical_name' => $name,
+				'reason'         => 'Could not verify this peptide name.',
+			);
+		}
+
+		$result = array(
+			'is_valid'       => ! empty( $data['is_valid'] ) && true === $data['is_valid'],
+			'canonical_name' => sanitize_text_field( $data['canonical_name'] ?? $name ),
+			'reason'         => sanitize_text_field( $data['reason'] ?? '' ),
+		);
+
+		// Cache for 24 hours (using PSA_Config for consistency).
+		set_transient( $cache_key, $result, DAY_IN_SECONDS ); // Validation cache TTL
+
+		return $result;
+	}
+
+	/**
+	 * Background generation handler (called via WP-Cron or synchronously).
+	 *
+	 * @param int    $post_id      The placeholder post ID.
+	 * @param string $peptide_name The peptide to research.
+	 */
+	public static function background_generate( $post_id, $peptide_name ) {
+		$post = get_post( $post_id );
+		if ( ! $post || 'draft' !== $post->post_status || 'peptide' !== $post->post_type ) {
+			error_log( 'PSA: background_generate skipped — post ' . $post_id . ' not a draft peptide.' );
+			return;
+		}
+
+		// Only process posts that are still in 'pending' state.
+		$source = get_post_meta( $post_id, 'psa_source', true );
+		if ( 'pending' !== $source ) {
+			error_log( 'PSA: background_generate skipped — post ' . $post_id . ' source is "' . $source . '", not "pending".' );
+			return;
+		}
+
+		$options      = self::get_settings();
+		$auto_publish = $options['auto_publish'];
+
+		error_log( 'PSA: Generating content for "' . $peptide_name . '" (post ' . $post_id . ') using model: ' . ( $options['ai_model'] ? $options['ai_model'] : 'google/gemini-2.5-flash' ) );
+
+		// Allow developers to hook before generation starts.
+		do_action( 'psa_before_generation', $post_id, $peptide_name );
+
+		// Generate the full content.
+		$result = self::generate_peptide_content( $peptide_name );
+		if ( is_wp_error( $result ) ) {
+			$err_msg = $result->get_error_message();
+			error_log( 'PSA: Generation FAILED for "' . $peptide_name . '": ' . $err_msg );
+			update_post_meta( $post_id, 'psa_generation_error', $err_msg );
+			return;
+		}
+
+		error_log( 'PSA: AI content generated successfully for "' . $peptide_name . '". Fields: ' . implode( ', ', array_keys( $result ) ) );
+
+		// FIX: Use 'overview' field (which the prompt returns) with fallback to 'description'.
+		$post_content = $result['overview'] ?? $result['description'] ?? '';
+
+		// Safeguard: if post_content is still empty after generation, log a warning.
+		if ( empty( trim( $post_content ) ) ) {
+			error_log( 'PSA: WARNING — AI returned valid JSON but post content (overview/description) is empty for "' . $peptide_name . '". Available keys: ' . implode( ', ', array_keys( $result ) ) );
+			update_post_meta( $post_id, 'psa_generation_error', 'AI returned empty overview/description content. Available fields: ' . implode( ', ', array_keys( $result ) ) );
+			return;
+		}
+
+		// Try PubChem enrichment.
+		$pubchem_data = null;
+		if ( ! empty( $options['use_pubchem'] ) ) {
+			$pubchem_result = PSA_PubChem::lookup( $peptide_name );
+			if ( is_wp_error( $pubchem_result ) ) {
+				// Log PubChem API failures.
+				error_log( 'PSA: PubChem lookup failed for "' . $peptide_name . '": ' . $pubchem_result->get_error_message() );
+			} elseif ( is_array( $pubchem_result ) ) {
+				$pubchem_data = $pubchem_result;
+				error_log( 'PSA: PubChem data found for "' . $peptide_name . '" (CID: ' . ( $pubchem_data['cid'] ?? 'unknown' ) . ')' );
+			}
+		}
+
+		// Update the placeholder with real content.
+		$post_status = ( 'publish' === $auto_publish ) ? 'publish' : 'draft';
+
+		$update_result = wp_update_post(
+			array(
+				'ID'           => $post_id,
+				'post_title'   => sanitize_text_field( $result['name'] ?? $peptide_name ),
+				'post_content' => wp_kses_post( $post_content ),
+				'post_status'  => $post_status,
+			),
+			true
+		);
+
+		if ( is_wp_error( $update_result ) ) {
+			error_log( 'PSA: wp_update_post FAILED for post ' . $post_id . ': ' . $update_result->get_error_message() );
+			update_post_meta( $post_id, 'psa_generation_error', 'Failed to update post: ' . $update_result->get_error_message() );
+			return;
+		}
+
+		// Save all meta fields — prefer PubChem data for molecular properties.
+		self::save_peptide_meta( $post_id, $result, $pubchem_data );
+
+		// Create a matching Knowledge Base article.
+		self::create_kb_article( $post_id, $result, $peptide_name, $post_status );
+
+		// Clean up generation tracking.
+		delete_post_meta( $post_id, 'psa_generation_started' );
+		delete_post_meta( $post_id, 'psa_generation_error' );
+		update_post_meta( $post_id, 'psa_generation_completed', time() );
+
+		// Allow developers to hook after generation completes.
+		do_action( 'psa_after_generation', $post_id, $result, $peptide_name );
+
+		error_log( 'PSA: Successfully completed generation for "' . $peptide_name . '" (post ' . $post_id . ', status: ' . $post_status . ')' );
+	}
+
+	/**
+	 * Generate full peptide content via AI.
+	 *
+	 * @param string $peptide_name The peptide to research.
+	 * @return array|WP_Error Parsed peptide data or error.
+	 */
+	public static function generate_peptide_content( $peptide_name ) {
+		$options = self::get_settings();
+		$api_key = $options['api_key'];
+		$model   = $options['ai_model'];
+
+		if ( empty( $api_key ) ) {
+			return new WP_Error( 'no_api_key', 'OpenRouter API key is not configured.' );
+		}
+
+		$prompt   = self::build_generation_prompt( $peptide_name );
+		// Allow filtering of generation prompt before sending.
+		$prompt = apply_filters( 'psa_generation_prompt', $prompt, $peptide_name );
+		$response = self::call_openrouter(
+			$api_key,
+			$model ? $model : 'google/gemini-2.5-flash',
+			$prompt,
+			PSA_Config::GENERATION_MAX_TOKENS
+		);
+
+		if ( is_wp_error( $response ) ) {
+			return $response;
+		}
+
+		return self::parse_ai_response( $response );
+	}
+
+	// -------------------------------------------------------------------------
+	// Private helpers
+	// -------------------------------------------------------------------------
+
+	/**
+	 * Get plugin settings with defaults.
+	 *
+	 * @return array
+	 */
+	private static function get_settings() {
+		$defaults = array(
+			'api_key'          => '',
+			'ai_model'         => '',
+			'validation_model' => '',
+			'auto_publish'     => 'draft',
+			'use_pubchem'      => '1',
+		);
+
+		$settings = wp_parse_args( get_option( 'psa_settings', array() ), $defaults );
+
+		// Decrypt API key if it's encrypted and constant is not defined.
+		if ( ! empty( $settings['api_key'] ) && ! ( defined( 'PSA_OPENROUTER_KEY' ) && PSA_OPENROUTER_KEY ) ) {
+			$decrypted = PSA_Encryption::decrypt( $settings['api_key'] );
+			if ( false !== $decrypted ) {
+				$settings['api_key'] = $decrypted;
+			}
+			// If decrypt fails, the key might be stored in plaintext (pre-encryption migration).
+			// Leave it as-is for backward compatibility — it will be encrypted on next save.
+		}
+
+		// Prefer wp-config.php constant over database value for security.
+		if ( defined( 'PSA_OPENROUTER_KEY' ) && PSA_OPENROUTER_KEY ) {
+			$settings['api_key'] = PSA_OPENROUTER_KEY;
+		}
+
+		// Allow filtering of settings before use.
+		$settings = apply_filters( 'psa_ai_settings', $settings );
+
+		return $settings;
+	}
+
+	/**
+	 * Save meta fields for a peptide post.
+	 *
+	 * @param int        $post_id      The post ID.
+	 * @param array      $ai_data      AI-generated data.
+	 * @param array|null $pubchem_data PubChem data (or null).
+	 */
+	private static function save_peptide_meta( $post_id, $ai_data, $pubchem_data ) {
+		$meta = array(
+			'psa_sequence'          => $ai_data['sequence'] ?? '',
+			'psa_molecular_weight'  => ! empty( $pubchem_data['molecular_weight'] )
+				? $pubchem_data['molecular_weight']
+				: ( $ai_data['molecular_weight'] ?? '' ),
+			'psa_molecular_formula' => ! empty( $pubchem_data['molecular_formula'] )
+				? $pubchem_data['molecular_formula']
+				: ( $ai_data['molecular_formula'] ?? '' ),
+			'psa_aliases'           => $ai_data['aliases'] ?? '',
+			'psa_mechanism'         => $ai_data['mechanism'] ?? '',
+			'psa_overview'          => $ai_data['overview'] ?? $ai_data['description'] ?? '',
+			'psa_category_label'    => $ai_data['category_label'] ?? '',
+			'psa_origin'            => $ai_data['origin'] ?? '',
+			'psa_research_apps'     => $ai_data['research_benefits'] ?? ( $ai_data['research_applications'] ?? '' ),
+			'psa_safety_profile'    => $ai_data['safety_side_effects'] ?? ( $ai_data['safety_profile'] ?? '' ),
+			'psa_dosage_info'       => $ai_data['administration_dosing'] ?? ( $ai_data['dosage_info'] ?? '' ),
+			'psa_legal_regulatory'  => $ai_data['legal_regulatory'] ?? '',
+			'psa_references'        => $ai_data['references'] ?? '',
+			'psa_category'          => $ai_data['category'] ?? '',
+			'psa_source'            => ! empty( $pubchem_data ) ? 'pubchem' : 'ai-generated',
+			'psa_pubchem_cid'       => $pubchem_data['cid'] ?? '',
+		);
+
+		// Allow filtering of meta before save.
+		$meta = apply_filters( 'psa_peptide_meta', $meta, $post_id, $ai_data, $pubchem_data );
+
+		foreach ( $meta as $key => $value ) {
+			update_post_meta( $post_id, $key, $value );
+		}
+	}
+
+	/**
+	 * Validate peptide name input characters and block injection patterns.
+	 *
+	 * @param string $name The peptide name to validate.
+	 * @return bool True if input looks legitimate.
+	 */
+	private static function validate_peptide_input( $name ) {
+		// Allow only characters that appear in legitimate peptide names.
+		if ( ! preg_match( '/^[\p{L}\d\s\-\(\),\.\/\+\[\]]+$/u', $name ) ) {
+			return false;
+		}
+		// Block obvious prompt injection patterns.
+		$blocked = array( 'ignore', 'instruction', 'override', 'system prompt', 'forget', 'disregard', 'pretend' );
+		$lower   = strtolower( $name );
+		foreach ( $blocked as $word ) {
+			if ( strpos( $lower, $word ) !== false ) {
+				return false;
+			}
+		}
+		return true;
+	}
+
+	/**
+	 * Build the lightweight validation prompt.
+	 *
+	 * Uses wp_json_encode() to safely encode the peptide name within the prompt.
+	 * This ensures special characters and quotes are properly escaped before sending to the AI.
+	 * The JSON-encoded format also helps the AI parser recognize the input clearly.
+	 *
+	 * @param string $name The peptide name to validate.
+	 * @return string Prompt text ready to send to OpenRouter API.
+	 */
+	private static function build_validation_prompt( $name ) {
+		$json_name = wp_json_encode( $name );
+		return <<<PROMPT
+You are a peptide and biochemistry expert. Determine if the peptide name given in the following JSON-encoded string is a real, recognized peptide, protein fragment, or peptide-based compound.
+
+Peptide name: {$json_name}
+
+Return ONLY valid JSON (no markdown fences) with exactly these fields:
+
+{
+  "is_valid": true or false,
+  "canonical_name": "The standard/official name for this peptide (correcting capitalization or common abbreviations)",
+  "reason": "Brief explanation of why this is or isn't a recognized peptide"
+}
+
+Rules:
+- Return is_valid: true only for real peptides, peptide hormones, peptide-based drugs, neuropeptides, antimicrobial peptides, synthetic peptides used in research, or well-known protein fragments.
+- Return is_valid: false for random words, made-up names, non-peptide drugs, non-peptide supplements, general proteins (unless commonly referred to as peptides), or anything that is clearly not a peptide.
+- Be generous with research peptides and experimental compounds that are known in the scientific literature.
+- Common examples that ARE valid: BPC-157, Thymosin Beta-4, TB-500, GHK-Cu, Melanotan II, Ipamorelin, CJC-1295, Semaglutide, Tirzepatide, AOD-9604, PT-141, DSIP, Epitalon, LL-37, Oxytocin, Vasopressin, Substance P, etc.
+PROMPT;
+	}
+
+	/**
+	 * Build the comprehensive generation prompt.
+	 *
+	 * Constructs a detailed prompt that instructs the AI to generate structured JSON output
+	 * with all required fields for a complete peptide database entry (name, sequence, mechanism,
+	 * research benefits, dosing, safety, legal status, references, etc).
+	 *
+	 * The prompt is designed to ensure the AI returns clean, factual information suitable for
+	 * scientific audiences. Uses JSON encoding for the peptide name to properly escape special characters.
+	 *
+	 * @param string $peptide_name The peptide to research.
+	 * @return string Prompt text ready to send to OpenRouter API.
+	 */
+	private static function build_generation_prompt( $peptide_name ) {
+		$json_name = wp_json_encode( $peptide_name );
+		return <<<PROMPT
+You are a scientific writer specializing in peptide research. Generate a comprehensive database entry for the peptide given in the following JSON-encoded string.
+
+Peptide name: {$json_name}
+
+Return ONLY valid JSON (no markdown fences, no commentary) with exactly these fields:
+
+{
+  "name": "Official peptide name",
+  "aliases": "Comma-separated list of alternative names, abbreviations, or synonyms",
+  "category_label": "e.g. Tissue Healing / Cytoprotective, or GH Secretagogue, etc.",
+  "origin": "Origin description, e.g. Synthetic (derived from human gastric juice protein)",
+  "sequence": "Full amino acid sequence in three-letter code with dashes, e.g. Gly-Glu-Pro-Pro-Pro (N amino acids). Use single-letter if three-letter not standard.",
+  "molecular_weight": "Molecular weight in Daltons (e.g. 1419.53 Da)",
+  "molecular_formula": "Chemical formula (e.g. C62H98N16O22)",
+  "overview": "2-3 paragraphs: what this peptide is, its origin, discovery, and significance. Written for a scientifically literate audience.",
+  "mechanism": "Detailed mechanism of action. Start with an intro paragraph, then describe each pathway as a labeled item like: Pathway name: Description. Separate items with double newlines.",
+  "research_benefits": "Detailed research applications organized by therapeutic area. Use area names as subheadings followed by a paragraph, e.g.:\n\nMusculoskeletal Healing\nParagraph about musculoskeletal research...\n\nGastrointestinal Protection\nParagraph about GI research...\n\nInclude 3-5 areas depending on the peptide.",
+  "administration_dosing": "Include a disclaimer that this is from research only. Then describe: typical research dose range, routes of administration, frequency, and duration from studies.",
+  "safety_side_effects": "Known safety profile from animal studies. Include any anecdotally reported side effects. Note theoretical concerns. Mention that long-term human safety data is limited.",
+  "legal_regulatory": "Current regulatory and legal status. Mention FDA status, WADA status if applicable, classification as research chemical.",
+  "references": "5-8 real published scientific references with authors, title, journal, year. Use real studies only.",
+  "category": "Classify into exactly ONE: GH Secretagogues, Healing & Repair, Melanocortin Peptides, Metabolic & Anti-Aging, Nootropic & Neuroprotective"
+}
+
+Important:
+- Use factual, evidence-based information only.
+- If information is uncertain or unknown, say so explicitly rather than fabricating data.
+- All content is for research and educational purposes.
+- Write in clean paragraphs. Do not use markdown formatting symbols like # or ** or *.
+- For research_benefits, use the therapeutic area name on its own line as a subheading, followed by a descriptive paragraph.
+PROMPT;
+	}
+
+	// -------------------------------------------------------------------------
+	// OpenRouter API Call
+	// -------------------------------------------------------------------------
+
+	/**
+	 * Call OpenRouter API with automatic retry on rate limits.
+	 *
+	 * Implements exponential backoff retry strategy for rate limit (429) errors.
+	 * On first rate limit: waits 5s before retry.
+	 * On second rate limit: waits 10s before retry.
+	 * On third rate limit: waits 20s before final attempt.
+	 * Other errors are returned immediately without retry.
+	 *
+	 * @param string $api_key    The OpenRouter API key.
+	 * @param string $model      The model identifier.
+	 * @param string $prompt     The prompt text.
+	 * @param int    $max_tokens Maximum tokens to generate.
+	 * @return string|WP_Error Response text or error.
+	 */
+	private static function call_openrouter( $api_key, $model, $prompt, $max_tokens = PSA_Config::GENERATION_MAX_TOKENS ) {
+		$max_retries = PSA_Config::API_RETRY_MAX;
+		$base_delay  = PSA_Config::API_RETRY_BASE_DELAY; // seconds
+
+		for ( $attempt = 1; $attempt <= $max_retries; $attempt++ ) {
+			$result = self::call_openrouter_once( $api_key, $model, $prompt, $max_tokens );
+
+			// If not a rate limit error, return immediately.
+			if ( ! is_wp_error( $result ) || 'rate_limited' !== $result->get_error_code() ) {
+				return $result;
+			}
+
+			// Rate limited — retry with exponential backoff.
+			if ( $attempt < $max_retries ) {
+				$delay = $base_delay * pow( 2, $attempt - 1 ); // 5s, 10s, 20s
+				// Avoid blocking PHP workers during WP-Cron execution.
+				if ( defined( 'DOING_CRON' ) && DOING_CRON ) {
+					error_log( 'PSA: Rate limited during cron on attempt ' . $attempt . '/' . $max_retries . '. Returning to free PHP worker.' );
+					return new WP_Error( 'rate_limited', 'Rate limited during background generation. Will retry on next cron trigger.' );
+				}
+				error_log( 'PSA: Rate limited on attempt ' . $attempt . '/' . $max_retries . '. Retrying in ' . $delay . 's...' );
+				sleep( $delay );
+			}
+		}
+
+		error_log( 'PSA: All ' . $max_retries . ' attempts failed due to rate limiting.' );
+		return new WP_Error( 'rate_limited', 'OpenRouter rate limit reached after ' . $max_retries . ' retries. Consider adding credits at openrouter.ai or switching to a non-free model.' );
+	}
+
+	/**
+	 * Single OpenRouter API call (no retry).
+	 *
+	 * @param string $api_key    The OpenRouter API key.
+	 * @param string $model      The model identifier.
+	 * @param string $prompt     The prompt text.
+	 * @param int    $max_tokens Maximum tokens to generate.
+	 * @return string|WP_Error Response text or error.
+	 */
+	private static function call_openrouter_once( $api_key, $model, $prompt, $max_tokens = 4096 ) {
+		$site_url  = get_bloginfo( 'url' );
+		$site_name = get_bloginfo( 'name' );
+
+		$response = wp_remote_post(
+			self::API_URL,
+			array(
+				'timeout' => 120,
+				'headers' => array(
+					'Content-Type'    => 'application/json',
+					'Authorization'   => 'Bearer ' . $api_key,
+					'HTTP-Referer'    => $site_url,
+					'X-Title'         => $site_name,
+				),
+				'body' => wp_json_encode(
+					array(
+						'model'       => $model,
+						'messages'    => array(
+							array(
+								'role'    => 'system',
+								'content' => 'You are a scientific database assistant. Return only valid JSON.',
+							),
+							array(
+								'role'    => 'user',
+								'content' => $prompt,
+							),
+						),
+						'max_tokens'  => $max_tokens,
+						'temperature' => 0.3,
+					)
+				),
+			)
+		);
+
+		if ( is_wp_error( $response ) ) {
+			error_log( 'PSA: OpenRouter connection error: ' . $response->get_error_message() );
+			return new WP_Error( 'api_error', 'Failed to connect to OpenRouter API: ' . $response->get_error_message() );
+		}
+
+		$code     = wp_remote_retrieve_response_code( $response );
+		$raw_body = wp_remote_retrieve_body( $response );
+		$body     = json_decode( $raw_body, true );
+
+		error_log( 'PSA: OpenRouter response code: ' . $code . ' for model: ' . $model );
+
+		if ( 200 !== $code ) {
+			if ( 429 === $code ) {
+				error_log( 'PSA: OpenRouter rate limited (429)' );
+				return new WP_Error( 'rate_limited', 'OpenRouter rate limit reached. Please try again in a few moments.' );
+			}
+			if ( 402 === $code ) {
+				error_log( 'PSA: OpenRouter insufficient credits (402)' );
+				return new WP_Error( 'insufficient_credits', 'OpenRouter account has insufficient credits. Please add funds at openrouter.ai.' );
+			}
+			$msg = $body['error']['message'] ?? ( 'Unknown error (HTTP ' . $code . ')' );
+			error_log( 'PSA: OpenRouter API error (' . $code . '): ' . $msg );
+			error_log( 'PSA: OpenRouter raw response: ' . substr( $raw_body, 0, 500 ) );
+			return new WP_Error( 'api_error', 'OpenRouter API error: ' . $msg );
+		}
+
+		if ( empty( $body['choices'][0]['message']['content'] ) ) {
+			error_log( 'PSA: OpenRouter returned empty content. Raw: ' . substr( $raw_body, 0, 500 ) );
+			return new WP_Error( 'api_error', 'OpenRouter API returned an empty response.' );
+		}
+
+		return $body['choices'][0]['message']['content'];
+	}
+
+	/**
+	 * Parse AI response text into structured data.
+	 *
+	 * @param string $response_text Raw response text.
+	 * @return array|WP_Error Parsed data or error.
+	 */
+	private static function parse_ai_response( $response_text ) {
+		// Strip any <think>...</think> tags (some models like DeepSeek include reasoning).
+		$cleaned = preg_replace( '/<think>.*?<\/think>/s', '', $response_text );
+
+		// Strip markdown code fences if present.
+		$cleaned = preg_replace( '/^```(?:json)?\s*/m', '', $cleaned );
+		$cleaned = preg_replace( '/\s*```\s*$/m', '', $cleaned );
+		$cleaned = trim( $cleaned );
+
+		$data = json_decode( $cleaned, true );
+		if ( JSON_ERROR_NONE !== json_last_error() ) {
+			error_log( 'PSA: JSON parse error: ' . json_last_error_msg() . '. Raw (first 500 chars): ' . substr( $response_text, 0, 500 ) );
+			return new WP_Error(
+				'parse_error',
+				'Failed to parse AI response as JSON: ' . json_last_error_msg()
+			);
+		}
+
+		return $data;
+	}
+
+	/**
+	 * Create a matching Echo Knowledge Base article with full structured content.
+	 *
+	 * @param int   $peptide_post_id The peptide post ID.
+	 * @param array $ai_data         The parsed AI data.
+	 * @param string $peptide_name   The peptide name.
+	 * @param string $post_status    The post status (default: 'draft').
+	 */
+	private static function create_kb_article( $peptide_post_id, $ai_data, $peptide_name, $post_status = 'draft' ) {
+		if ( ! post_type_exists( 'epkb_post_type_1' ) ) {
+			error_log( 'PSA: Echo Knowledge Base not active — skipping KB article.' );
+			return;
+		}
+
+		$title = sanitize_text_field( $ai_data['name'] ?? $peptide_name );
+		$existing = get_posts(
+			array(
+				'post_type'   => 'epkb_post_type_1',
+				'title'       => $title,
+				'post_status' => 'any',
+				'numberposts' => 1,
+			)
+		);
+
+		if ( ! empty( $existing ) ) {
+			error_log( 'PSA: KB article already exists for "' . $peptide_name . '".' );
+			return;
+		}
+
+		// Build header meta line.
+		$cat_label = ! empty( $ai_data['category_label'] ) ? $ai_data['category_label'] : '';
+		$origin    = ! empty( $ai_data['origin'] ) ? $ai_data['origin'] : '';
+		$sequence  = ! empty( $ai_data['sequence'] ) ? $ai_data['sequence'] : '';
+
+		$header = '';
+		if ( $cat_label ) {
+			$header .= '<strong>Category:</strong> ' . esc_html( $cat_label );
+		}
+		if ( $origin ) {
+			$header .= ' | <strong>Origin:</strong> ' . esc_html( $origin );
+		}
+		if ( $sequence ) {
+			$header .= ' | <strong>Sequence:</strong> ' . esc_html( $sequence );
+		}
+
+		// Build full article content.
+		$c = $header ? '<p>' . $header . '</p>' . "\n\n" : '';
+
+		// Overview.
+		$c .= '<h2>Overview</h2>' . "\n";
+		$c .= self::paragraphs( $ai_data['overview'] ?? $ai_data['description'] ?? '' );
+
+		// Mechanism of Action.
+		if ( ! empty( $ai_data['mechanism'] ) ) {
+			$c .= '<h2>Mechanism of Action</h2>' . "\n";
+			$c .= self::paragraphs( $ai_data['mechanism'] );
+		}
+
+		// Research & Potential Benefits (with h3 subheadings).
+		if ( ! empty( $ai_data['research_benefits'] ) || ! empty( $ai_data['research_applications'] ) ) {
+			$c .= '<h2>Research &amp; Potential Benefits</h2>' . "\n";
+			$c .= '<p><em>The following potential benefits are based on animal studies and preclinical research. Human clinical trial data is extremely limited.</em></p>' . "\n";
+			$research = $ai_data['research_benefits'] ?? $ai_data['research_applications'] ?? '';
+			$c .= self::research_with_subheadings( $research );
+		}
+
+		// Administration & Dosing.
+		if ( ! empty( $ai_data['administration_dosing'] ) || ! empty( $ai_data['dosage_info'] ) ) {
+			$c .= '<h2>Administration &amp; Dosing (Research Context)</h2>' . "\n";
+			$c .= '<p><strong>Important:</strong> The following dosing information is derived from animal studies and extrapolated research. This peptide is not approved for human use. This information is provided for educational purposes only.</p>' . "\n";
+			$c .= self::paragraphs( $ai_data['administration_dosing'] ?? $ai_data['dosage_info'] ?? '' );
+		}
+
+		// Safety & Side Effects.
+		if ( ! empty( $ai_data['safety_side_effects'] ) || ! empty( $ai_data['safety_profile'] ) ) {
+			$c .= '<h2>Safety &amp; Side Effects</h2>' . "\n";
+			$c .= self::paragraphs( $ai_data['safety_side_effects'] ?? $ai_data['safety_profile'] ?? '' );
+		}
+
+		// Legal & Regulatory Status.
+		if ( ! empty( $ai_data['legal_regulatory'] ) ) {
+			$c .= '<h2>Legal &amp; Regulatory Status</h2>' . "\n";
+			$c .= self::paragraphs( $ai_data['legal_regulatory'] );
+		}
+
+		// References.
+		if ( ! empty( $ai_data['references'] ) ) {
+			$c .= '<h2>Notable Research References</h2>' . "\n";
+			$c .= self::paragraphs( $ai_data['references'] );
+		}
+
+		// Medical Disclaimer.
+		$c .= "\n" . '<p><strong>Medical Disclaimer:</strong> The information on this page is provided for educational and research purposes only. This peptide is not approved for human therapeutic use. Nothing on this page constitutes medical advice. Always consult a licensed healthcare professional before using any peptide, supplement, or research chemical.</p>';
+
+		$kb_post_id = wp_insert_post(
+			array(
+				'post_title'   => $title,
+				'post_content' => wp_kses_post( $c ),
+				'post_type'    => 'epkb_post_type_1',
+				'post_status'  => $post_status,
+			),
+			true
+		);
+
+		if ( is_wp_error( $kb_post_id ) ) {
+			error_log( 'PSA: Failed to create KB article: ' . $kb_post_id->get_error_message() );
+			return;
+		}
+
+		// Assign KB category.
+		$category_map = array(
+			'GH Secretagogues'          => 'gh-secretagogues',
+			'Healing & Repair'          => 'healing-repair',
+			'Melanocortin Peptides'     => 'melanocortin-peptides',
+			'Metabolic & Anti-Aging'    => 'metabolic-anti-aging',
+			'Nootropic & Neuroprotective' => 'nootropic-neuroprotective',
+		);
+
+		$cat_name = trim( $ai_data['category'] ?? '' );
+		if ( isset( $category_map[ $cat_name ] ) ) {
+			$term = get_term_by( 'slug', $category_map[ $cat_name ], 'epkb_post_type_1_category' );
+			if ( $term ) {
+				wp_set_object_terms( $kb_post_id, array( (int) $term->term_id ), 'epkb_post_type_1_category' );
+			}
+		}
+
+		update_post_meta( $peptide_post_id, 'psa_kb_article_id', $kb_post_id );
+		update_post_meta( $kb_post_id, 'psa_peptide_post_id', $peptide_post_id );
+
+		error_log( 'PSA: Created KB article #' . $kb_post_id . ' for "' . $peptide_name . '"' );
+	}
+
+	/**
+	 * Convert text to HTML paragraphs.
+	 */
+	private static function paragraphs( $text ) {
+		if ( empty( $text ) ) {
+			return '';
+		}
+		$text  = str_replace( "\r\n", "\n", $text );
+		$parts = preg_split( '/\n{2,}/', trim( $text ) );
+		$out   = '';
+		foreach ( $parts as $p ) {
+			$p = trim( $p );
+			if ( '' === $p ) {
+				continue;
+			}
+			$out .= '<p>' . wp_kses_post( $p ) . '</p>' . "\n";
+		}
+		return $out;
+	}
+
+	/**
+	 * Parse research text into h3 subheadings + paragraphs.
+	 */
+	private static function research_with_subheadings( $text ) {
+		if ( empty( $text ) ) {
+			return '';
+		}
+		$text   = str_replace( "\r\n", "\n", trim( $text ) );
+		$blocks = preg_split( '/\n{2,}/', $text );
+		$out    = '';
+		foreach ( $blocks as $block ) {
+			$block = trim( $block );
+			if ( '' === $block ) {
+				continue;
+			}
+			// If block is short (under 80 chars) and has no period, treat as a subheading.
+			if ( strlen( $block ) < 80 && strpos( $block, '.' ) === false ) {
+				$out .= '<h3>' . esc_html( $block ) . '</h3>' . "\n";
+			} else {
+				// Check if first line is a subheading followed by content.
+				$first_nl = strpos( $block, "\n" );
+				if ( false !== $first_nl ) {
+					$first_line = trim( substr( $block, 0, $first_nl ) );
+					$rest       = trim( substr( $block, $first_nl + 1 ) );
+					if ( strlen( $first_line ) < 80 && strpos( $first_line, '.' ) === false ) {
+						$out .= '<h3>' . esc_html( $first_line ) . '</h3>' . "\n";
+						$out .= '<p>' . wp_kses_post( $rest ) . '</p>' . "\n";
+						continue;
+					}
+				}
+				$out .= '<p>' . wp_kses_post( $block ) . '</p>' . "\n";
+			}
+		}
+		return $out;
+	}
+}
diff --git a/includes/class-psa-encryption.php b/includes/class-psa-encryption.php
new file mode 100755
index 0000000..8594203
--- /dev/null
+++ b/includes/class-psa-encryption.php
@@ -0,0 +1,129 @@
+<?php
+/**
+ * Handles encryption/decryption of sensitive data at rest.
+ *
+ * What: Provides AES-256-CBC encryption for API keys stored in the database.
+ * Who calls it: PSA_Admin (encrypt on save), PSA_AI_Generator (decrypt on read).
+ * Dependencies: PHP openssl extension, WordPress wp_salt() function.
+ *
+ * @package PeptideSearchAI
+ * @see     includes/class-psa-admin.php
+ * @see     includes/class-psa-ai-generator.php
+ */
+
+if ( ! defined( 'ABSPATH' ) ) {
+	exit;
+}
+
+class PSA_Encryption {
+
+	/**
+	 * Encrypt plaintext using AES-256-CBC.
+	 *
+	 * Prepends the IV to the ciphertext and base64-encodes the result.
+	 *
+	 * @param string $plaintext The plaintext to encrypt.
+	 * @return string|false Base64-encoded IV + ciphertext, or false on failure.
+	 */
+	public static function encrypt( $plaintext ) {
+		if ( empty( $plaintext ) ) {
+			return false;
+		}
+
+		$key = self::get_key();
+		if ( false === $key ) {
+			return false;
+		}
+
+		// Generate a random IV for this encryption.
+		$iv = openssl_random_pseudo_bytes( 16 );
+		if ( false === $iv ) {
+			return false;
+		}
+
+		// Encrypt using AES-256-CBC.
+		$ciphertext = openssl_encrypt( $plaintext, 'AES-256-CBC', $key, OPENSSL_RAW_DATA, $iv );
+		if ( false === $ciphertext ) {
+			return false;
+		}
+
+		// Prepend IV to ciphertext and base64-encode.
+		$encrypted = base64_encode( $iv . $ciphertext );
+
+		return $encrypted;
+	}
+
+	/**
+	 * Decrypt AES-256-CBC ciphertext.
+	 *
+	 * Expects base64-encoded input with IV prepended (as produced by encrypt()).
+	 *
+	 * @param string $ciphertext The base64-encoded IV + ciphertext.
+	 * @return string|false Decrypted plaintext, or false on failure.
+	 */
+	public static function decrypt( $ciphertext ) {
+		if ( empty( $ciphertext ) ) {
+			return false;
+		}
+
+		$key = self::get_key();
+		if ( false === $key ) {
+			return false;
+		}
+
+		// Base64-decode and extract IV + ciphertext.
+		$data = base64_decode( $ciphertext, true );
+		if ( false === $data || strlen( $data ) < 16 ) {
+			return false;
+		}
+
+		// First 16 bytes are the IV.
+		$iv = substr( $data, 0, 16 );
+		$encrypted_data = substr( $data, 16 );
+
+		// Decrypt.
+		$plaintext = openssl_decrypt( $encrypted_data, 'AES-256-CBC', $key, OPENSSL_RAW_DATA, $iv );
+
+		return $plaintext;
+	}
+
+	/**
+	 * Check if a value looks encrypted.
+	 *
+	 * A value is considered encrypted if it's base64-decodable and contains
+	 * at least 16 bytes (IV) + some ciphertext.
+	 *
+	 * @param string $value The value to check.
+	 * @return bool True if the value appears to be encrypted.
+	 */
+	public static function is_encrypted( $value ) {
+		if ( empty( $value ) || ! is_string( $value ) ) {
+			return false;
+		}
+
+		$data = base64_decode( $value, true );
+		if ( false === $data || strlen( $data ) < 16 ) {
+			return false;
+		}
+
+		return true;
+	}
+
+	/**
+	 * Derive a 32-byte encryption key from WordPress salt.
+	 *
+	 * Uses SHA-256 hash of wp_salt( 'auth' ) to produce a consistent 32-byte key.
+	 *
+	 * @return string|false 32-byte key, or false if salt is unavailable.
+	 */
+	private static function get_key() {
+		$salt = wp_salt( 'auth' );
+		if ( empty( $salt ) ) {
+			return false;
+		}
+
+		// SHA-256 produces a 64-character hex string (32 bytes when decoded).
+		$key = hash( 'sha256', $salt, true );
+		return $key;
+	}
+}
diff --git a/peptide-search-ai.php b/peptide-search-ai.php
new file mode 100755
index 0000000..b049769
--- /dev/null
+++ b/peptide-search-ai.php
@@ -0,0 +1,198 @@
+<?php
+/**
+ * Plugin Name: Peptide Search AI
+ * Plugin URI:  https://example.com/peptide-search-ai
+ * Description: Searchable peptide database with AI-powered auto-population.
+ * Version:     4.0.0
+ * Author:      Terence
+ * License:     GPL v2 or later
+ * Text Domain: peptide-search-ai
+ * Requires at least: 5.8
+ * Requires PHP: 7.4
+ */
+
+if ( ! defined( 'ABSPATH' ) ) {
+	exit;
+}
+
+define( 'PSA_VERSION', '4.0.0' );
+define( 'PSA_PLUGIN_DIR', plugin_dir_path( __FILE__ ) );
+define( 'PSA_PLUGIN_URL', plugin_dir_url( __FILE__ ) );
+define( 'PSA_PLUGIN_FILE', __FILE__ );
+
+require_once PSA_PLUGIN_DIR . 'includes/class-psa-config.php';
+require_once PSA_PLUGIN_DIR . 'includes/class-psa-error.php';
+require_once PSA_PLUGIN_DIR . 'includes/class-psa-encryption.php';
+require_once PSA_PLUGIN_DIR . 'includes/class-psa-post-type.php';
+require_once PSA_PLUGIN_DIR . 'includes/class-psa-search.php';
+require_once PSA_PLUGIN_DIR . 'includes/class-psa-ai-generator.php';
+require_once PSA_PLUGIN_DIR . 'includes/class-psa-pubchem.php';
+require_once PSA_PLUGIN_DIR . 'includes/class-psa-admin.php';
+require_once PSA_PLUGIN_DIR . 'includes/class-psa-template.php';
+
+function psa_init() {
+	PSA_Post_Type::register_peptide_post_type();
+	PSA_Search::init();
+	PSA_AI_Generator::init();
+	PSA_Admin::init();
+	PSA_Template::init();
+}
+add_action( 'init', 'psa_init' );
+
+function psa_admin_init() {
+	PSA_Post_Type::init_admin();
+}
+add_action( 'admin_init', 'psa_admin_init' );
+
+/**
+ * Check if current page is the Echo KB main page.
+ * Uses is_page() which is reliable even in block templates.
+ */
+function psa_is_kb_page() {
+	$settings = get_option( 'psa_settings', array() );
+	$kb_page  = $settings['kb_page_id'] ?? 73;
+	return is_page( $kb_page ) || is_page( 'peptide-database' );
+}
+
+/**
+ * Enqueue assets on pages that need the search:
+ * - Homepage (front page) where the hero search lives
+ * - KB page (page ID 73)
+ * - Any page/post containing the [peptide_search] shortcode
+ * - Single peptide pages
+ */
+function psa_maybe_enqueue_assets() {
+	// Homepage: always enqueue (hero section + search overlay use the shortcode).
+	if ( is_front_page() ) {
+		psa_enqueue_frontend_assets();
+		return;
+	}
+
+	// KB page: enqueue and return early (no $post dependency).
+	if ( psa_is_kb_page() ) {
+		psa_enqueue_frontend_assets();
+		return;
+	}
+
+	global $post;
+	if ( ! is_a( $post, 'WP_Post' ) ) {
+		return;
+	}
+
+	if ( ! has_shortcode( $post->post_content, 'peptide_search' ) && ! is_singular( 'peptide' ) ) {
+		return;
+	}
+
+	psa_enqueue_frontend_assets();
+}
+add_action( 'wp_enqueue_scripts', 'psa_maybe_enqueue_assets' );
+
+/**
+ * Shared helper to enqueue CSS, JS, and localize script.
+ */
+function psa_enqueue_frontend_assets() {
+	wp_enqueue_style(
+		'psa-styles',
+		PSA_PLUGIN_URL . 'assets/css/peptide-search.css',
+		array(),
+		PSA_VERSION
+	);
+
+	wp_enqueue_script(
+		'psa-search',
+		PSA_PLUGIN_URL . 'assets/js/peptide-search.js',
+		array( 'jquery' ),
+		PSA_VERSION,
+		true
+	);
+
+	wp_localize_script(
+		'psa-search',
+		'psaAjax',
+		array(
+			'ajaxurl' => admin_url( 'admin-ajax.php' ),
+			'nonce'   => wp_create_nonce( 'psa_search_nonce' ),
+		)
+	);
+}
+
+/**
+ * On the KB page, hide Echo KB search and inject ours via wp_footer.
+ */
+function psa_replace_kb_search() {
+	if ( ! psa_is_kb_page() ) {
+		return;
+	}
+
+	$search_html = PSA_Search::render_search_form(
+		array(
+			'placeholder' => 'Search for a peptide (e.g., BPC-157, Thymosin Beta-4)...',
+		)
+	);
+	$encoded     = wp_json_encode( $search_html );
+
+	echo '<style>
+		#epkb-ml__module-search { display: none !important; }
+		.psa-kb-search-wrap { background: #4a8c3f; padding: 30px 20px; text-align: center; }
+		.psa-kb-search-wrap h2 { color: #fff; font-size: 26px; margin: 0 0 15px 0; font-weight: 600; }
+		.psa-kb-search-wrap .psa-search-wrap { max-width: 700px; margin: 0 auto; }
+		.psa-kb-search-wrap .psa-search-results,
+		.psa-kb-search-wrap .psa-checking,
+		.psa-kb-search-wrap .psa-pending,
+		.psa-kb-search-wrap .psa-invalid,
+		.psa-kb-search-wrap .psa-error {
+			text-align: left; background: #fff; border-radius: 6px; margin-top: 10px; padding: 15px;
+		}
+	</style>';
+
+	echo '<script>
+		document.addEventListener("DOMContentLoaded", function() {
+			var kbRow = document.getElementById("epkb-ml__row-1");
+			if (!kbRow) return;
+			var wrap = document.createElement("div");
+			wrap.className = "psa-kb-search-wrap";
+			wrap.innerHTML = "<h2>Search Our Peptide Database</h2>" + ' . $encoded . ';
+			kbRow.parentNode.insertBefore(wrap, kbRow);
+		});
+	</script>';
+}
+add_action( 'wp_footer', 'psa_replace_kb_search' );
+
+function psa_activate() {
+	PSA_Post_Type::register_peptide_post_type();
+	flush_rewrite_rules();
+}
+register_activation_hook( __FILE__, 'psa_activate' );
+
+function psa_deactivate() {
+	flush_rewrite_rules();
+}
+register_deactivation_hook( __FILE__, 'psa_deactivate' );
+
+function psa_get_client_ip() {
+	$headers = array(
+		'HTTP_CF_CONNECTING_IP',
+		'REMOTE_ADDR',
+	);
+	foreach ( $headers as $header ) {
+		if ( ! empty( $_SERVER[ $header ] ) ) {
+			$ip = explode( ',', sanitize_text_field( wp_unslash( $_SERVER[ $header ] ) ) );
+			$ip = trim( $ip[0] );
+			if ( filter_var( $ip, FILTER_VALIDATE_IP ) ) {
+				return $ip;
+			}
+		}
+	}
+	return '0.0.0.0';
+}
+
+function psa_get_admin_user_id() {
+	$admins = get_users(
+		array(
+			'role'   => 'administrator',
+			'number' => 1,
+			'fields' => 'ID',
+		)
+	);
+	return ! empty( $admins ) ? (int) $admins[0] : 0;
+}