67499506ba
Add PRV_Key_Store (resolver), PRV_Crypto_Helper (libsodium/OpenSSL), PRV_Key_Manager_Renderer (write-only Settings card), PRV_Key_Test_Ajax. Key resolver: PRV_OPENROUTER_API_KEY constant > prv_provider_key_enc option > none. All probe + test paths read key through PRV_Key_Store::get_key(). Security: - Ciphertext only in prv_provider_key_enc (hex nonce:hex ciphertext). - Enc key from SHA-256(AUTH_KEY+SECURE_AUTH_KEY) — never stored. - Plaintext never in options, logs, exceptions, page source, REST, or JS. - manage_options + nonce on set/remove/test. wp-config precedence enforced. - write-only UI: password input always renders empty; status text only. - uninstall.php prv_ wildcard DELETE covers prv_provider_key_enc. Files: 4 new (all ≤300 lines), 14 modified. Tests: test-key-store.php (encrypt/decrypt round-trip, wrong-key fails silently, resolver precedence, write-only render, Remove, constant wins). ARCHITECTURE/CONVENTIONS/CONTEXT/ CHANGELOG all updated in this commit. Agent-Session: 2026-06-15-pr-vision-v0.2.3-api-key-ui
PR Vision
An internal WordPress plugin that runs weekly server-side LLM probes to measure whether peptiderepo.com is cited by AI assistants across core peptides.
v0.1.0 — AI-visibility dashboard only. Internal use; no public-facing output.
Purpose
GEO (Generative Engine Optimization) is peptiderepo.com's #1 strategic goal. This plugin provides the measurement instrument: weekly LLM probes → time-series storage → admin trendline + per-peptide standings.
The displayed metric is a directional proxy — API probes do not replicate the consumer ChatGPT/Gemini experience (different retrieval, personalisation, and system prompts), but they provide a consistent, trackable signal.
Required wp-config.php constants
// OpenRouter API key (sk-or-…) — required for all providers.
define( 'PRV_OPENROUTER_API_KEY', 'sk-or-YOUR_KEY_HERE' );
// Cloudflare AI Gateway routing (optional — falls back to direct OpenRouter).
define( 'PRV_CF_ACCOUNT_ID', 'YOUR_CF_ACCOUNT_ID' );
define( 'PRV_CF_GATEWAY_ID', 'YOUR_GATEWAY_NAME' );
Never commit these values. They are read at runtime from wp-config.php only.
Architecture
See ARCHITECTURE.md for the full file tree, data flow, and design decisions.
Admin page
Navigate to PR Vision in the WordPress admin sidebar (manage_options required).
The page shows:
- A proxy-metric disclaimer note.
- A Chart.js trendline of the visibility score across runs.
- A per-peptide standings table (cited?, our position, top competitor domains).
- Month-to-date cost vs. the monthly cap.
- A "Run now" button to trigger an on-demand probe run.
Scheduling
A weekly WP-Cron event (prv_weekly_probe) is registered on plugin activation and cleared on deactivation. Probe runs (cron or manual) respect the hard monthly budget cap.
Cost cap
Default cap: $5.00 USD/month (configurable via the prv_monthly_budget_usd option). The runner checks the month-to-date spend before each API call and stops gracefully when the cap is reached — partial runs are recorded, never over-spend.
Uninstall
Uninstalling the plugin drops the {prefix}prv_ai_visibility table and deletes all prv_* options. Deactivation only clears the cron schedule.
Developer notes
- PHP 8.1+ required. No runtime Composer dependencies.
- All classes prefixed
PRV_. All options/hooks prefixedprv_. - Files are kept under 300 lines; one class per file.
- See
CONVENTIONS.mdfor naming patterns and extension guides. - See
CONTEXT.mdfor the domain glossary including the visibility score formula.