We built DEV3 AI Content & Layout Builder as a WordPress plugin in PHP with React-based editor integrations, using the Google Gemini API through the customer's own encrypted API key.
Key design decisions
- One builder-neutral layout tree. The model fills a single response schema: sections → columns → widgets, with 15 widget types such as heading, text, price, period toggle, accordion and testimonial. The same tree is converted to Elementor elements and to WPBakery shortcodes, so the AI never has to know either builder's internal format.
- Normalise before converting.
Layout_Schema::normalize() drops unknown widgets, caps sections, columns and items, rebalances column widths to 100%, sanitises HTML, URLs and Font Awesome classes, and turns a price card with no amount into a heading instead of an empty card.
- Native widgets only. Elementor output uses free core widgets in container (flexbox) or legacy section/column mode, detected from the site. WPBakery output uses core elements with correctly escaped attributes. A small frontend script powers the billing-period toggle and loads only on pages that use it.
- Reliable structured output. Copy and JSON tasks on gemini-2.5-flash run with low temperature and schema length caps; vision gets a small thinking budget; layouts get an explicit 2,048-token thinking budget and room for long answers; malformed or truncated JSON gets one near-deterministic retry.
- Editor-native entry points. A wand on Elementor text controls plus "Write with AI" and "Generate items" for accordions, tabs and toggles; WPBakery params and a navbar button; a block-editor toolbar button and AI sidebar with SEO meta; alt text, caption and title in Media Library attachment details.
Architecture
All editors call one REST namespace. A prompt orchestrator builds the system instruction, prompt and schema per task (rewrite, tone, translate, SEO meta, items, vision, layout), the client calls the API, and the response parser turns the answer into plain text, safe HTML or validated JSON. Every generation is rate-limited per user, logged with tokens and latency, and stored in a per-user history that can be restored. The API key is encrypted with AES-256-GCM and never sent to the browser. Licensing, updates and the settings shell come from a shared core used across DEV3's plugins.