MevvCode — Mevvsoft Documentation

What MevvCode is for

MevvCode is a home for small pieces of site-specific behaviour: a WooCommerce shipping rule, a checkout field, a verification tag, a short admin tool, a visual CSS fix or reusable HTML/text. It gives code an owner, a location, conditions, history and a guarded route into production.

Use it when: The change is smaller than a full plugin but important enough that it should not disappear inside a theme file.
Do not use it when: The requirement is a complete domain product with its own data model, screens and release lifecycle; build a conventional plugin instead.
Code ownership: Write the code yourself or bring reviewed code from a developer or source you trust. MevvCode manages and protects code; it does not make an unknown snippet trustworthy.

Start every borrowed snippet inactive. Read it, remove secrets and site-specific identifiers, then validate it before activation.

Installation

Install and activate the free MevvCode plugin first. It requires WordPress 6.6 or newer and PHP 8.1 or newer. Pro is a separate companion plugin and never replaces the free runtime.

Upload mevvcode-1.1.0.zip and activate it.
Open MevvCode → Snippets. The storage directory and its web-server protection files are created automatically.
Create an inactive snippet, choose its type and location, then save it.
Use the preview and syntax result before activating it.
Install mevvcode-pro-1.1.0.zip only if you need the Pro surfaces, then activate your MEVD licence under MevvCode → Licence.

Keep the free plugin active when Pro is installed. The executable runtime belongs to Free so a lapsed licence never makes already-published behaviour disappear.

Your first snippet

Create the first record inactive. Give it a purpose-led name, select PHP and the global location only if the code itself attaches to a narrow WordPress or WooCommerce hook, then save.

add_filter( 'woocommerce_package_rates', function ( $rates ) {
    if ( ! WC()->cart || WC()->cart->get_subtotal() < 1000 ) {
        return $rates;
    }
    return array_filter( $rates, function ( $rate ) {
        return 'free_shipping' === $rate->method_id;
    } );
} );

Read the validation result; a parse error must leave the record inactive.
Confirm that your store already has a free-shipping method configured.
Activate the snippet in staging and test carts below and above the threshold.
Export a JSON copy before carrying the record to production.
Publish, then verify the public cart and the MevvCode health endpoint.

The example demonstrates the workflow, not a universal shipping policy. Taxes, coupons, currencies and shipping zones can change which subtotal your business rule should use.

Turkish dashboard and plugin row

Free and Pro 1.1.0 ship editable PO, compiled MO and POT catalogues. When the WordPress site language is Türkçe (tr_TR), the dashboard, migration states, validation errors and licence screen load in Turkish automatically.

The Plugins screen shows the translated description.
Settings opens the MevvCode settings tab directly.
Documentation opens this page and Support opens the contact page.
WordPress dependency handling prevents Free from being removed while MevvCode Pro requires it.

If the Turkish dashboard does not load, check Settings → General → Site Language, then update both Free and Pro to the same version. Do not rename files under the languages directory.

The runtime model

Editable records live under wp-content/mevvcode-snippets/records. Saving an active change builds a new generation in a temporary directory, validates every PHP file, writes a manifest and only then swaps the current pointer.

Records: The editable source, metadata, conditions and history.
Generation: Immutable compiled files for one known-good state.
Manifest: The small map the request path reads to find the current generation.

A compile failure does not partially update the site. The old manifest remains current, the failed source stays editable and the dashboard shows the error. There is no per-request query for snippet code.

Do not edit generated files by hand. They are disposable build output and will be replaced by the next successful compile.

Types, locations and conditions

PHP runs through WordPress hooks. JavaScript, CSS, HTML and text are printed only at the explicit location you select: head, body-open, footer, before or after content, shortcode, manual or once.

AND applies inside one condition group; groups are joined with OR.
Admin, front-end, URL, user, role and request context can be combined.
Tags and groups organise records; a lock prevents accidental edits and bulk actions.
A manual snippet never joins a request hook until your own code calls it.

Use the narrowest location and condition that describes the requirement. A global PHP hook should be a deliberate choice, not the default home for code copied from a support ticket.

The library and the packs

The Library tab holds sixty reviewed snippets for the ordinary jobs people otherwise paste out of a forum post: disabling XML-RPC, dropping the emoji assets, adding a skip link, marking external links noopener, WooCommerce tweaks. Adding one copies it into your own workspace as an inactive record — you read it, then you switch it on. Nothing installs itself running.

Six packs group them for a job rather than a category: store launch, checkout cleanup, catalogue tuning, store performance, hardening basics and admin tidy. A pack is all-or-nothing — if one of its snippets cannot be written, the ones already written are rolled back, so you never end up with half a pack and no way to tell which half.

Library records are copies. Editing one in your workspace never changes the library, and a later plugin update never edits what you have already customised.

Migrating from Code Snippets

Open MevvCode → Migration. The importer reads the site-prefix snippets table, preserves every source id and the exact code bytes, and creates staged MevvCode records without changing which plugin is active.

Run detection and inspect the record count.
Import into the staged, inactive set.
Parse every snippet that is active in Code Snippets.
Create a rollback snapshot of the active-plugin list and current MevvCode manifest.
Compile one complete generation.
Start the cutover. Code Snippets is switched off only after the manifest exists.
A signed loopback request checks the public site. Success commits; failure restores the plugin list and manifest automatically.

The source tables are not deleted. Manual rollback remains available after a successful cutover, and re-enables the exact former active-plugin list. On mevvshop.com on 1 September 2026, the measured production cutover preserved 9 records, 6 active states and produced 0 mismatches across name, exact code bytes, priority and status. That is evidence for that store, not a universal benchmark.

If an imported snippet fails parsing, fix the staged MevvCode copy or leave it inactive. Do not deactivate Code Snippets by hand before the cutover reports a healthy generation.

Safe mode and recovery

Safe mode can be entered with the documented constant or a short-lived signed URL generated for an administrator. In safe mode snippet execution stops while the dashboard remains available for repair.

A PHP parse error never becomes the current generation.
A runtime exception disables the responsible record and leaves other snippets available.
A fatal guard records only the record identity and state needed for recovery — never the source code or request secrets.
The previous known-good generation is retained until the replacement passes all checks.

define( 'MEVVCODE_SAFE_MODE', true );

Remove the constant after the broken record has been fixed or disabled. Leaving it in place intentionally keeps all snippets off.

Portability and backups

Export selected records as MevvCode JSON v1 for a lossless round trip, or as readable PHP when the destination should not depend on MevvCode. Code Snippets and WPCode imports are adapters into the same canonical record format.

A JSON export includes metadata, conditions and status.
A PHP export is meant for review and manual ownership, not for re-importing hidden metadata.
The must-use loader can carry compiled behaviour when the normal plugin must be removed.
Pro can package selected snippets as a conventional functionality plugin ZIP after validating names, paths and PHP.

Keep an off-site copy of exports before a large import, bulk activation or migration. Revisions are an editing history, not a disaster-recovery backup.

Free and Pro

Free is the complete safe local snippet manager. It includes all five types, the atomic runtime, locations and base conditions, the fatal guard, safe mode, Code Snippets migration, import/export, generators, revisions, role capabilities, read-only REST and the must-use loader.

Pro is the collaboration and delivery layer. It adds reusable and scheduled conditions; device, referrer, geo, cart and order context; unlimited audit history; CSS/JS builds and external assets; ecommerce pixel events with a live monitor; signed automation; plugin export; local aggregate insights; encrypted cloud workspaces; opt-in AI review and AI drafting with your own provider key; and an action-gated REST/MCP-compatible API.

Cloud and AI are separate opt-ins. AI receives the redacted copy and returns a review diff; it never applies the diff automatically. Cloud writes use an HMAC signed with the licence key and optimistic revisions reject stale updates.

Drafting a snippet with AI

Pro can draft a snippet from a description of what you need. It is strictly bring-your-own: you choose the provider — OpenAI or Anthropic — and paste your own API key, and the request goes from your site straight to that provider. Generation does not pass through our servers at all. AI is off until you switch it on.

What comes back is always saved as an inactive draft. Generated code is never applied, activated or run on its own.
A proposal that does not pass the same PHP syntax gate the free compiler applies before activation is not saved at all, so a snippet that would fatal the site never reaches your list.
All five snippet types can be drafted: PHP, JavaScript, CSS, HTML and text.

AI review and AI drafting are different features and take different routes. Review sends a redacted copy of code you already have to our own endpoint with your licence key and returns a diff; drafting talks only to your chosen provider with your own key. Both are separate opt-ins, and neither applies anything by itself.

Country condition and SCSS (Pro)

Running a snippet only in some countries

Pro adds a country condition to the same rule editor the free edition uses. The country is resolved from the WooCommerce customer’s own billing or shipping address, and failing that from a geolocation database installed on your server. It is never asked of a third-party lookup service, and no visitor address is stored — the question is answered locally or it is not answered at all.

Writing SCSS

The Styles screen compiles SCSS or LESS and files the result as a new CSS snippet, inactive, for you to read before switching on. It is a deliberate detour rather than a hook on the CSS editor: what runs on your site stays plain CSS you can open.

The compiler is written for this one job — variables, nesting, the ampersand, and media, supports, layer and container rules bubbled outwards. What it does not implement it refuses with an error: mixins, extends, imports, control directives and interpolation. Refusing is the point. A compiler that half-supports a directive produces CSS that is subtly not what you wrote, and you find out on the front end.

Live pixel events

Pro normalises ecommerce events for Meta, Google and TikTok — view item, add to cart, begin checkout and purchase — and can show them arriving while you work, so you can see that an event actually fires and carries the values you expect. Capture is off by default and has to be switched on deliberately.

Events stay on your own site. There is no third-party collector anywhere in that path.
Only the last two hundred events are kept, in a rolling buffer. Nothing older survives and there is no table to grow.
No IP address, no cookie, no identifier and no query string is stored. Where an email address or a phone number belongs to the event, it is hashed with SHA-256 first.

This is a monitor for checking your events, not analytics. It keeps no history you could build a report from, and it is not meant to.

Finding and activating a Pro licence

A purchased licence is associated with the checkout email and appears at mevvsoft.com/account. The key begins with MEVD; never paste it into a support ticket, URL or public log.

Install and activate the free MevvCode package.
Install and activate the matching MevvCode Pro package.
Sign in to the account created for the checkout email and copy the MevvCode Pro key.
Open MevvCode → Licence, paste the MEVD key and activate it.
Confirm that the status is active and the site appears against the licence in your account.

If the licence is absent from the account, first confirm that you signed in with the same email used at checkout. If it is present but activation reports a site limit, release an old site from the account or contact support without sending the full key.

Updates

Updates arrive through WordPress itself. The plugin asks our store whether a newer version exists and hands the answer to WordPress’s own update flow, so a new release turns up on the plugins screen with an ordinary Update button instead of waiting for someone to fetch a zip by hand. In the free edition that request carries only the package name and the installed version — no site address, no e-mail address, no licence key and no plugin inventory. Because nothing in it identifies you, trust rests on the signature: the reply is signed with our Ed25519 key, and one that is unsigned, wrongly signed, replayed from an old timestamp or that points the download at any host but ours is discarded without touching the site.

FAQ and troubleshooting

A snippet saved but did not run: Check that it is active, its location matches the request, every condition group can be satisfied and safe mode is off.
The old plugin is still active after migration: The cutover did not commit. Read the migration result; a parse, compile or loopback health check failed and rollback protected the site.
The site entered safe mode: Open the dashboard through the signed recovery URL, inspect the most recently disabled record, fix or leave it disabled, compile, then leave safe mode.
Cloud reports a conflict: Another client changed the workspace after the revision you loaded. Compare the remote record with your local record and push again using the new base revision.
AI review is unavailable: Both the Pro licence and the explicit AI opt-in must be active, and the service adapter must be configured. Local snippets continue working.

When asking for support, send the plugin versions, WordPress/PHP versions, the record UUID and the exact error text. Remove secrets and customer data. Do not send a production licence key or the complete source unless it is necessary and you have reviewed it.

Run small code with a real safety boundary.