Help, supported versions and security reports
Where to ask, what is supported, and how to report a vulnerability without making it public.
Ask a question or report a bug
- Search the Docs and the troubleshooting list below first.
- Run pnpm svs explain <code> for any SVS_E error: it prints the cause and the fix.
- Still stuck? Email support@sada.id with the svs about output, the command you ran and the full error.
Who can use Samveys
Samveys is proprietary. Employees and contractors of PT Teknologi Sada Indonesia may use it for the organization’s work. Do not publish or share the packages outside the organization.
Supported versions
| Version | Bug fixes | Security fixes |
|---|---|---|
| Latest major | 18 months after release | 2 years after release |
| Older majors | No | No |
| Unreleased (main) | Best effort | Best effort |
Report a vulnerability
Do not open a public issue, pull request or discussion for a security problem.
- Email support@sada.id with the subject “[security] samveys-framework: <short summary>”.
- Include the affected package and version (or commit), steps to reproduce or a proof of concept, and the impact you expect.
- If the report contains credentials or customer data, say so in the first line and send only what is needed to reproduce.
What happens next
-
Acknowledgement Within 3 business days
A reply confirms the report and names the person handling it.
-
Initial assessment Within 7 business days
Severity (CVSS 4.0), affected versions, and whether a workaround exists.
-
Fix or mitigation Before public disclosure
A patch release for every supported version, reviewed like any other change.
Troubleshooting
I typed svs and got “command not found”. Why?
svs is not a global program; it is the bin of the @samveys/console package. Outside a project, run it through npx @samveys/console …. Inside a project it is a devDependency, so use pnpm svs … or npx svs …. If npx says 404, run the one-time npm config set @samveys:registry step first. Want a bare svs everywhere? npm i -g @samveys/console.
Which Node.js version do I need?
Node.js 26 LTS (26.13.0 or newer). There are no polyfills or compatibility paths; devEngines makes installs fail on older versions on purpose.
Do I have to compile TypeScript during development?
No. Development runs .ts files directly on Node 26 with erasable syntax only. svs build emits dist/ when you deploy.
Can I keep Fastify or Hono?
Yes. @samveys/fastify and @samveys/hono are HTTP drivers: they carry the transport while the Samveys kernel still owns routing, middleware and errors. All three drivers pass the same 29-case conformance suite.
How safe are the templates?
Templates are compiled to ES modules and loaded with import(). Expressions are a parsed subset — no assignments, no new, no functions — and constructor, prototype and __* access is refused at compile time and at run time.
How do I add an optional package?
Install it, then register its plugin in samveys.config.ts. svs add ships recipes for http, validator and testing today.
Who can use Samveys?
It is proprietary and internal: employees and contractors of PT Teknologi Sada Indonesia, for the organization’s work only.
Explain an error code
Live: svs explain inside an HTTP request
GET /_demo/explain?code=… runs createKernel().run(['explain', code, '--json']) from @samveys/console in this server process. The code is validated by a query schema first.
$ svs explain SVS_E044 --json
// press Run