Everything in CAP

Alerting by mail is not telemetry — if you need traces and metrics correlated across handlers, that is a different layer. It also publishes no repository, so the package is the only thing to read.

Archived The declared repository is archived.

Functional boundary For versioned or thumbnail-enabled repositories, or bulk upload and download, the [README](https://raw.githubusercontent.com/vneecious/sap-cap-sdm-plugin/d9f036b16542e5c5b9b6dc704e0ba5f880193212/README.md) labels this an “early release” and lists those features as unsupported.

When user-dependent responses are cached without user-aware or explicit operation keys, or translated responses share keys across locales. These cases require key isolation; locale-aware keys are off by default.

The repository the package declares has been deleted — verified against the GitHub API, not just a failed fetch. The package is still on npm, so it installs; the source it was published from is no longer readable, which is a harder thing to discover than a stale version number.

The declared repository is archived.

Nothing about it is readable from outside the package: there is no repository, no issue tracker, and the npm page carries no readme, so the README, the examples and the changelog can be read only from the tarball or a CDN mirror, and a bug has nowhere to be filed. Provider URLs are called from the plugin with API keys taken from environment variables in a .env file, so on BTP no call resolves through a destination and the keys live in the environment. The npm line stops at 1.0.1 on 3 November 2025; the changelog shipped inside that version is headed v2.1, so the version npm shows and the version the author counts are not the same.

The metadata is inconsistent: the declared repository is github.com/acme/search-vocab and the README installs @acme/search-vocab, neither of which matches the published name. One release, November 2025.

It changes what DELETE means for every client of the annotated projection, so anything that must actually remove a row — an erasure request, a retention job — has to go around it.

Quiet Release and repository quiet for 57 months.

Functional boundary The package declares `@sap/cds` ^4.5.2 among its dependencies and pins `@sap-cloud-sdk/core` at 1.37.1, so a project on CAP 5 or later is outside the range it states.

Release and repository quiet for 46 months.

CAP Java is outside it: the plugin is written for CAP Node.js applications, and `cds add decisions` prints a message and writes nothing in a Java project. A decision needs an answer, so the service cannot be queued: a truthy `queued`, `outboxed` or `outbox` setting fails with `INVALID_CONFIG`, which rules out handing a call to the outbox. The package is not yet on npm, so it is installed from a GitHub release archive, and the subclass hooks, the HTTP mock server, the `cds add` facet and the provider test kit are marked experimental.

Not a way to edit Office formats: the author states that access to a file does not automatically provide native editing of Word documents, spreadsheets or PDFs, and suggests starting with text-based content such as instructions, templates and reports. Not a control point either: a prompt telling the agent to ask for confirmation or to leave a template alone needs enforceable application controls where that is a business requirement, and the host application stays responsible for the authenticated request context and tenant isolation.

CAP Java is outside it: the plugin is written for CAP Node.js applications, and `cds add decisions` prints a message and writes nothing in a Java project. A decision needs an answer, so the service cannot be queued: a truthy `queued`, `outboxed` or `outbox` setting fails with `INVALID_CONFIG`, which rules out handing a call to the outbox. The package is not yet on npm, so it is installed from a GitHub release archive, and the subclass hooks, the HTTP mock server, the `cds add` facet and the provider test kit are marked experimental.

Last released January 2022 at 0.0.21, against a passport strategy Microsoft has since deprecated.

It is a bundle rather than a plugin with one job, and a single release from March 2026 — depending on it for the query helpers brings the auth and validation layers too.

It is a bundle rather than a plugin with one job, and a single release from March 2026 — depending on it for the query helpers brings the auth and validation layers too.

Quiet Release and repository quiet for 31 months.

Functional boundary The annotation sits on a single element, so a rule that spans two fields, or one that needs a lookup, has nowhere in it to go.

When user-dependent responses are cached without user-aware or explicit operation keys, or translated responses share keys across locales. These cases require key isolation; locale-aware keys are off by default.

The declared repository is on SAP's internal GitHub (github.tools.sap) and is not publicly reachable, so npm is the only place to read anything about it.

Release and repository quiet for 46 months.

Nothing about it is readable from outside the package: there is no repository, no issue tracker, and the npm page carries no readme, so the README, the examples and the changelog can be read only from the tarball or a CDN mirror, and a bug has nowhere to be filed. Provider URLs are called from the plugin with API keys taken from environment variables in a .env file, so on BTP no call resolves through a destination and the keys live in the environment. The npm line stops at 1.0.1 on 3 November 2025; the changelog shipped inside that version is headed v2.1, so the version npm shows and the version the author counts are not the same.

The declared repository is github.com/your-username/urp-vocab, an unedited placeholder. Three releases, September 2025.