Everything in CAP

Not in a project on CAP 7 or earlier: the package declares `@sap/cds` >=8 and `@sap/cds-compiler` >=5 as peer dependencies.

Alerting by mail is not telemetry — if you need traces and metrics correlated across handlers, that is a different layer. It also publishes no repository, so the package is the only thing to read.

SAP prohibits gateway/proxy use for SAP Application APIs; the Atlas applies that prohibition to CAP wrappers around those APIs. Data changes require application-defined unbound actions, and the adapter supplies no rate limiting, agent-action audit logging, approval workflows or policy enforcement. In beta, with nine releases in the six weeks after the first, so pin it.

Not published to npm. Install from source.

If document versions are required, [@cap-js/sdm](artifact:cap-js-sdm) excludes versioned repositories in its [documented restrictions](https://raw.githubusercontent.com/cap-js/sdm/ad13b61f21816ebead2d08264a74521cfb75846c/README.md).

Archived The declared repository is archived.

Functional boundary For versioned or thumbnail-enabled repositories, or bulk upload and download, the [README](https://raw.githubusercontent.com/vneecious/sap-cap-sdm-plugin/d9f036b16542e5c5b9b6dc704e0ba5f880193212/README.md) labels this an “early release” and lists those features as unsupported.

When user-dependent responses are cached without user-aware or explicit operation keys, or translated responses share keys across locales. These cases require key isolation; locale-aware keys are off by default.

The maintainer marks this under active development; public APIs, annotation names and OData contracts may still change.

When your adoption policy excludes experimental dependencies: the [maintainer’s README](https://github.com/cap-js/cds-federation-synonyms#about-this-project) explicitly labels this plugin experimental.

The README is one line and the package carries no licence field. Last released July 2023. The repository the package declares has been deleted — verified against the GitHub API, not just a failed fetch. The package is still on npm, so it installs; the source it was published from is no longer readable, which is a harder thing to discover than a stale version number.

The maintainer marks this early development; expect the contract to move.

It declares no peer range on [@sap/cds](artifact:sap-cds) and publishes no repository, so there is nothing to read but the package itself and no CI to look at.

The repository the package declares has been deleted — verified against the GitHub API, not just a failed fetch. The package is still on npm, so it installs; the source it was published from is no longer readable, which is a harder thing to discover than a stale version number.

The declared repository is archived.

Nothing about it is readable from outside the package: there is no repository, no issue tracker, and the npm page carries no readme, so the README, the examples and the changelog can be read only from the tarball or a CDN mirror, and a bug has nowhere to be filed. Provider URLs are called from the plugin with API keys taken from environment variables in a .env file, so on BTP no call resolves through a destination and the keys live in the environment. The npm line stops at 1.0.1 on 3 November 2025; the changelog shipped inside that version is headed v2.1, so the version npm shows and the version the author counts are not the same.

When your adoption policy excludes experimental dependencies: the [maintainer’s README](https://github.com/cap-js/cds-federation-synonyms#about-this-project) explicitly labels this plugin experimental.

Release and repository quiet for 39 months.

The metadata is inconsistent: the declared repository is github.com/acme/search-vocab and the README installs @acme/search-vocab, neither of which matches the published name. One release, November 2025.

No license Neither the package manifest nor the repository tree declares a licence.

Functional boundary The Maven coordinate its README gives, io.github.miyasuta:cds-feature-softdelete:1.0.0, does not resolve on Maven Central as of 2026-09-07 — you build and install it from source.

It changes what DELETE means for every client of the annotated projection, so anything that must actually remove a row — an erasure request, a retention job — has to go around it.

If you need sub-second fan-out to external consumers this is the wrong layer — reach for [Event Mesh](artifact:btp-event-mesh) or Kafka. Without [Redis](external:redis), periodic processing still works but instant dispatch degrades to polling.

Last released December 2022. Nothing says it fails on current cds, but nothing says it was tried either. The repository the package declares has been deleted — verified against the GitHub API, not just a failed fetch. The package is still on npm, so it installs; the source it was published from is no longer readable, which is a harder thing to discover than a stale version number.

Release and repository quiet for 24 months.

Node below 22, or [@sap/cds](artifact:sap-cds) below 9: the package declares the first in engines and the second as a peer dependency. Any mail path other than Microsoft Graph, until a provider is written for it: graph is the only kind that sends, and basic, the kind configured by default, is the base class such a provider extends.

Reach for the original unless you know why you are not. This is a republished copy rather than a fork with a direction of its own: the README points at cap-js/notifications for the details, and nothing here says what was changed or why.

Not as a gateway or proxy for SAP Application APIs: capire's guide states that CAP-level agents are intended only for exposing custom CAP application services and are not an SAP-endorsed architecture or pathway for agentic access to those APIs, and sends the reader to the SAP Architecture Center for the endorsed routes. Not as the screen a user of the application talks to, either — the chat preview in the generic index.html page is marked experimental and for local development.

No public repository is declared on the package, so the README is the documentation.

Not where the agent is reached over anything other than A2A: the README states the plugin does not speak anything other than A2A as @cap-js/agents serves it. Not where an upgrade has to be uneventful either — it pins @cap-js/agents to exactly 0.9.1, calls that package pre-1.0 and days old at the time of writing, and says this plugin inherits that instability and to expect breakage on upgrade.

Not where the records sit anywhere but [SAP HANA Cloud](artifact:btp-hana-cloud): the similarity search and the single retrieval method are both written against its vector engine, and the embeddings and the chat call go through [SAP AI Core](artifact:btp-ai-core), so a project without both has nothing here to call. Not where the dependency has to be an SAP-supported one either: the README states that the plugin is not an official SAP product and is published as a community contribution.

Not where the records sit anywhere but [SAP HANA Cloud](artifact:btp-hana-cloud): the similarity search and the single retrieval method are both written against its vector engine, and the embeddings and the chat call go through [SAP AI Core](artifact:btp-ai-core), so a project without both has nothing here to call. Not where the dependency has to be an SAP-supported one either: the README states that the plugin is not an official SAP product and is published as a community contribution.

It is text processing, not an agent: there is no tool calling, no retrieval and no conversation. It needs SAP AI Core, and the backend half needs [@sap-ai-sdk/orchestration](artifact:sap-ai-sdk-orchestration) installed alongside it — an optional peer, so a frontend-only install stays lean.

Not where the records sit anywhere but [SAP HANA Cloud](artifact:btp-hana-cloud): the similarity search and the single retrieval method are both written against its vector engine, and the embeddings and the chat call go through [SAP AI Core](artifact:btp-ai-core), so a project without both has nothing here to call. Not where the dependency has to be an SAP-supported one either: the README states that the plugin is not an official SAP product and is published as a community contribution.

No public repository is declared on the package, so the README is the documentation.

Last released January 2022 at 0.0.21, against a passport strategy Microsoft has since deprecated.

Last released April 2022 at 0.0.2, and no repository is declared on the package.

Quiet Release and repository quiet for 25 months.

Functional boundary It performs no authentication flow of its own. The app must already be protected by Entra ID OAuth 2.0 at the App Service level; this only maps the resulting claims. It is explicitly not intended to run locally.

Quiet Release and repository quiet for 30 months.

Functional boundary The annotation sits on a single element, so a rule that spans two fields, or one that needs a lookup, has nowhere in it to go.

Last released January 2024 at 0.0.6. The repository the package declares has been deleted — verified against the GitHub API, not just a failed fetch. The package is still on npm, so it installs; the source it was published from is no longer readable, which is a harder thing to discover than a stale version number.

It audits through npm: a project that resolves its dependencies with another package manager, or has no `package.json`, has nothing for it to run. What it reports is what `npm audit` knows, so a vulnerability outside the npm advisory data is not in its table.

A team that does not keep one long-lived branch per environment has no environment branches for it to compare feature branches against. What it reports is the merge state of branches in Git, so it says nothing about whether a merged change has been built or deployed to the environment.

Last released June 2022 at 0.0.6, and no repository is declared on the package.

If you need sub-second fan-out to external consumers this is the wrong layer — reach for [Event Mesh](artifact:btp-event-mesh) or Kafka. Without [Redis](external:redis), periodic processing still works but instant dispatch degrades to polling.