Everything in the atlas

It is a bundle, not a plugin with one job. Depending on it for one feature brings the rest.

If document versions are required, [@cap-js/sdm](artifact:cap-js-sdm) excludes versioned repositories in its [documented restrictions](https://raw.githubusercontent.com/cap-js/sdm/ad13b61f21816ebead2d08264a74521cfb75846c/README.md).

The metadata is inconsistent: the declared repository is github.com/acme/search-vocab and the README installs @acme/search-vocab, neither of which matches the published name. One release, November 2025.

Release and repository quiet for 39 months.

The maintainer marks this under active development; public APIs, annotation names and OData contracts may still change.

Nothing about it is readable from outside the package: there is no repository, no issue tracker, and the npm page carries no readme, so the README, the examples and the changelog can be read only from the tarball or a CDN mirror, and a bug has nowhere to be filed. Provider URLs are called from the plugin with API keys taken from environment variables in a .env file, so on BTP no call resolves through a destination and the keys live in the environment. The npm line stops at 1.0.1 on 3 November 2025; the changelog shipped inside that version is headed v2.1, so the version npm shows and the version the author counts are not the same.

The maintainer marks this early development; expect the contract to move.

When user-dependent responses are cached without user-aware or explicit operation keys, or translated responses share keys across locales. These cases require key isolation; locale-aware keys are off by default.

Archived The declared repository is archived.

Functional boundary The repository is archived, so nothing here will move again. Fine to keep where it already runs; anything new should start from what the current cds deploy leaves open rather than from this.

When your adoption policy excludes experimental dependencies: the [maintainer’s README](https://github.com/cap-js/cds-federation-synonyms#about-this-project) explicitly labels this plugin experimental.

It declares no peer range on [@sap/cds](artifact:sap-cds) and publishes no repository, so there is nothing to read but the package itself and no CI to look at.

The repository the package declares has been deleted — verified against the GitHub API, not just a failed fetch. The package is still on npm, so it installs; the source it was published from is no longer readable, which is a harder thing to discover than a stale version number.

The declared repository is archived.

It changes what DELETE means for every client of the annotated projection, so anything that must actually remove a row — an erasure request, a retention job — has to go around it.

For deployed environments, the [README](https://raw.githubusercontent.com/cap-java/cds-feature-attachments/302f61c8bb76a0f54f43482ad91d89bf7dc5540f/README.md) excludes the cds-feature-attachments-fs file-system target, which is intended only for local development and testing.

If document versions are required, the [documented restrictions](https://raw.githubusercontent.com/cap-java/sdm/673769f24ef66fd97daa6a6be41262d45065d3fe/README.md) exclude versioned repositories.

Archived The declared repository is archived.

Functional boundary For versioned or thumbnail-enabled repositories, or bulk upload and download, the [README](https://raw.githubusercontent.com/vneecious/sap-cap-sdm-plugin/d9f036b16542e5c5b9b6dc704e0ba5f880193212/README.md) labels this an “early release” and lists those features as unsupported.

Not where the UI library itself is expected to bind data: the documentation leaves binding a component's content and events to the host framework. Not from a CDN script tag: the project publishes none, so it assumes a build step.

No published releases; repository quiet for 26 months.

Not an end-user app: it reads from any table the user names and writes into tables of the Z/Y namespace, with no authorisation check of its own, so the README asks a project to add its own checks on `S_TABU_DIS`/`S_TABU_NAM` and to restrict who may run it before it is used beyond a development system. XLSX upload and download are not ready for ABAP Cloud yet, and of the upload apps only the JSON one writes the file's rows back to the database.

No published releases; repository quiet for 66 months.

Release and repository quiet for 80 months.

Where the release and programming model offer durable locks, as RAP draft handling does, the README states that those solve the problem at the kernel level and the lock manager is for where that is not an option. A running handler occupies one background work process for as long as any lock is held, and only generated `ENQUEUE_*` modules can be locked.

No published releases; repository quiet for 81 months.

Not for a table whose contents matter, and not for one chosen at run time: the name of the table is fixed in the calling code, and the maintainer's own warning is "only hardcode the table name, don't use with important tables, use at own risk!"

No published releases; repository quiet for 24 months.

No published releases; repository quiet for 72 months.

The app writes to whatever table is passed in the URL parameter `table` and carries no authorisation check of its own, so past a development system it needs authorisation checks added and a restriction on who may run it.

Not where SAP's own Google Workspace integration already applies: the README opens by announcing a native integration between Google Workspace and [SAP S/4HANA](external:sap-s4hana), whose first set of features is included in SAP S/4HANA Cloud 2208 and SAP S/4HANA 2022 and needs an additional licence for the SAP Document Management Service. Not where end users cannot each hold a regular Google account, since there is no way to use an enterprise account or to log on to Google Drive through single sign-on, and not where the redirect URL Google calls cannot reach a public top-level domain server. No SAP standard support is provided for it.

It writes and it administers — ETL extraction and database user management are not read operations, and the same connection that profiles a column can move data out of the tenant. Masking is only as good as the configuration naming the fields, so an unlisted sensitive column is an unmasked one.

Its README says it plainly and so does this entry: this is not a simulation, every tool call reaches a live BW system, and write operations produce real changes. BW modelling objects are the definition of a warehouse — the blast radius of a wrong one is every report built on it.

Its own feature comparison marks connection pooling, automatic reconnect, active-active reads, client-side data encryption, statement distribution, Kerberos authentication, the hdbuserstore, promises and TypeScript types as [@sap/hana-client](https://www.npmjs.com/package/@sap/hana-client) only, so a service that wants a pool or a promise API writes both itself over a callback interface. OpenSSL is its one security provider where the other driver lists SAP CommonCryptoLib, OpenSSL and MSCrypto, and it runs on Node.js 18 or later.

It reaches a data warehouse, so what an agent can see is business data by definition — the SQL sanitisation and PII filtering in the server are there because of that, not instead of a decision about it. And the guidance is Datasphere-shaped: nothing here transfers to a HANA Cloud database used directly.

Ninety tools is a large surface to put in front of a model at once, and client-credentials OAuth means the tenant sees one identity rather than the person asking. Content transport and user management sit in the same tool list as reading a story.