Everything in the atlas

Not in a project on CAP 7 or earlier: the package declares `@sap/cds` >=8 and `@sap/cds-compiler` >=5 as peer dependencies.

Alerting by mail is not telemetry — if you need traces and metrics correlated across handlers, that is a different layer. It also publishes no repository, so the package is the only thing to read.

SAP prohibits gateway/proxy use for SAP Application APIs; the Atlas separately excludes CAP wrappers around those APIs from its assessed scope. Data changes require application-defined unbound actions, and the adapter supplies no rate limiting, agent-action audit logging, approval workflows or policy enforcement.

Neither the package manifest nor the repository tree declares a licence.

The metadata is inconsistent: the declared repository is github.com/acme/search-vocab and the README installs @acme/search-vocab, neither of which matches the published name. One release, November 2025.

The README is one line and the package carries no licence field. Last released July 2023. The repository the package declares has been deleted — verified against the GitHub API, not just a failed fetch. The package is still on npm, so it installs; the source it was published from is no longer readable, which is a harder thing to discover than a stale version number.

The maintainer marks this early development; expect the contract to move.

When user-dependent responses are cached without user-aware or explicit operation keys, or translated responses share keys across locales. These cases require key isolation; locale-aware keys are off by default.

Archived The declared repository is archived.

Functional boundary The repository is archived, so nothing here will move again. Fine to keep where it already runs; anything new should start from what the current cds deploy leaves open rather than from this.

No license Neither the package manifest nor the repository tree declares a licence.

Functional boundary The Maven coordinate its README gives, io.github.miyasuta:cds-feature-softdelete:1.0.0, does not resolve on Maven Central as of 2026-09-07 — you build and install it from source.

It declares no peer range on [@sap/cds](artifact:sap-cds) and publishes no repository, so there is nothing to read but the package itself and no CI to look at.

The declared repository is archived.

It changes what DELETE means for every client of the annotated projection, so anything that must actually remove a row — an erasure request, a retention job — has to go around it.

For deployed environments, the [README](https://raw.githubusercontent.com/cap-java/cds-feature-attachments/302f61c8bb76a0f54f43482ad91d89bf7dc5540f/README.md) excludes the cds-feature-attachments-fs file-system target, which is intended only for local development and testing.

If document versions are required, the [documented restrictions](https://raw.githubusercontent.com/cap-java/sdm/673769f24ef66fd97daa6a6be41262d45065d3fe/README.md) exclude versioned repositories.

The declared repository is on SAP's internal GitHub (github.tools.sap) and is not publicly reachable, so npm is the only place to read anything about it.

Its own feature comparison marks connection pooling, automatic reconnect, active-active reads, client-side data encryption, statement distribution, Kerberos authentication, the hdbuserstore, promises and TypeScript types as [@sap/hana-client](https://www.npmjs.com/package/@sap/hana-client) only, so a service that wants a pool or a promise API writes both itself over a callback interface. OpenSSL is its one security provider where the other driver lists SAP CommonCryptoLib, OpenSSL and MSCrypto, and it runs on Node.js 18 or later.

Neither the package manifest nor the repository tree declares a licence.

If you need sub-second fan-out to external consumers this is the wrong layer — reach for [Event Mesh](artifact:btp-event-mesh) or Kafka. Without [Redis](external:redis), periodic processing still works but instant dispatch degrades to polling.

Node below 22, or [@sap/cds](artifact:sap-cds) below 9: the package declares the first in engines and the second as a peer dependency. Any mail path other than Microsoft Graph, until a provider is written for it: graph is the only kind that sends, and basic, the kind configured by default, is the base class such a provider extends.

Reach for the original unless you know why you are not. This is a republished copy rather than a fork with a direction of its own: the README points at cap-js/notifications for the details, and nothing here says what was changed or why.

Quiet Release and repository quiet for 57 months.

Functional boundary The package declares `@sap/cds` ^4.5.2 among its dependencies and pins `@sap-cloud-sdk/core` at 1.37.1, so a project on CAP 5 or later is outside the range it states.

Nothing about it is readable from outside the package: there is no repository, no issue tracker, and the npm page carries no readme, so the README, the examples and the changelog can be read only from the tarball or a CDN mirror, and a bug has nowhere to be filed. Provider URLs are called from the plugin with API keys taken from environment variables in a .env file, so on BTP no call resolves through a destination and the keys live in the environment. The npm line stops at 1.0.1 on 3 November 2025; the changelog shipped inside that version is headed v2.1, so the version npm shows and the version the author counts are not the same.

Last released December 2022. Nothing says it fails on current cds, but nothing says it was tried either. The repository the package declares has been deleted — verified against the GitHub API, not just a failed fetch. The package is still on npm, so it installs; the source it was published from is no longer readable, which is a harder thing to discover than a stale version number.

Release and repository quiet for 46 months.

BUSL-1.1 rather than node-rfc's Apache-2.0, so a product you distribute has to be read against the licence and its Additional Use Grant first, and the source is closed: the GitHub repository is the issue tracker and the documentation, nothing else. `RfcServerOptions.bgRfcHandlers` raises instead of accepting handlers, so a server receiving inbound bgRFC units is outside what this does. An ABAP `MESSAGE`-raised failure still arrives with its T100 template rather than the rendered sentence, and the dump name is not reported as `key` for that case.

The maintainer states 0.x is beta with no production SLA, and scopes support deliberately narrowly: direct application-server transport, classic serialization and password authentication on S/4HANA 2023 and NetWeaver 7.50. Anything outside that is untested rather than unsupported.

Neither the package manifest nor the repository tree declares a licence.

Neither the package manifest nor the repository tree declares a licence.

Neither the package manifest nor the repository tree declares a licence.

Neither the package manifest nor the repository tree declares a licence.

Neither the package manifest nor the repository tree declares a licence.