Everything in the atlas

Not in a project on CAP 7 or earlier: the package declares `@sap/cds` >=8 and `@sap/cds-compiler` >=5 as peer dependencies.

Alerting by mail is not telemetry — if you need traces and metrics correlated across handlers, that is a different layer. It also publishes no repository, so the package is the only thing to read.

It is a bundle, not a plugin with one job. Depending on it for one feature brings the rest.

Not a system to run a business application on: there is no business application in it, and what it implements of the language, the dictionary and Gateway is a stated subset of each. It is a clean-room reimplementation of the `/IWBEP/` interfaces that bundles no SAP source and no standard DDIC, so a service that reads standard objects has nothing to read, and `ANORMALIES.md` records every place the runtime differs from SAP before any workaround is written.

On an [SAP BTP ABAP environment](artifact:btp-abap-environment) system only the generated code is left: DDIC creation is not supported on ABAP Cloud, because classic DDIC object creation over REST is not available there. Create DDIC is also disabled where ADT is not installed in the same Eclipse, and Insert into Editor then works with any editor implementing `ITextEditor` instead of the ABAP one.

SAP prohibits gateway/proxy use for SAP Application APIs; the Atlas applies that prohibition to CAP wrappers around those APIs. Data changes require application-defined unbound actions, and the adapter supplies no rate limiting, agent-action audit logging, approval workflows or policy enforcement. In beta, with nine releases in the six weeks after the first, so pin it.

The repository the package declares has been deleted — verified against the GitHub API, not just a failed fetch. The package is still on npm, so it installs; the source it was published from is no longer readable, which is a harder thing to discover than a stale version number.

Not published to npm. Install from source.

SAP prohibits gateway/proxy use for SAP Application APIs; the Atlas separately excludes CAP wrappers around those APIs from its assessed scope. Data changes require application-defined unbound actions, and the adapter supplies no rate limiting, agent-action audit logging, approval workflows or policy enforcement.

Its README says it plainly and so does this entry: this is not a simulation, every tool call reaches a live BW system, and write operations produce real changes. BW modelling objects are the definition of a warehouse — the blast radius of a wrong one is every report built on it.

Ninety tools is a large surface to put in front of a model at once, and client-credentials OAuth means the tenant sees one identity rather than the person asking. Content transport and user management sit in the same tool list as reading a story.

For deployed environments, the [README](https://raw.githubusercontent.com/cap-java/cds-feature-attachments/302f61c8bb76a0f54f43482ad91d89bf7dc5540f/README.md) excludes the cds-feature-attachments-fs file-system target, which is intended only for local development and testing.

If document versions are required, the [documented restrictions](https://raw.githubusercontent.com/cap-java/sdm/673769f24ef66fd97daa6a6be41262d45065d3fe/README.md) exclude versioned repositories.

It is a bundle, not a plugin with one job. Depending on it for one feature brings the rest.

When user-dependent responses are cached without user-aware or explicit operation keys, or translated responses share keys across locales. These cases require key isolation; locale-aware keys are off by default.

The maintainer marks this under active development; public APIs, annotation names and OData contracts may still change.

It is a bundle, not a plugin with one job. Depending on it for one feature brings the rest.

The README is one line and the package carries no licence field. Last released July 2023. The repository the package declares has been deleted — verified against the GitHub API, not just a failed fetch. The package is still on npm, so it installs; the source it was published from is no longer readable, which is a harder thing to discover than a stale version number.

The maintainer marks this early development; expect the contract to move.

It declares no peer range on [@sap/cds](artifact:sap-cds) and publishes no repository, so there is nothing to read but the package itself and no CI to look at.

The declared repository is archived.

Its own feature comparison marks connection pooling, automatic reconnect, active-active reads, client-side data encryption, statement distribution, Kerberos authentication, the hdbuserstore, promises and TypeScript types as [@sap/hana-client](https://www.npmjs.com/package/@sap/hana-client) only, so a service that wants a pool or a promise API writes both itself over a callback interface. OpenSSL is its one security provider where the other driver lists SAP CommonCryptoLib, OpenSSL and MSCrypto, and it runs on Node.js 18 or later.

Its README says it plainly and so does this entry: this is not a simulation, every tool call reaches a live BW system, and write operations produce real changes. BW modelling objects are the definition of a warehouse — the blast radius of a wrong one is every report built on it.

Ninety tools is a large surface to put in front of a model at once, and client-credentials OAuth means the tenant sees one identity rather than the person asking. Content transport and user management sit in the same tool list as reading a story.

Nothing about it is readable from outside the package: there is no repository, no issue tracker, and the npm page carries no readme, so the README, the examples and the changelog can be read only from the tarball or a CDN mirror, and a bug has nowhere to be filed. Provider URLs are called from the plugin with API keys taken from environment variables in a .env file, so on BTP no call resolves through a destination and the keys live in the environment. The npm line stops at 1.0.1 on 3 November 2025; the changelog shipped inside that version is headed v2.1, so the version npm shows and the version the author counts are not the same.

It is a bundle, not a plugin with one job. Depending on it for one feature brings the rest.

Archived The declared repository is archived.

Functional boundary The repository is archived, so nothing here will move again. Fine to keep where it already runs; anything new should start from what the current cds deploy leaves open rather than from this.

The metadata is inconsistent: the declared repository is github.com/acme/search-vocab and the README installs @acme/search-vocab, neither of which matches the published name. One release, November 2025.

No license Neither the package manifest nor the repository tree declares a licence.

Functional boundary The Maven coordinate its README gives, io.github.miyasuta:cds-feature-softdelete:1.0.0, does not resolve on Maven Central as of 2026-09-07 — you build and install it from source.

It changes what DELETE means for every client of the annotated projection, so anything that must actually remove a row — an erasure request, a retention job — has to go around it.

If you need sub-second fan-out to external consumers this is the wrong layer — reach for [Event Mesh](artifact:btp-event-mesh) or Kafka. Without [Redis](external:redis), periodic processing still works but instant dispatch degrades to polling.

Last released December 2022. Nothing says it fails on current cds, but nothing says it was tried either. The repository the package declares has been deleted — verified against the GitHub API, not just a failed fetch. The package is still on npm, so it installs; the source it was published from is no longer readable, which is a harder thing to discover than a stale version number.

Quiet Release and repository quiet for 57 months.

Functional boundary The package declares `@sap/cds` ^4.5.2 among its dependencies and pins `@sap-cloud-sdk/core` at 1.37.1, so a project on CAP 5 or later is outside the range it states.

Release and repository quiet for 46 months.

Node below 22, or [@sap/cds](artifact:sap-cds) below 9: the package declares the first in engines and the second as a peer dependency. Any mail path other than Microsoft Graph, until a provider is written for it: graph is the only kind that sends, and basic, the kind configured by default, is the base class such a provider extends.

Reach for the original unless you know why you are not. This is a republished copy rather than a fork with a direction of its own: the README points at cap-js/notifications for the details, and nothing here says what was changed or why.

BUSL-1.1 rather than node-rfc's Apache-2.0, so a product you distribute has to be read against the licence and its Additional Use Grant first, and the source is closed: the GitHub repository is the issue tracker and the documentation, nothing else. `RfcServerOptions.bgRfcHandlers` raises instead of accepting handlers, so a server receiving inbound bgRFC units is outside what this does. An ABAP `MESSAGE`-raised failure still arrives with its T100 template rather than the rendered sentence, and the dump name is not reported as `key` for that case.

The maintainer states 0.x is beta with no production SLA, and scopes support deliberately narrowly: direct application-server transport, classic serialization and password authentication on S/4HANA 2023 and NetWeaver 7.50. Anything outside that is untested rather than unsupported.

Every gate here runs off-system, so what the class does on a real system and what the view does on the oldest UI5 release it has to serve are what the `pitfalls` catalogues carry and no local run can see. It runs abap2UI5 app classes, so ABAP that is not one has nothing here to deploy into. In system mode the sandbox tools are not offered, and an `app_act` event runs on the system as the configured user.

A descendant rather than a distinct idea: if what you need is the ADT surface itself, its ancestors are entered here too and one of them may already be in your stack.

It expects a real landscape, not just a project: a `.service.metadata` file naming the Mobile Services app, endpoint and destination, the Cloud Foundry CLI, and access to a BTP Cloud Foundry environment. From 0.4.0 macOS support is ARM64 only — Intel Macs are not supported — alongside Linux and Windows on x64 and ARM64.

It reads a UI5 project and the framework's own documentation, not a running system or a backend: a question about the service behind the app is answered somewhere else. Node.js v20.17 or v22.9 and above.

Commercial Its maker offers it commercially.

Functional boundary The MIT licence covers the connector only: connecting to SAP needs a licensed ABAPilot backend installed in your system, so this is a commercial decision wearing an open-source badge on one half. Its own published checks did not cover writes, activation, transports or authorisation boundaries.

A system that reports itself productive, or whose role the probe cannot prove non-productive, is write-locked with no override, so changing code in production is not something this does. The permission ladder constrains the package, object name and transport request the server itself passes on a write, and is not a sandbox around ABAP it executes: `abap_run`, `abap_test` and the opt-in `core.eval` run under the connected technical user's SAP authorisations, which is where the boundary actually sits. Data preview, dump variable contents and driving a transaction by batch input stay off in every mode, `admin` included, until each is named explicitly.