Everything in UI5 / Web Components

It audits through npm: a project that resolves its dependencies with another package manager, or has no `package.json`, has nothing for it to run. What it reports is what `npm audit` knows, so a vulnerability outside the npm advisory data is not in its table.

A team that does not keep one long-lived branch per environment has no environment branches for it to compare feature branches against. What it reports is the merge state of branches in Git, so it says nothing about whether a merged change has been built or deployed to the environment.

The 221 ports under `src/02` need a UI5 runtime newer than 1.71: they install and activate on any release, and on an older UI5 the newer control does not render. The `src/03` collection is hand-written for SAPUI5-only controls and needs a SAPUI5 bootstrap. There are no per-library branches, so pulling the whole repository is the one way in and the activation takes a few minutes.

Nothing here runs on its own: a plugin sample needs a Digital Manufacturing tenant to be uploaded into, and the integration samples need a Cloud Integration tenant plus an ERP system, or a mock server as the outbound example uses, before they do anything.

No license Neither the package manifest nor the repository tree declares a licence.

Functional boundary The data is illustrative: availability is binary and backup capacity unlimited, and the model carries no inventory; nothing in it is forecast or priced. The recall half runs only against classic ABAP, because its openCypher trace goes through ADBC, which is not released for ABAP Cloud, and it expects an SSH tunnel to the A4H system it was built against. A plain `npm start` passes no model key, so the agent cannot be used on a server started that way.

Neither the package manifest nor the repository tree declares a licence.