github TypeScript analyzed 0478b00

craveup-oss/opensource-loyalty

github

Open-source restaurant loyalty platform and vendor-neutral checkout protocol for POS, ordering, and multi-unit teams.

maintainer: craveup-oss
licence: Apache-2.0
first seen: 2026-09-02
last seen: 2026-09-02
releases · 30d: 0
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 7 tools

transport stdio · http counts 7 tools · 0 res · 0 prompts permission surface via code analysis

tools

lip_checkout_flow
lip_index
lip_list_api_operations
lip_list_schemas
lip_read_doc
lip_sdk_snippet
lip_validate_json

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 0478b00 · analyzer v33 · 2d ago

skills & prompt files 7

danger signals2

suspicious endpoint 169.254.169.254 (cloud metadata) craveup-oss-opensource-loyalty-0478b00/tests/unit/outbound-url.test.ts :32 "https://169.254.169.254/latest/meta-data",
suspicious endpoint 169.254.169.254 (cloud metadata) craveup-oss-opensource-loyalty-0478b00/tests/unit/webhooks.test.ts :104 url: "https://169.254.169.254/latest/meta-data",

code evidence vv0.2.0 · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 205

filesystem 64

fs craveup-oss-opensource-loyalty-0478b00/apps/cloud/src/cli.ts :4 import { mkdirSync } from "node:fs";
fs (weak) craveup-oss-opensource-loyalty-0478b00/apps/cloud/src/cloud.test.ts :2 import { mkdtempSync, readFileSync, rmSync } from "node:fs";
fs (weak) craveup-oss-opensource-loyalty-0478b00/apps/cloud/src/customer-contract.test.ts :1 import { readFileSync } from "node:fs";
fs craveup-oss-opensource-loyalty-0478b00/apps/cloud/src/customer-postgres-repository.ts :1 import { readFile } from "node:fs/promises";
fs (weak) craveup-oss-opensource-loyalty-0478b00/apps/cloud/src/data-plane-provisioner.test.ts :2 import { mkdirSync, mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
fs craveup-oss-opensource-loyalty-0478b00/apps/cloud/src/data-plane-provisioner.ts :7 import { existsSync, mkdirSync, readdirSync } from "node:fs";
fs (weak) craveup-oss-opensource-loyalty-0478b00/apps/cloud/src/managed-data-plane.test.ts :1 import { mkdtempSync, rmSync } from "node:fs";
fs (weak) craveup-oss-opensource-loyalty-0478b00/apps/cloud/src/managed-diskless.test.ts :1 import { readFileSync } from "node:fs";
fs (weak) craveup-oss-opensource-loyalty-0478b00/apps/cloud/src/operator-auth.test.ts :2 import { readFileSync } from "node:fs";
fs craveup-oss-opensource-loyalty-0478b00/apps/cloud/src/postgres-repository.ts :2 import { readFile } from "node:fs/promises";
fs craveup-oss-opensource-loyalty-0478b00/apps/wallet/src/server.ts :2 import { readFile } from "node:fs/promises";
fs craveup-oss-opensource-loyalty-0478b00/packages/cli/src/config.ts :1 import { mkdir, readFile, writeFile } from "node:fs/promises";

show 28 more

fs craveup-oss-opensource-loyalty-0478b00/packages/cli/src/member-migration.ts :2 import { chmod, readFile, writeFile } from "node:fs/promises";
fs (weak) craveup-oss-opensource-loyalty-0478b00/packages/cli/src/migration.test.ts :1 import { mkdtemp, rm, writeFile } from "node:fs/promises";
fs craveup-oss-opensource-loyalty-0478b00/packages/cli/src/migration.ts :1 import { readFile } from "node:fs/promises";
fs craveup-oss-opensource-loyalty-0478b00/packages/cli/src/mock.ts :1 import { readFile } from "node:fs/promises";
fs craveup-oss-opensource-loyalty-0478b00/packages/cli/src/validate.ts :1 import { readFile } from "node:fs/promises";
fs craveup-oss-opensource-loyalty-0478b00/packages/mcp/src/lib.ts :1 import { existsSync } from "node:fs";
fs (weak) craveup-oss-opensource-loyalty-0478b00/packages/server/src/migration.test.ts :1 import { mkdtemp, readFile, rm, stat } from "node:fs/promises";
fs craveup-oss-opensource-loyalty-0478b00/packages/server/src/migration.ts :2 import { existsSync } from "node:fs";
fs craveup-oss-opensource-loyalty-0478b00/packages/server/src/platform.ts :1 import { existsSync } from "node:fs";
fs craveup-oss-opensource-loyalty-0478b00/packages/server/src/server.ts :2 import { readFile } from "node:fs/promises";
fs craveup-oss-opensource-loyalty-0478b00/packages/storage-postgres/src/index.ts :2 import { readFile } from "node:fs/promises";
fs (weak) craveup-oss-opensource-loyalty-0478b00/packages/storage-postgres/src/tenant-isolation.test.ts :1 import { readFileSync } from "node:fs";
fs (weak) craveup-oss-opensource-loyalty-0478b00/packages/storage-sqlite/src/async.test.ts :1 import { mkdtempSync, rmSync } from "node:fs";
fs craveup-oss-opensource-loyalty-0478b00/packages/storage-sqlite/src/index.ts :1 import { mkdirSync } from "node:fs";
fs (weak) craveup-oss-opensource-loyalty-0478b00/scripts/build-mcp-assets.mjs :1 import { cp, mkdir, rm } from "node:fs/promises";
fs (weak) craveup-oss-opensource-loyalty-0478b00/scripts/check-docs-mirror.ts :24 import { existsSync } from "node:fs";
fs (weak) craveup-oss-opensource-loyalty-0478b00/scripts/check-launch-surface.ts :1 import { readFile, readdir } from "node:fs/promises";
fs (weak) craveup-oss-opensource-loyalty-0478b00/scripts/check-managed-environment-evidence.ts :1 import { readFileSync } from "node:fs";
fs (weak) craveup-oss-opensource-loyalty-0478b00/scripts/check-public-safety.ts :2 import { readFile } from "node:fs/promises";
fs (weak) craveup-oss-opensource-loyalty-0478b00/scripts/check-release-manifest.ts :3 import { readFile } from "node:fs/promises";
fs (weak) craveup-oss-opensource-loyalty-0478b00/scripts/generate-platform-openapi.ts :1 import { writeFile } from "node:fs/promises";
fs (weak) craveup-oss-opensource-loyalty-0478b00/scripts/generate-release-manifest.ts :2 import { mkdir, readFile, readdir, writeFile } from "node:fs/promises";
fs (weak) craveup-oss-opensource-loyalty-0478b00/scripts/generate-sdk.ts :1 import { mkdir, readFile, writeFile } from "node:fs/promises";
fs (weak) craveup-oss-opensource-loyalty-0478b00/scripts/generate-spec.ts :1 import { mkdir, writeFile } from "node:fs/promises";
fs (weak) craveup-oss-opensource-loyalty-0478b00/scripts/prepare-release-evidence.ts :1 import { copyFile, mkdir, readFile, writeFile } from "node:fs/promises";
fs (weak) craveup-oss-opensource-loyalty-0478b00/scripts/verify-rendered-surfaces.mjs :2 import { existsSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
fs (weak) craveup-oss-opensource-loyalty-0478b00/tests/conformance/cloud-attach-conformance.test.ts :1 import { mkdtempSync, rmSync } from "node:fs";
fs (weak) craveup-oss-opensource-loyalty-0478b00/tests/unit/access-control.test.ts :1 import { mkdtempSync, rmSync } from "node:fs";

24 more not shown — this panel samples each group; the count above is the real total.

shell / exec 6

shell (weak) craveup-oss-opensource-loyalty-0478b00/scripts/check-docs-mirror.ts :23 import { execFileSync } from "node:child_process";
shell (weak) craveup-oss-opensource-loyalty-0478b00/scripts/check-public-safety.ts :1 import { execFile } from "node:child_process";
shell (weak) craveup-oss-opensource-loyalty-0478b00/scripts/generate-release-manifest.ts :1 import { execFile } from "node:child_process";
shell (weak) craveup-oss-opensource-loyalty-0478b00/scripts/verify-packages.ts :1 import { execFile } from "node:child_process";
shell (weak) craveup-oss-opensource-loyalty-0478b00/scripts/verify-rendered-surfaces.mjs :1 import { spawn } from "node:child_process";
shell (weak) craveup-oss-opensource-loyalty-0478b00/tests/unit/cli.test.ts :1 import { execFile } from "node:child_process";

network 26

net craveup-oss-opensource-loyalty-0478b00/apps/admin/src/App.tsx :105 const response = await fetch(adminPath(path), {
net (weak) craveup-oss-opensource-loyalty-0478b00/apps/cloud/src/billing.test.ts :193 expect((await fetch(url, { method: "POST", body: payload })).status).toBe(400);
net (weak) craveup-oss-opensource-loyalty-0478b00/apps/cloud/src/cloud.test.ts :283 expect(await fetch(`${running.url}/cloud/v1/plans`, {
net (weak) craveup-oss-opensource-loyalty-0478b00/apps/cloud/src/customer-routes.test.ts :74 const session = await fetch(`${running.url}/cloud/v1/customer/session`, {
net (weak) craveup-oss-opensource-loyalty-0478b00/apps/cloud/src/data-plane-provisioner.test.ts :3 import { createServer as createNetServer } from "node:net";
net craveup-oss-opensource-loyalty-0478b00/apps/cloud/src/deployment-verification-cli.ts :20 const healthResponse = await fetch(`${baseUrl}/health`, {
net (weak) craveup-oss-opensource-loyalty-0478b00/apps/cloud/src/managed-data-plane.test.ts :2 import { createServer, type Server } from "node:http";
net craveup-oss-opensource-loyalty-0478b00/apps/cloud/src/managed-data-plane.ts :2 import type { IncomingMessage, ServerResponse } from "node:http";
net (weak) craveup-oss-opensource-loyalty-0478b00/apps/cloud/src/operator-auth.test.ts :292 const bootstrap = await fetch(`${running.url}/cloud/v1/operators`, {
net craveup-oss-opensource-loyalty-0478b00/apps/cloud/src/operator-cli.ts :73 const response = await fetch(`${base}${path}`, {
net craveup-oss-opensource-loyalty-0478b00/apps/cloud/src/server.ts :7 } from "node:http";
net (weak) craveup-oss-opensource-loyalty-0478b00/apps/cloud/src/tenant-onboarding.test.ts :188 const response = await fetch(`${url}/cloud/v1/organizations`, {

show 14 more

net craveup-oss-opensource-loyalty-0478b00/apps/cloud/src/tenant-onboarding.ts :168 const response = await fetch(`${base}${path}`, {
net (weak) craveup-oss-opensource-loyalty-0478b00/apps/wallet/src/server.test.ts :14 const page = await fetch(running.url);
net craveup-oss-opensource-loyalty-0478b00/apps/wallet/src/server.ts :7 } from "node:http";
net craveup-oss-opensource-loyalty-0478b00/packages/cli/src/cloud-verify.ts :39 res = await fetch(`${base}/lip/v1/members/lookup`, {
net craveup-oss-opensource-loyalty-0478b00/packages/server/src/outbound-url.ts :2 import { isIP } from "node:net";
net craveup-oss-opensource-loyalty-0478b00/packages/server/src/server.ts :3 import { createServer, type IncomingMessage, type Server, type ServerResponse } from "node:http";
net (weak) craveup-oss-opensource-loyalty-0478b00/scripts/verify-rendered-surfaces.mjs :39 const response = await fetch(url, options);
net (weak) craveup-oss-opensource-loyalty-0478b00/tests/conformance/cloud-attach-conformance.test.ts :94 const attach = await fetch(
net (weak) craveup-oss-opensource-loyalty-0478b00/tests/conformance/http-lifecycle.test.ts :43 const response = await fetch(`${running.url}${path}`, {
net (weak) craveup-oss-opensource-loyalty-0478b00/tests/unit/cli.test.ts :108 const listed = await fetch(`${running.url}/admin/api/v1/locations`, {
net (weak) craveup-oss-opensource-loyalty-0478b00/tests/unit/location-report-read-path.test.ts :70 const response = await fetch(`${running.url}/admin/api/v1/reports/locations`, {
net (weak) craveup-oss-opensource-loyalty-0478b00/tests/unit/platform-api.test.ts :29 const request = async (path: string, init: RequestInit = {}) => fetch(`${running.url}${path}`, {
net (weak) craveup-oss-opensource-loyalty-0478b00/tests/unit/server.test.ts :61 const response = await fetch(`${running.url}/lip/v1/members/enroll`, {
net (weak) craveup-oss-opensource-loyalty-0478b00/tests/unit/webhooks.test.ts :3 import { createServer, type Server } from "node:http";

secrets 14

secrets craveup-oss-opensource-loyalty-0478b00/apps/cloud/src/cli.ts :41 const apiKey = process.env["LIP_CLOUD_API_KEY"];
secrets (weak) craveup-oss-opensource-loyalty-0478b00/apps/cloud/src/data-plane-provisioner.test.ts :615 process.env["LIP_WEBHOOK_SECRET"] = "host-level-shared-secret";
secrets craveup-oss-opensource-loyalty-0478b00/apps/cloud/src/deployment-verification-cli.ts :9 process.env["LIP_CLOUD_OPERATOR_KEY"] ?? process.env["LIP_CLOUD_API_KEY"];
secrets craveup-oss-opensource-loyalty-0478b00/apps/cloud/src/operator-cli.ts :49 const apiKey = process.env["LIP_CLOUD_OPERATOR_KEY"] ?? process.env["LIP_CLOUD_API_KEY"];
secrets craveup-oss-opensource-loyalty-0478b00/apps/cloud/src/tenant-onboarding-cli.ts :71 const operatorKey = process.env["LIP_CLOUD_OPERATOR_KEY"];
secrets craveup-oss-opensource-loyalty-0478b00/apps/wallet/src/cli.ts :27 ...(process.env.WALLET_OIDC_CLIENT_SECRET
secrets (weak) craveup-oss-opensource-loyalty-0478b00/examples/typescript/full-lifecycle.js :7 apiKey: process.env.LIP_API_KEY ?? "lip-dev-key",
secrets (weak) craveup-oss-opensource-loyalty-0478b00/examples/typescript/full-lifecycle.ts :8 apiKey: process.env.LIP_API_KEY ?? "lip-dev-key",
secrets (weak) craveup-oss-opensource-loyalty-0478b00/examples/typescript/ordering-bff.ts :189 apiKey: process.env.LIP_API_KEY ?? "lip-dev-key",
secrets craveup-oss-opensource-loyalty-0478b00/packages/mcp/src/lib.ts :149 secret: process.env.LIP_WEBHOOK_SECRET!,
secrets craveup-oss-opensource-loyalty-0478b00/packages/server/src/cli.ts :20 const apiKey = process.env.LIP_API_KEY ?? "lip-dev-key";
secrets (weak) craveup-oss-opensource-loyalty-0478b00/scripts/test-examples.ts :9 process.env.LIP_API_KEY = apiKey;

show 2 more

secrets (weak) craveup-oss-opensource-loyalty-0478b00/scripts/verify-rendered-surfaces.mjs :8 const adminApiKey = process.env.LIP_VISUAL_ADMIN_API_KEY ?? "lip-dev-key";
secrets (weak) craveup-oss-opensource-loyalty-0478b00/tests/unit/cli.test.ts :244 const previousSecret = process.env.LIP_WEBHOOK_SECRET;

database 16

db craveup-oss-opensource-loyalty-0478b00/apps/cloud/src/cli.ts :8 import type { Pool } from "pg";
db craveup-oss-opensource-loyalty-0478b00/apps/cloud/src/credential-operation-store.ts :1 import { Pool, type PoolClient, type QueryResultRow } from "pg";
db craveup-oss-opensource-loyalty-0478b00/apps/cloud/src/customer-postgres-repository.ts :3 import { Pool, type PoolClient, type PoolConfig } from "pg";
db craveup-oss-opensource-loyalty-0478b00/apps/cloud/src/managed-data-plane.ts :3 import type { Pool } from "pg";
db craveup-oss-opensource-loyalty-0478b00/apps/cloud/src/postgres-operators.ts :1 import type { Pool, PoolClient } from "pg";
db craveup-oss-opensource-loyalty-0478b00/apps/cloud/src/postgres-repository.ts :9 } from "pg";
db craveup-oss-opensource-loyalty-0478b00/apps/cloud/src/restore-source-stability-cli.ts :3 import { Pool } from "pg";
db craveup-oss-opensource-loyalty-0478b00/apps/cloud/src/restore-verification-cli.ts :3 import { Pool } from "pg";
db (weak) craveup-oss-opensource-loyalty-0478b00/apps/cloud/src/restore-verification.test.ts :2 import type { Pool } from "pg";
db craveup-oss-opensource-loyalty-0478b00/apps/cloud/src/restore-verification.ts :2 import type { Pool } from "pg";
db craveup-oss-opensource-loyalty-0478b00/packages/server/src/platform.ts :3 import type { Pool } from "pg";
db craveup-oss-opensource-loyalty-0478b00/packages/storage-postgres/src/index.ts :4 import { Pool, type PoolClient, type PoolConfig, type QueryResultRow } from "pg";

show 4 more

db (weak) craveup-oss-opensource-loyalty-0478b00/packages/storage-postgres/src/tenant-isolation.test.ts :3 import type { Pool, PoolClient } from "pg";
db craveup-oss-opensource-loyalty-0478b00/packages/storage-sqlite/src/index.ts :3 import Database from "better-sqlite3";
db (weak) craveup-oss-opensource-loyalty-0478b00/tests/conformance/postgres-lease-conformance.test.ts :2 import { Client } from "pg";
db (weak) craveup-oss-opensource-loyalty-0478b00/tests/unit/tenant-isolation-live.test.ts :3 import type { Pool, PoolClient } from "pg";

tool registrations 7

lip_index craveup-oss-opensource-loyalty-0478b00/packages/mcp/src/server.ts :33
lip_read_doc craveup-oss-opensource-loyalty-0478b00/packages/mcp/src/server.ts :42
lip_list_api_operations craveup-oss-opensource-loyalty-0478b00/packages/mcp/src/server.ts :54
lip_list_schemas craveup-oss-opensource-loyalty-0478b00/packages/mcp/src/server.ts :63
lip_validate_json craveup-oss-opensource-loyalty-0478b00/packages/mcp/src/server.ts :72
lip_checkout_flow craveup-oss-opensource-loyalty-0478b00/packages/mcp/src/server.ts :88
lip_sdk_snippet craveup-oss-opensource-loyalty-0478b00/packages/mcp/src/server.ts :97

install hooks 11

prepack craveup-oss-opensource-loyalty-0478b00/packages/adapter-kit/package.json :28 npm run build
prepack craveup-oss-opensource-loyalty-0478b00/packages/cli/package.json :39 npm run build
prepack craveup-oss-opensource-loyalty-0478b00/packages/identity/package.json :37 npm run build
prepack craveup-oss-opensource-loyalty-0478b00/packages/mcp/package.json :48 npm run build
prepack craveup-oss-opensource-loyalty-0478b00/packages/protocol/package.json :37 npm run build
prepack craveup-oss-opensource-loyalty-0478b00/packages/reference/package.json :37 npm run build
prepack craveup-oss-opensource-loyalty-0478b00/packages/sdk/package.json :37 npm run build
prepack craveup-oss-opensource-loyalty-0478b00/packages/server/package.json :40 npm run build --workspace @loyalty-interchange/admin && npm run build
prepack craveup-oss-opensource-loyalty-0478b00/packages/storage-postgres/package.json :38 npm run build
prepack craveup-oss-opensource-loyalty-0478b00/packages/storage-sqlite/package.json :37 npm run build
prepack craveup-oss-opensource-loyalty-0478b00/packages/storage/package.json :37 npm run build

declared dependencies 9

@apidevtools/swagger-parser@^12.1.0
@types/node@^26.1.1
@vitest/coverage-v8@^4.1.10
ajv@^8.20.0
ajv-formats@^3.0.1
tsx@^4.23.1
typescript@^6.0.3
vitest@^4.1.10
yaml@^2.9.0

perm:untrusted 3

untrusted (weak) craveup-oss-opensource-loyalty-0478b00/apps/cloud/src/data-plane-provisioner.test.ts :252 expect(await fetch(`${resumed.api_url}/health`).then((response) => response.status)).toBe(200);
untrusted (weak) craveup-oss-opensource-loyalty-0478b00/apps/wallet/src/server.test.ts :19 expect(await (await fetch(`${running.url}/api/session`)).json()).toMatchObject({
untrusted (weak) craveup-oss-opensource-loyalty-0478b00/tests/unit/server.test.ts :103 const health = await (await fetch(`${running.url}/health`)).json();

transport_posture 1

binds all interfaces (0.0.0.0) craveup-oss-opensource-loyalty-0478b00/tests/unit/server.test.ts :32 await expect(startReferenceServer(engine, { apiKey: "lip-dev-key", host: "0.0.0.0" }))