@harrylabsj/kiwi-merchant-cloud 0.12.0 → 0.12.1

package/node_modules/@hono/node-server/dist/index.cjs

@@ -868,7 +868,10 @@ const handleResponseError = (e, outgoing) => {
 	if (err.code === "ERR_STREAM_PREMATURE_CLOSE") console.info("The user aborted a request.");
 	else {
 		console.error(e);
-		if (!outgoing.headersSent) outgoing.writeHead(500, { "Content-Type": "text/plain" });
+		if (!outgoing.headersSent) {
+			if (outgoing instanceof node_http.ServerResponse) outgoing._contentLength = null;
+			outgoing.writeHead(500, { "Content-Type": "text/plain" });
+		}
 		outgoing.end(`Error: ${err.message}`);
 		outgoing.destroy(err);
 	}
@@ -876,6 +879,21 @@ const handleResponseError = (e, outgoing) => {
 const flushHeaders = (outgoing) => {
 	if ("flushHeaders" in outgoing && outgoing.writable) outgoing.flushHeaders();
 };
+const trySetContentLength = (outgoing, status, length) => {
+	const http1 = outgoing;
+	if (http1._contentLength === null && http1._hasBody && http1.useChunkedEncodingByDefault && !http1._removedContLen && status >= 200 && status !== 204 && status !== 304 && !outgoing.hasHeader("content-length") && !outgoing.hasHeader("transfer-encoding") && !outgoing.hasHeader("trailer")) {
+		http1._contentLength = length;
+		return true;
+	}
+	return false;
+};
+const writeDefaultHeaders = (outgoing, status, length) => {
+	if (trySetContentLength(outgoing, status, length)) outgoing.writeHead(status, { "Content-Type": defaultContentType });
+	else outgoing.writeHead(status, {
+		"Content-Type": defaultContentType,
+		"Content-Length": length
+	});
+};
 const responseViaCache = async (res, outgoing) => {
 	let [status, body, header] = res[cacheKey];
 	if (!header) {
@@ -883,22 +901,13 @@ const responseViaCache = async (res, outgoing) => {
 			outgoing.writeHead(status);
 			outgoing.end();
 		} else if (typeof body === "string") {
-			outgoing.writeHead(status, {
-				"Content-Type": defaultContentType,
-				"Content-Length": Buffer.byteLength(body)
-			});
+			writeDefaultHeaders(outgoing, status, Buffer.byteLength(body));
 			outgoing.end(body);
 		} else if (body instanceof Uint8Array) {
-			outgoing.writeHead(status, {
-				"Content-Type": defaultContentType,
-				"Content-Length": body.byteLength
-			});
+			writeDefaultHeaders(outgoing, status, body.byteLength);
 			outgoing.end(body);
 		} else if (body instanceof Blob) {
-			outgoing.writeHead(status, {
-				"Content-Type": defaultContentType,
-				"Content-Length": body.size
-			});
+			writeDefaultHeaders(outgoing, status, body.size);
 			outgoing.end(new Uint8Array(await body.arrayBuffer()));
 		} else {
 			outgoing.writeHead(status, { "Content-Type": defaultContentType });
@@ -909,6 +918,8 @@ const responseViaCache = async (res, outgoing) => {
 		return;
 	}
 	let hasContentLength = false;
+	let plainHeaders = false;
+	let canAutoLength = true;
 	if (header instanceof Headers) {
 		hasContentLength = header.has("content-length");
 		header = buildOutgoingHttpHeaders(header, body === null ? void 0 : defaultContentType);
@@ -916,14 +927,25 @@ const responseViaCache = async (res, outgoing) => {
 		const headerObj = new Headers(header);
 		hasContentLength = headerObj.has("content-length");
 		header = buildOutgoingHttpHeaders(headerObj, body === null ? void 0 : defaultContentType);
-	} else for (const key in header) if (key.length === 14 && key.toLowerCase() === "content-length") {
-		hasContentLength = true;
-		break;
+	} else {
+		plainHeaders = true;
+		for (const key in header) {
+			if (key.length === 14 && key.toLowerCase() === "content-length") {
+				hasContentLength = true;
+				break;
+			}
+			if (key.length === 17 && key.toLowerCase() === "transfer-encoding" || key.length === 7 && key.toLowerCase() === "trailer") canAutoLength = false;
+		}
 	}
 	if (!hasContentLength) {
-		if (typeof body === "string") header["Content-Length"] = Buffer.byteLength(body);
-		else if (body instanceof Uint8Array) header["Content-Length"] = body.byteLength;
-		else if (body instanceof Blob) header["Content-Length"] = body.size;
+		let length;
+		if (typeof body === "string") length = Buffer.byteLength(body);
+		else if (body instanceof Uint8Array) length = body.byteLength;
+		else if (body instanceof Blob) length = body.size;
+		if (length !== void 0 && (!plainHeaders || !canAutoLength || !trySetContentLength(outgoing, status, length))) {
+			if (plainHeaders) header = { ...header };
+			header["Content-Length"] = length;
+		}
 	}
 	outgoing.writeHead(status, header);
 	if (body == null) outgoing.end();

package/node_modules/@hono/node-server/dist/index.mjs

@@ -1,5 +1,5 @@
 import { t as X_ALREADY_SENT } from "./constants-BLSFu_RU.mjs";
-import { STATUS_CODES, createServer } from "node:http";
+import { STATUS_CODES, ServerResponse, createServer } from "node:http";
 import { Http2ServerRequest, constants } from "node:http2";
 import { Readable } from "node:stream";
 import { defineWebSocketHelper } from "hono/ws";
@@ -867,7 +867,10 @@ const handleResponseError = (e, outgoing) => {
 	if (err.code === "ERR_STREAM_PREMATURE_CLOSE") console.info("The user aborted a request.");
 	else {
 		console.error(e);
-		if (!outgoing.headersSent) outgoing.writeHead(500, { "Content-Type": "text/plain" });
+		if (!outgoing.headersSent) {
+			if (outgoing instanceof ServerResponse) outgoing._contentLength = null;
+			outgoing.writeHead(500, { "Content-Type": "text/plain" });
+		}
 		outgoing.end(`Error: ${err.message}`);
 		outgoing.destroy(err);
 	}
@@ -875,6 +878,21 @@ const handleResponseError = (e, outgoing) => {
 const flushHeaders = (outgoing) => {
 	if ("flushHeaders" in outgoing && outgoing.writable) outgoing.flushHeaders();
 };
+const trySetContentLength = (outgoing, status, length) => {
+	const http1 = outgoing;
+	if (http1._contentLength === null && http1._hasBody && http1.useChunkedEncodingByDefault && !http1._removedContLen && status >= 200 && status !== 204 && status !== 304 && !outgoing.hasHeader("content-length") && !outgoing.hasHeader("transfer-encoding") && !outgoing.hasHeader("trailer")) {
+		http1._contentLength = length;
+		return true;
+	}
+	return false;
+};
+const writeDefaultHeaders = (outgoing, status, length) => {
+	if (trySetContentLength(outgoing, status, length)) outgoing.writeHead(status, { "Content-Type": defaultContentType });
+	else outgoing.writeHead(status, {
+		"Content-Type": defaultContentType,
+		"Content-Length": length
+	});
+};
 const responseViaCache = async (res, outgoing) => {
 	let [status, body, header] = res[cacheKey];
 	if (!header) {
@@ -882,22 +900,13 @@ const responseViaCache = async (res, outgoing) => {
 			outgoing.writeHead(status);
 			outgoing.end();
 		} else if (typeof body === "string") {
-			outgoing.writeHead(status, {
-				"Content-Type": defaultContentType,
-				"Content-Length": Buffer.byteLength(body)
-			});
+			writeDefaultHeaders(outgoing, status, Buffer.byteLength(body));
 			outgoing.end(body);
 		} else if (body instanceof Uint8Array) {
-			outgoing.writeHead(status, {
-				"Content-Type": defaultContentType,
-				"Content-Length": body.byteLength
-			});
+			writeDefaultHeaders(outgoing, status, body.byteLength);
 			outgoing.end(body);
 		} else if (body instanceof Blob) {
-			outgoing.writeHead(status, {
-				"Content-Type": defaultContentType,
-				"Content-Length": body.size
-			});
+			writeDefaultHeaders(outgoing, status, body.size);
 			outgoing.end(new Uint8Array(await body.arrayBuffer()));
 		} else {
 			outgoing.writeHead(status, { "Content-Type": defaultContentType });
@@ -908,6 +917,8 @@ const responseViaCache = async (res, outgoing) => {
 		return;
 	}
 	let hasContentLength = false;
+	let plainHeaders = false;
+	let canAutoLength = true;
 	if (header instanceof Headers) {
 		hasContentLength = header.has("content-length");
 		header = buildOutgoingHttpHeaders(header, body === null ? void 0 : defaultContentType);
@@ -915,14 +926,25 @@ const responseViaCache = async (res, outgoing) => {
 		const headerObj = new Headers(header);
 		hasContentLength = headerObj.has("content-length");
 		header = buildOutgoingHttpHeaders(headerObj, body === null ? void 0 : defaultContentType);
-	} else for (const key in header) if (key.length === 14 && key.toLowerCase() === "content-length") {
-		hasContentLength = true;
-		break;
+	} else {
+		plainHeaders = true;
+		for (const key in header) {
+			if (key.length === 14 && key.toLowerCase() === "content-length") {
+				hasContentLength = true;
+				break;
+			}
+			if (key.length === 17 && key.toLowerCase() === "transfer-encoding" || key.length === 7 && key.toLowerCase() === "trailer") canAutoLength = false;
+		}
 	}
 	if (!hasContentLength) {
-		if (typeof body === "string") header["Content-Length"] = Buffer.byteLength(body);
-		else if (body instanceof Uint8Array) header["Content-Length"] = body.byteLength;
-		else if (body instanceof Blob) header["Content-Length"] = body.size;
+		let length;
+		if (typeof body === "string") length = Buffer.byteLength(body);
+		else if (body instanceof Uint8Array) length = body.byteLength;
+		else if (body instanceof Blob) length = body.size;
+		if (length !== void 0 && (!plainHeaders || !canAutoLength || !trySetContentLength(outgoing, status, length))) {
+			if (plainHeaders) header = { ...header };
+			header["Content-Length"] = length;
+		}
 	}
 	outgoing.writeHead(status, header);
 	if (body == null) outgoing.end();

package/node_modules/@hono/node-server/dist/serve-static.cjs

@@ -77,6 +77,7 @@ const serveStatic = (options = { root: "" }) => {
 		let filename;
 		if (optionPath) filename = optionPath;
 		else try {
+			if (!options.allowPercentInPath && c.req.path.includes("%")) throw new Error();
 			filename = tryDecodeURI(c.req.path);
 			if (/(?:^|[\/\\])\.{1,2}(?:$|[\/\\])|[\/\\]{2,}|\\/.test(filename)) throw new Error();
 		} catch {

package/node_modules/@hono/node-server/dist/serve-static.d.cts

@@ -8,7 +8,8 @@ type ServeStaticOptions<E extends Env = Env> = {
   root?: string;
   path?: string;
   index?: string;
-  precompressed?: boolean;
+  precompressed?: boolean; /** Allow percent signs in the routed request path. Defaults to false. */
+  allowPercentInPath?: boolean;
   rewriteRequestPath?: (path: string, c: Context<E>) => string;
   onFound?: (path: string, c: Context<E>) => void | Promise<void>;
   onNotFound?: (path: string, c: Context<E>) => void | Promise<void>;

package/node_modules/@hono/node-server/dist/serve-static.d.mts

@@ -8,7 +8,8 @@ type ServeStaticOptions<E extends Env = Env> = {
   root?: string;
   path?: string;
   index?: string;
-  precompressed?: boolean;
+  precompressed?: boolean; /** Allow percent signs in the routed request path. Defaults to false. */
+  allowPercentInPath?: boolean;
   rewriteRequestPath?: (path: string, c: Context<E>) => string;
   onFound?: (path: string, c: Context<E>) => void | Promise<void>;
   onNotFound?: (path: string, c: Context<E>) => void | Promise<void>;

package/node_modules/@hono/node-server/dist/serve-static.mjs

@@ -76,6 +76,7 @@ const serveStatic = (options = { root: "" }) => {
 		let filename;
 		if (optionPath) filename = optionPath;
 		else try {
+			if (!options.allowPercentInPath && c.req.path.includes("%")) throw new Error();
 			filename = tryDecodeURI(c.req.path);
 			if (/(?:^|[\/\\])\.{1,2}(?:$|[\/\\])|[\/\\]{2,}|\\/.test(filename)) throw new Error();
 		} catch {

package/node_modules/@hono/node-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hono/node-server",
-  "version": "2.1.1",
+  "version": "2.1.3",
   "description": "Node.js Adapter for Hono",
   "main": "dist/index.mjs",
   "type": "module",
@@ -100,7 +100,7 @@
     "@types/ws": "^8.18.1",
     "@whatwg-node/fetch": "^0.9.14",
     "eslint": "^9.10.0",
-    "hono": "^4.12.8",
+    "hono": "^4.13.9",
     "np": "^11.2.1",
     "prettier": "^3.2.4",
     "publint": "^0.3.18",
@@ -119,6 +119,7 @@
     "postbuild": "publint",
     "prerelease": "pnpm run build && pnpm run test --run",
     "release": "np --no-publish",
+    "typecheck": "tsc --noEmit",
     "lint": "eslint src test",
     "lint:fix": "eslint src test --fix",
     "format": "prettier --check \"src/**/*.{js,ts}\" \"test/**/*.{js,ts}\"",

package/node_modules/hono/dist/cjs/adapter/bun/websocket.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_helper_websocket_index = require("../../helper/websocket/index.js");
 const require_adapter_bun_server = require("./server.js");
+const require_helper_websocket_index = require("../../helper/websocket/index.js");
 //#region src/adapter/bun/websocket.ts
 /**
 * @internal

package/node_modules/hono/dist/cjs/middleware/language/language.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_utils_accept = require("../../utils/accept.js");
 const require_helper_cookie_index = require("../../helper/cookie/index.js");
+const require_utils_accept = require("../../utils/accept.js");
 //#region src/middleware/language/language.ts
 const DEFAULT_OPTIONS = {
 	order: [

package/node_modules/hono/dist/cjs/middleware/serve-static/index.js

@@ -23,6 +23,7 @@ const serveStatic = (options) => {
 		let filename;
 		if (options.path) filename = options.path;
 		else try {
+			if (!options.allowPercentInPath && c.req.path.includes("%")) throw new Error();
 			filename = require_utils_url.tryDecodeURI(c.req.path);
 			if (/(?:^|[\/\\])\.{1,2}(?:$|[\/\\])|[\/\\]{2,}|\\/.test(filename)) throw new Error();
 		} catch {

package/node_modules/hono/dist/middleware/language/language.js

@@ -1,5 +1,5 @@
-import { getCookie, setCookie } from "../../helper/cookie/index.js";
 import { parseAccept } from "../../utils/accept.js";
+import { getCookie, setCookie } from "../../helper/cookie/index.js";
 //#region src/middleware/language/language.ts
 const DEFAULT_OPTIONS = {
 	order: [

package/node_modules/hono/dist/middleware/serve-static/index.js

@@ -22,6 +22,7 @@ const serveStatic = (options) => {
 		let filename;
 		if (options.path) filename = options.path;
 		else try {
+			if (!options.allowPercentInPath && c.req.path.includes("%")) throw new Error();
 			filename = tryDecodeURI(c.req.path);
 			if (/(?:^|[\/\\])\.{1,2}(?:$|[\/\\])|[\/\\]{2,}|\\/.test(filename)) throw new Error();
 		} catch {

package/node_modules/hono/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hono",
-  "version": "4.13.10",
+  "version": "4.13.11",
   "description": "Web framework built on Web Standards",
   "main": "dist/cjs/index.js",
   "type": "module",

package/node_modules/yaml/browser/dist/compose/resolve-flow-scalar.js

@@ -64,46 +64,47 @@ function plainValue(source, onError) {
     }
     if (badChar)
         onError(0, 'BAD_SCALAR_START', `Plain value cannot start with ${badChar}`);
-    return foldLines(source);
+    return unfoldLines(source);
 }
 function singleQuotedValue(source, onError) {
     if (source[source.length - 1] !== "'" || source.length === 1)
         onError(source.length, 'MISSING_CHAR', "Missing closing 'quote");
-    return foldLines(source.slice(1, -1)).replace(/''/g, "'");
+    return unfoldLines(source.slice(1, -1)).replace(/''/g, "'");
 }
-function foldLines(source) {
+function unfoldLines(source) {
+    const line = /(.*?)\r?\n/sy;
+    let match = line.exec(source);
+    if (!match)
+        return source;
     /**
-     * The negative lookbehind here and in the `re` RegExp is to
+     * The negative lookbehinds in these RegExps are to
      * prevent causing a polynomial search time in certain cases.
      *
-     * The try-catch is for Safari, which doesn't support this yet:
+     * The try-catch is for Safari < 16.4 and other old browsers:
      * https://caniuse.com/js-regexp-lookbehind
      */
-    let first, line;
+    let trimEnd, trimBoth;
     try {
-        first = new RegExp('(.*?)(?<![ \t])[ \t]*\r?\n', 'sy');
-        line = new RegExp('[ \t]*(.*?)(?:(?<![ \t])[ \t]*)?\r?\n', 'sy');
+        trimEnd = new RegExp('(?<![ \t])[ \t]+$');
+        trimBoth = new RegExp('^[ \t]+|(?<![ \t])[ \t]+$', 'g');
     }
     catch {
-        first = /(.*?)[ \t]*\r?\n/sy;
-        line = /[ \t]*(.*?)[ \t]*\r?\n/sy;
+        trimEnd = /[ \t]+$/;
+        trimBoth = /^[ \t]+|[ \t]+$/g;
     }
-    let match = first.exec(source);
-    if (!match)
-        return source;
-    let res = match[1];
+    let res = match[1].replace(trimEnd, '');
     let sep = ' ';
-    let pos = first.lastIndex;
-    line.lastIndex = pos;
+    let pos = line.lastIndex;
     while ((match = line.exec(source))) {
-        if (match[1] === '') {
+        const lm = match[1].replace(trimBoth, '');
+        if (lm === '') {
             if (sep === '\n')
                 res += sep;
             else
                 sep = '\n';
         }
         else {
-            res += sep + match[1];
+            res += sep + lm;
             sep = ' ';
         }
         pos = line.lastIndex;

package/node_modules/yaml/browser/dist/nodes/Alias.js

@@ -43,38 +43,40 @@ class Alias extends NodeBase {
             if (node.anchor === this.source)
                 found = node;
         }
+        if (found && ctx) {
+            const { anchors, doc, maxAliasCount } = ctx;
+            let data = anchors.get(found);
+            if (!data) {
+                // Resolve anchors for Node.prototype.toJS()
+                toJS(found, null, ctx);
+                data = anchors.get(found);
+            }
+            /* istanbul ignore if */
+            if (data?.res === undefined) {
+                const msg = 'This should not happen: Alias anchor was not resolved?';
+                throw new ReferenceError(msg);
+            }
+            if (maxAliasCount >= 0) {
+                data.count += 1;
+                if (data.aliasCount === 0)
+                    data.aliasCount = getAliasCount(doc, found, anchors);
+                if (data.count * data.aliasCount > maxAliasCount) {
+                    const msg = 'Excessive alias count indicates a resource exhaustion attack';
+                    throw new ReferenceError(msg);
+                }
+            }
+        }
         return found;
     }
     toJSON(_arg, ctx) {
         if (!ctx)
             return { source: this.source };
-        const { anchors, doc, maxAliasCount } = ctx;
-        const source = this.resolve(doc, ctx);
+        const source = this.resolve(ctx.doc, ctx);
         if (!source) {
             const msg = `Unresolved alias (the anchor must be set before the alias): ${this.source}`;
             throw new ReferenceError(msg);
         }
-        let data = anchors.get(source);
-        if (!data) {
-            // Resolve anchors for Node.prototype.toJS()
-            toJS(source, null, ctx);
-            data = anchors.get(source);
-        }
-        /* istanbul ignore if */
-        if (data?.res === undefined) {
-            const msg = 'This should not happen: Alias anchor was not resolved?';
-            throw new ReferenceError(msg);
-        }
-        if (maxAliasCount >= 0) {
-            data.count += 1;
-            if (data.aliasCount === 0)
-                data.aliasCount = getAliasCount(doc, source, anchors);
-            if (data.count * data.aliasCount > maxAliasCount) {
-                const msg = 'Excessive alias count indicates a resource exhaustion attack';
-                throw new ReferenceError(msg);
-            }
-        }
-        return data.res;
+        return ctx.anchors.get(source).res;
     }
     toString(ctx, _onComment, _onChompKeep) {
         const src = `*${this.source}`;

package/node_modules/yaml/dist/compose/resolve-flow-scalar.js

@@ -66,46 +66,47 @@ function plainValue(source, onError) {
     }
     if (badChar)
         onError(0, 'BAD_SCALAR_START', `Plain value cannot start with ${badChar}`);
-    return foldLines(source);
+    return unfoldLines(source);
 }
 function singleQuotedValue(source, onError) {
     if (source[source.length - 1] !== "'" || source.length === 1)
         onError(source.length, 'MISSING_CHAR', "Missing closing 'quote");
-    return foldLines(source.slice(1, -1)).replace(/''/g, "'");
+    return unfoldLines(source.slice(1, -1)).replace(/''/g, "'");
 }
-function foldLines(source) {
+function unfoldLines(source) {
+    const line = /(.*?)\r?\n/sy;
+    let match = line.exec(source);
+    if (!match)
+        return source;
     /**
-     * The negative lookbehind here and in the `re` RegExp is to
+     * The negative lookbehinds in these RegExps are to
      * prevent causing a polynomial search time in certain cases.
      *
-     * The try-catch is for Safari, which doesn't support this yet:
+     * The try-catch is for Safari < 16.4 and other old browsers:
      * https://caniuse.com/js-regexp-lookbehind
      */
-    let first, line;
+    let trimEnd, trimBoth;
     try {
-        first = new RegExp('(.*?)(?<![ \t])[ \t]*\r?\n', 'sy');
-        line = new RegExp('[ \t]*(.*?)(?:(?<![ \t])[ \t]*)?\r?\n', 'sy');
+        trimEnd = new RegExp('(?<![ \t])[ \t]+$');
+        trimBoth = new RegExp('^[ \t]+|(?<![ \t])[ \t]+$', 'g');
     }
     catch {
-        first = /(.*?)[ \t]*\r?\n/sy;
-        line = /[ \t]*(.*?)[ \t]*\r?\n/sy;
+        trimEnd = /[ \t]+$/;
+        trimBoth = /^[ \t]+|[ \t]+$/g;
     }
-    let match = first.exec(source);
-    if (!match)
-        return source;
-    let res = match[1];
+    let res = match[1].replace(trimEnd, '');
     let sep = ' ';
-    let pos = first.lastIndex;
-    line.lastIndex = pos;
+    let pos = line.lastIndex;
     while ((match = line.exec(source))) {
-        if (match[1] === '') {
+        const lm = match[1].replace(trimBoth, '');
+        if (lm === '') {
             if (sep === '\n')
                 res += sep;
             else
                 sep = '\n';
         }
         else {
-            res += sep + match[1];
+            res += sep + lm;
             sep = ' ';
         }
         pos = line.lastIndex;

package/node_modules/yaml/dist/nodes/Alias.js

@@ -45,38 +45,40 @@ class Alias extends Node.NodeBase {
             if (node.anchor === this.source)
                 found = node;
         }
+        if (found && ctx) {
+            const { anchors, doc, maxAliasCount } = ctx;
+            let data = anchors.get(found);
+            if (!data) {
+                // Resolve anchors for Node.prototype.toJS()
+                toJS.toJS(found, null, ctx);
+                data = anchors.get(found);
+            }
+            /* istanbul ignore if */
+            if (data?.res === undefined) {
+                const msg = 'This should not happen: Alias anchor was not resolved?';
+                throw new ReferenceError(msg);
+            }
+            if (maxAliasCount >= 0) {
+                data.count += 1;
+                if (data.aliasCount === 0)
+                    data.aliasCount = getAliasCount(doc, found, anchors);
+                if (data.count * data.aliasCount > maxAliasCount) {
+                    const msg = 'Excessive alias count indicates a resource exhaustion attack';
+                    throw new ReferenceError(msg);
+                }
+            }
+        }
         return found;
     }
     toJSON(_arg, ctx) {
         if (!ctx)
             return { source: this.source };
-        const { anchors, doc, maxAliasCount } = ctx;
-        const source = this.resolve(doc, ctx);
+        const source = this.resolve(ctx.doc, ctx);
         if (!source) {
             const msg = `Unresolved alias (the anchor must be set before the alias): ${this.source}`;
             throw new ReferenceError(msg);
         }
-        let data = anchors.get(source);
-        if (!data) {
-            // Resolve anchors for Node.prototype.toJS()
-            toJS.toJS(source, null, ctx);
-            data = anchors.get(source);
-        }
-        /* istanbul ignore if */
-        if (data?.res === undefined) {
-            const msg = 'This should not happen: Alias anchor was not resolved?';
-            throw new ReferenceError(msg);
-        }
-        if (maxAliasCount >= 0) {
-            data.count += 1;
-            if (data.aliasCount === 0)
-                data.aliasCount = getAliasCount(doc, source, anchors);
-            if (data.count * data.aliasCount > maxAliasCount) {
-                const msg = 'Excessive alias count indicates a resource exhaustion attack';
-                throw new ReferenceError(msg);
-            }
-        }
-        return data.res;
+        return ctx.anchors.get(source).res;
     }
     toString(ctx, _onComment, _onChompKeep) {
         const src = `*${this.source}`;

package/node_modules/yaml/package.json

@@ -1,6 +1,6 @@
 {
   "name": "yaml",
-  "version": "2.9.0",
+  "version": "2.9.1",
   "license": "ISC",
   "author": "Eemeli Aro <eemeli@gmail.com>",
   "funding": "https://github.com/sponsors/eemeli",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@harrylabsj/kiwi-merchant-cloud",
-  "version": "0.12.0",
+  "version": "0.12.1",
   "description": "Kiwi merchant cloud runtime package",
   "license": "Apache-2.0",
   "type": "module",
@@ -26,7 +26,7 @@
     "@simplewebauthn/server": "14.0.2",
     "ajv": "8.20.0",
     "ajv-formats": "3.0.1",
-    "yaml": "2.9.0"
+    "yaml": "2.9.1"
   },
   "bundleDependencies": [
     "@modelcontextprotocol/sdk",

package/runtime-package.json

@@ -1,6 +1,6 @@
 {
   "name": "@harrylabsj/kiwi-cloud-runtime",
-  "version": "0.12.0",
+  "version": "0.12.1",
   "private": true,
   "type": "module",
   "main": "index.js",
@@ -15,7 +15,7 @@
     "@simplewebauthn/server": "14.0.2",
     "ajv": "8.20.0",
     "ajv-formats": "3.0.1",
-    "yaml": "2.9.0"
+    "yaml": "2.9.1"
   },
   "engines": {
     "node": ">=22.5.0"