@tokenoftrust/storefront-runner 4.11.8 → 4.11.9

package/apps/storefront/src/lib/access/shared/viewerGrant.ts

@@ -50,14 +50,19 @@ export class FetchShipGrantTransport implements ViewerShipGrantGetTransport {
     // every admin tab), so an unbounded hang stalls the whole document stream. A
     // timeout aborts to the documented deny-default (the resolver maps any transport/
     // timeout fault to `preview-access`) — never a render-blocking wait on a slow MCP.
-    // `redirect: "error"`: a redirect would carry the service-secret header to another origin,
-    // so it rejects (a transport fault, so a deny) and nothing is sent to the redirect target.
+    // `redirect: "manual"`, then a 3xx throws: a followed redirect would carry the service-secret
+    // header to another origin, so a redirect is a transport fault (a deny) and nothing is sent to
+    // its target. Not `redirect: "error"`: the Workers runtime rejects that value before the request
+    // leaves, so every lookup would deny without ever reaching tot-mcp.
     const res = await fetch(url, {
       method: "GET",
       headers,
-      redirect: "error",
+      redirect: "manual",
       signal: AbortSignal.timeout(2500),
     });
+    if ((res.status >= 300 && res.status < 400) || res.type === "opaqueredirect") {
+      throw new Error("grant authority answered a redirect; refused");
+    }
     return { status: res.status, json: () => res.json() };
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "4.11.8",
+  "version": "4.11.9",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",