v4.128.0

Preview a members-only Astro site signed in

• CLI: run402 dev --as <label> mints a 2-hour test session for the test user <label>@<project_id>.test.invalid with the project's service key and hands it to the astro dev server (never the browser). With @run402/astro 2.7.0+, every dev request runs as that user, so auth.user() (is_test: true), auth.requireUser(), auth.role({ from }) and db() behave as for a signed-in visitor on the deployed site. Needs RUN402_ANON_KEY in .env.local and the project's test mode (on by default for prototype). The label is a test-user label, never an email or user id, so no real member can be impersonated.
• SDK: r.auth.createTestSession(projectId, { label, isAdmin? }) (and r.project(id).auth.createTestSession) wraps POST /auth/v1/test-sessions. It returns a credential, so it refuses on the MCP run sandbox with SECRET_REQUIRES_CLI naming run402 dev --as <label>.

Note: the 4.127.1 tarballs were built just before this change reached main; 4.128.0 is the first release that carries it.

Full Changelog: v4.127.1...v4.128.0