feat(client): add authenticated origin requests

[kitlangton]

What

Add a public Effect client for structured, schema-decoded JSON requests authenticated by the live browser page. Applications can atomically ensure a named Browser Control session, bind it to an exact origin, and issue same-origin requests without exporting cookies or generating execute scripts.

Sensitive responses use Effect Redacted, bypass execute journals, set Cache-Control: no-store, and fail closed while session network capture is active.

The packaged agent skill is also reorganized around an inspect-act-verify golden path with explicit completion criteria.

Before / After

Before: Application integrations had to invoke the CLI, embed JavaScript strings, parse execute envelopes, and use out-of-band private files to keep short-lived credentials out of journals. When imported from Bun, managed relay startup also reused Bun as the relay runtime, causing Playwright CDP checkout to time out.

After: Applications call the typed BrowserControlClient and AuthenticatedOrigin.json interface. Browser authentication stays in window.fetch, responses are schema-decoded, mutation ambiguity is explicit, and imported clients always launch the relay with Node even when the consumer runs under Bun.

How

• src/browser-control-client.ts exposes the Effect service, session capability, typed errors, sensitive decoding, reveal, and session reset.
• src/authenticated-origin.ts validates origins and paths, performs bounded page-context fetches, blocks redirects, and classifies request outcomes.
• src/session-manager.ts atomically ensures sessions and serializes authenticated requests with existing lifecycle permits.
• src/http-api.ts, src/relay-client.ts, and src/relay-schema.ts define the two typed relay routes and wire contracts.
• scripts/build-cli.ts, src/index.ts, and tsconfig.build.json build and publish the ESM library entrypoint with declarations.
• src/relay-lifecycle.ts maps the library entrypoint to the packaged CLI and allows Bun consumers to launch the relay explicitly with Node.

Scope

This does not serialize multi-request application workflows under one relay-owned transaction. Destructive workflows that require cross-process exclusivity, verification, and rollback should remain a single execute until that capability exists.

Saved authentication profiles remain an explicit, separate adapter. Authenticated-origin requests never read captured credentials or Secret Profiles.

Testing

• pnpm typecheck
• pnpm test (361 tests passed)
• pnpm build:cli
• pnpm pack --dry-run
• git diff --check
• Real Bun consumer verification against a signed-in X Studio page
• Verified stopped-relay auto-start, first typed request success, and node .../dist/cli.js serve as the managed process

Flow

sequenceDiagram
  participant App as Effect application
  participant Client as BrowserControlClient
  participant Relay as Node relay
  participant Page as Live browser page
  participant Origin as Same-origin server

  App->>Client: ensureSession(id)
  Client->>Relay: POST /v1/sessions/ensure
  App->>Client: origin.json(path, schema)
  Client->>Relay: POST /v1/authenticated-origin/json
  Relay->>Page: evaluate fixed fetch routine
  Page->>Origin: window.fetch with browser auth
  Origin-->>Page: bounded JSON response
  Page-->>Relay: structured outcome
  Relay-->>Client: no-store response
  Client-->>App: decoded value or Redacted value

Loading