Implement replay-safe browser synchronization

docs/api/openapi.yaml

@@ -384,10 +384,35 @@ paths:
           $ref: '#/components/responses/NotFound'
         default:
           $ref: '#/components/responses/Error'
+  /v1/event-tickets:
+    post:
+      operationId: createEventTicket
+      description: >-
+        Creates an independent short-lived, single-use browser WebSocket
+        credential bound to the authenticated principal and request origin.
+        This ephemeral authentication exchange does not enter the public
+        domain mutation idempotency ledger.
+      responses:
+        '201':
+          description: Event ticket created. The response is not cacheable.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/EventTicket'
+        default:
+          $ref: '#/components/responses/Error'
   /v1/events:
     get:
       operationId: connectEvents
+      security:
+        - oidc: []
+        - eventTicket: []
       parameters:
+        - name: ticket
+          in: query
+          description: Short-lived single-use browser credential created by createEventTicket. Native clients may use OIDC bearer authentication instead.
+          schema:
+            $ref: '#/components/schemas/OpaqueId'
         - name: cursor
           in: query
           description: Opaque authorization-bound replay cursor from an HTTP snapshot or prior frame.
@@ -643,6 +668,10 @@ components:
       openIdConnectUrl: https://identity.invalid/.well-known/openid-configuration
     serviceAuth:
       type: mutualTLS
+    eventTicket:
+      type: apiKey
+      in: query
+      name: ticket
   parameters:
     IdempotencyKey:
       name: Idempotency-Key
@@ -1619,6 +1648,16 @@ components:
         updated_at:
           type: string
           format: date-time
+    EventTicket:
+      type: object
+      additionalProperties: false
+      required: [ticket, expires_at]
+      properties:
+        ticket:
+          $ref: '#/components/schemas/OpaqueId'
+        expires_at:
+          type: string
+          format: date-time
     ApiError:
       type: object
       additionalProperties: false