digraph techviz {
  graph [rankdir=LR, splines=ortho, nodesep=0.55, ranksep=0.85];
  node [fontname=Helvetica, fontsize=11, margin="0.18,0.12", style="rounded,filled", fillcolor=white, color="#2d4357", penwidth=1.5];
  edge [fontname=Helvetica, fontsize=10, color="#364b5f", penwidth=1.4, arrowsize=0.75];
  subgraph cluster_0 {
    label="External browser";
    style="rounded,dashed";
    color="#66788a";
    n0 [label="Browser", shape=box, style="rounded,dashed,filled"];
  }
  subgraph cluster_1 {
    label="AP4 deployment path";
    style="rounded,dashed";
    color="#66788a";
    n1 [label="Nginx edge", shape=box, style="rounded,filled"];
    n2 [label="Spring upstream", shape=box, style="rounded,filled"];
    n3 [label="oauth2-proxy", shape=box, style="rounded,filled"];
  }
  n0 -> n1 [label="GET /api/edge · AP4_SESSION", style=solid];
  n1 -> n3 [label="internal /oauth2/auth subrequest", style=solid];
  n1 -> n2 [label="allowlisted identity + internal token", style=solid];
}