%% AP2 server-held token에서 브라우저 Bearer 요청까지
%% question: AP2에서 AP2_SESSION으로 찾은 server-side authorized client는 어떻게 브라우저의 직접 Bearer API 호출이 되는가?
sequenceDiagram
    participant n0 as 브라우저
    participant n1 as Spring mediator
    participant n2 as Authorized-client store
    participant n3 as Resource Server
    n0->>n1: GET /token/access + AP2_SESSION
    n1->>n2: authorize current principal
    n2->>n1: current access token
    n1->>n0: access token + type + expiry
    n0->>n3: GET /api/me · browser-created Bearer
    n3->>n0: subject · username · issuer · audience