{
    "$schema": "../../../../schemas/diagram-spec.schema.json",
    "schemaVersion": "2.0",
    "diagramKind": "deployment",
    "id": "deployment-editorial-platform",
    "title": "Editorial Platform Deployment",
    "description": "Vendor-neutral production topology from public ingress through a private runtime to restricted data.",
    "language": "en",
    "environment": "production",
    "entryNodeIds": [
        "public-client"
    ],
    "boundaries": [
        {
            "id": "managed-cloud",
            "type": "cloud-provider",
            "title": "MANAGED CLOUD"
        },
        {
            "id": "primary-region",
            "type": "region",
            "title": "PRIMARY REGION",
            "parentId": "managed-cloud"
        },
        {
            "id": "workload-network",
            "type": "network",
            "title": "EDITORIAL WORKLOAD NETWORK",
            "parentId": "primary-region",
            "exposure": "public"
        },
        {
            "id": "public-subnet",
            "type": "subnet",
            "title": "PUBLIC EDGE",
            "parentId": "workload-network",
            "exposure": "public"
        },
        {
            "id": "private-subnet",
            "type": "subnet",
            "title": "PRIVATE APPLICATION",
            "parentId": "workload-network",
            "exposure": "private"
        },
        {
            "id": "restricted-subnet",
            "type": "subnet",
            "title": "RESTRICTED DATA",
            "parentId": "workload-network",
            "exposure": "restricted"
        }
    ],
    "nodes": [
        {
            "id": "public-client",
            "type": "external-system",
            "title": "Publishing Client",
            "description": "Starts an authenticated editorial publishing request.",
            "technology": "HTTPS client",
            "exposure": "public"
        },
        {
            "id": "edge-gateway",
            "type": "gateway",
            "title": "Edge Gateway",
            "description": "Terminates public ingress and applies request policy.",
            "technology": "API gateway",
            "exposure": "public",
            "boundaryId": "public-subnet"
        },
        {
            "id": "public-balancer",
            "type": "load-balancer",
            "title": "Public Load Balancer",
            "description": "Distributes accepted requests to the inspection tier.",
            "technology": "L7 balancer",
            "exposure": "public",
            "boundaryId": "public-subnet"
        },
        {
            "id": "ingress-firewall",
            "type": "firewall",
            "title": "Ingress Firewall",
            "description": "Inspects traffic entering the private application tier.",
            "technology": "WAF",
            "exposure": "private",
            "boundaryId": "private-subnet"
        },
        {
            "id": "application-host",
            "type": "host",
            "title": "Application Host",
            "description": "Provides the managed execution environment.",
            "technology": "Linux host",
            "exposure": "private",
            "boundaryId": "private-subnet"
        },
        {
            "id": "editorial-service",
            "type": "service",
            "title": "Editorial Service",
            "description": "Validates sources and renders deterministic artifacts.",
            "technology": "Node.js 22",
            "exposure": "private",
            "boundaryId": "private-subnet"
        },
        {
            "id": "diagram-database",
            "type": "database",
            "title": "Diagram Database",
            "description": "Stores managed sources, hashes, and review state.",
            "technology": "PostgreSQL 16",
            "exposure": "restricted",
            "boundaryId": "restricted-subnet"
        }
    ],
    "edges": [
        {
            "id": "client-to-gateway",
            "from": "public-client",
            "to": "edge-gateway",
            "type": "communication",
            "description": "Submits a publishing request",
            "protocol": "HTTPS",
            "port": 443,
            "boundaryIds": [
                "managed-cloud",
                "primary-region",
                "workload-network",
                "public-subnet"
            ]
        },
        {
            "id": "gateway-to-balancer",
            "from": "edge-gateway",
            "to": "public-balancer",
            "type": "communication",
            "description": "Forwards an accepted request",
            "protocol": "HTTPS",
            "port": 443
        },
        {
            "id": "balancer-to-firewall",
            "from": "public-balancer",
            "to": "ingress-firewall",
            "type": "communication",
            "description": "Routes traffic for inspection",
            "protocol": "HTTPS",
            "port": 443,
            "boundaryIds": [
                "public-subnet",
                "private-subnet"
            ]
        },
        {
            "id": "firewall-to-host",
            "from": "ingress-firewall",
            "to": "application-host",
            "type": "communication",
            "description": "Forwards inspected traffic",
            "protocol": "HTTPS",
            "port": 8443
        },
        {
            "id": "host-to-service",
            "from": "application-host",
            "to": "editorial-service",
            "type": "communication",
            "description": "Invokes the editorial runtime",
            "protocol": "HTTP",
            "port": 8080
        },
        {
            "id": "service-to-database",
            "from": "editorial-service",
            "to": "diagram-database",
            "type": "communication",
            "description": "Reads and writes managed sources",
            "protocol": "TLS",
            "port": 5432,
            "boundaryIds": [
                "private-subnet",
                "restricted-subnet"
            ]
        }
    ]
}