Architecture Overview


media-gateway (Express, port 3000)
  ├── /api/v1/creative/*          REST API (behind CF Tunnel + CF Access)
  ├── /api/v1/creative/social/*   Social gateway (publish, discover, track)
  ├── Providers: Seedance/Jimeng, Kling, Sora, Gemini/flow4api
  ├── Storage: R2 (primary), GDrive (fallback)
  └── Classification: claude -p (AI asset categorization)

jimeng-sign-service (Node.js, port 3457)
  └── Standalone sidecar            a_bogus signing + pure HTTP login (zero browser)

Workers (Cloudflare Edge)
  ├── asset-browser                Directory browsing at assets.frai.paradream.info
  ├── inbox-worker                 Event-driven inbox → AI classify → archive → Slack notify
  ├── job-runner                   Async generation task queue (polls every 5min)
  ├── outbox-worker                R2 outbox/ event handler → social publish
  ├── social-worker                Social gateway D1 state + cron scheduler
  └── api-gateway                  External API gateway at creative.hellyeahai.com

Python Workers (same-machine systemd)
  └── social-worker                Platform adapter (IG/TikTok) — polls Express for tasks

Jimeng Provider Architecture

The jimeng provider uses a dual-backend approach:

Primary: Standalone Sidecar — jimeng-sign-service runs on port 3457, handles all signing (a_bogus, msToken, sign headers) and session cookies natively in Node.js. Zero browser dependency.
Fallback: Browser Client — Puppeteer-based Chrome automation. Only used if the sidecar is unavailable.

Cloudflare Infrastructure

Resource	Type	Account
`creative-assets`	R2 Bucket	Company (cc323c2a…)
`inbox-state`	D1 Database	Company
`social-state`	D1 Database	Company
`api-gateway`	D1 Database	Company
`inbox-events` / `outbox-events`	Queues	Company
`frai.paradream.info`	CF Tunnel	Personal
`assets.frai.paradream.info`	CNAME → Worker (pending DNS migration)	Personal DNS
`creative.hellyeahai.com`	Worker Custom Domain	Company