A full media studio behind one API.
Generate video and images, manage a private asset library, and use a dedicated /draw canvas — all billed per job, tracked per tenant, with signed-on-demand URLs on every read.
One pipeline, every media type
From a text prompt to a finished video, image, or edit — with the billing and storage guardrails built in.
Video generation
Run Sora-class video jobs through one endpoint. Track status, resolution, and duration per job. Admins can cancel or batch-cancel jobs; user deletions refund correctly.
Image generation
Generate images from text or reference images via the images API. Image-to-image edits reuse the same asset drawer, so reference images flow into new generations without re-uploading.
/draw canvas
A dedicated generation console at /draw: a常驻 composer, waterfall history grid, and one-click reference reuse. Real-time quoting that scales with the number of images, default Epic preset.
Private asset library
Every generated asset lives in a private object store. Reads are signed on demand — the database stores only object keys, never public URLs. Reference URLs are re-signed at dispatch time.
Per-job billing
Each generation is billed per job, with tier pricing stored in settlement currency to avoid cross-currency drift. Video completion tokens are recorded so output usage is never zero.
Tenant-scoped storage
Storage quotas are enforced at two levels — tenant pool (free grant × seats + subscriptions) and per-member cap. Subscriptions, purchases, and admin allocations all stack correctly.
The Media Studio console
Every generation job with status, progress, model, resolution, duration, and owning user. Cancel or batch-cancel from the console; click through to the asset or its debug exchange.
Assets are private by default
The asset library and video generation share one object store. Reads are signed on demand — S3 via SigV4 presigned URLs, local via HMAC-signed server checks. The database stores only object keys, never public URLs.
Two TTLs keep exposure tight: a short browser URL lifetime and a longer reference-URL lifetime for upstream providers. Reference images are re-signed at dispatch, so shortening the window never breaks an in-flight job.
