Core Architectural Flows

Code SCE is structured around five core operational workflows. Each flow connects frontend clients, Express services, database records, and external security systems.

---

Flow 1 — Publishing with Zero Source Exposure

An author publishes a component via Studio with visual proofs and documentation.

Upload Proofs→Security Scan→Store Assets→Publish

1. Upload: In Studio Step 1, the author attaches up to 5 visual previews (screenshots/GIFs), README.md, metadata, and pricing.
2. Security Pipeline: The automated scanner suite evaluates the assets:
   • Environment detector ensures client-side frontend code only.
   • NSFW image moderation checks visual proofs.
   • Keyword filter inspects metadata and documentation.
   • Simhash deduplication prevents exact and near-duplicate listing spam.
3. Store Assets: Public screenshots and README files are stored in Cloudflare R2 (public/), and the module record is created in PostgreSQL.
4. Publish: In Step 2, the author defines the config_schema. Upon final submission, clean modules go live immediately; borderline scores are held as drafts for manual review.

---

Flow 2 — Purchase & Verification

A buyer pays with cryptocurrency, and ownership unlocks solely through verified webhooks.

Checkout→Crypto Invoice→IPN Verification→Ownership

1. Checkout: The backend initiates an order using the fixed USD price from the server listing.
2. Payment: The buyer pays via NOWPayments (settled in USDT on BNB Smart Chain / BEP-20). The frontend polls the pending order.
3. Verification: NOWPayments sends a signed IPN webhook. The backend verifies the HMAC-SHA512 signature, finished status, and USD amount.
4. Ownership: On verification, an idempotent transaction records permanent ownership in PostgreSQL and unlocks the module for download.

---

Flow 3 — Gated Download & Forensic Watermarking

A buyer retrieves the purchased package securely.

Request Token→Verify & Sign→Apply Watermark→Stream

1. Request Token: The buyer initiates download; the client requests an access token (/api/modules/:id/download).
2. Verify & Sign: The server re-validates the session, confirms ownership in PostgreSQL, and generates a signed token (≤ 60s lifetime, bound to user and IP).
3. Apply Watermark: The server dynamically injects invisible zero-width HMAC marks into source files and embeds .sce/watermark.json.
4. Stream: The file streams directly to the buyer; the one-time token is consumed to prevent replay.

---

Flow 4 — Interactive Developer Messaging

Developers and creators collaborate directly through built-in chat.

Search / Open→Validate Receiver→Dispatch Message→Sync & Read

1. Discovery: A developer searches creators via /api/users/search or clicks Message Author on a module page.
2. Validation: The backend confirms both users have completed onboarding (profile_completed = true) and that the sender is not muted or messaging self.
3. Dispatch: The message (POST /api/messages) is validated (≤ 4,000 characters) and persisted to the PostgreSQL messages store.
4. Sync & Read: The recipient's global header updates its unread counter (/api/messages/unread-count), and reading the thread marks the dialogue as read.

---

Flow 5 — Multi-Provider OAuth Account Linking

An authenticated developer connects multiple login providers to a single account.

Initiate Link→OAuth Consent→Conflict Shield→Provider Linked

1. Initiate: Inside Security Settings, the user clicks Connect Google or Connect GitHub (/auth/:provider?action=link).
2. OAuth Consent: The server sets a short-lived auth_link_user session cookie and redirects to the provider consent page.
3. Conflict Shield: The callback verifies that the provider identity is not already bound to another user (PROVIDER_ALREADY_LINKED).
4. Account Update: The provider ID is attached to the existing user record, and the UI redirects back to Security Settings showing the updated connection status.

Lifecycle Integration

Together, these flows provide an end-to-end ecosystem:

[Author Publishes] ──▶ [Buyer Explores & Messages] ──▶ [Crypto Checkout] ──▶ [Watermarked Delivery]

Next Step

Quickly jump into the platform: Quick Start Guide →.