`POST /v1/videos` decoded `data:image/...` references but refused
`data:` video references and passed every `audio_url` to the pipeline
unchanged, so clients without a public URL could not send a reference
video or audio file (SGLang Diffusion accepts all three).
- `video_reference` / `video_path` / `video_url` accept
`data:video/...;base64,` and `audio_reference` accepts
`data:audio/...;base64,`. Each decoded file is capped by
`server.media_reference_max_bytes` (checked from the payload length
before decoding), written under `output_dir/uploads`, kept in field
order, and deleted when the job ends.
- Invalid base64, a non-base64 data URL, or a media type that does not
match the field returns HTTP 400. Percent escapes and line-wrapped
payloads decode, as in SGLang.
- Audio references are now materialized like video references: http(s)
URLs go through the media policy download (public addresses, byte
cap) and local paths must sit under `server.media_roots`. Before, the
raw string reached PyAV, which opened any local file or URL.
- `docs/design/server_contracts/openai.md` lists the accepted forms per
field.
Fixes#2018
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
