- Add path traversal validation for ElevenLabs voice_id and HuggingFace
model_id URL concatenation (prevents SSRF via ../ sequences)
- Add saveCallLog usage tracking to video and music handlers for
consistent analytics with imageGeneration.ts
- Extract shared upstreamErrorResponse() and audioStreamResponse()
helpers to reduce error handling duplication in audioSpeech.ts
- Extract shared upstreamErrorResponse() and isValidPathSegment()
helpers in audioTranscription.ts
- Add explicit format: "openai" to qwen TTS and STT provider entries
- Remove unused modelId parameter from handleCoquiSpeech and
handleTortoiseSpeech
- Filter cloud video/music providers by active status in models route
(local providers with authType: "none" always listed)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
d97a11a54f