bump version to 1.6.4

- 主标题固定 top=200，副标题固定 top=380，不再根据封面形象高度和文字行数动态计算
- 清理未使用的 avatarTop、hasAvatar、mainTitleHeight、subtitleHeight 变量
- 补全 renderCover useCallback 依赖数组（增加 loadAvatarImage）

.github/workflows/release.yml

@@ -25,6 +25,8 @@ jobs:
     name: Build macOS (Universal)
     if: ${{ github.event_name == 'push' || inputs.platform == 'all' || inputs.platform == 'macos' }}
     runs-on: macos-latest
+    permissions:
+      contents: write
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -96,6 +98,7 @@ jobs:
         env:
           VITE_API_BASE_URL: https://dev.tapi.meijiaka.cn/api/v1
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
 
       - name: Upload artifacts
         uses: actions/upload-artifact@v4
@@ -103,12 +106,25 @@ jobs:
           name: macos-universal
           path: |
             tauri-app/src-tauri/target/universal-apple-darwin/release/bundle/dmg/*.dmg
-            tauri-app/src-tauri/target/universal-apple-darwin/release/bundle/dmg/*.dmg.sig
+            tauri-app/src-tauri/target/universal-apple-darwin/release/bundle/macos/*.app.tar.gz
+            tauri-app/src-tauri/target/universal-apple-darwin/release/bundle/macos/*.app.tar.gz.sig
+          retention-days: 3
+
+      - name: Upload to GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: ${{ github.ref_name }}
+          files: |
+            tauri-app/src-tauri/target/universal-apple-darwin/release/bundle/dmg/*.dmg
+            tauri-app/src-tauri/target/universal-apple-darwin/release/bundle/macos/*.app.tar.gz
+            tauri-app/src-tauri/target/universal-apple-darwin/release/bundle/macos/*.app.tar.gz.sig
 
   build-windows:
     name: Build Windows (x64)
     if: ${{ github.event_name == 'push' || inputs.platform == 'all' || inputs.platform == 'windows' }}
     runs-on: windows-latest
+    permissions:
+      contents: write
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -144,6 +160,7 @@ jobs:
           New-Item -ItemType Directory -Force -Path tauri-app/src-tauri/binaries
           gh release download v0.0.0-sidecar --repo ${{ github.repository }} --pattern "sidecar-binaries.tar.gz" --dir $env:TEMP
           tar xzf "$env:TEMP\sidecar-binaries.tar.gz" -C tauri-app/src-tauri/binaries/
+          Get-ChildItem tauri-app/src-tauri/binaries/
         env:
           GH_TOKEN: ${{ github.token }}
 
@@ -170,6 +187,7 @@ jobs:
         env:
           VITE_API_BASE_URL: https://dev.tapi.meijiaka.cn/api/v1
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
 
       - name: Upload artifacts
         uses: actions/upload-artifact@v4
@@ -178,4 +196,15 @@ jobs:
           path: |
             tauri-app/src-tauri/target/x86_64-pc-windows-msvc/release/bundle/nsis/*.exe
             tauri-app/src-tauri/target/x86_64-pc-windows-msvc/release/bundle/nsis/*.exe.sig
+            tauri-app/src-tauri/target/x86_64-pc-windows-msvc/release/bundle/nsis/*-setup.exe
+          retention-days: 3
+
+      - name: Upload to GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: ${{ github.ref_name }}
+          files: |
+            tauri-app/src-tauri/target/x86_64-pc-windows-msvc/release/bundle/nsis/*.exe
+            tauri-app/src-tauri/target/x86_64-pc-windows-msvc/release/bundle/nsis/*.exe.sig
+            tauri-app/src-tauri/target/x86_64-pc-windows-msvc/release/bundle/nsis/*-setup.exe
 

.gitignore

@@ -27,3 +27,7 @@ test_kick.sh
 .qiniu_pythonsdk_hostscache.json
 tauri-app/src-tauri/binaries/*
 .tauri-signing-key
+*.key
+*test*.key*
+.atomcode/
+mixkit_bgm/

.gitlab-ci.yml

@@ -80,8 +80,9 @@ build-frontend-macos:
     paths:
       # DMG 安装包 (推荐用户下载)
       - tauri-app/src-tauri/target/universal-apple-darwin/release/bundle/dmg/*.dmg
-      # .app bundle (供进一步分发或公证使用)
-      - tauri-app/src-tauri/target/universal-apple-darwin/release/bundle/macos/*.app
+      # Updater 专用包 + 签名
+      - tauri-app/src-tauri/target/universal-apple-darwin/release/bundle/macos/*.app.tar.gz
+      - tauri-app/src-tauri/target/universal-apple-darwin/release/bundle/macos/*.app.tar.gz.sig
     expire_in: "${ARTIFACT_EXPIRE_DAYS} days"
   timeout: 45 minutes
   retry:
@@ -114,8 +115,11 @@ build-frontend-windows:
   artifacts:
     name: "meijiaka-windows-${CI_COMMIT_REF_NAME}-${CI_COMMIT_SHORT_SHA}"
     paths:
-      # NSIS 安装包 (推荐用户下载)
+      # Updater 专用包 + 签名
       - tauri-app/src-tauri/target/x86_64-pc-windows-msvc/release/bundle/nsis/*.exe
+      - tauri-app/src-tauri/target/x86_64-pc-windows-msvc/release/bundle/nsis/*.exe.sig
+      # NSIS 安装包 (推荐用户下载)
+      - tauri-app/src-tauri/target/x86_64-pc-windows-msvc/release/bundle/nsis/*-setup.exe
       # MSI 安装包 (企业部署场景)
       - tauri-app/src-tauri/target/x86_64-pc-windows-msvc/release/bundle/msi/*.msi
     expire_in: "${ARTIFACT_EXPIRE_DAYS} days"

AGENTS.md

@@ -9,7 +9,7 @@
 **美家卡智影**是一款面向桌面端的 AI 视频创作应用，采用"Python 后端 API + Tauri 桌面前端"的混合架构。
 
 - **产品标识**: `cn.meijiaka.ai-video` / `cn.meijiaka.ai-zy`
-- **版本**: `1.5.18`
+- **版本**: `1.6.4`
 - **核心功能**: AI 脚本生成、AI 配音合成（TTS）、声音复刻、视频生成（Vidu）、视频字幕生成、压制成片（FFmpeg）、项目本地持久化
 
 ### 技术栈总览

VERSION

@@ -1 +1 @@
-1.5.18
+1.6.4

docs/app-update-system.md

@@ -71,7 +71,7 @@ INSERT INTO app_releases (version, release_date, notes, mandatory) VALUES
 ('0.2.0', '2026-04-20 10:00:00', '新增：批量导出功能\n优化：性能提升 30%', FALSE);
 ```
 
-#### 2.1.2 release_packages - 平台包信息
+#### 2.1.2 mjk_app_release_packages - 平台包信息
 
 | 字段 | 类型 | 说明 | 约束 |
 |------|------|------|------|
@@ -97,7 +97,7 @@ INSERT INTO app_releases (version, release_date, notes, mandatory) VALUES
 
 **示例数据**:
 ```sql
-INSERT INTO release_packages (release_id, platform, architecture, filename, file_url, file_size, file_hash) VALUES
+INSERT INTO mjk_app_release_packages (release_id, platform, architecture, filename, file_url, file_size, file_hash) VALUES
 (2, 'darwin', 'x86_64', 'meijiaka_0.1.1_darwin_x86_64.dmg',
  'https://cdn.meijiaka.com/releases/meijiaka_0.1.1_darwin_x86_64.dmg',
  102400000, 'sha256:abc123...'),
@@ -129,7 +129,7 @@ INSERT INTO release_packages (release_id, platform, architecture, filename, file
 CREATE INDEX idx_releases_release_date ON app_releases(release_date DESC);
 
 -- 平台包复合索引
-CREATE INDEX idx_packages_platform_arch ON release_packages(platform, architecture);
+CREATE INDEX idx_packages_platform_arch ON mjk_app_release_packages(platform, architecture);
 
 -- 下载统计
 CREATE INDEX idx_downloads_release_id ON update_downloads(release_id);
@@ -151,7 +151,7 @@ CREATE TABLE IF NOT EXISTS app_releases (
 );
 
 -- 创建平台包信息表
-CREATE TABLE IF NOT EXISTS release_packages (
+CREATE TABLE IF NOT EXISTS mjk_app_release_packages (
     id SERIAL PRIMARY KEY,
     release_id INTEGER NOT NULL REFERENCES app_releases(id) ON DELETE CASCADE,
     platform VARCHAR(20) NOT NULL,
@@ -177,8 +177,8 @@ CREATE TABLE IF NOT EXISTS update_downloads (
 -- 创建索引
 CREATE INDEX IF NOT EXISTS idx_releases_version ON app_releases(version);
 CREATE INDEX IF NOT EXISTS idx_releases_release_date ON app_releases(release_date DESC);
-CREATE INDEX IF NOT EXISTS idx_packages_platform_arch ON release_packages(platform, architecture);
-CREATE INDEX IF NOT EXISTS idx_packages_release_id ON release_packages(release_id);
+CREATE INDEX IF NOT EXISTS idx_packages_platform_arch ON mjk_app_release_packages(platform, architecture);
+CREATE INDEX IF NOT EXISTS idx_packages_release_id ON mjk_app_release_packages(release_id);
 CREATE INDEX IF NOT EXISTS idx_downloads_release_id ON update_downloads(release_id);
 CREATE INDEX IF NOT EXISTS idx_downloads_download_at ON update_downloads(download_at);
 
@@ -240,7 +240,7 @@ class AppRelease(Base):
 
 class ReleasePackage(Base):
     """平台包信息"""
-    __tablename__ = "release_packages"
+    __tablename__ = "mjk_app_release_packages"
     
     id: Mapped[int] = mapped_column(Integer, primary_key=True)
     release_id: Mapped[int] = mapped_column(

docs/frontend-compatibility-audit-v2.md

@@ -0,0 +1,756 @@
+# 前端系统兼容性审查报告 v2（业务场景驱动）
+
+> 审查范围：`tauri-app/src` 全部源码 + `tauri-app/src-tauri/src` Rust 层命令
+> 审查方法：按用户真实使用路径和数据流转分析，非通用技术罗列
+> 审查日期：2026-05-21
+> 当前版本：v1.6.0
+
+---
+
+## 一、综述
+
+本次审查以**用户真实操作流程**为主线，从数据持久化、媒体处理、第三方服务、版本升级、跨设备迁移五个业务维度展开，共发现 **14 项与业务直接相关的兼容性问题**。
+
+**核心结论**：
+1. **BGM 云端化改造存在链路缺口**：前端存储了 URL，但混音时直接传给 FFmpeg，未做本地缓存，网络波动或 URL 过期会导致合成失败或产生"无声成片"。
+2. **积分消费存在 TOCTOU 竞态**：预检通过→合成完成→扣费失败之间有时间窗口，可能导致用户白嫖或重复扣费。
+3. **项目数据完全不可迁移**：所有本地路径为绝对路径，无导出/导入功能，换设备后项目报废。
+4. **磁盘满等大文件场景缺乏保护**：合成成果可能直接丢失，大视频上传/下载全量读内存。
+5. **多处"静默失败"**：保存项目、分段配音、BGM 混音等关键环节出错时不提示用户，导致用户以为成功实际数据残缺。
+
+---
+
+## 二、🔴 严重问题（影响功能、数据或资金）
+
+### 1. BGM 云端化后混音链路断裂——"无声成片"与合成失败
+
+**业务场景**：
+1. 用户在 BGM 弹窗中选择一首云端 BGM（七牛云 URL）
+2. 保存项目（`bgmMusicPath` 写入 `meta.json`，值为 `https://media.liche.cn/.../xxx.mp3`）
+3. 几天后点击「合成视频」，FFmpeg 混音时直接拉取该 URL
+4. 网络波动或 URL 签名过期 → FFmpeg HTTP 输入超时 → 混音失败
+
+**实际代码路径**：
+```typescript
+// VideoCompose.tsx:265-276
+if (bgmMusicPath) {
+  const mixRes = await invoke('mix_bgm_to_video', {
+    args: {
+      videoPath: result,
+      bgmPath: bgmFullPath,   // <-- 这里是七牛云 URL，不是本地路径
+      outputPath: result,
+      bgmVolume: (bgmVolume ?? 0.25),
+    },
+  });
+  if (mixRes.code !== 200) {
+    console.warn('BGM 混合失败，使用无 BGM 版本:', mixRes.message);
+  }
+}
+```
+
+```rust
+// ffmpeg_cmd.rs:509-546
+pub async fn mix_bgm_to_video(...) {
+    let safe_video = validate_safe_path(video_path)?;  // 只校验视频路径
+    let safe_bgm = bgm_path.to_string();                // <-- 直接透传 URL，无校验
+    run_ffmpeg(app, vec!["-i", safe_video, "-i", safe_bgm, ...])
+}
+```
+
+**用户实际看到**：
+- 界面提示「压制成片完成」✅
+- 播放视频发现**没有背景音乐** ❌
+- 用户以为是自己操作问题，反复合成浪费积分和时间
+
+**影响评估**：
+- 功能完整性受损：选了 BGM 却出无声视频
+- 积分浪费：每次合成消耗积分，但产出不符合预期
+- 用户信任度下降：无法解释为什么有时有 BGM 有时没有
+
+**修复建议**：
+在 `VideoCompose.tsx` `handleStart` 中，混音前确保 BGM 为本地文件：
+```typescript
+let finalBgmPath = bgmMusicPath;
+if (bgmMusicPath?.startsWith('http')) {
+  // 下载到本地缓存目录
+  const cacheDir = await invoke<string>('get_bgm_cache_dir');
+  const cachedPath = `${cacheDir}/bgm_${bgmMusicId}.mp3`;
+  const exists = await invoke<boolean>('file_exists', { path: cachedPath });
+  if (!exists) {
+    useProgressStore.getState().update('正在下载背景音乐...');
+    await videoComposeApi.downloadFile({ url: bgmMusicPath, outputPath: cachedPath });
+  }
+  finalBgmPath = cachedPath;
+}
+// 然后传给 mix_bgm_to_video
+```
+
+Rust 侧 `mix_bgm_to_video` 应恢复 `validate_safe_path` 校验，拒绝 URL：
+```rust
+let safe_bgm = validate_safe_path(bgm_path)?;  // 强制要求本地路径
+```
+
+---
+
+### 2. 积分消费 TOCTOU 竞态——合成完成扣费失败导致"白嫖"或需重来
+
+**业务场景**：
+1. 用户点击「合成视频」，预检余额充足（如 50 积分，需扣 5 分）
+2. 视频合成耗时 3-5 分钟
+3. 期间用户在手机端或其他场景消费了积分，余额降至 3 分
+4. 合成完成后调用 `consumePoints`，返回 402 "积分不足"
+5. 前端回滚 `finalVideoPath` 状态，但**不删除已生成的视频文件**
+
+**实际代码**：
+```typescript
+// VideoCompose.tsx:287-309
+const composePoints = usePointStore.getState().getRule('compose')?.points || 5;
+try {
+  await pointsApi.consumePoints({
+    points: composePoints,
+    sourceType: 'compose',
+    sourceId: `compose_${useAuthStore.getState().user?.id || 'unknown'}_${Date.now()}`,
+    description: '压制成片',
+  });
+} catch (err) {
+  const msg = err instanceof Error ? err.message : String(err);
+  setResultPath('');
+  setFinalVideoPath(undefined);   // 回滚前端状态
+  setExportedAt(undefined);
+  // ❌ 没有删除 products/ 目录下已生成的视频文件
+  if (msg.includes('402') || msg.includes('积分不足')) {
+    setShowPointsModal(true);
+    return;
+  }
+}
+```
+
+**用户实际看到**：
+- 提示「积分不足」弹出充值弹窗
+- 但 `~/Library/Application Support/cn.meijiaka.ai-zy/projects/xxx/products/` 下已经有一份完整的 `.mp4`
+- 用户可以通过 Finder 直接找到并播放该文件，**实际已白嫖成功**
+- 或者用户充值后再次点击合成，重复消耗时间
+
+**影响评估**：
+- 资金损失风险：用户可在不扣积分的情况下拿到成品
+- 用户体验差：明明看到"合成完成"的进度条走到 100%，最后说积分不够
+- 运营数据失真：成品文件存在但系统无消费记录
+
+**修复建议（方案二选一）**：
+
+**方案 A：积分预占/冻结机制（推荐）**
+后端新增 "预占积分" API，合成前预占 5 积分，合成完成后确认扣费，失败则释放。消除时间窗口。
+
+**方案 B：扣费前置 + 失败清理**
+若无法改后端，至少做到失败时清理文件：
+```typescript
+} catch (err) {
+  // 回滚状态
+  setResultPath('');
+  setFinalVideoPath(undefined);
+  // 清理已生成的文件
+  if (outputPath) {
+    await invoke('delete_project_file', { projectId, filePath: outputPath })
+      .catch(() => {});  // 清理失败不阻断错误提示
+  }
+  // ... 原有错误处理
+}
+```
+
+---
+
+### 3. 项目数据绝对路径依赖——换设备后项目完全报废
+
+**业务场景**：
+1. 用户 Mac A 上创建项目，生成视频，一切正常
+2. 用户将 `~/Library/Application Support/cn.meijiaka.ai-zy/projects/` 文件夹复制到 Mac B（或 Time Machine 恢复）
+3. 在 Mac B 上打开应用，项目列表显示正常
+4. 点击项目进入编辑，视频预览空白、配音无法播放、封面无法加载
+
+**根本原因**：
+`meta.json` 和 `segments.json` 中所有本地文件路径均为**绝对路径**：
+```json
+{
+  "avatarMaterialPath": "/Users/alice/Library/Application Support/cn.meijiaka.ai-zy/projects/proj_xxx/assets/voice.mp3",
+  "burnedVideoPath": "/Users/alice/Library/Application Support/.../burned_xxx.mp4",
+  "coverPath": "/Users/alice/Library/Application Support/.../cover.png"
+}
+```
+
+Mac B 上用户名为 `bob`，上述路径全部指向不存在的目录。
+
+**当前代码无修复机制**：
+- `loadMeta` 直接返回磁盘数据，无路径校验或重映射
+- `getLocalFileUrl` 调用 Rust `validate_media_path`，校验通过后会返回 `asset://` URL，但文件不存在时直接抛错
+- `useLocalVideo` 抛错后显示空白，无降级提示
+
+**用户实际看到**：
+- 项目标题、主题等文字信息正常
+- 视频预览区域空白或转圈
+- 配音试听按钮点击无反应
+- 用户以为数据损坏，恐慌
+
+**影响评估**：
+- 用户换机/重装系统后所有本地项目无法继续编辑
+- 与「桌面端本地持久化」的核心卖点相矛盾
+- Time Machine 备份恢复后项目数据"假死"
+
+**修复建议**：
+
+**短期（最小改动）**：加载项目时检测路径有效性，无效时给出明确提示：
+```typescript
+// initProjectStore 中
+const validatedMeta = await validateProjectPaths(meta);
+if (validatedMeta.brokenPaths.length > 0) {
+  toast.warn(`项目 ${validatedMeta.brokenPaths.join(', ')} 关联的文件已丢失，可能因迁移设备或清理磁盘导致`);
+}
+```
+
+**长期**：
+1. 持久化时存储**相对路径**（相对于项目目录）
+2. 加载时解析为绝对路径：
+```typescript
+function resolveProjectPath(projectId: string, relativePath: string): string {
+  return `${APP_LOCAL_DATA_DIR}/projects/${projectId}/${relativePath}`;
+}
+```
+3. 新增「项目包导出/导入」功能：将 `meta.json` + `segments.json` + `assets/` + `videos/` 打包为 `.zip`
+
+---
+
+### 4. 磁盘空间不足时合成成果直接丢失
+
+**业务场景**：
+1. 用户 Mac 剩余空间 2GB
+2. 合成一个 1.5GB 的视频，临时文件 + 输出文件刚好占满磁盘
+3. FFmpeg 合成成功，但 `std::fs::copy` 移动最终文件时因磁盘满失败
+4. 临时文件被清理，用户一无所获
+
+**实际代码**：
+```rust
+// video_processing.rs:93
+std::fs::rename(&final_output, output_path)
+    .or_else(|_| {
+        std::fs::copy(&final_output, output_path)
+            .and_then(|_| std::fs::remove_file(&final_output))
+    })
+```
+
+`rename` 跨卷时失败，`copy` 在磁盘满时失败，临时文件在 `Drop` 或后续清理中被删除。
+
+**用户实际看到**：
+- 进度条走到 100%，显示「正在保存...」
+- 突然报错「移动最终视频失败」
+- 数分钟的等待 + 积分消耗，结果什么都没有
+
+**影响评估**：
+- 极端挫败感：用户最高预期时刻（"马上完成了"）直接失败
+- 积分和时间双重浪费
+
+**修复建议**：
+1. 合成前检查磁盘空间：
+```rust
+// 在 handleStart 调用前
+let required_space = estimate_output_size(video_paths) * 2;  // 输出 + 临时文件
+let available = fs2::available_space(&output_parent)?;
+if available < required_space {
+    return Err("磁盘空间不足，需要至少 {} GB 可用空间".into());
+}
+```
+2. `copy` 失败时保留临时文件，给用户手动恢复的机会：
+```rust
+if let Err(e) = std::fs::copy(&final_output, output_path) {
+    return Err(format!("保存失败（磁盘可能已满）。临时文件保留在: {}，错误: {}",
+        final_output.display(), e));
+}
+```
+
+---
+
+### 5. 大文件上传/下载全量读内存——低配机器 OOM
+
+**业务场景**：
+1. 用户生成了一段 10 分钟 1080p 视频，文件大小 500MB
+2. 点击「上传」或系统自动上传到七牛云/后端
+3. Rust 侧 `std::fs::read(local_path)` 将 500MB 全量读入内存
+4. 再复制到 reqwest multipart body，峰值内存占用 >1GB
+5. 8GB 内存的 MacBook Air 可能触发系统 OOM，应用被杀死
+
+**实际代码**：
+```rust
+// Rust 侧 upload_video_file / upload_audio_file
+let file_bytes = match std::fs::read(local_path) { ... };
+let form = reqwest::multipart::Form::new()
+    .part("file", reqwest::multipart::Part::bytes(file_bytes) ...);
+```
+
+```rust
+// Rust 侧 download_file
+let client = reqwest::Client::new();  // 默认无超时
+let bytes = match response.bytes().await { ... };  // 全量入内存
+std::fs::write(&safe_output, &bytes);
+```
+
+**用户实际看到**：
+- 上传/下载大文件时应用突然消失（被系统杀死）
+- 或进度条卡住很久，没有任何反馈
+- 重启后需要重新开始整个流程
+
+**影响评估**：
+- 长视频用户（核心目标用户群）完全无法使用
+- 应用稳定性差，低配置设备体验极差
+
+**修复建议**：
+
+上传改用流式：
+```rust
+use tokio::fs::File;
+use tokio::io::AsyncReadExt;
+
+let file = File::open(local_path).await?;
+let stream = tokio_util::codec::FramedRead::new(file, tokio_util::codec::BytesCodec::new());
+let body = reqwest::Body::wrap_stream(stream);
+let part = reqwest::multipart::Part::stream(body)
+    .file_name(filename)
+    .mime_str("video/mp4")?;
+```
+
+下载改用边下边写 + 超时：
+```rust
+let client = reqwest::Client::builder()
+    .timeout(std::time::Duration::from_secs(300))
+    .connect_timeout(std::time::Duration::from_secs(30))
+    .build()?;
+
+let mut response = client.get(url).send().await?;
+let mut file = tokio::fs::File::create(&safe_output).await?;
+while let Some(chunk) = response.chunk().await? {
+    tokio::io::copy(&mut chunk.as_ref(), &mut file).await?;
+}
+```
+
+---
+
+## 三、🟡 中等问题（影响体验或存在数据风险）
+
+### 6. 保存项目失败用户完全不知情——数据丢失风险
+
+**业务场景**：
+1. 用户在 CoverDesign 页面调整标题，触发自动保存
+2. 磁盘已满（或文件被其他程序锁定）
+3. `saveMetaToLocalFile` 抛出 IO 错误
+4. 错误被 `.catch` 捕获后只 `console.error`，**没有任何 UI 提示**
+5. 用户继续编辑，关闭应用
+6. 重新打开后发现之前的修改全部丢失
+
+**实际代码**：
+```typescript
+// localStorage.ts 中的 safeInvoke 错误处理
+try {
+  const result = await invoke<T>(cmd, args);
+  return result;
+} catch (error) {
+  console.error(`Tauri IPC 调用失败 [${cmd}]:`, error);
+  throw error;  // 抛给上层
+}
+
+// saveMetaToLocalFile 调用链
+metaSavePromise = metaSavePromise.then(task).catch(err => {
+  console.error('保存项目元数据失败:', err);
+  throw err;  // 继续抛出，但无人处理
+});
+```
+
+**用户实际看到**：
+- 没有任何错误提示
+- 下次打开项目时数据回到旧状态
+- 用户以为是应用 bug，不信任自动保存功能
+
+**修复建议**：
+在 `saveMetaToLocalFile` 的 catch 中增加用户可见提示：
+```typescript
+metaSavePromise = metaSavePromise.then(task).catch(err => {
+  console.error('保存项目元数据失败:', err);
+  const message = err instanceof Error ? err.message : String(err);
+  if (message.includes('磁盘') || message.includes('space') || message.includes('No space')) {
+    toast.error('项目保存失败：磁盘空间不足，请清理后重试');
+  } else {
+    toast.error('项目保存失败，请检查文件权限或重启应用');
+  }
+  throw err;
+});
+```
+
+---
+
+### 7. 配音分段失败静默继续——"部分缺失"的配音
+
+**业务场景**：
+1. 用户生成 10 段配音，每段对应一个分镜
+2. 第 3 段 `extractAudioSegment` 或 `uploadAudioFile` 失败（网络抖动、文件被占用）
+3. 错误被 catch 后只 `console.error`，循环继续
+4. 最终提示「配音合成完成」
+5. 用户导出视频后发现第 3 分镜没有声音
+
+**实际代码**：
+```typescript
+// VoiceSynthesis.tsx:243-245（近似逻辑）
+for (const segment of segments) {
+  try {
+    await extractAudioSegment(...);
+    await uploadAudioFile(...);
+  } catch (err) {
+    console.error('分段处理失败:', err);  // ❌ 静默吞掉
+    // 循环继续...
+  }
+}
+toast.success('配音合成完成');
+```
+
+**用户实际看到**：
+- 提示「配音合成完成」✅
+- 导出视频后发现部分片段无声 ❌
+- 无法定位是哪一段出了问题
+
+**修复建议**：
+```typescript
+const failedSegments: string[] = [];
+for (const segment of segments) {
+  try {
+    await extractAudioSegment(...);
+    await uploadAudioFile(...);
+  } catch (err) {
+    console.error('分段处理失败:', err);
+    failedSegments.push(segment.id);
+    // 继续处理其他段，但记录失败
+  }
+}
+if (failedSegments.length > 0) {
+  toast.warn(`配音合成部分完成，第 ${failedSegments.join(', ')} 段处理失败，请检查网络后重试`);
+} else {
+  toast.success('配音合成完成');
+}
+```
+
+---
+
+### 8. 轮询任务状态遇到网络闪断直接失败——长任务前功尽弃
+
+**业务场景**：
+1. 用户提交 Vidu 视频生成任务，进入轮询等待
+2. 轮询 3 分钟后，用户 WiFi 短暂断开 5 秒
+3. `getTaskStatus` 抛出网络错误
+4. `while` 循环无内部 try-catch，整个函数抛出异常
+5. 前端提示「视频生成失败」
+6. 实际上后端任务仍在执行，用户需重新提交并再次等待
+
+**实际代码**：
+```typescript
+// useVideoGeneration.ts / ScriptCreation.tsx 等处的轮询逻辑
+while (status === 'pending' || status === 'running') {
+  await new Promise(resolve => setTimeout(resolve, pollInterval));
+  const resp = await taskApi.getTaskStatus(taskId);  // ❌ 无 try-catch
+  status = resp.status;
+}
+```
+
+**用户实际看到**：
+- 等待数分钟后突然报错「失败」
+- 重新提交后又需等待同样长的时间
+- 后端实际上可能已经完成了任务，但前端放弃了
+
+**修复建议**：
+```typescript
+let consecutiveErrors = 0;
+const MAX_CONSECUTIVE_ERRORS = 3;
+
+while (status === 'pending' || status === 'running') {
+  await new Promise(resolve => setTimeout(resolve, pollInterval));
+  try {
+    const resp = await taskApi.getTaskStatus(taskId);
+    status = resp.status;
+    consecutiveErrors = 0;
+  } catch (err) {
+    consecutiveErrors++;
+    console.warn(`轮询失败 (${consecutiveErrors}/${MAX_CONSECUTIVE_ERRORS}):`, err);
+    if (consecutiveErrors >= MAX_CONSECUTIVE_ERRORS) {
+      throw new Error('网络异常，视频状态获取失败，请稍后重试');
+    }
+    // 继续轮询，给用户一个恢复的机会
+  }
+}
+```
+
+---
+
+### 9. 余额获取失败 = 误判为余额不足——有积分却被阻止
+
+**业务场景**：
+1. 用户打开应用，网络较差
+2. `fetchBalance` 调用失败（`console.error` 后静默）
+3. `balance` 保持默认值 `0`
+4. 用户点击「合成视频」
+5. 预检：`currentBalance < requiredPoints` → `0 < 5` → **阻止**
+6. 用户明明有积分，却无法使用
+
+**实际代码**：
+```typescript
+// pointStore.ts
+fetchBalance: async () => {
+  try {
+    const data = await pointsApi.getBalance();
+    set({ balance: data.balance, rules: data.rules });
+  } catch (e) {
+    console.error('获取积分余额失败:', e);  // ❌ 静默失败
+    // balance 保持旧值或 0
+  }
+},
+```
+
+**用户实际看到**：
+- 点击合成按钮后弹出「积分不足」充值弹窗
+- 用户去「我的」页面查看，发现余额显示为 0 或旧值
+- 刷新页面后余额恢复正常
+
+**修复建议**：
+```typescript
+fetchBalance: async () => {
+  try {
+    const data = await pointsApi.getBalance();
+    set({ balance: data.balance, rules: data.rules, balanceError: null });
+  } catch (e) {
+    console.error('获取积分余额失败:', e);
+    set({ balanceError: '获取余额失败，请检查网络' });
+    // balance 保持旧值，不要变成 0
+  }
+},
+
+// 预检时
+if (balanceError) {
+  // 无法确认余额，允许操作但提示风险
+  toast.warn('余额获取失败，将尝试扣费，若余额不足会提示充值');
+  return true;
+}
+```
+
+---
+
+### 10. 多应用实例并发修改导致数据覆盖
+
+**业务场景**：
+1. 用户双击应用图标，意外打开两个窗口（或命令行启动第二个实例）
+2. 实例 A 在 CoverDesign 修改标题为「现代简约风」
+3. 实例 B 在 ScriptCreation 修改主题为「奶油风」
+4. 两个实例同时点击保存
+5. 实例 A 的保存覆盖了实例 B 的修改（或反之）
+
+**根因分析**：
+`saveMetaToLocalFile` 使用 Read-Modify-Write 模式：
+1. 读 `meta.json`
+2. 内存合并
+3. 写 `meta.json`（带文件锁，保证单写）
+
+但文件锁只保护"写"操作，两个实例可以同时读取同一个文件，然后各自基于旧版本修改并写入，导致后写入的覆盖前者。
+
+**用户实际看到**：
+- 在一个窗口里明明保存了修改
+- 切到另一个窗口再切回来，发现修改消失了
+- 用户以为是应用不稳定
+
+**修复建议**：
+1. **应用层单实例锁**：启动时检查是否已有实例在运行
+```rust
+// main.rs
+let single = single_instance::SingleInstance::new("cn.meijiaka.ai-zy").unwrap();
+if !single.is_single() {
+    // 已有实例，唤起旧实例窗口并退出
+    return;
+}
+```
+2. **或文件锁扩展为读写锁**：读取时也加共享锁，防止并发读-改-写
+
+---
+
+### 11. BGM 预览硬编码开发者路径——正式包无法预览系统 BGM
+
+**业务场景**：
+1. 用户安装正式版应用
+2. 进入 BGM 选择弹窗
+3. 点击任意系统 BGM 的试听按钮
+4. 无声音，或报错
+
+**实际代码**：
+```typescript
+// VideoCompose.tsx:113
+const audioSrc = item.url || (item.filePath ? `/Users/0fun/work/meijiaka-zy/mixkit_bgm/${item.filePath}` : '');
+```
+
+当 `item.url` 为空且 `item.filePath` 存在时，构造的路径是开发者本机绝对路径 `/Users/0fun/...`，正式包用户机器上不存在此目录。
+
+**影响评估**：
+- 虽然云端化后 `item.url` 应始终有值，但如果 API 返回异常或旧数据残留，会回退到硬编码路径
+- 开发环境测试时「正常」的功能，正式包上直接失效
+
+**修复建议**：
+直接移除硬编码回退，若 `item.url` 为空则禁用试听：
+```typescript
+const audioSrc = item.url;
+if (!audioSrc) {
+  toast.warn('该音乐暂无可用的试听链接');
+  return;
+}
+```
+
+---
+
+### 12. 封面 Fabric.js 跨域加载失败无用户提示
+
+**业务场景**：
+1. 用户选择一张网络图片作为封面背景
+2. 该图片服务器未配置 CORS 头
+3. `image.crossOrigin = 'anonymous'` 加载失败
+4. `useCoverFabric.ts` 中 catch 静默吞掉错误
+5. Canvas 上背景为空白，用户不知道为什么
+
+**实际代码**：
+```typescript
+// useCoverFabric.ts:192-196
+const image = new Image();
+image.crossOrigin = 'anonymous';
+image.onload = () => resolve(image);
+image.onerror = (e) => reject(e);
+image.src = imagePath;
+// ...
+} catch {
+  // no-op: 背景图加载失败已在内部处理
+}
+```
+
+**用户实际看到**：
+- 选了背景图，但 Canvas 预览为纯色背景
+- 不知道是因为图片跨域、链接失效还是其他原因
+
+**修复建议**：
+在 catch 中区分错误类型并提示：
+```typescript
+} catch (err) {
+  console.error('封面背景加载失败:', err);
+  if (imagePath.startsWith('http')) {
+    toast.error('封面图片加载失败，可能是跨域限制或链接失效，请尝试本地上传');
+  } else {
+    toast.error('封面图片加载失败，文件可能已被移动或删除');
+  }
+}
+```
+
+---
+
+## 四、🟢 低风险/建议（5 项）
+
+### 13. 自动更新后无数据迁移逻辑
+
+**业务场景**：
+1. v1.6.0 用户自动更新到 v1.7.0
+2. v1.7.0 新增了某个必填字段（如 `videoCodec`）
+3. 旧项目加载后该字段为 `undefined`
+4. 如果新功能直接读取此字段不做防御，可能崩溃
+
+**现状**：
+- `migrateMeta` 只处理了 `v0 → v1`（添加 `version` 字段）
+- 注释预留了 `v1 → v2` 的扩展点，但无实际实现
+- Tauri updater 安装后只是重启应用，不触发任何数据迁移
+
+**建议**：
+在应用启动时（`bootstrap` 或 `App.tsx` useEffect）增加一次性的全局迁移检查：
+```typescript
+async function runGlobalMigrations() {
+  const appVersion = await getVersion();
+  const lastMigratedVersion = localStorage.getItem('last_migrated_version');
+  if (lastMigratedVersion === appVersion) return;
+  
+  // 遍历所有本地项目，执行迁移
+  const projects = await localProjectApi.listProjects();
+  for (const project of projects) {
+    const meta = await localProjectApi.loadMeta(project.id);
+    if (meta) {
+      const migrated = migrateMeta(meta);  // 扩展此函数
+      await localProjectApi.saveMeta(project.id, migrated);
+    }
+  }
+  
+  localStorage.setItem('last_migrated_version', appVersion);
+}
+```
+
+---
+
+### 14. 旧字段删除无运行时降级处理
+
+**现状**：
+Git 历史中有多个字段被删除/重命名：
+- `subtitlePreset` → `captionPreset`
+- `dubbingVoiceId` → `selectedVoiceId`
+- `selectedHumanId` / `selectedElementId` 被移除
+- `caption` → `mainTitle`（CoverDesign 中有 fallback）
+
+**当前行为**：
+旧项目加载后，旧字段保留在 `meta.json` 中但被忽略，对应功能降级为默认状态。对用户来说，打开旧项目后发现某些设置"复位"了，但不明白为什么。
+
+**建议**：
+在 `migrateMeta` 中增加字段映射：
+```typescript
+function migrateMeta(raw: Record<string, unknown>): Partial<ProjectMeta> {
+  // v0 → v1
+  if ((raw.version as number) < 1) {
+    raw.version = 1;
+  }
+  
+  // 字段重命名映射
+  if (raw.subtitlePreset && !raw.captionPreset) {
+    raw.captionPreset = raw.subtitlePreset;
+    delete raw.subtitlePreset;
+  }
+  if (raw.dubbingVoiceId && !raw.selectedVoiceId) {
+    raw.selectedVoiceId = raw.dubbingVoiceId;
+    delete raw.dubbingVoiceId;
+  }
+  
+  return raw as Partial<ProjectMeta>;
+}
+```
+
+---
+
+## 五、按业务维度汇总
+
+| 业务维度 | 问题编号 | 核心风险 | 用户感知 |
+|----------|----------|----------|----------|
+| **BGM/音频** | 1, 11 | 合成无声、预览失效 | "为什么选了音乐却没有声音" |
+| **积分/资金** | 2, 9 | 白嫖可能、误判余额不足 | "明明有积分却说不让用" |
+| **数据持久化** | 3, 6, 10, 13, 14 | 换机报废、保存失败无感知、多实例覆盖 | "修改保存后怎么没了" |
+| **视频合成** | 4, 5, 7, 8 | 磁盘满丢失、OOM、分段缺失、长任务闪断 | "等了5分钟结果什么都没有" |
+| **封面/视觉** | 12 | 跨域图片加载失败无提示 | "选了图片但封面是空的" |
+
+---
+
+## 六、修复优先级（按业务影响排序）
+
+### P0（立即修复，影响核心功能或资金）
+1. **#1 BGM 混音链路缺口**：混音前下载 URL 到本地缓存
+2. **#2 积分 TOCTOU**：扣费失败时清理已生成文件，或推动后端预占机制
+3. **#5 大文件 OOM**：上传/下载改用流式传输
+
+### P1（本轮迭代修复，影响体验）
+4. **#4 磁盘满保护**：合成前检查空间，`copy` 失败保留临时文件
+5. **#6 保存失败无提示**：`saveMetaToLocalFile` 错误 toast 提示
+6. **#7 分段配音失败静默**：记录失败段并提示用户
+7. **#8 轮询闪断**：增加网络错误容忍和重试
+8. **#9 余额误判**：余额获取失败时不阻断用户
+
+### P2（后续排期，架构改进）
+9. **#3 项目跨设备迁移**：路径相对化 + 导出/导入功能
+10. **#10 多实例并发**：应用层单实例锁
+11. **#11 BGM 预览硬编码**：移除开发者路径
+12. **#12 封面跨域提示**：增加错误提示
+13. **#13 自动更新迁移**：全局迁移框架
+14. **#14 旧字段映射**：`migrateMeta` 扩展

docs/frontend-compatibility-audit.md

@@ -0,0 +1,676 @@
+# 前端系统兼容性审查报告
+
+> 审查范围：`tauri-app/src` 全部源码 + `tauri-app/src-tauri/src` Rust 层命令
+> 审查维度：跨平台（macOS/Windows）、Tauri API、媒体/音频、CSS、网络、文件系统
+> 审查日期：2026-05-21
+
+---
+
+## 一、综述
+
+本次审查共发现 **28 项兼容性问题**，其中：
+
+| 级别 | 数量 | 说明 |
+|------|------|------|
+| 🔴 严重 | 6 | 可能导致功能失效、安全漏洞或数据损坏 |
+| 🟡 中等 | 11 | 潜在风险，特定场景下会触发问题 |
+| 🟢 低风险 | 11 | 建议优化，影响较小或仅存在于边缘场景 |
+
+**关键结论**：
+1. **Windows 路径处理是最大隐患**：多处 Rust 代码对 Windows 路径的反斜杠、大小写、UNC 前缀处理不完善，可能导致 FFmpeg 调用失败或安全检查被绕过。
+2. **前端内存泄漏已确认 1 处**：`CoverDesign.tsx` 的 `URL.createObjectURL` 未释放。
+3. **Asset Protocol 过度授权**：`tauri.conf.json` 中 `"scope": "/**"` 允许 WebView 读取整个文件系统。
+4. **CSS/Web API 兼容性良好**：项目运行在 Tauri 封装的 WebView（Edge/WebKit）中，现代 CSS 特性和 Web API 支持度较高，未发现严重兼容性问题。
+
+---
+
+## 二、🔴 严重问题（6 项）
+
+### 1. `URL.createObjectURL` 内存泄漏 — 背景图上传
+
+**位置**：`tauri-app/src/pages/VideoCreation/CoverDesign.tsx:181`
+
+```typescript
+const url = URL.createObjectURL(file);
+setConfig(prev => ({ ...prev, backgroundImage: url }));
+```
+
+**问题**：本地上传背景图时创建 Blob URL，但**从未调用 `URL.revokeObjectURL(url)`**。用户多次上传不同背景图时，旧的 Blob URL 会一直占用内存，直到页面刷新。
+
+**影响**：内存泄漏，长时间使用后可能导致应用卡顿或崩溃。
+
+**修复建议**：
+```typescript
+const prevUrl = config.backgroundImage;
+const url = URL.createObjectURL(file);
+setConfig(prev => ({ ...prev, backgroundImage: url }));
+// 释放旧的 Blob URL
+if (prevUrl?.startsWith('blob:')) {
+  URL.revokeObjectURL(prevUrl);
+}
+// 组件卸载时也要清理
+useEffect(() => {
+  return () => {
+    if (config.backgroundImage?.startsWith('blob:')) {
+      URL.revokeObjectURL(config.backgroundImage);
+    }
+  };
+}, []);
+```
+
+---
+
+### 2. Windows 敏感路径检查大小写不敏感问题
+
+**位置**：`tauri-app/src-tauri/src/commands/file.rs:47`
+
+```rust
+let windows_denied = vec![
+    r"c:\windows\",
+    r"c:\program files\",
+    r"c:\program files (x86)\",
+    r"c:\users\all users\",
+];
+```
+
+**问题**：Windows 文件系统（NTFS）是**大小写保留但大小写不敏感**的。用户传入 `C:\Windows\` 或 `C:\WINDOWS\` 会**完全绕过**上述安全检查。
+
+**影响**：攻击者可通过大小写变体访问系统敏感目录。
+
+**修复建议**：
+```rust
+let path_lower = path.to_lowercase();
+let windows_denied = vec![
+    r"c:\windows\",
+    r"c:\program files\",
+    r"c:\program files (x86)\",
+    r"c:\users\all users\",
+];
+for denied in &windows_denied {
+    if path_lower.starts_with(denied) {
+        return Err(...);
+    }
+}
+```
+
+---
+
+### 3. Asset Protocol 范围过度授权
+
+**位置**：`tauri-app/src-tauri/tauri.conf.json`
+
+```json
+"assetProtocol": {
+  "enable": true,
+  "scope": ["$APPLOCALDATA/**", "$APPDATA/**", "$APPCONFIG/**", "/**"]
+}
+```
+
+**问题**：`/**` 允许 WebView 通过 `asset://` 协议读取**整个文件系统的任何文件**。这意味着前端 JavaScript 可以构造 URL 访问用户的任何本地文件（如 `asset:///etc/passwd` 或 `asset://C:/Users/xxx/Documents/`）。
+
+**影响**：严重安全漏洞。即使需要配合路径遍历，也极大扩大了攻击面。
+
+**修复建议**：移除 `/**`，仅保留应用数据目录：
+```json
+"assetProtocol": {
+  "enable": true,
+  "scope": ["$APPLOCALDATA/**", "$APPDATA/**", "$APPCONFIG/**"]
+}
+```
+
+> 注：如果确有需要访问用户选择的文件，应通过 Tauri Dialog API 让用户主动选择，而非开放全局文件系统。
+
+---
+
+### 4. `escape_ffmpeg_path` 不支持 Windows 路径格式
+
+**位置**：`tauri-app/src-tauri/src/ffmpeg_cmd.rs:23`
+
+```rust
+fn escape_ffmpeg_path(path: &str) -> String {
+    path.replace("'", "'\\''")
+}
+```
+
+**问题**：该函数仅转义单引号，但**不处理 Windows 反斜杠 `\` 和盘符冒号 `:`**。在 FFmpeg 的 `ass='{}':fontsdir='{}'` filter 语法或 concat demuxer 的 `file 'path'` 格式中，Windows 路径如 `C:\Users\name\video.mp4` 中的反斜杠可能被 FFmpeg 解析为转义序列。
+
+**影响**：Windows 用户在字幕压制、字体加载、视频合成时，FFmpeg 可能因路径解析错误而失败。
+
+**修复建议**：
+```rust
+fn escape_ffmpeg_path(path: &str) -> String {
+    // 1. 统一使用正斜杠（FFmpeg 支持跨平台路径分隔符）
+    let normalized = path.replace('\\', "/");
+    // 2. 转义单引号（用于 FFmpeg filter 语法中的引号包裹）
+    normalized.replace("'", "'\\''")
+}
+```
+
+> 注意：Windows 上 `C:/Users/...` 这种正斜杠路径 FFmpeg 完全支持，这是最简单的跨平台方案。
+
+---
+
+### 5. `canonicalize()` 在 Windows 上返回 UNC 路径导致下游问题
+
+**位置**：多处使用 `std::fs::canonicalize`
+
+- `tauri-app/src-tauri/src/commands/product.rs:198,258,345`
+- `tauri-app/src-tauri/src/commands/project.rs:124,140`
+- `tauri-app/src-tauri/src/ffmpeg_cmd.rs:46,792`
+
+**问题**：在 Windows 上，`std::fs::canonicalize()` 返回 UNC 路径格式 `\\?\C:\Users\...`。这种路径格式：
+1. **FFmpeg 某些版本不支持**，可能导致命令执行失败
+2. **与 `starts_with` 比较时行为异常**，如果比较路径不是 UNC 格式
+3. **序列化到 JSON 传给前端时**，前端可能无法正确理解这种路径
+
+**影响**：Windows 上的文件校验、路径比较、FFmpeg 调用可能全部受影响。
+
+**修复建议**：封装一个跨平台的 `normalize_path` 函数，替代 `canonicalize`：
+```rust
+use std::path::{Path, PathBuf};
+
+fn normalize_path(path: &Path) -> PathBuf {
+    // 使用 dunce::simplified() 消除 UNC 前缀，同时保持路径有效性
+    dunce::simplified(path).to_path_buf()
+}
+```
+
+> 需要添加 `dune` crate 依赖，这是 Rust 社区处理 UNC 路径的标准方案。
+
+---
+
+### 6. `atob()` 解析 JWT 存在 base64url 兼容性问题
+
+**位置**：`tauri-app/src/api/client.ts:116`
+
+```typescript
+const payload = JSON.parse(atob(token.split('.')[1]));
+```
+
+**问题**：JWT 使用 **base64url** 编码（将 `+` → `-`，`/` → `_`，去掉 padding `=`），而 `atob()` 是标准 **base64** 解码器。如果 JWT payload 中包含 `-`、`_` 或需要 padding 的字符，`atob()` 会抛出 `DOMException`。
+
+**当前影响有限**：因为 `exp` 字段通常是纯数字时间戳，但理论上如果用户 ID 或其他 claim 包含这些字符就会失败。
+
+**修复建议**：
+```typescript
+function base64UrlDecode(str: string): string {
+  // base64url → base64
+  let padding = '';
+  const padLen = 4 - (str.length % 4);
+  if (padLen !== 4) {
+    padding = '='.repeat(padLen);
+  }
+  const base64 = str.replace(/-/g, '+').replace(/_/g, '/') + padding;
+  return atob(base64);
+}
+
+// 使用
+const payload = JSON.parse(base64UrlDecode(token.split('.')[1]));
+```
+
+---
+
+## 三、🟡 中等问题（11 项）
+
+### 7. `crossOrigin = 'anonymous'` 跨域图片污染 Canvas
+
+**位置**：
+- `tauri-app/src/hooks/useCoverFabric.ts:192,235`
+
+```typescript
+image.crossOrigin = 'anonymous';
+image.src = imagePath;
+```
+
+**问题**：当加载远程 HTTP(S) 图片时，如果服务器未配置 `Access-Control-Allow-Origin` 响应头，Canvas 会被**污染（tainted）**。被污染的 Canvas 调用 `toDataURL()` 会抛出 `SecurityError: The canvas has been tainted by cross-origin data`。
+
+当前代码用 try-catch 静默吞掉了错误，用户会看到空白封面，但不知道原因。
+
+**修复建议**：捕获错误并向用户提示：
+```typescript
+try {
+  // ...加载图片...
+} catch (err) {
+  console.error('封面图片加载失败:', err);
+  toast.error('封面图片加载失败，可能是跨域限制或图片链接失效');
+}
+```
+
+---
+
+### 8. `requestAnimationFrame` + Video 字幕同步在后台标签页节流
+
+**位置**：`tauri-app/src/hooks/useCanvasSubtitleRenderer.ts:158-168`
+
+```typescript
+const onFrame = () => {
+  drawFrame();
+  if (!video.paused) {
+    rafRef.current = requestAnimationFrame(onFrame);
+  }
+};
+```
+
+**问题**：当应用窗口不在前台或标签页在后台时，浏览器会**节流 `requestAnimationFrame`**（通常降到 1fps 或完全暂停）。这会导致 Canvas 字幕与视频画面不同步。
+
+**影响**：用户切出应用再切回时，字幕可能短暂错位。
+
+**修复建议**：使用 `video.requestVideoFrameCallback()`（如果支持）作为更精确的同步机制，或在 `visibilitychange` 事件触发时强制重绘：
+```typescript
+useEffect(() => {
+  const onVisibilityChange = () => {
+    if (!document.hidden) drawFrame();
+  };
+  document.addEventListener('visibilitychange', onVisibilityChange);
+  return () => document.removeEventListener('visibilitychange', onVisibilityChange);
+}, [drawFrame]);
+```
+
+---
+
+### 9. `video` 控制条高度硬编码导致字幕定位偏移
+
+**位置**：`tauri-app/src/hooks/useCanvasSubtitleRenderer.ts:86`
+
+```typescript
+const VIDEO_CONTROLS_HEIGHT = 40;
+```
+
+**问题**：`<video controls>` 的控制条高度在不同浏览器/OS 上不同（macOS Safari 约 30px，Windows 约 40-50px，全屏模式约 0px）。硬编码 40px 会导致字幕在预览时的垂直位置与压制输出不完全一致。
+
+**修复建议**：在视频元数据加载后动态计算：
+```typescript
+const video = videoRef.current;
+if (video) {
+  const rect = video.getBoundingClientRect();
+  const videoRect = video.videoWidth / video.videoHeight;
+  // 实际视频画面高度 = 容器宽度 / 宽高比
+  const actualVideoHeight = rect.width / videoRect;
+  const controlsHeight = rect.height - actualVideoHeight;
+}
+```
+
+---
+
+### 10. `audio.duration` 可能返回 `NaN`/`Infinity` 未处理
+
+**位置**：
+- `tauri-app/src/pages/VideoCreation/VoiceSynthesis.tsx:360-367`
+- `tauri-app/src/pages/VideoGeneration/hooks/useVideoGeneration.ts:371-378`
+- `tauri-app/src/pages/ContentManagement/VoiceMaterialLibrary.tsx:163-178`
+
+```typescript
+audio.onloadedmetadata = () => {
+  clearTimeout(timeoutId);
+  resolve(audio.duration);
+};
+```
+
+**问题**：如果音频文件损坏、格式不支持或元数据缺失，`audio.duration` 可能返回 `NaN` 或 `Infinity`。直接 resolve 这个值会导致下游计算错误。
+
+**修复建议**：
+```typescript
+audio.onloadedmetadata = () => {
+  clearTimeout(timeoutId);
+  if (!isFinite(audio.duration) || audio.duration <= 0) {
+    reject(new Error('音频时长无效，文件可能损坏或格式不支持'));
+  } else {
+    resolve(audio.duration);
+  }
+};
+```
+
+---
+
+### 11. `rename` 在 Windows 上目标已存在时失败
+
+**位置**：
+- `tauri-app/src-tauri/src/video_processing.rs:93`
+- `tauri-app/src-tauri/src/commands/video_compose.rs:222`
+
+**问题**：`std::fs::rename()` 在 Windows 上**如果目标文件已存在会直接失败**（Unix 是原子替换）。代码虽然有 copy 回退，但逻辑可能留下残留文件。
+
+**影响**：Windows 上如果输出路径已存在（如用户重复合成），操作可能失败或留下临时文件。
+
+**修复建议**：在 `rename` 前先删除目标文件（如果存在）：
+```rust
+if output_path.exists() {
+    std::fs::remove_file(&output_path)?;
+}
+std::fs::rename(&temp_output, &output_path)?;
+```
+
+---
+
+### 12. `to_str().unwrap()` 在非 UTF-8 路径上会 panic
+
+**位置**：`tauri-app/src-tauri/src/commands/video_compose.rs:80`
+
+```rust
+concat_videos_copy(&app, list_path.to_str().unwrap(), ...)
+```
+
+**问题**：Windows 允许非 UTF-8 编码的文件路径（历史 OEM code page 文件）。`to_str()` 返回 `None`，`unwrap()` 会**直接 panic**。
+
+**影响**：极少数 Windows 用户（使用中文 Windows 95/XP 时代遗留文件系统编码）可能导致应用崩溃。
+
+**修复建议**：使用 `to_string_lossy()` 或 `as_os_str()` 传递路径：
+```rust
+// 如果需要传给 FFmpeg，使用 to_string_lossy()
+let path_str = list_path.to_string_lossy();
+```
+
+---
+
+### 13. `get_fonts_dir` 开发模式路径探测在 Windows 上可能失效
+
+**位置**：`tauri-app/src-tauri/src/ffmpeg_cmd.rs:298-328`
+
+```rust
+cwd.join("fonts"),
+parent.join("src-tauri/fonts"),
+grandparent.join("tauri-app/src-tauri/fonts"),
+```
+
+**问题**：开发模式下的字体目录探测使用 `/` 路径拼接。虽然 `PathBuf::join` 会处理分隔符，但如果开发时的**当前工作目录**与预期不同（如从 IDE 以不同路径启动），探测会失败。
+
+**影响**：开发环境下 Windows 开发者可能遇到字体加载失败。
+
+**修复建议**：添加环境变量覆盖或更健壮的探测逻辑：
+```rust
+// 优先从环境变量读取
+if let Ok(font_dir) = std::env::var("MEIJIAKA_FONTS_DIR") {
+    let p = PathBuf::from(font_dir);
+    if p.exists() { return Some(p); }
+}
+```
+
+---
+
+### 14. `concat` demuxer 列表中的 Windows 反斜杠问题
+
+**位置**：`tauri-app/src-tauri/src/commands/video_compose.rs:65`
+
+```rust
+format!("file '{}'\n", ffmpeg_cmd::escape_ffmpeg_path(path))
+```
+
+**问题**：FFmpeg concat demuxer 的列表文件格式中，`file 'path'` 语法在 Windows 上如果路径包含反斜杠，反斜杠可能被 FFmpeg 解释为转义字符。
+
+**影响**：与问题 #4 类似，Windows 路径导致 FFmpeg 解析错误。
+
+**修复建议**：在写入 concat 列表前统一将路径中的 `\` 替换为 `/`：
+```rust
+let normalized = path.replace('\\', "/");
+format!("file '{}'\n", normalized)
+```
+
+---
+
+### 15. `load_app_config` 失败时无降级配置
+
+**位置**：`tauri-app/src/main.tsx:10-16`
+
+```typescript
+try {
+  const config = await loadAppConfig();
+  appEnvironment = config.environment;
+} catch {
+  // 加载失败时默认为生产模式
+}
+```
+
+**问题**：如果 `load_app_config`（Tauri IPC 调用）失败，应用降级为生产模式。这是合理的，但**生产模式会禁用右键菜单和 F12 DevTools**。开发者在调试时如果 IPC 调用失败，会突然失去所有调试能力，且不知道原因。
+
+**修复建议**：在降级时输出警告日志：
+```typescript
+} catch (e) {
+  console.warn('[bootstrap] 加载应用配置失败，降级为生产模式:', e);
+  appEnvironment = 'production';
+}
+```
+
+---
+
+### 16. `window.location.reload()` 在 Tauri 中行为不确定
+
+**位置**：`tauri-app/src/pages/Settings/Settings.tsx:178`
+
+```typescript
+setTimeout(() => { window.location.reload(); }, 500);
+```
+
+**问题**：Tauri 应用中的 `window.location.reload()` 行为与浏览器不同。在某些 Tauri 版本中可能导致：
+- 白屏而非正常刷新
+- WebView 进程崩溃
+- 状态丢失但窗口不重新加载
+
+**修复建议**：使用 Tauri 的 `relaunch()` 命令重启整个应用，或重新挂载 React 根组件：
+```typescript
+import { relaunch } from '@tauri-apps/plugin-process';
+// 重启应用
+await relaunch();
+```
+
+---
+
+### 17. `Math.random()` 用于缓存清除参数（安全性）
+
+**位置**：`tauri-app/src/api/client.ts:334`
+
+```typescript
+const cacheBuster = `_t=${Date.now()}_${Math.random().toString(36).slice(2, 8)}`;
+```
+
+**问题**：`Math.random()` 不是加密安全的随机数生成器。虽然这里只是用于缓存清除，但如果未来用于其他安全相关场景会有风险。
+
+**修复建议**：使用 `crypto.randomUUID()` 或 `crypto.getRandomValues()`：
+```typescript
+const cacheBuster = `_t=${Date.now()}_${crypto.randomUUID().slice(0, 8)}`;
+```
+
+---
+
+## 四、🟢 低风险/建议（11 项）
+
+### 18. `backdrop-filter` 无标准前缀回退
+
+**位置**：`tauri-app/src/pages/VideoCreation/CoverDesign.css:444-445`
+
+```css
+backdrop-filter: blur(6px);
+-webkit-backdrop-filter: blur(6px);
+```
+
+**评估**：当前代码同时有标准和 WebKit 前缀版本，在 Tauri WebView（Edge/WebKit）中支持良好。Firefox 不支持，但项目不面向 Firefox。**无需修复**。
+
+---
+
+### 19. `::-webkit-scrollbar` 在 Firefox 中无效
+
+**位置**：多处（`global.css`、`CoverDesign.css` 等）
+
+**评估**：项目运行在 Tauri WebView 中（基于系统浏览器引擎），不是 Firefox。在 Windows 上基于 WebView2（Edge），macOS 上基于 WKWebView（Safari），均支持 WebKit 滚动条样式。**无需修复**。
+
+---
+
+### 20. `aspect-ratio` 在旧版 Safari 中可能不支持
+
+**位置**：多处使用 `aspect-ratio: 9 / 16`
+
+**评估**：macOS 12+ 的 Safari 支持 `aspect-ratio`。如果目标用户可能使用较旧的 macOS 版本，可能需要 `padding-top: 177.77%` 回退。但鉴于这是 Tauri 桌面应用，可以控制最低系统版本。**建议确认 `tauri.conf.json` 中 `macOS.minimumSystemVersion` 是否要求 12.0+**。
+
+---
+
+### 21. `requestIdleCallback` 缺失回退不完整
+
+**位置**：`tauri-app/src/main.tsx:75-79`
+
+```typescript
+if ('requestIdleCallback' in window) {
+  requestIdleCallback(showWindow, { timeout: 500 });
+} else {
+  setTimeout(showWindow, 100);
+}
+```
+
+**评估**：Tauri WebView2（Edge）和 WKWebView（Safari）均支持 `requestIdleCallback`。回退逻辑也已实现。**无需修复**。
+
+---
+
+### 22. `navigator.userAgent` 已被冻结
+
+**位置**：
+- `tauri-app/src/store/authStore.ts:254`
+- `tauri-app/src/api/client.ts:259`
+
+**评估**：虽然现代浏览器正在限制 `navigator.userAgent`，但 Tauri WebView 不受此限制。且当前用法仅为日志和登录信息上报，不影响功能。**无需修复**。
+
+---
+
+### 23. `document.fonts.check()` 参数格式兼容性
+
+**位置**：`tauri-app/src/utils/canvasSubtitleDrawer.ts:209`
+
+```typescript
+if (document.fonts.check(`bold 16px ${fontName}`)) {
+```
+
+**评估**：`document.fonts.check()` 的参数格式在不同浏览器中实现有细微差异，但 Tauri WebView2/WKWebView 均支持此用法。**风险极低**。
+
+---
+
+### 24. `Date.now()` 连续调用可能冲突
+
+**位置**：多处使用 `Date.now()` 生成文件名
+
+**评估**：仅在极快速连续调用时（<1ms）可能冲突。当前场景下不太可能。**风险极低**。
+
+---
+
+### 25. `autoPlay` 视频可能被浏览器阻止
+
+**位置**：多处 `<video autoPlay>`
+
+**评估**：桌面应用中的 WebView 通常不受浏览器自动播放策略限制。但如果用户操作系统设置了辅助功能限制，仍可能被阻止。**建议添加 `muted` 属性作为后备**（如果需要自动播放且带声音）。
+
+---
+
+### 26. `file.path` 是非标准 Chromium 属性
+
+**位置**：`tauri-app/src/pages/VideoCreation/CoverDesign.tsx:178`
+
+```typescript
+const path = (file as any).path || (file as any).webkitRelativePath || '';
+```
+
+**评估**：`File.path` 是 Chromium 的私有属性，在标准浏览器（Firefox）中不存在。但由于项目运行在 Tauri（Chromium/WebView2）中，这**当前是可行的**。但如果未来需要支持 Web 端部署，需要改用 Tauri Dialog API 获取路径。**建议添加注释说明此依赖**。
+
+---
+
+### 27. `storage/engine.rs` 无 Windows 文件权限设置
+
+**位置**：`tauri-app/src-tauri/src/storage/engine.rs:161`
+
+```rust
+#[cfg(unix)]
+fn set_restrictive_permissions(path: &Path) -> Result<()> {
+    use std::os::unix::fs::PermissionsExt;
+    let mut perms = std::fs::metadata(path)?.permissions();
+    perms.set_mode(0o600);
+    std::fs::set_permissions(path, perms)?;
+    Ok(())
+}
+```
+
+**评估**：Unix 上设置了 0o600 权限，Windows 上跳过。Windows 上文件默认对用户可读可写，其他用户也可读（取决于 ACL）。虽然这不是严重安全问题（应用数据存储在用户目录），但**建议在 Windows 上设置等效的 ACL 限制**。
+
+**修复建议**：
+```rust
+#[cfg(windows)]
+fn set_restrictive_permissions(path: &Path) -> Result<()> {
+    // 使用 windows  crate 或 fs_extra 设置 ACL
+    // 简化为仅当前用户可读写
+    // 这是可选优化，优先级低
+    Ok(())
+}
+```
+
+---
+
+### 28. `Slider.css` 和 `CoverDesign.css` 中 `appearance` 重复声明
+
+**位置**：
+- `tauri-app/src/components/Slider/Slider.css:32-33`
+- `tauri-app/src/pages/VideoCreation/CoverDesign.css:79-80`
+
+```css
+appearance: none;
+appearance: none;
+```
+
+**评估**：纯代码质量问题，不影响兼容性。**建议移除重复行**。
+
+---
+
+## 五、按维度汇总表
+
+| 维度 | 严重 | 中等 | 低风险 | 主要文件 |
+|------|------|------|--------|----------|
+| **内存/资源管理** | 1 (#1) | 1 (#10) | 1 (#24) | CoverDesign.tsx, VoiceSynthesis.tsx |
+| **Windows 路径** | 2 (#4, #5) | 3 (#11, #12, #14) | 1 (#27) | ffmpeg_cmd.rs, file.rs, product.rs |
+| **安全检查** | 2 (#2, #3) | 0 | 0 | file.rs, tauri.conf.json |
+| **Canvas/媒体** | 0 | 3 (#7, #8, #9) | 2 (#20, #25) | useCoverFabric.ts, useCanvasSubtitleRenderer.ts |
+| **网络/API** | 1 (#6) | 1 (#17) | 2 (#22, #23) | client.ts |
+| **Tauri 原生** | 0 | 1 (#16) | 1 (#26) | Settings.tsx, CoverDesign.tsx |
+| **CSS** | 0 | 0 | 3 (#18, #19, #28) | CoverDesign.css, global.css |
+| **启动/配置** | 0 | 1 (#15) | 1 (#21) | main.tsx |
+| **字体加载** | 0 | 1 (#13) | 0 | ffmpeg_cmd.rs |
+
+---
+
+## 六、修复优先级建议
+
+### 立即修复（影响功能/安全）
+
+1. **#3 Asset Protocol 过度授权** — 安全漏洞，一行配置修改
+2. **#2 Windows 敏感路径大小写** — 安全检查被绕过
+3. **#1 URL.createObjectURL 泄漏** — 内存泄漏，用户可见
+4. **#4 escape_ffmpeg_path Windows 支持** — Windows 功能失效
+5. **#5 canonicalize() UNC 路径** — Windows 文件操作异常
+
+### 本轮迭代修复（影响体验）
+
+6. **#6 atob() base64url 兼容性** — Token 解析潜在失败
+7. **#7 crossOrigin 图片污染提示** — 用户友好性
+8. **#8 RAF 后台节流** — 字幕同步
+9. **#10 audio.duration NaN 处理** — 音频处理健壮性
+10. **#9 控制条高度硬编码** — 预览准确性
+11. **#11 Windows rename 已存在** — 文件操作健壮性
+
+### 后续排期（优化/边缘场景）
+
+12-28. 其余低风险项
+
+---
+
+## 七、特别说明：Tauri 环境 vs 浏览器环境的兼容性差异
+
+本项目同时支持两种运行模式：
+
+| 特性 | Tauri 桌面模式 | 浏览器模式（开发调试用） |
+|------|---------------|------------------------|
+| `invoke()` | ✅ Tauri IPC | ❌ 会 catch 失败 |
+| `convertFileSrc()` | ✅ `asset://` | ❌ 会 catch 失败 |
+| `localStorage` | ✅ 可用 | ✅ 可用 |
+| File 系统 API | ✅ Tauri 插件 | ❌ 不可用 |
+| `__TAURI_INTERNALS__` | ✅ 存在 | ❌ 不存在 |
+
+**当前代码对浏览器模式有降级处理**（`isTauri()` 检查 + catch 错误），这是好的实践。但以下功能在浏览器模式下完全不可用，需要评估是否影响开发调试：
+
+- 本地视频预览（依赖 `asset://` + FFmpeg 转码）
+- 文件保存/导出（依赖 Tauri Dialog）
+- 项目本地持久化（依赖 Tauri IPC）
+- 自动更新（依赖 Tauri Updater）
+
+**建议**：在 `README` 或开发文档中明确列出浏览器模式的功能限制，避免开发者困惑。

docs/mixkit_bgm_catalog.md

@@ -0,0 +1,336 @@
+# Mixkit 免版权音乐清单（装修行业口播短视频）
+
+> 来源: Mixkit.co（免版税、无需署名、可商用）
+> 下载时间: 2026-05-23
+> 总计: 129 首 / 616 MB
+
+---
+
+## 分类说明
+
+| 分类 | 适用场景 | 数量 |
+|------|----------|------|
+| **知识科普** | 装修避坑、材料选择、流程科普 | 66 首 |
+| **案例展示** | 完工验收、前后对比、实景展示 | 49 首 |
+| **促销活动** | 开业促销、团购活动、限时优惠 | 49 首 |
+| **家居生活** | 软装搭配、生活 vlog、温馨家庭 | 54 首 |
+| **智能家居** | 全屋智能、现代设计、灯光系统 | 48 首 |
+
+---
+
+## 一、知识科普（专业可信，不抢戏）
+
+| ID | 音乐名 | 艺术家 |
+|----|--------|--------|
+| 22 | Piano Reflections | Ahjay Stelino |
+| 105 | See Line Funk | Alejandro Magaña |
+| 113 | House Fest | Alejandro Magaña (A. M.) |
+| 114 | Kodama Night Town | Alejandro Magaña (A. M.) |
+| 1167 | Close Up | Michael Ramir C. |
+| 124 | Techno Fest Vibes | Alejandro Magaña (A. M.) |
+| 127 | Valley Sunset | Alejandro Magaña (A. M.) |
+| 132 | Hazy After Hours | Alejandro Magaña (A. M.) |
+| 134 | Deep Techno Ambience | Alejandro Magaña (A. M.) |
+| 138 | Forest Treasure | Alejandro Magaña (A. M.) |
+| 139 | Spirit in the Woods | Alejandro Magaña (A. M.) |
+| 147 | Spirit in the Woods 2 | Alejandro Magaña (A. M.) |
+| 160 | Minimal Emotion | Alejandro Magaña (A. M.) |
+| 162 | Minimal Techno 01 | Alejandro Magaña (A. M.) |
+| 168 | Staring at the Night Sky | Alejandro Magaña (A. M.) |
+| 169 | Zanarkand Forest | Alejandro Magaña (A. M.) |
+| 175 | Digital Clouds | Alejandro Magaña (A. M.) |
+| 184 | Vastness | Andrew Ev |
+| 251 | Ambient | Arulo |
+| 292 | Relax Beat | Arulo |
+| 324 | Smooth Meditation | Arulo |
+| 340 | Nap Time | Arulo |
+| 371 | Cat Walk | Arulo |
+| 416 | Young Trizzy | Arulo |
+| 441 | Meditation | Arulo |
+| 443 | Serene View | Arulo |
+| 470 | Golden Storm | Diego Nava |
+| 471 | Rising Forest | Diego Nava |
+| 480 | Curiosity | Diego Nava |
+| 493 | Beautiful Dream | Diego Nava |
+| 568 | Focus on Yourself | Eugenio Mininni |
+| 584 | Rest Now | Eugenio Mininni |
+| 593 | Opalescent | Eugenio Mininni |
+| 594 | River Flow | Eugenio Mininni |
+| 616 | What it Takes | Eugenio Mininni |
+| 617 | Wind Leaves | Eugenio Mininni |
+| 620 | B.O.R.N | Eugenio Mininni |
+| 623 | Deep Urban | Eugenio Mininni |
+| 628 | Summer Dream | Eugenio Mininni |
+| 629 | Skeeomaver Sound | Eugenio Mininni |
+| 633 | Xanthos | Eugenio Mininni |
+| 652 | Soul Jazz | Francisco Alvear |
+| 664 | Pop One | Francisco Alvear |
+| 695 | Pop 05 | Grigoriy Nuzhny |
+| 700 | Pop 03 | Grigoriy Nuzhny |
+| 713 | Classical 6 | Jonny S. |
+| 720 | New Bass 01 | Lily J |
+| 726 | Uplifting Bass | Lily J |
+| 729 | Pop Track 03 | Lily J |
+| 738 | Hip Hop 02 | Lily J |
+| 744 | House 02 | Lily J |
+| 749 | Relaxation 05 | Lily J |
+| 759 | Romantic 05 | Lily J |
+| 770 | Autofahren | Mauro Urbina |
+| 779 | Oh | Michael Ramir C. |
+| 801 | Happy Home | Michael Ramir C. |
+| 802 | Here Comes The Train | Michael Ramir C. |
+| 804 | I Love You Grandma | Michael Ramir C. |
+| 813 | Magical moment | Michael Ramir C. |
+| 816 | Please | Michael Ramir C. |
+| 821 | At the Playhouse | Michael Ramir C. |
+| 832 | I'm Going Home | Michael Ramir C. |
+| 834 | It's Love | Michael Ramir C. |
+| 837 | Life is a Dream | Michael Ramir C. |
+| 839 | Tears of Joy | Michael Ramir C. |
+| 840 | That's the Way of Life | Michael Ramir C. |
+| 847 | It's April | Michael Ramir C. |
+| 852 | Music and Life | Michael Ramir C. |
+| 856 | Salty and Sweet | Michael Ramir C. |
+| 872 | Gimme that Groove! | Michael Ramir C. |
+| 897 | A Very Happy Christmas | Michael Ramir C. |
+| 953 | Feel Alive | Michael Ramir C. |
+| 963 | Just Keep Walking | Michael Ramir C. |
+| 970 | Night Sky Hip Hop | Michael Ramir C. |
+| 993 | Finding Myself | Michael Ramir C. |
+| 1000 | I Can Hear Your Heartbeat | Michael Ramir C. |
+| 1001 | I Do! | Michael Ramir C. |
+| 1052 | Baby Yohan | Michael Ramir C. |
+| 1081 | We'll Be Okay | Michael Ramir C. |
+| 1140 | Funkee Monkeee | Michael Ramir C. |
+| 1183 | Karma | Michael Ramir C. |
+| 1210 | Can't Get You Off My Mind | Michael Ramir C. |
+
+## 二、案例展示（有成就感、积极）
+
+| ID | 音乐名 | 艺术家 |
+|----|--------|--------|
+| 3 | Dance with Me | Ahjay Stelino |
+| 4 | Delightful | Ahjay Stelino |
+| 5 | Feeling Happy | Ahjay Stelino |
+| 8 | Jumping Around | Ahjay Stelino |
+| 11 | Just Kidding | Ahjay Stelino |
+| 12 | Playground Fun | Ahjay Stelino |
+| 13 | Summer Fun | Ahjay Stelino |
+| 31 | Dreaming Big | Ahjay Stelino |
+| 32 | Driving Ambition | Ahjay Stelino |
+| 34 | Raising Me Higher | Ahjay Stelino |
+| 91 | Summer's Here | Ahjay Stelino |
+| 288 | One More Dance | Arulo |
+| 339 | Villa Penthouse | Arulo |
+| 350 | Follow Me Home | Arulo |
+| 528 | You Got Jazz | Diego Nava |
+| 529 | Walking in the Park | Diego Nava |
+| 532 | A Happy Child | Diego Nava |
+| 621 | BRIDGE No 98 | Eugenio Mininni |
+| 684 | Classical vibes 4 | Grigoriy Nuzhny |
+| 801 | Happy Home | Michael Ramir C. |
+| 823 | Be Happy 2 | Michael Ramir C. |
+| 839 | Tears of Joy | Michael Ramir C. |
+| 872 | Gimme that Groove! | Michael Ramir C. |
+| 897 | A Very Happy Christmas | Michael Ramir C. |
+| 953 | Feel Alive | Michael Ramir C. |
+| 1000 | I Can Hear Your Heartbeat | Michael Ramir C. |
+| 1001 | I Do! | Michael Ramir C. |
+| 1052 | Baby Yohan | Michael Ramir C. |
+| 1140 | Funkee Monkeee | Michael Ramir C. |
+| 1183 | Karma | Michael Ramir C. |
+| 1210 | Can't Get You Off My Mind | Michael Ramir C. |
+
+## 三、促销活动（轻快、有能量）
+
+同案例展示分类，推荐节奏更欢快的:
+- 3.mp3, 4.mp3, 5.mp3, 8.mp3, 11.mp3, 12.mp3, 13.mp3, 31.mp3, 32.mp3, 34.mp3, 91.mp3
+- 288.mp3, 339.mp3, 350.mp3, 528.mp3, 529.mp3, 532.mp3, 621.mp3
+- 801.mp3, 823.mp3, 839.mp3, 872.mp3, 897.mp3, 953.mp3
+- 1000.mp3, 1001.mp3, 1052.mp3, 1140.mp3, 1183.mp3, 1210.mp3
+
+## 四、家居生活（温馨、治愈）
+
+| ID | 音乐名 | 艺术家 |
+|----|--------|--------|
+| 22 | Piano Reflections | Ahjay Stelino |
+| 127 | Valley Sunset | Alejandro Magaña (A. M.) |
+| 138 | Forest Treasure | Alejandro Magaña (A. M.) |
+| 139 | Spirit in the Woods | Alejandro Magaña (A. M.) |
+| 147 | Spirit in the Woods 2 | Alejandro Magaña (A. M.) |
+| 168 | Staring at the Night Sky | Alejandro Magaña (A. M.) |
+| 169 | Zanarkand Forest | Alejandro Magaña (A. M.) |
+| 199 | Loner | Arulo |
+| 250 | Island Beat | Arulo |
+| 282 | Sweet September | Arulo |
+| 292 | Relax Beat | Arulo |
+| 322 | Life's a Movie | Arulo |
+| 324 | Smooth Meditation | Arulo |
+| 340 | Nap Time | Arulo |
+| 345 | Nature Meditation | Arulo |
+| 350 | Follow Me Home | Arulo |
+| 416 | Young Trizzy | Arulo |
+| 441 | Meditation | Arulo |
+| 442 | Nature Yoga | Arulo |
+| 443 | Serene View | Arulo |
+| 444 | Yoga Song | Arulo |
+| 493 | Beautiful Dream | Diego Nava |
+| 528 | You Got Jazz | Diego Nava |
+| 529 | Walking in the Park | Diego Nava |
+| 532 | A Happy Child | Diego Nava |
+| 568 | Focus on Yourself | Eugenio Mininni |
+| 584 | Rest Now | Eugenio Mininni |
+| 593 | Opalescent | Eugenio Mininni |
+| 594 | River Flow | Eugenio Mininni |
+| 617 | Wind Leaves | Eugenio Mininni |
+| 620 | B.O.R.N | Eugenio Mininni |
+| 623 | Deep Urban | Eugenio Mininni |
+| 628 | Summer Dream | Eugenio Mininni |
+| 629 | Skeeomaver Sound | Eugenio Mininni |
+| 633 | Xanthos | Eugenio Mininni |
+| 652 | Soul Jazz | Francisco Alvear |
+| 664 | Pop One | Francisco Alvear |
+| 695 | Pop 05 | Grigoriy Nuzhny |
+| 700 | Pop 03 | Grigoriy Nuzhny |
+| 713 | Classical 6 | Jonny S. |
+| 720 | New Bass 01 | Lily J |
+| 726 | Uplifting Bass | Lily J |
+| 729 | Pop Track 03 | Lily J |
+| 738 | Hip Hop 02 | Lily J |
+| 744 | House 02 | Lily J |
+| 749 | Relaxation 05 | Lily J |
+| 759 | Romantic 05 | Lily J |
+| 770 | Autofahren | Mauro Urbina |
+| 779 | Oh | Michael Ramir C. |
+| 801 | Happy Home | Michael Ramir C. |
+| 802 | Here Comes The Train | Michael Ramir C. |
+| 804 | I Love You Grandma | Michael Ramir C. |
+| 813 | Magical moment | Michael Ramir C. |
+| 816 | Please | Michael Ramir C. |
+| 821 | At the Playhouse | Michael Ramir C. |
+| 832 | I'm Going Home | Michael Ramir C. |
+| 834 | It's Love | Michael Ramir C. |
+| 837 | Life is a Dream | Michael Ramir C. |
+| 839 | Tears of Joy | Michael Ramir C. |
+| 840 | That's the Way of Life | Michael Ramir C. |
+| 847 | It's April | Michael Ramir C. |
+| 852 | Music and Life | Michael Ramir C. |
+| 856 | Salty and Sweet | Michael Ramir C. |
+| 872 | Gimme that Groove! | Michael Ramir C. |
+| 897 | A Very Happy Christmas | Michael Ramir C. |
+| 953 | Feel Alive | Michael Ramir C. |
+| 963 | Just Keep Walking | Michael Ramir C. |
+| 970 | Night Sky Hip Hop | Michael Ramir C. |
+| 993 | Finding Myself | Michael Ramir C. |
+| 1000 | I Can Hear Your Heartbeat | Michael Ramir C. |
+| 1001 | I Do! | Michael Ramir C. |
+| 1052 | Baby Yohan | Michael Ramir C. |
+| 1081 | We'll Be Okay | Michael Ramir C. |
+| 1140 | Funkee Monkeee | Michael Ramir C. |
+| 1167 | Close Up | Michael Ramir C. |
+| 1183 | Karma | Michael Ramir C. |
+| 1210 | Can't Get You Off My Mind | Michael Ramir C. |
+
+## 五、智能家居（科技感、高级感）
+
+| ID | 音乐名 | 艺术家 |
+|----|--------|--------|
+| 105 | See Line Funk | Alejandro Magaña |
+| 113 | House Fest | Alejandro Magaña (A. M.) |
+| 114 | Kodama Night Town | Alejandro Magaña (A. M.) |
+| 122 | Slow Rain | Alejandro Magaña (A. M.) |
+| 124 | Techno Fest Vibes | Alejandro Magaña (A. M.) |
+| 130 | Tech House vibes | Alejandro Magaña (A. M.) |
+| 132 | Hazy After Hours | Alejandro Magaña (A. M.) |
+| 134 | Deep Techno Ambience | Alejandro Magaña (A. M.) |
+| 136 | Infected Mushroom Vibes | Alejandro Magaña (A. M.) |
+| 137 | Goa Trance Mantra | Alejandro Magaña (A. M.) |
+| 140 | Cyberpunk City | Alejandro Magaña (A. M.) |
+| 157 | Infected Vibes | Alejandro Magaña (A. M.) |
+| 160 | Minimal Emotion | Alejandro Magaña (A. M.) |
+| 162 | Minimal Techno 01 | Alejandro Magaña (A. M.) |
+| 166 | Trance Party | Alejandro Magaña (A. M.) |
+| 173 | Better Times are Coming | Alejandro Magaña (A. M.) |
+| 175 | Digital Clouds | Alejandro Magaña (A. M.) |
+| 180 | Gear | Andrew Ev |
+| 181 | Pop | Andrew Ev |
+| 184 | Vastness | Andrew Ev |
+| 199 | Loner | Arulo |
+| 251 | Ambient | Arulo |
+| 292 | Relax Beat | Arulo |
+| 324 | Smooth Meditation | Arulo |
+| 340 | Nap Time | Arulo |
+| 371 | Cat Walk | Arulo |
+| 416 | Young Trizzy | Arulo |
+| 441 | Meditation | Arulo |
+| 442 | Nature Yoga | Arulo |
+| 443 | Serene View | Arulo |
+| 444 | Yoga Song | Arulo |
+| 464 | Sci-Fi Score | Arulo |
+| 470 | Golden Storm | Diego Nava |
+| 471 | Rising Forest | Diego Nava |
+| 480 | Curiosity | Diego Nava |
+| 517 | Jungle Voices | Diego Nava |
+| 568 | Focus on Yourself | Eugenio Mininni |
+| 584 | Rest Now | Eugenio Mininni |
+| 593 | Opalescent | Eugenio Mininni |
+| 594 | River Flow | Eugenio Mininni |
+| 609 | Moon Walk | Eugenio Mininni |
+| 616 | What it Takes | Eugenio Mininni |
+| 617 | Wind Leaves | Eugenio Mininni |
+| 620 | B.O.R.N | Eugenio Mininni |
+| 623 | Deep Urban | Eugenio Mininni |
+| 628 | Summer Dream | Eugenio Mininni |
+| 629 | Skeeomaver Sound | Eugenio Mininni |
+| 633 | Xanthos | Eugenio Mininni |
+| 652 | Soul Jazz | Francisco Alvear |
+| 664 | Pop One | Francisco Alvear |
+| 695 | Pop 05 | Grigoriy Nuzhny |
+| 700 | Pop 03 | Grigoriy Nuzhny |
+| 713 | Classical 6 | Jonny S. |
+| 720 | New Bass 01 | Lily J |
+| 726 | Uplifting Bass | Lily J |
+| 729 | Pop Track 03 | Lily J |
+| 738 | Hip Hop 02 | Lily J |
+| 744 | House 02 | Lily J |
+| 749 | Relaxation 05 | Lily J |
+| 759 | Romantic 05 | Lily J |
+| 770 | Autofahren | Mauro Urbina |
+| 779 | Oh | Michael Ramir C. |
+| 801 | Happy Home | Michael Ramir C. |
+| 802 | Here Comes The Train | Michael Ramir C. |
+| 804 | I Love You Grandma | Michael Ramir C. |
+| 813 | Magical moment | Michael Ramir C. |
+| 816 | Please | Michael Ramir C. |
+| 821 | At the Playhouse | Michael Ramir C. |
+| 832 | I'm Going Home | Michael Ramir C. |
+| 834 | It's Love | Michael Ramir C. |
+| 837 | Life is a Dream | Michael Ramir C. |
+| 839 | Tears of Joy | Michael Ramir C. |
+| 840 | That's the Way of Life | Michael Ramir C. |
+| 847 | It's April | Michael Ramir C. |
+| 852 | Music and Life | Michael Ramir C. |
+| 856 | Salty and Sweet | Michael Ramir C. |
+| 872 | Gimme that Groove! | Michael Ramir C. |
+| 897 | A Very Happy Christmas | Michael Ramir C. |
+| 953 | Feel Alive | Michael Ramir C. |
+| 963 | Just Keep Walking | Michael Ramir C. |
+| 970 | Night Sky Hip Hop | Michael Ramir C. |
+| 993 | Finding Myself | Michael Ramir C. |
+| 1000 | I Can Hear Your Heartbeat | Michael Ramir C. |
+| 1001 | I Do! | Michael Ramir C. |
+| 1052 | Baby Yohan | Michael Ramir C. |
+| 1081 | We'll Be Okay | Michael Ramir C. |
+| 1140 | Funkee Monkeee | Michael Ramir C. |
+| 1167 | Close Up | Michael Ramir C. |
+| 1183 | Karma | Michael Ramir C. |
+| 1210 | Can't Get You Off My Mind | Michael Ramir C. |
+
+---
+
+## 使用说明
+
+1. 所有音乐文件在 `mixkit_bgm/` 目录下，文件名为 `{ID}.mp3`
+2. 运营人员可试听挑选，将选中的音乐上传到七牛云 CDN
+3. 上传后通过 `POST /api/v1/update/releases` 或直接写 SQL 入库
+4. 分类字段建议: `knowledge` | `showcase` | `promotion` | `lifestyle` | `tech`

docs/release-guide.md

@@ -170,4 +170,4 @@ Tauri updater 插件已内置跨平台安装逻辑，前端代码无需区分平
 | `tauri-app/src-tauri/tauri.conf.json` | updater 配置：公钥 + endpoint URL |
 | `python-api/scripts/publish_release.py` | 发版脚本（扫描 .sig → 上传七牛云 → 写数据库） |
 | `python-api/app/api/v1/update.py` | 后端更新检查 API |
-| `python-api/app/models/update.py` | 数据库模型（`app_releases` / `release_packages`） |
+| `python-api/app/models/update.py` | 数据库模型（`mjk_app_releases` / `mjk_app_release_packages`） |

docs/windows-dev-setup.md

@@ -0,0 +1,192 @@
+# Windows 11 开发环境搭建指南
+
+> 适用场景：全新重装系统后的 Windows 11，国内网络环境。
+
+---
+
+## 前置说明
+
+- **WebView2**：Windows 11 自带，无需安装。
+- **WSL2**：Windows 11 默认支持，Docker Desktop 会自动启用。
+- **全程使用 cmd + 官网 .exe 安装包**，不依赖 PowerShell 脚本。
+
+---
+
+## 一、基础工具安装（图形界面，双击下一步）
+
+按顺序安装，装完一个再装下一个。
+
+### 1. Git
+
+- 下载：https://git-scm.com/download/win
+- 安装：全默认，一路 Next。
+
+### 2. Node.js 22 LTS
+
+- 下载：https://nodejs.org/
+- 安装：勾选 **"Automatically install necessary tools"**（会自动装 Python 2.7 等构建工具）。
+
+### 3. Visual Studio Build Tools 2022
+
+- 下载：https://aka.ms/vs/17/release/vs_BuildTools.exe
+- 安装：只勾选 **"使用 C++ 的桌面开发"**（约 8GB），其他全取消。
+
+### 4. Rust
+
+- 下载：https://rustup.rs/ → 点击 `rustup-init.exe (64-bit)`
+- 安装：选 **1) Proceed with default installation**（默认 MSVC 工具链）。
+
+---
+
+## 二、国内镜像配置（cmd 执行）
+
+打开 **cmd（Win+R → cmd）**，逐行执行：
+
+```cmd
+:: ========== npm 镜像 ==========
+npm config set registry https://registry.npmmirror.com
+
+:: ========== Rust 镜像 ==========
+mkdir "%USERPROFILE%\.cargo" 2>nul
+
+echo [source.crates-io] > "%USERPROFILE%\.cargo\config.toml"
+echo replace-with = 'ustc' >> "%USERPROFILE%\.cargo\config.toml"
+echo [source.ustc] >> "%USERPROFILE%\.cargo\config.toml"
+echo registry = "sparse+https://mirrors.ustc.edu.cn/crates.io-index/" >> "%USERPROFILE%\.cargo\config.toml"
+
+setx RUSTUP_UPDATE_ROOT https://mirrors.ustc.edu.cn/rust-static/rustup
+setx RUSTUP_DIST_SERVER https://mirrors.ustc.edu.cn/rust-static
+
+:: ========== Python 镜像（预留，方案 B 用到） ==========
+pip config set global.index-url https://pypi.tuna.tsinghua.edu.cn/simple
+pip config set global.trusted-host pypi.tuna.tsinghua.edu.cn
+
+echo 镜像配置完成，请关闭并重新打开 cmd
+```
+
+**执行完后，关闭 cmd，重新打开**，再执行验证：
+
+```cmd
+npm config get registry
+cargo --version
+```
+
+---
+
+## 三、方案 A：只跑前端（连测试环境后端）
+
+### 1. 拉代码
+
+```cmd
+git clone <你的仓库地址>
+cd meijiaka-zy\tauri-app
+```
+
+### 2. 装依赖
+
+```cmd
+npm ci
+```
+
+### 3. 启动
+
+```cmd
+npm run tauri dev
+```
+
+前端默认连接 `https://dev.tapi.meijiaka.cn/api/v1`，无需本地后端。
+
+---
+
+## 四、方案 B：前后端都本地跑
+
+在方案 A 基础上继续。
+
+### 1. Python 3.13
+
+- 下载：https://www.python.org/ftp/python/3.13.0/python-3.13.0-amd64.exe
+- 安装：**务必勾选 "Add python.exe to PATH"**，然后 Install Now。
+
+### 2. 安装 uv
+
+```cmd
+pip install uv
+```
+
+### 3. Docker Desktop
+
+- 下载：https://desktop.docker.com/win/main/amd64/Docker%20Desktop%20Installer.exe
+- 安装：默认，装完**重启电脑**。
+- 重启后打开 Docker Desktop，等左下角状态变绿。
+
+### 4. 后端启动
+
+```cmd
+cd meijiaka-zy\python-api
+
+:: 安装依赖
+uv pip install -e ".[dev]"
+
+:: 复制环境变量
+copy .env.example .env
+
+:: 启动数据库
+docker compose -f docker-compose.test.yml up -d db redis
+
+:: 数据库迁移
+alembic upgrade head
+
+:: 启动 API（终端 1）
+make run
+:: 或：uvicorn app.main:app --reload --port 8000
+```
+
+如果需要异步调度器（脚本/TTS/字幕生成等），另开终端：
+
+```cmd
+cd meijiaka-zy\python-api
+make scheduler
+:: 或：python -m app.scheduler.main
+```
+
+### 5. 前端启动（连本地后端）
+
+```cmd
+cd meijiaka-zy\tauri-app
+npm run tauri dev
+```
+
+前端 Vite 开发服务器会代理 API 请求到 `localhost:8000`。如果代理异常，检查 `tauri-app/src/api/client.ts` 中的 `PYTHON_API_BASE_URL`。
+
+---
+
+## 五、验证清单
+
+全部装完后，在 cmd 里执行：
+
+```cmd
+git --version
+node -v
+npm -v
+rustc --version
+cargo --version
+python --version
+uv --version
+docker --version
+```
+
+每个都要有版本号输出。
+
+---
+
+## 六、常见问题
+
+| 现象 | 原因 | 解决 |
+|------|------|------|
+| `npm ci` 卡住 | 镜像没配好 | 检查 `npm config get registry` 是否为 `registry.npmmirror.com` |
+| `cargo build` 卡住 | Rust 镜像没生效 | 关闭 cmd 重新打开，或检查 `%USERPROFILE%\.cargo\config.toml` |
+| Tauri 编译报错 `link.exe not found` | VS Build Tools 没装 C++ 桌面开发 | 重装，确保勾选了该工作负载 |
+| `tauri dev` 白屏 | 前端代理地址错误 | 检查 `client.ts` 里的 base URL |
+| Docker 启动失败 | WSL2 未启用 | 控制面板 → 程序和功能 → 启用 Windows 功能 → 勾选 **适用于 Linux 的 Windows 子系统** |
+| `python` 命令找不到 | 安装时没勾选 Add to PATH | 重装 Python，务必勾选 |
+| `alembic` 命令找不到 | 没在虚拟环境里 | 确保在 `python-api` 目录下执行，`uv pip install` 已经装了 |

python-api/.env.example

@@ -4,7 +4,7 @@
 
 # === 基础配置 ===
 APP_NAME=美家卡智影 API
-APP_VERSION=1.5.18
+APP_VERSION=1.6.4
 # ⚠️ 生产环境必须设为 false
 DEBUG=true
 ENV=development
@@ -47,6 +47,9 @@ VOLCENGINE_API_KEY=your-volcengine-api-key
 VOLCENGINE_CAPTION_APPID=your-caption-appid
 VOLCENGINE_CAPTION_TOKEN=your-caption-token
 
+# 火山 MediaKit
+VOLCENGINE_MEDIAKIT_TOKEN=your-mediakit-token
+
 # Vidu（TTS、声音复刻、对口型）
 VIDU_API_KEY=your-vidu-api-key
 
@@ -71,6 +74,8 @@ SMS_APP_ID=your-sms-app-id
 SMS_SECRET_KEY=your-16-24-32-byte-aes-key
 SMS_BASE_URL=https://bjksmtn.b2m.cn/inter/sendSingleSMS
 # SMS_EXTENDED_CODE=    # 扩展码（选填）
+# 免验证码登录白名单（逗号分隔），名单内的手机号登录时跳过验证码校验
+# SMS_CODE_WHITELIST=13800138000,13900139000
 
 # === 日志配置 ===
 # 生产环境建议 INFO

python-api/alembic/env.py

@@ -20,17 +20,18 @@ load_dotenv()
 
 # 导入模型
 from app.db.session import Base
+from app.models.bgm_music import BgmMusic  # noqa
 from app.models.broll_category import BrollCategory  # noqa
 from app.models.broll_material import BrollMaterial  # noqa
 from app.models.broll_tag import BrollTag  # noqa
+from app.models.cover_background import CoverBackground  # noqa
 from app.models.point_batch import PointBatch  # noqa
 from app.models.point_recharge_order import PointRechargeOrder  # noqa
 from app.models.point_transaction import PointTransaction  # noqa
+from app.models.update import AppRelease, ReleasePackage  # noqa
 from app.models.user import User  # noqa
 from app.models.user_device import UserDevice  # noqa
 from app.models.user_point import UserPoint  # noqa
-from app.models.cover_background import CoverBackground  # noqa
-from app.models.update import AppRelease, ReleasePackage  # noqa
 
 # this is the Alembic Config object
 config = context.config

python-api/alembic/versions/100366516fbd_add_url_to_bgm_music.py

@@ -0,0 +1,28 @@
+"""add_url_to_bgm_music
+
+Revision ID: 100366516fbd
+Revises: 7172a476e5b2
+Create Date: 2026-05-24 15:24:11.076162
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = '100366516fbd'
+down_revision: Union[str, Sequence[str], None] = '7172a476e5b2'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    """Upgrade schema."""
+    op.add_column('mjk_bgm_musics', sa.Column('url', sa.String(length=1024), nullable=True, comment='七牛云 URL'))
+
+
+def downgrade() -> None:
+    """Downgrade schema."""
+    op.drop_column('mjk_bgm_musics', 'url')

python-api/alembic/versions/7149f61a2f9c_make_bgm_music_url_non_nullable.py

@@ -0,0 +1,41 @@
+"""make_bgm_music_url_non_nullable
+
+Revision ID: 7149f61a2f9c
+Revises: 7172a476e5b2
+Create Date: 2026-05-21 10:45:00.000000
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = '7149f61a2f9c'
+down_revision: Union[str, Sequence[str], None] = '100366516fbd'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    """Upgrade schema."""
+    # BGM 云端化改造后，url 字段为必填（七牛云 CDN 地址）
+    op.alter_column(
+        'mjk_bgm_musics',
+        'url',
+        existing_type=sa.String(length=1024),
+        nullable=False,
+        comment='七牛云 URL',
+    )
+
+
+def downgrade() -> None:
+    """Downgrade schema."""
+    op.alter_column(
+        'mjk_bgm_musics',
+        'url',
+        existing_type=sa.String(length=1024),
+        nullable=True,
+        comment='七牛云 URL',
+    )

python-api/alembic/versions/7172a476e5b2_add_bgm_music_table.py

@@ -0,0 +1,46 @@
+"""add_bgm_music_table
+
+Revision ID: 7172a476e5b2
+Revises: d8f4912d7a52
+Create Date: 2026-05-23 13:56:46.013156
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = '7172a476e5b2'
+down_revision: Union[str, Sequence[str], None] = 'd8f4912d7a52'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    """Upgrade schema."""
+    # ### commands auto generated by Alembic - please adjust! ###
+    op.create_table('mjk_bgm_musics',
+    sa.Column('title', sa.String(length=255), nullable=False, comment='音乐名称'),
+    sa.Column('artist', sa.String(length=255), nullable=True, comment='艺术家'),
+    sa.Column('category', sa.String(length=32), nullable=False, comment='场景分类'),
+    sa.Column('file_path', sa.String(length=512), nullable=False, comment='相对文件路径'),
+    sa.Column('duration', sa.Float(), nullable=True, comment='时长（秒）'),
+    sa.Column('status', sa.String(length=16), nullable=False, comment='状态: active/inactive'),
+    sa.Column('sort_order', sa.Integer(), nullable=False, comment='排序权重'),
+    sa.Column('id', sa.BigInteger(), autoincrement=True, nullable=False),
+    sa.Column('created_at', sa.DateTime(timezone=True), nullable=False),
+    sa.Column('updated_at', sa.DateTime(timezone=True), nullable=False),
+    sa.PrimaryKeyConstraint('id')
+    )
+    op.create_index(op.f('ix_mjk_bgm_musics_category'), 'mjk_bgm_musics', ['category'], unique=False)
+    # ### end Alembic commands ###
+
+
+def downgrade() -> None:
+    """Downgrade schema."""
+    # ### commands auto generated by Alembic - please adjust! ###
+    op.drop_index(op.f('ix_mjk_bgm_musics_category'), table_name='mjk_bgm_musics')
+    op.drop_table('mjk_bgm_musics')
+    # ### end Alembic commands ###

python-api/alembic/versions/8d901bc90e67_rename_mjk_release_packages_to_mjk_app_.py

@@ -0,0 +1,29 @@
+"""rename mjk_release_packages to mjk_app_release_packages
+
+Revision ID: 8d901bc90e67
+Revises: 7149f61a2f9c
+Create Date: 2026-05-26 10:05:16.921079
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+
+
+# revision identifiers, used by Alembic.
+revision: str = '8d901bc90e67'
+down_revision: Union[str, Sequence[str], None] = '7149f61a2f9c'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    """Upgrade schema."""
+    op.execute("ALTER TABLE IF EXISTS mjk_release_packages RENAME TO mjk_app_release_packages")
+    op.execute("ALTER INDEX IF EXISTS uix_pkg_platform_arch RENAME TO uix_app_pkg_platform_arch")
+
+
+def downgrade() -> None:
+    """Downgrade schema."""
+    op.execute("ALTER INDEX IF EXISTS uix_app_pkg_platform_arch RENAME TO uix_pkg_platform_arch")
+    op.execute("ALTER TABLE IF EXISTS mjk_app_release_packages RENAME TO mjk_release_packages")

python-api/alembic/versions/d8f4912d7a52_rename_old_table_prefix_for_update_.py

@@ -0,0 +1,48 @@
+"""rename_old_table_prefix_for_update_tables
+
+Revision ID: d8f4912d7a52
+Revises: c3a0e1c71ce6
+Create Date: 2026-05-20 18:02:45.186600
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = 'd8f4912d7a52'
+down_revision: Union[str, Sequence[str], None] = 'c3a0e1c71ce6'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    """Upgrade schema."""
+    # 将旧环境（cbd4068 前）创建的 app_releases / release_packages 重命名为 mjk_ 前缀
+    # 使用 IF EXISTS 兼容：新环境已在 initial_schema 中创建了正确前缀的表名
+    op.execute(
+        "ALTER TABLE IF EXISTS app_releases RENAME TO mjk_app_releases"
+    )
+    op.execute(
+        "ALTER INDEX IF EXISTS ix_app_releases_version "
+        "RENAME TO ix_mjk_app_releases_version"
+    )
+    op.execute(
+        "ALTER TABLE IF EXISTS release_packages RENAME TO mjk_release_packages"
+    )
+
+
+def downgrade() -> None:
+    """Downgrade schema."""
+    op.execute(
+        "ALTER TABLE IF EXISTS mjk_app_releases RENAME TO app_releases"
+    )
+    op.execute(
+        "ALTER INDEX IF EXISTS ix_mjk_app_releases_version "
+        "RENAME TO ix_app_releases_version"
+    )
+    op.execute(
+        "ALTER TABLE IF EXISTS mjk_release_packages RENAME TO release_packages"
+    )

python-api/app/ai/adapters/constants.py

@@ -20,3 +20,4 @@ class Method:
     CAPTION = "caption"
     AUTO_ALIGN = "auto_align"
     VIDEO_GENERATE = "video_generate"
+    REMOVE_BACKGROUND = "remove_background"

python-api/app/ai/adapters/volcengine_mediakit_adapter.py

@@ -0,0 +1,95 @@
+"""
+火山引擎 MediaKit Adapter
+==========================
+
+实现 PlatformAdapter + SyncCapable。
+直接接入 VolcengineMediakitProvider，提供标准 Protocol 接口。
+"""
+
+from __future__ import annotations
+
+import logging
+from typing import Any
+
+from app.ai.adapters.base import AdapterResponse, PlatformAdapter, SyncCapable
+from app.ai.adapters.constants import Method
+from app.ai.providers.volcengine_mediakit_provider import VolcengineMediakitProvider
+from app.core.exceptions import PlatformError, PlatformErrorType
+
+logger = logging.getLogger(__name__)
+
+
+class VolcengineMediakitAdapter(PlatformAdapter, SyncCapable):
+    """火山引擎 MediaKit 平台标准 Adapter"""
+
+    platform_id = "volcengine_mediakit"
+
+    def __init__(self, provider: VolcengineMediakitProvider):
+        self.provider = provider
+
+    # ── PlatformAdapter ──
+
+    async def health(self) -> AdapterResponse:
+        try:
+            # 用无效 URL 测试连通性（400 说明网络通且认证通过）
+            await self.provider.remove_background(
+                image_url="https://example.com/health-check.jpg",
+                scene="general",
+            )
+            return AdapterResponse(success=True)
+        except PlatformError as e:
+            if e.error_type in (
+                PlatformErrorType.AUTH_FAILED,
+                PlatformErrorType.BAD_REQUEST,
+            ):
+                return AdapterResponse(success=True)
+            return AdapterResponse(
+                success=False,
+                error_message=str(e),
+                retryable=e.retryable,
+            )
+        except Exception as e:
+            return AdapterResponse(
+                success=False,
+                error_message=str(e),
+                retryable=False,
+            )
+
+    async def close(self) -> None:
+        await self.provider.close()
+
+    # ── SyncCapable ──
+
+    async def call(self, method: str, payload: dict[str, Any]) -> AdapterResponse:
+        try:
+            if method == Method.REMOVE_BACKGROUND:
+                result = await self.provider.remove_background(
+                    image_url=payload["image_url"],
+                    scene=payload.get("scene", "general"),
+                    need_contour=payload.get("need_contour", False),
+                    contour_color=payload.get("contour_color", "#FFFFFF"),
+                    contour_size=payload.get("contour_size", 10),
+                    need_crop_background=payload.get("need_crop_background", False),
+                )
+                data = result.get("data", {})
+                return AdapterResponse(
+                    success=True,
+                    data={"image_url": data.get("image_url")},
+                )
+
+            else:
+                return AdapterResponse(
+                    success=False,
+                    error_message=f"不支持的方法: {method}",
+                    retryable=False,
+                )
+
+        except PlatformError:
+            raise
+        except Exception as e:
+            raise PlatformError(
+                f"MediaKit {method} 调用失败: {e}",
+                platform="volcengine_mediakit",
+                retryable=False,
+                error_type=PlatformErrorType.UNKNOWN,
+            ) from e

python-api/app/ai/providers/volcengine_mediakit_provider.py

@@ -0,0 +1,174 @@
+"""
+火山引擎 MediaKit Provider
+===========================
+
+直接封装火山引擎 MediaKit HTTP API：
+- 图像背景移除（/api/v1/tools/remove-image-background/sync）
+
+使用 httpx.AsyncClient，支持外部注入（由 lifespan 管理生命周期）。
+"""
+
+from __future__ import annotations
+
+import logging
+from typing import Any
+
+import httpx
+
+from app.config import get_settings
+from app.core.exceptions import PlatformError, PlatformErrorType
+
+logger = logging.getLogger(__name__)
+
+
+def _map_mediakit_error(status: int, message: str, code: int | None = None) -> PlatformError:
+    """把 MediaKit 错误映射为标准 PlatformError"""
+    error_mapping = {
+        400: (PlatformErrorType.BAD_REQUEST, False),
+        401: (PlatformErrorType.AUTH_FAILED, False),
+        403: (PlatformErrorType.AUTH_FAILED, False),
+        429: (PlatformErrorType.RATE_LIMIT, True),
+        500: (PlatformErrorType.SERVER_ERROR, True),
+        502: (PlatformErrorType.SERVER_ERROR, True),
+        503: (PlatformErrorType.SERVER_ERROR, True),
+    }
+    error_type, retryable = error_mapping.get(status, (PlatformErrorType.UNKNOWN, False))
+    return PlatformError(
+        message, platform="volcengine_mediakit",
+        retryable=retryable, error_type=error_type,
+        status_code=status,
+    )
+
+
+class VolcengineMediakitProvider:
+    """火山引擎 MediaKit Provider
+
+    直接调用 MediaKit HTTP API，不做业务层处理。
+    """
+
+    BASE_URL = "https://mediakit.cn-beijing.volces.com"
+    REMOVE_BG_PATH = "/api/v1/tools/remove-image-background/sync"
+    DEFAULT_TIMEOUT = 60.0
+
+    def __init__(
+        self,
+        token: str | None = None,
+        client: httpx.AsyncClient | None = None,
+    ):
+        settings = get_settings()
+        self.token = token or settings.VOLCENGINE_MEDIAKIT_TOKEN or ""
+
+        if not self.token:
+            raise PlatformError(
+                "VOLCENGINE_MEDIAKIT_TOKEN 未配置",
+                platform="volcengine_mediakit",
+                retryable=False,
+                error_type=PlatformErrorType.BAD_REQUEST,
+            )
+
+        if client is not None:
+            self.client = client
+            self._owns_client = False
+        else:
+            self.client = httpx.AsyncClient(timeout=self.DEFAULT_TIMEOUT)
+            self._owns_client = True
+
+    def _get_headers(self) -> dict:
+        return {
+            "Authorization": f"Bearer; {self.token}",
+            "Content-Type": "application/json",
+        }
+
+    async def close(self) -> None:
+        """关闭 HTTP 客户端"""
+        if self._owns_client and self.client and not self.client.is_closed:
+            await self.client.aclose()
+
+    async def remove_background(
+        self,
+        image_url: str,
+        scene: str = "general",
+        need_contour: bool = False,
+        contour_color: str = "#FFFFFF",
+        contour_size: int = 10,
+        need_crop_background: bool = False,
+    ) -> dict[str, Any]:
+        """同步抠图，返回原始 JSON
+
+        Args:
+            image_url: 原始图片 URL
+            scene: 场景类型
+            need_contour: 是否为主体生成描边（仅 human/product 场景生效）
+            contour_color: 描边颜色，十六进制 RGB 格式
+            contour_size: 描边宽度（px），范围 [1, 100]
+            need_crop_background: 是否裁剪透明背景到刚好包裹主体
+
+        Returns:
+            {"code": 0, "message": "Success", "data": {"image_url": "https://..."}}
+        """
+        payload: dict[str, Any] = {"image_url": image_url, "scene": scene}
+        if need_contour:
+            payload["need_contour"] = True
+            payload["contour_color"] = contour_color
+            payload["contour_size"] = max(1, min(100, contour_size))
+        if need_crop_background:
+            payload["need_crop_background"] = True
+
+        try:
+            response = await self.client.post(
+                f"{self.BASE_URL}{self.REMOVE_BG_PATH}",
+                json=payload,
+                headers=self._get_headers(),
+            )
+            response.raise_for_status()
+            data = response.json()
+
+            # 火山引擎 MediaKit 有两种响应格式：
+            # 格式1: {"code": 0, "message": "...", "data": {...}}
+            # 格式2: {"success": true, "result": {...}, "expires_at": ...}
+            code = data.get("code")
+            if code is not None:
+                # 格式1
+                if code != 0:
+                    logger.warning(
+                        f"[MediaKit] 抠图业务失败: code={code}, "
+                        f"message={data.get('message', 'N/A')}, "
+                        f"raw_response={data}, image_url={image_url[:80]}..."
+                    )
+                    raise _map_mediakit_error(
+                        response.status_code,
+                        data.get("message", f"抠图失败: code={code}"),
+                        code=code,
+                    )
+                return data
+            else:
+                # 格式2
+                if not data.get("success", False):
+                    logger.warning(
+                        f"[MediaKit] 抠图业务失败: success=false, "
+                        f"raw_response={data}, image_url={image_url[:80]}..."
+                    )
+                    raise _map_mediakit_error(
+                        response.status_code,
+                        "抠图失败: 平台返回失败状态",
+                    )
+                # 将格式2标准化为格式1，方便上层统一处理
+                return {
+                    "code": 0,
+                    "message": "Success",
+                    "data": data.get("result", {}),
+                }
+
+        except PlatformError:
+            raise
+        except httpx.HTTPStatusError as e:
+            raise _map_mediakit_error(
+                e.response.status_code, f"HTTP错误: {e.response.status_code}"
+            ) from e
+        except (httpx.NetworkError, httpx.TimeoutException) as e:
+            raise PlatformError(
+                f"MediaKit 网络错误: {e}", platform="volcengine_mediakit",
+                retryable=True, error_type=PlatformErrorType.TIMEOUT,
+            ) from e
+        except Exception as e:
+            raise _map_mediakit_error(500, f"抠图失败: {str(e)}") from e

python-api/app/api/v1/bgm_music.py

@@ -0,0 +1,43 @@
+"""
+背景音乐 API
+===========
+
+提供装修行业场景化 BGM 列表查询。
+"""
+
+from fastapi import APIRouter, Depends, Query
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.api.deps import get_db
+from app.crud.bgm_music import bgm_music
+from app.schemas.bgm_music import BgmMusicItem, BgmMusicListResponse
+from app.schemas.common import ApiResponse
+
+router = APIRouter()
+
+
+@router.get("/bgm-musics", response_model=ApiResponse[BgmMusicListResponse])
+async def list_bgm_musics(
+    category: str | None = Query(None, description="场景分类筛选"),
+    db: AsyncSession = Depends(get_db),
+) -> ApiResponse[BgmMusicListResponse]:
+    """
+    获取背景音乐列表
+
+    按场景分类返回可用的背景音乐列表。
+    分类说明：
+    - knowledge: 知识科普（极简、低频）
+    - showcase: 案例展示（积极、有成就感）
+    - promotion: 促销活动（轻快、有能量）
+    - lifestyle: 家居生活（温馨、治愈）
+    - tech: 智能家居（科技感、高级感）
+    """
+    items = await bgm_music.get_active_by_category(db, category=category)
+    return ApiResponse(
+        code=200,
+        message="success",
+        data=BgmMusicListResponse(
+            items=[BgmMusicItem.model_validate(item) for item in items],
+            total=len(items),
+        ),
+    )

python-api/app/api/v1/image.py

@@ -0,0 +1,262 @@
+"""
+图片处理 API
+============
+
+提供图片上传（七牛云）和 AI 抠图（火山引擎 MediaKit）功能。
+"""
+
+import io
+import logging
+import time
+import uuid
+from pathlib import Path
+
+import httpx
+from fastapi import APIRouter, Depends, File, HTTPException, Request, UploadFile
+from pydantic import BaseModel, Field
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.api.deps import get_current_user, get_db
+from app.config import get_settings
+from app.models.user import User
+from app.schemas.common import ApiResponse, success_response
+from app.services import point_service as ps
+from app.services.qiniu_service import get_qiniu_service
+from app.services.volcengine_mediakit_service import VolcengineMediakitService
+from app.utils.file_validation import check_upload_file
+
+router = APIRouter(tags=["Image"])
+
+logger = logging.getLogger(__name__)
+settings = get_settings()
+
+
+# ── Dependencies ──
+
+async def get_mediakit_service(request: Request) -> VolcengineMediakitService:
+    """FastAPI Depends：从 app.state 获取全局 VolcengineMediakitService 实例。"""
+    service = getattr(request.app.state, "volcengine_mediakit_service", None)
+    if service is None:
+        raise HTTPException(
+            status_code=503,
+            detail="MediaKit 服务未初始化，请检查配置",
+        )
+    return service
+
+
+# ── Schemas ──
+
+class ImageUploadResponse(BaseModel):
+    """图片上传响应"""
+
+    url: str = Field(..., description="七牛云图片 URL")
+    key: str = Field(..., description="七牛云文件 key")
+    size: int = Field(..., description="文件大小（字节）")
+
+
+class RemoveBackgroundResponse(BaseModel):
+    """抠图响应"""
+
+    url: str = Field(..., description="抠图结果图片 URL")
+
+
+class RemoveBackgroundRequest(BaseModel):
+    """抠图请求"""
+
+    image_url: str = Field(..., description="原始图片 URL")
+    scene: str = Field(default="human", description="场景类型：general（通用）、human（人物，默认白色描边）或 product（商品）")
+
+
+# ── Endpoints ──
+
+@router.post("/upload/image", response_model=ApiResponse[ImageUploadResponse])
+async def upload_image(
+    file: UploadFile = File(..., description="图片文件"),
+    current_user: User = Depends(get_current_user),
+) -> ApiResponse[ImageUploadResponse]:
+    """
+    上传图片到七牛云
+
+    支持格式：jpg, jpeg, png, gif, webp
+    返回七牛云永久访问 URL。
+    """
+    try:
+        allowed_types = {
+            "image/jpeg",
+            "image/jpg",
+            "image/png",
+            "image/gif",
+            "image/webp",
+        }
+        content_type = file.content_type or ""
+
+        # 如果 content_type 为空，尝试从文件名推断
+        if not content_type:
+            ext = Path(file.filename or "").suffix.lower()
+            ext_to_mime = {
+                ".jpg": "image/jpeg",
+                ".jpeg": "image/jpeg",
+                ".png": "image/png",
+                ".gif": "image/gif",
+                ".webp": "image/webp",
+            }
+            content_type = ext_to_mime.get(ext, "")
+
+        if content_type not in allowed_types:
+            raise HTTPException(
+                status_code=400,
+                detail=f"不支持的图片格式: {content_type}，请上传 jpg/png/gif/webp 图片",
+            )
+
+        # 读取文件内容
+        content = await file.read()
+        if not content:
+            raise HTTPException(status_code=400, detail="文件内容为空")
+
+        # 校验大小和魔数
+        check_upload_file(
+            content,
+            settings.UPLOAD_MAX_IMAGE_SIZE,
+            content_type,
+            "图片",
+        )
+
+        # 生成唯一文件名
+        ext = Path(file.filename or "image.jpg").suffix or ".jpg"
+        unique_name = f"{uuid.uuid4().hex[:16]}{ext}"
+
+        # 上传到七牛云
+        qiniu = get_qiniu_service()
+        bucket, domain = qiniu._get_bucket_and_domain("image")
+        file_key = qiniu.generate_key("image", unique_name)
+        stream = io.BytesIO(content)
+        result = await qiniu.upload_stream_async(
+            stream=stream,
+            key=file_key,
+            mime_type=content_type or "image/jpeg",
+            bucket=bucket,
+            domain=domain,
+        )
+
+        url = result.get("url")
+        returned_key = result.get("key")
+
+        if not url:
+            raise HTTPException(status_code=500, detail="上传到七牛云失败：未返回 URL")
+
+        logger.info(f"[Upload] 图片上传成功: {url[:80]}..., size={len(content)}")
+
+        return success_response(
+            data=ImageUploadResponse(
+                url=url,
+                key=returned_key or file_key,
+                size=len(content),
+            )
+        )
+
+    except HTTPException:
+        raise
+    except Exception as e:
+        logger.error(f"[Upload] 图片上传失败: {e}")
+        raise HTTPException(status_code=500, detail=f"上传失败: {e}")
+
+
+@router.post("/image/remove-background", response_model=ApiResponse[RemoveBackgroundResponse])
+async def remove_background(
+    req: RemoveBackgroundRequest,
+    current_user: User = Depends(get_current_user),
+    mediakit_service: VolcengineMediakitService = Depends(get_mediakit_service),
+    db: AsyncSession = Depends(get_db),
+) -> ApiResponse[RemoveBackgroundResponse]:
+    """
+    AI 抠图（火山引擎 MediaKit）
+
+    移除图片背景，返回透明背景图片 URL。
+    每次调用消耗 10 积分。
+    """
+    # 前置积分检查
+    required_points = ps._calculate_cost("cover_avatar")
+    check = await ps.check_balance(db, current_user.id, required_points)
+    if not check["sufficient"]:
+        raise HTTPException(
+            status_code=402,
+            detail=f"积分不足，需要 {required_points} 积分，当前余额 {check['balance']}",
+        )
+
+    try:
+        logger.info(
+            f"[RemoveBackground] 开始抠图: image_url={req.image_url[:80]}..., scene={req.scene}"
+        )
+        result = await mediakit_service.remove_background(
+            image_url=req.image_url,
+            scene=req.scene,
+        )
+
+        if not result.image_url:
+            logger.error(
+                f"[RemoveBackground] 抠图返回空 URL: raw={result.raw}"
+            )
+            raise HTTPException(status_code=500, detail="抠图失败：未返回结果图片 URL")
+
+        logger.info(f"[RemoveBackground] 抠图成功: {result.image_url[:80]}...")
+
+        # 下载抠图结果并转存到七牛云（避免前端 CORS 问题）
+        try:
+            async with httpx.AsyncClient(timeout=60.0) as client:
+                img_resp = await client.get(result.image_url, follow_redirects=True)
+                img_resp.raise_for_status()
+                img_content = img_resp.content
+
+            if not img_content:
+                raise HTTPException(status_code=500, detail="抠图结果下载失败：内容为空")
+
+            # 上传到七牛云 image bucket
+            qiniu = get_qiniu_service()
+            bucket, domain = qiniu._get_bucket_and_domain("image")
+            unique_name = f"{uuid.uuid4().hex[:16]}.png"
+            file_key = qiniu.generate_key("image", unique_name)
+            stream = io.BytesIO(img_content)
+            upload_result = await qiniu.upload_stream_async(
+                stream=stream,
+                key=file_key,
+                mime_type="image/png",
+                bucket=bucket,
+                domain=domain,
+            )
+
+            qiniu_url = upload_result.get("url")
+            if not qiniu_url:
+                raise HTTPException(status_code=500, detail="抠图结果转存到七牛云失败")
+
+            logger.info(f"[RemoveBackground] 结果已转存七牛云: {qiniu_url[:80]}...")
+
+            # 后置扣费（服务已调用成功）
+            await ps.consume(
+                db,
+                user_id=current_user.id,
+                points=required_points,
+                source_type="cover_avatar",
+                source_id=f"cover_avatar_{current_user.id}_{int(time.time() * 1000)}",
+                description="【封面形象抠图】",
+            )
+            await db.commit()
+
+            return success_response(
+                data=RemoveBackgroundResponse(url=qiniu_url),
+                message="抠图成功",
+            )
+        except HTTPException:
+            raise
+        except Exception as e:
+            logger.error(f"[RemoveBackground] 结果转存失败: {e}")
+            raise HTTPException(status_code=500, detail=f"抠图结果转存失败: {e}")
+
+    except HTTPException:
+        raise
+    except ValueError as e:
+        raise HTTPException(status_code=400, detail=str(e))
+    except Exception as e:
+        logger.error(
+            f"[RemoveBackground] 抠图失败: image_url={req.image_url[:80]}..., error={e}"
+        )
+        raise HTTPException(status_code=500, detail=f"抠图失败: {e}")

python-api/app/api/v1/router.py

@@ -7,9 +7,11 @@ from fastapi import APIRouter
 
 from app.api.v1 import (
     auth,
+    bgm_music,
     caption,
     cover_background,
     events,
+    image,
     materials,
     points,
     script,
@@ -59,5 +61,11 @@ api_router.include_router(cover_background.router, tags=["Cover Background"])
 # 积分系统模块
 api_router.include_router(points.router, tags=["Points"])
 
+# 图片处理模块（上传 + 抠图）
+api_router.include_router(image.router, tags=["Image"])
+
+# 背景音乐模块
+api_router.include_router(bgm_music.router, tags=["BGM Music"])
+
 # 应用更新模块
 api_router.include_router(update.router, prefix="/update", tags=["Update"])

python-api/app/api/v1/update.py

@@ -7,7 +7,7 @@
 
 from datetime import UTC, datetime
 
-from fastapi import APIRouter, Depends, HTTPException, Query, status
+from fastapi import APIRouter, Depends, HTTPException, Query, Response, status
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
@@ -44,11 +44,11 @@ async def check_update(
     latest: AppRelease | None = result.scalar_one_or_none()
 
     if not latest:
-        raise HTTPException(status_code=status.HTTP_204_NO_CONTENT)
+        return Response(status_code=status.HTTP_204_NO_CONTENT)
 
     # 已是最新版本（或更高）
     if latest.version == version:
-        raise HTTPException(status_code=status.HTTP_204_NO_CONTENT)
+        return Response(status_code=status.HTTP_204_NO_CONTENT)
 
     # 查询对应平台的包
     result = await db.execute(
@@ -62,7 +62,7 @@ async def check_update(
 
     if not pkg:
         # 该平台无包，返回 204（避免报错阻断用户）
-        raise HTTPException(status_code=status.HTTP_204_NO_CONTENT)
+        return Response(status_code=status.HTTP_204_NO_CONTENT)
 
     # 构建 Tauri 格式的响应
     platform_key = f"{target}-{arch}"

python-api/app/api/v1/upload.py

@@ -18,6 +18,7 @@ from app.config import get_settings
 from app.models.user import User
 from app.schemas.common import ApiResponse, success_response
 from app.services.qiniu_service import get_qiniu_service
+from app.utils.file_validation import check_upload_file
 
 router = APIRouter(prefix="/upload", tags=["Upload"])
 
@@ -25,101 +26,6 @@ logger = logging.getLogger(__name__)
 settings = get_settings()
 
 
-def _validate_file_magic(content: bytes, expected_content_type: str) -> bool:
-    """通过文件头魔数校验文件真实类型，防止 MIME 伪造攻击。"""
-    if len(content) < 12:
-        return False
-
-    # 拒绝常见危险文件头
-    dangerous_signatures = [
-        (b"MZ", "Windows 可执行文件"),           # .exe, .dll
-        (b"#!", "Shell 脚本"),                    # bash, python, etc
-        (b"PK\x03\x04", "ZIP 压缩包"),            # .zip, .jar, .docx
-        (b"<?xml", "XML 文件"),
-        (b"<html", "HTML 文件"),
-        (b"<!DO", "HTML 文档"),
-        (b"%PDF", "PDF 文件"),
-    ]
-    for sig, _ in dangerous_signatures:
-        if content.startswith(sig):
-            return False
-    if b"<script" in content[:512].lower():
-        return False
-
-    main_type = expected_content_type.split("/")[0]
-
-    # 图片校验
-    if main_type == "image":
-        if content.startswith(b"\xff\xd8\xff"):
-            return expected_content_type in ("image/jpeg", "image/jpg")
-        if content.startswith(b"\x89PNG\r\n\x1a\n"):
-            return expected_content_type == "image/png"
-        if content.startswith(b"GIF89a") or content.startswith(b"GIF87a"):
-            return expected_content_type == "image/gif"
-        if content.startswith(b"RIFF") and content[8:12] == b"WEBP":
-            return expected_content_type == "image/webp"
-        return False
-
-    # 视频校验
-    if main_type == "video":
-        # MP4 / MOV / M4V 等 ISO Base Media File Format
-        if content[4:8] == b"ftyp":
-            brand = content[8:12]
-            if brand in (b"qt  ", b"qtw "):
-                return expected_content_type in ("video/quicktime",)
-            # mp4, isom, avc1, mp41, mp42 等
-            return expected_content_type in (
-                "video/mp4",
-                "video/quicktime",
-            )
-        if content.startswith(b"RIFF") and content[8:12] == b"AVI ":
-            return expected_content_type == "video/x-msvideo"
-        if content.startswith(b"\x1aE\xdf\xa3"):
-            return expected_content_type == "video/webm"
-        return False
-
-    # 音频校验
-    if main_type == "audio":
-        if content[:3] == b"ID3" or content[:2] in (
-            b"\xff\xfb",
-            b"\xff\xf3",
-            b"\xff\xf2",
-        ):
-            return expected_content_type in ("audio/mpeg", "audio/mp3")
-        if content.startswith(b"RIFF") and content[8:12] == b"WAVE":
-            return expected_content_type in ("audio/wav", "audio/x-wav")
-        if content.startswith(b"fLaC"):
-            return expected_content_type == "audio/flac"
-        if content.startswith(b"OggS"):
-            return expected_content_type == "audio/ogg"
-        # AAC / M4A（也是 ftyp 格式）
-        if content[4:8] == b"ftyp":
-            brand = content[8:12]
-            if brand in (b"M4A ", b"m4a ", b"mp42", b"isom", b"M4P "):
-                return expected_content_type in (
-                    "audio/mp4",
-                    "audio/aac",
-                    "audio/m4a",
-                )
-        return False
-
-    return False
-
-
-def _check_upload_file(content: bytes, max_size: int, content_type: str, type_label: str) -> None:
-    """统一校验文件大小和魔数，失败时直接抛 HTTPException。"""
-    if len(content) > max_size:
-        max_mb = max_size // 1024 // 1024
-        raise HTTPException(
-            status_code=413,
-            detail=f"{type_label}文件大小不能超过 {max_mb}MB",
-        )
-    if not _validate_file_magic(content, content_type):
-        raise HTTPException(
-            status_code=400,
-            detail=f"{type_label}文件内容与实际格式不符，可能存在安全风险",
-        )
-
 
 class UploadResponse(BaseModel):
     """上传响应"""
@@ -173,7 +79,7 @@ async def upload_video(
             raise HTTPException(status_code=400, detail="文件内容为空")
 
         # 校验大小和魔数
-        _check_upload_file(
+        check_upload_file(
             content,
             settings.UPLOAD_MAX_VIDEO_SIZE,
             content_type,
@@ -269,7 +175,7 @@ async def upload_audio(
             raise HTTPException(status_code=400, detail="文件内容为空")
 
         # 校验大小和魔数
-        _check_upload_file(
+        check_upload_file(
             content,
             settings.UPLOAD_MAX_AUDIO_SIZE,
             content_type,

python-api/app/config.py

@@ -24,7 +24,7 @@ class Settings(BaseSettings):
 
     # 应用基础配置
     APP_NAME: str = Field(default="美家卡智影 API", description="应用名称")
-    APP_VERSION: str = Field(default="1.5.18", description="应用版本")
+    APP_VERSION: str = Field(default="1.6.4", description="应用版本")
     DEBUG: bool = Field(default=False, description="调试模式")
     ENV: Literal["development", "staging", "production"] = Field(
         default="development", description="运行环境"
@@ -106,6 +106,9 @@ class Settings(BaseSettings):
     VOLCENGINE_CAPTION_APPID: str | None = Field(default=None, description="火山字幕 AppID")
     VOLCENGINE_CAPTION_TOKEN: str | None = Field(default=None, description="火山字幕 Token")
 
+    # 火山引擎 MediaKit 服务（背景移除等多媒体处理）
+    VOLCENGINE_MEDIAKIT_TOKEN: str | None = Field(default=None, description="火山引擎 MediaKit Token")
+
     # Vidu 密钥（base_url 已从 Settings 移除，改用 config/platform-config.yaml 配置）
     VIDU_API_KEY: str | None = Field(default=None, description="Vidu API Key")
 
@@ -134,6 +137,10 @@ class Settings(BaseSettings):
     SMS_EXTENDED_CODE: str | None = Field(
         default=None, description="B2M 短信平台扩展码（选填）"
     )
+    SMS_CODE_WHITELIST: str = Field(
+        default="",
+        description="免验证码登录白名单（逗号分隔的手机号，如 13800138000,13900139000）",
+    )
 
 
 
@@ -175,6 +182,17 @@ class Settings(BaseSettings):
         """是否使用 Redis"""
         return bool(self.REDIS_HOST)
 
+    @property
+    def sms_code_whitelist_set(self) -> set[str]:
+        """免验证码登录白名单（去重、去空格）"""
+        if not self.SMS_CODE_WHITELIST:
+            return set()
+        return {
+            mobile.strip()
+            for mobile in self.SMS_CODE_WHITELIST.split(",")
+            if mobile.strip()
+        }
+
 
 @lru_cache
 def get_settings() -> Settings:

python-api/app/crud/__init__.py

@@ -10,6 +10,7 @@ CRUD 模块
     user_obj = await user.get(db, id="xxx")
 """
 
+from app.crud.bgm_music import bgm_music
 from app.crud.broll_category import broll_category
 from app.crud.broll_material import broll_material
 from app.crud.cover_background import cover_background
@@ -17,6 +18,7 @@ from app.crud.user import user
 
 __all__ = [
     "user",
+    "bgm_music",
     "broll_category",
     "broll_material",
     "cover_background",

python-api/app/crud/bgm_music.py

@@ -0,0 +1,37 @@
+"""
+背景音乐 CRUD
+============
+"""
+
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.crud.base import CRUDBase
+from app.models.bgm_music import BgmMusic
+
+
+class BgmMusicCRUD(CRUDBase[BgmMusic]):
+    """背景音乐数据访问"""
+
+    def __init__(self) -> None:
+        super().__init__(BgmMusic)
+
+    async def get_active_by_category(
+        self, db: AsyncSession, *, category: str | None = None
+    ) -> list[BgmMusic]:
+        """
+        获取指定分类下状态为 active 的音乐列表
+
+        Args:
+            category: 场景分类，None 表示获取全部
+        """
+        query = select(BgmMusic).where(BgmMusic.status == "active")
+        if category:
+            query = query.where(BgmMusic.category == category)
+        query = query.order_by(BgmMusic.sort_order.asc(), BgmMusic.id.asc())
+        result = await db.execute(query)
+        return list(result.scalars().all())
+
+
+# 导出实例
+bgm_music = BgmMusicCRUD()

python-api/app/main.py

@@ -66,6 +66,10 @@ async def lifespan(app: FastAPI):
             timeout=httpx.Timeout(60.0, connect=5.0),
             limits=httpx.Limits(max_connections=10, max_keepalive_connections=10),
         ),
+        "volcengine_mediakit": httpx.AsyncClient(
+            timeout=httpx.Timeout(60.0, connect=5.0),
+            limits=httpx.Limits(max_connections=10, max_keepalive_connections=10),
+        ),
         "default": httpx.AsyncClient(
             timeout=httpx.Timeout(30.0, connect=5.0),
             limits=httpx.Limits(max_connections=50, max_keepalive_connections=20),
@@ -90,6 +94,18 @@ async def lifespan(app: FastAPI):
         logger.warning(f"Volcengine Caption Provider 初始化跳过: {e}")
         app.state.volcengine_caption_provider = None
 
+    # 火山 Mediakit Provider
+    from app.ai.providers.volcengine_mediakit_provider import VolcengineMediakitProvider
+
+    try:
+        app.state.volcengine_mediakit_provider = VolcengineMediakitProvider(
+            client=app.state.http_clients["volcengine_mediakit"]
+        )
+        logger.info("Volcengine Mediakit Provider initialized")
+    except Exception as e:
+        logger.warning(f"Volcengine Mediakit Provider 初始化跳过: {e}")
+        app.state.volcengine_mediakit_provider = None
+
     # 火山方舟 Provider（可选，需要 API Key）
     try:
         from app.ai.providers.volcengine_provider import VolcengineProvider
@@ -104,6 +120,7 @@ async def lifespan(app: FastAPI):
     from app.ai.adapters.vidu_adapter import ViduAdapter
     from app.ai.adapters.volcengine_ark_adapter import VolcengineArkAdapter
     from app.ai.adapters.volcengine_caption_adapter import VolcengineCaptionAdapter
+    from app.ai.adapters.volcengine_mediakit_adapter import VolcengineMediakitAdapter
     from app.platform_gateway import PlatformGateway
 
     app.state.vidu_adapter = ViduAdapter(app.state.vidu_provider)
@@ -122,6 +139,15 @@ async def lifespan(app: FastAPI):
         )
         logger.info("VolcengineCaptionAdapter initialized")
 
+    if app.state.volcengine_mediakit_provider:
+        app.state.volcengine_mediakit_adapter = VolcengineMediakitAdapter(
+            app.state.volcengine_mediakit_provider
+        )
+        app.state.platform_gateway.register(
+            "volcengine_mediakit", app.state.volcengine_mediakit_adapter
+        )
+        logger.info("VolcengineMediakitAdapter initialized")
+
     if app.state.volcengine_provider:
         app.state.volcengine_ark_adapter = VolcengineArkAdapter(
             app.state.volcengine_provider
@@ -145,6 +171,7 @@ async def lifespan(app: FastAPI):
     # 初始化 Service（传入 Gateway）
     from app.services.vidu_service import ViduService
     from app.services.volcengine_caption_service import VolcengineCaptionService
+    from app.services.volcengine_mediakit_service import VolcengineMediakitService
 
     app.state.vidu_service = ViduService(app.state.platform_gateway)
     logger.info("Vidu Service initialized")
@@ -157,6 +184,14 @@ async def lifespan(app: FastAPI):
     else:
         app.state.volcengine_caption_service = None
 
+    if app.state.volcengine_mediakit_provider:
+        app.state.volcengine_mediakit_service = VolcengineMediakitService(
+            app.state.platform_gateway
+        )
+        logger.info("Volcengine Mediakit Service initialized")
+    else:
+        app.state.volcengine_mediakit_service = None
+
     # LLM Gateway（可选，向后兼容）
     if app.state.volcengine_provider:
         from app.ai.gateways.llm_gateway import LLMGateway
@@ -331,4 +366,3 @@ def main():
 
 if __name__ == "__main__":
     main()
-# test

python-api/app/models/__init__.py

@@ -7,6 +7,7 @@
 """
 
 from app.models.base import BaseModel, BaseModelBigInt
+from app.models.bgm_music import BgmMusic
 from app.models.broll_category import BrollCategory
 from app.models.broll_material import BrollMaterial
 from app.models.broll_tag import BrollTag
@@ -21,6 +22,7 @@ from app.models.user_point import UserPoint
 __all__ = [
     "BaseModel",
     "BaseModelBigInt",
+    "BgmMusic",
     "User",
     "UserDevice",
     "UserPoint",

python-api/app/models/bgm_music.py

@@ -0,0 +1,50 @@
+"""
+背景音乐模型
+==========
+
+装修行业场景化 BGM 库，按知识科普/案例展示/促销活动/家居生活/智能家居
+五个场景分类管理。
+"""
+
+from sqlalchemy import Float, Integer, String
+from sqlalchemy.orm import Mapped, mapped_column
+
+from app.models.base import BaseModelBigInt
+
+
+class BgmMusic(BaseModelBigInt):
+    """
+    背景音乐表
+
+    Attributes:
+        title: 音乐名称
+        artist: 艺术家
+        category: 场景分类 (knowledge/showcase/promotion/lifestyle/tech)
+        file_path: 相对文件路径（如 knowledge/3_Dance_with_Me.mp3）
+        duration: 时长（秒）
+        status: 状态 (active/inactive)
+        sort_order: 排序权重（越小越靠前）
+    """
+
+    __tablename__ = "mjk_bgm_musics"
+
+    title: Mapped[str] = mapped_column(String(255), nullable=False, comment="音乐名称")
+    artist: Mapped[str] = mapped_column(String(255), nullable=True, comment="艺术家")
+    category: Mapped[str] = mapped_column(
+        String(32), nullable=False, index=True, comment="场景分类"
+    )
+    file_path: Mapped[str] = mapped_column(
+        String(512), nullable=False, comment="相对文件路径"
+    )
+    url: Mapped[str] = mapped_column(
+        String(1024), nullable=False, comment="七牛云 URL"
+    )
+    duration: Mapped[float] = mapped_column(
+        Float, nullable=True, comment="时长（秒）"
+    )
+    status: Mapped[str] = mapped_column(
+        String(16), default="active", nullable=False, comment="状态: active/inactive"
+    )
+    sort_order: Mapped[int] = mapped_column(
+        Integer, default=0, nullable=False, comment="排序权重"
+    )

python-api/app/models/update.py

@@ -38,7 +38,7 @@ class AppRelease(Base):
 class ReleasePackage(Base):
     """平台安装包信息"""
 
-    __tablename__ = "mjk_release_packages"
+    __tablename__ = "mjk_app_release_packages"
 
     id: Mapped[int] = mapped_column(Integer, primary_key=True, autoincrement=True)
     release_id: Mapped[int] = mapped_column(
@@ -60,5 +60,5 @@ class ReleasePackage(Base):
     release: Mapped["AppRelease"] = relationship("AppRelease", back_populates="packages")
 
     __table_args__ = (
-        UniqueConstraint("release_id", "platform", "architecture", name="uix_pkg_platform_arch"),
+        UniqueConstraint("release_id", "platform", "architecture", name="uix_app_pkg_platform_arch"),
     )

python-api/app/schemas/bgm_music.py

@@ -0,0 +1,29 @@
+"""
+背景音乐 Schema
+==============
+"""
+
+from pydantic import BaseModel, Field
+
+
+class BgmMusicItem(BaseModel):
+    """背景音乐项"""
+
+    id: int = Field(description="音乐ID")
+    title: str = Field(description="音乐名称")
+    artist: str | None = Field(default=None, description="艺术家")
+    category: str = Field(description="场景分类")
+    file_path: str = Field(description="相对文件路径")
+    url: str = Field(description="七牛云 URL")
+    duration: float | None = Field(default=None, description="时长（秒）")
+    sort_order: int = Field(default=0, description="排序权重")
+
+    class Config:
+        from_attributes = True
+
+
+class BgmMusicListResponse(BaseModel):
+    """背景音乐列表响应"""
+
+    items: list[BgmMusicItem] = Field(description="音乐列表")
+    total: int = Field(description="总数")

python-api/app/services/auth_service.py

@@ -18,6 +18,7 @@ from typing import Any
 import httpx
 from sqlalchemy.ext.asyncio import AsyncSession
 
+from app.config import get_settings
 from app.core.redis_client import get_redis_client
 from app.core.security import (
     create_access_token,
@@ -188,8 +189,9 @@ async def login_with_sms(
     5. 创建/覆盖设备记录
     6. 签发双 Token
     """
-    # 1. 校验验证码
-    if not await verify_sms_code(mobile, code):
+    # 1. 校验验证码（白名单内的手机号跳过校验）
+    settings = get_settings()
+    if mobile not in settings.sms_code_whitelist_set and not await verify_sms_code(mobile, code):
         raise ValueError("验证码错误或已过期")
 
     # 2. 查询用户（不再自动注册）

python-api/app/services/point_service.py

@@ -329,6 +329,7 @@ _CATEGORY_MAP: dict[str, str] = {
     "compose": "压制成片",
     "subtitle_burn": "字幕烧录",
     "cover_design": "封面设计",
+    "cover_avatar": "封面形象",
     "wxpay": "充值",
     "compensation": "充值",
     "invite": "充值",

python-api/app/services/volcengine_mediakit_service.py

@@ -0,0 +1,89 @@
+"""
+火山引擎 MediaKit Service
+=========================
+
+通过 PlatformGateway 调用 MediaKit 第三方 API，自身负责：
+- 参数校验
+- 结果提取与格式化
+"""
+
+from __future__ import annotations
+
+import logging
+from dataclasses import dataclass, field
+from typing import Any
+
+from app.ai.adapters.constants import Method
+from app.platform_gateway import PlatformGateway
+
+logger = logging.getLogger(__name__)
+
+
+@dataclass
+class RemoveBackgroundResult:
+    """抠图结果"""
+
+    image_url: str = ""
+    raw: dict[str, Any] = field(default_factory=dict)
+
+
+class VolcengineMediakitService:
+    """火山引擎 MediaKit 服务封装"""
+
+    # 支持的场景
+    SUPPORTED_SCENES = {"general", "human", "product"}
+
+    def __init__(self, gateway: PlatformGateway):
+        self.gateway = gateway
+
+    async def remove_background(
+        self,
+        image_url: str,
+        scene: str = "human",
+    ) -> RemoveBackgroundResult:
+        """同步抠图
+
+        Args:
+            image_url: 原始图片 URL
+            scene: 场景类型，"general"（通用）、"human"（人物）或 "product"（商品）
+
+        Returns:
+            RemoveBackgroundResult: 包含抠图结果图片 URL
+
+        Raises:
+            ValueError: 参数校验失败
+            PlatformError: 平台调用失败
+        """
+        if not image_url:
+            raise ValueError("image_url 不能为空")
+
+        if scene not in self.SUPPORTED_SCENES:
+            raise ValueError(f"不支持的场景: {scene}，可选: {self.SUPPORTED_SCENES}")
+
+        # 人物/商品场景默认启用白色描边 + 裁剪背景
+        enable_contour = scene in ("human", "product")
+        payload = {
+            "image_url": image_url,
+            "scene": scene,
+            "need_contour": enable_contour,
+            "contour_color": "#FFFFFF",
+            "contour_size": 20,
+            "need_crop_background": enable_contour,
+        }
+
+        response = await self.gateway.call_sync(
+            platform="volcengine_mediakit",
+            method=Method.REMOVE_BACKGROUND,
+            payload=payload,
+        )
+
+        if not response.success:
+            raise RuntimeError(
+                response.error_message or "抠图失败"
+            )
+
+        result_image_url = (response.data or {}).get("image_url", "")
+        return RemoveBackgroundResult(
+            image_url=result_image_url,
+            raw=response.data or {},
+        )

python-api/app/utils/file_validation.py

@@ -0,0 +1,105 @@
+"""
+文件校验工具
+==========
+
+提供文件头魔数校验和上传文件统一校验功能，
+防止 MIME 伪造攻击和危险文件上传。
+"""
+
+from fastapi import HTTPException
+
+
+def validate_file_magic(content: bytes, expected_content_type: str) -> bool:
+    """通过文件头魔数校验文件真实类型，防止 MIME 伪造攻击。"""
+    if len(content) < 12:
+        return False
+
+    # 拒绝常见危险文件头
+    dangerous_signatures = [
+        (b"MZ", "Windows 可执行文件"),           # .exe, .dll
+        (b"#!", "Shell 脚本"),                    # bash, python, etc
+        (b"PK\x03\x04", "ZIP 压缩包"),            # .zip, .jar, .docx
+        (b"<?xml", "XML 文件"),
+        (b"<html", "HTML 文件"),
+        (b"<!DO", "HTML 文档"),
+        (b"%PDF", "PDF 文件"),
+    ]
+    for sig, _ in dangerous_signatures:
+        if content.startswith(sig):
+            return False
+    if b"<script" in content[:512].lower():
+        return False
+
+    main_type = expected_content_type.split("/")[0]
+
+    # 图片校验
+    if main_type == "image":
+        if content.startswith(b"\xff\xd8\xff"):
+            return expected_content_type in ("image/jpeg", "image/jpg")
+        if content.startswith(b"\x89PNG\r\n\x1a\n"):
+            return expected_content_type == "image/png"
+        if content.startswith(b"GIF89a") or content.startswith(b"GIF87a"):
+            return expected_content_type == "image/gif"
+        if content.startswith(b"RIFF") and content[8:12] == b"WEBP":
+            return expected_content_type == "image/webp"
+        return False
+
+    # 视频校验
+    if main_type == "video":
+        # MP4 / MOV / M4V 等 ISO Base Media File Format
+        if content[4:8] == b"ftyp":
+            brand = content[8:12]
+            if brand in (b"qt  ", b"qtw "):
+                return expected_content_type in ("video/quicktime",)
+            # mp4, isom, avc1, mp41, mp42 等
+            return expected_content_type in (
+                "video/mp4",
+                "video/quicktime",
+            )
+        if content.startswith(b"RIFF") and content[8:12] == b"AVI ":
+            return expected_content_type == "video/x-msvideo"
+        if content.startswith(b"\x1aE\xdf\xa3"):
+            return expected_content_type == "video/webm"
+        return False
+
+    # 音频校验
+    if main_type == "audio":
+        if content[:3] == b"ID3" or content[:2] in (
+            b"\xff\xfb",
+            b"\xff\xf3",
+            b"\xff\xf2",
+        ):
+            return expected_content_type in ("audio/mpeg", "audio/mp3")
+        if content.startswith(b"RIFF") and content[8:12] == b"WAVE":
+            return expected_content_type in ("audio/wav", "audio/x-wav")
+        if content.startswith(b"fLaC"):
+            return expected_content_type == "audio/flac"
+        if content.startswith(b"OggS"):
+            return expected_content_type == "audio/ogg"
+        # AAC / M4A（也是 ftyp 格式）
+        if content[4:8] == b"ftyp":
+            brand = content[8:12]
+            if brand in (b"M4A ", b"m4a ", b"mp42", b"isom", b"M4P "):
+                return expected_content_type in (
+                    "audio/mp4",
+                    "audio/aac",
+                    "audio/m4a",
+                )
+        return False
+
+    return False
+
+
+def check_upload_file(content: bytes, max_size: int, content_type: str, type_label: str) -> None:
+    """统一校验文件大小和魔数，失败时直接抛 HTTPException。"""
+    if len(content) > max_size:
+        max_mb = max_size // 1024 // 1024
+        raise HTTPException(
+            status_code=413,
+            detail=f"{type_label}文件大小不能超过 {max_mb}MB",
+        )
+    if not validate_file_magic(content, content_type):
+        raise HTTPException(
+            status_code=400,
+            detail=f"{type_label}文件内容与实际格式不符，可能存在安全风险",
+        )

python-api/config/platform-config.yaml

@@ -87,6 +87,23 @@ platforms:
           qps: 5
           burst: 10
 
+  # ── 火山引擎媒体处理（MediaKit）──
+  volcengine_mediakit:
+    name: "火山引擎媒体处理"
+    provider: "volcengine_mediakit"
+    base_url: "https://mediakit.cn-beijing.volces.com"
+    rate_limit:
+      qps: 5
+      burst: 10
+    models: []
+    methods:
+      remove_background:
+        timeout: 120
+        max_connections: 10
+        rate_limit:
+          qps: 5
+          burst: 10
+
 # ── 任务默认模型映射 ──
 # 当调用方未指定模型时，按任务类型选择默认模型
 task_defaults:

python-api/config/points-config.yaml

@@ -24,10 +24,13 @@ fixed_costs:
   voice_clone: 200
 
   # 字幕烧录：将生成的字幕文件烧录到视频中（FFmpeg 合成）
-  subtitle_burn: 2
+  subtitle_burn: 5
 
   # 封面设计：根据视频内容自动生成封面图
-  cover_design: 2
+  cover_design: 5
+
+  # 封面形象：上传人物照片 AI 抠图生成透明背景形象
+  cover_avatar: 10
 
   # 压制成片：将多个素材片段合并为最终视频（FFmpeg 拼接）
   compose: 5
@@ -52,11 +55,11 @@ duration_based_costs:
       # 计算依据：中文正常朗读语速约 200~250 字/分钟，取 240 字/分钟：
       #   60秒 ÷ 240字 = 0.25 秒/字
       # 注意：此为经验值，未经过 Vidu TTS 实测校准。实际时长受标点停顿、
-      #       数字/英文混合、TTS 角色风格等因素影响，误差约 ±20%。
+      # 数字/英文混合、TTS 角色风格等因素影响，误差约 ±20%。
       # TODO: 收集实测数据后校准此值。
       seconds_per_char: 0.25
 
-  # ── 视频生成（对口型）──
+  # ── 视频生成 ──
   # 计费公式：max(min_points, ceil(实际视频秒数) × multiplier)
   # 说明：秒数先向上取整为整数，再乘以 multiplier。不足 1 秒按 1 秒计算。
   # 示例：4.5秒视频 → ceil(4.5) × 1 = 5 积分；0.8秒 → ceil(0.8) × 1 = 1 积分
@@ -66,8 +69,7 @@ duration_based_costs:
 
     # 预估参数（执行业务前检查余额时使用）
     estimation:
-      # 是否直接使用输入素材秒数作为预估上限。
-      # 视频生成时长 = 输入音频/素材时长，因此用 input_seconds 预估最准确。
+      # 视频生成时长 = 输入音频时长，因此用 input_seconds 预估最准确。
       # 调用方需传入 input_seconds 参数。
       use_input_seconds: true
 
@@ -77,10 +79,10 @@ duration_based_costs:
 # 支持积分赠送：points 为实际到账积分数，amount_rmb 为支付金额（分）。
 # label 为空时不显示标签角标。
 recharge_options:
-  - { price: 10000,  points: 2000,   label: "",      validity_days: 180 }
+  - { price: 10000,  points: 2000,   label: "",      validity_days: 90 }
   - { price: 50000,  points: 11000,  label: "热销",  validity_days: 180 }
-  - { price: 100000, points: 23000,  label: "推荐",  validity_days: 365 }
-  - { price: 500000, points: 125000, label: "超值",  validity_days: 0 }
+  - { price: 100000, points: 22500,  label: "推荐",  validity_days: 180 }
+  - { price: 500000, points: 120000, label: "超值",  validity_days: 365 }
 
 
 # ── 免费业务（不扣积分）───────────────────────────────

python-api/deploy-test.sh

@@ -15,6 +15,7 @@ echo "========================================"
 PROJECT_DIR="/opt/meijiaka-zy"
 GIT_REPO="http://git2.haodian.cn/xiaoyu/meijiaka-zy.git"
 API_PORT=8081
+COMPOSE_FILE="docker-compose.test.yml"
 
 # 1. 检查 Docker
 echo "[1/7] 检查 Docker 环境..."
@@ -34,7 +35,8 @@ docker compose version || echo "docker-compose 版本: $(docker-compose --versio
 echo "[2/7] 更新代码..."
 if [ -d "$PROJECT_DIR/.git" ]; then
     cd "$PROJECT_DIR"
-    git pull origin master
+    git fetch origin master
+    git reset --hard origin/master
 else
     git clone "$GIT_REPO" "$PROJECT_DIR"
     cd "$PROJECT_DIR"
@@ -83,12 +85,12 @@ echo "✅ 环境变量检查通过"
 
 # 5. 构建镜像
 echo "[5/7] 构建 Docker 镜像..."
-docker compose -f docker-compose.test.yml build --no-cache
+docker compose -f "$COMPOSE_FILE" build --pull
 
 # 6. 启动服务
 echo "[6/7] 启动服务..."
-docker compose -f docker-compose.test.yml down 2>/dev/null || true
-docker compose -f docker-compose.test.yml up -d
+docker compose -f "$COMPOSE_FILE" down 2>/dev/null || true
+docker compose -f "$COMPOSE_FILE" up -d
 
 # 7. 等待并验证
 echo "[7/7] 等待服务启动..."
@@ -98,6 +100,10 @@ MAX_RETRY=12
 RETRY=0
 while [ $RETRY -lt $MAX_RETRY ]; do
     if curl -s http://localhost:$API_PORT/health | grep -q "healthy"; then
+        # 验证 scheduler 容器也在运行
+        if ! docker ps --filter "name=meijiaka-zy-scheduler" --filter "status=running" -q | grep -q .; then
+            echo "⚠️  API 已就绪，但 scheduler 容器未运行，请检查日志"
+        fi
         echo ""
         echo "========================================"
         echo "  ✅ 测试服部署成功！"
@@ -114,8 +120,8 @@ while [ $RETRY -lt $MAX_RETRY ]; do
         echo ""
         echo "  常用命令:"
         echo "    cd $PROJECT_DIR/python-api"
-        echo "    docker compose -f docker-compose.test.yml logs -f"
-        echo "    docker compose -f docker-compose.test.yml restart api"
+        echo "    docker compose -f $COMPOSE_FILE logs -f"
+        echo "    docker compose -f $COMPOSE_FILE restart api"
         echo "========================================"
         exit 0
     fi

python-api/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "meijiaka-ai-api"
-version = "1.5.18"
+version = "1.6.4"
 description = "美家卡智影 - AI 视频创作后端 API"
 authors = [{ name = "Meijiaka Team" }]
 readme = "README.md"
@@ -61,6 +61,9 @@ dependencies = [
 
     # 音频时长探测（TTS 扣费用）
     "mutagen~=1.47.0",
+
+    # 图像处理（智能抠图合成封面）
+    "Pillow>=11.0.0",
 ]
 
 [project.optional-dependencies]

python-api/scripts/import_bgm.py

@@ -0,0 +1,136 @@
+#!/usr/bin/env python3
+"""
+导入 Mixkit BGM 音频文件到数据库并上传七牛云
+扫描 mixkit_bgm/ 目录下的分类文件夹，读取音频元数据并插入 mjk_bgm_musics 表
+同时上传音频到七牛云视频/音频 bucket，保存 URL。
+"""
+
+import asyncio
+import os
+import sys
+from pathlib import Path
+
+# 将项目根目录加入 Python 路径
+project_root = Path(__file__).parent.parent
+sys.path.insert(0, str(project_root))
+
+# 加载环境变量
+from dotenv import load_dotenv
+
+load_dotenv()
+
+from mutagen.mp3 import MP3
+from sqlalchemy import select
+from app.db.session import AsyncSessionLocal
+from app.models.bgm_music import BgmMusic
+from app.services.qiniu_service import get_qiniu_service
+
+BGM_BASE_DIR = Path("/Users/0fun/work/meijiaka-zy/mixkit_bgm")
+
+
+def parse_title(filename: str) -> str:
+    """从文件名解析标题，如 '105_See_Line_Funk.mp3' -> 'See Line Funk'"""
+    # 去掉扩展名
+    name = filename.rsplit(".", 1)[0]
+    # 去掉开头的编号前缀（如 105_）
+    parts = name.split("_", 1)
+    if len(parts) > 1 and parts[0].isdigit():
+        title_part = parts[1]
+    else:
+        title_part = name
+    # 将下划线替换为空格
+    return title_part.replace("_", " ")
+
+
+def get_duration(filepath: Path) -> float | None:
+    """获取音频文件时长（秒）"""
+    try:
+        audio = MP3(str(filepath))
+        return audio.info.length
+    except Exception as e:
+        print(f"  无法读取时长: {filepath.name} ({e})")
+        return None
+
+
+async def import_bgm():
+    """扫描目录并导入数据库，同时上传七牛云"""
+    if not BGM_BASE_DIR.exists():
+        print(f"错误: BGM 目录不存在: {BGM_BASE_DIR}")
+        return
+
+    categories = [d.name for d in BGM_BASE_DIR.iterdir() if d.is_dir()]
+    print(f"发现分类: {categories}")
+
+    # 初始化七牛云服务
+    try:
+        qiniu = get_qiniu_service()
+        print("七牛云服务初始化成功")
+    except ValueError as e:
+        print(f"七牛云配置错误: {e}")
+        return
+
+    async with AsyncSessionLocal() as session:
+        # 清空现有数据（可选）
+        result = await session.execute(select(BgmMusic))
+        existing = result.scalars().all()
+        if existing:
+            print(f"数据库中已有 {len(existing)} 条 BGM 记录，将删除后重新导入")
+            for row in existing:
+                await session.delete(row)
+            await session.commit()
+
+        total = 0
+        upload_ok = 0
+        upload_fail = 0
+        for category in sorted(categories):
+            cat_dir = BGM_BASE_DIR / category
+            files = sorted([f for f in cat_dir.iterdir() if f.suffix.lower() in (".mp3", ".wav", ".m4a")])
+            print(f"\n分类 [{category}]: {len(files)} 首")
+
+            for idx, filepath in enumerate(files):
+                title = parse_title(filepath.name)
+                relative_path = f"{category}/{filepath.name}"
+                duration = get_duration(filepath)
+
+                # 上传七牛云
+                qiniu_key = f"meijiaka-zy/bgm/{relative_path}"
+                url = None
+                try:
+                    upload_result = qiniu.upload_file(
+                        local_path=str(filepath),
+                        key=qiniu_key,
+                        file_type="audio",
+                        check_duplicate=True,
+                    )
+                    url = upload_result.get("url")
+                    if upload_result.get("isDuplicate"):
+                        print(f"  + {title} (复用已有文件)")
+                    else:
+                        print(f"  + {title} (上传成功)")
+                    upload_ok += 1
+                except Exception as e:
+                    print(f"  ! {title} (上传失败: {e})")
+                    upload_fail += 1
+                    # 上传失败也继续入库，只是 url 为空
+
+                bgm = BgmMusic(
+                    title=title,
+                    artist=None,
+                    category=category,
+                    file_path=relative_path,
+                    url=url,
+                    duration=duration,
+                    status="active",
+                    sort_order=idx,
+                )
+                session.add(bgm)
+                total += 1
+
+        await session.commit()
+        print(f"\n导入完成，共 {total} 首")
+        print(f"  上传成功: {upload_ok} 首")
+        print(f"  上传失败: {upload_fail} 首")
+
+
+if __name__ == "__main__":
+    asyncio.run(import_bgm())

python-api/scripts/publish_release.py

@@ -24,6 +24,9 @@ import sys
 from pathlib import Path
 
 import httpx
+from dotenv import load_dotenv
+
+load_dotenv()
 
 
 def find_packages(bundle_dir: Path) -> list[dict]:
@@ -37,21 +40,30 @@ def find_packages(bundle_dir: Path) -> list[dict]:
             print(f"警告: 签名文件存在但安装包缺失: {pkg_file}")
             continue
 
-        # 解析文件名：{name}_{version}_{target}_{arch}.app.tar.gz
-        parts = pkg_file.stem.split("_")
-        # 最后一个部分可能是 arch，需要处理
-        arch = "aarch64" if "aarch64" in pkg_file.name or "arm64" in pkg_file.name else "x86_64"
-
         signature = sig_file.read_text().strip()
+        file_size = pkg_file.stat().st_size
+        filename = pkg_file.name
 
-        packages.append({
-            "platform": "darwin",
-            "architecture": arch,
-            "filename": pkg_file.name,
-            "local_path": str(pkg_file),
-            "signature": signature,
-            "file_size": pkg_file.stat().st_size,
-        })
+        # 判断文件名是否包含架构标识
+        has_arch_marker = any(marker in filename for marker in ["aarch64", "arm64", "x86_64"])
+
+        if has_arch_marker:
+            # 文件名含架构标识，按标识解析
+            arch = "aarch64" if "aarch64" in filename or "arm64" in filename else "x86_64"
+            archs = [arch]
+        else:
+            # Universal Binary：同时支持 x86_64 和 aarch64
+            archs = ["x86_64", "aarch64"]
+
+        for arch in archs:
+            packages.append({
+                "platform": "darwin",
+                "architecture": arch,
+                "filename": filename,
+                "local_path": str(pkg_file),
+                "signature": signature,
+                "file_size": file_size,
+            })
 
     # Windows: .exe + .exe.sig
     for sig_file in bundle_dir.rglob("*.exe.sig"):
@@ -165,16 +177,21 @@ def main():
         print(f"  - {p['platform']}-{p['architecture']}: {p['filename']} ({p['file_size'] / 1024 / 1024:.1f} MB)")
 
     # 2. 上传到七牛云（或构造 URL）
+    # 按 local_path 去重，同一个文件只上传一次
+    uploaded = {}  # local_path -> file_url
     for p in packages:
         if args.skip_upload:
             if not args.base_url:
                 print("错误: --skip-upload 时必须提供 --base-url")
                 sys.exit(1)
-            p["file_url"] = f"{args.base_url.rstrip('/')}/{p['filename']}"
+            p["file_url"] = f"{args.base_url.rstrip('/')}/{p['platform']}/{p['filename']}"
         else:
-            key = f"releases/{args.version}/{p['filename']}"
-            print(f"上传 {p['filename']} 到七牛云...")
-            p["file_url"] = upload_to_qiniu(p["local_path"], key)
+            local_path = p["local_path"]
+            if local_path not in uploaded:
+                key = f"meijiaka-zy/releases/{args.version}/{p['platform']}/{p['filename']}"
+                print(f"上传 {p['filename']} ({p['platform']}) 到七牛云...")
+                uploaded[local_path] = upload_to_qiniu(local_path, key)
+            p["file_url"] = uploaded[local_path]
 
         # 删除临时字段
         del p["local_path"]

python-api/scripts/seed_bgm.py

@@ -0,0 +1,71 @@
+#!/usr/bin/env python3
+"""
+BGM 种子数据导入脚本
+==================
+
+用于部署环境初始化 BGM 数据。读取同目录下的 bgm_seed_data.json，
+将 129 首系统背景音乐的元数据（含七牛云 URL）写入数据库。
+
+执行方式（在 API 容器内）:
+    python scripts/seed_bgm.py
+
+环境变量依赖:
+    DATABASE_URL — 同应用配置，容器启动时已注入
+"""
+
+import asyncio
+import json
+import os
+import sys
+from pathlib import Path
+
+project_root = Path(__file__).parent.parent
+sys.path.insert(0, str(project_root))
+
+from dotenv import load_dotenv
+
+load_dotenv()
+
+from sqlalchemy import select, func
+from app.db.session import AsyncSessionLocal
+from app.models.bgm_music import BgmMusic
+
+
+SEED_FILE = Path(__file__).parent / "bgm_seed_data.json"
+
+
+async def seed_bgm():
+    if not SEED_FILE.exists():
+        print(f"错误: 种子数据文件不存在: {SEED_FILE}")
+        return
+
+    with open(SEED_FILE, "r", encoding="utf-8") as f:
+        data = json.load(f)
+
+    async with AsyncSessionLocal() as session:
+        # 检查是否已有数据
+        count = await session.scalar(select(func.count(BgmMusic.id)))
+        if count and count > 0:
+            print(f"数据库中已有 {count} 条 BGM 记录，跳过导入")
+            print("如需强制重新导入，请先清空 mjk_bgm_musics 表")
+            return
+
+        for idx, item in enumerate(data):
+            bgm = BgmMusic(
+                title=item["title"],
+                artist=item.get("artist"),
+                category=item["category"],
+                file_path=item["file_path"],
+                url=item["url"],
+                duration=item.get("duration"),
+                status=item.get("status", "active"),
+                sort_order=item.get("sort_order", idx),
+            )
+            session.add(bgm)
+
+        await session.commit()
+        print(f"种子数据导入完成，共 {len(data)} 首")
+
+
+if __name__ == "__main__":
+    asyncio.run(seed_bgm())

python-api/uv.lock

@@ -944,7 +944,7 @@ wheels = [
 
 [[package]]
 name = "meijiaka-ai-api"
-version = "1.5.18"
+version = "1.6.4"
 source = { virtual = "." }
 dependencies = [
     { name = "aiohttp" },
@@ -957,6 +957,7 @@ dependencies = [
     { name = "openai" },
     { name = "orjson" },
     { name = "passlib", extra = ["bcrypt"] },
+    { name = "pillow" },
     { name = "psycopg2-binary" },
     { name = "pydantic" },
     { name = "pydantic-settings" },
@@ -999,6 +1000,7 @@ requires-dist = [
     { name = "openai", specifier = "~=1.58.0" },
     { name = "orjson", specifier = ">=3.11.0" },
     { name = "passlib", extras = ["bcrypt"], specifier = "~=1.7.4" },
+    { name = "pillow", specifier = ">=11.0.0" },
     { name = "pip-audit", marker = "extra == 'dev'", specifier = "~=2.7.0" },
     { name = "pre-commit", marker = "extra == 'dev'", specifier = "~=4.0.0" },
     { name = "psycopg2-binary", specifier = "~=2.9.10" },
@@ -1280,6 +1282,64 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/ef/3c/2c197d226f9ea224a9ab8d197933f9da0ae0aac5b6e0f884e2b8d9c8e9f7/pathspec-1.0.4-py3-none-any.whl", hash = "sha256:fb6ae2fd4e7c921a165808a552060e722767cfa526f99ca5156ed2ce45a5c723", size = 55206, upload-time = "2026-01-27T03:59:45.137Z" },
 ]
 
+[[package]]
+name = "pillow"
+version = "12.2.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/8c/21/c2bcdd5906101a30244eaffc1b6e6ce71a31bd0742a01eb89e660ebfac2d/pillow-12.2.0.tar.gz", hash = "sha256:a830b1a40919539d07806aa58e1b114df53ddd43213d9c8b75847eee6c0182b5", size = 46987819, upload-time = "2026-04-01T14:46:17.687Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/4a/01/53d10cf0dbad820a8db274d259a37ba50b88b24768ddccec07355382d5ad/pillow-12.2.0-cp313-cp313-ios_13_0_arm64_iphoneos.whl", hash = "sha256:8297651f5b5679c19968abefd6bb84d95fe30ef712eb1b2d9b2d31ca61267f4c", size = 4100837, upload-time = "2026-04-01T14:43:41.506Z" },
+    { url = "https://files.pythonhosted.org/packages/0f/98/f3a6657ecb698c937f6c76ee564882945f29b79bad496abcba0e84659ec5/pillow-12.2.0-cp313-cp313-ios_13_0_arm64_iphonesimulator.whl", hash = "sha256:50d8520da2a6ce0af445fa6d648c4273c3eeefbc32d7ce049f22e8b5c3daecc2", size = 4176528, upload-time = "2026-04-01T14:43:43.773Z" },
+    { url = "https://files.pythonhosted.org/packages/69/bc/8986948f05e3ea490b8442ea1c1d4d990b24a7e43d8a51b2c7d8b1dced36/pillow-12.2.0-cp313-cp313-ios_13_0_x86_64_iphonesimulator.whl", hash = "sha256:766cef22385fa1091258ad7e6216792b156dc16d8d3fa607e7545b2b72061f1c", size = 3640401, upload-time = "2026-04-01T14:43:45.87Z" },
+    { url = "https://files.pythonhosted.org/packages/34/46/6c717baadcd62bc8ed51d238d521ab651eaa74838291bda1f86fe1f864c9/pillow-12.2.0-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:5d2fd0fa6b5d9d1de415060363433f28da8b1526c1c129020435e186794b3795", size = 5308094, upload-time = "2026-04-01T14:43:48.438Z" },
+    { url = "https://files.pythonhosted.org/packages/71/43/905a14a8b17fdb1ccb58d282454490662d2cb89a6bfec26af6d3520da5ec/pillow-12.2.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:56b25336f502b6ed02e889f4ece894a72612fe885889a6e8c4c80239ff6e5f5f", size = 4695402, upload-time = "2026-04-01T14:43:51.292Z" },
+    { url = "https://files.pythonhosted.org/packages/73/dd/42107efcb777b16fa0393317eac58f5b5cf30e8392e266e76e51cff28c3d/pillow-12.2.0-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:f1c943e96e85df3d3478f7b691f229887e143f81fedab9b20205349ab04d73ed", size = 6280005, upload-time = "2026-04-01T14:43:54.242Z" },
+    { url = "https://files.pythonhosted.org/packages/a8/68/b93e09e5e8549019e61acf49f65b1a8530765a7f812c77a7461bca7e4494/pillow-12.2.0-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:03f6fab9219220f041c74aeaa2939ff0062bd5c364ba9ce037197f4c6d498cd9", size = 8090669, upload-time = "2026-04-01T14:43:57.335Z" },
+    { url = "https://files.pythonhosted.org/packages/4b/6e/3ccb54ce8ec4ddd1accd2d89004308b7b0b21c4ac3d20fa70af4760a4330/pillow-12.2.0-cp313-cp313-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:5cdfebd752ec52bf5bb4e35d9c64b40826bc5b40a13df7c3cda20a2c03a0f5ed", size = 6395194, upload-time = "2026-04-01T14:43:59.864Z" },
+    { url = "https://files.pythonhosted.org/packages/67/ee/21d4e8536afd1a328f01b359b4d3997b291ffd35a237c877b331c1c3b71c/pillow-12.2.0-cp313-cp313-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:eedf4b74eda2b5a4b2b2fb4c006d6295df3bf29e459e198c90ea48e130dc75c3", size = 7082423, upload-time = "2026-04-01T14:44:02.74Z" },
+    { url = "https://files.pythonhosted.org/packages/78/5f/e9f86ab0146464e8c133fe85df987ed9e77e08b29d8d35f9f9f4d6f917ba/pillow-12.2.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:00a2865911330191c0b818c59103b58a5e697cae67042366970a6b6f1b20b7f9", size = 6505667, upload-time = "2026-04-01T14:44:05.381Z" },
+    { url = "https://files.pythonhosted.org/packages/ed/1e/409007f56a2fdce61584fd3acbc2bbc259857d555196cedcadc68c015c82/pillow-12.2.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:1e1757442ed87f4912397c6d35a0db6a7b52592156014706f17658ff58bbf795", size = 7208580, upload-time = "2026-04-01T14:44:08.39Z" },
+    { url = "https://files.pythonhosted.org/packages/23/c4/7349421080b12fb35414607b8871e9534546c128a11965fd4a7002ccfbee/pillow-12.2.0-cp313-cp313-win32.whl", hash = "sha256:144748b3af2d1b358d41286056d0003f47cb339b8c43a9ea42f5fea4d8c66b6e", size = 6375896, upload-time = "2026-04-01T14:44:11.197Z" },
+    { url = "https://files.pythonhosted.org/packages/3f/82/8a3739a5e470b3c6cbb1d21d315800d8e16bff503d1f16b03a4ec3212786/pillow-12.2.0-cp313-cp313-win_amd64.whl", hash = "sha256:390ede346628ccc626e5730107cde16c42d3836b89662a115a921f28440e6a3b", size = 7081266, upload-time = "2026-04-01T14:44:13.947Z" },
+    { url = "https://files.pythonhosted.org/packages/c3/25/f968f618a062574294592f668218f8af564830ccebdd1fa6200f598e65c5/pillow-12.2.0-cp313-cp313-win_arm64.whl", hash = "sha256:8023abc91fba39036dbce14a7d6535632f99c0b857807cbbbf21ecc9f4717f06", size = 2463508, upload-time = "2026-04-01T14:44:16.312Z" },
+    { url = "https://files.pythonhosted.org/packages/4d/a4/b342930964e3cb4dce5038ae34b0eab4653334995336cd486c5a8c25a00c/pillow-12.2.0-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:042db20a421b9bafecc4b84a8b6e444686bd9d836c7fd24542db3e7df7baad9b", size = 5309927, upload-time = "2026-04-01T14:44:18.89Z" },
+    { url = "https://files.pythonhosted.org/packages/9f/de/23198e0a65a9cf06123f5435a5d95cea62a635697f8f03d134d3f3a96151/pillow-12.2.0-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:dd025009355c926a84a612fecf58bb315a3f6814b17ead51a8e48d3823d9087f", size = 4698624, upload-time = "2026-04-01T14:44:21.115Z" },
+    { url = "https://files.pythonhosted.org/packages/01/a6/1265e977f17d93ea37aa28aa81bad4fa597933879fac2520d24e021c8da3/pillow-12.2.0-cp313-cp313t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:88ddbc66737e277852913bd1e07c150cc7bb124539f94c4e2df5344494e0a612", size = 6321252, upload-time = "2026-04-01T14:44:23.663Z" },
+    { url = "https://files.pythonhosted.org/packages/3c/83/5982eb4a285967baa70340320be9f88e57665a387e3a53a7f0db8231a0cd/pillow-12.2.0-cp313-cp313t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:d362d1878f00c142b7e1a16e6e5e780f02be8195123f164edf7eddd911eefe7c", size = 8126550, upload-time = "2026-04-01T14:44:26.772Z" },
+    { url = "https://files.pythonhosted.org/packages/4e/48/6ffc514adce69f6050d0753b1a18fd920fce8cac87620d5a31231b04bfc5/pillow-12.2.0-cp313-cp313t-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:2c727a6d53cb0018aadd8018c2b938376af27914a68a492f59dfcaca650d5eea", size = 6433114, upload-time = "2026-04-01T14:44:29.615Z" },
+    { url = "https://files.pythonhosted.org/packages/36/a3/f9a77144231fb8d40ee27107b4463e205fa4677e2ca2548e14da5cf18dce/pillow-12.2.0-cp313-cp313t-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:efd8c21c98c5cc60653bcb311bef2ce0401642b7ce9d09e03a7da87c878289d4", size = 7115667, upload-time = "2026-04-01T14:44:32.773Z" },
+    { url = "https://files.pythonhosted.org/packages/c1/fc/ac4ee3041e7d5a565e1c4fd72a113f03b6394cc72ab7089d27608f8aaccb/pillow-12.2.0-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:9f08483a632889536b8139663db60f6724bfcb443c96f1b18855860d7d5c0fd4", size = 6538966, upload-time = "2026-04-01T14:44:35.252Z" },
+    { url = "https://files.pythonhosted.org/packages/c0/a8/27fb307055087f3668f6d0a8ccb636e7431d56ed0750e07a60547b1e083e/pillow-12.2.0-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:dac8d77255a37e81a2efcbd1fc05f1c15ee82200e6c240d7e127e25e365c39ea", size = 7238241, upload-time = "2026-04-01T14:44:37.875Z" },
+    { url = "https://files.pythonhosted.org/packages/ad/4b/926ab182c07fccae9fcb120043464e1ff1564775ec8864f21a0ebce6ac25/pillow-12.2.0-cp313-cp313t-win32.whl", hash = "sha256:ee3120ae9dff32f121610bb08e4313be87e03efeadfc6c0d18f89127e24d0c24", size = 6379592, upload-time = "2026-04-01T14:44:40.336Z" },
+    { url = "https://files.pythonhosted.org/packages/c2/c4/f9e476451a098181b30050cc4c9a3556b64c02cf6497ea421ac047e89e4b/pillow-12.2.0-cp313-cp313t-win_amd64.whl", hash = "sha256:325ca0528c6788d2a6c3d40e3568639398137346c3d6e66bb61db96b96511c98", size = 7085542, upload-time = "2026-04-01T14:44:43.251Z" },
+    { url = "https://files.pythonhosted.org/packages/00/a4/285f12aeacbe2d6dc36c407dfbbe9e96d4a80b0fb710a337f6d2ad978c75/pillow-12.2.0-cp313-cp313t-win_arm64.whl", hash = "sha256:2e5a76d03a6c6dcef67edabda7a52494afa4035021a79c8558e14af25313d453", size = 2465765, upload-time = "2026-04-01T14:44:45.996Z" },
+    { url = "https://files.pythonhosted.org/packages/bf/98/4595daa2365416a86cb0d495248a393dfc84e96d62ad080c8546256cb9c0/pillow-12.2.0-cp314-cp314-ios_13_0_arm64_iphoneos.whl", hash = "sha256:3adc9215e8be0448ed6e814966ecf3d9952f0ea40eb14e89a102b87f450660d8", size = 4100848, upload-time = "2026-04-01T14:44:48.48Z" },
+    { url = "https://files.pythonhosted.org/packages/0b/79/40184d464cf89f6663e18dfcf7ca21aae2491fff1a16127681bf1fa9b8cf/pillow-12.2.0-cp314-cp314-ios_13_0_arm64_iphonesimulator.whl", hash = "sha256:6a9adfc6d24b10f89588096364cc726174118c62130c817c2837c60cf08a392b", size = 4176515, upload-time = "2026-04-01T14:44:51.353Z" },
+    { url = "https://files.pythonhosted.org/packages/b0/63/703f86fd4c422a9cf722833670f4f71418fb116b2853ff7da722ea43f184/pillow-12.2.0-cp314-cp314-ios_13_0_x86_64_iphonesimulator.whl", hash = "sha256:6a6e67ea2e6feda684ed370f9a1c52e7a243631c025ba42149a2cc5934dec295", size = 3640159, upload-time = "2026-04-01T14:44:53.588Z" },
+    { url = "https://files.pythonhosted.org/packages/71/e0/fb22f797187d0be2270f83500aab851536101b254bfa1eae10795709d283/pillow-12.2.0-cp314-cp314-macosx_10_15_x86_64.whl", hash = "sha256:2bb4a8d594eacdfc59d9e5ad972aa8afdd48d584ffd5f13a937a664c3e7db0ed", size = 5312185, upload-time = "2026-04-01T14:44:56.039Z" },
+    { url = "https://files.pythonhosted.org/packages/ba/8c/1a9e46228571de18f8e28f16fabdfc20212a5d019f3e3303452b3f0a580d/pillow-12.2.0-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:80b2da48193b2f33ed0c32c38140f9d3186583ce7d516526d462645fd98660ae", size = 4695386, upload-time = "2026-04-01T14:44:58.663Z" },
+    { url = "https://files.pythonhosted.org/packages/70/62/98f6b7f0c88b9addd0e87c217ded307b36be024d4ff8869a812b241d1345/pillow-12.2.0-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:22db17c68434de69d8ecfc2fe821569195c0c373b25cccb9cbdacf2c6e53c601", size = 6280384, upload-time = "2026-04-01T14:45:01.5Z" },
+    { url = "https://files.pythonhosted.org/packages/5e/03/688747d2e91cfbe0e64f316cd2e8005698f76ada3130d0194664174fa5de/pillow-12.2.0-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:7b14cc0106cd9aecda615dd6903840a058b4700fcb817687d0ee4fc8b6e389be", size = 8091599, upload-time = "2026-04-01T14:45:04.5Z" },
+    { url = "https://files.pythonhosted.org/packages/f6/35/577e22b936fcdd66537329b33af0b4ccfefaeabd8aec04b266528cddb33c/pillow-12.2.0-cp314-cp314-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:8cbeb542b2ebc6fcdacabf8aca8c1a97c9b3ad3927d46b8723f9d4f033288a0f", size = 6396021, upload-time = "2026-04-01T14:45:07.117Z" },
+    { url = "https://files.pythonhosted.org/packages/11/8d/d2532ad2a603ca2b93ad9f5135732124e57811d0168155852f37fbce2458/pillow-12.2.0-cp314-cp314-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:4bfd07bc812fbd20395212969e41931001fd59eb55a60658b0e5710872e95286", size = 7083360, upload-time = "2026-04-01T14:45:09.763Z" },
+    { url = "https://files.pythonhosted.org/packages/5e/26/d325f9f56c7e039034897e7380e9cc202b1e368bfd04d4cbe6a441f02885/pillow-12.2.0-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:9aba9a17b623ef750a4d11b742cbafffeb48a869821252b30ee21b5e91392c50", size = 6507628, upload-time = "2026-04-01T14:45:12.378Z" },
+    { url = "https://files.pythonhosted.org/packages/5f/f7/769d5632ffb0988f1c5e7660b3e731e30f7f8ec4318e94d0a5d674eb65a4/pillow-12.2.0-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:deede7c263feb25dba4e82ea23058a235dcc2fe1f6021025dc71f2b618e26104", size = 7209321, upload-time = "2026-04-01T14:45:15.122Z" },
+    { url = "https://files.pythonhosted.org/packages/6a/7a/c253e3c645cd47f1aceea6a8bacdba9991bf45bb7dfe927f7c893e89c93c/pillow-12.2.0-cp314-cp314-win32.whl", hash = "sha256:632ff19b2778e43162304d50da0181ce24ac5bb8180122cbe1bf4673428328c7", size = 6479723, upload-time = "2026-04-01T14:45:17.797Z" },
+    { url = "https://files.pythonhosted.org/packages/cd/8b/601e6566b957ca50e28725cb6c355c59c2c8609751efbecd980db44e0349/pillow-12.2.0-cp314-cp314-win_amd64.whl", hash = "sha256:4e6c62e9d237e9b65fac06857d511e90d8461a32adcc1b9065ea0c0fa3a28150", size = 7217400, upload-time = "2026-04-01T14:45:20.529Z" },
+    { url = "https://files.pythonhosted.org/packages/d6/94/220e46c73065c3e2951bb91c11a1fb636c8c9ad427ac3ce7d7f3359b9b2f/pillow-12.2.0-cp314-cp314-win_arm64.whl", hash = "sha256:b1c1fbd8a5a1af3412a0810d060a78b5136ec0836c8a4ef9aa11807f2a22f4e1", size = 2554835, upload-time = "2026-04-01T14:45:23.162Z" },
+    { url = "https://files.pythonhosted.org/packages/b6/ab/1b426a3974cb0e7da5c29ccff4807871d48110933a57207b5a676cccc155/pillow-12.2.0-cp314-cp314t-macosx_10_15_x86_64.whl", hash = "sha256:57850958fe9c751670e49b2cecf6294acc99e562531f4bd317fa5ddee2068463", size = 5314225, upload-time = "2026-04-01T14:45:25.637Z" },
+    { url = "https://files.pythonhosted.org/packages/19/1e/dce46f371be2438eecfee2a1960ee2a243bbe5e961890146d2dee1ff0f12/pillow-12.2.0-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:d5d38f1411c0ed9f97bcb49b7bd59b6b7c314e0e27420e34d99d844b9ce3b6f3", size = 4698541, upload-time = "2026-04-01T14:45:28.355Z" },
+    { url = "https://files.pythonhosted.org/packages/55/c3/7fbecf70adb3a0c33b77a300dc52e424dc22ad8cdc06557a2e49523b703d/pillow-12.2.0-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:5c0a9f29ca8e79f09de89293f82fc9b0270bb4af1d58bc98f540cc4aedf03166", size = 6322251, upload-time = "2026-04-01T14:45:30.924Z" },
+    { url = "https://files.pythonhosted.org/packages/1c/3c/7fbc17cfb7e4fe0ef1642e0abc17fc6c94c9f7a16be41498e12e2ba60408/pillow-12.2.0-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:1610dd6c61621ae1cf811bef44d77e149ce3f7b95afe66a4512f8c59f25d9ebe", size = 8127807, upload-time = "2026-04-01T14:45:33.908Z" },
+    { url = "https://files.pythonhosted.org/packages/ff/c3/a8ae14d6defd2e448493ff512fae903b1e9bd40b72efb6ec55ce0048c8ce/pillow-12.2.0-cp314-cp314t-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:0a34329707af4f73cf1782a36cd2289c0368880654a2c11f027bcee9052d35dd", size = 6433935, upload-time = "2026-04-01T14:45:36.623Z" },
+    { url = "https://files.pythonhosted.org/packages/6e/32/2880fb3a074847ac159d8f902cb43278a61e85f681661e7419e6596803ed/pillow-12.2.0-cp314-cp314t-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:8e9c4f5b3c546fa3458a29ab22646c1c6c787ea8f5ef51300e5a60300736905e", size = 7116720, upload-time = "2026-04-01T14:45:39.258Z" },
+    { url = "https://files.pythonhosted.org/packages/46/87/495cc9c30e0129501643f24d320076f4cc54f718341df18cc70ec94c44e1/pillow-12.2.0-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:fb043ee2f06b41473269765c2feae53fc2e2fbf96e5e22ca94fb5ad677856f06", size = 6540498, upload-time = "2026-04-01T14:45:41.879Z" },
+    { url = "https://files.pythonhosted.org/packages/18/53/773f5edca692009d883a72211b60fdaf8871cbef075eaa9d577f0a2f989e/pillow-12.2.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:f278f034eb75b4e8a13a54a876cc4a5ab39173d2cdd93a638e1b467fc545ac43", size = 7239413, upload-time = "2026-04-01T14:45:44.705Z" },
+    { url = "https://files.pythonhosted.org/packages/c9/e4/4b64a97d71b2a83158134abbb2f5bd3f8a2ea691361282f010998f339ec7/pillow-12.2.0-cp314-cp314t-win32.whl", hash = "sha256:6bb77b2dcb06b20f9f4b4a8454caa581cd4dd0643a08bacf821216a16d9c8354", size = 6482084, upload-time = "2026-04-01T14:45:47.568Z" },
+    { url = "https://files.pythonhosted.org/packages/ba/13/306d275efd3a3453f72114b7431c877d10b1154014c1ebbedd067770d629/pillow-12.2.0-cp314-cp314t-win_amd64.whl", hash = "sha256:6562ace0d3fb5f20ed7290f1f929cae41b25ae29528f2af1722966a0a02e2aa1", size = 7225152, upload-time = "2026-04-01T14:45:50.032Z" },
+    { url = "https://files.pythonhosted.org/packages/ff/6e/cf826fae916b8658848d7b9f38d88da6396895c676e8086fc0988073aaf8/pillow-12.2.0-cp314-cp314t-win_arm64.whl", hash = "sha256:aa88ccfe4e32d362816319ed727a004423aab09c5cea43c01a4b435643fa34eb", size = 2556579, upload-time = "2026-04-01T14:45:52.529Z" },
+]
+
 [[package]]
 name = "pip"
 version = "26.0.1"

scripts/admin-ops.sql

@@ -108,8 +108,8 @@ END $$;
 
 DO $$
 DECLARE
-    v_mobile       TEXT := '13800138000';     -- ← 修改：目标用户手机号
-    v_gift_points  INT  := 500;                -- ← 修改：赠送积分数量
+    v_mobile       TEXT := '13860199646';     -- ← 修改：目标用户手机号
+    v_gift_points  INT  := 5000;                -- ← 修改：赠送积分数量
     v_gift_days    INT  := 180;                -- ← 修改：有效期（天）
     v_reason       TEXT := '运营活动赠送';       -- ← 修改：赠送原因（写入流水描述）
     v_user_id      UUID;

scripts/generate-rounded-icon.py

@@ -1,14 +1,17 @@
 #!/usr/bin/env python3
-"""生成圆角图标：原图（白底+内容）作为整体，缩放居中，圆角外透明"""
+"""生成圆角图标：原图（透明背景 logo）作为整体，缩放居中，圆角外透明"""
 
 import os
 from PIL import Image, ImageDraw
 
 ICONS_DIR = "/Users/0fun/work/meijiaka-zy/tauri-app/src-tauri/icons"
-SOURCE_PNG = "/tmp/original-source-icon.png"
+SOURCE_PNG = "/Users/0fun/work/meijiaka-zy/tauri-app/public/assets/logo.png"
 
 # macOS Big Sur 圆角比例 ≈ 22.6%
-CORNER_RATIO = 0.226
+CORNER_RATIO_MACOS = 0.226
+
+# Windows 11 风格圆角比例 ≈ 18%（Fluent Design 圆角矩形）
+CORNER_RATIO_WINDOWS = 0.18
 
 # 内容占画布比例（参考腾讯视频 ≈ 80.5%）
 CONTENT_RATIO = 0.805
@@ -43,14 +46,33 @@ def create_rounded_rect_mask(size: int, radius: int) -> Image.Image:
     return mask
 
 
+def prepare_source(source: Image.Image, canvas_size: int = 1024) -> Image.Image:
+    """将源图居中放置在正方形透明画布上，作为后续处理的统一源图"""
+    src_w, src_h = source.size
+    canvas = Image.new("RGBA", (canvas_size, canvas_size), (0, 0, 0, 0))
+
+    # 等比缩放，长边充满画布的 CONTENT_RATIO
+    target_size = int(canvas_size * CONTENT_RATIO)
+    ratio = max(target_size / src_w, target_size / src_h)
+    new_w = int(src_w * ratio)
+    new_h = int(src_h * ratio)
+    resized = source.resize((new_w, new_h), Image.LANCZOS)
+
+    # 居中放置
+    left = (canvas_size - new_w) // 2
+    top = (canvas_size - new_h) // 2
+    canvas.paste(resized, (left, top), resized)
+    return canvas
+
+
 def compose_icon(size: int, source: Image.Image, rounded: bool = True) -> Image.Image:
-    """原图作为整体，缩放至画布 CONTENT_RATIO，居中"""
+    """macOS / Linux 图标：内容占画布 80.5%，大圆角"""
     canvas = Image.new("RGBA", (size, size), (0, 0, 0, 0))
 
     plate_size = int(size * CONTENT_RATIO)
     plate_offset = (size - plate_size) // 2
 
-    # 原图等比缩放，短边充满 plate_size
+    # 源图等比缩放，短边充满 plate_size
     src_w, src_h = source.size
     ratio = max(plate_size / src_w, plate_size / src_h)
     new_w = int(src_w * ratio)
@@ -64,18 +86,20 @@ def compose_icon(size: int, source: Image.Image, rounded: bool = True) -> Image.
 
     if rounded:
         # 圆角蒙版裁剪（macOS / Linux）
-        radius = int(plate_size * CORNER_RATIO)
+        radius = int(plate_size * CORNER_RATIO_MACOS)
         mask = create_rounded_rect_mask(plate_size, radius)
         canvas.paste(img, (plate_offset, plate_offset), mask)
     else:
-        # 正方形填满（Windows 专用）
+        # 正方形填满
         canvas.paste(img, (plate_offset, plate_offset))
     return canvas
 
 
-def compose_icon_windows(size: int, source: Image.Image) -> Image.Image:
-    """Windows 专用：原图填满整个画布 100%，无圆角，无透明边距"""
-    # 原图等比缩放，短边充满画布
+def compose_icon_windows(size: int, source: Image.Image, rounded: bool = True) -> Image.Image:
+    """Windows 图标：原图填满整个画布 100%，支持轻微圆角"""
+    canvas = Image.new("RGBA", (size, size), (0, 0, 0, 0))
+
+    # 源图等比缩放，短边充满画布
     src_w, src_h = source.size
     ratio = max(size / src_w, size / src_h)
     new_w = int(src_w * ratio)
@@ -85,7 +109,17 @@ def compose_icon_windows(size: int, source: Image.Image) -> Image.Image:
     # 居中裁剪到画布尺寸
     left = (new_w - size) // 2
     top = (new_h - size) // 2
-    return resized.crop((left, top, left + size, top + size))
+    img = resized.crop((left, top, left + size, top + size))
+
+    if rounded:
+        # Windows 11 风格轻微圆角
+        radius = max(1, int(size * CORNER_RATIO_WINDOWS))
+        mask = create_rounded_rect_mask(size, radius)
+        canvas.paste(img, (0, 0), mask)
+    else:
+        canvas.paste(img, (0, 0))
+
+    return canvas
 
 
 def generate_icns(source: Image.Image, output_path: str):
@@ -112,17 +146,18 @@ def generate_icns(source: Image.Image, output_path: str):
 
 
 def generate_ico(source: Image.Image, output_path: str):
-    """生成 Windows .ico 文件"""
+    """生成 Windows .ico 文件，包含更多尺寸以支持高 DPI"""
     import struct
     import io
 
-    sizes = [16, 24, 32, 48, 64, 128, 256]
+    # 添加 20x20 和 40x40 以支持 Windows 高 DPI (125%, 150%)
+    sizes = [16, 20, 24, 32, 40, 48, 64, 128, 256]
     png_datas = []
     entries = []
 
     for sz in sizes:
-        # Windows .ico 填满画布，无圆角，无透明边距
-        img = compose_icon_windows(sz, source)
+        # Windows 图标使用轻微圆角
+        img = compose_icon_windows(sz, source, rounded=True)
         buf = io.BytesIO()
         img.save(buf, format="PNG")
         data = buf.getvalue()
@@ -149,18 +184,24 @@ def generate_ico(source: Image.Image, output_path: str):
 
 
 def main():
-    source = Image.open(SOURCE_PNG).convert("RGBA")
-    print(f"源图标尺寸: {source.size}")
+    # 加载原始 logo（透明背景）
+    raw_source = Image.open(SOURCE_PNG).convert("RGBA")
+    print(f"原始 logo 尺寸: {raw_source.size}")
 
+    # 预处理：居中放置在 1024x1024 透明画布上
+    source = prepare_source(raw_source, canvas_size=1024)
+    print(f"预处理后源图尺寸: {source.size}")
+
+    # macOS / Linux PNG 图标（大圆角 + 透明边距）
     for filename, size in PNG_SIZES:
         path = os.path.join(ICONS_DIR, filename)
-        compose_icon(size, source).save(path)
+        compose_icon(size, source, rounded=True).save(path)
         print(f"已生成: {filename} ({size}x{size})")
 
-    # Windows Square Logo 填满画布，无圆角，无透明边距
+    # Windows Square Logo（轻微圆角 + 填满画布）
     for filename, size in SQUARE_SIZES:
         path = os.path.join(ICONS_DIR, filename)
-        compose_icon_windows(size, source).save(path)
+        compose_icon_windows(size, source, rounded=True).save(path)
         print(f"已生成: {filename} ({size}x{size})")
 
     generate_icns(source, os.path.join(ICONS_DIR, "icon.icns"))

tauri-app/AGENTS.md

@@ -9,7 +9,7 @@
 **美家卡智影**（产品名）是一款基于 Tauri v2 + React 19 + TypeScript 的桌面端 AI 视频创作应用。
 
 - **产品标识**: `cn.meijiaka.ai-video`
-- **版本**: `1.5.18`
+- **版本**: `1.6.4`
 - **窗口尺寸**: 1200×800，不可缩放（`resizable: false`）
 - **核心功能**: AI 脚本生成、AI 配音合成、视频生成、压制成片（FFmpeg）、项目本地持久化
 

tauri-app/docs/windows-signing.md

@@ -23,12 +23,12 @@
 ### 2.2 密钥管理
 
 **公钥**
-- 文件: `src-tauri/tauri.key.pub`
+- 文件: `src-tauri/.tauri-signing-key.pub`
 - 已嵌入 `tauri.conf.json` → `plugins.updater.pubkey`
 - **已提交到 Git 仓库**（公钥可以公开）
 
 **私钥**
-- 文件: `tauri.key`（**已删除，未提交到 Git**）
+- 文件: `.tauri-signing-key`（**已加入 .gitignore，未提交到 Git**）
 - 必须保存在安全位置（如 GitLab CI/CD Variables、1Password、公司密码管理器）
 - **切勿泄露或提交到仓库**
 
@@ -48,11 +48,11 @@
 
 ```bash
 cd tauri-app
-npm run tauri signer generate -- --write-keys src-tauri/tauri.key
+npm run tauri signer generate -- --write-keys src-tauri/.tauri-signing-key
 ```
 
 然后：
-1. 将新生成的公钥（`tauri.key.pub` 内容）更新到 `tauri.conf.json`
+1. 将新生成的公钥（`.tauri-signing-key.pub` 内容）更新到 `tauri.conf.json`
 2. 将新生成的私钥保存到 GitLab CI/CD Variables
 3. **旧版本客户端将无法通过自动更新升级**（公钥不匹配），必须重新下载安装包
 
@@ -120,5 +120,5 @@ npm run tauri signer generate -- --write-keys src-tauri/tauri.key
 ## 五、相关文件
 
 - `src-tauri/tauri.conf.json` — updater 公钥配置
-- `src-tauri/tauri.key.pub` — minisign 公钥（已提交）
+- `src-tauri/.tauri-signing-key.pub` — minisign 公钥（已提交）
 - `.gitlab-ci.yml` — CI 构建流程与签名环境变量

tauri-app/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "tauri-app",
-  "version": "1.5.18",
+  "version": "1.6.4",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "tauri-app",
-      "version": "1.5.18",
+      "version": "1.6.4",
       "dependencies": {
         "@microsoft/fetch-event-source": "^2.0.1",
         "@tanstack/react-virtual": "^3.13.23",
@@ -28,7 +28,7 @@
         "zustand": "^5.0.12"
       },
       "devDependencies": {
-        "@tauri-apps/cli": "^2",
+        "@tauri-apps/cli": "^2.11.2",
         "@testing-library/jest-dom": "^6.9.1",
         "@testing-library/react": "^16.3.2",
         "@types/qrcode": "^1.5.6",
@@ -1818,7 +1818,9 @@
       }
     },
     "node_modules/@tauri-apps/cli": {
-      "version": "2.10.0",
+      "version": "2.11.2",
+      "resolved": "https://registry.npmjs.org/@tauri-apps/cli/-/cli-2.11.2.tgz",
+      "integrity": "sha512-bk3HemqvGRoy+5D/dVMUQHKMYLglD0jVnMm/0iGMH6ufZ+p8r14m6BpIixwij3PBvZdvORUp1YifTD8QxVZ1Nw==",
       "dev": true,
       "license": "Apache-2.0 OR MIT",
       "bin": {
@@ -1832,21 +1834,23 @@
         "url": "https://opencollective.com/tauri"
       },
       "optionalDependencies": {
-        "@tauri-apps/cli-darwin-arm64": "2.10.0",
-        "@tauri-apps/cli-darwin-x64": "2.10.0",
-        "@tauri-apps/cli-linux-arm-gnueabihf": "2.10.0",
-        "@tauri-apps/cli-linux-arm64-gnu": "2.10.0",
-        "@tauri-apps/cli-linux-arm64-musl": "2.10.0",
-        "@tauri-apps/cli-linux-riscv64-gnu": "2.10.0",
-        "@tauri-apps/cli-linux-x64-gnu": "2.10.0",
-        "@tauri-apps/cli-linux-x64-musl": "2.10.0",
-        "@tauri-apps/cli-win32-arm64-msvc": "2.10.0",
-        "@tauri-apps/cli-win32-ia32-msvc": "2.10.0",
-        "@tauri-apps/cli-win32-x64-msvc": "2.10.0"
+        "@tauri-apps/cli-darwin-arm64": "2.11.2",
+        "@tauri-apps/cli-darwin-x64": "2.11.2",
+        "@tauri-apps/cli-linux-arm-gnueabihf": "2.11.2",
+        "@tauri-apps/cli-linux-arm64-gnu": "2.11.2",
+        "@tauri-apps/cli-linux-arm64-musl": "2.11.2",
+        "@tauri-apps/cli-linux-riscv64-gnu": "2.11.2",
+        "@tauri-apps/cli-linux-x64-gnu": "2.11.2",
+        "@tauri-apps/cli-linux-x64-musl": "2.11.2",
+        "@tauri-apps/cli-win32-arm64-msvc": "2.11.2",
+        "@tauri-apps/cli-win32-ia32-msvc": "2.11.2",
+        "@tauri-apps/cli-win32-x64-msvc": "2.11.2"
       }
     },
     "node_modules/@tauri-apps/cli-darwin-arm64": {
-      "version": "2.10.0",
+      "version": "2.11.2",
+      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-darwin-arm64/-/cli-darwin-arm64-2.11.2.tgz",
+      "integrity": "sha512-+4UZzLt+eOAEQCwgd+TqKgyUJMrvx+BgdXLLaqJYmPqzP+nE6YZr/hY6CWLYGQb8jFn99jEkmC6uA3tNvamA1w==",
       "cpu": [
         "arm64"
       ],
@@ -1861,9 +1865,9 @@
       }
     },
     "node_modules/@tauri-apps/cli-darwin-x64": {
-      "version": "2.10.0",
-      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-darwin-x64/-/cli-darwin-x64-2.10.0.tgz",
-      "integrity": "sha512-keDmlvJRStzVFjZTd0xYkBONLtgBC9eMTpmXnBXzsHuawV2q9PvDo2x6D5mhuoMVrJ9QWjgaPKBBCFks4dK71Q==",
+      "version": "2.11.2",
+      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-darwin-x64/-/cli-darwin-x64-2.11.2.tgz",
+      "integrity": "sha512-VjYYtZUPqDMLutSfJEyxFE3Bz+DPi7c8wC3imckgvciLDZLq4qwKJxBicg0BXGhXjJsl8vKWgWRFNMPELQ+Xyg==",
       "cpu": [
         "x64"
       ],
@@ -1878,9 +1882,9 @@
       }
     },
     "node_modules/@tauri-apps/cli-linux-arm-gnueabihf": {
-      "version": "2.10.0",
-      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-linux-arm-gnueabihf/-/cli-linux-arm-gnueabihf-2.10.0.tgz",
-      "integrity": "sha512-e5u0VfLZsMAC9iHaOEANumgl6lfnJx0Dtjkd8IJpysZ8jp0tJ6wrIkto2OzQgzcYyRCKgX72aKE0PFgZputA8g==",
+      "version": "2.11.2",
+      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-linux-arm-gnueabihf/-/cli-linux-arm-gnueabihf-2.11.2.tgz",
+      "integrity": "sha512-yMemD6f4i95AQriS8EazyOFzbE34yjnP16i3IOzpHGQvBoy2DjypFMFBq0NtPuITURv/cOGguRtHR5d79/9CSA==",
       "cpu": [
         "arm"
       ],
@@ -1895,13 +1899,16 @@
       }
     },
     "node_modules/@tauri-apps/cli-linux-arm64-gnu": {
-      "version": "2.10.0",
-      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-linux-arm64-gnu/-/cli-linux-arm64-gnu-2.10.0.tgz",
-      "integrity": "sha512-YrYYk2dfmBs5m+OIMCrb+JH/oo+4FtlpcrTCgiFYc7vcs6m3QDd1TTyWu0u01ewsCtK2kOdluhr/zKku+KP7HA==",
+      "version": "2.11.2",
+      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-linux-arm64-gnu/-/cli-linux-arm64-gnu-2.11.2.tgz",
+      "integrity": "sha512-cgI91D2wL8GSgoWwZXDqt+DwnuZCP2/bz03QAE4TrhgAKIsrB4hX26W/H1EONPUUNkqrsgeCD0wU6pcNjV/5kw==",
       "cpu": [
         "arm64"
       ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "Apache-2.0 OR MIT",
       "optional": true,
       "os": [
@@ -1912,13 +1919,16 @@
       }
     },
     "node_modules/@tauri-apps/cli-linux-arm64-musl": {
-      "version": "2.10.0",
-      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-linux-arm64-musl/-/cli-linux-arm64-musl-2.10.0.tgz",
-      "integrity": "sha512-GUoPdVJmrJRIXFfW3Rkt+eGK9ygOdyISACZfC/bCSfOnGt8kNdQIQr5WRH9QUaTVFIwxMlQyV3m+yXYP+xhSVA==",
+      "version": "2.11.2",
+      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-linux-arm64-musl/-/cli-linux-arm64-musl-2.11.2.tgz",
+      "integrity": "sha512-X1rm0BERqAAggtYTESSgXrS3sz4Sb/OiPiz54UqISlXW+GkR3vNIGnsy/lejNmoXGVqri3Q53BCfQiclOIyRPw==",
       "cpu": [
         "arm64"
       ],
       "dev": true,
+      "libc": [
+        "musl"
+      ],
       "license": "Apache-2.0 OR MIT",
       "optional": true,
       "os": [
@@ -1929,13 +1939,16 @@
       }
     },
     "node_modules/@tauri-apps/cli-linux-riscv64-gnu": {
-      "version": "2.10.0",
-      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-linux-riscv64-gnu/-/cli-linux-riscv64-gnu-2.10.0.tgz",
-      "integrity": "sha512-JO7s3TlSxshwsoKNCDkyvsx5gw2QAs/Y2GbR5UE2d5kkU138ATKoPOtxn8G1fFT1aDW4LH0rYAAfBpGkDyJJnw==",
+      "version": "2.11.2",
+      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-linux-riscv64-gnu/-/cli-linux-riscv64-gnu-2.11.2.tgz",
+      "integrity": "sha512-usbMLJbT3KtkOrBMDVeGYNM35aTHXx38SJSzTMSqqjeUIOQ+iVPjb2yAGNAE+KqmBbAx4FOFIyMeKXx2M/JKGQ==",
       "cpu": [
         "riscv64"
       ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "Apache-2.0 OR MIT",
       "optional": true,
       "os": [
@@ -1946,13 +1959,16 @@
       }
     },
     "node_modules/@tauri-apps/cli-linux-x64-gnu": {
-      "version": "2.10.0",
-      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-linux-x64-gnu/-/cli-linux-x64-gnu-2.10.0.tgz",
-      "integrity": "sha512-Uvh4SUUp4A6DVRSMWjelww0GnZI3PlVy7VS+DRF5napKuIehVjGl9XD0uKoCoxwAQBLctvipyEK+pDXpJeoHng==",
+      "version": "2.11.2",
+      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-linux-x64-gnu/-/cli-linux-x64-gnu-2.11.2.tgz",
+      "integrity": "sha512-Ru4gwJKPG0ctVGchRGpRup4Y4lW2SSfFnrbQcyHhCliKy4g8Qz97TrUgCur4CbWyAgKxvGh3SjrkA0LDYzDGiw==",
       "cpu": [
         "x64"
       ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "Apache-2.0 OR MIT",
       "optional": true,
       "os": [
@@ -1963,13 +1979,16 @@
       }
     },
     "node_modules/@tauri-apps/cli-linux-x64-musl": {
-      "version": "2.10.0",
-      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-linux-x64-musl/-/cli-linux-x64-musl-2.10.0.tgz",
-      "integrity": "sha512-AP0KRK6bJuTpQ8kMNWvhIpKUkQJfcPFeba7QshOQZjJ8wOS6emwTN4K5g/d3AbCMo0RRdnZWwu67MlmtJyxC1Q==",
+      "version": "2.11.2",
+      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-linux-x64-musl/-/cli-linux-x64-musl-2.11.2.tgz",
+      "integrity": "sha512-eUm7T6clN1MMmNSRQ9gaWsQdyehQx2Gmn5hht/QUlqZQI/qcP2OJK5dnaxqwFzCr2HdsEo9ydxaqcS1oJzMvUw==",
       "cpu": [
         "x64"
       ],
       "dev": true,
+      "libc": [
+        "musl"
+      ],
       "license": "Apache-2.0 OR MIT",
       "optional": true,
       "os": [
@@ -1980,9 +1999,9 @@
       }
     },
     "node_modules/@tauri-apps/cli-win32-arm64-msvc": {
-      "version": "2.10.0",
-      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-win32-arm64-msvc/-/cli-win32-arm64-msvc-2.10.0.tgz",
-      "integrity": "sha512-97DXVU3dJystrq7W41IX+82JEorLNY+3+ECYxvXWqkq7DBN6FsA08x/EFGE8N/b0LTOui9X2dvpGGoeZKKV08g==",
+      "version": "2.11.2",
+      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-win32-arm64-msvc/-/cli-win32-arm64-msvc-2.11.2.tgz",
+      "integrity": "sha512-HeeZW80jU+gVTOEX4X/hC6NVSAdDVXajwP5fxIZ/3z9WvUC7qrudX2GMTilYq6Dg0e0sk0XgsAJD1hZ5wPBXUA==",
       "cpu": [
         "arm64"
       ],
@@ -1997,9 +2016,9 @@
       }
     },
     "node_modules/@tauri-apps/cli-win32-ia32-msvc": {
-      "version": "2.10.0",
-      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-win32-ia32-msvc/-/cli-win32-ia32-msvc-2.10.0.tgz",
-      "integrity": "sha512-EHyQ1iwrWy1CwMalEm9z2a6L5isQ121pe7FcA2xe4VWMJp+GHSDDGvbTv/OPdkt2Lyr7DAZBpZHM6nvlHXEc4A==",
+      "version": "2.11.2",
+      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-win32-ia32-msvc/-/cli-win32-ia32-msvc-2.11.2.tgz",
+      "integrity": "sha512-YhjQNZcXfbkCLyazSv1nPnJ9iRFE1wm6kc51FDbU10/Dk09io+6PAGMLjkxnX2GdM0qMnDmTjstY8mTDVvtKeA==",
       "cpu": [
         "ia32"
       ],
@@ -2014,9 +2033,9 @@
       }
     },
     "node_modules/@tauri-apps/cli-win32-x64-msvc": {
-      "version": "2.10.0",
-      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-win32-x64-msvc/-/cli-win32-x64-msvc-2.10.0.tgz",
-      "integrity": "sha512-NTpyQxkpzGmU6ceWBTY2xRIEaS0ZLbVx1HE1zTA3TY/pV3+cPoPPOs+7YScr4IMzXMtOw7tLw5LEXo5oIG3qaQ==",
+      "version": "2.11.2",
+      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-win32-x64-msvc/-/cli-win32-x64-msvc-2.11.2.tgz",
+      "integrity": "sha512-d2JchlFIpZevZVReyqhQOekJmb1UH3rhZ5VX6sH3ty9ETE0TKQavpihvoScUXfKKpW6HZC0MrFGRU0ZtD+w3gA==",
       "cpu": [
         "x64"
       ],

tauri-app/package.json

@@ -1,7 +1,7 @@
 {
   "name": "tauri-app",
   "private": true,
-  "version": "1.5.18",
+  "version": "1.6.4",
   "type": "module",
   "scripts": {
     "dev": "vite",
@@ -39,7 +39,7 @@
     "zustand": "^5.0.12"
   },
   "devDependencies": {
-    "@tauri-apps/cli": "^2",
+    "@tauri-apps/cli": "^2.11.2",
     "@testing-library/jest-dom": "^6.9.1",
     "@testing-library/react": "^16.3.2",
     "@types/qrcode": "^1.5.6",

tauri-app/src-tauri/.gitignore

@@ -5,3 +5,6 @@
 # Generated by Tauri
 # will have schema files for capabilities auto-completion
 /gen/schemas
+
+# Sidecar binaries (FFmpeg / ffprobe) — large platform-specific executables
+/binaries/

tauri-app/src-tauri/.tauri-signing-key.pub

@@ -0,0 +1 @@
+dW50cnVzdGVkIGNvbW1lbnQ6IG1pbmlzaWduIHB1YmxpYyBrZXk6IDIwOEVEODY4MTgyRkJFRTMKUldUanZpOFlhTmlPSUJzS0FLL1NMUEgzLzRtNXpsT1FoTXZlS3JLOHJvak5KeThIeDJQRFpJZWgK

tauri-app/src-tauri/Cargo.lock

@@ -4219,12 +4219,13 @@ dependencies = [
 
 [[package]]
 name = "tauri-app"
-version = "1.5.18"
+version = "1.6.4"
 dependencies = [
  "base64 0.22.1",
  "chrono",
  "dirs 5.0.1",
  "fs2",
+ "log",
  "reqwest 0.12.28",
  "serde",
  "serde_json",

tauri-app/src-tauri/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "tauri-app"
-version = "1.5.18"
+version = "1.6.4"
 description = "美家卡智影 - AI 视频创作桌面应用"
 authors = ["美家卡科技"]
 edition = "2021"
@@ -27,6 +27,7 @@ tauri-plugin-updater = "2"
 tauri-plugin-process = "2"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
+log = "0.4"
 dirs = "5"
 # HTTP 客户端: 精简功能
 # 使用 default-tls（默认）+ json，无需额外 features
@@ -43,6 +44,6 @@ thiserror = "1"
 # 文件锁（跨平台）
 fs2 = "0.4"
 # 异步运行时定时器（FFmpeg 超时保护）
-tokio = { version = "1", features = ["time"] }
+tokio = { version = "1", features = ["time", "sync"] }
 tauri-plugin-single-instance = "2"
 

tauri-app/src-tauri/capabilities/default.json

@@ -51,6 +51,8 @@
     },
     "dialog:default",
     "dialog:allow-open",
+    "core:window:allow-show",
+    "core:window:allow-set-focus",
     "updater:default"
   ]
 }

tauri-app/src-tauri/src/commands/cover_avatar.rs

@@ -0,0 +1,123 @@
+//! 封面形象管理 IPC 命令
+
+use crate::ApiResponse;
+use crate::storage::cover_avatar as cover_avatar_storage;
+
+// --------------------- 封面形象库命令 ---------------------
+
+#[derive(serde::Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct CoverAvatarArgs {
+    pub id: String,
+    pub name: String,
+    pub image_url: String,
+    pub local_path: Option<String>,
+    pub created_at: String,
+}
+
+/// 加载封面形象库
+#[tauri::command]
+pub async fn load_cover_avatars() -> ApiResponse<Vec<cover_avatar_storage::CoverAvatar>> {
+    match cover_avatar_storage::load_cover_avatars() {
+        Ok(list) => ApiResponse {
+            code: 200,
+            message: "封面形象库加载成功".to_string(),
+            data: Some(list.avatars),
+        },
+        Err(e) => ApiResponse {
+            code: 500,
+            message: format!("加载封面形象库失败: {}", e),
+            data: Some(vec![]),
+        },
+    }
+}
+
+/// 保存封面形象
+#[tauri::command]
+pub async fn save_cover_avatar(
+    args: CoverAvatarArgs,
+) -> ApiResponse<bool> {
+    let avatar = cover_avatar_storage::CoverAvatar {
+        id: args.id,
+        name: args.name,
+        image_url: args.image_url,
+        local_path: args.local_path,
+        created_at: args.created_at,
+    };
+    match cover_avatar_storage::add_cover_avatar(avatar) {
+        Ok(_) => ApiResponse {
+            code: 200,
+            message: "封面形象保存成功".to_string(),
+            data: Some(true),
+        },
+        Err(e) => ApiResponse {
+            code: 500,
+            message: format!("保存封面形象失败: {}", e),
+            data: Some(false),
+        },
+    }
+}
+
+/// 删除封面形象
+#[tauri::command]
+pub async fn delete_cover_avatar_cmd(
+    id: String,
+) -> ApiResponse<bool> {
+    match cover_avatar_storage::delete_cover_avatar(&id) {
+        Ok(_) => ApiResponse {
+            code: 200,
+            message: "封面形象删除成功".to_string(),
+            data: Some(true),
+        },
+        Err(e) => ApiResponse {
+            code: 500,
+            message: format!("删除封面形象失败: {}", e),
+            data: Some(false),
+        },
+    }
+}
+
+// --------------------- 封面形象图片文件命令 ---------------------
+
+#[derive(serde::Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SaveCoverAvatarImageArgs {
+    pub avatar_id: String,
+    pub image_data: String, // base64 编码
+    pub ext: String,        // 文件扩展名，如 "png"
+}
+
+/// 保存封面形象图片文件（前端传入 base64 编码）
+#[tauri::command]
+pub async fn save_cover_avatar_image(
+    args: SaveCoverAvatarImageArgs,
+) -> ApiResponse<String> {
+    let image_bytes = match base64::Engine::decode(
+        &base64::engine::general_purpose::STANDARD,
+        &args.image_data,
+    ) {
+        Ok(data) => data,
+        Err(e) => return ApiResponse {
+            code: 400,
+            message: format!("Invalid base64 data: {}", e),
+            data: None,
+        },
+    };
+
+    match cover_avatar_storage::save_cover_avatar_image(
+        &args.avatar_id,
+        &image_bytes,
+        &args.ext,
+    ) {
+        Ok(path) => ApiResponse {
+            code: 200,
+            message: "封面形象图片保存成功".to_string(),
+            data: Some(path),
+        },
+        Err(e) => ApiResponse {
+            code: 500,
+            message: format!("保存封面形象图片失败: {}", e),
+            data: None,
+        },
+    }
+}

tauri-app/src-tauri/src/commands/mod.rs

@@ -11,3 +11,4 @@ pub mod project;
 pub mod voice;
 pub mod video_compose;
 pub mod file;
+pub mod cover_avatar;

tauri-app/src-tauri/src/commands/product.rs

@@ -219,8 +219,9 @@ pub async fn delete_local_product(path: String) -> ApiResponse<()> {
             data: None,
         },
     };
+    let app_data_canonical = app_data.canonicalize().unwrap_or_else(|_| app_data.clone());
 
-    if !canonical.starts_with(app_data) {
+    if !canonical.starts_with(&app_data_canonical) {
         return ApiResponse {
             code: 400,
             message: "路径不在允许范围内".to_string(),
@@ -279,8 +280,9 @@ pub async fn rename_local_product(path: String, new_filename: String) -> ApiResp
             data: None,
         },
     };
+    let app_data_canonical = app_data.canonicalize().unwrap_or_else(|_| app_data.clone());
 
-    if !canonical.starts_with(app_data) {
+    if !canonical.starts_with(&app_data_canonical) {
         return ApiResponse {
             code: 400,
             message: "路径不在允许范围内".to_string(),
@@ -359,8 +361,9 @@ pub async fn export_product(source_path: String, target_path: String) -> ApiResp
             data: None,
         },
     };
+    let app_data_canonical = app_data.canonicalize().unwrap_or_else(|_| app_data.clone());
 
-    if !source_canonical.starts_with(app_data) {
+    if !source_canonical.starts_with(&app_data_canonical) {
         return ApiResponse {
             code: 400,
             message: "源文件不在允许范围内".to_string(),

tauri-app/src-tauri/src/commands/video_compose.rs

@@ -174,6 +174,77 @@ pub async fn generate_empty_shot_clip(
     }
 }
 
+/// 混合 BGM 请求参数
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct MixBgmToVideoArgs {
+    pub video_path: String,
+    pub bgm_path: String,
+    pub output_path: String,
+    pub video_volume: Option<f64>,
+    pub bgm_volume: Option<f64>,
+}
+
+/// 混合背景音乐到视频（保留原音频）
+#[tauri::command]
+pub async fn mix_bgm_to_video(
+    app: AppHandle,
+    args: MixBgmToVideoArgs,
+) -> ApiResponse<String> {
+    let safe_output = match sanitize_output_path(&args.output_path) {
+        Ok(p) => p,
+        Err(e) => return ApiResponse { code: 500, message: e, data: None },
+    };
+
+    let video_vol = args.video_volume.unwrap_or(1.0);
+    let bgm_vol = args.bgm_volume.unwrap_or(0.25);
+
+    // 如果输出路径和输入路径相同，使用临时文件避免 FFmpeg 报错
+    let use_temp = args.video_path == safe_output;
+    let temp_output = if use_temp {
+        format!("{}.tmp_bgm.mp4", safe_output)
+    } else {
+        safe_output.clone()
+    };
+
+    match crate::ffmpeg_cmd::mix_bgm_to_video(
+        &app,
+        &args.video_path,
+        &args.bgm_path,
+        &temp_output,
+        video_vol,
+        bgm_vol,
+    ).await {
+        Ok(_) => {
+            if use_temp {
+                // 用混合后的文件替换原文件
+                let _ = std::fs::remove_file(&safe_output);
+                if let Err(e) = std::fs::rename(&temp_output, &safe_output) {
+                    let _ = std::fs::remove_file(&temp_output);
+                    return ApiResponse {
+                        code: 500,
+                        message: format!("替换原文件失败: {}", e),
+                        data: None,
+                    };
+                }
+            }
+            ApiResponse {
+                code: 200,
+                message: "BGM 混合成功".to_string(),
+                data: Some(safe_output),
+            }
+        }
+        Err(e) => {
+            let _ = std::fs::remove_file(&temp_output);
+            ApiResponse {
+                code: 500,
+                message: format!("BGM 混合失败: {}", e),
+                data: None,
+            }
+        }
+    }
+}
+
 /// 截取视频片段请求参数
 #[derive(Debug, Deserialize)]
 #[serde(rename_all = "camelCase")]

tauri-app/src-tauri/src/ffmpeg_cmd.rs

@@ -2,7 +2,21 @@ use tauri_plugin_shell::ShellExt;
 use crate::StringResultExt;
 use tauri_plugin_shell::process::CommandEvent;
 use tauri::{AppHandle, Emitter};
-use serde::Serialize;
+use serde::{Deserialize, Serialize};
+use std::sync::LazyLock;
+use tokio::sync::Semaphore;
+
+/// 预览转码并发锁：保证同时只有一个 FFmpeg 进程在转码，避免 CPU/磁盘争抢
+static PREVIEW_SEMAPHORE: LazyLock<Semaphore> = LazyLock::new(|| Semaphore::new(1));
+
+/// 视频元数据（由 ffprobe 解析）
+#[derive(Debug, Serialize, Deserialize)]
+pub struct VideoMetadata {
+    pub width: u32,
+    pub height: u32,
+    pub duration: f64,
+    pub fps: f64,
+}
 
 #[derive(Serialize, Clone)]
 struct PhaseInfo {
@@ -10,11 +24,42 @@ struct PhaseInfo {
     total: u8,
 }
 
-/// FFmpeg 路径转义（替换 `:` 为 `\:`，替换 `'` 为 `'\''`）
+/// FFmpeg concat 列表文件中的路径转义（单引号用 `'\''` 包裹转义）
 pub fn escape_ffmpeg_path(path: &str) -> String {
+    // 去掉 Windows UNC 前缀（\\?\）
+    let path = if path.starts_with(r"\\?\") {
+        &path[4..]
+    } else {
+        path
+    };
+    // concat 列表中路径被单引号包裹，需要将单引号转义为 '\''
     path.replace("'", "'\\''")
 }
 
+/// FFmpeg filter 字符串中的路径转义（用于单引号包裹的字符串内部）
+fn escape_ffmpeg_filter_path(path: &str) -> String {
+    // 去掉 Windows UNC 前缀（\\?\）
+    let path = if path.starts_with(r"\\?\") {
+        &path[4..]
+    } else {
+        path
+    };
+    // 使用正斜杠，避免反斜杠在 filter 字符串中被当作转义符
+    let path = path.replace('\\', "/");
+    // 单引号内需要将 ' 转义为 \'
+    path.replace("'", "\\'")
+}
+
+/// 去掉 Windows UNC 前缀（\\?\），使 convertFileSrc 能正确生成 asset:// URL
+fn normalize_path(path: &std::path::Path) -> String {
+    let s = path.to_string_lossy().to_string();
+    if s.starts_with(r"\\?\") {
+        std::path::PathBuf::from(&s[4..]).to_string_lossy().to_string()
+    } else {
+        s
+    }
+}
+
 /// 验证路径在允许的目录内，防止路径遍历攻击
 /// 允许的目录：应用数据目录（app_local_data_dir）
 fn validate_safe_path(path: &str) -> Result<String, String> {
@@ -37,8 +82,13 @@ fn validate_safe_path(path: &str) -> Result<String, String> {
     let canonical = abs_path.canonicalize()
         .unwrap_or(abs_path.clone());
 
+    // 同时规范化允许目录（Windows 上 canonicalize 会添加 \\?\ 前缀，
+    // 必须与输入路径保持一致的规范化格式才能正确比较）
+    let allowed_canonical = allowed_dir.canonicalize()
+        .unwrap_or(allowed_dir.clone());
+
     // 检查是否在允许目录下
-    if !canonical.starts_with(allowed_dir) {
+    if !canonical.starts_with(&allowed_canonical) {
         return Err(format!("路径不在允许目录内: {}", path.display()));
     }
 
@@ -73,9 +123,23 @@ pub fn sanitize_output_path(path: &str) -> Result<String, String> {
  * 使用 Tauri 官方 sidecar API，自动处理开发/生产环境的 sidecar 查找。
  */
 pub async fn run_ffmpeg(app: &AppHandle, args: Vec<String>) -> Result<String, String> {
-    let (mut rx, child) = app.shell()
+    run_ffmpeg_in_dir(app, args, None).await
+}
+
+pub async fn run_ffmpeg_in_dir(
+    app: &AppHandle,
+    args: Vec<String>,
+    current_dir: Option<&std::path::Path>,
+) -> Result<String, String> {
+    let cmd = app.shell()
         .sidecar("ffmpeg")
-        .map_err(|e| format!("Failed to find ffmpeg sidecar: {e}"))?
+        .map_err(|e| format!("Failed to find ffmpeg sidecar: {e}"))?;
+    let cmd = if let Some(dir) = current_dir {
+        cmd.current_dir(dir)
+    } else {
+        cmd
+    };
+    let (mut rx, child) = cmd
         .args(args)
         .spawn()
         .map_err(|e| format!("Failed to spawn ffmpeg: {e}"))?;
@@ -91,6 +155,7 @@ pub async fn run_ffmpeg(app: &AppHandle, args: Vec<String>) -> Result<String, St
                 }
                 CommandEvent::Stderr(line) => {
                     let log = String::from_utf8_lossy(&line);
+                    log::debug!("[ffmpeg stderr] {}", log.trim());
                     stderr_output.push_str(&log);
                     stderr_output.push('\n');
 
@@ -105,7 +170,12 @@ pub async fn run_ffmpeg(app: &AppHandle, args: Vec<String>) -> Result<String, St
                 }
                 CommandEvent::Terminated(status) => {
                     match status.code {
-                        Some(0) => return Ok(()),
+                        Some(0) => {
+                            if !stderr_output.is_empty() {
+                                log::debug!("[ffmpeg] stderr:\n{}", stderr_output.trim());
+                            }
+                            return Ok(());
+                        }
                         Some(code) => {
                             let err_detail = if stderr_output.is_empty() {
                                 "(no stderr output)".to_string()
@@ -330,9 +400,61 @@ fn get_fonts_dir(app: &AppHandle) -> Result<std::path::PathBuf, String> {
 /**
  * 压制 ASS 字幕到视频（使用嵌入字体）
  *
- * 使用抖音美好体 (DouyinSansBold) 作为默认字体。
+ * 使用抖音美好体 Bold (DouyinSans Bold) 作为默认字体。
  * 支持可选的 PNG overlay（用于大标题/小标题，效果与前端 Canvas 预览一致）。
  */
+/// 为 FFmpeg 字幕压制准备临时工作目录，将 ASS 文件和字体复制到该目录，
+/// 返回 (临时目录路径, ASS 相对文件名, filter 字符串)
+fn prepare_subtitle_work_dir(
+    safe_ass: &str,
+    app: &AppHandle,
+) -> Result<(std::path::PathBuf, String, String), String> {
+    let ass_path = std::path::Path::new(safe_ass);
+    let ass_file_name = ass_path
+        .file_name()
+        .ok_or("无效的 ASS 文件路径")?
+        .to_string_lossy()
+        .to_string();
+
+    // 创建临时目录（系统临时目录下）
+    let temp_dir = std::env::temp_dir().join(format!(
+        "meijiaka_subtitle_{}",
+        std::time::SystemTime::now()
+            .duration_since(std::time::UNIX_EPOCH)
+            .unwrap_or_default()
+            .as_millis()
+    ));
+    std::fs::create_dir_all(&temp_dir)
+        .map_err(|e| format!("创建临时目录失败: {}", e))?;
+
+    // 复制 ASS 文件到临时目录
+    let temp_ass = temp_dir.join(&ass_file_name);
+    if let Err(e) = std::fs::copy(safe_ass, &temp_ass) {
+        let _ = std::fs::remove_dir_all(&temp_dir);
+        return Err(format!("复制 ASS 文件到临时目录失败: {}", e));
+    }
+
+    // 复制字体文件到临时目录
+    if let Ok(fonts_dir) = get_fonts_dir(app) {
+        if let Ok(entries) = std::fs::read_dir(&fonts_dir) {
+            for entry in entries.flatten() {
+                let path = entry.path();
+                if let Some(ext) = path.extension() {
+                    let ext = ext.to_string_lossy().to_lowercase();
+                    if ext == "ttf" || ext == "otf" || ext == "woff" || ext == "woff2" {
+                        let _ = std::fs::copy(&path, temp_dir.join(path.file_name().unwrap_or_default()));
+                    }
+                }
+            }
+        }
+    }
+
+    // 使用相对路径的 filter 字符串（无 C: 盘符问题）
+    let filter = format!("subtitles='{}'", escape_ffmpeg_filter_path(&ass_file_name));
+
+    Ok((temp_dir, ass_file_name, filter))
+}
+
 pub async fn burn_ass_subtitle(
     app: &AppHandle,
     video_path: &str,
@@ -349,18 +471,8 @@ pub async fn burn_ass_subtitle(
     let safe_ass = validate_safe_path(ass_path)?;
     let safe_output = sanitize_output_path(output_path)?;
 
-    let ass_path_escaped = escape_ffmpeg_path(&safe_ass);
-
-    // 构建 ASS filter（尝试带 fontsdir）
-    let ass_filter = if let Ok(fonts_dir) = get_fonts_dir(app) {
-        if let Some(fonts_dir_str) = fonts_dir.to_str() {
-            format!("ass='{}':fontsdir='{}'", ass_path_escaped, escape_ffmpeg_path(fonts_dir_str))
-        } else {
-            format!("ass='{}'", ass_path_escaped)
-        }
-    } else {
-        format!("ass='{}'", ass_path_escaped)
-    };
+    // 准备临时工作目录（ASS + 字体），使用相对路径避开 Windows C: 盘符问题
+    let (work_dir, _ass_name, subtitle_filter) = prepare_subtitle_work_dir(&safe_ass, app)?;
 
     // 如果有 overlay 图片，先 overlay 再 burn 字幕（两步避免 filter_complex 音频映射问题）
     if let Some(img_path) = overlay_image {
@@ -376,6 +488,7 @@ pub async fn burn_ass_subtitle(
             "-c:v".to_string(), "libx264".to_string(),
             "-preset".to_string(), "veryfast".to_string(),
             "-crf".to_string(), "18".to_string(),
+            "-pix_fmt".to_string(), "yuv420p".to_string(),
             "-c:a".to_string(), "copy".to_string(),
             "-y".to_string(),
             temp_output.clone(),
@@ -383,6 +496,7 @@ pub async fn burn_ass_subtitle(
 
         let _ = app.emit("ffmpeg-phase-start", PhaseInfo { step: 1, total: 2 });
         if let Err(e) = run_ffmpeg(app, overlay_args).await {
+            let _ = std::fs::remove_dir_all(&work_dir);
             let _ = std::fs::remove_file(&temp_output);
             return Err(format!("Overlay 图片失败: {}", e));
         }
@@ -390,97 +504,88 @@ pub async fn burn_ass_subtitle(
         // Step 2: burn ASS 字幕
         let burn_args = vec![
             "-i".to_string(), temp_output.clone(),
-            "-vf".to_string(), ass_filter.clone(),
+            "-vf".to_string(), subtitle_filter.clone(),
             "-c:v".to_string(), "libx264".to_string(),
             "-preset".to_string(), "medium".to_string(),
             "-crf".to_string(), "23".to_string(),
+            "-pix_fmt".to_string(), "yuv420p".to_string(),
             "-c:a".to_string(), "copy".to_string(),
             "-y".to_string(),
             safe_output.clone(),
         ];
 
         let _ = app.emit("ffmpeg-phase-start", PhaseInfo { step: 2, total: 2 });
-        let result = run_ffmpeg(app, burn_args).await;
+        let result = run_ffmpeg_in_dir(app, burn_args, Some(&work_dir)).await;
+        let _ = std::fs::remove_dir_all(&work_dir);
         let _ = std::fs::remove_file(&temp_output);
         return result.map(|_| ());
     }
 
-    // 无 overlay，走原有单步逻辑（带 fontsdir 回退）
-    let filter = ass_filter.clone();
+    // 无 overlay，单步 burn 字幕
     let _ = app.emit("ffmpeg-phase-start", PhaseInfo { step: 1, total: 1 });
 
-    let args = vec![
-        "-i".to_string(), safe_video.clone(),
-        "-vf".to_string(), filter,
-        "-c:v".to_string(), "libx264".to_string(),
-        "-preset".to_string(), "medium".to_string(),
-        "-crf".to_string(), "23".to_string(),
-        "-c:a".to_string(), "copy".to_string(),
-        "-y".to_string(),
-        safe_output.clone(),
-    ];
-
-    match run_ffmpeg(app, args).await {
-        Ok(_) => return Ok(()),
-        Err(e) => {
-            eprintln!("[ffmpeg] 带 fontsdir 的 ASS 烧录失败，尝试回退: {}", e);
-        }
-    }
-
-    // 回退：不带 fontsdir
-    let filter = format!("ass='{}'", ass_path_escaped);
-
     let args = vec![
         "-i".to_string(), safe_video,
-        "-vf".to_string(), filter,
+        "-vf".to_string(), subtitle_filter,
         "-c:v".to_string(), "libx264".to_string(),
         "-preset".to_string(), "medium".to_string(),
         "-crf".to_string(), "23".to_string(),
+        "-pix_fmt".to_string(), "yuv420p".to_string(),
         "-c:a".to_string(), "copy".to_string(),
         "-y".to_string(),
         safe_output,
     ];
 
-    run_ffmpeg(app, args).await.map(|_| ())
+    let result = run_ffmpeg_in_dir(app, args, Some(&work_dir)).await;
+    let _ = std::fs::remove_dir_all(&work_dir);
+    result.map(|_| ())
 }
 
-/** 压制 ASS 字幕到视频（带自定义字体目录）
- * 当前未使用，保留为扩展点。
+
+
+/**
+ * 混合背景音乐到视频（保留原视频音频）
+ *
+ * 使用 FFmpeg amix 滤镜将 BGM 与原视频音频混合。
+ * 如果 BGM 短于视频，会自动循环；如果长于视频，会截断到视频长度。
+ *
+ * BGM 路径必须是本地文件（由前端下载到 bgm_cache 后传入）。
  */
-#[allow(dead_code)]
-pub async fn burn_ass_subtitle_with_fonts(
+pub async fn mix_bgm_to_video(
     app: &AppHandle,
     video_path: &str,
-    ass_path: &str,
-    fonts_dir: &str,
+    bgm_path: &str,
     output_path: &str,
+    video_volume: f64,
+    bgm_volume: f64,
 ) -> Result<(), String> {
-    // 输入路径验证：HTTP URL 直接传递，本地文件需要安全检查
-    let safe_video = if video_path.starts_with("http://") || video_path.starts_with("https://") {
-        video_path.to_string()
-    } else {
-        validate_safe_path(video_path)?
-    };
-    let safe_ass = validate_safe_path(ass_path)?;
+    let safe_video = validate_safe_path(video_path)?;
+    let safe_bgm = validate_safe_path(bgm_path)?;
     let safe_output = sanitize_output_path(output_path)?;
-    
-    let filter = format!(
-        "ass='{}':fontsdir='{}'",
-        escape_ffmpeg_path(&safe_ass),
-        escape_ffmpeg_path(fonts_dir)
+
+    // 构建 filter_complex:
+    // [0:a]volume=1.0[a0];                — 原视频音频调整音量
+    // [1:a]volume=0.25,aloop=loop=-1:size=2e+09[bgm]; — BGM 调整音量后无限循环
+    // [a0][bgm]amix=inputs=2:duration=first:dropout_transition=2[aout] — 混合，以第一个输入时长为准
+    let filter_complex = format!(
+        "[0:a]volume={:.2}[a0];[1:a]volume={:.2},aloop=loop=-1:size=2e+09[bgm];[a0][bgm]amix=inputs=2:duration=first:dropout_transition=2[aout]",
+        video_volume, bgm_volume
     );
-    
+
     let args = vec![
         "-i".to_string(), safe_video,
-        "-vf".to_string(), filter,
-        "-c:v".to_string(), "libx264".to_string(),
-        "-preset".to_string(), "medium".to_string(),
-        "-crf".to_string(), "23".to_string(),
-        "-c:a".to_string(), "copy".to_string(),
+        "-i".to_string(), safe_bgm,
+        "-filter_complex".to_string(), filter_complex,
+        "-map".to_string(), "0:v:0".to_string(),
+        "-map".to_string(), "[aout]".to_string(),
+        "-c:v".to_string(), "copy".to_string(),
+        "-c:a".to_string(), "aac".to_string(),
+        "-b:a".to_string(), "192k".to_string(),
+        "-ar".to_string(), "44100".to_string(),
+        "-ac".to_string(), "2".to_string(),
         "-y".to_string(),
-        safe_output
+        safe_output,
     ];
-    
     run_ffmpeg(app, args).await.map(|_| ())
 }
 
@@ -519,6 +624,117 @@ pub async fn replace_audio_track(
     run_ffmpeg(app, args).await.map(|_| ())
 }
 
+/**
+ * 通过 ffprobe 获取视频元数据（分辨率、时长、帧率）
+ *
+ * 跨平台可靠，不依赖浏览器视频解码器。
+ */
+pub async fn get_video_metadata(app: &AppHandle, input_path: &str) -> Result<VideoMetadata, String> {
+    // URL 直接传递；本地文件只检查是否存在（用户通过系统文件选择器选取，已获授权）
+    let safe_input = if input_path.starts_with("http://") || input_path.starts_with("https://") {
+        input_path.to_string()
+    } else if std::path::Path::new(input_path).exists() {
+        input_path.to_string()
+    } else {
+        return Err(format!("输入文件不存在: {}", input_path));
+    };
+
+    let args = vec![
+        "-v".to_string(), "error".to_string(),
+        "-select_streams".to_string(), "v:0".to_string(),
+        "-show_entries".to_string(), "stream=width,height,duration,r_frame_rate:format=duration".to_string(),
+        "-of".to_string(), "json".to_string(),
+        safe_input,
+    ];
+
+    let (mut rx, child) = app.shell()
+        .sidecar("ffprobe")
+        .map_err(|e| format!("Failed to find ffprobe sidecar: {e}"))?
+        .args(args)
+        .spawn()
+        .map_err(|e| format!("Failed to spawn ffprobe: {e}"))?;
+
+    let mut stdout = String::new();
+    let mut stderr = String::new();
+
+    let probe_future = async {
+        while let Some(event) = rx.recv().await {
+            match event {
+                CommandEvent::Stdout(line) => {
+                    stdout.push_str(&String::from_utf8_lossy(&line));
+                }
+                CommandEvent::Stderr(line) => {
+                    stderr.push_str(&String::from_utf8_lossy(&line));
+                }
+                CommandEvent::Terminated(status) => {
+                    match status.code {
+                        Some(0) => return Ok(()),
+                        Some(code) => {
+                            return Err(format!("ffprobe exited with status {}. stderr: {}", code, stderr.trim()));
+                        }
+                        None => return Err("ffprobe terminated by signal".to_string()),
+                    }
+                }
+                _ => {}
+            }
+        }
+        Ok(())
+    };
+
+    match tokio::time::timeout(std::time::Duration::from_secs(30), probe_future).await {
+        Ok(Ok(())) => {}
+        Ok(Err(e)) => return Err(e),
+        Err(_) => {
+            let _ = child.kill();
+            return Err("ffprobe 执行超时（超过30秒），已强制终止".to_string());
+        }
+    }
+
+    // 解析 JSON 输出
+    let parsed: serde_json::Value = serde_json::from_str(&stdout)
+        .map_err(|e| format!("ffprobe JSON 解析失败: {}. raw: {}", e, &stdout))?;
+
+    let stream = parsed.get("streams")
+        .and_then(|s| s.as_array())
+        .and_then(|arr| arr.first())
+        .ok_or_else(|| format!("ffprobe 未返回视频流信息: {}", &stdout))?;
+
+    let width = stream.get("width")
+        .and_then(|v| v.as_u64())
+        .ok_or_else(|| "无法解析视频宽度".to_string())? as u32;
+
+    let height = stream.get("height")
+        .and_then(|v| v.as_u64())
+        .ok_or_else(|| "无法解析视频高度".to_string())? as u32;
+
+    // duration 可能是字符串或数字；某些格式（如 MPEG-TS）stream duration 为 N/A，需从 format 回退
+    let stream_duration = stream.get("duration")
+        .and_then(|v| v.as_f64().or_else(|| v.as_str().and_then(|s| s.parse().ok())));
+
+    let format_duration = parsed.get("format")
+        .and_then(|f| f.get("duration"))
+        .and_then(|v| v.as_f64().or_else(|| v.as_str().and_then(|s| s.parse().ok())));
+
+    let duration = stream_duration.or(format_duration).unwrap_or(0.0);
+
+    // 帧率格式为 "25/1" 或 "30000/1001"
+    let fps = stream.get("r_frame_rate")
+        .and_then(|v| v.as_str())
+        .and_then(|s| {
+            let parts: Vec<&str> = s.split('/').collect();
+            if parts.len() == 2 {
+                let num: f64 = parts[0].parse().ok()?;
+                let den: f64 = parts[1].parse().ok()?;
+                if den != 0.0 { Some(num / den) } else { None }
+            } else {
+                s.parse().ok()
+            }
+        })
+        .unwrap_or(0.0);
+
+    Ok(VideoMetadata { width, height, duration, fps })
+}
+
 
 /**
  * 裁剪视频片段（支持本地文件和 HTTP URL）
@@ -603,3 +819,284 @@ pub async fn extract_audio_segment(
 }
 
 
+
+/**
+ * 解析 ffprobe 返回的帧率字符串（如 "30000/1001" 或 "30/1"）
+ */
+fn parse_frame_rate(s: &str) -> f64 {
+    if s.is_empty() {
+        return 0.0;
+    }
+    if let Some(idx) = s.find('/') {
+        let num: f64 = s[..idx].parse().unwrap_or(0.0);
+        let den: f64 = s[idx + 1..].parse().unwrap_or(1.0);
+        if den > 0.0 {
+            return num / den;
+        }
+    }
+    s.parse().unwrap_or(0.0)
+}
+
+/**
+ * 为预览转码视频（统一为浏览器兼容格式）
+ *
+ * 快速通过检测：只有满足全部兼容性条件的视频才直接返回原路径，
+ * 任一不满足则强制转码为 H.264 Baseline + YUV420p 540p 代理。
+ *
+ * 检测项（基于主流浏览器/WebView 兼容性最佳实践）：
+ * - codec: H.264
+ * - pix_fmt: YUV420p
+ * - profile: Baseline / Constrained Baseline / Main
+ * - level: <= 4.1
+ * - color_range: limited (tv) — macOS VideoToolbox 对 full range 支持不完整
+ * - has_b_frames: 0 — macOS WKWebView 对 B-frames 支持不完整
+ * - refs: <= 4 — 参考帧数过多可能导致解码失败
+ * - r_frame_rate: <= 60fps — 高帧率可能异常
+ * - width/height: <= 1920x1920
+ *
+ * 转码参数参考 Mux/Transloadit 主流推荐，针对预览场景优化：
+ * - preset ultrafast: 编码速度优先（预览不追求极致压缩率）
+ * - crf 28: 预览画质够用
+ * - g 30 / keyint_min 30: 每秒一个关键帧，seek 更精确
+ * - 保留音频（人物形象视频有配音）
+ * - +faststart: moov atom 前置，快速开始播放
+ *
+ * 并发控制：tokio Semaphore(1)，保证同时只有一个 FFmpeg 进程在跑，
+ * 避免多视频同时预览时 CPU/磁盘争抢。
+ *
+ * 转码结果按（文件路径 + 大小 + 修改时间）缓存，避免重复处理。
+ */
+pub async fn transcode_for_preview(app: &AppHandle, input_path: &str) -> Result<String, String> {
+    // 网络视频：先下载到本地缓存，再统一走转码/预览流程
+    let path_str = if input_path.starts_with("http://") || input_path.starts_with("https://") {
+        let app_data_dir = crate::storage::paths::get_app_data_dir()
+            .map_err(|e| format!("无法获取应用数据目录: {}", e))?;
+        let cache_dir = app_data_dir.join("video_cache");
+        std::fs::create_dir_all(&cache_dir)
+            .map_err(|e| format!("无法创建缓存目录: {}", e))?;
+
+        let url_hash = {
+            use std::collections::hash_map::DefaultHasher;
+            use std::hash::{Hash, Hasher};
+            let mut hasher = DefaultHasher::new();
+            input_path.hash(&mut hasher);
+            format!("{:016x}", hasher.finish())
+        };
+
+        let download_path = cache_dir.join(format!("download_{}.mp4", url_hash));
+
+        if !download_path.exists() {
+            log::info!("[transcode_for_preview] 下载网络视频: {} -> {}", input_path, download_path.display());
+            let client = reqwest::Client::builder()
+                .timeout(std::time::Duration::from_secs(60))
+                .build()
+                .map_err(|e| format!("创建 HTTP 客户端失败: {}", e))?;
+            let response = client.get(input_path)
+                .header("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64)")
+                .send()
+                .await
+                .map_err(|e| format!("下载网络视频失败: {}", e))?
+                .error_for_status()
+                .map_err(|e| format!("下载网络视频返回错误: {}", e))?;
+            let bytes = response.bytes()
+                .await
+                .map_err(|e| format!("读取网络视频数据失败: {}", e))?;
+            // 用 spawn_blocking 避免同步写文件阻塞 tokio 运行时
+            let download_path_clone = download_path.clone();
+            let bytes_clone = bytes.clone();
+            let write_result = tokio::task::spawn_blocking(move || {
+                std::fs::write(&download_path_clone, &bytes_clone)
+            })
+            .await;
+            if let Err(e) = write_result {
+                let _ = std::fs::remove_file(&download_path);
+                return Err(format!("写入任务失败: {}", e));
+            }
+            if let Err(e) = write_result.unwrap() {
+                let _ = std::fs::remove_file(&download_path);
+                return Err(format!("保存网络视频失败: {}", e));
+            }
+            if let Ok(file) = std::fs::File::open(&download_path) {
+                let _ = file.sync_all();
+            }
+            log::info!("[transcode_for_preview] 下载完成: {} bytes", bytes.len());
+        }
+
+        download_path.to_string_lossy().to_string()
+    } else {
+        let input = std::path::Path::new(input_path);
+        if !input.exists() {
+            return Err(format!("输入文件不存在: {}", input_path));
+        }
+        input.canonicalize()
+            .unwrap_or(input.to_path_buf())
+            .to_string_lossy()
+            .to_string()
+    };
+
+    // ============================================================
+    // 1. 快速通过检测：用 ffprobe 全面检查视频兼容性
+    // ============================================================
+    let probe_args = vec![
+        "-v".to_string(), "error".to_string(),
+        "-select_streams".to_string(), "v:0".to_string(),
+        "-show_entries".to_string(), "stream=codec_name,pix_fmt,width,height,profile,level,color_range,has_b_frames,refs,r_frame_rate".to_string(),
+        "-of".to_string(), "json".to_string(),
+        path_str.clone(),
+    ];
+
+    let probe_result = app.shell().sidecar("ffprobe")
+        .and_then(|s| s.args(probe_args).spawn());
+    if let Ok((mut rx, child)) = probe_result {
+        let mut stdout = String::new();
+        let probe_future = async {
+            while let Some(event) = rx.recv().await {
+                match event {
+                    CommandEvent::Stdout(line) => stdout.push_str(&String::from_utf8_lossy(&line)),
+                    CommandEvent::Terminated(status) if status.code == Some(0) => return Ok(()),
+                    _ => {}
+                }
+            }
+            Ok::<(), ()>(())
+        };
+        match tokio::time::timeout(std::time::Duration::from_secs(3), probe_future).await {
+            Ok(Ok(())) => {
+                if let Ok(parsed) = serde_json::from_str::<serde_json::Value>(&stdout) {
+                    if let Some(stream) = parsed.get("streams").and_then(|s| s.as_array()).and_then(|a| a.first()) {
+                        let codec = stream.get("codec_name").and_then(|v| v.as_str()).unwrap_or("");
+                        let pix_fmt = stream.get("pix_fmt").and_then(|v| v.as_str()).unwrap_or("");
+                        let profile = stream.get("profile").and_then(|v| v.as_str()).unwrap_or("");
+                        let level = stream.get("level").and_then(|v| v.as_i64()).unwrap_or(0);
+                        let color_range = stream.get("color_range").and_then(|v| v.as_str()).unwrap_or("tv");
+                        let has_b_frames = stream.get("has_b_frames").and_then(|v| v.as_i64()).unwrap_or(0);
+                        let refs = stream.get("refs").and_then(|v| v.as_i64()).unwrap_or(0);
+                        let r_frame_rate = stream.get("r_frame_rate").and_then(|v| v.as_str()).unwrap_or("");
+                        let width = stream.get("width").and_then(|v| v.as_u64()).unwrap_or(0);
+                        let height = stream.get("height").and_then(|v| v.as_u64()).unwrap_or(0);
+
+                        let is_safe_profile = profile == "Baseline"
+                            || profile == "Constrained Baseline"
+                            || profile == "Main";
+                        let is_limited_range = color_range == "tv" || color_range.is_empty();
+                        let no_b_frames = has_b_frames == 0;
+                        let refs_ok = refs <= 4;
+                        let level_ok = level <= 41;
+                        let fps = parse_frame_rate(r_frame_rate);
+                        let fps_ok = fps > 0.0 && fps <= 60.0;
+                        let resolution_ok = width <= 1920 && height <= 1920;
+
+                        let can_skip = codec == "h264"
+                            && pix_fmt == "yuv420p"
+                            && is_safe_profile
+                            && is_limited_range
+                            && no_b_frames
+                            && refs_ok
+                            && level_ok
+                            && fps_ok
+                            && resolution_ok;
+
+                        if can_skip {
+                            return Ok(normalize_path(&std::path::Path::new(&path_str)));
+                        }
+                    }
+                }
+            }
+            _ => {
+                // 超时或异常：强制结束 ffprobe，避免僵尸进程
+                let _ = child.kill();
+            }
+        }
+    }
+
+    // ============================================================
+    // 2. 缓存检查
+    // ============================================================
+    let metadata = std::fs::metadata(&path_str)
+        .map_err(|e| format!("无法读取文件元数据: {}", e))?;
+    let mtime = metadata.modified()
+        .ok()
+        .and_then(|t| t.duration_since(std::time::UNIX_EPOCH).ok())
+        .unwrap_or_default()
+        .as_secs();
+    let file_size = metadata.len();
+
+    let path_hash = {
+        use std::collections::hash_map::DefaultHasher;
+        use std::hash::{Hash, Hasher};
+        let mut hasher = DefaultHasher::new();
+        path_str.hash(&mut hasher);
+        format!("{:016x}", hasher.finish())
+    };
+
+    let app_data_dir = crate::storage::paths::get_app_data_dir()
+        .map_err(|e| format!("无法获取应用数据目录: {}", e))?;
+    let cache_dir = app_data_dir.join("video_cache");
+    std::fs::create_dir_all(&cache_dir)
+        .map_err(|e| format!("无法创建缓存目录: {}", e))?;
+    // 缓存版本号：每次修改转码参数后递增，确保旧缓存自动失效
+    const CACHE_VERSION: &str = "v3";
+    let cache_path = cache_dir.join(format!("preview_{}_{}_{}_{}.mp4", path_hash, file_size, mtime, CACHE_VERSION));
+
+    if cache_path.exists() {
+        let cache_meta = std::fs::metadata(&cache_path)
+            .map_err(|e| format!("无法读取缓存文件: {}", e))?;
+        if cache_meta.len() > 1024 {
+            return Ok(cache_path.to_string_lossy().to_string());
+        }
+    }
+
+    // ============================================================
+    // 3. FFmpeg 转码（带并发锁）
+    // ============================================================
+    let _permit = PREVIEW_SEMAPHORE.acquire().await
+        .map_err(|e| format!("无法获取转码锁: {}", e))?;
+
+    // 先写入临时文件，避免 FFmpeg 写入过程中被 WebKit 读取到不完整文件
+    let tmp_path = cache_path.with_extension("mp4.tmp");
+
+    let args = vec![
+        "-i".to_string(), path_str.clone(),
+        "-map".to_string(), "0:v:0".to_string(),
+        "-map".to_string(), "0:a:0?".to_string(),
+        "-c:v".to_string(), "libx264".to_string(),
+        "-profile:v".to_string(), "baseline".to_string(),
+        "-level".to_string(), "3.0".to_string(),
+        "-pix_fmt".to_string(), "yuv420p".to_string(),
+        "-preset".to_string(), "ultrafast".to_string(),
+        "-crf".to_string(), "23".to_string(),
+        "-vf".to_string(), "scale=540:-2:force_original_aspect_ratio=decrease".to_string(),
+        "-c:a".to_string(), "aac".to_string(),
+        "-b:a".to_string(), "128k".to_string(),
+        "-movflags".to_string(), "+faststart".to_string(),
+        "-f".to_string(), "mp4".to_string(),
+        "-y".to_string(),
+        tmp_path.to_string_lossy().to_string(),
+    ];
+
+    run_ffmpeg(app, args).await?;
+
+    // 转码完成后验证临时文件大小
+    let output_meta = std::fs::metadata(&tmp_path)
+        .map_err(|e| format!("转码后无法读取临时文件: {}", e))?;
+    if output_meta.len() < 1024 {
+        let _ = std::fs::remove_file(&tmp_path);
+        return Err(format!("FFmpeg 转码输出文件过小: {} bytes", output_meta.len()));
+    }
+    log::info!("[transcode_for_preview] 转码完成: {} ({} bytes)", tmp_path.display(), output_meta.len());
+
+    // 原子重命名：确保 WebKit 只读到完整文件
+    std::fs::rename(&tmp_path, &cache_path)
+        .map_err(|e| format!("重命名缓存文件失败: {}", e))?;
+
+    // 强制刷新文件系统缓存（文件数据 + 目录项），避免 WebKit asset:// 首次读取到不完整数据
+    if let Ok(file) = std::fs::File::open(&cache_path) {
+        let _ = file.sync_all();
+    }
+    if let Some(parent) = cache_path.parent() {
+        if let Ok(dir) = std::fs::OpenOptions::new().read(true).open(parent) {
+            let _ = dir.sync_all();
+        }
+    }
+
+    Ok(cache_path.to_string_lossy().to_string())
+}

tauri-app/src-tauri/src/lib.rs

@@ -30,6 +30,11 @@ fn restart_app(app: tauri::AppHandle) {
     app.restart();
 }
 
+#[tauri::command]
+fn open_devtools(window: tauri::WebviewWindow) {
+    let _ = window.open_devtools();
+}
+
 // ============================================================
 // 公共类型导出
 // ============================================================
@@ -41,25 +46,294 @@ pub struct ApiResponse<T> {
     pub data: Option<T>,
 }
 
+// ============================================================
+// 视频缓存清理
+// ============================================================
+
+/// 清理 video_cache 目录
+///
+/// 策略：
+/// 1. 删除超过 30 天未修改的文件
+/// 2. 总容量超过 500MB 时，按修改时间删最旧文件直到 300MB
+fn clean_video_cache(app_data_dir: &std::path::Path) {
+    let cache_dir = app_data_dir.join("video_cache");
+    if !cache_dir.exists() {
+        return;
+    }
+
+    let max_age = std::time::Duration::from_secs(30 * 24 * 60 * 60);
+    let max_total_size: u64 = 2 * 1024 * 1024 * 1024;
+    let target_size: u64 = 1024 * 1024 * 1024;
+    let now = std::time::SystemTime::now();
+
+    let mut entries: Vec<(std::path::PathBuf, std::time::SystemTime, u64)> = Vec::new();
+    let mut total_size: u64 = 0;
+
+    let read_dir = match std::fs::read_dir(&cache_dir) {
+        Ok(d) => d,
+        Err(e) => {
+            eprintln!("[cache] 无法读取缓存目录: {}", e);
+            return;
+        }
+    };
+
+    for entry in read_dir.flatten() {
+        let Ok(metadata) = entry.metadata() else { continue };
+        if !metadata.is_file() { continue; }
+        let mtime = metadata.modified().unwrap_or(now);
+        let size = metadata.len();
+        total_size += size;
+        entries.push((entry.path(), mtime, size));
+    }
+
+    // 1. 删除超过 30 天的文件
+    let mut deleted_size: u64 = 0;
+    for (path, mtime, size) in &entries {
+        if now.duration_since(*mtime).unwrap_or_default() > max_age {
+            if std::fs::remove_file(path).is_ok() {
+                deleted_size += size;
+            }
+        }
+    }
+
+    // 2. 容量超限，删最旧的
+    let remaining_size = total_size.saturating_sub(deleted_size);
+    if remaining_size > max_total_size {
+        let mut sorted = entries;
+        sorted.sort_by_key(|(_, mtime, _)| *mtime);
+        let mut to_free = remaining_size.saturating_sub(target_size);
+        for (path, _, size) in sorted {
+            if to_free == 0 { break; }
+            if path.exists() && std::fs::remove_file(&path).is_ok() {
+                to_free = to_free.saturating_sub(size);
+            }
+        }
+    }
+}
+
+/// 手动清理 video_cache 目录，返回释放的字节数
+#[tauri::command]
+fn clear_video_cache_cmd() -> Result<u64, String> {
+    let app_data_dir = crate::storage::paths::get_app_data_dir()
+        .map_err(|e| e.to_string())?;
+    let cache_dir = app_data_dir.join("video_cache");
+    if !cache_dir.exists() {
+        return Ok(0);
+    }
+
+    let mut freed: u64 = 0;
+    let read_dir = match std::fs::read_dir(&cache_dir) {
+        Ok(d) => d,
+        Err(e) => return Err(format!("无法读取缓存目录: {}", e)),
+    };
+
+    for entry in read_dir.flatten() {
+        let Ok(metadata) = entry.metadata() else { continue };
+        if !metadata.is_file() { continue; }
+        let size = metadata.len();
+        if std::fs::remove_file(entry.path()).is_ok() {
+            freed += size;
+        }
+    }
+
+    Ok(freed)
+}
+
+/// 获取 video_cache 目录当前占用大小（字节）
+#[tauri::command]
+fn get_video_cache_size_cmd() -> Result<u64, String> {
+    let app_data_dir = crate::storage::paths::get_app_data_dir()
+        .map_err(|e| e.to_string())?;
+    let cache_dir = app_data_dir.join("video_cache");
+    if !cache_dir.exists() {
+        return Ok(0);
+    }
+
+    let mut total: u64 = 0;
+    let read_dir = match std::fs::read_dir(&cache_dir) {
+        Ok(d) => d,
+        Err(e) => return Err(format!("无法读取缓存目录: {}", e)),
+    };
+
+    for entry in read_dir.flatten() {
+        let Ok(metadata) = entry.metadata() else { continue };
+        if metadata.is_file() {
+            total += metadata.len();
+        }
+    }
+
+    Ok(total)
+}
+
+// ============================================================
+// BGM 缓存清理
+// ============================================================
+
+/// 清理 bgm_cache 目录
+///
+/// 策略：和视频缓存一致
+/// 1. 删除超过 30 天未修改的文件
+/// 2. 总容量超过 200MB 时，按修改时间删最旧文件直到 100MB
+fn clean_bgm_cache(app_data_dir: &std::path::Path) {
+    let cache_dir = app_data_dir.join("bgm_cache");
+    if !cache_dir.exists() {
+        return;
+    }
+
+    let max_age = std::time::Duration::from_secs(30 * 24 * 60 * 60);
+    let max_total_size: u64 = 200 * 1024 * 1024;
+    let target_size: u64 = 100 * 1024 * 1024;
+    let now = std::time::SystemTime::now();
+
+    let mut entries: Vec<(std::path::PathBuf, std::time::SystemTime, u64)> = Vec::new();
+    let mut total_size: u64 = 0;
+
+    let read_dir = match std::fs::read_dir(&cache_dir) {
+        Ok(d) => d,
+        Err(e) => {
+            eprintln!("[bgm_cache] 无法读取缓存目录: {}", e);
+            return;
+        }
+    };
+
+    for entry in read_dir.flatten() {
+        let Ok(metadata) = entry.metadata() else { continue };
+        if !metadata.is_file() { continue; }
+        let mtime = metadata.modified().unwrap_or(now);
+        let size = metadata.len();
+        total_size += size;
+        entries.push((entry.path(), mtime, size));
+    }
+
+    // 1. 删除超过 30 天的文件
+    let mut deleted_size: u64 = 0;
+    for (path, mtime, size) in &entries {
+        if now.duration_since(*mtime).unwrap_or_default() > max_age {
+            if std::fs::remove_file(path).is_ok() {
+                deleted_size += size;
+            }
+        }
+    }
+
+    // 2. 容量超限，删最旧的
+    let remaining_size = total_size.saturating_sub(deleted_size);
+    if remaining_size > max_total_size {
+        let mut sorted = entries;
+        sorted.sort_by_key(|(_, mtime, _)| *mtime);
+        let mut to_free = remaining_size.saturating_sub(target_size);
+        for (path, _, size) in sorted {
+            if to_free == 0 { break; }
+            if path.exists() && std::fs::remove_file(&path).is_ok() {
+                to_free = to_free.saturating_sub(size);
+            }
+        }
+    }
+}
+
+/// 手动清理 bgm_cache 目录，返回释放的字节数
+#[tauri::command]
+fn clear_bgm_cache_cmd() -> Result<u64, String> {
+    let app_data_dir = crate::storage::paths::get_app_data_dir()
+        .map_err(|e| e.to_string())?;
+    let cache_dir = app_data_dir.join("bgm_cache");
+    if !cache_dir.exists() {
+        return Ok(0);
+    }
+
+    let mut freed: u64 = 0;
+    let read_dir = match std::fs::read_dir(&cache_dir) {
+        Ok(d) => d,
+        Err(e) => return Err(format!("无法读取缓存目录: {}", e)),
+    };
+
+    for entry in read_dir.flatten() {
+        let Ok(metadata) = entry.metadata() else { continue };
+        if !metadata.is_file() { continue; }
+        let size = metadata.len();
+        if std::fs::remove_file(entry.path()).is_ok() {
+            freed += size;
+        }
+    }
+
+    Ok(freed)
+}
+
+/// 获取 bgm_cache 目录当前占用大小（字节）
+#[tauri::command]
+fn get_bgm_cache_size_cmd() -> Result<u64, String> {
+    let app_data_dir = crate::storage::paths::get_app_data_dir()
+        .map_err(|e| e.to_string())?;
+    let cache_dir = app_data_dir.join("bgm_cache");
+    if !cache_dir.exists() {
+        return Ok(0);
+    }
+
+    let mut total: u64 = 0;
+    let read_dir = match std::fs::read_dir(&cache_dir) {
+        Ok(d) => d,
+        Err(e) => return Err(format!("无法读取缓存目录: {}", e)),
+    };
+
+    for entry in read_dir.flatten() {
+        let Ok(metadata) = entry.metadata() else { continue };
+        if metadata.is_file() {
+            total += metadata.len();
+        }
+    }
+
+    Ok(total)
+}
+
+/// 获取 BGM 缓存目录路径（供前端下载 BGM 时使用）
+#[tauri::command]
+fn get_bgm_cache_dir() -> Result<String, String> {
+    crate::storage::paths::get_bgm_cache_dir()
+        .map(|p| p.to_string_lossy().to_string())
+        .map_err(|e| e.to_string())
+}
+
 // ============================================================
 // 应用入口
 // ============================================================
 
 #[cfg_attr(mobile, tauri::mobile_entry_point)]
 pub fn run() {
+    // Windows: 禁用 D3D11 硬件视频解码，解决本地视频预览黑屏问题
+    // Chromium 在 Windows 上的 D3D11 视频解码器与部分显卡驱动/视频编码不兼容，
+    // 回退到软件解码可确保视频画面正常渲染。对 5~20 秒短视频预览性能影响可忽略。
+    #[cfg(target_os = "windows")]
+    {
+        std::env::set_var(
+            "WEBVIEW2_ADDITIONAL_BROWSER_ARGUMENTS",
+            "--disable-features=MediaFoundationD3D11VideoDecode"
+        );
+    }
+
     let _api_base_url = crate::storage::config::get_api_base_url_sync();
 
     tauri::Builder::default()
         .setup(|app| {
             // 初始化应用数据目录（所有业务数据的根目录）
             if let Ok(app_data_dir) = app.path().app_local_data_dir() {
-                crate::storage::init_app_data_dir(app_data_dir);
+                crate::storage::init_app_data_dir(app_data_dir.clone());
+                // 后台清理过期视频缓存和 BGM 缓存，不阻塞首屏
+                let app_data_dir_clone = app_data_dir.clone();
+                std::thread::spawn(move || {
+                    clean_video_cache(&app_data_dir_clone);
+                    clean_bgm_cache(&app_data_dir_clone);
+                });
             }
 
-            // Release 构建也打开 DevTools（临时：排查 Windows 网络问题）
-            // 排查完成后可移除或改为快捷键触发
+            // 窗口初始 visible=false，setup 阶段先显示窗口
             if let Some(window) = app.get_webview_window("main") {
-                let _ = window.open_devtools();
+                if let Err(e) = window.show() {
+                    eprintln!("[setup] window.show() failed: {}", e);
+                }
+                if let Err(e) = window.set_focus() {
+                    eprintln!("[setup] window.set_focus() failed: {}", e);
+                }
+            } else {
+                eprintln!("[setup] main window not found");
             }
 
             // macOS 自定义菜单栏（中文本地化）
@@ -126,6 +400,7 @@ pub fn run() {
             storage::config::save_app_config,
             storage::config::get_environment_presets,
             restart_app,
+            open_devtools,
             // 项目存储
             commands::project::save_project_meta_raw,
             commands::project::load_project_meta,
@@ -167,12 +442,28 @@ pub fn run() {
             commands::voice::load_voice_materials,
             commands::voice::save_voice_material,
             commands::voice::delete_voice_material_cmd,
+            // 封面形象库
+            commands::cover_avatar::load_cover_avatars,
+            commands::cover_avatar::save_cover_avatar,
+            commands::cover_avatar::delete_cover_avatar_cmd,
+            commands::cover_avatar::save_cover_avatar_image,
             // 压制成片（Phase 2）
             commands::video_compose::extract_video_segment,
             commands::video_compose::concat_video_clips,
             commands::video_compose::generate_empty_shot_clip,
             commands::video_compose::upload_video_file,
             commands::video_compose::download_file,
+            commands::video_compose::mix_bgm_to_video,
+            // 视频元数据读取（ffprobe）
+            get_video_metadata_cmd,
+            // 视频预览转码（统一浏览器兼容格式）
+            transcode_for_preview_cmd,
+            // 缓存清理
+            get_video_cache_size_cmd,
+            clear_video_cache_cmd,
+            get_bgm_cache_size_cmd,
+            clear_bgm_cache_cmd,
+            get_bgm_cache_dir,
         ])
         .run(tauri::generate_context!())
         .expect("error while running tauri application");
@@ -274,6 +565,64 @@ async fn video_composite_synthesis(
     }
 }
 
+// ============================================================
+// 视频元数据读取（ffprobe）
+// ============================================================
+
+#[derive(Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub struct GetVideoMetadataRequest {
+    path: String,
+}
+
+#[tauri::command]
+async fn get_video_metadata_cmd(
+    app: tauri::AppHandle,
+    request: GetVideoMetadataRequest,
+) -> ApiResponse<ffmpeg_cmd::VideoMetadata> {
+    match ffmpeg_cmd::get_video_metadata(&app, &request.path).await {
+        Ok(meta) => ApiResponse {
+            code: 200,
+            message: "读取成功".to_string(),
+            data: Some(meta),
+        },
+        Err(e) => ApiResponse {
+            code: 500,
+            message: e,
+            data: None,
+        },
+    }
+}
+
+// ============================================================
+// 视频预览转码
+// ============================================================
+
+#[derive(Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub struct TranscodeForPreviewRequest {
+    path: String,
+}
+
+#[tauri::command]
+async fn transcode_for_preview_cmd(
+    app: tauri::AppHandle,
+    request: TranscodeForPreviewRequest,
+) -> ApiResponse<String> {
+    match ffmpeg_cmd::transcode_for_preview(&app, &request.path).await {
+        Ok(path) => ApiResponse {
+            code: 200,
+            message: "转码成功".to_string(),
+            data: Some(path),
+        },
+        Err(e) => ApiResponse {
+            code: 500,
+            message: e,
+            data: None,
+        },
+    }
+}
+
 // ============================================================
 // 错误处理扩展
 // ============================================================

tauri-app/src-tauri/src/storage/config.rs

@@ -2,19 +2,21 @@
 //!
 //! 存储路径: {app_local_data_dir}/config.json
 //!
-//! 所有环境预设和默认配置均在 Rust 层定义，前端不硬编码任何 API 地址。
+//! 运行模式（生产/调试）控制桌面端行为，API 地址固定为 dev 环境。
 
 use std::path::PathBuf;
 use serde::{Deserialize, Serialize};
 use crate::storage::engine::{read_json, atomic_write_json, StorageError};
 
+const API_BASE_URL: &str = "https://dev.tapi.meijiaka.cn/api/v1";
+
 #[derive(Serialize, Deserialize, Clone, Debug)]
 pub struct AppConfig {
     pub api_base_url: String,
     pub environment: String,
 }
 
-/// 环境预设（唯一数据源，前端通过 IPC 获取）
+/// 运行模式预设（唯一数据源，前端通过 IPC 获取）
 #[derive(Serialize, Clone, Debug)]
 pub struct EnvironmentPreset {
     pub label: String,
@@ -25,27 +27,22 @@ pub struct EnvironmentPreset {
 fn presets() -> Vec<EnvironmentPreset> {
     vec![
         EnvironmentPreset {
-            label: "生产环境".to_string(),
-            url: "https://tapi.meijiaka.cn/api/v1".to_string(),
+            label: "生产模式".to_string(),
+            url: API_BASE_URL.to_string(),
             env: "production".to_string(),
         },
         EnvironmentPreset {
-            label: "测试环境".to_string(),
-            url: "https://dev.tapi.meijiaka.cn/api/v1".to_string(),
-            env: "staging".to_string(),
-        },
-        EnvironmentPreset {
-            label: "本地开发".to_string(),
-            url: "http://127.0.0.1:8081/api/v1".to_string(),
-            env: "development".to_string(),
+            label: "调试模式".to_string(),
+            url: API_BASE_URL.to_string(),
+            env: "debug".to_string(),
         },
     ]
 }
 
 impl Default for AppConfig {
     fn default() -> Self {
-        // 默认指向测试环境（索引 1），避免首次安装时误连生产环境
-        let preset = &presets()[1];
+        // 默认生产模式
+        let preset = &presets()[0];
         Self {
             api_base_url: preset.url.clone(),
             environment: preset.env.clone(),
@@ -59,22 +56,24 @@ fn get_config_path() -> Result<PathBuf, StorageError> {
 
 /// 同步读取 API Base URL（供 Rust 命令内部使用）
 pub fn get_api_base_url_sync() -> String {
-    let path = match get_config_path() {
-        Ok(p) => p,
-        // 默认指向测试环境（索引 1）
-        Err(_) => return presets()[1].url.clone(),
-    };
-    match read_json::<AppConfig>(&path) {
-        Ok(Some(config)) => config.api_base_url,
-        _ => AppConfig::default().api_base_url,
-    }
+    API_BASE_URL.to_string()
 }
 
 #[tauri::command]
 pub async fn load_app_config() -> Result<AppConfig, String> {
     let path = get_config_path().map_err(|e| e.to_string())?;
     match read_json::<AppConfig>(&path) {
-        Ok(Some(config)) => Ok(config),
+        Ok(Some(config)) => {
+            // 兼容旧环境值：旧值（staging/development/custom）统一映射为 debug
+            let environment = match config.environment.as_str() {
+                "production" => "production".to_string(),
+                _ => "debug".to_string(),
+            };
+            Ok(AppConfig {
+                api_base_url: API_BASE_URL.to_string(),
+                environment,
+            })
+        }
         Ok(None) => Ok(AppConfig::default()),
         Err(e) => Err(e.to_string()),
     }
@@ -86,19 +85,9 @@ pub async fn get_environment_presets() -> Result<Vec<EnvironmentPreset>, String>
 }
 
 #[tauri::command]
-pub async fn save_app_config(environment: String, custom_url: Option<String>) -> Result<(), String> {
-    let url = if environment == "custom" {
-        custom_url.ok_or("自定义地址不能为空")?
-    } else {
-        presets()
-            .iter()
-            .find(|p| p.env == environment)
-            .map(|p| p.url.clone())
-            .unwrap_or_else(|| "https://dev.tapi.meijiaka.cn/api/v1".to_string())
-    };
-
+pub async fn save_app_config(environment: String, _custom_url: Option<String>) -> Result<(), String> {
     let config = AppConfig {
-        api_base_url: url,
+        api_base_url: API_BASE_URL.to_string(),
         environment,
     };
 

tauri-app/src-tauri/src/storage/cover_avatar.rs

@@ -0,0 +1,101 @@
+//! 封面形象存储模块
+//!
+//! 管理用户上传的人物照片（抠图后）的本地存储。
+
+use serde::{Deserialize, Serialize};
+
+use crate::storage::engine::{atomic_write_bytes, atomic_write_json, ensure_dir, read_json, StorageError};
+use crate::storage::paths::get_cover_avatars_dir;
+
+/// 封面形象记录
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct CoverAvatar {
+    pub id: String,
+    pub name: String,
+    /// 抠图后的透明背景图片 URL（七牛云）
+    pub image_url: String,
+    /// 本地文件路径（相对于项目目录或绝对路径）
+    pub local_path: Option<String>,
+    pub created_at: String,
+}
+
+/// 封面形象列表
+#[derive(Debug, Clone, Serialize, Deserialize, Default)]
+#[serde(rename_all = "camelCase")]
+pub struct CoverAvatarsList {
+    pub avatars: Vec<CoverAvatar>,
+    pub updated_at: String,
+}
+
+/// 加载封面形象库
+pub fn load_cover_avatars() -> Result<CoverAvatarsList, StorageError> {
+    let path = crate::storage::paths::get_cover_avatars_json_path()?;
+    Ok(read_json(&path)?.unwrap_or_default())
+}
+
+/// 保存封面形象库
+pub fn save_cover_avatars(list: &CoverAvatarsList) -> Result<(), StorageError> {
+    let path = crate::storage::paths::get_cover_avatars_json_path()?;
+    atomic_write_json(&path, list)
+}
+
+/// 添加封面形象
+pub fn add_cover_avatar(avatar: CoverAvatar) -> Result<(), StorageError> {
+    let mut list = load_cover_avatars()?;
+    // 去重：相同 id 替换
+    if let Some(pos) = list.avatars.iter().position(|a| a.id == avatar.id) {
+        list.avatars[pos] = avatar;
+    } else {
+        list.avatars.push(avatar);
+    }
+    list.updated_at = chrono_lite_now();
+    save_cover_avatars(&list)
+}
+
+/// 删除封面形象
+pub fn delete_cover_avatar(id: &str) -> Result<(), StorageError> {
+    let mut list = load_cover_avatars()?;
+    let pos = list.avatars.iter().position(|a| a.id == id)
+        .ok_or_else(|| StorageError::Io(std::io::Error::new(
+            std::io::ErrorKind::NotFound,
+            format!("封面形象 {} 不存在", id),
+        )))?;
+    list.avatars.remove(pos);
+    list.updated_at = chrono_lite_now();
+    save_cover_avatars(&list)
+}
+
+/// 保存封面形象图片文件到本地
+///
+/// 将 base64 编码的图片数据写入 `cover_avatars/` 子目录。
+pub fn save_cover_avatar_image(
+    avatar_id: &str,
+    data: &[u8],
+    ext: &str,
+) -> Result<String, StorageError> {
+    let avatars_dir = get_cover_avatars_dir()?;
+    ensure_dir(&avatars_dir)?;
+
+    // 净化扩展名：只允许字母数字，防止路径遍历
+    let safe_ext = ext
+        .chars()
+        .filter(|c| c.is_alphanumeric())
+        .collect::<String>();
+    if safe_ext.is_empty() {
+        return Err(StorageError::InvalidId("无效的文件扩展名".into()));
+    }
+
+    let file_name = format!("{}.{}", avatar_id, safe_ext);
+    let file_path = avatars_dir.join(&file_name);
+
+    atomic_write_bytes(&file_path, data)?;
+
+    Ok(file_path.to_str().unwrap_or_default().to_string())
+}
+
+// ====================== 工具函数 ======================
+
+fn chrono_lite_now() -> String {
+    chrono::Utc::now().to_rfc3339()
+}

tauri-app/src-tauri/src/storage/engine.rs

@@ -158,6 +158,7 @@ pub fn ensure_dir(path: &Path) -> Result<(), StorageError> {
 ///
 /// 非 Unix 平台上为无操作。
 pub fn restrict_file_permissions(path: &Path) -> Result<(), StorageError> {
+    let _ = path; // 非 Unix 平台上避免 unused_variables 警告
     #[cfg(unix)]
     {
         use std::os::unix::fs::PermissionsExt;

tauri-app/src-tauri/src/storage/mod.rs

@@ -12,6 +12,7 @@ pub mod project;
 pub mod auth;
 pub mod voice;
 pub mod config;
+pub mod cover_avatar;
 
 pub use engine::{
     atomic_write_json, atomic_write_bytes,
@@ -22,5 +23,5 @@ pub use paths::{
     init_app_data_dir, get_app_data_dir, get_projects_root_dir,
     get_project_dir, get_project_dir_path, get_project_assets_dir,
     get_project_videos_dir, get_project_products_dir, get_voices_json_path,
-    get_app_config_json_path,
+    get_app_config_json_path, get_cover_avatars_dir, get_cover_avatars_json_path,
 };

tauri-app/src-tauri/src/storage/paths.rs

@@ -104,3 +104,28 @@ pub fn get_auth_state_path(app: &AppHandle) -> Result<PathBuf, StorageError> {
     crate::storage::engine::ensure_dir(&path)?;
     Ok(path.join("auth.json"))
 }
+
+/// 获取封面形象图片存储目录
+/// {app_local_data_dir}/cover_avatars/
+pub fn get_cover_avatars_dir() -> Result<PathBuf, StorageError> {
+    let base = get_app_data_dir()?;
+    let path = base.join("cover_avatars");
+    crate::storage::engine::ensure_dir(&path)?;
+    Ok(path)
+}
+
+/// 获取封面形象库 JSON 路径
+/// {app_local_data_dir}/cover_avatars.json
+pub fn get_cover_avatars_json_path() -> Result<PathBuf, StorageError> {
+    let base = get_app_data_dir()?;
+    Ok(base.join("cover_avatars.json"))
+}
+
+/// 获取 BGM 缓存目录
+/// {app_local_data_dir}/bgm_cache/
+pub fn get_bgm_cache_dir() -> Result<PathBuf, StorageError> {
+    let base = get_app_data_dir()?;
+    let path = base.join("bgm_cache");
+    crate::storage::engine::ensure_dir(&path)?;
+    Ok(path)
+}

tauri-app/src-tauri/tauri.conf.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "美家卡智影",
-  "version": "1.5.18",
+  "version": "1.6.4",
   "identifier": "cn.meijiaka.ai-zy",
   "build": {
     "beforeDevCommand": "npm run dev",
@@ -23,7 +23,7 @@
       }
     ],
     "security": {
-      "csp": "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; font-src 'self'; img-src 'self' https: data: blob: asset:; media-src 'self' https: blob: asset:; connect-src 'self' https: ws://localhost:*;",
+      "csp": "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; font-src 'self' asset: http://asset.localhost; img-src 'self' https: data: blob: asset: http://asset.localhost; media-src 'self' https: blob: asset: http://asset.localhost; connect-src 'self' https: ws://localhost:* wss://localhost:* ipc://localhost http://ipc.localhost;",
       "capabilities": [
         "default"
       ],
@@ -41,7 +41,7 @@
   "plugins": {
     "opener": {},
     "updater": {
-      "pubkey": "dW50cnVzdGVkIGNvbW1lbnQ6IG1pbmlzaWduIHB1YmxpYyBrZXk6IDkwRTdFOUI5NkZERkNFRDMKUldUVHp0OXZ1ZW5ua0pVN2M0ZGoyakxneFc5am5pR21UNFdCaThDN0p5S0JubUxUVUhLNnlkMWkK",
+      "pubkey": "dW50cnVzdGVkIGNvbW1lbnQ6IG1pbmlzaWduIHB1YmxpYyBrZXk6IDIwOEVEODY4MTgyRkJFRTMKUldUanZpOFlhTmlPSUJzS0FLL1NMUEgzLzRtNXpsT1FoTXZlS3JLOHJvak5KeThIeDJQRFpJZWgK",
       "endpoints": [
         "https://dev.tapi.meijiaka.cn/api/v1/update/check?version={{current_version}}&target={{target}}&arch={{arch}}"
       ]

tauri-app/src-tauri/tauri.key.pub

@@ -1 +0,0 @@
-dW50cnVzdGVkIGNvbW1lbnQ6IG1pbmlzaWduIHB1YmxpYyBrZXk6IEZCMUQyRjU1MzY3ODZDREIKUldUYmJIZzJWUzhkK3l4VTl0RGE3OFRhN2JXdjBjZnR5UC9aMmwxTUY5K2ZoeDVNOStjZlFwQWYK

tauri-app/src/App.css

@@ -13,7 +13,7 @@
   width: 40px;
   height: 40px;
   border: 3px solid #e8e8e8;
-  border-top-color: #1a9e8a;
+  border-top-color: var(--primary);
   border-radius: 50%;
   animation: app-loading-spin 0.8s linear infinite;
 }
@@ -27,7 +27,7 @@
 .app-loading-text {
   font-size: 16px;
   font-weight: 500;
-  color: #1a9e8a;
+  color: var(--primary);
   letter-spacing: 2px;
 }
 

tauri-app/src/App.tsx

@@ -9,10 +9,8 @@ import Login from './pages/Login/Login';
 import VideoCreation from './pages/VideoCreation';
 import MyWorks from './pages/ContentManagement/MyWorks';
 import VoiceMaterialLibrary from './pages/ContentManagement/VoiceMaterialLibrary';
-import AboutUs from './pages/Settings/AboutUs';
-import SystemUpdate from './pages/Settings/SystemUpdate';
-
-
+import CoverAvatarLibrary from './pages/ContentManagement/CoverAvatarLibrary';
+import Settings from './pages/Settings/Settings';
 import Profile from './pages/Profile/Profile';
 import UsageDetail from './pages/Profile/UsageDetail';
 import ToastContainer from './components/Toast/ToastContainer';
@@ -20,7 +18,7 @@ import ProgressModal from './components/ProgressModal/ProgressModal';
 import UpdateDialog from './components/UpdateDialog/UpdateDialog';
 import { ErrorBoundary } from './components/ErrorBoundary';
 import ConfirmModal from './components/Modal/ConfirmModal';
-import { useAuthStore } from './store';
+import { useAuthStore, usePointStore } from './store';
 import { initProjectStore } from './store/projectStore';
 import { loadAppConfig } from './api/modules/config';
 import { setApiBaseUrl } from './api/client';
@@ -32,9 +30,9 @@ import './App.css';
 type PageType =
   | 'video-creation'
   | 'voice-material'
+  | 'cover-avatar'
   | 'my-works'
-  | 'about-us'
-  | 'system-update'
+  | 'settings'
   | 'profile'
   | 'usage-detail';
 
@@ -42,9 +40,9 @@ type PageType =
 const pages: Record<PageType, React.ComponentType> = {
   'video-creation': VideoCreation,
   'voice-material': VoiceMaterialLibrary,
+  'cover-avatar': CoverAvatarLibrary,
   'my-works': MyWorks,
-  'about-us': AboutUs,
-  'system-update': SystemUpdate,
+  settings: Settings,
   profile: Profile,
   'usage-detail': UsageDetail,
 };
@@ -96,6 +94,7 @@ function App() {
   useEffect(() => {
     if (isAuthenticated) {
       initProjectStore().catch(console.error);
+      usePointStore.getState().loadRules();
     }
   }, [isAuthenticated]);
 

tauri-app/src/api/modules/bgmMusic.ts

@@ -0,0 +1,32 @@
+import { client } from '../client';
+
+export interface BgmMusicItem {
+  id: number;
+  title: string;
+  artist: string | null;
+  category: string;
+  filePath: string;
+  url: string;
+  duration: number | null;
+  sortOrder: number;
+}
+
+export interface BgmMusicListResponse {
+  items: BgmMusicItem[];
+  total: number;
+}
+
+/**
+ * BGM 音乐 API
+ */
+export const bgmMusicApi = {
+  /**
+   * 获取背景音乐列表
+   * @param category 场景分类筛选（可选）
+   */
+  list: async (category?: string): Promise<BgmMusicItem[]> => {
+    const path = category ? `/bgm-musics?category=${encodeURIComponent(category)}` : '/bgm-musics';
+    const response = await client.get<{ items: BgmMusicItem[]; total: number }>(path);
+    return response.items || [];
+  },
+};

tauri-app/src/api/modules/config.ts

@@ -40,8 +40,8 @@ export async function getEnvironmentPresets(): Promise<EnvironmentPreset[]> {
 
 /**
  * 保存应用配置
- * @param environment 环境标识（production / staging / development / custom）
- * @param customUrl 自定义地址（仅 custom 时必填）
+ * @param environment 运行模式（production / debug）
+ * @param customUrl 已废弃，保留参数仅为兼容旧调用
  */
 export async function saveAppConfig(environment: string, customUrl?: string): Promise<void> {
   await invoke('save_app_config', { environment, customUrl });

tauri-app/src/api/modules/coverAvatar.ts

@@ -0,0 +1,104 @@
+/**
+ * Cover Avatar 封面形象 API 模块
+ * ================================
+ *
+ * 提供图片上传、AI 抠图、本地封面形象库管理接口。
+ */
+
+import { invoke } from '@tauri-apps/api/core';
+import { client } from '../client';
+
+// ====================== 类型 ======================
+
+export interface CoverAvatar {
+  id: string;
+  name: string;
+  imageUrl: string;
+  localPath?: string;
+  createdAt: string;
+}
+
+// ====================== HTTP API（后端直连） ======================
+
+/**
+ * 上传图片到七牛云
+ */
+export async function uploadImage(file: File): Promise<string> {
+  const formData = new FormData();
+  formData.append('file', file);
+  const result = await client.postForm<{ url: string; key: string }>('/upload/image', formData);
+  return result.url;
+}
+
+/**
+ * AI 抠图（火山引擎 MediaKit）
+ */
+export async function removeBackground(imageUrl: string, scene = 'human'): Promise<string> {
+  const result = await client.post<{ url: string }>('/image/remove-background', {
+    imageUrl,
+    scene,
+  });
+  return result.url;
+}
+
+// ====================== IPC 命令（本地存储） ======================
+
+/**
+ * 从本地加载封面形象库
+ */
+export async function loadCoverAvatars(): Promise<CoverAvatar[]> {
+  const result = await invoke<{ code: number; data?: CoverAvatar[]; message: string }>('load_cover_avatars');
+  if (result.code !== 200) {
+    throw new Error(result.message || '加载封面形象库失败');
+  }
+  return result.data || [];
+}
+
+/**
+ * 保存封面形象到本地
+ */
+export async function saveCoverAvatar(avatar: CoverAvatar): Promise<void> {
+  const result = await invoke<{ code: number; message: string }>('save_cover_avatar', {
+    args: {
+      id: avatar.id,
+      name: avatar.name,
+      imageUrl: avatar.imageUrl,
+      localPath: avatar.localPath,
+      createdAt: avatar.createdAt,
+    },
+  });
+  if (result.code !== 200) {
+    throw new Error(result.message || '保存封面形象失败');
+  }
+}
+
+/**
+ * 删除本地封面形象
+ */
+export async function deleteCoverAvatar(id: string): Promise<void> {
+  const result = await invoke<{ code: number; message: string }>('delete_cover_avatar_cmd', { id });
+  if (result.code !== 200) {
+    throw new Error(result.message || '删除封面形象失败');
+  }
+}
+
+/**
+ * 保存封面形象图片文件到本地（base64 编码）
+ */
+export async function saveCoverAvatarImage(args: {
+  avatarId: string;
+  imageData: string;
+  ext: string;
+}): Promise<string> {
+  const result = await invoke<{ code: number; data?: string; message: string }>('save_cover_avatar_image', {
+    args: {
+      avatarId: args.avatarId,
+      imageData: args.imageData,
+      ext: args.ext,
+    },
+  });
+  if (result.code !== 200 || !result.data) {
+    throw new Error(result.message || '保存封面形象图片失败');
+  }
+  return result.data;
+}

tauri-app/src/api/modules/localStorage.ts

@@ -101,6 +101,7 @@ export const localProjectApi = {
       updatedAt: meta.updatedAt,
       coverPath: meta.coverPath,
       finalVideoPath: meta.finalVideoPath,
+      finalVideoDuration: meta.finalVideoDuration,
       exportedAt: meta.exportedAt,
       selectedVoiceId: meta.selectedVoiceId,
       composedVideoUrl: meta.composedVideoUrl,
@@ -111,6 +112,7 @@ export const localProjectApi = {
       lipSyncedVideoUrl: meta.lipSyncedVideoUrl,
       dubbingAudioUrl: meta.dubbingAudioUrl,
       dubbingAudioPath: meta.dubbingAudioPath,
+      dubbingAudioDuration: meta.dubbingAudioDuration,
       voiceSpeed: meta.voiceSpeed,
       voiceVolume: meta.voiceVolume,
       voicePitch: meta.voicePitch,
@@ -125,8 +127,13 @@ export const localProjectApi = {
       subTitlePreset: meta.subTitlePreset,
       captionPreset: meta.captionPreset,
       coverConfig: meta.coverConfig,
+      bgmMusicId: meta.bgmMusicId,
+      bgmMusicTitle: meta.bgmMusicTitle,
+      bgmMusicPath: meta.bgmMusicPath,
+      bgmVolume: meta.bgmVolume,
       version: meta.version,
       userUploadedMaterials: meta.userUploadedMaterials,
+      stepDirtyFlags: meta.stepDirtyFlags,
     };
     const jsonContent = JSON.stringify(orderedMeta, null, 2);
     const res = await safeInvoke<ApiResponse<boolean>>('save_project_meta_raw', { 

tauri-app/src/components/Layout/AppHeader.tsx

@@ -0,0 +1,25 @@
+interface AppHeaderProps {
+  title: string;
+  showBack?: boolean;
+  onBack?: () => void;
+  rightActions?: React.ReactNode;
+}
+
+export default function AppHeader({ title, showBack, onBack, rightActions }: AppHeaderProps) {
+  return (
+    <div className="app-header">
+      <h2 className="app-header-title">{title}</h2>
+      <div className="app-header-right">
+        {showBack && onBack && (
+          <button className="page-back-btn" onClick={onBack}>
+            返回
+            <svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round">
+              <polyline points="9 18 15 12 9 6" />
+            </svg>
+          </button>
+        )}
+        {rightActions}
+      </div>
+    </div>
+  );
+}

tauri-app/src/components/Layout/Sidebar.css

@@ -101,17 +101,16 @@
   cursor: pointer;
   padding: 0;
   margin-left: auto;
-  margin-right: 0;
-  transform: translateY(1px);
+  margin-right: -4px;
   transition: all 0.2s ease;
 }
 
 .nav-new-project:hover {
-  transform: translateY(1px) scale(1.08);
+  transform: scale(1.08);
 }
 
 .nav-new-project:active {
-  transform: translateY(1px) scale(0.96);
+  transform: scale(0.96);
 }
 
 .nav-chevron {
@@ -164,15 +163,28 @@
   display: flex;
   flex-direction: column;
   gap: var(--spacing-xs);
+  position: relative;
+}
+
+.sidebar-footer-card {
+  background: var(--bg-card);
+  border: 1px solid var(--border-light);
+  border-radius: var(--radius-lg);
+  overflow: hidden;
+}
+
+.sidebar-balance-text {
+  font-size: 12px;
+  font-weight: 600;
+  color: var(--primary);
+  margin-top: 2px;
 }
 
 .sidebar-user {
   display: flex;
   align-items: center;
-  justify-content: center;
   gap: var(--spacing-sm);
-  padding: var(--spacing-sm);
-  border-radius: var(--radius-md);
+  padding: var(--spacing-sm) var(--spacing-md);
   cursor: pointer;
   transition: background var(--transition-fast);
 }
@@ -199,15 +211,84 @@
   display: flex;
   flex-direction: column;
   min-width: 0;
+  flex: 1;
+  gap: 1px;
 }
 
 .user-name {
-  font-size: var(--font-sm);
-  font-weight: 500;
+  font-size: 14px;
+  font-weight: 600;
   color: var(--text-primary);
   white-space: nowrap;
   overflow: hidden;
   text-overflow: ellipsis;
 }
 
+.user-chevron {
+  flex-shrink: 0;
+  transition: transform var(--transition-fast);
+  color: var(--text-tertiary);
+}
+
+.user-chevron.expanded {
+  transform: rotate(90deg);
+}
+
+.user-dropdown-menu {
+  position: absolute;
+  bottom: calc(100% + 4px);
+  left: var(--spacing-md);
+  right: var(--spacing-md);
+  background: var(--bg-card);
+  border: 1px solid var(--border-light);
+  border-radius: var(--radius-lg);
+  box-shadow: 0 4px 16px rgba(0, 0, 0, 0.1);
+  padding: var(--spacing-xs);
+  display: flex;
+  flex-direction: column;
+  gap: 2px;
+  z-index: 200;
+  animation: fadeIn 0.15s ease;
+}
+
+.user-dropdown-item {
+  display: flex;
+  align-items: center;
+  padding: var(--spacing-sm) var(--spacing-md);
+  border-radius: var(--radius-md);
+  border: none;
+  background: transparent;
+  cursor: pointer;
+  font-size: var(--font-sm);
+  font-family: var(--font-family);
+  color: var(--text-secondary);
+  text-align: left;
+  transition: all var(--transition-fast);
+}
+
+.user-dropdown-item:hover {
+  background: var(--bg-hover);
+  color: var(--text-primary);
+}
+
+.user-dropdown-item.active {
+  color: var(--primary);
+  font-weight: 500;
+}
+
+.user-dropdown-divider {
+  height: 1px;
+  background: var(--border-light);
+  margin: var(--spacing-xs) 0;
+}
+
+.user-dropdown-danger {
+  color: var(--text-secondary);
+}
+
+.user-dropdown-danger:hover {
+  color: #e74c3c;
+  background: #fdf2f2;
+}
+
 

tauri-app/src/components/Layout/Sidebar.tsx

@@ -1,5 +1,6 @@
-import { useState } from 'react';
+import { useState, useRef, useEffect } from 'react';
 import { createNewProject, useAuthStore } from '../../store';
+import { usePointStore } from '../../store';
 import { useNavigation } from '../../contexts/NavigationContext';
 import './Sidebar.css';
 
@@ -22,19 +23,10 @@ const navItems: NavItem[] = [
     icon: 'M19 11H5m14 0a2 2 0 012 2v6a2 2 0 01-2 2H5a2 2 0 01-2-2v-6a2 2 0 012-2m14 0V9a2 2 0 00-2-2M5 11V9a2 2 0 012-2m0 0V5a2 2 0 012-2h6a2 2 0 012 2v2M7 7h10',
     children: [
       { id: 'voice-material', label: '声音复刻' },
+      { id: 'cover-avatar', label: '封面形象' },
       { id: 'my-works', label: '我的作品' },
     ],
   },
-  {
-    id: 'settings',
-    label: '系统设置',
-    icon: 'M10.325 4.317c.426-1.756 2.924-1.756 3.35 0a1.724 1.724 0 002.573 1.066c1.543-.94 3.31.826 2.37 2.37a1.724 1.724 0 001.066 2.573c1.756.426 1.756 2.924 0 3.35a1.724 1.724 0 00-1.066 2.573c.94 1.543-.826 3.31-2.37 2.37a1.724 1.724 0 00-2.573 1.066c-.426 1.756-2.924 1.756-3.35 0a1.724 1.724 0 00-2.573-1.066c-1.543.94-3.31-.826-2.37-2.37a1.724 1.724 0 00-1.066-2.573c-1.756-.426-1.756-2.924 0-3.35a1.724 1.724 0 001.066-2.573c-.94-1.543.826-3.31 2.37-2.37.996.608 2.296.07 2.572-1.065z M15 12a3 3 0 11-6 0 3 3 0 016 0z',
-    children: [
-      { id: 'system-update', label: '系统更新' },
-      { id: 'about-us', label: '关于我们' },
-
-    ],
-  },
 ];
 
 interface SidebarProps {
@@ -42,12 +34,38 @@ interface SidebarProps {
   onNavigate: (path: string) => void;
 }
 
+const userMenuItems = [
+  { id: 'profile', label: '我的账户' },
+  { id: 'settings', label: '设置' },
+];
+
 export default function Sidebar({ currentPath, onNavigate }: SidebarProps) {
   const { appEnvironment } = useNavigation();
   const authUser = useAuthStore((s) => s.user);
+  const balance = usePointStore((s) => s.balance);
+  const fetchBalance = usePointStore((s) => s.fetchBalance);
   const [expandedItems, setExpandedItems] = useState<Set<string>>(
-    new Set(['content-management', 'settings'])
+    new Set(['content-management'])
   );
+  const [showUserMenu, setShowUserMenu] = useState(false);
+  const menuRef = useRef<HTMLDivElement>(null);
+
+  // 组件挂载时拉取一次余额
+  useEffect(() => {
+    fetchBalance().catch(() => {});
+  }, [fetchBalance]);
+
+  // 点击外部关闭用户菜单
+  useEffect(() => {
+    if (!showUserMenu) return;
+    const handleClick = (e: MouseEvent) => {
+      if (menuRef.current && !menuRef.current.contains(e.target as Node)) {
+        setShowUserMenu(false);
+      }
+    };
+    document.addEventListener('mousedown', handleClick);
+    return () => document.removeEventListener('mousedown', handleClick);
+  }, [showUserMenu]);
 
   const toggleExpand = (id: string) => {
     setExpandedItems(prev => {
@@ -64,10 +82,9 @@ export default function Sidebar({ currentPath, onNavigate }: SidebarProps) {
   const handleClick = (item: NavItem) => {
     if (item.children) {
       toggleExpand(item.id);
-      // Navigate to first child
-      if (!expandedItems.has(item.id)) {
-        onNavigate(item.children[0].id);
-      }
+    } else if (item.id === 'recharge') {
+      window.dispatchEvent(new CustomEvent('open-recharge-modal'));
+      onNavigate('profile');
     } else {
       onNavigate(item.id);
     }
@@ -196,18 +213,64 @@ export default function Sidebar({ currentPath, onNavigate }: SidebarProps) {
           {appEnvironment === 'staging' ? '测试环境' : appEnvironment === 'development' ? '开发环境' : appEnvironment}
         </div>
       )}
-      <div className="sidebar-footer">
-        <div className="sidebar-user" onClick={() => onNavigate('profile')} title="个人中心">
-          <img
-            src={authUser?.avatar || '/default-avatar.svg'}
-            alt="avatar"
-            className="user-avatar"
-            style={{ objectFit: 'cover' }}
-          />
-          <div className="user-info">
-            <span className="user-name">{authUser?.nickname || '用户'}</span>
+      <div className="sidebar-footer" ref={menuRef}>
+        <div className="sidebar-footer-card">
+          <div
+            className="sidebar-user"
+            onClick={() => setShowUserMenu(!showUserMenu)}
+            title="菜单"
+          >
+            <img
+              src={authUser?.avatar || '/default-avatar.svg'}
+              alt="avatar"
+              className="user-avatar"
+              style={{ objectFit: 'cover' }}
+            />
+            <div className="user-info">
+              <span className="user-name">{authUser?.nickname || '用户'}</span>
+              <span className="sidebar-balance-text">{balance} 积分</span>
+            </div>
+            <svg
+              className={`user-chevron ${showUserMenu ? 'expanded' : ''}`}
+              width="14"
+              height="14"
+              viewBox="0 0 24 24"
+              fill="none"
+              stroke="currentColor"
+              strokeWidth="2"
+              strokeLinecap="round"
+              strokeLinejoin="round"
+            >
+              <polyline points="9 18 15 12 9 6" />
+            </svg>
           </div>
         </div>
+        {showUserMenu && (
+          <div className="user-dropdown-menu">
+            {userMenuItems.map((item) => (
+              <button
+                key={item.id}
+                className={`user-dropdown-item ${currentPath === item.id ? 'active' : ''}`}
+                onClick={() => {
+                  setShowUserMenu(false);
+                  onNavigate(item.id);
+                }}
+              >
+                {item.label}
+              </button>
+            ))}
+            <div className="user-dropdown-divider" />
+            <button
+              className="user-dropdown-item user-dropdown-danger"
+              onClick={() => {
+                setShowUserMenu(false);
+                onNavigate('logout');
+              }}
+            >
+              退出登录
+            </button>
+          </div>
+        )}
       </div>
     </aside>
   );

tauri-app/src/components/Modal/EnvironmentSwitchModal.tsx

@@ -1,5 +1,5 @@
 /**
- * 环境切换弹窗
+ * 运行模式切换弹窗
  * =============
  *
  * 通过「关于我们」页面连击版本号 5 次触发。
@@ -13,7 +13,7 @@ import { getEnvironmentPresets, type EnvironmentPreset } from '../../api/modules
 interface EnvironmentSwitchModalProps {
   open: boolean;
   currentEnv: string;
-  onSave: (env: string, customUrl?: string) => void;
+  onSave: (env: string) => void;
   onCancel: () => void;
 }
 
@@ -25,7 +25,6 @@ export default function EnvironmentSwitchModal({
 }: EnvironmentSwitchModalProps) {
   const [presets, setPresets] = useState<EnvironmentPreset[]>([]);
   const [selected, setSelected] = useState(currentEnv);
-  const [customUrl, setCustomUrl] = useState('');
 
   useEffect(() => {
     if (open) {
@@ -36,12 +35,7 @@ export default function EnvironmentSwitchModal({
   if (!open) {return null;}
 
   const handleSave = () => {
-    if (selected === 'custom') {
-      if (!customUrl.trim()) {return;}
-      onSave('custom', customUrl.trim());
-    } else {
-      onSave(selected);
-    }
+    onSave(selected);
   };
 
   return (
@@ -55,7 +49,7 @@ export default function EnvironmentSwitchModal({
               <line x1="12" y1="8" x2="12.01" y2="8" />
             </svg>
           </div>
-          <h3 className="confirm-modal-title" style={{ marginBottom: '8px' }}>切换服务器环境</h3>
+          <h3 className="confirm-modal-title" style={{ marginBottom: '8px' }}>切换运行模式</h3>
         </div>
 
         <div style={{ marginBottom: '20px' }}>
@@ -85,67 +79,11 @@ export default function EnvironmentSwitchModal({
                     style={{ margin: '2px 0 0' }}
                   />
                 </div>
-                <div style={{ display: 'inline-block', verticalAlign: 'top', marginLeft: '8px', width: 'calc(100% - 32px)' }}>
+                <div style={{ display: 'inline-block', verticalAlign: 'top', marginLeft: '8px' }}>
                   <div style={{ fontSize: '14px', lineHeight: '20px' }}>{preset.label}</div>
-                  <div
-                    style={{
-                      fontSize: '11px',
-                      color: 'var(--text-tertiary)',
-                      overflow: 'hidden',
-                      textOverflow: 'ellipsis',
-                      whiteSpace: 'nowrap',
-                    }}
-                    title={preset.url}
-                  >
-                    {preset.url}
-                  </div>
                 </div>
               </label>
             ))}
-
-            <label
-              style={{
-                display: 'block',
-                padding: '8px 12px',
-                borderRadius: '8px',
-                cursor: 'pointer',
-                background: selected === 'custom' ? 'var(--bg-hover)' : 'transparent',
-              }}
-            >
-              <div style={{ display: 'inline-block', verticalAlign: 'top', width: '20px' }}>
-                <input
-                  type="radio"
-                  name="env"
-                  value="custom"
-                  checked={selected === 'custom'}
-                  onChange={() => setSelected('custom')}
-                  style={{ margin: '2px 0 0' }}
-                />
-              </div>
-              <div style={{ display: 'inline-block', verticalAlign: 'top', marginLeft: '8px' }}>
-                <div style={{ fontSize: '14px', lineHeight: '20px' }}>自定义</div>
-              </div>
-            </label>
-
-            {selected === 'custom' && (
-              <input
-                type="text"
-                placeholder="输入 API 地址，如 http://192.168.1.100:8081/api/v1"
-                value={customUrl}
-                onChange={e => setCustomUrl(e.target.value)}
-                style={{
-                  marginLeft: '32px',
-                  padding: '8px 12px',
-                  borderRadius: '8px',
-                  border: '1px solid var(--border-light)',
-                  fontSize: '14px',
-                  background: 'var(--bg-primary)',
-                  color: 'var(--text-primary)',
-                  width: 'calc(100% - 56px)',
-                  boxSizing: 'border-box',
-                }}
-              />
-            )}
           </div>
         </div>
 

tauri-app/src/components/Modal/Modal.tsx

@@ -8,6 +8,7 @@ interface ModalProps {
   children: React.ReactNode;
   width?: string;
   centerTitle?: boolean;
+  maxHeight?: string;
 }
 
 export default function Modal({
@@ -17,6 +18,7 @@ export default function Modal({
   children,
   width = '560px',
   centerTitle = false,
+  maxHeight,
 }: ModalProps) {
   const overlayRef = useRef<HTMLDivElement>(null);
 
@@ -45,7 +47,15 @@ export default function Modal({
         }
       }}
     >
-      <div className={`modal-container animate-slideUp ${!title ? 'modal-container--no-title' : ''}`} style={{ width: '90%', maxWidth: width, position: 'relative' }}>
+      <div
+        className={`modal-container animate-slideUp ${!title ? 'modal-container--no-title' : ''}`}
+        style={{
+          width: '90%',
+          maxWidth: width,
+          position: 'relative',
+          ...(maxHeight ? { maxHeight } : {}),
+        }}
+      >
         {title && (
           <div
             className="modal-header"

tauri-app/src/components/PointsCard/PointsCard.tsx

@@ -0,0 +1,44 @@
+interface PointsCardProps {
+  balance: number;
+  todayConsumed: number;
+  onViewDetail: () => void;
+  onViewUsage: () => void;
+}
+
+export default function PointsCard({
+  balance,
+  todayConsumed,
+  onViewDetail,
+  onViewUsage,
+}: PointsCardProps) {
+  return (
+    <div className="profile-points-section">
+      <div className="profile-points-grid">
+        <div className="profile-points-card">
+          <div className="profile-points-card-header">
+            <span className="profile-points-label">剩余积分</span>
+            <span className="profile-points-corner-link" onClick={onViewDetail}>
+              充值记录 →
+            </span>
+          </div>
+          <div className="profile-points-value-row">
+            <span className="profile-points-value primary">{balance}</span>
+            <span className="profile-points-unit">分</span>
+          </div>
+        </div>
+        <div className="profile-points-card">
+          <div className="profile-points-card-header">
+            <span className="profile-points-label">今日消耗</span>
+            <span className="profile-points-corner-link" onClick={onViewUsage}>
+              消耗明细 →
+            </span>
+          </div>
+          <div className="profile-points-value-row">
+            <span className="profile-points-value danger">{todayConsumed}</span>
+            <span className="profile-points-unit">分</span>
+          </div>
+        </div>
+      </div>
+    </div>
+  );
+}