From 61fa9cb820cf0cbda3b43b59d655749dbebefb40 Mon Sep 17 00:00:00 2001
From: 237899745 <237899745@users.noreply.git.workyai.cn>
Date: Sat, 25 Jul 2026 12:23:35 +0800
Subject: [PATCH] fix: harden compression boundaries and target search

---
 README.md                       |   2 +-
 docs/api.md                     |  18 +-
 docs/billing.md                 |   1 +
 frontend/src/pages/DocsPage.vue |   7 +-
 frontend/src/pages/HomePage.vue |  53 +-
 src/api/compress.rs             |  33 +-
 src/api/tasks.rs                |   8 +-
 src/services/compress.rs        | 829 ++++++++++++++++++++++++++------
 src/worker/mod.rs               |   5 +-
 9 files changed, 787 insertions(+), 169 deletions(-)

diff --git a/README.md b/README.md
index 0605e69..dbac907 100644
--- a/README.md
+++ b/README.md
@@ -6,7 +6,7 @@
 
 ### 核心功能
 
-- **图片压缩**：支持 PNG/JPG/JPEG/WebP/AVIF/GIF/BMP/TIFF/ICO（GIF 仅静态，支持格式转换）
+- **图片压缩**：支持 PNG/JPG/JPEG/WebP/AVIF/GIF/BMP/TIFF/ICO（仅静态图片，支持格式转换）
 - **批量处理**：支持多图片同时上传和处理
 - **压缩率**：1-100（JPEG/WebP/AVIF 以该比例为体积上限；无损格式按安全方式尽力优化）
 - **用户系统**：注册、登录、API Key 管理
diff --git a/docs/api.md b/docs/api.md
index d68dd18..aa86ef5 100644
--- a/docs/api.md
+++ b/docs/api.md
@@ -272,13 +272,19 @@ Idempotency-Key: <key>          # 建议
 | 字段 | 类型 | 必填 | 说明 |
 |---|---|---:|---|
 | `file` | File | 是 | 图片文件 |
-| `compression_rate` | Integer | 否 | 压缩率 1-100；JPEG/WebP/AVIF 以该比例为体积上限，无损格式为尽力优化，100 表示不压缩；优先级高于 `level` |
+| `compression_rate` | Integer | 否 | 压缩率 1-100；JPEG/WebP/AVIF 以该比例为体积上限，无损格式为尽力优化；同格式且不缩放时，100 保留原始编码；优先级高于 `level` |
 | `level` | String | 否 | `high` / `medium` / `low`（兼容参数，默认 `medium`） |
 | `output_format` | String | 否 | 输出格式：`png/jpeg/webp/avif/gif/bmp/tiff/ico`（默认保持原格式；ICO 自动等比缩至 256x256 边界） |
-| `max_width` | Integer | 否 | 最大宽度（等比缩放） |
-| `max_height` | Integer | 否 | 最大高度（等比缩放） |
-| `target_size_bytes` | Integer | 否 | 目标体积（字节），仅 `jpeg/webp/avif` 输出支持；会优先保清晰度并在必要时小幅缩放 |
-| `preserve_metadata` | Boolean | 否 | 是否保留元数据（默认 `false`） |
+| `max_width` | Integer | 否 | 大于 0 的最大宽度（等比缩放） |
+| `max_height` | Integer | 否 | 大于 0 的最大高度（等比缩放） |
+| `target_size_bytes` | Integer | 否 | 不小于 1024 的目标体积（字节），仅 `jpeg/webp/avif` 输出支持；不能与 `compression_rate` 同时指定 |
+| `preserve_metadata` | Boolean | 否 | 是否保留 EXIF/ICC（默认 `false`）；元数据输出仅支持 `jpeg/png/webp` |
+
+处理约束：
+- 动画 GIF/APNG/WebP/AVIF 不会静默截取首帧，而是返回 `400 UNSUPPORTED_FORMAT`。
+- EXIF 方向会先应用到像素，再移除或归一化方向标记；透明图片转 JPEG 时以白色合成背景。
+- 目标体积搜索优先保持原分辨率，必要时在清晰度保护范围内缩放；仍无法达到时返回 `400 INVALID_REQUEST`，不会把超出目标的文件作为成功结果。
+- `compression_rate=100` 只有在同格式且未指定缩放时属于免计量原样请求；格式转换或缩放后若体积变小，正常计 1 次。
 
 响应：
 ```json
@@ -340,7 +346,7 @@ Idempotency-Key: <key>           # 建议
 | 字段 | 类型 | 必填 | 说明 |
 |---|---|---:|---|
 | `files[]` | File[] | 是 | 图片文件数组（上限由套餐决定） |
-| `compression_rate` | Integer | 否 | 压缩率 1-100；JPEG/WebP/AVIF 以该比例为体积上限，无损格式为尽力优化，100 表示不压缩；优先级高于 `level` |
+| `compression_rate` | Integer | 否 | 压缩率 1-100；JPEG/WebP/AVIF 以该比例为体积上限，无损格式为尽力优化；同格式且不缩放时，100 保留原始编码；优先级高于 `level` |
 | `level` | String | 否 | `high` / `medium` / `low`（兼容参数） |
 | `output_format` | String | 否 | 输出格式：`png/jpeg/webp/avif/gif/bmp/tiff/ico`（默认保持原格式） |
 | `preserve_metadata` | Boolean | 否 | 是否保留元数据（默认 `false`） |
diff --git a/docs/billing.md b/docs/billing.md
index e9ab781..781f79a 100644
--- a/docs/billing.md
+++ b/docs/billing.md
@@ -24,6 +24,7 @@
 - 同一任务中失败的文件不计费。
 - 同一请求重试若携带相同 `Idempotency-Key`，不重复计费（返回相同结果）。
 - 输出格式转换（png->webp 等）不额外加价（首期），后续可按“高级功能”计价。
+- 输出体积未变小不计费；`compression_rate=100` 仅在同格式且无缩放的原样请求中免计费，格式转换或缩放后若体积变小则正常计 1 单位。
 
 ### 1.2 套餐（Plan）
 套餐是“功能 + 配额 + 限制”的集合，建议存为可配置（DB 或配置中心）。
diff --git a/frontend/src/pages/DocsPage.vue b/frontend/src/pages/DocsPage.vue
index f9b9005..222f6b2 100644
--- a/frontend/src/pages/DocsPage.vue
+++ b/frontend/src/pages/DocsPage.vue
@@ -19,9 +19,10 @@
       <ul class="mt-2 list-disc space-y-1 pl-5">
         <li>Base URL：<code>https://ys.workyai.cn/api/v1</code></li>
         <li>认证方式：<code>X-API-Key</code>（推荐）或 <code>Authorization: Bearer &lt;token&gt;</code></li>
-        <li>支持格式：PNG / JPG / JPEG / WebP / AVIF / GIF（静态）/ BMP / TIFF / ICO（支持 output_format 转码）</li>
+        <li>支持格式：PNG / JPG / JPEG / WebP / AVIF / GIF / BMP / TIFF / ICO（仅静态图片，支持 output_format 转码）</li>
         <li>压缩率：<code>compression_rate</code> 1-100；JPEG/WebP/AVIF 以该比例为体积上限，无损格式为尽力优化</li>
-        <li>计量：成功压缩 1 个文件计 1 次；若体积未变小或压缩率为 100，则不扣额度</li>
+        <li>目标体积：<code>target_size_bytes</code> 仅支持 JPEG/WebP/AVIF，且不能与 <code>compression_rate</code> 同时提交</li>
+        <li>计量：输出体积变小时计 1 次；仅同格式、无缩放的 <code>compression_rate=100</code> 原样请求免计量</li>
       </ul>
     </div>
 
@@ -40,6 +41,7 @@
   https://ys.workyai.cn/api/v1/compress</code></pre>
       <div class="mt-3 text-xs text-slate-500">
         返回字段包含 <code>download_url</code>、<code>saved_percent</code> 与 <code>billing.units_charged</code>。
+        目标小于清晰度保护边界时返回 <code>INVALID_REQUEST</code>，不会返回超过目标的文件。
       </div>
     </div>
 
@@ -95,6 +97,7 @@ curl -H "X-API-Key: if_live_xxx" \
       <div class="font-medium text-slate-900">错误处理与常见问题</div>
       <ul class="mt-2 list-disc space-y-1 pl-5">
         <li><code>INVALID_REQUEST</code>：参数或文件不合法（检查格式与字段）</li>
+        <li><code>UNSUPPORTED_FORMAT</code>：不支持该格式或输入为动画图片</li>
         <li><code>QUOTA_EXCEEDED</code>：额度不足（升级套餐或等待周期重置）</li>
         <li><code>FORBIDDEN</code>：无权限下载该任务/文件（认证不一致）</li>
         <li><code>EMAIL_NOT_VERIFIED</code>：登录用户需先完成邮箱验证</li>
diff --git a/frontend/src/pages/HomePage.vue b/frontend/src/pages/HomePage.vue
index 5d0e14a..2717b98 100644
--- a/frontend/src/pages/HomePage.vue
+++ b/frontend/src/pages/HomePage.vue
@@ -3,7 +3,14 @@ import { computed, onMounted, reactive, ref } from 'vue'
 import { zipSync } from 'fflate'
 
 import { useAuthStore } from '@/stores/auth'
-import { compressFile, getSubscription, getUsage, sendVerification, type CompressResponse } from '@/services/api'
+import {
+  compressFile,
+  getSubscription,
+  getUsage,
+  sendVerification,
+  type CompressResponse,
+  type OutputFormat,
+} from '@/services/api'
 import { ApiError } from '@/services/http'
 import { formatBytes } from '@/utils/format'
 
@@ -22,6 +29,7 @@ const auth = useAuthStore()
 
 type CompressionMode = 'percent' | 'size'
 type OutputFormatOption = 'auto' | 'png' | 'jpeg' | 'webp' | 'avif' | 'gif' | 'bmp' | 'tiff' | 'ico'
+const targetSizeFormats = new Set<OutputFormat>(['jpeg', 'webp', 'avif'])
 
 const options = reactive({
   mode: 'percent' as CompressionMode,  // 压缩模式：百分比 / 目标大小
@@ -121,6 +129,17 @@ function getTargetSizeBytes(): number | undefined {
   return Math.round(bytes)
 }
 
+function setCompressionMode(mode: CompressionMode) {
+  options.mode = mode
+  if (
+    mode === 'size'
+    && options.outputFormat !== 'auto'
+    && !targetSizeFormats.has(options.outputFormat)
+  ) {
+    options.outputFormat = 'webp'
+  }
+}
+
 async function runOne(item: UploadItem) {
   item.status = 'compressing'
   item.error = undefined
@@ -133,7 +152,15 @@ async function runOne(item: UploadItem) {
       return
     }
 
-    const outputFormat = options.outputFormat === 'auto' ? undefined : options.outputFormat
+    const outputFormat: OutputFormat | undefined = options.outputFormat === 'auto'
+      ? (options.mode === 'size' ? 'webp' : undefined)
+      : options.outputFormat
+
+    if (options.mode === 'size' && outputFormat && !targetSizeFormats.has(outputFormat)) {
+      item.status = 'error'
+      item.error = '按目标大小仅支持 JPEG、WebP 或 AVIF 输出'
+      return
+    }
 
     const compressOptions = options.mode === 'percent'
       ? {
@@ -347,7 +374,7 @@ async function resendVerification() {
         <div class="rounded-xl border border-slate-200 bg-white p-5">
           <div class="flex items-center justify-between">
             <div class="text-sm font-medium text-slate-900">上传图片</div>
-            <div class="text-xs text-slate-500">支持 PNG / JPG / JPEG / WebP / AVIF / GIF / BMP / TIFF / ICO（GIF 仅静态）</div>
+            <div class="text-xs text-slate-500">支持 PNG / JPG / JPEG / WebP / AVIF / GIF / BMP / TIFF / ICO（仅静态图片）</div>
           </div>
 
           <div class="mt-4 flex flex-col gap-3">
@@ -503,7 +530,7 @@ async function resendVerification() {
                   type="button"
                   class="flex-1 rounded-md px-3 py-1.5 text-xs font-medium transition"
                   :class="options.mode === 'percent' ? 'bg-indigo-600 text-white' : 'text-slate-600 hover:bg-slate-100'"
-                  @click="options.mode = 'percent'"
+                  @click="setCompressionMode('percent')"
                 >
                   按百分比
                 </button>
@@ -511,7 +538,7 @@ async function resendVerification() {
                   type="button"
                   class="flex-1 rounded-md px-3 py-1.5 text-xs font-medium transition"
                   :class="options.mode === 'size' ? 'bg-indigo-600 text-white' : 'text-slate-600 hover:bg-slate-100'"
-                  @click="options.mode = 'size'"
+                  @click="setCompressionMode('size')"
                 >
                   按目标大小
                 </button>
@@ -556,7 +583,9 @@ async function resendVerification() {
                   <option value="MB">MB</option>
                 </select>
               </div>
-              <div class="text-xs text-slate-500">直接指定压缩后的目标大小，系统会自动调整质量以逼近目标（仅 JPEG/WebP/AVIF 支持）。</div>
+              <div class="text-xs text-slate-500">
+                仅支持 JPEG/WebP/AVIF；保持原格式时会自动输出 WebP，过小且无法保证清晰度的目标会被拒绝。
+              </div>
             </div>
 
             <label class="space-y-1">
@@ -565,15 +594,15 @@ async function resendVerification() {
                 v-model="options.outputFormat"
                 class="w-full rounded-md border border-slate-200 bg-white px-3 py-2 text-sm text-slate-800"
               >
-                <option value="auto">保持原格式（推荐）</option>
+                <option value="auto">{{ options.mode === 'size' ? '自动选择 WebP（推荐）' : '保持原格式（推荐）' }}</option>
                 <option value="jpeg">JPEG</option>
-                <option value="png">PNG</option>
+                <option value="png" :disabled="options.mode === 'size'">PNG</option>
                 <option value="webp">WebP</option>
                 <option value="avif">AVIF</option>
-                <option value="gif">GIF（仅静态）</option>
-                <option value="bmp">BMP</option>
-                <option value="tiff">TIFF</option>
-                <option value="ico">ICO</option>
+                <option value="gif" :disabled="options.mode === 'size'">GIF（仅静态）</option>
+                <option value="bmp" :disabled="options.mode === 'size'">BMP</option>
+                <option value="tiff" :disabled="options.mode === 'size'">TIFF</option>
+                <option value="ico" :disabled="options.mode === 'size'">ICO</option>
               </select>
               <div class="text-xs text-slate-500">支持按需转码。目标大小模式建议配合 JPEG/WebP/AVIF。</div>
             </label>
diff --git a/src/api/compress.rs b/src/api/compress.rs
index 2c3dbb5..e18275a 100644
--- a/src/api/compress.rs
+++ b/src/api/compress.rs
@@ -293,7 +293,11 @@ async fn compress_json(
         } else {
             (saved_bytes as f64) * 100.0 / (original_size as f64)
         };
-        let skip_charge = req.compression_rate == Some(100);
+        let skip_charge = req.compression_rate == Some(100)
+            && req.target_size_bytes.is_none()
+            && format_in == format_out
+            && req.max_width.is_none()
+            && req.max_height.is_none();
         let charge_units = !skip_charge && compressed_size < original_size;
 
         if charge_units {
@@ -660,7 +664,11 @@ async fn compress_direct(
         } else {
             (saved_bytes as f64) * 100.0 / (original_size as f64)
         };
-        let skip_charge = req.compression_rate == Some(100);
+        let skip_charge = req.compression_rate == Some(100)
+            && req.target_size_bytes.is_none()
+            && format_in == format_out
+            && req.max_width.is_none()
+            && req.max_height.is_none();
         let charge_units = !skip_charge && compressed_size < original_size;
 
         if !state.config.storage_type.eq_ignore_ascii_case("local") {
@@ -893,6 +901,12 @@ async fn parse_single_file_request(multipart: &mut Multipart) -> Result<Compress
     })? {
         let name = field.name().unwrap_or("").to_string();
         if name == "file" {
+            if file_bytes.is_some() {
+                return Err(AppError::new(
+                    ErrorCode::InvalidRequest,
+                    "单文件压缩接口仅允许一个 file 字段",
+                ));
+            }
             file_name = Some(field.file_name().unwrap_or("upload").to_string());
             let bytes = field.bytes().await.map_err(|err| {
                 AppError::new(ErrorCode::InvalidRequest, "读取文件失败").with_source(err)
@@ -924,17 +938,13 @@ async fn parse_single_file_request(multipart: &mut Multipart) -> Result<Compress
             "max_width" => {
                 let v = text.trim();
                 if !v.is_empty() {
-                    max_width = Some(v.parse::<u32>().map_err(|_| {
-                        AppError::new(ErrorCode::InvalidRequest, "max_width 格式错误")
-                    })?);
+                    max_width = Some(compress::parse_dimension(v, "max_width")?);
                 }
             }
             "max_height" => {
                 let v = text.trim();
                 if !v.is_empty() {
-                    max_height = Some(v.parse::<u32>().map_err(|_| {
-                        AppError::new(ErrorCode::InvalidRequest, "max_height 格式错误")
-                    })?);
+                    max_height = Some(compress::parse_dimension(v, "max_height")?);
                 }
             }
             "preserve_metadata" => {
@@ -971,6 +981,13 @@ async fn parse_single_file_request(multipart: &mut Multipart) -> Result<Compress
         file_bytes.ok_or_else(|| AppError::new(ErrorCode::InvalidRequest, "缺少 file"))?;
     let file_name = file_name.unwrap_or_else(|| "upload".to_string());
 
+    if compression_rate.is_some() && target_size_bytes.is_some() {
+        return Err(AppError::new(
+            ErrorCode::InvalidRequest,
+            "compression_rate 与 target_size_bytes 不能同时指定",
+        ));
+    }
+
     Ok(CompressRequest {
         file_name,
         file_bytes,
diff --git a/src/api/tasks.rs b/src/api/tasks.rs
index a00d2d6..114f3b0 100644
--- a/src/api/tasks.rs
+++ b/src/api/tasks.rs
@@ -530,13 +530,13 @@ async fn parse_batch_request(
             "max_width" => {
                 let v = text.trim();
                 if !v.is_empty() {
-                    opts.max_width = Some(match v.parse::<u32>() {
+                    opts.max_width = Some(match compress::parse_dimension(v, "max_width") {
                         Ok(n) => n,
                         Err(_) => {
                             cleanup_file_paths(&files).await;
                             return Err(AppError::new(
                                 ErrorCode::InvalidRequest,
-                                "max_width 格式错误",
+                                "max_width 必须为大于 0 的整数",
                             ));
                         }
                     });
@@ -545,13 +545,13 @@ async fn parse_batch_request(
             "max_height" => {
                 let v = text.trim();
                 if !v.is_empty() {
-                    opts.max_height = Some(match v.parse::<u32>() {
+                    opts.max_height = Some(match compress::parse_dimension(v, "max_height") {
                         Ok(n) => n,
                         Err(_) => {
                             cleanup_file_paths(&files).await;
                             return Err(AppError::new(
                                 ErrorCode::InvalidRequest,
-                                "max_height 格式错误",
+                                "max_height 必须为大于 0 的整数",
                             ));
                         }
                     });
diff --git a/src/services/compress.rs b/src/services/compress.rs
index 8261aed..005cda1 100644
--- a/src/services/compress.rs
+++ b/src/services/compress.rs
@@ -4,10 +4,14 @@ use crate::state::AppState;
 use image::codecs::bmp::BmpEncoder;
 use image::codecs::gif::{GifDecoder, GifEncoder};
 use image::codecs::ico::IcoEncoder;
-use image::codecs::png::PngEncoder;
+use image::codecs::png::{PngDecoder, PngEncoder};
 use image::codecs::tiff::TiffEncoder;
-use image::{AnimationDecoder, GenericImageView};
-use image::{DynamicImage, ExtendedColorType, ImageEncoder};
+use image::codecs::webp::WebPDecoder;
+use image::metadata::Orientation;
+use image::{
+    AnimationDecoder, DynamicImage, ExtendedColorType, GenericImageView, ImageDecoder,
+    ImageEncoder, ImageReader, Rgb, RgbImage,
+};
 use img_parts::{Bytes as ImgBytes, DynImage, ImageEXIF, ImageICC};
 use oxipng::StripChunks;
 use rgb::FromSlice;
@@ -15,12 +19,13 @@ use std::io::Cursor;
 
 const TARGET_MIN_LONG_EDGE: u32 = 640;
 const TARGET_MIN_SCALE: f64 = 0.55;
-const TARGET_RESIZE_ATTEMPTS: usize = 5;
-const TARGET_SCALE_REFINEMENT_ATTEMPTS: usize = 3;
+const TARGET_SCALE_SEARCH_ATTEMPTS: usize = 6;
+const TARGET_QUALITY_INTERPOLATION_ATTEMPTS: usize = 2;
 
 const JPEG_TARGET_MIN_QUALITY: u8 = 25;
 const WEBP_TARGET_MIN_QUALITY: u8 = 30;
 const AVIF_TARGET_MIN_QUALITY: u8 = 38;
+const METADATA_TARGET_OVERHEAD: u64 = 1024;
 
 #[derive(Debug, Clone, Copy)]
 pub enum CompressionLevel {
@@ -120,6 +125,20 @@ pub fn parse_compression_rate(value: &str) -> Result<u8, AppError> {
     Ok(rate)
 }
 
+pub fn parse_dimension(value: &str, field: &str) -> Result<u32, AppError> {
+    let dimension = value
+        .trim()
+        .parse::<u32>()
+        .map_err(|_| AppError::new(ErrorCode::InvalidRequest, format!("{field} 格式错误")))?;
+    if dimension == 0 {
+        return Err(AppError::new(
+            ErrorCode::InvalidRequest,
+            format!("{field} 必须大于 0"),
+        ));
+    }
+    Ok(dimension)
+}
+
 pub fn rate_to_level(rate: u8) -> CompressionLevel {
     match rate {
         1..=33 => CompressionLevel::High,
@@ -149,19 +168,39 @@ pub fn supports_target_size_format(format: ImageFmt) -> bool {
     matches!(format, ImageFmt::Jpeg | ImageFmt::Webp | ImageFmt::Avif)
 }
 
+fn supports_metadata_format(format: ImageFmt) -> bool {
+    matches!(format, ImageFmt::Jpeg | ImageFmt::Png | ImageFmt::Webp)
+}
+
 fn parse_ftyp_brands(bytes: &[u8]) -> Option<Vec<[u8; 4]>> {
     if bytes.len() < 16 || &bytes[4..8] != b"ftyp" {
         return None;
     }
 
-    let mut brands = Vec::new();
+    let declared_size = u32::from_be_bytes(bytes[0..4].try_into().ok()?);
+    let (major_offset, compatible_offset, box_end) = match declared_size {
+        0 => (8, 16, bytes.len()),
+        1 => {
+            if bytes.len() < 24 {
+                return None;
+            }
+            let extended_size = u64::from_be_bytes(bytes[8..16].try_into().ok()?);
+            let end = usize::try_from(extended_size).ok()?;
+            (16, 24, end)
+        }
+        size => (8, 16, size as usize),
+    };
+    if box_end > bytes.len() || box_end < compatible_offset {
+        return None;
+    }
 
+    let mut brands = Vec::new();
     let mut major = [0_u8; 4];
-    major.copy_from_slice(&bytes[8..12]);
+    major.copy_from_slice(bytes.get(major_offset..major_offset + 4)?);
     brands.push(major);
 
-    let mut offset = 16;
-    while offset + 4 <= bytes.len() && brands.len() < 20 {
+    let mut offset = compatible_offset;
+    while offset + 4 <= box_end && brands.len() < 20 {
         let mut brand = [0_u8; 4];
         brand.copy_from_slice(&bytes[offset..offset + 4]);
         brands.push(brand);
@@ -190,7 +229,13 @@ pub fn detect_format(bytes: &[u8]) -> Result<ImageFmt, AppError> {
         return Ok(ImageFmt::Webp);
     }
     if let Some(brands) = parse_ftyp_brands(bytes) {
-        if has_brand(&brands, &[*b"avif", *b"avis"]) {
+        if has_brand(&brands, &[*b"avis"]) {
+            return Err(AppError::new(
+                ErrorCode::UnsupportedFormat,
+                "暂不支持动画 AVIF",
+            ));
+        }
+        if has_brand(&brands, &[*b"avif"]) {
             return Ok(ImageFmt::Avif);
         }
         if has_brand(
@@ -287,10 +332,21 @@ fn compress_image_bytes_sync(
     max_image_pixels: u64,
 ) -> Result<Vec<u8>, AppError> {
     let original_size = input.len() as u64;
-    if format_in == ImageFmt::Gif && is_animated_gif(&input)? {
+
+    #[cfg(not(target_os = "linux"))]
+    if format_in == ImageFmt::Avif {
         return Err(AppError::new(
             ErrorCode::UnsupportedFormat,
-            "暂不支持动图 GIF",
+            "当前平台构建不支持 AVIF 解码，请转换为 PNG/JPEG/WebP 后重试",
+        ));
+    }
+
+    let orientation = inspect_image(&input, max_image_pixels)?;
+
+    if is_animated_image(&input, format_in)? {
+        return Err(AppError::new(
+            ErrorCode::UnsupportedFormat,
+            format!("暂不支持动画 {}", format_in.as_str().to_ascii_uppercase()),
         ));
     }
 
@@ -301,10 +357,13 @@ fn compress_image_bytes_sync(
         None => compression_rate.map(|value| target_size_from_rate(original_size, value)),
     };
 
-    if compression_rate == Some(100)
+    // If the original already satisfies a same-format target, keeping it is
+    // both the highest-quality and the smallest amount of work.
+    if target_size.is_some_and(|target| original_size <= target)
         && format_in == format_out
         && max_width.is_none()
         && max_height.is_none()
+        && (preserve_metadata || orientation == Orientation::NoTransforms)
     {
         if preserve_metadata {
             return Ok(input);
@@ -313,19 +372,53 @@ fn compress_image_bytes_sync(
         return Ok(stripped);
     }
 
-    let (icc_profile, exif) = if preserve_metadata {
+    let (icc_profile, mut exif) = if preserve_metadata {
         extract_metadata(&input)
     } else {
         (None, None)
     };
 
+    if preserve_metadata
+        && (icc_profile.is_some() || exif.is_some())
+        && !supports_metadata_format(format_out)
+    {
+        return Err(AppError::new(
+            ErrorCode::InvalidRequest,
+            format!(
+                "输出 {} 暂不支持保留 EXIF/ICC 元数据，请关闭保留元数据或改用 jpeg/png/webp",
+                format_out.as_str()
+            ),
+        ));
+    }
+
+    if orientation != Orientation::NoTransforms {
+        if let Some(exif_bytes) = exif.take() {
+            let mut normalized = exif_bytes.to_vec();
+            let _ = Orientation::remove_from_exif_chunk(&mut normalized);
+            exif = Some(ImgBytes::from(normalized));
+        }
+    }
+
+    let encoding_target_size = target_size
+        .map(|target| {
+            target_size_without_metadata(
+                target,
+                format_out,
+                preserve_metadata,
+                icc_profile.as_ref(),
+                exif.as_ref(),
+            )
+        })
+        .transpose()?;
+
     let strength_rate = strength_from_rate(retention_rate);
 
-    let mut resized = false;
+    let mut transformed = orientation != Orientation::NoTransforms;
     let mut output = if format_in == ImageFmt::Png
         && format_out == ImageFmt::Png
         && max_width.is_none()
         && max_height.is_none()
+        && orientation == Orientation::NoTransforms
     {
         let preset = png_preset_from_rate(strength_rate);
         let mut opts = oxipng::Options::from_preset(preset);
@@ -336,34 +429,24 @@ fn compress_image_bytes_sync(
             AppError::new(ErrorCode::CompressionFailed, "PNG 压缩失败").with_source(err)
         })?
     } else {
-        #[cfg(not(target_os = "linux"))]
-        if format_in == ImageFmt::Avif {
-            return Err(AppError::new(
-                ErrorCode::UnsupportedFormat,
-                "当前平台构建不支持 AVIF 解码，请转换为 PNG/JPEG/WebP 后重试",
-            ));
-        }
+        let mut image = decode_image(&input, format_in)?;
 
-        let image = image::load_from_memory(&input).map_err(|err| {
-            AppError::new(ErrorCode::InvalidImage, "图片解码失败").with_source(err)
-        })?;
-
-        enforce_pixel_limit(max_image_pixels, &image)?;
+        image.apply_orientation(orientation);
 
         let (image, did_resize) = resize_if_needed(image, max_width, max_height);
-        resized = did_resize;
+        transformed |= did_resize;
 
         match format_out {
             ImageFmt::Png => encode_png(image, strength_rate, preserve_metadata)?,
-            ImageFmt::Jpeg => match target_size {
+            ImageFmt::Jpeg => match encoding_target_size {
                 Some(target) => encode_jpeg_target(image, target)?,
                 None => encode_jpeg(image, strength_rate)?,
             },
-            ImageFmt::Webp => match target_size {
+            ImageFmt::Webp => match encoding_target_size {
                 Some(target) => encode_webp_target(image, target)?,
                 None => encode_webp(image, strength_rate)?,
             },
-            ImageFmt::Avif => match target_size {
+            ImageFmt::Avif => match encoding_target_size {
                 Some(target) => encode_avif_target(image, target)?,
                 None => encode_avif(image, strength_rate)?,
             },
@@ -378,7 +461,13 @@ fn compress_image_bytes_sync(
         output = apply_metadata(output, icc_profile, exif)?;
     }
 
-    if format_in == format_out && !resized && output.len() >= input.len() {
+    if let Some(target) = target_size {
+        if supports_target_size_format(format_out) && output.len() as u64 > target {
+            return Err(target_unreachable_error(target, output.len() as u64));
+        }
+    }
+
+    if format_in == format_out && !transformed && output.len() >= input.len() {
         if preserve_metadata {
             return Ok(input);
         }
@@ -393,8 +482,14 @@ fn compress_image_bytes_sync(
     Ok(output)
 }
 
-fn enforce_pixel_limit(max_image_pixels: u64, image: &DynamicImage) -> Result<(), AppError> {
-    let (w, h) = image.dimensions();
+fn inspect_image(input: &[u8], max_image_pixels: u64) -> Result<Orientation, AppError> {
+    let reader = ImageReader::new(Cursor::new(input))
+        .with_guessed_format()
+        .map_err(|err| AppError::new(ErrorCode::InvalidImage, "读取图片头失败").with_source(err))?;
+    let mut decoder = reader.into_decoder().map_err(|err| {
+        AppError::new(ErrorCode::InvalidImage, "读取图片尺寸失败").with_source(err)
+    })?;
+    let (w, h) = decoder.dimensions();
     let pixels = (w as u64).saturating_mul(h as u64);
     if pixels > max_image_pixels {
         return Err(AppError::new(
@@ -402,7 +497,115 @@ fn enforce_pixel_limit(max_image_pixels: u64, image: &DynamicImage) -> Result<()
             format!("图片像素过大（{}x{}）", w, h),
         ));
     }
-    Ok(())
+    decoder
+        .orientation()
+        .map_err(|err| AppError::new(ErrorCode::InvalidImage, "读取图片方向失败").with_source(err))
+}
+
+fn decode_image(input: &[u8], format: ImageFmt) -> Result<DynamicImage, AppError> {
+    match image::load_from_memory(input) {
+        Ok(image) => Ok(image),
+        Err(primary_error) => {
+            // image-rs deliberately rejects ICO files whose embedded PNG is not
+            // RGBA, although RGB PNG icons are produced by common tooling.
+            if format == ImageFmt::Ico {
+                if let Some(image) = decode_ico_png_entry(input) {
+                    return Ok(image);
+                }
+            }
+            Err(AppError::new(ErrorCode::InvalidImage, "图片解码失败").with_source(primary_error))
+        }
+    }
+}
+
+fn decode_ico_png_entry(input: &[u8]) -> Option<DynamicImage> {
+    if input.len() < 6
+        || u16::from_le_bytes(input[0..2].try_into().ok()?) != 0
+        || u16::from_le_bytes(input[2..4].try_into().ok()?) != 1
+    {
+        return None;
+    }
+
+    let count = usize::from(u16::from_le_bytes(input[4..6].try_into().ok()?));
+    let table_end = 6_usize.checked_add(count.checked_mul(16)?)?;
+    if count == 0 || table_end > input.len() {
+        return None;
+    }
+
+    let mut selected: Option<(u16, u32, u32, u32, u32, u32)> = None;
+    for index in 0..count {
+        let entry = 6 + index * 16;
+        let width = if input[entry] == 0 {
+            256
+        } else {
+            u32::from(input[entry])
+        };
+        let height = if input[entry + 1] == 0 {
+            256
+        } else {
+            u32::from(input[entry + 1])
+        };
+        let bits = u16::from_le_bytes(input[entry + 6..entry + 8].try_into().ok()?);
+        let length = u32::from_le_bytes(input[entry + 8..entry + 12].try_into().ok()?);
+        let offset = u32::from_le_bytes(input[entry + 12..entry + 16].try_into().ok()?);
+        let pixels = width.saturating_mul(height);
+        if selected.is_none_or(|(best_bits, best_pixels, _, _, _, _)| {
+            (bits, pixels) >= (best_bits, best_pixels)
+        }) {
+            selected = Some((bits, pixels, width, height, length, offset));
+        }
+    }
+
+    let (_, _, expected_width, expected_height, length, offset) = selected?;
+    let start = usize::try_from(offset).ok()?;
+    let end = start.checked_add(usize::try_from(length).ok()?)?;
+    let embedded = input.get(start..end)?;
+    if !embedded.starts_with(b"\x89PNG\r\n\x1a\n") {
+        return None;
+    }
+
+    let image = image::load_from_memory_with_format(embedded, image::ImageFormat::Png).ok()?;
+    (image.dimensions() == (expected_width, expected_height)).then_some(image)
+}
+
+fn target_size_without_metadata(
+    target_size: u64,
+    format_out: ImageFmt,
+    preserve_metadata: bool,
+    icc_profile: Option<&ImgBytes>,
+    exif: Option<&ImgBytes>,
+) -> Result<u64, AppError> {
+    if !preserve_metadata || !supports_metadata_format(format_out) {
+        return Ok(target_size);
+    }
+
+    let payload_size = icc_profile
+        .map(|bytes| bytes.len() as u64)
+        .unwrap_or_default()
+        .saturating_add(exif.map(|bytes| bytes.len() as u64).unwrap_or_default());
+    if payload_size == 0 {
+        return Ok(target_size);
+    }
+
+    let reservation = payload_size.saturating_add(METADATA_TARGET_OVERHEAD);
+    if reservation >= target_size {
+        return Err(AppError::new(
+            ErrorCode::InvalidRequest,
+            format!(
+                "目标体积 {target_size} 字节不足以保留约 {payload_size} 字节的元数据，请提高目标大小或关闭保留元数据"
+            ),
+        ));
+    }
+    Ok(target_size - reservation)
+}
+
+fn target_unreachable_error(target_size: u64, smallest_size: u64) -> AppError {
+    AppError::new(
+        ErrorCode::InvalidRequest,
+        format!(
+            "目标体积 {target_size} 字节在清晰度保护范围内无法达到，当前最小约 {smallest_size} 字节；请提高目标大小/比例或改用 AVIF/WebP"
+        ),
+    )
 }
 
 fn resize_if_needed(
@@ -469,11 +672,29 @@ fn encode_jpeg(image: DynamicImage, rate: u8) -> Result<Vec<u8>, AppError> {
 }
 
 fn encode_jpeg_with_quality(image: DynamicImage, quality: u8) -> Result<Vec<u8>, AppError> {
-    let rgb = image.to_rgb8();
+    let rgb = jpeg_rgb(&image);
     let (w, h) = rgb.dimensions();
     encode_jpeg_raw(rgb.as_raw(), w, h, quality)
 }
 
+fn jpeg_rgb(image: &DynamicImage) -> RgbImage {
+    if !image.color().has_alpha() {
+        return image.to_rgb8();
+    }
+
+    let rgba = image.to_rgba8();
+    RgbImage::from_fn(rgba.width(), rgba.height(), |x, y| {
+        let pixel = rgba.get_pixel(x, y).0;
+        let alpha = u16::from(pixel[3]);
+        let inverse_alpha = 255 - alpha;
+        Rgb([
+            ((u16::from(pixel[0]) * alpha + 255 * inverse_alpha + 127) / 255) as u8,
+            ((u16::from(pixel[1]) * alpha + 255 * inverse_alpha + 127) / 255) as u8,
+            ((u16::from(pixel[2]) * alpha + 255 * inverse_alpha + 127) / 255) as u8,
+        ])
+    })
+}
+
 fn encode_jpeg_raw(raw: &[u8], w: u32, h: u32, quality: u8) -> Result<Vec<u8>, AppError> {
     let width = u16::try_from(w)
         .map_err(|_| AppError::new(ErrorCode::InvalidImage, "JPEG 宽度不能超过 65535 像素"))?;
@@ -540,7 +761,7 @@ fn encode_avif_raw(raw: &[u8], w: u32, h: u32, quality: u8) -> Result<Vec<u8>, A
 
 fn encode_jpeg_target(image: DynamicImage, target_size: u64) -> Result<Vec<u8>, AppError> {
     encode_with_auto_resize(image, target_size, JPEG_TARGET_MIN_QUALITY, 95, |img, q| {
-        let rgb = img.to_rgb8();
+        let rgb = jpeg_rgb(img);
         let (w, h) = rgb.dimensions();
         encode_jpeg_raw(rgb.as_raw(), w, h, q)
     })
@@ -566,8 +787,9 @@ fn encode_avif_target(image: DynamicImage, target_size: u64) -> Result<Vec<u8>,
 ///
 /// 策略：
 /// 1) 先在原图尺寸内二分质量，尽量保持清晰度；
-/// 2) 仅在无法接近目标时，才逐步缩小尺寸；
-/// 3) 严格限制最小缩放比例，避免“过度糊图”。
+/// 2) 原尺寸失败时先验证最低允许尺寸，快速识别不可达目标；
+/// 3) 最低尺寸可达时，二分查找满足目标的最高分辨率；
+/// 4) 严格限制最小缩放比例，避免“过度糊图”。
 fn encode_with_auto_resize<F>(
     image: DynamicImage,
     target_size: u64,
@@ -583,103 +805,98 @@ where
     let long_edge_floor = TARGET_MIN_LONG_EDGE.min(long_edge) as f64 / long_edge as f64;
     let min_scale = TARGET_MIN_SCALE.max(long_edge_floor).min(1.0);
 
-    let mut scales = Vec::with_capacity(TARGET_RESIZE_ATTEMPTS + 1);
-    scales.push(1.0);
-    for step in 1..=TARGET_RESIZE_ATTEMPTS {
-        let ratio = step as f64 / TARGET_RESIZE_ATTEMPTS as f64;
-        scales.push(1.0 - (1.0 - min_scale) * ratio);
+    let (full_result, full_dimensions) =
+        encode_target_at_scale(&image, 1.0, min_q, max_q, target_size, &mut encode_fn)?;
+    if full_result.len() as u64 <= target_size {
+        return Ok(full_result);
     }
 
-    let mut best_over: Option<(Vec<u8>, u64, u64)> = None;
-    let mut previous_over_scale = 1.0;
-    let mut last_dimensions: Option<(u32, u32)> = None;
+    if min_scale >= 1.0 {
+        return Err(target_unreachable_error(
+            target_size,
+            full_result.len() as u64,
+        ));
+    }
 
-    for scale in scales {
-        let new_w = ((orig_w as f64 * scale).round() as u32).clamp(1, orig_w);
-        let new_h = ((orig_h as f64 * scale).round() as u32).clamp(1, orig_h);
-        if last_dimensions == Some((new_w, new_h)) {
+    let (min_result, min_dimensions) =
+        encode_target_at_scale(&image, min_scale, min_q, max_q, target_size, &mut encode_fn)?;
+    if min_result.len() as u64 > target_size {
+        return Err(target_unreachable_error(
+            target_size,
+            min_result.len() as u64,
+        ));
+    }
+
+    let mut best_under = min_result;
+    let mut under_scale = min_scale;
+    let mut under_dimensions = min_dimensions;
+    let mut over_scale = 1.0;
+    let mut over_dimensions = full_dimensions;
+
+    for _ in 0..TARGET_SCALE_SEARCH_ATTEMPTS {
+        let candidate_scale = (under_scale + over_scale) / 2.0;
+        let candidate_dimensions = dimensions_at_scale(orig_w, orig_h, candidate_scale);
+
+        if candidate_dimensions == under_dimensions {
+            under_scale = candidate_scale;
+            continue;
+        }
+        if candidate_dimensions == over_dimensions {
+            over_scale = candidate_scale;
             continue;
         }
-        last_dimensions = Some((new_w, new_h));
 
-        let resized = if new_w == orig_w && new_h == orig_h {
-            image.clone()
+        let (candidate_result, _) = encode_target_at_scale(
+            &image,
+            candidate_scale,
+            min_q,
+            max_q,
+            target_size,
+            &mut encode_fn,
+        )?;
+        if candidate_result.len() as u64 <= target_size {
+            best_under = candidate_result;
+            under_scale = candidate_scale;
+            under_dimensions = candidate_dimensions;
         } else {
-            image.resize_exact(new_w, new_h, image::imageops::FilterType::Lanczos3)
-        };
-
-        let result =
-            encode_target_quality_with_image(&resized, min_q, max_q, target_size, &mut encode_fn)?;
-        let result_size = result.len() as u64;
-
-        if result_size <= target_size {
-            if new_w == orig_w && new_h == orig_h {
-                return Ok(result);
-            }
-
-            // The first passing coarse scale has the highest resolution. Refine the
-            // boundary between it and the preceding failing scale before returning.
-            let mut best_under = result;
-            let mut under_scale = scale;
-            let mut over_scale = previous_over_scale;
-            let mut under_dimensions = (new_w, new_h);
-
-            for _ in 0..TARGET_SCALE_REFINEMENT_ATTEMPTS {
-                let candidate_scale = (under_scale + over_scale) / 2.0;
-                let candidate_w =
-                    ((orig_w as f64 * candidate_scale).round() as u32).clamp(1, orig_w);
-                let candidate_h =
-                    ((orig_h as f64 * candidate_scale).round() as u32).clamp(1, orig_h);
-                if (candidate_w, candidate_h) == under_dimensions {
-                    break;
-                }
-
-                let candidate = image.resize_exact(
-                    candidate_w,
-                    candidate_h,
-                    image::imageops::FilterType::Lanczos3,
-                );
-                let candidate_result = encode_target_quality_with_image(
-                    &candidate,
-                    min_q,
-                    max_q,
-                    target_size,
-                    &mut encode_fn,
-                )?;
-                if candidate_result.len() as u64 <= target_size {
-                    best_under = candidate_result;
-                    under_scale = candidate_scale;
-                    under_dimensions = (candidate_w, candidate_h);
-                } else {
-                    over_scale = candidate_scale;
-                }
-            }
-
-            return Ok(best_under);
-        } else {
-            let should_update = match &best_over {
-                None => true,
-                Some((_bytes, best_size, best_pixels)) => {
-                    let over = result_size.saturating_sub(target_size);
-                    let best_over_by = best_size.saturating_sub(target_size);
-                    let new_pixels = (new_w as u64).saturating_mul(new_h as u64);
-                    over < best_over_by || (over == best_over_by && new_pixels > *best_pixels)
-                }
-            };
-
-            if should_update {
-                let pixels = (new_w as u64).saturating_mul(new_h as u64);
-                best_over = Some((result, result_size, pixels));
-            }
-            previous_over_scale = scale;
+            over_scale = candidate_scale;
+            over_dimensions = candidate_dimensions;
         }
     }
 
-    if let Some((bytes, _, _)) = best_over {
-        return Ok(bytes);
-    }
+    Ok(best_under)
+}
 
-    Err(AppError::new(ErrorCode::CompressionFailed, "压缩失败"))
+fn dimensions_at_scale(orig_w: u32, orig_h: u32, scale: f64) -> (u32, u32) {
+    (
+        ((orig_w as f64 * scale).round() as u32).clamp(1, orig_w),
+        ((orig_h as f64 * scale).round() as u32).clamp(1, orig_h),
+    )
+}
+
+fn encode_target_at_scale<F>(
+    image: &DynamicImage,
+    scale: f64,
+    min_q: u8,
+    max_q: u8,
+    target_size: u64,
+    encode_fn: &mut F,
+) -> Result<(Vec<u8>, (u32, u32)), AppError>
+where
+    F: FnMut(&DynamicImage, u8) -> Result<Vec<u8>, AppError>,
+{
+    let (orig_w, orig_h) = image.dimensions();
+    let dimensions = dimensions_at_scale(orig_w, orig_h, scale);
+    let resized = (dimensions != (orig_w, orig_h)).then(|| {
+        image.resize_exact(
+            dimensions.0,
+            dimensions.1,
+            image::imageops::FilterType::Lanczos3,
+        )
+    });
+    let candidate = resized.as_ref().unwrap_or(image);
+    let result = encode_target_quality_with_image(candidate, min_q, max_q, target_size, encode_fn)?;
+    Ok((result, dimensions))
 }
 
 /// 对给定图片进行二分质量搜索
@@ -696,27 +913,64 @@ where
     // Start with the highest quality. If it already fits, no lower-quality
     // encodes can improve the result.
     let max_quality = encode_fn(image, max_q)?;
-    if max_quality.len() as u64 <= target_size || min_q == max_q {
+    let max_size = max_quality.len() as u64;
+    if max_size <= target_size || min_q == max_q {
         return Ok(max_quality);
     }
 
     let min_quality = encode_fn(image, min_q)?;
-    if min_quality.len() as u64 > target_size {
+    let min_size = min_quality.len() as u64;
+    if min_size > target_size {
         return Ok(min_quality);
     }
 
     let mut best_under = min_quality;
-    let mut low = min_q.saturating_add(1);
-    let mut high = max_q.saturating_sub(1);
-    while low <= high {
-        let mid = (low + high) / 2;
+    let mut under_q = min_q;
+    let mut under_size = min_size;
+    let mut over_q = max_q;
+    let mut over_size = max_size;
+
+    // Encoded size is usually close to monotonic in quality. Interpolation
+    // jumps near the target first; the binary phase still proves the exact
+    // highest fitting integer quality, so output quality is not approximated.
+    for _ in 0..TARGET_QUALITY_INTERPOLATION_ATTEMPTS {
+        if under_q.saturating_add(1) >= over_q {
+            break;
+        }
+
+        let quality_span = u64::from(over_q - under_q);
+        let size_span = over_size.saturating_sub(under_size);
+        let estimated_offset = if size_span == 0 {
+            quality_span / 2
+        } else {
+            target_size
+                .saturating_sub(under_size)
+                .saturating_mul(quality_span)
+                / size_span
+        };
+        let candidate_q =
+            under_q.saturating_add(estimated_offset.clamp(1, quality_span.saturating_sub(1)) as u8);
+        let bytes = encode_fn(image, candidate_q)?;
+        let size = bytes.len() as u64;
+        if size > target_size {
+            over_q = candidate_q;
+            over_size = size;
+        } else {
+            best_under = bytes;
+            under_q = candidate_q;
+            under_size = size;
+        }
+    }
+
+    while under_q.saturating_add(1) < over_q {
+        let mid = under_q + (over_q - under_q) / 2;
         let bytes = encode_fn(image, mid)?;
         let size = bytes.len() as u64;
         if size > target_size {
-            high = mid.saturating_sub(1);
+            over_q = mid;
         } else {
             best_under = bytes;
-            low = mid.saturating_add(1);
+            under_q = mid;
         }
     }
 
@@ -907,10 +1161,141 @@ fn is_animated_gif(input: &[u8]) -> Result<bool, AppError> {
     Ok(false)
 }
 
+fn is_animated_image(input: &[u8], format: ImageFmt) -> Result<bool, AppError> {
+    match format {
+        ImageFmt::Gif => is_animated_gif(input),
+        ImageFmt::Png => {
+            let decoder = PngDecoder::new(Cursor::new(input)).map_err(|err| {
+                AppError::new(ErrorCode::InvalidImage, "PNG 解码失败").with_source(err)
+            })?;
+            decoder.is_apng().map_err(|err| {
+                AppError::new(ErrorCode::InvalidImage, "PNG 动画检测失败").with_source(err)
+            })
+        }
+        ImageFmt::Webp => {
+            let decoder = WebPDecoder::new(Cursor::new(input)).map_err(|err| {
+                AppError::new(ErrorCode::InvalidImage, "WebP 解码失败").with_source(err)
+            })?;
+            Ok(decoder.has_animation())
+        }
+        _ => Ok(false),
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
 
+    fn crc32(bytes: &[u8]) -> u32 {
+        let mut crc = u32::MAX;
+        for byte in bytes {
+            crc ^= u32::from(*byte);
+            for _ in 0..8 {
+                crc = (crc >> 1) ^ (0xedb8_8320 & (0_u32.wrapping_sub(crc & 1)));
+            }
+        }
+        !crc
+    }
+
+    fn apng_header() -> Vec<u8> {
+        let png = encode_png(DynamicImage::new_rgba8(2, 2), 100, false).unwrap();
+        let ihdr_end = 8 + 4 + 4 + 13 + 4;
+        let mut chunk = Vec::new();
+        chunk.extend_from_slice(&8_u32.to_be_bytes());
+        chunk.extend_from_slice(b"acTL");
+        chunk.extend_from_slice(&2_u32.to_be_bytes());
+        chunk.extend_from_slice(&0_u32.to_be_bytes());
+        chunk.extend_from_slice(&crc32(&chunk[4..]).to_be_bytes());
+
+        let mut output = Vec::with_capacity(png.len() + chunk.len());
+        output.extend_from_slice(&png[..ihdr_end]);
+        output.extend_from_slice(&chunk);
+        output.extend_from_slice(&png[ihdr_end..]);
+        output
+    }
+
+    fn animated_webp() -> Vec<u8> {
+        let mut config = webp::WebPConfig::new().unwrap();
+        config.lossless = 1;
+        let red = [255_u8, 0, 0, 255].repeat(16);
+        let blue = [0_u8, 0, 255, 255].repeat(16);
+        let mut encoder = webp::AnimEncoder::new(4, 4, &config);
+        encoder.add_frame(webp::AnimFrame::from_rgba(&red, 4, 4, 0));
+        encoder.add_frame(webp::AnimFrame::from_rgba(&blue, 4, 4, 100));
+        encoder.encode().to_vec()
+    }
+
+    fn rgb_png_ico() -> Vec<u8> {
+        let width = 16_u32;
+        let height = 10_u32;
+        let rgb = [32_u8, 128, 224].repeat((width * height) as usize);
+        let mut png = Vec::new();
+        PngEncoder::new(&mut png)
+            .write_image(&rgb, width, height, ExtendedColorType::Rgb8)
+            .unwrap();
+
+        let mut ico = Vec::new();
+        ico.extend_from_slice(&0_u16.to_le_bytes());
+        ico.extend_from_slice(&1_u16.to_le_bytes());
+        ico.extend_from_slice(&1_u16.to_le_bytes());
+        ico.extend_from_slice(&[width as u8, height as u8, 0, 0]);
+        ico.extend_from_slice(&1_u16.to_le_bytes());
+        ico.extend_from_slice(&24_u16.to_le_bytes());
+        ico.extend_from_slice(&(png.len() as u32).to_le_bytes());
+        ico.extend_from_slice(&22_u32.to_le_bytes());
+        ico.extend_from_slice(&png);
+        ico
+    }
+
+    fn jpeg_with_orientation(width: u16, height: u16, orientation: u8) -> Vec<u8> {
+        let mut raw = Vec::with_capacity(width as usize * height as usize * 3);
+        for y in 0..height {
+            for x in 0..width {
+                raw.extend_from_slice(&[
+                    (x % 256) as u8,
+                    (y % 256) as u8,
+                    ((u32::from(x) + u32::from(y)) % 256) as u8,
+                ]);
+            }
+        }
+
+        let exif = [
+            b'I',
+            b'I',
+            42,
+            0,
+            8,
+            0,
+            0,
+            0, // Little-endian TIFF header.
+            1,
+            0, // One IFD entry.
+            0x12,
+            0x01,
+            3,
+            0,
+            1,
+            0,
+            0,
+            0,
+            orientation,
+            0,
+            0,
+            0,
+            0,
+            0,
+            0,
+            0,
+        ];
+        let mut output = Vec::new();
+        let mut encoder = jpeg_encoder::Encoder::new(&mut output, 95);
+        encoder.add_exif_metadata(&exif).unwrap();
+        encoder
+            .encode(&raw, width, height, jpeg_encoder::ColorType::Rgb)
+            .unwrap();
+        output
+    }
+
     #[test]
     fn detects_supported_formats_from_signatures() {
         assert_eq!(detect_format(b"\x89PNG\r\n\x1a\n").unwrap(), ImageFmt::Png);
@@ -925,12 +1310,55 @@ mod tests {
 
     #[test]
     fn detects_avif_and_rejects_heic() {
-        let avif = b"\x00\x00\x00\x18ftypavif\x00\x00\x00\x00avif";
+        let avif = b"\x00\x00\x00\x14ftypavif\x00\x00\x00\x00avif";
         assert_eq!(detect_format(avif).unwrap(), ImageFmt::Avif);
 
-        let heic = b"\x00\x00\x00\x18ftypheic\x00\x00\x00\x00mif1";
+        let heic = b"\x00\x00\x00\x14ftypheic\x00\x00\x00\x00mif1";
         let error = detect_format(heic).unwrap_err();
         assert_eq!(error.code, ErrorCode::UnsupportedFormat);
+
+        let mut bounded_ftyp = b"\x00\x00\x00\x10ftypavif\x00\x00\x00\x00".to_vec();
+        bounded_ftyp.extend_from_slice(b"avis");
+        assert_eq!(detect_format(&bounded_ftyp).unwrap(), ImageFmt::Avif);
+    }
+
+    #[test]
+    fn rejects_animated_png_webp_and_avif_sequence() {
+        assert!(is_animated_image(&apng_header(), ImageFmt::Png).unwrap());
+        assert!(is_animated_image(&animated_webp(), ImageFmt::Webp).unwrap());
+
+        let mut avif_sequence = Vec::new();
+        avif_sequence.extend_from_slice(&24_u32.to_be_bytes());
+        avif_sequence.extend_from_slice(b"ftypavis");
+        avif_sequence.extend_from_slice(&0_u32.to_be_bytes());
+        avif_sequence.extend_from_slice(b"avisavif");
+        let error = detect_format(&avif_sequence).unwrap_err();
+        assert_eq!(error.code, ErrorCode::UnsupportedFormat);
+        assert!(error.message.contains("动画 AVIF"));
+    }
+
+    #[test]
+    fn decodes_ico_with_an_embedded_rgb_png() {
+        let input = rgb_png_ico();
+        assert!(image::load_from_memory(&input).is_err());
+
+        let decoded = decode_image(&input, ImageFmt::Ico).unwrap();
+        assert_eq!(decoded.dimensions(), (16, 10));
+
+        let output = compress_image_bytes_sync(
+            input,
+            ImageFmt::Ico,
+            ImageFmt::Webp,
+            CompressionLevel::Low,
+            None,
+            None,
+            None,
+            None,
+            false,
+            1_000_000,
+        )
+        .unwrap();
+        assert_eq!(detect_format(&output).unwrap(), ImageFmt::Webp);
     }
 
     #[test]
@@ -947,6 +1375,15 @@ mod tests {
         assert_eq!(target_size_from_rate(10_000, 100), 10_000);
     }
 
+    #[test]
+    fn dimensions_must_be_positive() {
+        assert_eq!(parse_dimension("128", "max_width").unwrap(), 128);
+        assert_eq!(
+            parse_dimension("0", "max_width").unwrap_err().code,
+            ErrorCode::InvalidRequest
+        );
+    }
+
     #[test]
     fn target_encoder_stops_when_full_resolution_meets_target() {
         use std::cell::Cell;
@@ -963,6 +1400,23 @@ mod tests {
         assert_eq!(calls.get(), 1);
     }
 
+    #[test]
+    fn target_quality_interpolation_finds_the_exact_boundary() {
+        use std::cell::RefCell;
+
+        let calls = RefCell::new(Vec::new());
+        let image = DynamicImage::new_rgb8(32, 32);
+        let result =
+            encode_target_quality_with_image(&image, 25, 95, 50_000, &mut |_image, quality| {
+                calls.borrow_mut().push(quality);
+                Ok(vec![0; usize::from(quality) * 1_000])
+            })
+            .unwrap();
+
+        assert_eq!(result.len(), 50_000);
+        assert_eq!(*calls.borrow(), vec![95, 25, 50, 51]);
+    }
+
     #[test]
     fn target_encoder_can_reduce_a_landscape_at_the_long_edge_floor() {
         let image = DynamicImage::new_rgb8(960, 640);
@@ -975,6 +1429,111 @@ mod tests {
         assert!(result.len() <= 40_000);
     }
 
+    #[test]
+    fn target_encoder_rejects_an_unreachable_target() {
+        use std::cell::Cell;
+
+        let calls = Cell::new(0);
+        let error = encode_with_auto_resize(
+            DynamicImage::new_rgb8(960, 640),
+            1_000,
+            40,
+            40,
+            |_image, _quality| {
+                calls.set(calls.get() + 1);
+                Ok(vec![0; 50_000])
+            },
+        )
+        .unwrap_err();
+
+        assert_eq!(error.code, ErrorCode::InvalidRequest);
+        assert!(error.message.contains("无法达到"));
+        assert_eq!(calls.get(), 2);
+    }
+
+    #[test]
+    fn png_fast_path_enforces_the_pixel_limit() {
+        let input = encode_png(DynamicImage::new_rgb8(20, 20), 100, false).unwrap();
+        let error = compress_image_bytes_sync(
+            input,
+            ImageFmt::Png,
+            ImageFmt::Png,
+            CompressionLevel::Low,
+            Some(100),
+            None,
+            None,
+            None,
+            true,
+            399,
+        )
+        .unwrap_err();
+
+        assert_eq!(error.code, ErrorCode::TooManyPixels);
+    }
+
+    #[test]
+    fn exif_orientation_is_applied_before_metadata_is_removed() {
+        let input = jpeg_with_orientation(120, 80, 6);
+        assert_eq!(
+            inspect_image(&input, 1_000_000).unwrap(),
+            Orientation::Rotate90
+        );
+
+        let output = compress_image_bytes_sync(
+            input,
+            ImageFmt::Jpeg,
+            ImageFmt::Png,
+            CompressionLevel::Medium,
+            None,
+            None,
+            None,
+            None,
+            false,
+            1_000_000,
+        )
+        .unwrap();
+        let decoded = image::load_from_memory(&output).unwrap();
+
+        assert_eq!(decoded.dimensions(), (80, 120));
+        assert_eq!(
+            inspect_image(&output, 1_000_000).unwrap(),
+            Orientation::NoTransforms
+        );
+    }
+
+    #[test]
+    fn jpeg_alpha_is_composited_onto_white() {
+        let image = DynamicImage::ImageRgba8(image::RgbaImage::from_pixel(
+            2,
+            1,
+            image::Rgba([0, 0, 0, 0]),
+        ));
+        let rgb = jpeg_rgb(&image);
+        assert_eq!(rgb.get_pixel(0, 0).0, [255, 255, 255]);
+
+        let image = DynamicImage::ImageRgba8(image::RgbaImage::from_pixel(
+            1,
+            1,
+            image::Rgba([255, 0, 0, 128]),
+        ));
+        assert_eq!(jpeg_rgb(&image).get_pixel(0, 0).0, [255, 127, 127]);
+    }
+
+    #[test]
+    fn metadata_bytes_are_reserved_from_the_encoding_target() {
+        let exif = ImgBytes::from(vec![0; 2_000]);
+        assert_eq!(
+            target_size_without_metadata(10_000, ImageFmt::Jpeg, true, None, Some(&exif)).unwrap(),
+            6_976
+        );
+        assert_eq!(
+            target_size_without_metadata(3_000, ImageFmt::Jpeg, true, None, Some(&exif))
+                .unwrap_err()
+                .code,
+            ErrorCode::InvalidRequest
+        );
+    }
+
     #[test]
     fn format_conversion_never_returns_the_original_encoding() {
         let input = encode_png(DynamicImage::new_rgba8(10, 10), 100, false).unwrap();
diff --git a/src/worker/mod.rs b/src/worker/mod.rs
index b0119be..430d7a1 100644
--- a/src/worker/mod.rs
+++ b/src/worker/mod.rs
@@ -456,7 +456,10 @@ async fn process_task_file(
     } else {
         (original_size.saturating_sub(compressed_size) as f64) * 100.0 / (original_size as f64)
     };
-    let skip_charge = compression_rate == Some(100);
+    let skip_charge = compression_rate == Some(100)
+        && format_in == format_out
+        && max_width.is_none()
+        && max_height.is_none();
     let charge_units = !skip_charge && compressed_size < original_size;
 
     if ctx.is_anonymous && charge_units {