From cce7e3b63401eb81f0b6c24de3a1dbba1d8f9a8b Mon Sep 17 00:00:00 2001
From: zj1123581321 <glm-pi-executor@invalid>
Date: Sat, 10 Oct 2026 12:05:18 +0800
Subject: [PATCH 1/3] =?UTF-8?q?=E5=85=A8=E4=BB=93=E7=89=88=E6=9C=AC?=
 =?UTF-8?q?=E5=8F=B7=E7=BB=9F=E4=B8=80=E4=B8=BA=201.0.0=EF=BC=88Python=20?=
 =?UTF-8?q?=E4=B8=8E=20Node=20=E4=BE=A7=E5=85=B1=206=20=E5=A4=84=E5=A3=B0?=
 =?UTF-8?q?=E6=98=8E=EF=BC=89?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Agent-Executor: glm-pi
Agent-Model: glm-5.3-flash
Agent-Effort: high
Dispatch-Id: dlg-20261010-040314-b42cb3
Task-Id: VideoTranscriptAPI-20261010-08
---
 e2e/package-lock.json | 4 ++--
 e2e/package.json      | 2 +-
 package-lock.json     | 4 ++--
 package.json          | 2 +-
 pyproject.toml        | 2 +-
 5 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/e2e/package-lock.json b/e2e/package-lock.json
index e5939dc8..1cf2ad3b 100644
--- a/e2e/package-lock.json
+++ b/e2e/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "video-transcript-api-browser-tests",
-  "version": "0.1.0",
+  "version": "1.0.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "video-transcript-api-browser-tests",
-      "version": "0.1.0",
+      "version": "1.0.0",
       "devDependencies": {
         "@playwright/test": "1.62.0",
         "@types/node": "22.20.1"
diff --git a/e2e/package.json b/e2e/package.json
index 0669dc03..d97f78d3 100644
--- a/e2e/package.json
+++ b/e2e/package.json
@@ -1,7 +1,7 @@
 {
   "name": "video-transcript-api-browser-tests",
   "private": true,
-  "version": "0.1.0",
+  "version": "1.0.0",
   "description": "Blocking Chromium regression tests for the existing VideoTranscriptAPI web pages",
   "scripts": {
     "test": "node run-browser-tests.mjs"
diff --git a/package-lock.json b/package-lock.json
index 86f2086e..e1ecc607 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "video-transcript-api-web",
-  "version": "0.1.0",
+  "version": "1.0.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "video-transcript-api-web",
-      "version": "0.1.0",
+      "version": "1.0.0",
       "devDependencies": {
         "jsdom": "27.0.1",
         "vitest": "^3.2.4"
diff --git a/package.json b/package.json
index 46c3c07a..8c38025a 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "video-transcript-api-web",
   "private": true,
-  "version": "0.1.0",
+  "version": "1.0.0",
   "description": "JS unit tests (vitest) for the PWA front-end assets of VideoTranscriptAPI",
   "scripts": {
     "test:web": "vitest run",
diff --git a/pyproject.toml b/pyproject.toml
index a849fd42..354a7927 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "video-transcript-api"
-version = "0.1.0"
+version = "1.0.0"
 description = "基于Python的视频转录API服务，支持从多个平台下载视频并转录为文字"
 requires-python = ">=3.11"
 dependencies = [

From f24826e7b2d10f54d67cc4055683ec55d5aa057f Mon Sep 17 00:00:00 2001
From: zj1123581321 <glm-pi-executor@invalid>
Date: Sat, 10 Oct 2026 12:07:42 +0800
Subject: [PATCH 2/3] =?UTF-8?q?=E6=96=B0=E5=A2=9E=20CHANGELOG=20=E4=B8=8E?=
 =?UTF-8?q?=E5=8F=91=E7=89=88=E6=B5=81=E7=A8=8B=E6=96=87=E6=A1=A3=EF=BC=88?=
 =?UTF-8?q?1.0.0=20=E5=9F=BA=E7=BA=BF=20+=20=E5=85=A8=E6=89=8B=E5=8A=A8?=
 =?UTF-8?q?=E5=8F=96=E6=9D=90=E6=B5=81=E7=A8=8B=EF=BC=89?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Agent-Executor: glm-pi
Agent-Model: glm-5.3-flash
Agent-Effort: high
Dispatch-Id: dlg-20261010-040314-b42cb3
Task-Id: VideoTranscriptAPI-20261010-08
---
 CHANGELOG.md            | 21 ++++++++++++++++++++
 docs/release-process.md | 43 +++++++++++++++++++++++++++++++++++++++++
 2 files changed, 64 insertions(+)
 create mode 100644 CHANGELOG.md
 create mode 100644 docs/release-process.md

diff --git a/CHANGELOG.md b/CHANGELOG.md
new file mode 100644
index 00000000..2c019708
--- /dev/null
+++ b/CHANGELOG.md
@@ -0,0 +1,21 @@
+# Changelog
+
+本文件回答一个问题：「某个版本改了什么」。只记录对外可见的变更，不搬运内部工作记录。
+
+格式遵循 [Keep a Changelog](https://keepachangelog.com/zh-CN/1.1.0/)，版本号遵循语义化版本。
+发版步骤见 [docs/release-process.md](docs/release-process.md)。
+
+## [1.0.0] - 2026-10-10
+
+首个版本基线，不追认历史。本条概括基线时点的对外能力与近期变更。
+
+### Added
+
+- 多平台视频链接转写 API：提交链接后后台转写为文字稿，支持校对稿、摘要、笔记等多视图导出，以及重总结与笔记再生成。
+- 网页本地上传：浏览器直接上传本地音视频文件，可查看本人上传历史、随时停止分享；上传幂等键在纯 HTTP 直连（非安全上下文）下同样可用。
+- 企业微信通知：任务完成回执与分享摘要回执（wecom-notifier 0.3.2，超长分段锁定预算）。
+- 公网入口切换为 sum.zlxlabs.com。
+
+### Security
+
+- 修复 HTTP 响应头自由文本注入（raw 导出 502 事故根因）。
diff --git a/docs/release-process.md b/docs/release-process.md
new file mode 100644
index 00000000..f5d000b4
--- /dev/null
+++ b/docs/release-process.md
@@ -0,0 +1,43 @@
+# 发版流程（全手动）
+
+本项目采用全手动发版：一条取材命令 + 人工整理 CHANGELOG，不引入 Conventional Commits、release-please 或任何发布自动化。版本号以 1.0.0 为基线，散布在 `pyproject.toml`、`package.json`、`e2e/package.json`、`src/video_transcript_api/__init__.py` 与 `src/video_transcript_api/api/app.py`，发版时人工同步。
+
+## 发版时机
+
+绑定部署：需要把主干部署到 n305 时发一版。不为发版而发版——没有部署需求就不打 tag、不发 CHANGELOG。
+
+## 发版步骤
+
+以下假设上一版是 `vX.Y.Z`，本次发 `vA.B.C`。
+
+### 1. 取材
+
+在主干 checkout 上跑取材命令，得到自上一版以来每个合并提交的正文（GitHub 会把 PR 标题写进合并提交正文，这就是变更素材）：
+
+```sh
+git log --first-parent --merges vX.Y.Z..HEAD --format='%b'
+```
+
+把素材人工整理成用户可见变更，写入 `CHANGELOG.md` 的新条目（Keep a Changelog 风格）。CHANGELOG 只回答「版本 → 用户可见变更」，不搬运 WORKLOG 或验收流水。
+
+### 2. 打 annotated tag
+
+CHANGELOG 条目经日常流程进主干后，在主干 HEAD（即本次发版提交）上打 annotated tag 并推送：
+
+```sh
+git tag -a vA.B.C -m "vA.B.C"
+git push origin vA.B.C
+```
+
+tag 命名固定 `v` 前缀 + 三段版本号，供下一次取材命令引用。
+
+### 3. 构建与部署
+
+按现有镜像流程：`docker/push_to_ghcr.sh` 在干净工作树上构建并推送 `ghcr.io/zj1123581321/video-transcript-api:<sha12>`，随后 `docker/pull_and_deploy.sh <镜像引用>` 以不可变 digest 部署到目标机。
+
+## 两条红线
+
+1. **禁止给镜像打浮动 tag**（含 `:latest`、`:vA.B.C` 等任何会被后续推送覆盖的引用），镜像 tag 只允许 sha12 唯一。机理：`docker/Dockerfile` 构建时通过 `COPY --from` 从仓库里一个冻结的旧镜像获取 BBDown 二进制；一旦出现浮动 tag，下次构建会把它静默解析到新镜像，BBDown 的来源就被悄悄换掉。`tests/deployment/test_pull_and_deploy.py` 已锁定该行为。
+2. **部署 digest 链不动**：`docker/pull_and_deploy.sh` 与 `docker/docker-compose.deploy.yml` 的不可变 digest 约束（`${VIDEO_TRANSCRIPT_IMAGE:?...}` 强制 digest 引用）是部署可追溯性的根基，禁止改成浮动引用或绕过校验。
+
+出现第三方镜像消费者时，浮动 tag 政策需重新裁决后才能放开。

From aa516fd81a7025e4adc7c2a0d94c746a0e714458 Mon Sep 17 00:00:00 2001
From: zj1123581321 <glm-pi-executor@invalid>
Date: Sat, 10 Oct 2026 12:30:57 +0800
Subject: [PATCH 3/3] =?UTF-8?q?uv.lock=20=E5=90=8C=E6=AD=A5=E9=A1=B9?=
 =?UTF-8?q?=E7=9B=AE=E7=89=88=E6=9C=AC=E5=8F=B7=201.0.0=EF=BC=88=E4=B8=8E?=
 =?UTF-8?q?=20package-lock=20=E5=90=8C=E7=B1=BB=E7=9A=84=E9=94=81=E4=BA=A7?=
 =?UTF-8?q?=E7=89=A9=EF=BC=89?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Agent-Executor: glm-pi
Agent-Model: glm-5.3-flash
Agent-Effort: high
Dispatch-Id: dlg-20261010-040314-b42cb3
Task-Id: VideoTranscriptAPI-20261010-08
---
 uv.lock | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/uv.lock b/uv.lock
index 7f723df1..fbc9902e 100644
--- a/uv.lock
+++ b/uv.lock
@@ -4454,7 +4454,7 @@ wheels = [
 
 [[package]]
 name = "video-transcript-api"
-version = "0.1.0"
+version = "1.0.0"
 source = { virtual = "." }
 dependencies = [
     { name = "beautifulsoup4" },