@striae-org/striae 3.1.1 → 3.2.0

package/.env.example

@@ -43,6 +43,7 @@ PAGES_CUSTOM_DOMAIN=your_custom_domain_here
 # ================================
 # KEYS WORKER ENVIRONMENT VARIABLES
 # ================================
+# Worker domains can be entered manually or auto-generated as a 10-character subdomain of PAGES_CUSTOM_DOMAIN during scripts/deploy-config.sh.
 KEYS_WORKER_NAME=your_keys_worker_name_here
 KEYS_WORKER_DOMAIN=your_keys_worker_domain_here
 KEYS_AUTH=your_custom_keys_auth_token_here
@@ -86,6 +87,7 @@ HMAC_KEY=your_cloudflare_images_hmac_key_here
 # ================================
 PDF_WORKER_NAME=your_pdf_worker_name_here
 PDF_WORKER_DOMAIN=your_pdf_worker_domain_here
+PDF_WORKER_AUTH=your_custom_pdf_worker_auth_token_here
 
 # ================================
 # QUICK MANUAL SETUP CHECKLIST

package/app/components/actions/generate-pdf.ts

@@ -1,6 +1,7 @@
 import paths from '~/config/config.json';
 import { AnnotationData } from '~/types/annotations';
 import { auditService } from '~/services/audit.service';
+import { getPdfApiKey } from '~/utils/auth';
 import { User } from 'firebase/auth';
 
 interface GeneratePDFParams {
@@ -74,10 +75,13 @@ export const generatePDF = async ({
       data: pdfData,
     };
 
+    const pdfAuthKey = await getPdfApiKey();
+
     const response = await fetch(paths.pdf_worker_url, {
       method: 'POST',
       headers: {
         'Content-Type': 'application/json',
+        'X-Custom-Auth-Key': pdfAuthKey,
       },
       body: JSON.stringify(pdfRequest)
     });

package/app/config-example/inactivity.ts

@@ -1,5 +1,5 @@
 export const INACTIVITY_CONFIG = {
-  TIMEOUT_MINUTES: 60,  
+  TIMEOUT_MINUTES: 30,  
   WARNING_MINUTES: 5, 
   TRACKED_ACTIVITIES: [
     'mousedown',

package/app/services/firebase.ts

@@ -1,6 +1,8 @@
 import { initializeApp } from 'firebase/app';
 import { 
     getAuth,
+    setPersistence,
+    browserSessionPersistence,
     //connectAuthEmulator,    
  } from 'firebase/auth';
 import firebaseConfig from '~/config/firebase';
@@ -9,6 +11,8 @@ import { getAppVersion } from '~/utils/version';
 export const app = initializeApp(firebaseConfig, "Striae");
 export const auth = getAuth(app);
 
+setPersistence(auth, browserSessionPersistence);
+
 console.log(`Welcome to ${app.name} v${getAppVersion()}`);
 
 //Connect to the Firebase Auth emulator if running locally

package/app/utils/auth.ts

@@ -3,7 +3,7 @@ import paths from '~/config/config.json';
 const KEYS_URL = paths.keys_url;
 const KEYS_AUTH = paths.keys_auth;
 
-type KeyType = 'USER_DB_AUTH' | 'R2_KEY_SECRET' | 'IMAGES_API_TOKEN' | 'ACCOUNT_HASH';
+type KeyType = 'USER_DB_AUTH' | 'R2_KEY_SECRET' | 'IMAGES_API_TOKEN' | 'ACCOUNT_HASH' | 'PDF_WORKER_AUTH';
 
 async function getApiKey(keyType: KeyType): Promise<string> {
   const keyResponse = await fetch(`${KEYS_URL}/${keyType}`, {
@@ -31,4 +31,8 @@ export async function getImageApiKey(): Promise<string> {
 
 export async function getAccountHash(): Promise<string> {
   return getApiKey('ACCOUNT_HASH');
+}
+
+export async function getPdfApiKey(): Promise<string> {
+  return getApiKey('PDF_WORKER_AUTH');
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@striae-org/striae",
-  "version": "3.1.1",
+  "version": "3.2.0",
   "private": false,
   "description": "Cloud-native forensic annotation application for firearms identification (Remix + Cloudflare Workers).",
   "license": "Apache-2.0",
@@ -77,7 +77,7 @@
     "publish:github": "npm publish --registry=https://npm.pkg.github.com --@striae-org:registry=https://npm.pkg.github.com",
     "publish:github:dry-run": "npm publish --dry-run --registry=https://npm.pkg.github.com --@striae-org:registry=https://npm.pkg.github.com",
     "publish:all": "npm run publish:npm && npm run publish:github",
-    "publish:all:dry-run": "npm run publish:npm:dry-run && npm run publish:github:dry-run",
+    "publish:all:dry-run": "npm run publish:npm:dry-run && npm run publish:github:dry-run",    
     "lint": "node ./scripts/run-eslint.cjs",
     "start": "node ./scripts/dev.cjs && wrangler pages dev",
     "typecheck": "tsc",

package/public/_routes.json

@@ -8,6 +8,7 @@
     "/*.css",
     "/*.js",
     "/*.pdf",
+    "/*.png",
     "/*.zip"    
   ]
 }

package/scripts/deploy-config.sh

@@ -57,9 +57,16 @@ is_placeholder() {
 
 # Check if .env file exists
 env_created_from_example=false
+preserved_domain_env_file=""
+
+if [ -f ".env" ]; then
+    preserved_domain_env_file=".env"
+fi
+
 if [ "$update_env" = "true" ]; then
     if [ -f ".env" ]; then
         cp .env .env.backup
+        preserved_domain_env_file=".env.backup"
         echo -e "${GREEN}📄 Existing .env backed up to .env.backup${NC}"
     fi
 
@@ -133,11 +140,151 @@ normalize_domain_value() {
     printf '%s' "$domain"
 }
 
+strip_carriage_returns() {
+    printf '%s' "$1" | tr -d '\r'
+}
+
+read_env_var_from_file() {
+    local env_file=$1
+    local var_name=$2
+
+    if [ ! -f "$env_file" ]; then
+        return 0
+    fi
+
+    awk -v key="$var_name" '
+        index($0, key "=") == 1 {
+            value = substr($0, length(key) + 2)
+        }
+        END {
+            if (value != "") {
+                gsub(/\r/, "", value)
+                gsub(/^"/, "", value)
+                gsub(/"$/, "", value)
+                print value
+            }
+        }
+    ' "$env_file"
+}
+
+worker_domain_wrangler_path() {
+    case "$1" in
+        KEYS_WORKER_DOMAIN)
+            printf '%s' "workers/keys-worker/wrangler.jsonc"
+            ;;
+        USER_WORKER_DOMAIN)
+            printf '%s' "workers/user-worker/wrangler.jsonc"
+            ;;
+        DATA_WORKER_DOMAIN)
+            printf '%s' "workers/data-worker/wrangler.jsonc"
+            ;;
+        AUDIT_WORKER_DOMAIN)
+            printf '%s' "workers/audit-worker/wrangler.jsonc"
+            ;;
+        IMAGES_WORKER_DOMAIN)
+            printf '%s' "workers/image-worker/wrangler.jsonc"
+            ;;
+        PDF_WORKER_DOMAIN)
+            printf '%s' "workers/pdf-worker/wrangler.jsonc"
+            ;;
+    esac
+}
+
+read_worker_domain_from_wrangler() {
+    local wrangler_file=$1
+
+    if [ ! -f "$wrangler_file" ]; then
+        return 0
+    fi
+
+    sed -n 's/.*"pattern"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' "$wrangler_file" | head -n 1
+}
+
+resolve_existing_domain_value() {
+    local var_name=$1
+    local current_value=$2
+    local preserved_value=""
+    local wrangler_file=""
+
+    current_value=$(normalize_domain_value "$current_value")
+
+    if [ "$current_value" = "$var_name" ]; then
+        current_value=""
+    fi
+
+    if [ -n "$current_value" ] && ! is_placeholder "$current_value"; then
+        printf '%s' "$current_value"
+        return 0
+    fi
+
+    if [ -n "$preserved_domain_env_file" ] && [ -f "$preserved_domain_env_file" ]; then
+        preserved_value=$(read_env_var_from_file "$preserved_domain_env_file" "$var_name")
+        preserved_value=$(normalize_domain_value "$preserved_value")
+
+        if [ "$preserved_value" = "$var_name" ]; then
+            preserved_value=""
+        fi
+
+        if [ -n "$preserved_value" ] && ! is_placeholder "$preserved_value"; then
+            printf '%s' "$preserved_value"
+            return 0
+        fi
+    fi
+
+    if [[ "$var_name" == *_WORKER_DOMAIN ]]; then
+        wrangler_file=$(worker_domain_wrangler_path "$var_name")
+
+        if [ -n "$wrangler_file" ] && [ -f "$wrangler_file" ]; then
+            preserved_value=$(read_worker_domain_from_wrangler "$wrangler_file")
+            preserved_value=$(normalize_domain_value "$preserved_value")
+
+            if [ "$preserved_value" = "$var_name" ]; then
+                preserved_value=""
+            fi
+
+            if [ -n "$preserved_value" ] && ! is_placeholder "$preserved_value"; then
+                printf '%s' "$preserved_value"
+                return 0
+            fi
+        fi
+    fi
+
+    printf '%s' "$current_value"
+}
+
+generate_worker_subdomain_label() {
+    node -e "const { randomInt } = require('crypto'); const alphabet = 'abcdefghijklmnopqrstuvwxyz0123456789'; let value = ''; for (let index = 0; index < 10; index += 1) { value += alphabet[randomInt(alphabet.length)]; } process.stdout.write(value);" 2>/dev/null
+}
+
+generate_worker_subdomain() {
+    local pages_domain=$1
+    local subdomain_label=""
+
+    pages_domain=$(normalize_domain_value "$pages_domain")
+
+    if [ -z "$pages_domain" ] || is_placeholder "$pages_domain"; then
+        return 1
+    fi
+
+    if ! subdomain_label=$(generate_worker_subdomain_label); then
+        return 1
+    fi
+
+    if [ ${#subdomain_label} -ne 10 ]; then
+        return 1
+    fi
+
+    printf '%s.%s' "$subdomain_label" "$pages_domain"
+}
+
 write_env_var() {
     local var_name=$1
     local var_value=$2
     local env_file_value="$var_value"
 
+    var_value=$(strip_carriage_returns "$var_value")
+    env_file_value="$var_value"
+
     if [ "$var_name" = "FIREBASE_SERVICE_ACCOUNT_PRIVATE_KEY" ] || [ "$var_name" = "MANIFEST_SIGNING_PRIVATE_KEY" ] || [ "$var_name" = "MANIFEST_SIGNING_PUBLIC_KEY" ]; then
         # Store as a quoted string so sourced .env preserves escaped newline markers (\n)
         env_file_value=${env_file_value//\"/\\\"}
@@ -276,6 +423,7 @@ configure_manifest_signing_credentials() {
     else
         echo -e "${GREEN}Current manifest signing key pair: [HIDDEN]${NC}"
         read -p "Generate new manifest signing key pair? (press Enter to keep current, or type 'y' to regenerate): " regenerate_choice
+        regenerate_choice=$(strip_carriage_returns "$regenerate_choice")
         if [ "$regenerate_choice" = "y" ] || [ "$regenerate_choice" = "Y" ]; then
             should_generate="true"
         fi
@@ -353,6 +501,7 @@ required_vars=(
     
     # Worker-Specific Secrets (required for deployment)
     "KEYS_AUTH"
+    "PDF_WORKER_AUTH"
     "ACCOUNT_HASH"
     "API_TOKEN"
     "HMAC_KEY"
@@ -579,16 +728,23 @@ prompt_for_secrets() {
         local current_value="${!var_name}"
         local new_value=""
         local allow_keep="false"
+
+        current_value=$(strip_carriage_returns "$current_value")
+
+        if [ "$var_name" = "PAGES_CUSTOM_DOMAIN" ] || [[ "$var_name" == *_WORKER_DOMAIN ]]; then
+            current_value=$(resolve_existing_domain_value "$var_name" "$current_value")
+        fi
         
         # Auto-generate specific authentication secrets - but allow keeping current
-        if [ "$var_name" = "USER_DB_AUTH" ] || [ "$var_name" = "R2_KEY_SECRET" ] || [ "$var_name" = "KEYS_AUTH" ]; then
+        if [ "$var_name" = "USER_DB_AUTH" ] || [ "$var_name" = "R2_KEY_SECRET" ] || [ "$var_name" = "KEYS_AUTH" ] || [ "$var_name" = "PDF_WORKER_AUTH" ]; then
             echo -e "${BLUE}$var_name${NC}"
             echo -e "${YELLOW}$description${NC}"
             
-            if [ "$update_env" != "true" ] && [ -n "$current_value" ] && ! is_placeholder "$current_value" && [ "$current_value" != "your_custom_user_db_auth_token_here" ] && [ "$current_value" != "your_custom_r2_secret_here" ] && [ "$current_value" != "your_custom_keys_auth_token_here" ]; then
+            if [ "$update_env" != "true" ] && [ -n "$current_value" ] && ! is_placeholder "$current_value" && [ "$current_value" != "your_custom_user_db_auth_token_here" ] && [ "$current_value" != "your_custom_r2_secret_here" ] && [ "$current_value" != "your_custom_keys_auth_token_here" ] && [ "$current_value" != "your_custom_pdf_worker_auth_token_here" ]; then
                 # Current value exists and is not a placeholder
                 echo -e "${GREEN}Current value: [HIDDEN]${NC}"
                 read -p "Generate new secret? (press Enter to keep current, or type 'y' to generate): " gen_choice
+                gen_choice=$(strip_carriage_returns "$gen_choice")
                 
                 if [ "$gen_choice" = "y" ] || [ "$gen_choice" = "Y" ]; then
                     new_value=$(openssl rand -hex 32 2>/dev/null || echo "")
@@ -598,6 +754,7 @@ prompt_for_secrets() {
                         while true; do
                             echo -e "${RED}❌ Failed to auto-generate, please enter manually:${NC}"
                             read -p "Enter value: " new_value
+                            new_value=$(strip_carriage_returns "$new_value")
                             if [ -z "$new_value" ]; then
                                 echo -e "${RED}❌ A value is required.${NC}"
                                 continue
@@ -624,6 +781,7 @@ prompt_for_secrets() {
                     while true; do
                         echo -e "${RED}❌ Failed to auto-generate, please enter manually:${NC}"
                         read -p "Enter value: " new_value
+                        new_value=$(strip_carriage_returns "$new_value")
                         if [ -z "$new_value" ]; then
                             echo -e "${RED}❌ A value is required.${NC}"
                             continue
@@ -637,6 +795,68 @@ prompt_for_secrets() {
                     done
                 fi
             fi
+        elif [[ "$var_name" == *_WORKER_DOMAIN ]]; then
+            local pages_domain
+            local domain_choice=""
+
+            pages_domain=$(resolve_existing_domain_value "PAGES_CUSTOM_DOMAIN" "$PAGES_CUSTOM_DOMAIN")
+
+            echo -e "${BLUE}$var_name${NC}"
+            echo -e "${YELLOW}$description${NC}"
+
+            if [ -n "$current_value" ] && ! is_placeholder "$current_value"; then
+                echo -e "${GREEN}Current value: $current_value${NC}"
+            else
+                while true; do
+                    if [ -n "$pages_domain" ] && ! is_placeholder "$pages_domain"; then
+                        echo -e "${YELLOW}Choose how to configure this worker domain:${NC}"
+                        echo "  A) Auto-generate a 10-character subdomain of $pages_domain"
+                        echo "  M) Manually enter the worker domain"
+                        read -p "Selection (A/M): " domain_choice
+                        domain_choice=$(strip_carriage_returns "$domain_choice")
+                        domain_choice=$(printf '%s' "$domain_choice" | tr '[:upper:]' '[:lower:]')
+
+                        if [ -z "$domain_choice" ] || [ "$domain_choice" = "a" ]; then
+                            new_value=$(generate_worker_subdomain "$pages_domain" || echo "")
+
+                            if [ -n "$new_value" ]; then
+                                echo -e "${GREEN}✅ Generated worker domain: $new_value${NC}"
+                                break
+                            fi
+
+                            echo -e "${RED}❌ Failed to auto-generate a worker subdomain. Please try manual entry.${NC}"
+                            continue
+                        fi
+
+                        if [ "$domain_choice" = "m" ]; then
+                            read -p "Enter value: " new_value
+                            new_value=$(strip_carriage_returns "$new_value")
+                        else
+                            echo -e "${RED}❌ Please choose 'A' for automatic or 'M' for manual.${NC}"
+                            continue
+                        fi
+                    else
+                        echo -e "${YELLOW}PAGES_CUSTOM_DOMAIN is required for auto-generated worker subdomains.${NC}"
+                        read -p "Enter value: " new_value
+                        new_value=$(strip_carriage_returns "$new_value")
+                    fi
+
+                    if [ -z "$new_value" ]; then
+                        echo -e "${RED}❌ A value is required.${NC}"
+                        continue
+                    fi
+
+                    new_value=$(normalize_domain_value "$new_value")
+
+                    if is_placeholder "$new_value"; then
+                        echo -e "${RED}❌ Placeholder values are not allowed.${NC}"
+                        new_value=""
+                        continue
+                    fi
+
+                    break
+                done
+            fi
         else
             # Normal prompt for other variables
             echo -e "${BLUE}$var_name${NC}"
@@ -653,11 +873,13 @@ prompt_for_secrets() {
             while true; do
                 if [ "$allow_keep" = "true" ]; then
                     read -p "New value (or press Enter to keep current): " new_value
+                    new_value=$(strip_carriage_returns "$new_value")
                     if [ -z "$new_value" ]; then
                         break
                     fi
                 else
                     read -p "Enter value: " new_value
+                    new_value=$(strip_carriage_returns "$new_value")
                     if [ -z "$new_value" ]; then
                         echo -e "${RED}❌ A value is required.${NC}"
                         continue
@@ -687,6 +909,7 @@ prompt_for_secrets() {
         elif [ -n "$current_value" ]; then
             # Keep values aligned with .env.example ordering and remove stale duplicates.
             write_env_var "$var_name" "$current_value"
+            export "$var_name=$current_value"
             echo -e "${GREEN}✅ Keeping current value for $var_name${NC}"
         fi
         echo ""
@@ -741,6 +964,7 @@ prompt_for_secrets() {
     echo -e "${BLUE}🔐 SERVICE-SPECIFIC SECRETS${NC}"
     echo "============================"
     prompt_for_var "KEYS_AUTH" "Keys worker authentication token (generate with: openssl rand -hex 16)"
+    prompt_for_var "PDF_WORKER_AUTH" "PDF worker authentication token (generate with: openssl rand -hex 16)"
     prompt_for_var "ACCOUNT_HASH" "Cloudflare Images Account Hash"
     prompt_for_var "API_TOKEN" "Cloudflare Images API token (for Images Worker)"
     prompt_for_var "HMAC_KEY" "Cloudflare Images HMAC signing key"

package/scripts/deploy-worker-secrets.sh

@@ -175,7 +175,7 @@ fi
 
 # Keys Worker
 if ! set_worker_secrets "Keys Worker" "workers/keys-worker" \
-    "KEYS_AUTH" "USER_DB_AUTH" "R2_KEY_SECRET" "ACCOUNT_HASH" "IMAGES_API_TOKEN"; then
+    "KEYS_AUTH" "USER_DB_AUTH" "R2_KEY_SECRET" "ACCOUNT_HASH" "IMAGES_API_TOKEN" "PDF_WORKER_AUTH"; then
     echo -e "${YELLOW}⚠️  Skipping Keys Worker (not configured)${NC}"
 fi
 
@@ -198,7 +198,11 @@ if ! set_worker_secrets "Images Worker" "workers/image-worker" \
 fi
 
 # PDF Worker (no secrets needed)
-echo -e "\n${BLUE}📄 PDF Worker: No environment variables needed${NC}"
+# PDF Worker
+if ! set_worker_secrets "PDF Worker" "workers/pdf-worker" \
+    "PDF_WORKER_AUTH"; then
+    echo -e "${YELLOW}⚠️  Skipping PDF Worker (not configured)${NC}"
+fi
 
 echo -e "\n${GREEN}🎉 Worker secrets deployment completed!${NC}"
 

package/workers/audit-worker/wrangler.jsonc.example

@@ -2,7 +2,7 @@
   "name": "AUDIT_WORKER_NAME",
   "account_id": "ACCOUNT_ID",
   "main": "src/audit-worker.ts",
-  "compatibility_date": "2026-03-12",
+  "compatibility_date": "2026-03-13",
   "compatibility_flags": [
     "nodejs_compat"
   ], 

package/workers/data-worker/wrangler.jsonc.example

@@ -3,7 +3,7 @@
   "name": "DATA_WORKER_NAME",
   "account_id": "ACCOUNT_ID",
   "main": "src/data-worker.ts",
-  "compatibility_date": "2026-03-12",
+  "compatibility_date": "2026-03-13",
   "compatibility_flags": [
     "nodejs_compat"
   ], 

package/workers/image-worker/wrangler.jsonc.example

@@ -2,7 +2,7 @@
   "name": "IMAGES_WORKER_NAME",
   "account_id": "ACCOUNT_ID",
   "main": "src/image-worker.ts",
-  "compatibility_date": "2026-03-12",
+  "compatibility_date": "2026-03-13",
   "compatibility_flags": [
     "nodejs_compat"
   ], 

package/workers/keys-worker/src/keys.example.ts

@@ -3,6 +3,7 @@ interface Env {
   ACCOUNT_HASH: string;
   IMAGES_API_TOKEN: string;
   USER_DB_AUTH: string;
+  PDF_WORKER_AUTH: string;
   KEYS_AUTH: string;
 }
 

package/workers/keys-worker/wrangler.jsonc.example

@@ -2,7 +2,7 @@
   "name": "KEYS_WORKER_NAME",
   "account_id": "ACCOUNT_ID",
   "main": "src/keys.ts",
-  "compatibility_date": "2026-03-12",
+  "compatibility_date": "2026-03-13",
   "compatibility_flags": [
     "nodejs_compat"
   ], 

package/workers/pdf-worker/package.json

@@ -3,6 +3,7 @@
 	"version": "0.0.0",
 	"private": true,
 	"scripts": {
+		"generate:assets": "node scripts/generate-assets.js",
 		"deploy": "wrangler deploy",
 		"dev": "wrangler dev",
 		"start": "wrangler dev",

package/workers/pdf-worker/src/format-striae.ts

@@ -1,4 +1,5 @@
 import type { PDFGenerationData, ReportRenderer } from './report-types';
+import { ICON_256 } from './generated-assets';
 
 export const renderReport: ReportRenderer = (data: PDFGenerationData): string => {
   const { imageUrl, caseNumber, annotationData, activeAnnotations, currentDate, notesUpdatedFormatted, userCompany } = data;
@@ -519,7 +520,7 @@ export const renderReport: ReportRenderer = (data: PDFGenerationData): string =>
     <div class="footer">
       <div class="footer-left">
         <span>Notes formatted by Striae</span>
-        <img class="footer-brand-icon" src="https://app.striae.org/icon-256.png" alt="Striae icon" />
+          <img class="footer-brand-icon" src="${ICON_256}" alt="Striae icon" />
       </div>
       <div class="footer-center">
         ${userCompany ? userCompany : ''}

package/workers/pdf-worker/src/generated-assets.ts

@@ -0,0 +1,117 @@
+// Auto-generated by scripts/generate-assets.js
+// Do not edit manually — run `npm run generate:assets` to regenerate.
+
+// Source: src/assets/icon-256.png
+export const ICON_256 =
+  "data:image/png;base64," +
+  "iVBORw0KGgoAAAANSUhEUgAAAQAAAAEACAYAAABccqhmAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAAYdEVY" +
+  "dFNvZnR3YXJlAFBhaW50Lk5FVCA1LjEuMvu8A7YAAAC2ZVhJZklJKgAIAAAABQAaAQUAAQAAAEoAAAAbAQUAAQAAAFIAAAAoAQMAAQAAAAIAAAAxAQIAEAAA" +
+  "AFoAAABphwQAAQAAAGoAAAAAAAAAYAAAAAEAAABgAAAAAQAAAFBhaW50Lk5FVCA1LjEuMgADAACQBwAEAAAAMDIzMAGgAwABAAAAAQAAAAWgBAABAAAAlAAA" +
+  "AAAAAAACAAEAAgAEAAAAUjk4AAIABwAEAAAAMDEwMAAAAADp1fY4ytpsegAAJW1JREFUeF7tnQecVdW1/9ftbXpv9KaYKFHMM3+RZzRoNAYFJY/yBGOMIu/p" +
+  "U3z2gJ/YRYLGmIiRYsooSIvGqMSnWGLJx5K8hygCQxkYhun99nv3f68zexQGpt/T9lnfz+d8zt7nUu49Z6/fLmevtYAgCIIgCIIgCIIgCIIgCIIgCEmxiTMx" +
+  "RB5//HHW0NAgaoSajBgxAq655hpquymAbuIQuP/++9n27dshFouJK4SW+P1+OP3002Hx4sXUjgcJ3bgBsGXLFvbhhx/C7t27xRXCSEyaNAmWLl1KbXoA0M3q" +
+  "Bw8//DD75JNPIJFIiCuEkfF6vTBlyhRYtGgRte8+oBvUA+Xl5Wzbtm3Q2NgorhBmZNiwYXD++efD9OnTqa0TBEEQBEEo0LDIhKx9/T1W29wKR/hR19IO9fxo" +
+  "C4UhHItBPJGARCIJ0XgCkowB48fR4AO32+38sIGDn/FwORzgdPCz0wFpfP5ckJUOZXnZUJiVAf916fnURiSGHq5BeWTDq+yLQ0dgz+FaCIajijEnkknlHOcG" +
+  "joaNdTVBkbDbbIpAuJ1OcHCRcHLBCHg9kJeZBhNKi+Dn/05zazNDD88ALNv4GjtY3wSHG5qhtrkNmjqCEIpExafGB0cLJTlZMKIwFx6+aia1KRNBD0sHVmx5" +
+  "nW3ffwg+raiE9lBEXJUHGx81jC8pgIkjSmD5T2ZRGzMw9HA04qoVa9kHOyuU4bsVGZafA1MmjoX7519Gbc5A0MNQkSV/eJG9u2M3VPHhPc7dCVDWEnLSA3BS" +
+  "WRGcPXEMXH3BFGqDOmKpm79u3TpVrbA1EoOKxnb4ZzWfz7eFIRiNi0+InsjxuWFcbjqcUZoD+QEPuB128Yk+OLlAXXHFFZaxC0v80JdffpmVl5dDJKLCfJvP" +
+  "d4N2DzR7MqHFlQZRu0t8QAwEbIiBeBCyIy2QEe8AZ1I/8czKyoI1a9ZYwjak/5F33303++KLL0QtdcTtTmhxp0OtJ4eMXgWyom1QGG4AbyIsrmjP1KlT4aab" +
+  "bpLaRqT+cfPmzWOhUEjUUkPY7oYGTxY08R4/AXy4ykcAhDo4WAIyo+1QEGkAT0Kf16IFBQWwcuVKaR+ylD9s1apV7JVXXhG11JDgt6rOm8MNP4t6fI3xJGN8" +
+  "atCsTA/cTPupgcvlgvXr10tpK9R99YPH17/EXvj7Z1DT0i6uEHpQmJkGl0+eCLfMpVeJqYJuZB+ctfhBhvvtCeMwsjAX3njwFmq7KYBuYg9c/+s/sjf/90vF" +
+  "uYYwHui49KMpk+HeKy+lNjwE6OadgHNuXcYONzaLGmFkJo0eBpvuvp7a8SChG3cUi35dzrZ+ukPUCLOAHotXnncWLJ37Q2rPA4RumOD/3fIwq2luFTXCjIwo" +
+  "yIU3H6K1gYFg+Zv14PpX2B+3fQiRGG3blYH8zHT4cMWdJAL9xNI36rY1G9mm9z4VNUIWcIFw59P3kQj0A8PfpCVLlqTcgSfK/8VtDUlowAIhLRMCNjg9065b" +
+  "I3e73dh+DW1jhv5yM2fOTLmFdji8UBUohpDDI64QMpMZa4eyjmpwMn1e52ZnZ8Pq1asNa2f6+l72wpw5c1Ju/G2uAFSmlZLxWwj00DzoL4KYzSGuaEtTUxNc" +
+  "d911hh1qGlIArrrqKpZq190Opx8OBEppH78FaXWnQ7W/EBI6iUBdXR16FRpSBAwnAAsWLGCtral9HdfOjX8/7/kTNsMOeAiVaXJnQJWvAPSywsrKSrj55psN" +
+  "JwKGmptg4I729tTuu99V3wZbPj+kROshrA029slluTD9pBJl85AezJ4921A2Z9jFiVQx5dZHWHVji6gRVgcjFt84/Tx+UMITROqb8J3FD7HaljZRI4hOsNHv" +
+  "Wf0gCQBH2knx9HufJOMnTghOxE+/4T7DrsxriZQCcPXjz7IdBw6LGkEcT0swBOff9QvLi4B0ArD0jy+yt7fvEjWC6Jn9NQ1KwhZRtSTSCUD5tr+LEkH0DSZu" +
+  "Wb31XcuKgFQCcMr199C8jhgwv3zpTVGyHtIIwL8/uoqFo/Sunxg4HeEIzF32jCU7DykE4Dcvb2Mf7NwragQxcP7+5T54dNNWy4mAZu9CMS/fjh2pD7fVFgd4" +
+  "rS4BMRr8E0PEwa3hB/l2SHPqu0Xgvvu0i2Wg2X+khmsvsj9QqqToIohUkB7rgNHtB0VNH7RMRKLJFEAN114k6PBy408TNYIYOugy3urSt03FYjHNXIhVF4Ab" +
+  "brgh5a69COblq/YX8JK+wzVCPqq9eUryVz1BF+IVK1aoLgKqCsDatWtZVVWVqKUWHPajmy9BpJqw02uItvW3v/1NlNRDVQF4+eWXRSm1MJsNGt2ZokYQqafG" +
+  "mwNJA8SPmD9/vqqjANOOn0++bimLximUN6EODrsd7vjRRXD1tLOlnmPqL3GDYMGKNWT8hKokkknY8O7HoiYvphSAj3cfECWCUI9dVTWiJC+mE4DFz7xAW34J" +
+  "zbj8gac0eR2nF6YTgNf/8bkoEYT6/HOvvpuC1MZ0AhCMREWJILThgfV/kXYUYCoB+PFjz0o9HCOMybuf7RYl+TDVK47xP72bJZKkAUeTm5EGJTmZkJ3mh3Sf" +
+  "F7ICfkjzecDt7HknG65wh/hIqjkYgsbWDmho64CKI3XKNeLEVEgaRNRUP2rMT+6yrPVjHPuA1wNZ3NALMtNhQmkh3Df/spQ/P3SJ3X24Fg7WNUJTewc/QhBP" +
+  "6JNXz0hM/5fT4LFr/006ERjyD1q9ejX7y1/+ImrqkORf80BaCbS6rOf1h0ktvfEwBOIhSI93gI+X7Vrkt+GCE7K7ocPpU+47no2wM04vnMk4jGmrBG/SOKOk" +
+  "zZs3D9l+h/wPzJo1iyVU7iFCDq+S2ssqef1sjEFWrB1yI03g54Zv0y2h1dcw/i2a3enQ5M5UPOasB4OSUB3khxtFXX/y8vLgt7/97ZBseEiS/sQTT6hu/Aj2" +
+  "PlYwfnyS6dzwJ7Tug+HBw7zXDxrC+BH8HtnRVhjZfkjpCbOibWBnSfGpFbBBm9NYwldfXy9Kg2dIAvDWW2+Jkrp0uOT3+vMkolAcrIFR3MA8OMzkowAjgtOP" +
+  "NC5MwzuqYCQ/fImw+ER+gk6vMhIyEldfffWQGsqgBeDRRx/VrIUGJc/nnxdphrFtByCfD/mN1bx6pnO00gHjWg9AAR8Wm+V7DwVMLx7ko1Ej0dzcDH/6058G" +
+  "bYuDFoAPPvhAlNQFF56YTnnd1YdBWagGSoNHlMU+M4JTg+JQrSJguEApO60GXP/gAiBKA2fQwo1BPkVRVapag7Dq470QTcg133Ta7XDJSSVwZmmOuGJ+8Blt" +
+  "/Owg7KiVNxtzSYYPrj59NPhcxuqUBpt23BQjtwnXLmGyvYuWdWMJ8pPHf8fe2v6lqMkFxgnY9cz90jw7w7/Yvfe5PzPcuSYTp40eJkpysvqmBTbcrCQjsrVF" +
+  "wwvAjsrDwAy6Ij4YHHYbbL77eml7/y4+WHGntL/xqb+8JU2DNLwAVNYaZ+NFKjh1lNy9/9FMHF4sSnKx67A8gUIMLwCN7UFRMj9Ohx023rVQ+t6/iz/fc4Mt" +
+  "M2Cs12ap4IBEnZLhBUCmxb+xxZjHwFp8/4xviJI8HKojASAGwSkjSkTJOjy4YIbN55ZrGze6T8sCCYCGjCrKEyVrcfGZ3xQleVjyh8HvvjMS/ZqP3nPPPWz7" +
+  "9u2iph1hhwe+zBglauZnWLAaciLybpLpCfQe3Jsm1+In+kOgU5RRufTSS2HBggV92ne/RgCfffaZKGmL0RwvhopNnreZAwK9Gr0JuaINoV+Akdm2bZso9U6f" +
+  "AlBeXs70eg+PKcBkIm6X1aehd+y8/WRHm0VNDhK8czJygJTW1lZR6p0+f0F/lUQNZBsBxGz6ZpzVE4wfINPTxBFA1ODP86GHHuqz5+5TABob9XvlIdsIIKZz" +
+  "ymk9cSdjfCQgkT8Hb5oxh1tUjMnHH/ed2qxXAVi2bJmus1YMjSUTUd5g9M47ryfFoXol2AlGEjLz4cA4jYmI+FXGBafuW7Zs6dWIeu1if/7zn7O4jkk4G6IM" +
+  "ttbL43yBajs50wZjA8adO6pNhD/OcIJB51M15wgPoyJ5HTbwmOAxlpSUwPXX9+x7YvgnIFso8FNHlsGWJYvM2fIJ6bBuV6QT/7f/EDz1yttyzW0I00ICoAPL" +
+  "N22VOt8cYR4MLwCYEUdG1vz1PfjPp54jESB0xfAC4HLKu3nm1Y8/g+8sfog9uP4VEgJCFwzfvX7rhntZa1D+aLOYzHPat06GJxbOoQVCQjMM39guXvpL9mWV" +
+  "PBFY+gKnPONLC+F7k06Gm2dMIzEgVMXwDWz+IyvZe7uM63WlJll+LxRmpkERP75RVgCL56Q+GzBhbY5rULfffjvbvXu3qOlPjTcXjvjQj57aPm5ACcQ6wJeI" +
+  "gJ8fHn64knFld5pRcggSxuXCCy+E66677hhDOm4RcM+ePaJkDLChozcZ0Zkmvc2VBrVcFPcHSpRYCV9kjIaKtGFQ7cuHZle6st1YNicqIjXs2LFDlL7mOAEw" +
+  "Wghu7OWod+uZhN2hJE9FUahMK4FdGSPh88wx/DwKDgSKlRFUizvd0j4IRCeHDh0Spa85RgDWrl1rOEtThrgkAP0Ce/4Ev1to7CGHB5rdmcr06aCvUBkl7E0r" +
+  "gypfATR6Mr9KuY5+7YR1OUYAvvzSeOmcsPd3chEgBgsXBS4IGF4Npw/13hw46C+GivQRsD+tFA4HiqDekwUhLghKgAtJN14RnaxZs+aY3vQYAaioqBAlY+GP" +
+  "h0SJSBXYCkIOLzTyUUKVvwh2cUH4LGs87EwfxQWiCJr49Yjd2P7uxMDp3skfIwAJg8bgT+MCQP2S+qAoRBxuPkXIgoOBYtidMUJZaDwQKIE6PnLAEUSMTxsI" +
+  "87J3715R6sQ0dnX+7cvY/nq54sqZjQyfB4qz0mF4biaMKciBW+fNIF02OaZ5gIufeYG9+OE/RY0wCrhr8cLTT4GbLvseiYEJMdVDky04iGxk+L1K8tNzvzke" +
+  "fjztbBIEE2CqhzT+pz9jsuVnlxGHww6Zfh9kp/nhrAmj4d4rLyUxMCimejBXLl/N3v/CmG8qiJ4JeD3KVOGMsSPgzh9dRGJgIEz3MGgaYH6G5+fAd0+dAEvn" +
+  "/pDEQGdM9wDOvOkB1ihRdlark8GnCt85aTT85j/mkRjogOlu+m0r/8g2ffS5qBGy4HTYIZuLwcSyfDh73HD4yaXfJ0HQAOUm33rrrcyouwC7g+m10OGFnFvk" +
+  "BX0/PIkopMU7IDPaDv540Hw9lcG54IILYOHChZ3ZDWtqzBNxx8XikM4bBiEv6PaMzkx1nhzYkz5c8Vtodmco14nU0GXzigC0t7crFbOQF25SvAQJa4Cei7gd" +
+  "eWfmGKjyFyriQAyN2tpa5XyML4BZ8CfCUBhuEDXCKmBy1XpPNuzlo4JKLgjom0CjgsFRXV2tnE0pAEh2pBm8fJ5IWI+4zQFNfEqA8Q0qA8UQ5CMEejc8OEwr" +
+  "ALhQVBiqEzXCqrRwIditxDYoU2IeEAPD/vzzz5tWPLNibZAWD4oaYWVa+XQAhQCnBkGHV1wl+sL20ksvsY8++khUzUdDjME7DUkIkYsAIcC03d9It8NInzlS" +
+  "eOvFfffdJ0f8p9Vb/8Ye2fgakKMQcTSnjSqDzT+jVOy9Ic3NWfrHF1n5tr+LGkF8zeypZ8IDCyh4yYmQ6qbMenAl+7TCmlmEiN4ZWZALbzx0C4lAN6S7IWct" +
+  "fojVtbSJGkF8DWaavnjyN2HFT39EQiCQ8kac8V/3s+Z2ejtAnJgpp4yD3y3+MYkAR9qbMJmLQBOJANEDZXnZ8PYjt1peBGzr1q2TchNVXUcYVn+8F9qi5DNA" +
+  "nJiA2wk/mFACpxVliSvWYvbs2TbbzJkzpd1FiTHu96YNU1JgEcSJwB2lZe3VkB1rFVesQ2lpqXm3AvcH9Ckf21YJnmRMXCGIY0FnooNpnf4EVgMTAUm/T8rF" +
+  "jX9c2wHIiJnL5ZnQDkyqio5Fba6AuGINksmk/AKAOJJxGN5+GHKirfKuehJDImFzdPoRWGgkwBizhgAgDj7YK+s4DHmRJmXeRxDdQTfjfYFSJe6AFbDb7dYR" +
+  "AAR7/5JgDZTyw8nIb4A4How1ia7FVog56XA4rCUAXeREmmF8617I5lMCgugOuhNX+QpETV4sKwAIxhQc1lENZaEa5W0BQRxNsytdSYkuMy6Xi9bEulj42Gr2" +
+  "xo69kGS0PkB04ve4YPtvfi61jZAAdOMH9zzBdh46ImqE1SnKzoD3lt8hrZ2QAPTABT97jFVUU8xBAuCWmRfAoh+cK6WtWHYNoC/+ev/Nthunnw9jS+RfDCJ6" +
+  "57m35A00QyOAfvD0q2+zLe//A/YeqaewYxblmgunwJ0/ulg6eyEBGCD/vWoDe+3THRCK0JsDK+F1uWDHSvkWBJUfJKtLsBrgS4K2aAy2H2mGL+raYF8T+RhY" +
+  "heFZfrh28hiwyRFLt9MduLy8nG3atElcIgYC7h8POr3Q6gxAszsdEnYXbTKWGgbjWw+ALxEWdXOzefNmm33evHk0DRgkDpaA9FgHlIZqYVxbpZKpyJukqYG8" +
+  "2KDRk6mcZYHeAqQIdzKmJCyd0LIXJrZUwLDgEUUcyPFILjAnYdzuEDXzQwKgAhiDAP0NRnVUwfiWfYoYYBozSmlufnDah2nIzE7XOgYJgIrYWBI8fEqAYjC8" +
+  "vQpGdhyCIj5N8MdD4ORiQHMvc4J+Aug6bGays7OVsyIA6BRAqAsauz8eVqYJGKFofOt+KBXTBCdLdL5eIExBh8tv+sAhhYWFylkRgKKiIqVCaIeLxSGXjwxG" +
+  "tx+Eic27YWLLHhjDhaEkVAsZ0TZlhEAYE4wjaHYBKC4uVs6KAHRVCH3A0YGLjwLS+NQgP9wIwzuqvxoljGo/BAWhesjkouDjIwhHko8WCN3pkEQAvpqGLlmy" +
+  "hMagBgYfTlucQQe3/+YYg8YYQCsfJESSDHgV4snOP0Nog98BcEmBA5wmXcjB1OB4NunXJ7rz21ffYZ/sOQCfV1ZDdVOLEvCRUI+A1wP/9+t7TG8/JAAS88sX" +
+  "/4eLQiWgMISjlBshlaDhLLrku7B4xjRT2xAJgMW497k/s0MNzXCEjxIO1TdBS0dIfEIMlDPHj4R1t19LAkCYlyf//Cb7sqoG9h2p46LQCsFIFKKxOK0n9IPM" +
+  "gA8+fWIJCQAhF49teZ19zKcNXxysphFCL+Buuj2rHpBHAOhNANFFkrcEbAxtCYCGSBLqY6AcLfjKgeiEMbgo3wHZbnNpQNcbAOSYby5zpmBiaCR5bxe1uZSs" +
+  "ORGnF8ION0TtbgjxwwpJNHoC92mYKe8k5gLYsGHDV3Z/jC+A2+0WJYI4Fjvv7dDVOT0ehLxwI5R1HOGN/6BiAIWhesW/wWbBV48Rk6WeHzdunCh1cowAdP+Q" +
+  "IHoDDd6fCENRuF7ZuTihdS8vNyhxEqxC1OFRtgabhQkTJohSJ8cIwPjx40WJIAaOB2MihOrgpNb9UMBHCVbwZ4jy6U/SdowZGZoFCxYco1bHfPMrr7zSPFJG" +
+  "GBYnF4LiUC2M4VOEzvyL8k4NInY3JEwkAN057pvjIoGuYKACMx/EV3gTERjecRjKgrXKirmM4KIoM4kAjBw5UpS+5rgWe9ddd7GdO3eKmnaE+Vyq3RUwf1/B" +
+  "Gzr692fEOiw1F+6LJk8mVPrl8zq18RY7jk95fFzsjM706dPhqquuOsbmjxMADBH+wgsviJp2VPvyodabK2rmBuMAFvNeLy/SJK4QSJWvEOq9nZFo5AEFoBL8" +
+  "CeNvmMIowKL4FceNXTBWuChqipnnUd3BVeFGT5apFoe0oDRUA+kmemfeP2zKHgmj09PU3jDf/NHntrCVb3wkanJQsfpB47cMjXnu1TfYko1viJoc3Hv5eTDv" +
+  "4u+Z8lkbpou6de4M6Yzl8T/9D+2s7Mbci863jSiQY6rXhVmNHzHUGDXN5xElOXj/iwpRIo7mW2OGixKhN4YSgDFF+aIkB59WVIoScTTjKOW6YTCUAAzLzxEl" +
+  "OcCwXHc+u5mmAd1YePG/0tqIQej1QWjtHvx5O4N/tsqVf9/NJfb7eXZIM2v0SBWojjDY1iDPc56aY4cyr3Gf79Huv93p9VvPnTuXhcPaZUJtc/phb7p880PM" +
+  "DITpwYhOWtwZsD9QImrmB3M7YIIXIzJ27FhYtmxZj3be6xTgrLPOEiVtQGcSGbeMNisJJa3rM9+dqMnTanXHyG7QvRk/0qsA3HjjjZqOa3ALrYfJ50GGG4Jq" +
+  "PdkSu8T0H9wkJZsY4nZgI9KVALQ3+lwEzMzEfOjagMk0MbCEjDR4cxRfB6vD7A4IObyiZn7Q+I06Apg8ebIo9UyfAnDeeeeJkvqgXqXxuZSmww6NwJ7viDdP" +
+  "8R+3MhGbE9pcflEzPzZu+0YdAdx55519mlKfAoAxAvozlEgVGHIKRwIyggkla3xy7XUYKLjQ2yn1cmDn01Z0/jIaWVlZotQ7fQoAMmnSJFFSH1cyBp5EVNTk" +
+  "o9GdCXUeufY79Je43QVNnv41TLPg5u0V4yUajWnTpolS7/RLAJYs0Tb5QcAErpVD4bC/AJq4EFiNal8eRBxyBZ7FQKlGi/uAI/Y5c+b0y2b7JQBIf4cUqQCn" +
+  "AQ5JpwFdHAoUQb1kvWFvtLrSoMmVIWrygFGP7AZrq2eeeaYo9c2AenatdgZi7ok36pPQaIEkFKem2+Eb6fLMiU9EKMHglbokRCTU9PNy7VDkMdbz623nX3cM" +
+  "2/JuWbWB/emDf4ia3Jw2qgw2/2yRtCow9bZlrKqhWdTkwuwxH/o9BdCaX1wzS1qD6M7/7jsE37nlIbb29fekG/KcedMD0hp/ht/8+xkMKwDIhLIiUZKf2uY2" +
+  "eHjDa/AfvymXQgSWb9rKTll4D2tsM+Ye+VQwXALvVUMLwCXfPlWUrEE8kYDXPtkBJ123hM1Z9owpheC3r77DvrP4IfbUK29DOBYTV+VEhg5qUMPsOXPmsEhE" +
+  "/TDIGCh0R9Z4S++hxweE3oQ50RYlDZfRnKVwh2PQ6YVWd4ayx0Gm4K69wp9Dacg4kZ9LSkrgySefHLA9D0oAnn/+ebZhwwZRU5eKtGG0h56Dr5rcLA6uZBx8" +
+  "8ZDy/hk3obgSMeWsBbjnLeFwKgkxcT9/mytN8exD5x6rRUB2JBMwtr1SeQ1oBE4U8rs/DOovIfPnz2ft7eqHeMb3x/vTyiw9CugJNHzMv+fmYuDlZXciquyi" +
+  "xK2puJ0aTbLLWQXv3wkfNr+Igwr+p3j5613tSqhrbtRo9GFu8LiBJ8bPUX4OOTydf97CBOJBGNtmjJBvo0ePhuXLlw/qgQz6Kb700kvs2WefFTX1wIb2ReYY" +
+  "JQUT0T/woeKIAXeooYs19lZ2HKx3mz5gLYm9N/8baPAJ3pvj/cYyprvC68SJwYzImBbdCAy290cGPW6bPn26LTdX/fDO2CfhHJjoP2jYOBeP8h47qAzVA9Di" +
+  "SlcCkxx9YGQedM7pcPqUIT3+eRRaFAIy/p5BcQ0YxG29Py6/vTHkpzxz5sxjuxUVwIa5N22YdPvICXOCW9VHtFcZwgdgKL0/MuSVm1GjRomSeuBcN0tJM00Q" +
+  "+oMxK4xg/BdeeKEoDZ6UjPO0GAXE+LC0ImOksgJNEHoyXskGrF2w3BPh8/mgvLx8yPabknc35557riiph4srbi5l2yV0Rnn9aoB4FakwfiQlAoDBQz0e9dN6" +
+  "4WIgrmgThF7khRoAl0j1pLS0VJSGTkoEAJk1a5YoqQfGCMiPNPKS6jMOgjgOfKWabYC1qF/96lcp6f2RlP1DWvLdO5azyjoUAoLQjp9+/xy4Y9ZFprSZnjDt" +
+  "jxl7zd0Mc+8RhBbkZaTB3x+7SyrjR1I2BdCauf/6bVEiCPW5aPI3REkuTK1oZ//3I+xIU4uoEYQ6FGVnwnvLb5eu90dU+1Fa7A3AyLqVgWJRIwh1yI00Q2nw" +
+  "iG69pcvlgvXr16vy36s2BbjgggtEST2yoy2QFg+KGkGkHkcyDkXhBl2HymoZP6KaACxcuNCGQQrUpowrsycpbyIRQk+YktbdqVG8hRNxxhlniJI6qC5ss2bN" +
+  "YomEupt30NMNpwJWC0pBqEtGrB1GtR8SNe3BXBxr1qxR1UZVt5i5c+eKknpkxtqgkA/TCCJVYKCV0mCNqGkPZvdR2/gR1QVgxowZtlNOOUXU1CMv0miIXVqE" +
+  "HJSG6jQLtXYipk+fLkrqosmYGTOV5OXliZo6YIJGVGx01iCIoZAXboRMHTuTCRMmwIIFCzRZd9TkP+mCTwdYOKyuGyVGwMHgIQm7Q1whiP7jSUSUWH+4718P" +
+  "CgoKYOXKlZrZpaYCgFx++eWqb+Ftd/pgX/pwCmtFDAiMuDy27YBuQ/9U+fgPBM2XzefPny9K6pEWDykhm7oHwSSInsAev4xPIfUyfrvdrrnxI5oLwKWXXmqb" +
+  "OnWqqKkHvsIZFqzmP5BEgOgD3lEUhep5m2kTF7Rn48aNugxXdRsjb9q0icU0SB31cVUjvLSzChJJEgLixEwdmQ8XjtNvS/ns2bN1s0Pd/mOtGXfN3SxJUwKi" +
+  "G+jl9+T1cy1jB93RfAqgF7tXPWALeNUPW0aYA9xoM2vKGZY2fsQyAoDceckUyJIgpzsxNND4L588ER7+8eWWNn7EMDdAq1yDmMjygL+YEo5aGHTw0TPbFAb1" +
+  "TGVcv6FgKAWcN28eC4XUT7mETkM13jyo9WRjdyCuErLTtb8/S8fV/sGm8VYLw7V+LbwHEVwOrPfmQK03F+I22jUoO/5EGIqCtUpaL73QwrtvoBiy+9Nit2AX" +
+  "HS4/HPYVKFuICTnJjLVDSahW14QemDfj+eefN5y9GVIAEC1FAFNiH/YXQD1OCQiJYNzw6yA/rG8IeT22+PYXwwoAotV0QMFmgyZXOtT48in/oAR442EoDdcp" +
+  "iTz1JBAIwB/+8AfD2pmhBQDRVAQ4YacXary50MzFgDAfuPU7nRt9cbAGPDr68yOZmZmwdu1aQ9uY4QUAmT17NotGtZu/4ZSg1psNR/howCS3iODgHL8oXK+k" +
+  "ktf7qeXk5MCqVasM33hM07q12idwNDG7U3lLUO/OUqYIhDFxJ2Lc8OsgG1/vGWC798iRI2HFihWmaDCmatW33HIL27dvn6hpR9jhgWpvHrS70iBJQmAY3Mko" +
+  "5ERaID/SBHamb8beLs466yy47bbbTNNITNealy9fzt5//31R0w40/HZnAOo82dDhCij7CAh9wA09udEWyIo0g1fneX4XuL14zpw5cMUVV5jKpkzZnb344ovs" +
+  "97//PR/t6WOGTZ5MZaEwYneLK4QWYMQezNKD23hdLC6u6o+RX/P1hSm/tJFY/MwLbOsnOyCsQWwDq3LaqDLY/LNF1FZVgG5qivjF5r+yt7Z/CZ9XVosrxFDI" +
+  "9Ptgyilj4YmFc6iNqgjd3BTz2LoX2btfHoA9NQ0QisaBgpD0HzufRxdnpcM5E0bAAz8lw9cCqW6yVt6E/SHscEObKw1aXenQ4fAAo7RlvYI79nB+j/v2bQZe" +
+  "YjXL+/3+Ip3K3nbbbWzPnj2ipj/YlBM2BwRdPmhzBrggpEGUthor0XcD8aDinReIhZRXekbnnHPOgZtvvlkqm5FymLVu3Tq2ceNGSCaN8W64CxSDODf+MD/a" +
+  "3WkQsnsUMYjbHYpIyAyu4KORp8dD4Oe9PQoAruRjRiejY+ZV/r6Q8kd1ccMNN7CqqipRMx7Y9MMOL0T4dCHEzyGnR3FESoADmB13tRt5MHw82JjwG9tYUjFs" +
+  "NHLMtOPjh1ccemXcGSyTJk2CpUuXSmsnUgsA8sILL7BNmzaBFiHIUwWOBnD3YYfTBx0OnyIQyigBQzgabCciGrQzwQ2dxRQD98fD/BzmPX7CZPJ1LBkZGfDs" +
+  "s89Kbx/S/8Au7rjjDrZr1y5RMw/KKIAbvZLmTJwTNrsiEhjJKGF3KmcUiDi/nuTlEBePJL/elRptsGaIBoxG7ebDdwc/XNzY8ezmQ3fcf985hOfTLN7bKz2/" +
+  "+Htm59xzz4Ubb7zRErZhGQHowkhvClJNjBs/xjvENw5o/Cgc+IiVMp9S4Bm3NDM+kkjgGd9McONFI+aTDjEfx087h/EOHMqj8fPr2NPj35SZ/Px8ePrppy1l" +
+  "E5YTAOTxxx9n77zzjqgRVsflcsGMGTN0zdCjF5YUgC4WLVrEjhw5ImqEFZk4cSLcf//9lrUDSwsAsn79erZlyxbQMuAIoT+ybegZLJa/AV387ne/Y6+99hpE" +
+  "IhFxhZCR7OxsZbh/ySWXUNvn0E3oxtq1a9nWrVtpRCAZGJP/sssug+nTp1ObPwq6GT2wefNmTeMQEuphxcU9giCIPiFlHCC4aKhXJCKid5xOp+lCcukN3axB" +
+  "gAuGb775JrS16ZdkkviawsJCmDZtGsycOZPa8wChGzZE7rrrLrZz505RI7TCbrfD5MmTcYs3teEhQDcvRTz33HPK7sLa2lpxhVCDMWPGwNSpU+GHP/whtd0U" +
+  "QDdRBZ5++mkldDlNEVIDDvExGMfcuXOpvaYYuqEq89RTT7EPP/yQxGCAFBQUwNlnnw1XXnkltVEVoZurIbh4+NFHH8Hhw4fFFaILTKwxbtw4+Pa3v02LeRpC" +
+  "N1pH0CsRFxCtum4wYsQIOPnkk+Haa6+ldqgTdOMNBG5D3r17N1RUVJgqglF/wDz548ePV3p52plnHOhBGJzy8nIlIer+/fuhsbFRXDUuOJQvLi6GUaNGKQcN" +
+  "540NPRwTg/EOGxoa4OhD7RTq6Eabl5ennHNzc5Xjsssuo3ZkUujBSQ46NXV0dCjejSc6sMd2u93K4fF4vip7vV5IT08nt1mCIAiCIAiCIAiCIAjTA/D/Abmz" +
+  "ZXM4My2jAAAAAElFTkSuQmCC";

package/workers/pdf-worker/src/pdf-worker.example.ts

@@ -3,6 +3,7 @@ import type { PDFGenerationData, PDFGenerationRequest, ReportModule } from './re
 
 interface Env {
   BROWSER: Fetcher;
+  PDF_WORKER_AUTH: string;
 }
 
 const DEFAULT_REPORT_FORMAT = 'striae';
@@ -15,9 +16,12 @@ const reportModuleLoaders: Record<string, () => Promise<ReportModule>> = {
 const corsHeaders: Record<string, string> = {
   'Access-Control-Allow-Origin': 'PAGES_CUSTOM_DOMAIN',
   'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
-  'Access-Control-Allow-Headers': 'Content-Type',
+  'Access-Control-Allow-Headers': 'Content-Type, X-Custom-Auth-Key',
 };
 
+const hasValidHeader = (request: Request, env: Env): boolean =>
+  request.headers.get('X-Custom-Auth-Key') === env.PDF_WORKER_AUTH;
+
 function normalizeReportFormat(format: unknown): string {
   if (typeof format !== 'string') {
     return DEFAULT_REPORT_FORMAT;
@@ -71,6 +75,13 @@ export default {
       return new Response(null, { headers: corsHeaders });
     }
 
+    if (!hasValidHeader(request, env)) {
+      return new Response(JSON.stringify({ error: 'Forbidden' }), {
+        status: 403,
+        headers: { ...corsHeaders, 'content-type': 'application/json' },
+      });
+    }
+
     if (request.method === 'POST') {
       let browser: Awaited<ReturnType<typeof launch>> | undefined;
 

package/workers/pdf-worker/wrangler.jsonc.example

@@ -2,7 +2,7 @@
   "name": "PDF_WORKER_NAME",
   "account_id": "ACCOUNT_ID",
   "main": "src/pdf-worker.ts",
-  "compatibility_date": "2026-03-12",
+  "compatibility_date": "2026-03-13",
   "compatibility_flags": [
     "nodejs_compat"
   ],

package/workers/user-worker/wrangler.jsonc.example

@@ -2,7 +2,7 @@
   "name": "USER_WORKER_NAME",
   "account_id": "ACCOUNT_ID",
   "main": "src/user-worker.ts",
-  "compatibility_date": "2026-03-12",
+  "compatibility_date": "2026-03-13",
   "compatibility_flags": [
     "nodejs_compat"
   ], 

package/wrangler.toml.example

@@ -1,6 +1,6 @@
 #:schema node_modules/wrangler/config-schema.json
 name = "PAGES_PROJECT_NAME"
-compatibility_date = "2026-03-12"
+compatibility_date = "2026-03-13"
 compatibility_flags = ["nodejs_compat"]
 pages_build_output_dir = "./build/client"