@striae-org/striae 4.2.1 → 4.3.1

package/app/utils/forensics/confirmation-signature.ts

@@ -123,8 +123,12 @@ function normalizeConfirmations(confirmations: ConfirmationMap): ConfirmationMap
 
 export function createConfirmationSigningPayload(
   confirmationData: ConfirmationImportData,
-  signatureVersion: string = CONFIRMATION_SIGNATURE_VERSION
+  signatureVersion: string = CONFIRMATION_SIGNATURE_VERSION,
+  options: {
+    includeExportedByBadgeId?: boolean;
+  } = {}
 ): string {
+  const includeExportedByBadgeId = options.includeExportedByBadgeId !== false;
   const canonicalPayload = {
     signatureVersion,
     metadata: {
@@ -134,7 +138,7 @@ export function createConfirmationSigningPayload(
       exportedByUid: confirmationData.metadata.exportedByUid,
       exportedByName: confirmationData.metadata.exportedByName,
       exportedByCompany: confirmationData.metadata.exportedByCompany,
-      ...(confirmationData.metadata.exportedByBadgeId
+      ...(includeExportedByBadgeId && confirmationData.metadata.exportedByBadgeId
         ? { exportedByBadgeId: confirmationData.metadata.exportedByBadgeId }
         : {}),
       totalConfirmations: confirmationData.metadata.totalConfirmations,
@@ -180,9 +184,7 @@ export async function verifyConfirmationSignature(
     };
   }
 
-  const payload = createConfirmationSigningPayload(confirmationData, signatureVersion);
-
-  return verifySignaturePayload(
+  const verifyPayload = (payload: string) => verifySignaturePayload(
     payload,
     signature,
     FORENSIC_MANIFEST_SIGNATURE_ALGORITHM,
@@ -197,4 +199,17 @@ export async function verifyConfirmationSignature(
       verificationPublicKeyPem
     }
   );
+
+  const primaryPayload = createConfirmationSigningPayload(confirmationData, signatureVersion);
+  const primaryResult = await verifyPayload(primaryPayload);
+
+  if (primaryResult.isValid || !confirmationData.metadata.exportedByBadgeId) {
+    return primaryResult;
+  }
+
+  const legacyPayload = createConfirmationSigningPayload(confirmationData, signatureVersion, {
+    includeExportedByBadgeId: false
+  });
+
+  return verifyPayload(legacyPayload);
 }

package/functions/api/image/[[path]].ts

@@ -53,6 +53,10 @@ function extractProxyPath(url: URL): ProxyPathResult {
 
   try {
     const decodedPath = decodeURIComponent(encodedPath);
+    if (decodedPath.includes('?') || decodedPath.includes('#')) {
+      return { ok: false, reason: 'bad-encoding' };
+    }
+
     return { ok: true, path: decodedPath.startsWith('/') ? decodedPath : `/${decodedPath}` };
   } catch {
     return { ok: false, reason: 'bad-encoding' };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@striae-org/striae",
-  "version": "4.2.1",
+  "version": "4.3.1",
   "private": false,
   "description": "Striae is a specialized, cloud-native platform designed to streamline forensic firearms identification by providing an intuitive environment for digital comparison image annotation, authenticated confirmations, and automated report generation.",
   "license": "Apache-2.0",
@@ -54,10 +54,9 @@
     "workers/*/src/*.example.ts",
     "workers/*/src/*.example.js",
     "workers/*/src/*.ts",
-    "workers/pdf-worker/scripts/*.js",
-    "workers/pdf-worker/src/assets/icon-256.png",
+    "workers/pdf-worker/scripts/*.js",    
     "!workers/*/src/*worker.ts",
-    "workers/pdf-worker/src/assets/generated-assets.ts",
+    "workers/pdf-worker/src/assets/generated-assets.example.ts",
     "workers/pdf-worker/src/formats/format-striae.ts",
     "workers/pdf-worker/src/report-types.ts",
     "workers/*/wrangler.jsonc.example",

package/workers/audit-worker/wrangler.jsonc.example

@@ -2,7 +2,7 @@
   "name": "AUDIT_WORKER_NAME",
   "account_id": "ACCOUNT_ID",
   "main": "src/audit-worker.ts",
-  "compatibility_date": "2026-03-21",
+  "compatibility_date": "2026-03-22",
   "compatibility_flags": [
     "nodejs_compat"
   ], 

package/workers/data-worker/src/signing-payload-utils.ts

@@ -13,6 +13,7 @@ export interface ConfirmationSignatureMetadata {
   exportedByUid: string;
   exportedByName: string;
   exportedByCompany: string;
+  exportedByBadgeId?: string;
   totalConfirmations: number;
   version: string;
   hash: string;
@@ -131,6 +132,7 @@ export function isValidConfirmationPayload(
     typeof metadata.exportedByUid !== 'string' ||
     typeof metadata.exportedByName !== 'string' ||
     typeof metadata.exportedByCompany !== 'string' ||
+    (typeof metadata.exportedByBadgeId !== 'undefined' && typeof metadata.exportedByBadgeId !== 'string') ||
     typeof metadata.totalConfirmations !== 'number' ||
     metadata.totalConfirmations < 0 ||
     typeof metadata.version !== 'string' ||
@@ -261,6 +263,9 @@ export function createConfirmationSigningPayload(confirmationData: ConfirmationS
       exportedByUid: confirmationData.metadata.exportedByUid,
       exportedByName: confirmationData.metadata.exportedByName,
       exportedByCompany: confirmationData.metadata.exportedByCompany,
+      ...(confirmationData.metadata.exportedByBadgeId
+        ? { exportedByBadgeId: confirmationData.metadata.exportedByBadgeId }
+        : {}),
       totalConfirmations: confirmationData.metadata.totalConfirmations,
       version: confirmationData.metadata.version,
       hash: confirmationData.metadata.hash.toUpperCase(),

package/workers/data-worker/wrangler.jsonc.example

@@ -3,7 +3,7 @@
   "name": "DATA_WORKER_NAME",
   "account_id": "ACCOUNT_ID",
   "main": "src/data-worker.ts",
-  "compatibility_date": "2026-03-21",
+  "compatibility_date": "2026-03-22",
   "compatibility_flags": [
     "nodejs_compat"
   ], 

package/workers/image-worker/wrangler.jsonc.example

@@ -2,7 +2,7 @@
   "name": "IMAGES_WORKER_NAME",
   "account_id": "ACCOUNT_ID",
   "main": "src/image-worker.ts",
-  "compatibility_date": "2026-03-21",
+  "compatibility_date": "2026-03-22",
   "compatibility_flags": [
     "nodejs_compat"
   ], 

package/workers/keys-worker/wrangler.jsonc.example

@@ -2,7 +2,7 @@
   "name": "KEYS_WORKER_NAME",
   "account_id": "ACCOUNT_ID",
   "main": "src/keys.ts",
-  "compatibility_date": "2026-03-21",
+  "compatibility_date": "2026-03-22",
   "compatibility_flags": [
     "nodejs_compat"
   ], 

package/workers/pdf-worker/src/formats/format-striae.ts

@@ -1,9 +1,12 @@
-import type { PDFGenerationData, ReportRenderer } from '../report-types';
+import type { PDFGenerationData, ReportPdfOptionsBuilder, ReportRenderer } from '../report-types';
 import { ICON_256 } from '../assets/generated-assets';
+import { buildRepeatedChromePdfOptions, escapeHtml } from '../report-layout';
 
 export const renderReport: ReportRenderer = (data: PDFGenerationData): string => {
-  const { imageUrl, caseNumber, annotationData, activeAnnotations, currentDate, notesUpdatedFormatted, userCompany } = data;
+  const { imageUrl, annotationData, activeAnnotations } = data;
   const annotationsSet = new Set(activeAnnotations);
+  const hasImage = Boolean(imageUrl && imageUrl !== '/clear.jpg');
+  const safeText = (value: unknown): string => escapeHtml(String(value ?? ''));
 
   // Programmatically determine if a color is dark and needs a light background
   const needsLightBackground = (color: string | undefined): boolean => {
@@ -71,42 +74,23 @@ export const renderReport: ReportRenderer = (data: PDFGenerationData): string =>
     <style>
       html, body {
         width: 100%;
-        height: 100%;
         margin: 0;
         font-family: Arial, sans-serif;
         background-color: white;
-        display: flex;
-        flex-direction: column;
-        min-height: 100vh;
       }
-      .header {
-        display: flex;
-        align-items: center;
-        margin-bottom: 15px;
-        border-bottom: 2px solid #333;
-        padding-bottom: 8px;
-        position: relative;
-      }
-      .header-content {
-        flex: 1;
-        display: flex;
-        align-items: center;
-        justify-content: space-between;
+      body {
+        color: #333;
       }
-      .date {
-        font-size: 16px;
-        font-weight: bold;
+      .report-body {
+        width: 100%;
+        box-sizing: border-box;
       }
-      .case-number {
-        font-size: 16px;
-        font-weight: bold;
-        color: #333;
-        text-align: right;
-      }      
       .image-container {
         width: 100%;
-        margin: 10px 0;
+        margin: 0 0 10px;
         position: relative;
+        page-break-inside: avoid;
+        break-inside: avoid;
       }
       .image-wrapper {
         display: flex;
@@ -170,6 +154,8 @@ export const renderReport: ReportRenderer = (data: PDFGenerationData): string =>
         width: 100%;
         margin-top: 12px;
         min-height: 50px;
+        page-break-inside: avoid;
+        break-inside: avoid;
       }
       .support-level-annotation {
         flex: 1;
@@ -235,10 +221,21 @@ export const renderReport: ReportRenderer = (data: PDFGenerationData): string =>
       }
       .confirmation-section {
         margin-top: 20px;
+        display: flex;
+        flex-direction: column;
+        gap: 16px;
+      }
+      .notes-page {
+        page-break-before: always;
+        break-before: page;
+      }
+      .confirmation-summary {
         display: flex;
         justify-content: flex-start;
         align-items: flex-start;
         gap: 20px;
+        page-break-inside: avoid;
+        break-inside: avoid;
       }
       .confirmation-box {
         background: #ffffff;
@@ -247,6 +244,7 @@ export const renderReport: ReportRenderer = (data: PDFGenerationData): string =>
         padding: 15px;
         width: 280px;
         font-family: 'Inter', Arial, sans-serif;
+        box-sizing: border-box;
       }
       .confirmation-label {
         font-size: 14px;
@@ -274,6 +272,7 @@ export const renderReport: ReportRenderer = (data: PDFGenerationData): string =>
         padding: 15px;
         width: 280px;
         font-family: 'Inter', Arial, sans-serif;
+        box-sizing: border-box;
       }
       .confirmation-title {
         font-size: 14px;
@@ -316,64 +315,32 @@ export const renderReport: ReportRenderer = (data: PDFGenerationData): string =>
         letter-spacing: 1px;
       }
       .additional-notes-section {
-        max-width: 400px;
+        border: 1px solid #d7dbe0;
+        border-radius: 8px;
+        background: #fafbfc;
+        padding: 16px 18px;
+        box-sizing: border-box;
         font-family: 'Inter', Arial, sans-serif;
-        font-size: 14px;
-        line-height: 1.6;
         color: #333;
-        white-space: pre-wrap;
-        word-wrap: break-word;
-        text-indent: 0 !important;
-        padding: 0;
-        margin: 0;
-        margin-left: 20px;
-        flex-shrink: 0;
-        text-align: left;
-        display: block;
       }
-      .footer {
-        margin-top: auto;
-        padding-top: 15px;
-        border-top: 1px solid #ccc;
-        display: flex;
-        justify-content: space-between;
-        align-items: center;
-        font-family: 'Inter', Arial, sans-serif;
-        font-size: 11px;
+      .additional-notes-title {
+        margin: 0 0 10px;
+        font-size: 12px;
+        font-weight: 700;
+        letter-spacing: 0.08em;
+        text-transform: uppercase;
         color: #666;
       }
-      .main-content {
-        flex: 1;
-        display: flex;
-        flex-direction: column;
-      }
-      .content-wrapper {
-        flex-grow: 0;
-        flex-shrink: 0;
-      }
-      .footer-left {
-        font-weight: 500;
-        flex: 1;
-        text-align: left;
-        display: flex;
-        align-items: center;
-        gap: 6px;
-      }
-      .footer-brand-icon {
-        width: 14px;
-        height: 14px;
-        object-fit: contain;
-      }
-      .footer-center {
-        font-weight: 600;
-        flex: 1;
-        text-align: center;
-        color: #333;
-      }
-      .footer-right {
-        font-style: italic;
-        flex: 1;
-        text-align: right;
+      .additional-notes-body {
+        margin: 0;
+        font-size: 14px;
+        line-height: 1.6;
+        white-space: pre-wrap;
+        overflow-wrap: anywhere;
+        word-break: break-word;
+        text-indent: 0 !important;
+        orphans: 3;
+        widows: 3;
       }
       .index-section {
         text-align: center;
@@ -395,19 +362,12 @@ export const renderReport: ReportRenderer = (data: PDFGenerationData): string =>
     </style>
   </head>
   <body>
-    <div class="main-content">
-    <div class="content-wrapper">
-    <div class="header">
-      <div class="header-content">
-        <div class="date">${currentDate}</div>
-        ${caseNumber ? `<div class="case-number">${caseNumber}</div>` : '<div class="case-number"></div>'}
-      </div>
-    </div>
+    <div class="report-body">
     
-    ${imageUrl && imageUrl !== '/clear.jpg' ? `
+    ${hasImage ? `
     ${annotationData && annotationsSet?.has('index') && annotationData.indexType === 'number' && annotationData.indexNumber ? `
     <div class="index-section">
-      Index: ${annotationData.indexNumber}
+      Index: ${safeText(annotationData.indexNumber)}
     </div>
     ` : ''}
     
@@ -419,12 +379,12 @@ export const renderReport: ReportRenderer = (data: PDFGenerationData): string =>
         <div class="annotations-overlay">
           <div class="left-annotation" style="${needsLightBackground(annotationData.caseFontColor || '#FFDE21') ? 'background: rgba(255, 255, 255, 0.9); border: 2px solid rgba(0, 0, 0, 0.2); box-shadow: 0 4px 12px rgba(0, 0, 0, 0.1);' : ''}">
             <div class="case-text" style="color: ${annotationData.caseFontColor || '#FFDE21'};">
-              ${annotationData.leftCase}${annotationData.leftItem ? ` ${annotationData.leftItem}` : ''}
+              ${safeText(annotationData.leftCase)}${annotationData.leftItem ? ` ${safeText(annotationData.leftItem)}` : ''}
             </div>
           </div>
           <div class="right-annotation" style="${needsLightBackground(annotationData.caseFontColor || '#FFDE21') ? 'background: rgba(255, 255, 255, 0.9); border: 2px solid rgba(0, 0, 0, 0.2); box-shadow: 0 4px 12px rgba(0, 0, 0, 0.1);' : ''}">
             <div class="case-text" style="color: ${annotationData.caseFontColor || '#FFDE21'};">
-              ${annotationData.rightCase}${annotationData.rightItem ? ` ${annotationData.rightItem}` : ''}
+              ${safeText(annotationData.rightCase)}${annotationData.rightItem ? ` ${safeText(annotationData.rightItem)}` : ''}
             </div>
           </div>
         </div>
@@ -450,7 +410,7 @@ export const renderReport: ReportRenderer = (data: PDFGenerationData): string =>
         ${annotationData && annotationsSet?.has('id') ? `
         <div class="support-level-annotation">
           <div class="support-level-text" style="color: ${annotationData.supportLevel === 'ID' ? '#28a745' : annotationData.supportLevel === 'Exclusion' ? '#dc3545' : '#ffc107'}; background: ${annotationData.supportLevel === 'Inconclusive' ? 'rgba(120, 120, 120, 0.95)' : 'rgba(240, 240, 240, 0.95)'};">
-            ${annotationData.supportLevel === 'ID' ? 'Identification' : annotationData.supportLevel}
+            ${safeText(annotationData.supportLevel === 'ID' ? 'Identification' : annotationData.supportLevel)}
           </div>
         </div>
         ` : '<div class="support-level-annotation"></div>'}
@@ -458,7 +418,7 @@ export const renderReport: ReportRenderer = (data: PDFGenerationData): string =>
         ${annotationData && annotationsSet?.has('class') ? `
         <div class="class-annotation">
           <div class="class-text-annotation">
-            ${annotationData.customClass || annotationData.classType}${annotationData.classNote ? ` (${annotationData.classNote})` : ''}
+            ${safeText(annotationData.customClass || annotationData.classType)}${annotationData.classNote ? ` (${safeText(annotationData.classNote)})` : ''}
           </div>
         </div>
         ` : '<div class="class-annotation"></div>'}
@@ -477,20 +437,21 @@ export const renderReport: ReportRenderer = (data: PDFGenerationData): string =>
     ${annotationData && ((annotationData.includeConfirmation === true) || annotationData.additionalNotes) ? `
     <div class="confirmation-section">
       ${annotationData && (annotationData.includeConfirmation === true) ? `
+        <div class="confirmation-summary">
         ${annotationData.confirmationData ? `
         <div class="confirmation-data">
           <div class="confirmation-title">IDENTIFICATION CONFIRMED</div>
           <div class="confirmation-field">
-            <div class="confirmation-name">${annotationData.confirmationData.fullName}, ${annotationData.confirmationData.badgeId}</div>
+            <div class="confirmation-name">${safeText(annotationData.confirmationData.fullName)}, ${safeText(annotationData.confirmationData.badgeId)}</div>
           </div>
           <div class="confirmation-field">
-            <div class="confirmation-company">${annotationData.confirmationData.confirmedByCompany || 'N/A'}</div>
+            <div class="confirmation-company">${safeText(annotationData.confirmationData.confirmedByCompany || 'N/A')}</div>
           </div>
           <div class="confirmation-field">
-            <div class="confirmation-timestamp">${annotationData.confirmationData.timestamp}</div>
+            <div class="confirmation-timestamp">${safeText(annotationData.confirmationData.timestamp)}</div>
           </div>
           <div class="confirmation-field">
-            <div class="confirmation-id">ID: ${annotationData.confirmationData.confirmationId}</div>
+            <div class="confirmation-id">ID: ${safeText(annotationData.confirmationData.confirmationId)}</div>
           </div>
         </div>
         ` : `
@@ -501,30 +462,35 @@ export const renderReport: ReportRenderer = (data: PDFGenerationData): string =>
           <div class="confirmation-line"></div>
         </div>
         `}
-      ` : '<div></div>'}
+        </div>
+      ` : ''}
 
       ${annotationData && annotationsSet?.has('notes') && annotationData.additionalNotes && annotationData.additionalNotes.trim() ? `
-      <div class="additional-notes-section">${annotationData.additionalNotes.trim()}</div>
-      ` : '<div></div>'}
+      <section class="additional-notes-section ${hasImage || annotationData.includeConfirmation === true ? 'notes-page' : ''}">
+        <h2 class="additional-notes-title">Additional Notes</h2>
+        <p class="additional-notes-body">${escapeHtml(annotationData.additionalNotes.trim())}</p>
+      </section>
+      ` : ''}
     </div>
     ` : ''}
     
     </div>
-    </div>
-    
-    <div class="footer">
-      <div class="footer-left">
-        <span>Notes formatted by Striae</span>
-          <img class="footer-brand-icon" src="${ICON_256}" alt="Striae icon" />
-      </div>
-      <div class="footer-center">
-        ${userCompany ? userCompany : ''}
-      </div>
-      <div class="footer-right">
-        ${notesUpdatedFormatted ? `Notes updated ${notesUpdatedFormatted}` : ''}
-      </div>
-    </div>
   </body>
 </html>
 `;
-};
+};
+
+export const getPdfOptions: ReportPdfOptionsBuilder = (data: PDFGenerationData) => buildRepeatedChromePdfOptions({
+  headerLeft: data.currentDate,
+  headerRight: data.caseNumber,
+  headerDetailLeft: [data.annotationData?.leftCase, data.annotationData?.leftItem].filter(Boolean).join(' / ')
+    ? `Left Case / Item: ${[data.annotationData?.leftCase, data.annotationData?.leftItem].filter(Boolean).join(' / ')}`
+    : undefined,
+  headerDetailRight: [data.annotationData?.rightCase, data.annotationData?.rightItem].filter(Boolean).join(' / ')
+    ? `Right Case / Item: ${[data.annotationData?.rightCase, data.annotationData?.rightItem].filter(Boolean).join(' / ')}`
+    : undefined,
+  footerLeft: 'Notes formatted by Striae',
+  footerCenter: data.userCompany,
+  footerRight: data.notesUpdatedFormatted ? `Notes updated ${data.notesUpdatedFormatted}` : undefined,
+  footerLeftImageSrc: ICON_256,
+});

package/workers/pdf-worker/src/pdf-worker.example.ts

@@ -1,16 +1,16 @@
-import type { PDFGenerationData, PDFGenerationRequest, ReportModule } from './report-types';
+import type { PDFGenerationData, PDFGenerationRequest, ReportModule, ReportPdfOptions } from './report-types';
 
 interface Env {
   BROWSER: Fetcher;
   PDF_WORKER_AUTH: string;
-  ACCOUNT_ID: string;
-  BROWSER_API_TOKEN: string;
+  ACCOUNT_ID?: string;
+  BROWSER_API_TOKEN?: string;
 }
 
 const BROWSER_PDF_TIMEOUT_MS = 90_000;
 const BROWSER_RENDERING_API_BASE = 'https://api.cloudflare.com/client/v4/accounts';
 
-const DEFAULT_PDF_OPTIONS = {
+const DEFAULT_PDF_OPTIONS: ReportPdfOptions = {
   printBackground: true,
   format: 'letter',
   margin: {
@@ -21,6 +21,17 @@ const DEFAULT_PDF_OPTIONS = {
   },
 };
 
+function resolvePdfOptions(overrides?: Partial<ReportPdfOptions>): ReportPdfOptions {
+  return {
+    ...DEFAULT_PDF_OPTIONS,
+    ...overrides,
+    margin: {
+      ...DEFAULT_PDF_OPTIONS.margin,
+      ...overrides?.margin,
+    },
+  };
+}
+
 const reportModuleLoaders: Record<string, () => Promise<ReportModule>> = {
   // Default Striae report format module
   striae: () => import('./formats/format-striae'),
@@ -63,7 +74,11 @@ class MissingSecretError extends Error {
   }
 }
 
-function getRequiredSecret(value: string, name: string): string {
+function getRequiredSecret(value: string | undefined, name: string): string {
+  if (typeof value !== 'string') {
+    throw new MissingSecretError(name);
+  }
+
   const normalized = value.trim();
   if (!normalized) {
     throw new MissingSecretError(name);
@@ -97,7 +112,7 @@ function resolveReportRequest(payload: unknown): PDFGenerationRequest {
   };
 }
 
-async function renderReport(reportFormat: string, data: PDFGenerationData): Promise<string> {
+async function renderReport(reportFormat: string, data: PDFGenerationData): Promise<{ html: string; pdfOptions: ReportPdfOptions }> {
   const loader = reportModuleLoaders[reportFormat];
 
   if (!loader) {
@@ -106,17 +121,20 @@ async function renderReport(reportFormat: string, data: PDFGenerationData): Prom
   }
 
   const reportModule = await loader();
-  return reportModule.renderReport(data);
+  return {
+    html: reportModule.renderReport(data),
+    pdfOptions: resolvePdfOptions(reportModule.getPdfOptions?.(data)),
+  };
 }
 
-async function renderPdfViaRestEndpoint(env: Env, html: string): Promise<Response> {
+async function renderPdfViaRestEndpoint(env: Env, html: string, pdfOptions: ReportPdfOptions): Promise<Response> {
   const accountId = getRequiredSecret(env.ACCOUNT_ID, 'ACCOUNT_ID');
   const browserApiToken = getRequiredSecret(env.BROWSER_API_TOKEN, 'BROWSER_API_TOKEN');
 
   const endpoint = `${BROWSER_RENDERING_API_BASE}/${accountId}/browser-rendering/pdf`;
   const requestBody = JSON.stringify({
     html,
-    pdfOptions: DEFAULT_PDF_OPTIONS,
+    pdfOptions,
   });
 
   let endpointResponse: Response;
@@ -192,7 +210,7 @@ export default {
         const { reportFormat, data } = resolveReportRequest(payload);
         const document = await renderReport(reportFormat, data);
 
-        return await renderPdfViaRestEndpoint(env, document);
+        return await renderPdfViaRestEndpoint(env, document.html, document.pdfOptions);
       } catch (error) {
         if (error instanceof MissingSecretError) {
           console.error(`[pdf-worker] Configuration error: ${error.message}`);