report-worker Isolate Profile

The report-worker is the automated document compiler of the Hoox trading platform. Deployed as a scheduled cron isolate, this worker runs twice daily (at 06:00 and 18:00 UTC) to pull D1 transactional stats, construct a highly styled HTML5 portfolio report, spin up a serverless Cloudflare Browser Rendering Chrome instance to compile the page into a PDF buffer, offload the file to R2, and push a private download link to your Telegram.

---

⚡ 1. Declared Wrangler Configurations & Bindings

The report-worker mounts storage buckets, notification bindings, and is triggered by Cloudflare's background cron engine:

{
  "name": "report-worker",
  "main": "src/index.ts",
  "compatibility_date": "2026-05-19",
  "compatibility_flags": ["nodejs_compat"],
  "account_id": "debc6545e63bea36be059cbc82d80ec8",
  "placement": {
    "mode": "smart",
  },
  "triggers": {
    "crons": ["0 6 * * *", "0 18 * * *"], // Runs twice daily
  },
  "r2_buckets": [
    {
      "binding": "REPORTS_BUCKET",
      "bucket_name": "trade-reports",
    },
  ],
  "services": [
    { "binding": "D1_SERVICE", "service": "d1-worker" },
    { "binding": "TELEGRAM_SERVICE", "service": "telegram-worker" },
  ],
  "secrets": [
    "INTERNAL_KEY_BINDING",
    "CF_API_TOKEN", // Required to call Browser Rendering REST API
  ],
}

---

🔑 2. Environmental Variables & Encrypted Secrets

• CF_API_TOKEN: Your Cloudflare API Token with Account.Browser Rendering and Account.R2 write permissions.
• INTERNAL_KEY_BINDING: Shared key used to validate calls from other V8 isolates.

---

🌐 3. Browser Rendering & PDF Print Pipeline

When the Cron schedule triggers, report-worker runs the following programmatic pipeline:

Step 1: Data Aggregation & HTML Compilation

The worker pings D1_SERVICE to retrieve P&L, win rate, and total daily fees, inserting the metrics into a styled HTML5 template utilizing Tailwind CSS and CSS Grid styling:

<div class="card">
  <h2>Daily P&L</h2>
  <p class="pnl-green">+$1,234.50</p>
</div>

---

Step 2: Cloudflare Chrome Isolate Print

Pushes the HTML template to Cloudflare's headless Chrome rendering pool via the REST API:

const response = await fetch(
  `https://api.cloudflare.com/client/v4/accounts/${env.ACCOUNT_ID}/browser-rendering/pdf`,
  {
    method: "POST",
    headers: {
      Authorization: `Bearer ${env.CF_API_TOKEN}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      html: htmlContent,
      options: {
        format: "A4",
        printBackground: true,
        margin: { top: "1cm", bottom: "1cm", left: "1cm", right: "1cm" },
      },
    }),
  }
);

---

Step 3: R2 Storage & Expiration

1. The Browser Rendering binding (BROWSER.quickAction("pdf", …)) compiles the page and returns a raw PDF binary stream.
2. The worker uploads the stream to the REPORTS_BUCKET R2 storage bucket using a path-safe key: reports/daily-pnl-YYYY-MM-DD-{timestamp}.pdf Keys are validated (assertSafeReportKey) so .., absolute paths, and non-PDF names are rejected.
3. A lifecycle rule on the R2 bucket automatically purges reports older than 30 days to maintain storage cleanliness.

---

Step 4: Dispatch Telegram Alert

Calls TELEGRAM_SERVICE /alert with fail-closed internal auth (TELEGRAM_ALERT_AUTH_KEY_FIELDS). Download URLs encode path segments and only use a validated host from REPORT_WORKER_URL.

---

Security notes

• Auth: GET /report requires X-Internal-Auth-Key (fail-closed). Cron uses the scheduled handler (no public HTTP).
• HTML escape: All D1-sourced strings (e.g. topAsset) are escaped before interpolation into the PDF HTML template.
• R2 path safety: Object keys must match ^reports/[A-Za-z0-9._-]+\.pdf$.

🔗 Next Steps

• telegram-worker Profile — Review push alert configurations and webhook tunnels.
• D1 Database Operations — Manage Drizzle schemas and execute custom queries.