Changelog.

Added- core: harden extensibility surfaces across plugins, formatters, and downloader (#2083)

Fixed

• security: SSRF hardening, WS compile quota enforcement, and two auth hardenings (#2081)
• ci: authenticate JSR publish with a token instead of OIDC (#2078)
• apply deno fmt to license docs (#2075)

Added- cli: add Bun runtime support and fix broken Node/Deno-only CLI paths (#2068)

Fixed

• ci: avoid broken-pipe failure in version-bump changelog step (#2070)

Added### Fixed

• transformations: don't drop plugin-registered transformation types from pipeline (#2065)
• docs: pin astro to 6.1.10, add CI guard for silent render regressions (#2062)
• docs: restore Mermaid diagram rendering across all docs pages (#2061)

Added- flagship: add Cloudflare Flagship feature flag integration

Fixed

• frontend: route /api/* through Worker before assets-first SPA fallback (#2053)
• worker: allow HEAD requests through pre-auth bypass for public paths (#2052)
• sitemap: fix production 404s on app/api sitemap endpoints (#2051)
• worker: align health-check db-name guard with production adblock-compiler (#2050)
• frontend: fix health status masking and add technical detail dialog (#2049)

Added- sitemap: add dynamic sitemaps and sitemap indexes to frontend and API worker (#2044)

Added### Fixed

• analytics: resolve CI failures on PR #1933 — valid-typeof lint and JSR slow-types (#2038)

Added### Fixed

• auth: add activeOrganizationId to Session model — unblocks all sign-ins (#2034)

Added- auth: forgot password flow, email verification UX, auth route CORS fix (#2032)

• frontend: upgrade Angular 22 → 22 with new feature support (#2023)

Fixed

• ci: fix sentry-cli v3 deploys new syntax in worker workflow (#2029)
• auth: include URL_FRONTEND/URL_LANDING in CORS trusted origins (#2027)
• ci: resolve Sentry source map CI errors (#2026)

Added### Fixed

• types: update ExecutionContext stubs for workers-types tracing property (#2013)
• correct indentation in resend-api-service.ts to use 4 spaces instead of tabs
• format ResendApiError JSDoc comment to pass deno fmt
• remove duplicate adminCfAuditRoute declaration at line 3006

Added### Fixed

• remove duplicate listPipelines method in CloudflareApiService

Added### Fixed

• update db name check from bloqr-compiler to bloqr-compiler (#1925)

Added- pricing: add public /pricing route with tier cards, comparison table, FAQ, and real-time add-on/cadence details (#1921)

• implement Cloudflare Artifacts binding end-to-end (#1912)
• worker: stub POST /api/webhook/stripe with HMAC-verified signature pattern (#1904)

Fixed

• pin container app name to bloqr-backend-adblockcompiler to fix DURABLE_OBJECT_ALREADY_HAS_APPLICATION (#1918)
• add v6 renamed_classes migration for AdblockCompiler → BloqrCompiler (#1914)
• worker: use ReturnType<typeof setTimeout> for timeoutId to fix TS2322 (#1906)
• ci: handle unregistered JSR package gracefully in workflow steps (#1905)

Added- implement dynamic workflows on dynamic workers with CI compatibility fixes (#1895)

• add closed-beta notices to API responses, landing page, and Angular docs (#1897)
• add sign-up link to beta banner (#1894)

Fixed

• docs: read entry from Astro.locals.starlightRoute not Astro.props
• docs: render page titles as "Bloqr AI — Page Title"
• docs: correctly derive page title from H1 when frontmatter title is absent
• docs: remove duplicate custom <title> from Head override
• correct docs page title format to pageTitle — Bloqr AI (#1890)
• move tagline inside header row for inline alignment (#1889)
• frontend: left-align nav brand on desktop; add vertical padding to title row (#1876)

Added### Fixed

• docs: add Bloqr light theme overrides for Starlight (#1849)
• restore private repo badges with shields.io token support

Added- docs: configure all Starlight plugins with full options (#1819)

• docs: integrate starlight-to-pdf for local PDF generation (#1816)
• docs: migrate 217 .md files to .mdx + enrich 4 key pages with MDX components (#1814)
• docs: add 6 compatible Starlight plugins to docs package (#1809)
• tools: add missing runbook deno task shortcuts and expand docs (#1806)
• frontend: animated splash screen + Bloqr AI rebrand in site chrome (#1798)
• Bloqr AI rebrand + splash screen + live API docs links + doc handler fallbacks (#1799)
• consolidate docs into single Astro Starlight project in docs/ (#1791)
• add dedicated Playwright E2E workflow (#1789)
• add DynamicCompilationWorkflow with @cloudflare/dynamic-workflows (#1787)
• tools: wire Bloqr theme CSS into all Marimo runbooks via mo.css() (#1778)

Fixed

• docs: resolve Starlight fallback slugs, favicon, and title format (#1817)
• docs: set starlightSiteGraph contentRoot to '.' to match glob loader base
• docs: escape bare < in OPENAPI_TOOLING.mdx to fix MDX parse error
• reformat JSON log file to pass deno fmt --check (4-space indent)
• docs: normalize Starlight sidebar links to lowercase and fix README index slugs (#1808)
• theming: remove global element overrides from bloqr-theme.css to fix dark mode visibility (#1807)
• docs: replace Starlight header logo with Bloqr horizontal bars brand logo (#1810)
• postman: use pm.environment instead of pm.collectionVariables (#1805)
• docs: fix Starlight build errors blocking docs CI (#1804)
• frontend: replace img logo with inline SVG branding in app header (#1803)
• docs: move content config to src/content.config.ts for Astro v6 compatibility (#1802)
• resolve CI regressions from PRs #1786–#1799 — double splash, E2E assertions, workflow triggers, docs playwright dep (#1801)
• API docs blank pages — remove CSP hash-source, add error handling, guard OpenAPI spec endpoint (#1796)
• workflows: fix CI permissions, disable CodeQL until GHAS license is active, and keep emitStepStarted in orchestrator context (#1792)
• docs-starlight: install Playwright Chromium in CI; fix Zod v3/v4 instance mismatch in content config (#1788)
• starlight: inject default title for docs missing frontmatter
• starlight: add required title to 404.md and fix deno fmt transition shorthand
• starlight: fix glob base path and remove non-existent font variant import
• Dockerfile bloqr-frontend rename, drop Docusaurus CI, promote Starlight to docs.bloqr.dev (#1786)
• config: rename all remaining adblock-* resources to bloqr-* with consistent naming conventions (#1785)
• complete bloqr-backend cutover — scheduling_policy, StripeWebhookProcessor DO, cron schedules (#1774)

Added- #1738: Marimo foundation setup with Cloudflare deployment and AI automation (#1765)

• auth: Better Auth performance optimizations (#1759)
• secure error-passing architecture — KV flash store, Bloqr-styled error UX, D1 audit log (#1748)
• postman: Complete Newman/Postman overhaul + CI integration (#1711)
• scaffold Docusaurus v3 docs site (docs-docusaurus/) (#1739)
• scaffold Starlight (Astro) documentation site in docs-starlight/ (#1740)
• tools: install marimo[mcp] extra
• tools: add Marimo optional deps and configure Anthropic AI in .marimo.toml
• monorepo: formally declare monorepo with Deno/pnpm workspaces + Astral Python toolchain (#1735)
• tools: Marimo runbooks, per-tool docs, PR template, and pipeline infrastructure (#1732)
• tools: complete debug pass on auth-healthcheck.py — cleanup, interactive menu, and pipeline mode (#1728)
• resend: Zod hardening, ZTA API-key guard, and Templates API service (#1719)

Fixed

• correct stale service binding docs and add explicit dev services override (#1764)
• remove explicit pnpm version to use packageManager from package.json
• correct pnpm/action-setup SHA pin for v4.0.0
• docker: recover from stale APT index in Dockerfile.container (#1761)
• ci: unblock cloudflare-dep-update workflow push by removing workflow file modifications (#1757)
• ci: remove invalid workflows: write permission from cloudflare-dep-update workflow (#1756)
• ci: stop cloudflare-dep-update from failing on feature-branch pushes and missing label (#1755)
• runbooks: fix all ruff CI failures in marimo runbooks + add Python/marimo lint guidance (#1751)
• tools: bump marimo to >=0.17.0 for MCP support
• runbooks: correctly scope cross-cell vs cell-private variables in auth-healthcheck.py
• deno: add missing exports field to worker deno.json configs
• runbooks: correctly scope cross-cell vs cell-private variables in pipeline.py
• runbooks: prefix all conflicting cell-local variables with _ in pipeline.py
• tools: migrate tool.uv.dev-dependencies to dependency-groups.dev
• tools: auth-healthcheck — 5 bug fixes, email auto-verify, universal cleanup, KV/D1/Neon caching (#1734)
• tools: rewrite auth-healthcheck.py — fix all 6 runtime bugs + 3 review-identified correctness fixes (#1733)
• tools: Neon table discovery, D1 --remote, KV stdout split, logs → tools/logs/
• tools: repair NEON_URL env loading + add tools/README.md
• auth: implement Better Auth system audit findings (#1726) — 13 issues (#1727)
• storeSessionInDatabase=true prevents BetterAuthError when KV secondary storage is bound (#1725)
• auth: gate sentinel() behind BETTER_AUTH_SENTINEL_ENABLED flag (#1724)
• auth: pass BETTER_AUTH_API_KEY explicitly to dash() and sentinel() plugins (#1722)
• auth: remove unavailable auditLogs import, complete Better Auth dash integration (#1715)
• worker: eliminate "body already used" crash on POST /api/workflow/*, KV-unguarded step failures, and unsafe configuration type casts in scheduled workflows (#1720)
• ci: demote wrangler version lag to warning, not CI failure
• skip Turnstile verification for API key authenticated requests (#1709)
• CORS middleware — allow no-Origin requests through; reject unknown origins with 403 (#1707)
• Better Auth MISSING_OR_NULL_ORIGIN for non-browser clients (Postman/curl/SDK) (#1708)

Added- api-keys: rename API key prefix abc_ → blq_ with dual-prefix backwards compatibility (#1704)

• hybrid email architecture — Resend (auth critical path) + CF Email Service REST (transactional) (#1703)
• auth: integrate Better Auth Dash plugin (dash()) from @better-auth/infra (#1700)

Fixed

• resolve 4 recurring production Cloudflare Worker errors (#1701)
• auth: resolve wrangler build failure — add @better-auth/infra to package.json (#1702)

Added- split Postman environment into separate local and prod files (#1682)

• docs: distinct coal/navy/ayu dark themes + theme-aware Mermaid rendering (#1675)
• email: add optional replyTo support throughout email pipeline (#1670)
• inject stub 2xx responses into Cloudflare schema and add CI guard (#1668)
• docs for PRs #1663/#1664 + automated schema sync pipeline (#1667)
• add extensible EmailService to worker with CF Email Workers binding, Queues, Workflows, DB tracking, admin API, and MailChannels fallback (#1664)
• instrument Durable Objects and Workflows with Sentry (lazy import, isolate-local init) (#1663)
• complete Sentry sourcemaps upload + Cloudflare SDK integration (#1662)

Fixed

• Postman collection generator — Better Auth endpoints, token auto-refresh, remove dead LocalAuth/Clerk endpoints + CF API Shield endpoint management (#1698)
• replace pg-pool with Prisma in api-keys handlers and user-access ban check (#1697)
• resolve c.req.raw body double-read and schema drift in api-keys routes (#1695)
• add Prisma $extends UUID enforcement for Better Auth 1.5.x compatibility (#1693)
• auth: force Better Auth to generate UUID IDs compatible with PostgreSQL uuid columns (#1692)
• add concurrency guard to cloudflare-dep-update and explicit wrangler config in deploy-frontend (#1691)
• workflows: eliminate all KV I/O from orchestrator context and add missing binding guards (#1689)
• ci: add push trigger and fix change detection in cloudflare-dep-update.yml (#1687)
• tail: add stub fetch handler to stop runtime exceptions from bots/scanners (#1690)
• build: widen polyfills.server.mjs patch to handle Angular 22.2+ aliased createRequire (#1686)
• auth: map Better Auth name/image fields to Prisma displayName/imageUrl, add regression tests, sync better-auth pin (#1685)
• correct production API base URL to https://api.bloqr.dev/api and bump Cloudflare deps (#1684)
• correct production API URL from https://bloqr.dev to https://api.bloqr.dev (#1683)
• move workflow guards inside try/catch to stop outcome:exception on every scheduled run (#1674)
• serve /favicon.svg and harden Swagger CSP with inline script hash (#1673)
• guard queueSwr for anonymous users, fix signOut 415, correct queue/stats auth label (#1672)
• workflows: replace (step as any).do() casts with typed stepDo helper; remove non-durable setTimeout (#1671)
• guard undefined method/url in tail summary log for non-HTTP events
• add --env=.env.local to schema upload tasks so Deno reads CLOUDFLARE_ZONE_ID / CLOUDFLARE_API_SHIELD_TOKEN locally
• visual polish — logo alignment, darker theme, tab scroll indicators, tile definition, app/API consistency (#1665)
• add CSP_LANDING variant to unblock styling on API landing page (#1661)
• csp: refactor frontend/server.ts CSP — add missing directives and pre-build at module scope

Added### Fixed

• three production bugs from Logpush runtime logs (2026-04-23/24) (#1658)