v1.22.0

Highlights

• Four anti-spam / editing dials are now tunable from the admin panel — edit window, spam link threshold, honeypot minimum fill time, and first-comment moderation. Each resolves DB override > env var > built-in default, so your existing wrangler.toml values keep working as the deploy-time default and "Reset to defaults" hands control back to the env. Moderation tab gains an "Anti-spam heuristics" card; the four rows they replace leave the read-only Configuration table.
• setup.sh no longer misassigns KV namespace ids. Ids were substituted into the first remaining placeholder, so if you had reordered or hand-edited the [[kv_namespaces]] blocks in your wrangler.toml and re-ran setup, every id could land under the wrong binding — setup reported success while the Worker read sessions out of the rate-limit namespace. Ids are now matched on binding name, and a block with no matching binding warns loudly instead of touching an unrelated one.
• setup.sh runs on macOS/BSD. The D1 id substitution used GNU-only sed -i, which on BSD sed read the expression as a backup suffix and failed with invalid command code, leaving the placeholder in place. No in-place sed remains in the script.

Notes

• The default edit window was split 5 minutes (widget) vs 15 (server); both are now 15. A window of 0 disables editing outright. Set EDIT_WINDOW_MINUTES explicitly if you were relying on the old widget-side value.
• SPAM_LINK_THRESHOLD stays tri-state: -1 disables the check, 0 flags any comment containing a link, N flags more than N.
• Enabling the honeypot fill-time dial without SPAM_FORM_TS_SECRET now shows an inline warning in the admin UI rather than leaving the check silently inert.
• wrangler.toml writes go through an atomic rename, and setup's "Next steps" list now names all four placeholder vars (ALLOWED_ORIGINS, ADMIN_EMAILS, PUBLIC_BASE_URL, OAUTH_CALLBACK_BASE) instead of three.
• No new env vars, no new secrets, and no D1 migration. Upgrading is a redeploy.