@jaredwray/mockhttp 2.1.0 → 3.0.1

package/site/dist/changelog.json

@@ -5,6 +5,32 @@
   "home_page_url": "https://mockhttp.org/",
   "feed_url": "https://mockhttp.org/changelog.json",
   "items": [
+    {
+      "id": "v3-0-1",
+      "title": "v3.0.1",
+      "url": "https://mockhttp.org/changelog/v3-0-1/",
+      "date_published": "2026-10-28",
+      "date_modified": "2026-10-28",
+      "summary": "<p>Security patches and Worker fixes. /healthz omits scheme, host, username, and password length.</p>\n<ul>\n<li>start the Worker during isolate startup (#248)</li>\n<li>report bin store health and keep a failed connect in process (#249)</li>\n<li>drop every second socket error that has no listener (#250)</li>\n<li>Add redacted URI diagnostics to /healthz (#254)</li>\n<li>open one MongoDB client per Worker request to stop 1101s on bins (#255)</li>\n<li>pin Node 24.22.1 and patched undici (#256)</li>\n</ul>",
+      "content_html": "<h2 id=\"jaredwraymockhttp301--2026-10-28\">@jaredwray/mockhttp@3.0.1 — 2026-10-28</h2>\n<p>Security patches and Worker fixes. /healthz omits scheme, host, username, and password length.</p>\n<h3 id=\"bug-fixes\">Bug Fixes</h3>\n<ul>\n<li>\n<p>start the Worker during isolate startup (#248)</p>\n</li>\n<li>\n<p>report bin store health and keep a failed connect in process (#249)</p>\n</li>\n<li>\n<p>drop every second socket error that has no listener (#250)</p>\n</li>\n<li>\n<p>Add redacted URI diagnostics to /healthz (#254)</p>\n</li>\n<li>\n<p>open one MongoDB client per Worker request to stop 1101s on bins (#255)</p>\n</li>\n<li>\n<p>pin Node 24.22.1 and patched undici (#256)</p>\n</li>\n<li>\n<p>force miniflare's sharp pin to 0.35.5 (#257)</p>\n</li>\n<li>\n<p>bump zod to 4.6.7 for GHSA-mrhx-c7xc-m3w5 (#258)</p>\n</li>\n<li>\n<p>security - markdown-it 15.0.3 (CVE-2026-111758) (#260)</p>\n</li>\n<li>\n<p>omit scheme and URI identity from /healthz (#262)</p>\n<pre><code class=\"hljs language-json\"><span class=\"hljs-punctuation\">{</span>\r\n  <span class=\"hljs-attr\">\"status\"</span><span class=\"hljs-punctuation\">:</span> <span class=\"hljs-string\">\"ok\"</span><span class=\"hljs-punctuation\">,</span>\r\n  <span class=\"hljs-attr\">\"bins\"</span><span class=\"hljs-punctuation\">:</span> <span class=\"hljs-punctuation\">{</span>\r\n    <span class=\"hljs-attr\">\"connected\"</span><span class=\"hljs-punctuation\">:</span> <span class=\"hljs-literal\"><span class=\"hljs-keyword\">true</span></span><span class=\"hljs-punctuation\">,</span>\r\n    <span class=\"hljs-attr\">\"uriPresent\"</span><span class=\"hljs-punctuation\">:</span> <span class=\"hljs-literal\"><span class=\"hljs-keyword\">true</span></span><span class=\"hljs-punctuation\">,</span>\r\n    <span class=\"hljs-attr\">\"uri\"</span><span class=\"hljs-punctuation\">:</span> <span class=\"hljs-punctuation\">{</span>\r\n      <span class=\"hljs-attr\">\"atCount\"</span><span class=\"hljs-punctuation\">:</span> <span class=\"hljs-number\">1</span><span class=\"hljs-punctuation\">,</span>\r\n      <span class=\"hljs-attr\">\"passwordHasPercent\"</span><span class=\"hljs-punctuation\">:</span> <span class=\"hljs-literal\"><span class=\"hljs-keyword\">false</span></span>\r\n    <span class=\"hljs-punctuation\">}</span>\r\n  <span class=\"hljs-punctuation\">}</span>\r\n<span class=\"hljs-punctuation\">}</span>\n</code></pre>\n</li>\n</ul>\n<h3 id=\"documentation\">Documentation</h3>\n<ul>\n<li>remove the empty vars note from the Cloudflare page (#253)</li>\n</ul>\n<h3 id=\"internal\">Internal</h3>\n<ul>\n<li>point worker URI fixtures at example.invalid (#251)</li>\n<li>declare empty Worker vars in Wrangler (#252)</li>\n<li>list LICENSE in the published package files (#259)</li>\n</ul>\n<h3 id=\"contributors\">Contributors</h3>\n<ul>\n<li>@jaredwray (13)</li>\n<li>@cursoragent (1)</li>\n</ul>\n<h3 id=\"full-list-of-changes\">Full List of Changes</h3>\n<ul>\n<li>fix: restore Cloudflare Worker routes after the v3.0.0 startup crash by @jaredwray in #248</li>\n<li>Add GET /healthz and redact bin store errors by @jaredwray in #249</li>\n<li>Use example.invalid for worker test URI fixtures by @jaredwray in #251</li>\n<li>Drop every second socket error that has no listener by @jaredwray in #250</li>\n<li>Declare empty Worker vars in Wrangler by @jaredwray in #252</li>\n<li>Remove the empty vars note from the Cloudflare page by @jaredwray in #253</li>\n<li>Add redacted URI diagnostics to /healthz by @jaredwray in #254</li>\n<li>fix: open one MongoDB client per Worker request to stop 1101s on bins by @jaredwray in #255</li>\n<li>security: pin Node 24.22.1 and patched undici by @jaredwray in #256</li>\n<li>fix: security - upgrade sharp to 0.35.5 (libheif RCE) by @jaredwray in #257</li>\n<li>fix: security - bump zod to 4.6.7 (GHSA-mrhx-c7xc-m3w5) by @jaredwray in #258</li>\n<li>chore: list LICENSE in the published package files by @jaredwray in #259</li>\n<li>fix: security - markdown-it 15.0.3 (CVE-2026-111758) by @jaredwray in #260</li>\n<li>fix: omit scheme and URI identity from /healthz by @jaredwray in #262</li>\n</ul>\n<p><strong>Full diff:</strong> <a href=\"https://github.com/jaredwray/mockhttp/compare/v3.0.0...v3.0.1\">https://github.com/jaredwray/mockhttp/compare/v3.0.0...v3.0.1</a></p>",
+      "content_text": "## @jaredwray/mockhttp@3.0.1 — 2026-10-28\r\n\r\nSecurity patches and Worker fixes. /healthz omits scheme, host, username, and password length.\r\n\r\n### Bug Fixes\r\n- start the Worker during isolate startup (#248)\r\n- report bin store health and keep a failed connect in process (#249)\r\n- drop every second socket error that has no listener (#250)\r\n- Add redacted URI diagnostics to /healthz (#254)\r\n- open one MongoDB client per Worker request to stop 1101s on bins (#255)\r\n- pin Node 24.22.1 and patched undici (#256)\r\n- force miniflare's sharp pin to 0.35.5 (#257)\r\n- bump zod to 4.6.7 for GHSA-mrhx-c7xc-m3w5 (#258)\r\n- security - markdown-it 15.0.3 (CVE-2026-111758) (#260)\r\n- omit scheme and URI identity from /healthz (#262)\r\n\r\n  ```json\r\n  {\r\n    \"status\": \"ok\",\r\n    \"bins\": {\r\n      \"connected\": true,\r\n      \"uriPresent\": true,\r\n      \"uri\": {\r\n        \"atCount\": 1,\r\n        \"passwordHasPercent\": false\r\n      }\r\n    }\r\n  }\r\n  ```\r\n\r\n### Documentation\r\n- remove the empty vars note from the Cloudflare page (#253)\r\n\r\n### Internal\r\n- point worker URI fixtures at example.invalid (#251)\r\n- declare empty Worker vars in Wrangler (#252)\r\n- list LICENSE in the published package files (#259)\r\n\r\n### Contributors\r\n- @jaredwray (13)\r\n- @cursoragent (1)\r\n\r\n### Full List of Changes\r\n- fix: restore Cloudflare Worker routes after the v3.0.0 startup crash by @jaredwray in #248\r\n- Add GET /healthz and redact bin store errors by @jaredwray in #249\r\n- Use example.invalid for worker test URI fixtures by @jaredwray in #251\r\n- Drop every second socket error that has no listener by @jaredwray in #250\r\n- Declare empty Worker vars in Wrangler by @jaredwray in #252\r\n- Remove the empty vars note from the Cloudflare page by @jaredwray in #253\r\n- Add redacted URI diagnostics to /healthz by @jaredwray in #254\r\n- fix: open one MongoDB client per Worker request to stop 1101s on bins by @jaredwray in #255\r\n- security: pin Node 24.22.1 and patched undici by @jaredwray in #256\r\n- fix: security - upgrade sharp to 0.35.5 (libheif RCE) by @jaredwray in #257\r\n- fix: security - bump zod to 4.6.7 (GHSA-mrhx-c7xc-m3w5) by @jaredwray in #258\r\n- chore: list LICENSE in the published package files by @jaredwray in #259\r\n- fix: security - markdown-it 15.0.3 (CVE-2026-111758) by @jaredwray in #260\r\n- fix: omit scheme and URI identity from /healthz by @jaredwray in #262\r\n\r\n**Full diff:** [https://github.com/jaredwray/mockhttp/compare/v3.0.0...v3.0.1](https://github.com/jaredwray/mockhttp/compare/v3.0.0...v3.0.1)",
+      "tags": [
+        "Release"
+      ]
+    },
+    {
+      "id": "v3-0-0",
+      "title": "v3.0.0",
+      "url": "https://mockhttp.org/changelog/v3-0-0/",
+      "date_published": "2026-10-20",
+      "date_modified": "2026-10-20",
+      "summary": "<p>Request bins now use Keyv via MockHttpBins, and the Worker can store them in MongoDB Atlas.</p>\n<ul>\n<li>Replace <code>BinManager</code>, <code>BinStore</code>, and <code>InMemoryBinStore</code> with async <code>MockHttpBins</code>. <code>mock.bins.start()</code> and <code>mock.bins.stop()</code> are removed. The default <code>maxBodySize</code> is 128 KiB (was 1 MiB). Node engines are now <code>>=22.19.0</code> (was <code>>=22.18.0</code>). (<code>b1ddcc0</code>, #246)\r\nMigration: assign <code>mock.bins = new MockHttpBins({ keyv })</code> before <code>start()</code> (default store is <code>new Keyv()</code>) and <code>await</code> the bin...</li>\n</ul>",
+      "content_html": "<h2 id=\"jaredwraymockhttp300--2026-10-19\">@jaredwray/mockhttp@3.0.0 — 2026-10-19</h2>\n<p>Request bins now use Keyv via MockHttpBins, and the Worker can store them in MongoDB Atlas.</p>\n<h3 id=\"-breaking-changes\">⚠ BREAKING CHANGES</h3>\n<ul>\n<li>\n<p>Replace <code>BinManager</code>, <code>BinStore</code>, and <code>InMemoryBinStore</code> with async <code>MockHttpBins</code>. <code>mock.bins.start()</code> and <code>mock.bins.stop()</code> are removed. The default <code>maxBodySize</code> is 128 KiB (was 1 MiB). Node engines are now <code>>=22.19.0</code> (was <code>>=22.18.0</code>). (<code>b1ddcc0</code>, #246)\r\nMigration: assign <code>mock.bins = new MockHttpBins({ keyv })</code> before <code>start()</code> (default store is <code>new Keyv()</code>) and <code>await</code> the bin methods.</p>\n<pre><code class=\"hljs language-ts\"><span class=\"hljs-keyword\">import</span> <span class=\"hljs-title class_\">Keyv</span> <span class=\"hljs-keyword\">from</span> <span class=\"hljs-string\">\"keyv\"</span>;\r\n<span class=\"hljs-keyword\">import</span> { <span class=\"hljs-title class_\">MockHttp</span>, <span class=\"hljs-title class_\">MockHttpBins</span> } <span class=\"hljs-keyword\">from</span> <span class=\"hljs-string\">\"@jaredwray/mockhttp\"</span>;\r\n\r\n<span class=\"hljs-keyword\">const</span> mock = <span class=\"hljs-keyword\">new</span> <span class=\"hljs-title class_\">MockHttp</span>();\r\nmock.<span class=\"hljs-property\">bins</span> = <span class=\"hljs-keyword\">new</span> <span class=\"hljs-title class_\">MockHttpBins</span>({ <span class=\"hljs-attr\">keyv</span>: <span class=\"hljs-keyword\">new</span> <span class=\"hljs-title class_\">Keyv</span>(), <span class=\"hljs-attr\">maxBodySize</span>: <span class=\"hljs-number\">128</span> * <span class=\"hljs-number\">1024</span> });\r\n<span class=\"hljs-keyword\">await</span> mock.<span class=\"hljs-title function_\">start</span>();\r\n<span class=\"hljs-keyword\">const</span> bin = <span class=\"hljs-keyword\">await</span> mock.<span class=\"hljs-property\">bins</span>.<span class=\"hljs-title function_\">createBin</span>();\n</code></pre>\n</li>\n</ul>\n<h3 id=\"features\">Features</h3>\n<ul>\n<li>\n<p>Store Worker request bins in MongoDB Atlas when <code>MONGODB_URI</code> is set (<code>266157b</code>, #247)</p>\n<pre><code class=\"hljs language-bash\"><span class=\"hljs-comment\"># Cloudflare Worker secret. Bins go in the Atlas `bins` collection.</span>\r\n<span class=\"hljs-comment\"># Leave MONGODB_URI unset to keep the in-memory Keyv.</span>\r\nwrangler secret put MONGODB_URI\n</code></pre>\n</li>\n</ul>\n<h3 id=\"bug-fixes\">Bug Fixes</h3>\n<ul>\n<li>security - upgrade fastify proxy-addr, fast-uri, find-my-way, undici (<code>9c52869</code>, #233)</li>\n<li>security - upgrade handlebars, source-map-js (<code>28aa662</code>, #236)</li>\n</ul>\n<h3 id=\"internal\">Internal</h3>\n<ul>\n<li>sync defense-in-depth files from agentic (<code>7fb3ce4</code>, #234)</li>\n<li>upgrade code quality dependencies (<code>a57b990</code>, #235)</li>\n<li>upgrade TypeScript and build tooling (<code>b11fa0f</code>, #237)</li>\n<li>upgrade monorepo tooling (<code>58e8596</code>, #238)</li>\n<li>upgrade GitHub Actions (<code>58bc448</code>, #239)</li>\n<li>upgrade Dev Container images (<code>2047c3c</code>, #240)</li>\n<li>upgrade Fastify dependencies (<code>3e93bea</code>, #241)</li>\n<li>upgrade hookified (<code>d938e6e</code>, #242)</li>\n<li>upgrade pino and pino-pretty (<code>c2a94ad</code>, #243)</li>\n<li>upgrade Docker Node.js runtime image (<code>cd5decf</code>, #244)</li>\n<li>pin the Compose image (<code>74ad4ea</code>, #245)</li>\n</ul>\n<h3 id=\"contributors\">Contributors</h3>\n<ul>\n<li>@jaredwray (11)</li>\n<li>@cursoragent (5)</li>\n</ul>\n<h3 id=\"full-list-of-changes\">Full List of Changes</h3>\n<ul>\n<li>fix: security - upgrade fastify proxy-addr, fast-uri, find-my-way, undici by @jaredwray in #233</li>\n<li>mono - chore: sync defense-in-depth files from agentic by @jaredwray in #234</li>\n<li>mono - chore: upgrade code quality dependencies by @jaredwray in #235</li>\n<li>fix: security - upgrade handlebars, source-map-js by @jaredwray in #236</li>\n<li>mono - chore: upgrade TypeScript and build tooling by @jaredwray in #237</li>\n<li>mono - chore: upgrade monorepo tooling by @jaredwray in #238</li>\n<li>mono - chore: upgrade GitHub Actions by @jaredwray in #239</li>\n<li>mono - chore: upgrade Dev Container images by @jaredwray in #240</li>\n<li>mono - chore: upgrade Fastify dependencies by @jaredwray in #241</li>\n<li>mono - chore: upgrade hookified by @jaredwray in #242</li>\n<li>mono - chore: upgrade pino and pino-pretty by @jaredwray in #243</li>\n<li>mono - chore: upgrade Docker Node.js runtime image by @jaredwray in #244</li>\n<li>mono - chore: pin the Compose image by @jaredwray in #245</li>\n<li>Store request bins in Keyv by @jaredwray in #246</li>\n<li>Store Worker request bins in MongoDB Atlas by @jaredwray in #247</li>\n</ul>\n<p><strong>Full diff:</strong> <a href=\"https://github.com/jaredwray/mockhttp/compare/v2.1.0...v3.0.0\">https://github.com/jaredwray/mockhttp/compare/v2.1.0...v3.0.0</a></p>",
+      "content_text": "## @jaredwray/mockhttp@3.0.0 — 2026-10-19\r\n\r\nRequest bins now use Keyv via MockHttpBins, and the Worker can store them in MongoDB Atlas.\r\n\r\n### ⚠ BREAKING CHANGES\r\n- Replace `BinManager`, `BinStore`, and `InMemoryBinStore` with async `MockHttpBins`. `mock.bins.start()` and `mock.bins.stop()` are removed. The default `maxBodySize` is 128 KiB (was 1 MiB). Node engines are now `>=22.19.0` (was `>=22.18.0`). (`b1ddcc0`, #246)\r\n  Migration: assign `mock.bins = new MockHttpBins({ keyv })` before `start()` (default store is `new Keyv()`) and `await` the bin methods.\r\n\r\n  ```ts\r\n  import Keyv from \"keyv\";\r\n  import { MockHttp, MockHttpBins } from \"@jaredwray/mockhttp\";\r\n\r\n  const mock = new MockHttp();\r\n  mock.bins = new MockHttpBins({ keyv: new Keyv(), maxBodySize: 128 * 1024 });\r\n  await mock.start();\r\n  const bin = await mock.bins.createBin();\r\n  ```\r\n\r\n### Features\r\n- Store Worker request bins in MongoDB Atlas when `MONGODB_URI` is set (`266157b`, #247)\r\n\r\n  ```bash\r\n  # Cloudflare Worker secret. Bins go in the Atlas `bins` collection.\r\n  # Leave MONGODB_URI unset to keep the in-memory Keyv.\r\n  wrangler secret put MONGODB_URI\r\n  ```\r\n\r\n### Bug Fixes\r\n- security - upgrade fastify proxy-addr, fast-uri, find-my-way, undici (`9c52869`, #233)\r\n- security - upgrade handlebars, source-map-js (`28aa662`, #236)\r\n\r\n### Internal\r\n- sync defense-in-depth files from agentic (`7fb3ce4`, #234)\r\n- upgrade code quality dependencies (`a57b990`, #235)\r\n- upgrade TypeScript and build tooling (`b11fa0f`, #237)\r\n- upgrade monorepo tooling (`58e8596`, #238)\r\n- upgrade GitHub Actions (`58bc448`, #239)\r\n- upgrade Dev Container images (`2047c3c`, #240)\r\n- upgrade Fastify dependencies (`3e93bea`, #241)\r\n- upgrade hookified (`d938e6e`, #242)\r\n- upgrade pino and pino-pretty (`c2a94ad`, #243)\r\n- upgrade Docker Node.js runtime image (`cd5decf`, #244)\r\n- pin the Compose image (`74ad4ea`, #245)\r\n\r\n### Contributors\r\n- @jaredwray (11)\r\n- @cursoragent (5)\r\n\r\n### Full List of Changes\r\n- fix: security - upgrade fastify proxy-addr, fast-uri, find-my-way, undici by @jaredwray in #233\r\n- mono - chore: sync defense-in-depth files from agentic by @jaredwray in #234\r\n- mono - chore: upgrade code quality dependencies by @jaredwray in #235\r\n- fix: security - upgrade handlebars, source-map-js by @jaredwray in #236\r\n- mono - chore: upgrade TypeScript and build tooling by @jaredwray in #237\r\n- mono - chore: upgrade monorepo tooling by @jaredwray in #238\r\n- mono - chore: upgrade GitHub Actions by @jaredwray in #239\r\n- mono - chore: upgrade Dev Container images by @jaredwray in #240\r\n- mono - chore: upgrade Fastify dependencies by @jaredwray in #241\r\n- mono - chore: upgrade hookified by @jaredwray in #242\r\n- mono - chore: upgrade pino and pino-pretty by @jaredwray in #243\r\n- mono - chore: upgrade Docker Node.js runtime image by @jaredwray in #244\r\n- mono - chore: pin the Compose image by @jaredwray in #245\r\n- Store request bins in Keyv by @jaredwray in #246\r\n- Store Worker request bins in MongoDB Atlas by @jaredwray in #247\r\n\r\n**Full diff:** [https://github.com/jaredwray/mockhttp/compare/v2.1.0...v3.0.0](https://github.com/jaredwray/mockhttp/compare/v2.1.0...v3.0.0)",
+      "tags": [
+        "Release"
+      ]
+    },
     {
       "id": "v2-1-0",
       "title": "v2.1.0",
@@ -368,32 +394,6 @@
       "tags": [
         "Release"
       ]
-    },
-    {
-      "id": "v0-2-1",
-      "title": "v0.2.1",
-      "url": "https://mockhttp.org/changelog/v0-2-1/",
-      "date_published": "2024-12-13",
-      "date_modified": "2024-12-13",
-      "summary": "<ul>\n<li>moving to logging on a single line by @jaredwray in <a href=\"https://github.com/jaredwray/mockhttp/pull/15\">https://github.com/jaredwray/mockhttp/pull/15</a></li>\n<li>upgrading scalar to 1.25.82 by @jaredwray in <a href=\"https://github.com/jaredwray/mockhttp/pull/16\">https://github.com/jaredwray/mockhttp/pull/16</a></li>\n</ul>\n<p><strong>Full Changelog</strong>: <a href=\"https://github.com/jaredwray/mockhttp/compare/v0.2.0...v0.2.1\">https://github.com/jaredwray/mockhttp/compare/v0.2.0...v0.2.1</a></p>",
-      "content_html": "<h2 id=\"whats-changed\">What's Changed</h2>\n<ul>\n<li>moving to logging on a single line by @jaredwray in <a href=\"https://github.com/jaredwray/mockhttp/pull/15\">https://github.com/jaredwray/mockhttp/pull/15</a></li>\n<li>upgrading scalar to 1.25.82 by @jaredwray in <a href=\"https://github.com/jaredwray/mockhttp/pull/16\">https://github.com/jaredwray/mockhttp/pull/16</a></li>\n</ul>\n<p><strong>Full Changelog</strong>: <a href=\"https://github.com/jaredwray/mockhttp/compare/v0.2.0...v0.2.1\">https://github.com/jaredwray/mockhttp/compare/v0.2.0...v0.2.1</a></p>",
-      "content_text": "## What's Changed\r\n* moving to logging on a single line by @jaredwray in [https://github.com/jaredwray/mockhttp/pull/15](https://github.com/jaredwray/mockhttp/pull/15)\r\n* upgrading scalar to 1.25.82 by @jaredwray in [https://github.com/jaredwray/mockhttp/pull/16](https://github.com/jaredwray/mockhttp/pull/16)\r\n\r\n\r\n**Full Changelog**: [https://github.com/jaredwray/mockhttp/compare/v0.2.0...v0.2.1](https://github.com/jaredwray/mockhttp/compare/v0.2.0...v0.2.1)",
-      "tags": [
-        "Release"
-      ]
-    },
-    {
-      "id": "v0-2-0",
-      "title": "v0.2.0",
-      "url": "https://mockhttp.org/changelog/v0-2-0/",
-      "date_published": "2024-12-13",
-      "date_modified": "2024-12-13",
-      "summary": "<ul>\n<li>response inspection by @jaredwray in <a href=\"https://github.com/jaredwray/mockhttp/pull/14\">https://github.com/jaredwray/mockhttp/pull/14</a></li>\n</ul>\n<p><strong>Full Changelog</strong>: <a href=\"https://github.com/jaredwray/mockhttp/compare/v0.1.0...v0.2.0\">https://github.com/jaredwray/mockhttp/compare/v0.1.0...v0.2.0</a></p>",
-      "content_html": "<h2 id=\"whats-changed\">What's Changed</h2>\n<ul>\n<li>response inspection by @jaredwray in <a href=\"https://github.com/jaredwray/mockhttp/pull/14\">https://github.com/jaredwray/mockhttp/pull/14</a></li>\n</ul>\n<p><strong>Full Changelog</strong>: <a href=\"https://github.com/jaredwray/mockhttp/compare/v0.1.0...v0.2.0\">https://github.com/jaredwray/mockhttp/compare/v0.1.0...v0.2.0</a></p>",
-      "content_text": "## What's Changed\r\n* response inspection by @jaredwray in [https://github.com/jaredwray/mockhttp/pull/14](https://github.com/jaredwray/mockhttp/pull/14)\r\n\r\n\r\n**Full Changelog**: [https://github.com/jaredwray/mockhttp/compare/v0.1.0...v0.2.0](https://github.com/jaredwray/mockhttp/compare/v0.1.0...v0.2.0)",
-      "tags": [
-        "Release"
-      ]
     }
   ]
 }

package/site/dist/docs/bins/index.html

@@ -35,7 +35,7 @@
   </script>
   <title>MockHTTP - Bins</title>
   <script type="application/ld+json">
-{"@context":"https://schema.org","@type":"TechArticle","headline":"Bins","description":"","url":"https://mockhttp.org/docs/bins/","publisher":{"@type":"Organization","name":"MockHTTP"},"dateModified":"2026-10-03","keywords":[]}
+{"@context":"https://schema.org","@type":"TechArticle","headline":"Bins","description":"","url":"https://mockhttp.org/docs/bins/","publisher":{"@type":"Organization","name":"MockHTTP"},"dateModified":"2026-10-28","keywords":[]}
 </script>
 </head>
 
@@ -312,6 +312,7 @@ here is stored against bin <code>:id</code></li>
 <ul>
 <li><a href="#quick-start">Quick Start</a></li>
 <li><a href="#endpoints">Endpoints</a></li>
+<li><a href="#storage-health">Storage health</a></li>
 <li><a href="#end-to-end-webhook-debugging-example">End-to-End Webhook Debugging Example</a></li>
 <li><a href="#captured-request-shape">Captured Request Shape</a></li>
 <li><a href="#body-encoding-examples">Body Encoding Examples</a>
@@ -330,7 +331,7 @@ here is stored against bin <code>:id</code></li>
 <li><a href="#configuration">Configuration</a>
 <ul>
 <li><a href="#defaults">Defaults</a></li>
-<li><a href="#pluggable-storage">Pluggable Storage</a></li>
+<li><a href="#storage">Storage</a></li>
 </ul>
 </li>
 </ul>
@@ -401,8 +402,67 @@ curl http://localhost:3000/bins/abc123def456/requests
 <td><code>/b/:id</code> and <code>/b/:id/*</code></td>
 <td>Capture requests sent to a bin</td>
 </tr>
+<tr>
+<td>GET</td>
+<td><code>/healthz</code></td>
+<td>Check whether bin storage is reachable</td>
+</tr>
 </tbody>
 </table>
+<h2 id="storage-health">Storage health</h2>
+<p><code>GET /healthz</code> is on the Node server and the Worker. This route does not create a bin.</p>
+<p>A memory store sends HTTP 200:</p>
+<pre><code class="hljs language-json"><span class="hljs-punctuation">{</span>
+  <span class="hljs-attr">"status"</span><span class="hljs-punctuation">:</span> <span class="hljs-string">"ok"</span><span class="hljs-punctuation">,</span>
+  <span class="hljs-attr">"bins"</span><span class="hljs-punctuation">:</span> <span class="hljs-punctuation">{</span>
+    <span class="hljs-attr">"store"</span><span class="hljs-punctuation">:</span> <span class="hljs-string">"memory"</span><span class="hljs-punctuation">,</span>
+    <span class="hljs-attr">"connected"</span><span class="hljs-punctuation">:</span> <span class="hljs-literal"><span class="hljs-keyword">true</span></span><span class="hljs-punctuation">,</span>
+    <span class="hljs-attr">"latencyMs"</span><span class="hljs-punctuation">:</span> <span class="hljs-number">1</span><span class="hljs-punctuation">,</span>
+    <span class="hljs-attr">"uriPresent"</span><span class="hljs-punctuation">:</span> <span class="hljs-literal"><span class="hljs-keyword">false</span></span>
+  <span class="hljs-punctuation">}</span>
+<span class="hljs-punctuation">}</span>
+</code></pre>
+<p>The Worker uses MongoDB when <code>MONGODB_URI</code> is set. The check opens a client, sends an admin ping, and then closes the client. The timeout is short. The check does not keep the client after a failure.</p>
+<p>A successful ping sends HTTP 200. <code>store</code> is <code>mongo</code>.</p>
+<p>A failed ping sends HTTP 503:</p>
+<pre><code class="hljs language-json"><span class="hljs-punctuation">{</span>
+  <span class="hljs-attr">"status"</span><span class="hljs-punctuation">:</span> <span class="hljs-string">"error"</span><span class="hljs-punctuation">,</span>
+  <span class="hljs-attr">"bins"</span><span class="hljs-punctuation">:</span> <span class="hljs-punctuation">{</span>
+    <span class="hljs-attr">"store"</span><span class="hljs-punctuation">:</span> <span class="hljs-string">"mongo"</span><span class="hljs-punctuation">,</span>
+    <span class="hljs-attr">"connected"</span><span class="hljs-punctuation">:</span> <span class="hljs-literal"><span class="hljs-keyword">false</span></span><span class="hljs-punctuation">,</span>
+    <span class="hljs-attr">"uriPresent"</span><span class="hljs-punctuation">:</span> <span class="hljs-literal"><span class="hljs-keyword">true</span></span><span class="hljs-punctuation">,</span>
+    <span class="hljs-attr">"uri"</span><span class="hljs-punctuation">:</span> <span class="hljs-punctuation">{</span>
+      <span class="hljs-attr">"length"</span><span class="hljs-punctuation">:</span> <span class="hljs-number">78</span><span class="hljs-punctuation">,</span>
+      <span class="hljs-attr">"leadingWhitespace"</span><span class="hljs-punctuation">:</span> <span class="hljs-literal"><span class="hljs-keyword">false</span></span><span class="hljs-punctuation">,</span>
+      <span class="hljs-attr">"trailingWhitespace"</span><span class="hljs-punctuation">:</span> <span class="hljs-literal"><span class="hljs-keyword">false</span></span><span class="hljs-punctuation">,</span>
+      <span class="hljs-attr">"newline"</span><span class="hljs-punctuation">:</span> <span class="hljs-literal"><span class="hljs-keyword">false</span></span><span class="hljs-punctuation">,</span>
+      <span class="hljs-attr">"wrappedQuotes"</span><span class="hljs-punctuation">:</span> <span class="hljs-literal"><span class="hljs-keyword">false</span></span><span class="hljs-punctuation">,</span>
+      <span class="hljs-attr">"atCount"</span><span class="hljs-punctuation">:</span> <span class="hljs-number">2</span><span class="hljs-punctuation">,</span>
+      <span class="hljs-attr">"passwordReserved"</span><span class="hljs-punctuation">:</span> <span class="hljs-punctuation">[</span><span class="hljs-string">"@"</span><span class="hljs-punctuation">]</span><span class="hljs-punctuation">,</span>
+      <span class="hljs-attr">"passwordHasPercent"</span><span class="hljs-punctuation">:</span> <span class="hljs-literal"><span class="hljs-keyword">false</span></span>
+    <span class="hljs-punctuation">}</span><span class="hljs-punctuation">,</span>
+    <span class="hljs-attr">"error"</span><span class="hljs-punctuation">:</span> <span class="hljs-punctuation">{</span>
+      <span class="hljs-attr">"name"</span><span class="hljs-punctuation">:</span> <span class="hljs-string">"MongoParseError"</span><span class="hljs-punctuation">,</span>
+      <span class="hljs-attr">"message"</span><span class="hljs-punctuation">:</span> <span class="hljs-string">"Invalid connection string. Percent-encode reserved characters in the username and password (@ : / ? # [ ] $)."</span><span class="hljs-punctuation">,</span>
+      <span class="hljs-attr">"code"</span><span class="hljs-punctuation">:</span> <span class="hljs-literal"><span class="hljs-keyword">null</span></span>
+    <span class="hljs-punctuation">}</span>
+  <span class="hljs-punctuation">}</span>
+<span class="hljs-punctuation">}</span>
+</code></pre>
+<p>A MongoDB result includes <code>bins.uri</code> on success and on failure. A memory result omits <code>bins.uri</code>. The response does not include the scheme, the host, the username, or the password length.</p>
+<p><code>uri.passwordReserved</code> lists raw reserved characters in the password. The list is empty when the password has only reserved characters. <code>uri.passwordHasPercent</code> is true when the password contains <code>%</code>. The response does not contain the connection string or the password. The logs do not contain the connection string, the username, the password, or the host. <code>uriPresent</code> is a boolean.</p>
+<p><code>Invalid connection string</code> is the driver text. MockHTTP adds the percent-encode hint only for that text or for <code>unescaped characters</code>. A DNS error stays a DNS error. <code>Invalid connection string</code> means that the URI has a second <code>@</code>. It also means that you did not encode a reserved character in the username or the password. Encode these characters:</p>
+<ul>
+<li><code>@</code> as <code>%40</code></li>
+<li><code>:</code> as <code>%3A</code></li>
+<li><code>/</code> as <code>%2F</code></li>
+<li><code>?</code> as <code>%3F</code></li>
+<li><code>#</code> as <code>%23</code></li>
+<li><code>[</code> as <code>%5B</code></li>
+<li><code>]</code> as <code>%5D</code></li>
+<li><code>$</code> as <code>%24</code></li>
+</ul>
+<p>A correct <code>mongodb+srv://</code> URI does not fail at parse time. A DNS failure or a network failure has a different error name.</p>
 <h2 id="end-to-end-webhook-debugging-example">End-to-End Webhook Debugging Example</h2>
 <p>A complete walkthrough using curl:</p>
 <pre><code class="hljs language-bash">BASE=http://localhost:3000
@@ -514,11 +574,11 @@ curl -s <span class="hljs-string">"http://localhost:3000/bins/<span class="hljs-
   | jq -r <span class="hljs-string">'.requests[0].body'</span> | <span class="hljs-built_in">base64</span> -d > recovered.png
 </code></pre>
 <h3 id="truncation">Truncation</h3>
-<p>Bodies larger than <code>maxBodySize</code> (1 MiB by default) are cut off and flagged:</p>
+<p>Bodies larger than <code>maxBodySize</code> (128 KiB by default) are cut off and flagged:</p>
 <pre><code class="hljs language-javascript"><span class="hljs-comment">// In test setup</span>
-<span class="hljs-keyword">import</span> { <span class="hljs-title class_">MockHttp</span>, <span class="hljs-title class_">BinManager</span> } <span class="hljs-keyword">from</span> <span class="hljs-string">'@jaredwray/mockhttp'</span>;
+<span class="hljs-keyword">import</span> { <span class="hljs-title class_">MockHttp</span>, <span class="hljs-title class_">MockHttpBins</span> } <span class="hljs-keyword">from</span> <span class="hljs-string">'@jaredwray/mockhttp'</span>;
 <span class="hljs-keyword">const</span> mock = <span class="hljs-keyword">new</span> <span class="hljs-title class_">MockHttp</span>();
-mock.<span class="hljs-property">bins</span> = <span class="hljs-keyword">new</span> <span class="hljs-title class_">BinManager</span>({ <span class="hljs-attr">maxBodySize</span>: <span class="hljs-number">1024</span> }); <span class="hljs-comment">// 1 KiB cap</span>
+mock.<span class="hljs-property">bins</span> = <span class="hljs-keyword">new</span> <span class="hljs-title class_">MockHttpBins</span>({ <span class="hljs-attr">maxBodySize</span>: <span class="hljs-number">1024</span> }); <span class="hljs-comment">// 1 KiB cap</span>
 <span class="hljs-keyword">await</span> mock.<span class="hljs-title function_">start</span>();
 </code></pre>
 <pre><code class="hljs language-bash"><span class="hljs-comment"># Send 5000 bytes to a bin with a 1 KiB cap</span>
@@ -550,21 +610,20 @@ curl -s <span class="hljs-string">"http://localhost:3000/bins/<span class="hljs-
 <span class="hljs-comment"># "/event/105"</span>
 </code></pre>
 <h2 id="programmatic-access">Programmatic Access</h2>
-<p>The bin manager is exposed on the <code>MockHttp</code> instance as <code>mock.bins</code>. This
-makes it easy to drive bins from a test suite without going through HTTP:</p>
+<p>Use <code>mock.bins</code> to control request bins from a test. You do not need an HTTP call:</p>
 <pre><code class="hljs language-javascript"><span class="hljs-keyword">import</span> { <span class="hljs-title class_">MockHttp</span> } <span class="hljs-keyword">from</span> <span class="hljs-string">'@jaredwray/mockhttp'</span>;
 
 <span class="hljs-keyword">const</span> mock = <span class="hljs-keyword">new</span> <span class="hljs-title class_">MockHttp</span>({ <span class="hljs-attr">logging</span>: <span class="hljs-literal">false</span> });
 <span class="hljs-keyword">await</span> mock.<span class="hljs-title function_">start</span>();
 
 <span class="hljs-comment">// Create a bin</span>
-<span class="hljs-keyword">const</span> bin = mock.<span class="hljs-property">bins</span>.<span class="hljs-title function_">createBin</span>();
+<span class="hljs-keyword">const</span> bin = <span class="hljs-keyword">await</span> mock.<span class="hljs-property">bins</span>.<span class="hljs-title function_">createBin</span>();
 <span class="hljs-variable language_">console</span>.<span class="hljs-title function_">log</span>(<span class="hljs-string">`Webhook target: http://localhost:<span class="hljs-subst">${mock.port}</span>/b/<span class="hljs-subst">${bin.id}</span>`</span>);
 
 <span class="hljs-comment">// ... point your code-under-test at that URL ...</span>
 
 <span class="hljs-comment">// Read captured requests (newest first)</span>
-<span class="hljs-keyword">const</span> requests = mock.<span class="hljs-property">bins</span>.<span class="hljs-title function_">getRequests</span>(bin.<span class="hljs-property">id</span>);
+<span class="hljs-keyword">const</span> requests = <span class="hljs-keyword">await</span> mock.<span class="hljs-property">bins</span>.<span class="hljs-title function_">getRequests</span>(bin.<span class="hljs-property">id</span>);
 <span class="hljs-variable language_">console</span>.<span class="hljs-title function_">log</span>(<span class="hljs-string">`Captured <span class="hljs-subst">${requests.length}</span> requests`</span>);
 
 <span class="hljs-keyword">for</span> (<span class="hljs-keyword">const</span> req <span class="hljs-keyword">of</span> requests) {
@@ -572,8 +631,8 @@ makes it easy to drive bins from a test suite without going through HTTP:</p>
 }
 
 <span class="hljs-comment">// Clean up</span>
-mock.<span class="hljs-property">bins</span>.<span class="hljs-title function_">deleteBin</span>(bin.<span class="hljs-property">id</span>);
-<span class="hljs-keyword">await</span> mock.<span class="hljs-title function_">close</span>(); <span class="hljs-comment">// also stops the bin cleanup timer</span>
+<span class="hljs-keyword">await</span> mock.<span class="hljs-property">bins</span>.<span class="hljs-title function_">deleteBin</span>(bin.<span class="hljs-property">id</span>);
+<span class="hljs-keyword">await</span> mock.<span class="hljs-title function_">close</span>();
 </code></pre>
 <h3 id="using-bins-in-a-vitest-test">Using Bins in a Vitest Test</h3>
 <pre><code class="hljs language-typescript"><span class="hljs-keyword">import</span> { afterAll, beforeAll, expect, test } <span class="hljs-keyword">from</span> <span class="hljs-string">'vitest'</span>;
@@ -591,14 +650,14 @@ mock.<span class="hljs-property">bins</span>.<span class="hljs-title function_">
 });
 
 <span class="hljs-title function_">test</span>(<span class="hljs-string">'my SDK sends the right webhook payload'</span>, <span class="hljs-title function_">async</span> () => {
-  <span class="hljs-keyword">const</span> bin = mock.<span class="hljs-property">bins</span>.<span class="hljs-title function_">createBin</span>();
+  <span class="hljs-keyword">const</span> bin = <span class="hljs-keyword">await</span> mock.<span class="hljs-property">bins</span>.<span class="hljs-title function_">createBin</span>();
   <span class="hljs-keyword">const</span> webhookUrl = <span class="hljs-string">`http://localhost:<span class="hljs-subst">${mock.port}</span>/b/<span class="hljs-subst">${bin.id}</span>`</span>;
 
   <span class="hljs-comment">// Drive your SDK at the bin</span>
   <span class="hljs-keyword">await</span> mySdk.<span class="hljs-title function_">notify</span>(webhookUrl, { <span class="hljs-attr">event</span>: <span class="hljs-string">'user.created'</span>, <span class="hljs-attr">id</span>: <span class="hljs-number">42</span> });
 
   <span class="hljs-comment">// Assert on what actually arrived</span>
-  <span class="hljs-keyword">const</span> [captured] = mock.<span class="hljs-property">bins</span>.<span class="hljs-title function_">getRequests</span>(bin.<span class="hljs-property">id</span>);
+  <span class="hljs-keyword">const</span> [captured] = <span class="hljs-keyword">await</span> mock.<span class="hljs-property">bins</span>.<span class="hljs-title function_">getRequests</span>(bin.<span class="hljs-property">id</span>);
   <span class="hljs-title function_">expect</span>(captured.<span class="hljs-property">method</span>).<span class="hljs-title function_">toBe</span>(<span class="hljs-string">'POST'</span>);
   <span class="hljs-title function_">expect</span>(captured.<span class="hljs-property">contentType</span>).<span class="hljs-title function_">toBe</span>(<span class="hljs-string">'application/json'</span>);
   <span class="hljs-title function_">expect</span>(<span class="hljs-title class_">JSON</span>.<span class="hljs-title function_">parse</span>(captured.<span class="hljs-property">body</span>!)).<span class="hljs-title function_">toEqual</span>({
@@ -614,16 +673,15 @@ mock.<span class="hljs-property">bins</span>.<span class="hljs-title function_">
   <span class="hljs-attr">httpBin</span>: { <span class="hljs-attr">bins</span>: <span class="hljs-literal">false</span> },
 });
 </code></pre>
-<p>To tune limits, replace the default <code>BinManager</code> before starting:</p>
-<pre><code class="hljs language-javascript"><span class="hljs-keyword">import</span> { <span class="hljs-title class_">MockHttp</span>, <span class="hljs-title class_">BinManager</span> } <span class="hljs-keyword">from</span> <span class="hljs-string">'@jaredwray/mockhttp'</span>;
+<p>To change the limits, replace the default <code>MockHttpBins</code> before you start the server:</p>
+<pre><code class="hljs language-javascript"><span class="hljs-keyword">import</span> { <span class="hljs-title class_">MockHttp</span>, <span class="hljs-title class_">MockHttpBins</span> } <span class="hljs-keyword">from</span> <span class="hljs-string">'@jaredwray/mockhttp'</span>;
 
 <span class="hljs-keyword">const</span> mock = <span class="hljs-keyword">new</span> <span class="hljs-title class_">MockHttp</span>();
-mock.<span class="hljs-property">bins</span> = <span class="hljs-keyword">new</span> <span class="hljs-title class_">BinManager</span>({
+mock.<span class="hljs-property">bins</span> = <span class="hljs-keyword">new</span> <span class="hljs-title class_">MockHttpBins</span>({
   <span class="hljs-attr">defaultTtlMs</span>: <span class="hljs-number">60</span> * <span class="hljs-number">60</span> * <span class="hljs-number">1000</span>,    <span class="hljs-comment">// 1 hour (default: 24h)</span>
   <span class="hljs-attr">maxRequestsPerBin</span>: <span class="hljs-number">500</span>,           <span class="hljs-comment">// (default: 100)</span>
-  <span class="hljs-attr">maxBodySize</span>: <span class="hljs-number">5</span> * <span class="hljs-number">1024</span> * <span class="hljs-number">1024</span>,     <span class="hljs-comment">// 5 MiB (default: 1 MiB)</span>
+  <span class="hljs-attr">maxBodySize</span>: <span class="hljs-number">512</span> * <span class="hljs-number">1024</span>,          <span class="hljs-comment">// 512 KiB (default: 128 KiB)</span>
   <span class="hljs-attr">idLength</span>: <span class="hljs-number">16</span>,                     <span class="hljs-comment">// (default: 12)</span>
-  <span class="hljs-attr">cleanupIntervalMs</span>: <span class="hljs-number">30</span> * <span class="hljs-number">1000</span>,     <span class="hljs-comment">// sweep every 30s (default: 60s)</span>
 });
 
 <span class="hljs-keyword">await</span> mock.<span class="hljs-title function_">start</span>();
@@ -641,7 +699,7 @@ mock.<span class="hljs-property">bins</span> = <span class="hljs-keyword">new</s
 <tr>
 <td><code>defaultTtlMs</code></td>
 <td><code>86400000</code> (24h)</td>
-<td>Bin lifetime. Expired bins return 404 and are lazily removed.</td>
+<td>Bin lifetime, set as the Keyv TTL. An expired bin returns 404.</td>
 </tr>
 <tr>
 <td><code>maxRequestsPerBin</code></td>
@@ -650,7 +708,7 @@ mock.<span class="hljs-property">bins</span> = <span class="hljs-keyword">new</s
 </tr>
 <tr>
 <td><code>maxBodySize</code></td>
-<td><code>1048576</code> (1 MiB)</td>
+<td><code>131072</code> (128 KiB)</td>
 <td>Larger bodies are truncated; <code>truncated: true</code> is set on the capture.</td>
 </tr>
 <tr>
@@ -659,40 +717,29 @@ mock.<span class="hljs-property">bins</span> = <span class="hljs-keyword">new</s
 <td>Length of generated bin and request ids.</td>
 </tr>
 <tr>
-<td><code>cleanupIntervalMs</code></td>
-<td><code>60000</code> (1 min)</td>
-<td>How often expired bins are swept. The timer is <code>unref()</code>'d so it never keeps the process alive.</td>
+<td><code>keyv</code></td>
+<td><code>new Keyv()</code></td>
+<td>Keyv store for bins. The default keeps bins in memory.</td>
 </tr>
 </tbody>
 </table>
-<h3 id="pluggable-storage">Pluggable Storage</h3>
-<p><code>BinManager</code> accepts a <code>store: BinStore</code> so you can plug in alternative
-backends (Redis, SQLite, etc.) without changing the rest of the codebase. The
-default <code>InMemoryBinStore</code> keeps state in process memory.</p>
-<pre><code class="hljs language-typescript"><span class="hljs-keyword">import</span> {
-  <span class="hljs-title class_">BinManager</span>,
-  <span class="hljs-title class_">InMemoryBinStore</span>,
-  <span class="hljs-keyword">type</span> <span class="hljs-title class_">Bin</span>,
-  <span class="hljs-keyword">type</span> <span class="hljs-title class_">BinStore</span>,
-  <span class="hljs-keyword">type</span> <span class="hljs-title class_">CapturedRequest</span>,
-} <span class="hljs-keyword">from</span> <span class="hljs-string">'@jaredwray/mockhttp'</span>;
-
-<span class="hljs-keyword">class</span> <span class="hljs-title class_">RedisBinStore</span> <span class="hljs-keyword">implements</span> <span class="hljs-title class_">BinStore</span> {
-  <span class="hljs-title function_">createBin</span>(<span class="hljs-attr">bin</span>: <span class="hljs-title class_">Bin</span>): <span class="hljs-built_in">void</span> { <span class="hljs-comment">/* SET bin:${bin.id} ... */</span> }
-  <span class="hljs-title function_">getBin</span>(<span class="hljs-attr">id</span>: <span class="hljs-built_in">string</span>): <span class="hljs-title class_">Bin</span> | <span class="hljs-literal">undefined</span> { <span class="hljs-comment">/* GET ... */</span> }
-  <span class="hljs-title function_">listBins</span>(): <span class="hljs-title class_">Bin</span>[] { <span class="hljs-comment">/* SCAN ... */</span> }
-  <span class="hljs-title function_">deleteBin</span>(<span class="hljs-attr">id</span>: <span class="hljs-built_in">string</span>): <span class="hljs-built_in">boolean</span> { <span class="hljs-comment">/* DEL ... */</span> }
-  <span class="hljs-title function_">addRequest</span>(<span class="hljs-attr">binId</span>: <span class="hljs-built_in">string</span>, <span class="hljs-attr">req</span>: <span class="hljs-title class_">CapturedRequest</span>, <span class="hljs-attr">max</span>: <span class="hljs-built_in">number</span>): <span class="hljs-built_in">void</span> {
-    <span class="hljs-comment">/* LPUSH bin:${binId}:requests + LTRIM to max */</span>
-  }
-  <span class="hljs-title function_">getRequests</span>(<span class="hljs-attr">binId</span>: <span class="hljs-built_in">string</span>): <span class="hljs-title class_">CapturedRequest</span>[] { <span class="hljs-comment">/* LRANGE ... */</span> }
-  <span class="hljs-title function_">getRequest</span>(<span class="hljs-attr">binId</span>: <span class="hljs-built_in">string</span>, <span class="hljs-attr">reqId</span>: <span class="hljs-built_in">string</span>): <span class="hljs-title class_">CapturedRequest</span> | <span class="hljs-literal">undefined</span> { <span class="hljs-comment">/* ... */</span> }
-  <span class="hljs-title function_">clearRequests</span>(<span class="hljs-attr">binId</span>: <span class="hljs-built_in">string</span>): <span class="hljs-built_in">void</span> { <span class="hljs-comment">/* DEL bin:${binId}:requests */</span> }
-  <span class="hljs-title function_">cleanupExpired</span>(<span class="hljs-attr">now</span>: <span class="hljs-built_in">number</span>): <span class="hljs-built_in">string</span>[] { <span class="hljs-comment">/* scan + delete */</span> <span class="hljs-keyword">return</span> []; }
-}
+<h3 id="storage">Storage</h3>
+<p><code>MockHttpBins</code> stores each bin in <a href="https://github.com/jaredwray/keyv">Keyv</a> 6. The default is <code>new Keyv()</code>. That store keeps the data in memory for this process.</p>
+<p>Pass a Keyv 6 instance when you want a different adapter. Install the adapter in your project. This package does not include an adapter. <code>@keyv/redis</code> 6 matches this Keyv version.</p>
+<pre><code class="hljs language-typescript"><span class="hljs-keyword">import</span> <span class="hljs-title class_">Keyv</span> <span class="hljs-keyword">from</span> <span class="hljs-string">'keyv'</span>;
+<span class="hljs-keyword">import</span> <span class="hljs-title class_">KeyvRedis</span> <span class="hljs-keyword">from</span> <span class="hljs-string">'@keyv/redis'</span>; <span class="hljs-comment">// pnpm add @keyv/redis</span>
+<span class="hljs-keyword">import</span> { <span class="hljs-title class_">MockHttpBins</span> } <span class="hljs-keyword">from</span> <span class="hljs-string">'@jaredwray/mockhttp'</span>;
 
-mock.<span class="hljs-property">bins</span> = <span class="hljs-keyword">new</span> <span class="hljs-title class_">BinManager</span>({ <span class="hljs-attr">store</span>: <span class="hljs-keyword">new</span> <span class="hljs-title class_">RedisBinStore</span>() });
+mock.<span class="hljs-property">bins</span> = <span class="hljs-keyword">new</span> <span class="hljs-title class_">MockHttpBins</span>({
+  <span class="hljs-attr">keyv</span>: <span class="hljs-keyword">new</span> <span class="hljs-title class_">Keyv</span>({ <span class="hljs-attr">store</span>: <span class="hljs-keyword">new</span> <span class="hljs-title class_">KeyvRedis</span>(<span class="hljs-string">'redis://localhost:6379'</span>) }),
+});
 </code></pre>
+<p>Each capture writes the full bin again. A large body or a high request limit makes that write large. Set <code>maxBodySize</code> and <code>maxRequestsPerBin</code> to limit the size. With the defaults, a full bin of binary bodies is about 17 MB.</p>
+<p>Two processes that share one Keyv can lose a capture. This occurs when both processes write the same bin at the same time.</p>
+<p>If Keyv does not store a write, the bin route returns <code>500</code> with the standard Fastify error body: <code>statusCode</code>, <code>error</code>, and <code>message</code>.</p>
+<p>A failed read depends on the Keyv <code>error</code> listener. Without a listener, Keyv throws the store error and the route returns <code>500</code>. With a listener, Keyv does not throw. A failed read then looks like a missing bin, and the route returns <code>404</code>. <code>listBins()</code> returns only the bins that it read before the error.</p>
+<p><code>listBins()</code> throws an error when the adapter has no iterator.</p>
+<p>An expired bin returns 404. The in-memory Keyv store deletes an expired bin only when a read or <code>listBins()</code> reaches it. Until then, the bin stays in memory.</p>
     </main>
     <aside class="content-aside">
       <h2 class="content-aside__title">TABLE OF CONTENTS</h2>
@@ -715,7 +762,7 @@ mock.<span class="hljs-property">bins</span> = <span class="hljs-keyword">new</s
     <a href="https://docula.org/" target="_blank" rel="noopener noreferrer" class="footer__link" aria-label="Docula">
       <svg class="footer__bat" xmlns="http://www.w3.org/2000/svg" viewBox="70 110 360 205" fill="currentColor"><path d="M420,173c-16.76-18-72.78-36.65-131.59-30.58A160.15,160.15,0,0,0,269,120.55c-3.78,4.52-11.15,9.45-19,9.45s-15.23-4.93-19-9.45a160.15,160.15,0,0,0-19.4,21.83C152.78,136.31,96.76,154.94,80,173c48.86,5.86,79.5,34.09,79.5,72.06,52.37,0,77,28,90.5,59.94C263.54,273,288.13,245,340.5,245,340.5,207,371.14,178.8,420,173Z"/><circle cx="239.19" cy="145.36" r="3.32" fill="#fff"/><circle cx="260.81" cy="145.36" r="3.32" fill="#fff"/></svg>
     </a>
-    <span class="footer__updated">updated: 2026-10-03</span>
+    <span class="footer__updated">updated: 2026-10-28</span>
   </footer>
   <script src="/css/highlight/highlight.min.js"></script>
   <script>

package/site/dist/docs/configuration/index.html

@@ -35,7 +35,7 @@
   </script>
   <title>MockHTTP - Configuration</title>
   <script type="application/ld+json">
-{"@context":"https://schema.org","@type":"TechArticle","headline":"Configuration","description":"","url":"https://mockhttp.org/docs/configuration/","publisher":{"@type":"Organization","name":"MockHTTP"},"dateModified":"2026-10-03","keywords":[]}
+{"@context":"https://schema.org","@type":"TechArticle","headline":"Configuration","description":"","url":"https://mockhttp.org/docs/configuration/","publisher":{"@type":"Organization","name":"MockHTTP"},"dateModified":"2026-10-28","keywords":[]}
 </script>
 </head>
 
@@ -544,7 +544,7 @@ GET /status/429/foo/bar
     <a href="https://docula.org/" target="_blank" rel="noopener noreferrer" class="footer__link" aria-label="Docula">
       <svg class="footer__bat" xmlns="http://www.w3.org/2000/svg" viewBox="70 110 360 205" fill="currentColor"><path d="M420,173c-16.76-18-72.78-36.65-131.59-30.58A160.15,160.15,0,0,0,269,120.55c-3.78,4.52-11.15,9.45-19,9.45s-15.23-4.93-19-9.45a160.15,160.15,0,0,0-19.4,21.83C152.78,136.31,96.76,154.94,80,173c48.86,5.86,79.5,34.09,79.5,72.06,52.37,0,77,28,90.5,59.94C263.54,273,288.13,245,340.5,245,340.5,207,371.14,178.8,420,173Z"/><circle cx="239.19" cy="145.36" r="3.32" fill="#fff"/><circle cx="260.81" cy="145.36" r="3.32" fill="#fff"/></svg>
     </a>
-    <span class="footer__updated">updated: 2026-10-03</span>
+    <span class="footer__updated">updated: 2026-10-28</span>
   </footer>
   <script src="/css/highlight/highlight.min.js"></script>
   <script>

package/site/dist/docs/hosted/index.html

@@ -35,7 +35,7 @@
   </script>
   <title>MockHTTP - MockHttp.org Live</title>
   <script type="application/ld+json">
-{"@context":"https://schema.org","@type":"TechArticle","headline":"MockHttp.org Live","description":"","url":"https://mockhttp.org/docs/hosted/","publisher":{"@type":"Organization","name":"MockHTTP"},"dateModified":"2026-10-03","keywords":[]}
+{"@context":"https://schema.org","@type":"TechArticle","headline":"MockHttp.org Live","description":"","url":"https://mockhttp.org/docs/hosted/","publisher":{"@type":"Organization","name":"MockHTTP"},"dateModified":"2026-10-28","keywords":[]}
 </script>
 </head>
 
@@ -293,7 +293,7 @@
   </header>
   <div class="article__body">
     <main class="article__main">
-      <p><a href="https://mockhttp.org">mockhttp.org</a> is a free hosted instance of this codebase for testing. It runs on a <a href="/docs/how-to-deploy/cloudflare/">Cloudflare Worker</a> (no containers): documentation is served from Workers Assets, and mock APIs such as <code>/get</code> and <code>/post</code> run in the Worker. The service is globally available and rate-limited (1000 requests per minute per IP) to prevent abuse.</p>
+      <p><a href="https://mockhttp.org">mockhttp.org</a> is a free hosted instance of this codebase for testing. It runs on a <a href="/docs/how-to-deploy/cloudflare/">Cloudflare Worker</a> (no containers): documentation is served from Workers Assets, and mock APIs such as <code>/get</code> and <code>/post</code> run in the Worker. The service is globally available and rate-limited (1000 requests per minute per IP) to prevent abuse. Request bins on this service are stored in MongoDB Atlas, in the <code>bins</code> collection, so they are shared across isolates.</p>
 <p>All <a href="https://mockhttp.org">mockhttp.org</a> traffic stays on Cloudflare. A separate test app runs the Node server on <a href="/docs/how-to-deploy/wasmer/">Wasmer Edge</a> at <a href="https://mockhttp.wasmer.app">mockhttp.wasmer.app</a>.</p>
 <p>Getting Started is served at <code>/</code> and <code>/docs</code>, other guides at <code>/docs/...</code>, and the interactive HTTP API reference at <code>/api</code>. Mock endpoints such as <code>/get</code> and <code>/post</code> are unchanged.</p>
     </main>
@@ -318,7 +318,7 @@
     <a href="https://docula.org/" target="_blank" rel="noopener noreferrer" class="footer__link" aria-label="Docula">
       <svg class="footer__bat" xmlns="http://www.w3.org/2000/svg" viewBox="70 110 360 205" fill="currentColor"><path d="M420,173c-16.76-18-72.78-36.65-131.59-30.58A160.15,160.15,0,0,0,269,120.55c-3.78,4.52-11.15,9.45-19,9.45s-15.23-4.93-19-9.45a160.15,160.15,0,0,0-19.4,21.83C152.78,136.31,96.76,154.94,80,173c48.86,5.86,79.5,34.09,79.5,72.06,52.37,0,77,28,90.5,59.94C263.54,273,288.13,245,340.5,245,340.5,207,371.14,178.8,420,173Z"/><circle cx="239.19" cy="145.36" r="3.32" fill="#fff"/><circle cx="260.81" cy="145.36" r="3.32" fill="#fff"/></svg>
     </a>
-    <span class="footer__updated">updated: 2026-10-03</span>
+    <span class="footer__updated">updated: 2026-10-28</span>
   </footer>
   <script src="/css/highlight/highlight.min.js"></script>
   <script>

package/site/dist/docs/how-to-deploy/cloudflare/index.html

@@ -35,7 +35,7 @@
   </script>
   <title>MockHTTP - Cloudflare</title>
   <script type="application/ld+json">
-{"@context":"https://schema.org","@type":"TechArticle","headline":"Cloudflare","description":"Deploy MockHTTP as a Cloudflare Worker. Workers Assets serve the docs site, and the Worker handles mock API routes.","url":"https://mockhttp.org/docs/how-to-deploy/cloudflare/","publisher":{"@type":"Organization","name":"MockHTTP"},"dateModified":"2026-10-03","keywords":[]}
+{"@context":"https://schema.org","@type":"TechArticle","headline":"Cloudflare","description":"Deploy MockHTTP as a Cloudflare Worker. Workers Assets serve the docs site, and the Worker handles mock API routes.","url":"https://mockhttp.org/docs/how-to-deploy/cloudflare/","publisher":{"@type":"Organization","name":"MockHTTP"},"dateModified":"2026-10-28","keywords":[]}
 </script>
 </head>
 
@@ -329,11 +329,6 @@
 <td>Logos and other <code>public/</code> files are copied into <code>site/dist</code> and read through the <code>ASSETS</code> binding.</td>
 </tr>
 <tr>
-<td><code>startBins</code></td>
-<td><code>false</code></td>
-<td>The bin cleanup timer uses <code>setInterval</code>, which can hang a Worker isolate during startup. Bin routes still register. Expired bins are removed when that bin is read, not by a sweep of every bin.</td>
-</tr>
-<tr>
 <td><code>pluginTimeout</code></td>
 <td><code>0</code></td>
 <td>Disables Fastify's plugin boot timeout. Those timers are unreliable on Workers.</td>
@@ -350,7 +345,12 @@
 </tr>
 </tbody>
 </table>
-<p>The rate limiter key is the <code>cf-connecting-ip</code> header, then the first address in <code>x-forwarded-for</code>, then <code>unknown</code>. A limited request returns <code>429</code> with <code>retry-after: 60</code>. That limiter is shared across isolates. Bins are not. The default store is in memory inside the isolate that handled the request, so a bin created on one request can be missing when another isolate or location handles the next one.</p>
+<p>The rate limiter key is the <code>cf-connecting-ip</code> header, then the first address in <code>x-forwarded-for</code>, then <code>unknown</code>. A limited request returns <code>429</code> with <code>retry-after: 60</code>. That limiter is shared across isolates.</p>
+<p>Bins stay in memory in the isolate when <code>MONGODB_URI</code> is not set. A bin from one request can be absent when a different isolate handles the next request. When <code>MONGODB_URI</code> is set, bins are stored in MongoDB. Each request opens its own client on its first bin operation and closes it after the response, through <code>ctx.waitUntil</code>. No client is shared between requests: workerd rejects I/O on a socket that a different request opened, and a shared client made bin requests fail with error 1101. It does not connect while the isolate starts. Each bin request therefore pays one connection setup, which is a few round trips to Atlas.</p>
+<p>Percent-encode reserved characters in the username and the password. <code>@</code> is <code>%40</code>. An unencoded <code>@</code> makes the driver throw <code>Invalid connection string</code> before it contacts Atlas.</p>
+<p><code>GET /healthz</code> reports the bin store. A successful admin ping returns HTTP 200 and <code>bins.connected: true</code>. A failed ping returns HTTP 503 with the driver error name, a redacted message, and a code. The body has <code>uriPresent</code> (boolean). It does not have the scheme. On the Node server, this route reports the memory store.</p>
+<p>When <code>MONGODB_URI</code> is set, <code>bins.uri</code> has the URI length and the <code>@</code> count. It also has flags for whitespace, a newline, and quote marks. It does not have the host, the username, or the password length. The body does not have the password or the full URI.</p>
+<p>The percent-encode hint is added only for <code>Invalid connection string</code> or <code>unescaped characters</code>. A DNS error keeps the driver text. <code>uri.passwordReserved</code> is empty when the password has only reserved characters. Worker logs still omit the URI, the username, the password, and the host.</p>
 <p>Taps are a library API (<code>mock.taps.inject</code>). They have no HTTP routes, so a deployed Worker has no way to inject one.</p>
 <p>Assets are checked before the Worker. A file under <code>site/dist</code> (the docs site, favicon, logos) is served as a static asset. A path that is not a file, such as <code>/get</code> or <code>/post</code>, is handled by the Worker.</p>
 <h2 id="deploy-your-own-worker">Deploy your own Worker</h2>
@@ -390,7 +390,7 @@ npx wrangler@4.127.0 deploy
     <a href="https://docula.org/" target="_blank" rel="noopener noreferrer" class="footer__link" aria-label="Docula">
       <svg class="footer__bat" xmlns="http://www.w3.org/2000/svg" viewBox="70 110 360 205" fill="currentColor"><path d="M420,173c-16.76-18-72.78-36.65-131.59-30.58A160.15,160.15,0,0,0,269,120.55c-3.78,4.52-11.15,9.45-19,9.45s-15.23-4.93-19-9.45a160.15,160.15,0,0,0-19.4,21.83C152.78,136.31,96.76,154.94,80,173c48.86,5.86,79.5,34.09,79.5,72.06,52.37,0,77,28,90.5,59.94C263.54,273,288.13,245,340.5,245,340.5,207,371.14,178.8,420,173Z"/><circle cx="239.19" cy="145.36" r="3.32" fill="#fff"/><circle cx="260.81" cy="145.36" r="3.32" fill="#fff"/></svg>
     </a>
-    <span class="footer__updated">updated: 2026-10-03</span>
+    <span class="footer__updated">updated: 2026-10-28</span>
   </footer>
   <script src="/css/highlight/highlight.min.js"></script>
   <script>

package/site/dist/docs/how-to-deploy/docker/index.html

@@ -35,7 +35,7 @@
   </script>
   <title>MockHTTP - Docker</title>
   <script type="application/ld+json">
-{"@context":"https://schema.org","@type":"TechArticle","headline":"Docker","description":"Run MockHTTP from the jaredwray/mockhttp image, with Docker Compose, or by building the image from this repository.","url":"https://mockhttp.org/docs/how-to-deploy/docker/","publisher":{"@type":"Organization","name":"MockHTTP"},"dateModified":"2026-10-03","keywords":[]}
+{"@context":"https://schema.org","@type":"TechArticle","headline":"Docker","description":"Run MockHTTP from the jaredwray/mockhttp image, with Docker Compose, or by building the image from this repository.","url":"https://mockhttp.org/docs/how-to-deploy/docker/","publisher":{"@type":"Organization","name":"MockHTTP"},"dateModified":"2026-10-28","keywords":[]}
 </script>
 </head>
 
@@ -399,7 +399,7 @@ docker run -d -p 3000:3000 jaredwray/mockhttp
     <a href="https://docula.org/" target="_blank" rel="noopener noreferrer" class="footer__link" aria-label="Docula">
       <svg class="footer__bat" xmlns="http://www.w3.org/2000/svg" viewBox="70 110 360 205" fill="currentColor"><path d="M420,173c-16.76-18-72.78-36.65-131.59-30.58A160.15,160.15,0,0,0,269,120.55c-3.78,4.52-11.15,9.45-19,9.45s-15.23-4.93-19-9.45a160.15,160.15,0,0,0-19.4,21.83C152.78,136.31,96.76,154.94,80,173c48.86,5.86,79.5,34.09,79.5,72.06,52.37,0,77,28,90.5,59.94C263.54,273,288.13,245,340.5,245,340.5,207,371.14,178.8,420,173Z"/><circle cx="239.19" cy="145.36" r="3.32" fill="#fff"/><circle cx="260.81" cy="145.36" r="3.32" fill="#fff"/></svg>
     </a>
-    <span class="footer__updated">updated: 2026-10-03</span>
+    <span class="footer__updated">updated: 2026-10-28</span>
   </footer>
   <script src="/css/highlight/highlight.min.js"></script>
   <script>

package/site/dist/docs/how-to-deploy/wasmer/index.html

@@ -35,7 +35,7 @@
   </script>
   <title>MockHTTP - Wasmer</title>
   <script type="application/ld+json">
-{"@context":"https://schema.org","@type":"TechArticle","headline":"Wasmer","description":"Deploy the MockHTTP Node.js server to Wasmer Edge with app.yaml, Anybuild, and wasmer deploy.","url":"https://mockhttp.org/docs/how-to-deploy/wasmer/","publisher":{"@type":"Organization","name":"MockHTTP"},"dateModified":"2026-10-03","keywords":[]}
+{"@context":"https://schema.org","@type":"TechArticle","headline":"Wasmer","description":"Deploy the MockHTTP Node.js server to Wasmer Edge with app.yaml, Anybuild, and wasmer deploy.","url":"https://mockhttp.org/docs/how-to-deploy/wasmer/","publisher":{"@type":"Organization","name":"MockHTTP"},"dateModified":"2026-10-28","keywords":[]}
 </script>
 </head>
 
@@ -320,7 +320,7 @@
 <h2 id="build-with-anybuild">Build with Anybuild</h2>
 <p><a href="https://github.com/jaredwray/mockhttp/blob/main/Anybuild"><code>Anybuild</code></a> tells Wasmer how to build the package on a remote builder:</p>
 <ul>
-<li>Node.js 24 and pnpm <code>12.4.1</code></li>
+<li>Node.js 24 and pnpm <code>12.12.1</code></li>
 <li>Build command: <code>pnpm run build &#x26;&#x26; pnpm website:build</code></li>
 <li>Start command: <code>node dist/index.mjs</code></li>
 </ul>
@@ -335,7 +335,7 @@
 <pre><code class="hljs language-bash">wasmer deploy --non-interactive --build-remote
 </code></pre>
 <h2 id="runtime-behavior">Runtime behavior</h2>
-<p>Bins use the default in-memory store, so a bin exists only on the instance that created it. Taps are a library API (<code>mock.taps.inject</code>) and have no HTTP routes, so a deployed app cannot inject one.</p>
+<p>Bins use <code>new Keyv()</code> by default. The store keeps each bin in memory on the instance that created it. Give <code>MockHttpBins</code> a shared Keyv when bins must be visible on more than one instance. Two processes can lose a capture when they write the same bin at the same time. Taps are a library API (<code>mock.taps.inject</code>) and have no HTTP routes, so a deployed app cannot inject one.</p>
 <p><code>@fastify/rate-limit</code> is on at 1000 requests per minute. It keys on the address that connects to the process. The server does not trust proxy headers, and the allow list is only <code>127.0.0.1</code> and <code>::1</code>. On the test app, <code>/ip</code> reports <code>127.0.0.100</code>, which is the edge proxy rather than the caller, and the response includes <code>x-ratelimit-limit: 1000</code>. Clients that share that proxy address share one limit on that instance. This is not the Cloudflare limiter used by <a href="https://mockhttp.org">mockhttp.org</a>.</p>
 <p>The process listens with HTTP. Wasmer terminates TLS for the <code>*.wasmer.app</code> hostname.</p>
     </main>
@@ -360,7 +360,7 @@
     <a href="https://docula.org/" target="_blank" rel="noopener noreferrer" class="footer__link" aria-label="Docula">
       <svg class="footer__bat" xmlns="http://www.w3.org/2000/svg" viewBox="70 110 360 205" fill="currentColor"><path d="M420,173c-16.76-18-72.78-36.65-131.59-30.58A160.15,160.15,0,0,0,269,120.55c-3.78,4.52-11.15,9.45-19,9.45s-15.23-4.93-19-9.45a160.15,160.15,0,0,0-19.4,21.83C152.78,136.31,96.76,154.94,80,173c48.86,5.86,79.5,34.09,79.5,72.06,52.37,0,77,28,90.5,59.94C263.54,273,288.13,245,340.5,245,340.5,207,371.14,178.8,420,173Z"/><circle cx="239.19" cy="145.36" r="3.32" fill="#fff"/><circle cx="260.81" cy="145.36" r="3.32" fill="#fff"/></svg>
     </a>
-    <span class="footer__updated">updated: 2026-10-03</span>
+    <span class="footer__updated">updated: 2026-10-28</span>
   </footer>
   <script src="/css/highlight/highlight.min.js"></script>
   <script>