@steve31415/baselib 3.55.0 → 3.57.0

package/README.md

@@ -49,7 +49,8 @@ job does not fast-forward the checkout under the build.
 `twitter` provides Mirror-first tweet lookup, TwitterAPI.io batch/search/
 article calls, and thread assembly through direct reply edges. It includes
 one level of quotes, article bodies and URL expansions. Use one shared
-`MirrorTweetClient(mirrorUrl, serviceFetch)` and `TwitterApiIoClient(key)`
+`MirrorTweetClient(mirrorUrl, serviceFetch, { logger })` (the logger gets
+the WARN when a refused query is retried) and `TwitterApiIoClient(key)`
 per run; `assembleThread(id, { api, mirror, ancestors: 'all' })` returns
 role-tagged tweets (with `links`: expanded URLs and link-card text), source
 counts and warnings; add `replies: { rule: 'digest', followed }` for Digest's

package/dist/auth.d.ts

@@ -28,7 +28,8 @@ declare module 'hono' {
 export interface RequireIdentityOptions extends S2sOptions {
     /** Base URL of the auth service. */
     authUrl?: string;
-    /** Injectable for tests (defaults to global fetch). */
+    /** Injectable for tests (default: fetch with the auth host's address
+     *  cached in-process, fleet-dns.ts). */
     whoamiFetch?: typeof fetch;
     logger?: Logger;
     /** Distinguishes API requests (401/403 JSON) from page requests (redirect

package/dist/auth.js

@@ -31,6 +31,7 @@ import { createMiddleware } from 'hono/factory';
 import { authMode } from './config.js';
 import { truncate } from './log-core.js';
 import { RateLimiter, resolveS2sCaller } from './s2s.js';
+import { fleetAddressState, fleetFetch } from './fleet-dns.js';
 export const DEFAULT_AUTH_URL = 'https://auth.apps.snewman.net';
 export const SESSION_COOKIE = 'pw_session';
 /** The `code` in a 403 JSON body when a signed-in user is refused by the
@@ -45,7 +46,8 @@ function parseRole(value) {
 }
 export function requireIdentity(opts) {
     const authUrl = (opts.authUrl ?? DEFAULT_AUTH_URL).replace(/\/$/, '');
-    const whoamiFetch = opts.whoamiFetch ?? fetch;
+    const whoamiFetch = opts.whoamiFetch ?? fleetFetch;
+    const authHost = new URL(authUrl).hostname;
     const hitMs = opts.cacheTtl?.hitMs ?? 600_000;
     const missMs = opts.cacheTtl?.missMs ?? 30_000;
     const policy = opts.userAccess ?? 'owner';
@@ -155,6 +157,10 @@ export function requireIdentity(opts) {
     async function callWhoami(c, key, cached, cookieHeader, joiners) {
         const started = Date.now();
         const cacheState = !cached ? 'absent' : cached.user ? 'expired-user' : 'expired-unauthenticated';
+        // Whether this call must look up the auth host's address (absent) or has
+        // it cached in-process (fresh, or stale and refreshing in the
+        // background); undefined for a non-fleet authUrl.
+        const authAddress = fleetAddressState(authHost);
         const callFields = {
             cacheState,
             ...(cached ? { entryAgeMs: started - cached.filled } : {}),
@@ -166,6 +172,7 @@ export function requireIdentity(opts) {
             path: truncate(c.req.path, 200),
             upgrade: (c.req.header('upgrade') ?? '').toLowerCase() === 'websocket',
             cookieCount: cookieHeader.split(';').filter((part) => part.includes('=')).length,
+            ...(authAddress ? { authAddress } : {}),
         };
         hitsSinceLastCall = 0;
         callCount++;

package/dist/fleet-dns.d.ts

@@ -0,0 +1,52 @@
+import { type LookupAddress } from 'node:dns';
+import type { LookupFunction } from 'node:net';
+import { Agent } from 'undici';
+export declare const FLEET_DOMAIN_SUFFIX = ".apps.snewman.net";
+/** How long a resolved fleet address is used before a background refresh.
+ *  Long, because the address is a reserved static IP and a change is
+ *  healed by the connect-failure path anyway. */
+export declare const FLEET_ADDRESS_TTL_MS: number;
+export declare function isFleetHost(hostname: string): boolean;
+export type FleetAddressState = 'fresh' | 'stale' | 'absent';
+export interface FleetAddressCacheOptions {
+    /** All addresses for a fleet host (default: dns.promises.lookup, all). */
+    resolve?: (hostname: string) => Promise<LookupAddress[]>;
+    /** Non-fleet hosts, and families the cached answer lacks (default dns.lookup). */
+    systemLookup?: LookupFunction;
+    ttlMs?: number;
+    now?: () => number;
+    /** Called when a connect failure drops an entry. */
+    onInvalidate?: (e: {
+        hostname: string;
+        addresses: string[];
+        reason: string;
+    }) => void;
+}
+export declare class FleetAddressCache {
+    private readonly entries;
+    private readonly inflight;
+    private readonly resolve;
+    private readonly systemLookup;
+    private readonly ttlMs;
+    private readonly now;
+    private readonly onInvalidate?;
+    constructor(opts?: FleetAddressCacheOptions);
+    /** net.connect's `lookup` option. */
+    readonly lookup: LookupFunction;
+    /** undefined for a non-fleet host. */
+    state(hostname: string): FleetAddressState | undefined;
+    /** Forget a host's address, so its next connection resolves afresh. */
+    invalidate(hostname: string, reason: string): void;
+    private refresh;
+    private answer;
+}
+/** An undici Agent whose connections resolve through `cache` and drop the
+ *  cached address when a connection fails for an address reason. */
+export declare function createFleetAgent(cache: FleetAddressCache): Agent;
+/** The dispatcher baselib's server-to-server calls use. */
+export declare function fleetDispatcher(): Agent;
+/** The process-wide cache's state for `hostname` (undefined: not a fleet host). */
+export declare function fleetAddressState(hostname: string): FleetAddressState | undefined;
+/** fetch() through fleetDispatcher(). `dispatcher` is Node's (undici's)
+ *  extension of RequestInit, absent from the DOM type. */
+export declare const fleetFetch: typeof fetch;

package/dist/fleet-dns.js

@@ -0,0 +1,164 @@
+// An in-process address cache for fleet hosts (*.apps.snewman.net), used by
+// the server-to-server calls baselib makes: the session check against auth
+// (whoami) and serviceFetch.
+//
+// Why: on Cloud Run, Node's dns.lookup goes through getaddrinfo to the
+// metadata-server resolver, which keeps an answer for at most ~300 s
+// whatever the record's TTL (the fleet's A records carry 3600 s since
+// 2026-10-30; it made no difference). An infrequent caller therefore paid a
+// ~60 ms lookup on almost every call: whoami took 113 ms p50 when the app's
+// previous call was 300-3600 s earlier against 52 ms under 300 s, 79 % of
+// calls in the slow bucket (2026-10-30 → 11-05,
+// ~/migration/research/whoami-latency-2026-10-30.md, "Follow-up 2026-11-05").
+//
+// What: every fleet host resolves to the one static load-balancer address,
+// so a resolved answer is kept for FLEET_ADDRESS_TTL_MS and, once older,
+// still served at once while a background lookup refreshes it. A connection
+// that fails in a way an address change would cause (refused, timed out,
+// unreachable) drops the entry, so the next call resolves afresh: an
+// address change heals after one failed call. Only the lookup changes: the
+// URL, Host header and TLS server name (SNI) are still the hostname. Other
+// hosts go straight to dns.lookup, uncached.
+import dns from 'node:dns';
+import { Agent, buildConnector } from 'undici';
+import { processMeta } from './process-meta.js';
+export const FLEET_DOMAIN_SUFFIX = '.apps.snewman.net';
+/** How long a resolved fleet address is used before a background refresh.
+ *  Long, because the address is a reserved static IP and a change is
+ *  healed by the connect-failure path anyway. */
+export const FLEET_ADDRESS_TTL_MS = 60 * 60_000;
+/** Connect errors that a stale address would cause. Anything else (a TLS
+ *  or HTTP failure) says nothing about the address and keeps the entry. */
+const ADDRESS_FAILURE_CODES = new Set(['ECONNREFUSED', 'ETIMEDOUT', 'EHOSTUNREACH', 'ENETUNREACH', 'UND_ERR_CONNECT_TIMEOUT']);
+export function isFleetHost(hostname) {
+    return normalize(hostname).endsWith(FLEET_DOMAIN_SUFFIX);
+}
+function normalize(hostname) {
+    return hostname.toLowerCase().replace(/\.$/, '');
+}
+export class FleetAddressCache {
+    entries = new Map();
+    inflight = new Map();
+    resolve;
+    systemLookup;
+    ttlMs;
+    now;
+    onInvalidate;
+    constructor(opts = {}) {
+        this.resolve = opts.resolve ?? ((hostname) => dns.promises.lookup(hostname, { all: true }));
+        this.systemLookup = opts.systemLookup ?? dns.lookup;
+        this.ttlMs = opts.ttlMs ?? FLEET_ADDRESS_TTL_MS;
+        this.now = opts.now ?? Date.now;
+        this.onInvalidate = opts.onInvalidate;
+    }
+    /** net.connect's `lookup` option. */
+    lookup = (hostname, options, callback) => {
+        if (!isFleetHost(hostname))
+            return this.systemLookup(hostname, options, callback);
+        const key = normalize(hostname);
+        const entry = this.entries.get(key);
+        if (entry) {
+            if (this.now() - entry.resolvedAt >= this.ttlMs)
+                this.refresh(key).catch(() => { }); // keep the old answer
+            return this.answer(entry, hostname, options, callback);
+        }
+        this.refresh(key).then((fresh) => this.answer(fresh, hostname, options, callback), (err) => callback(err, options.all ? [] : ''));
+    };
+    /** undefined for a non-fleet host. */
+    state(hostname) {
+        if (!isFleetHost(hostname))
+            return undefined;
+        const entry = this.entries.get(normalize(hostname));
+        if (!entry)
+            return 'absent';
+        return this.now() - entry.resolvedAt < this.ttlMs ? 'fresh' : 'stale';
+    }
+    /** Forget a host's address, so its next connection resolves afresh. */
+    invalidate(hostname, reason) {
+        const key = normalize(hostname);
+        const entry = this.entries.get(key);
+        if (!entry)
+            return;
+        this.entries.delete(key);
+        this.onInvalidate?.({ hostname: key, addresses: entry.addresses.map((a) => a.address), reason });
+    }
+    // One resolution per host at a time; a failure is never cached.
+    refresh(key) {
+        let pending = this.inflight.get(key);
+        if (!pending) {
+            pending = this.resolve(key)
+                .then((addresses) => {
+                if (addresses.length === 0)
+                    throw Object.assign(new Error(`no address for ${key}`), { code: 'ENOTFOUND' });
+                const entry = { addresses, resolvedAt: this.now() };
+                this.entries.set(key, entry);
+                return entry;
+            })
+                .finally(() => this.inflight.delete(key));
+            this.inflight.set(key, pending);
+        }
+        return pending;
+    }
+    answer(entry, hostname, options, callback) {
+        const family = familyNumber(options.family);
+        const addresses = family ? entry.addresses.filter((a) => a.family === family) : entry.addresses;
+        if (addresses.length === 0)
+            return this.systemLookup(hostname, options, callback);
+        if (options.all)
+            callback(null, addresses);
+        else
+            callback(null, addresses[0].address, addresses[0].family);
+    }
+}
+function familyNumber(family) {
+    if (family === 'IPv4')
+        return 4;
+    if (family === 'IPv6')
+        return 6;
+    return family ?? 0;
+}
+/** The code of a connect error, looking inside the AggregateError that
+ *  Node's happy-eyeballs connect raises when every address failed. */
+function addressFailureCode(err) {
+    const codes = [err, ...(err.errors ?? [])].map((e) => e?.code);
+    return codes.find((c) => typeof c === 'string' && ADDRESS_FAILURE_CODES.has(c));
+}
+/** An undici Agent whose connections resolve through `cache` and drop the
+ *  cached address when a connection fails for an address reason. */
+export function createFleetAgent(cache) {
+    const connect = buildConnector({ lookup: cache.lookup });
+    return new Agent({
+        connect: (opts, callback) => connect(opts, (...args) => {
+            const err = args[0];
+            if (err) {
+                const code = addressFailureCode(err);
+                if (code)
+                    cache.invalidate(opts.hostname, code);
+            }
+            callback(...args);
+        }),
+    });
+}
+let shared;
+function sharedFleet() {
+    if (!shared) {
+        const cache = new FleetAddressCache({
+            // Rare (the load balancer's address would have to change), so worth
+            // a line. No logger reaches this module: stdout, like db.ts's backstop.
+            onInvalidate: (e) => console.warn('fleet address dropped after connect failure', { ...processMeta(), ...e }),
+        });
+        shared = { cache, agent: createFleetAgent(cache) };
+    }
+    return shared;
+}
+/** The dispatcher baselib's server-to-server calls use. */
+export function fleetDispatcher() {
+    return sharedFleet().agent;
+}
+/** The process-wide cache's state for `hostname` (undefined: not a fleet host). */
+export function fleetAddressState(hostname) {
+    return sharedFleet().cache.state(hostname);
+}
+/** fetch() through fleetDispatcher(). `dispatcher` is Node's (undici's)
+ *  extension of RequestInit, absent from the DOM type. */
+export const fleetFetch = (input, init) => fetch(input, { ...init, dispatcher: fleetDispatcher() });

package/dist/front-end-retry.d.ts

@@ -0,0 +1,28 @@
+import type { Logger } from './log-core.js';
+/** The statuses retried. A 500 page is left out: Cloud Run also sends one
+ *  when the app crashes mid-request, and that is not worth a second try. */
+export declare const FRONT_END_REFUSAL_STATUSES: ReadonlySet<number>;
+/** Pause before the one retry. Each attempt keeps whatever timeout `send`
+ *  gives it, so a caller's worst case is two of its timeouts plus this. */
+export declare const FRONT_END_RETRY_DELAY_MS = 1000;
+/** True when `status` and `body` are Google's front end refusing the request
+ *  (a 502/503/504 HTML page), not the app answering. */
+export declare function isFrontEndRefusal(status: number, body: string): boolean;
+export interface FrontEndRetryOptions {
+    logger: Pick<Logger, 'warn'>;
+    /** The WARN logged before the retry, e.g. 'mirror_query_retry'. */
+    event: string;
+    /** Extra fields for that WARN (the caller's label, path, page). It adds
+     *  status, body (first 200 chars) and elapsedMs of the refused attempt. */
+    meta?: Record<string, unknown>;
+    /** Default FRONT_END_RETRY_DELAY_MS. */
+    delayMs?: number;
+}
+/** Send one idempotent request; when Google's front end refuses it
+ *  (isFrontEndRefusal), log a WARN and send it once more after the delay.
+ *  `send` builds the request afresh each time, timeout signal included.
+ *  Returns the last Response as `send` produced it: any failure other than a
+ *  first refusal, and a second refusal, come back with the body unread for
+ *  the caller's own ERROR path. A thrown error (network, timeout) is not
+ *  retried here. */
+export declare function withFrontEndRetry(send: () => Promise<Response>, opts: FrontEndRetryOptions): Promise<Response>;

package/dist/front-end-retry.js

@@ -0,0 +1,50 @@
+// One retry for a request Google's front end refused without passing it to
+// the app (PW KNOWN_LOG_PATTERNS.md, "Cloud Run's front end answers a 5xx
+// while the instance stays up"). The load balancer or Cloud Run's serving
+// front end answers with its own HTML error page and the target's Cloud Run
+// request log has no entry: 2026-11-06 12:00:01Z, Digest's Mirror tweet
+// query got a 502 page after 8.93 s and its whole sync failed at ERROR. The
+// LB re-sends a bodiless request on a 502 itself, so it is mostly POSTs with
+// a body (Mirror's record queries) that surface the refusal.
+//
+// Only for reads and other idempotent requests. That a refused request never
+// reached the app is inferred from the missing Cloud Run entry, not
+// guaranteed, so a write that must not run twice is never sent through here.
+/** The statuses retried. A 500 page is left out: Cloud Run also sends one
+ *  when the app crashes mid-request, and that is not worth a second try. */
+export const FRONT_END_REFUSAL_STATUSES = new Set([502, 503, 504]);
+/** Google's error page; an app's own error is JSON or plain text. */
+const GOOGLE_ERROR_PAGE = /^\s*(<!doctype html|<html)/i;
+/** Pause before the one retry. Each attempt keeps whatever timeout `send`
+ *  gives it, so a caller's worst case is two of its timeouts plus this. */
+export const FRONT_END_RETRY_DELAY_MS = 1_000;
+/** True when `status` and `body` are Google's front end refusing the request
+ *  (a 502/503/504 HTML page), not the app answering. */
+export function isFrontEndRefusal(status, body) {
+    return FRONT_END_REFUSAL_STATUSES.has(status) && GOOGLE_ERROR_PAGE.test(body);
+}
+/** Send one idempotent request; when Google's front end refuses it
+ *  (isFrontEndRefusal), log a WARN and send it once more after the delay.
+ *  `send` builds the request afresh each time, timeout signal included.
+ *  Returns the last Response as `send` produced it: any failure other than a
+ *  first refusal, and a second refusal, come back with the body unread for
+ *  the caller's own ERROR path. A thrown error (network, timeout) is not
+ *  retried here. */
+export async function withFrontEndRetry(send, opts) {
+    const startedAt = Date.now();
+    const first = await send();
+    if (!FRONT_END_REFUSAL_STATUSES.has(first.status))
+        return first;
+    const body = await first.clone().text().catch(() => '');
+    if (!isFrontEndRefusal(first.status, body))
+        return first;
+    await first.body?.cancel().catch(() => { });
+    opts.logger.warn(opts.event, {
+        ...opts.meta,
+        status: first.status,
+        body: body.slice(0, 200),
+        elapsedMs: Date.now() - startedAt,
+    });
+    await new Promise((resolve) => setTimeout(resolve, opts.delayMs ?? FRONT_END_RETRY_DELAY_MS));
+    return send();
+}

package/dist/s2s.d.ts

@@ -1,5 +1,6 @@
 import { OAuth2Client } from 'google-auth-library';
 import { type Logger } from './log-core.js';
+export * from './front-end-retry.js';
 /** The fleet coding agent's service-account email, read from AGENT_SA — set at
  * deploy time by each service (SECURITY.md: agents have full access, so
  * grantAllows always admits this identity). Env-driven rather than a baked-in
@@ -80,7 +81,8 @@ export declare const ID_TOKEN_MINT_TIMEOUT_MS = 5000;
  *  (identity from TEST_S2S_IDENTITY, default 'test-service@test'). The token
  *  is cached per audience until ID_TOKEN_REFRESH_MARGIN_MS before it
  *  expires; concurrent calls share one mint, which is bounded by
- *  ID_TOKEN_MINT_TIMEOUT_MS, and `init.signal` also ends the wait for it. */
+ *  ID_TOKEN_MINT_TIMEOUT_MS, and `init.signal` also ends the wait for it.
+ *  Fleet hosts' addresses are cached in-process (fleet-dns.ts). */
 export declare function serviceFetch(url: string, opts: {
     audience: string;
 } & RequestInit): Promise<Response>;

package/dist/s2s.js

@@ -17,6 +17,9 @@ import { OAuth2Client } from 'google-auth-library';
 import { createHash } from 'node:crypto';
 import { authMode } from './config.js';
 import { truncate } from './log-core.js';
+import { fleetFetch } from './fleet-dns.js';
+// The one-retry wrapper for a caller's idempotent serviceFetch requests.
+export * from './front-end-retry.js';
 /** The fleet coding agent's service-account email, read from AGENT_SA — set at
  * deploy time by each service (SECURITY.md: agents have full access, so
  * grantAllows always admits this identity). Env-driven rather than a baked-in
@@ -201,7 +204,8 @@ const idTokenMints = new Map();
  *  (identity from TEST_S2S_IDENTITY, default 'test-service@test'). The token
  *  is cached per audience until ID_TOKEN_REFRESH_MARGIN_MS before it
  *  expires; concurrent calls share one mint, which is bounded by
- *  ID_TOKEN_MINT_TIMEOUT_MS, and `init.signal` also ends the wait for it. */
+ *  ID_TOKEN_MINT_TIMEOUT_MS, and `init.signal` also ends the wait for it.
+ *  Fleet hosts' addresses are cached in-process (fleet-dns.ts). */
 export async function serviceFetch(url, opts) {
     const { audience, ...init } = opts;
     const headers = new Headers(init.headers);
@@ -212,7 +216,7 @@ export async function serviceFetch(url, opts) {
         const token = await abortable(idTokenFor(audience), init.signal);
         headers.set('authorization', `Bearer ${token}`);
     }
-    return fetch(url, { ...init, headers });
+    return fleetFetch(url, { ...init, headers });
 }
 function idTokenFor(audience) {
     const cached = idTokens.get(audience);

package/dist/twitter-mirror.d.ts

@@ -1,4 +1,5 @@
 import type { serviceFetch } from './s2s.js';
+import type { Logger } from './log-core.js';
 import { type TwitterApiIoTweet, type TweetEntityUrl } from './twitter-client.js';
 export interface MirrorTweetRecord {
     tweet_id: string;
@@ -36,13 +37,19 @@ export declare const MIRROR_CONVERSATION_MAX_PAGES = 10;
 /** Shared per run: batch prefetch seeds the id cache, conversation requests
  * are coalesced, and failed requests are evicted so a later link can retry.
  * Conversations follow Mirror's keyset cursor (record_timestamp DESC, id
- * DESC) while `has_more`, bounded by MIRROR_CONVERSATION_MAX_PAGES. */
+ * DESC) while `has_more`, bounded by MIRROR_CONVERSATION_MAX_PAGES.
+ * A query Google's front end refuses is sent once more (withFrontEndRetry:
+ * every query is a read); pass `logger` so the retry logs its WARN
+ * (`mirror_tweets_query_retry`). */
 export declare class MirrorTweetClient implements MirrorTwitterClient {
     private readonly mirrorUrl;
     private readonly fetchFn;
+    private readonly opts;
     private readonly byId;
     private readonly conversations;
-    constructor(mirrorUrl: string, fetchFn: typeof serviceFetch);
+    constructor(mirrorUrl: string, fetchFn: typeof serviceFetch, opts?: {
+        logger?: Pick<Logger, 'warn'>;
+    });
     private query;
     getTweetsByIds(ids: string[]): Promise<TwitterApiIoTweet[]>;
     getConversation(id: string): Promise<MirrorConversation>;

package/dist/twitter-mirror.js

@@ -1,3 +1,4 @@
+import { withFrontEndRetry } from './front-end-retry.js';
 import { assertTweetId } from './twitter-client.js';
 /** Mirror snapshots store URL expansions under `url`, without the original
  * t.co token. Keep both shapes; rendering handles the positional fallback. */
@@ -37,23 +38,30 @@ export const MIRROR_CONVERSATION_MAX_PAGES = 10;
 /** Shared per run: batch prefetch seeds the id cache, conversation requests
  * are coalesced, and failed requests are evicted so a later link can retry.
  * Conversations follow Mirror's keyset cursor (record_timestamp DESC, id
- * DESC) while `has_more`, bounded by MIRROR_CONVERSATION_MAX_PAGES. */
+ * DESC) while `has_more`, bounded by MIRROR_CONVERSATION_MAX_PAGES.
+ * A query Google's front end refuses is sent once more (withFrontEndRetry:
+ * every query is a read); pass `logger` so the retry logs its WARN
+ * (`mirror_tweets_query_retry`). */
 export class MirrorTweetClient {
     mirrorUrl;
     fetchFn;
+    opts;
     byId = new Map();
     conversations = new Map();
-    constructor(mirrorUrl, fetchFn) {
+    constructor(mirrorUrl, fetchFn, opts = {}) {
         this.mirrorUrl = mirrorUrl;
         this.fetchFn = fetchFn;
+        this.opts = opts;
     }
     async query(filter, cursor) {
-        const response = await this.fetchFn(`${this.mirrorUrl.replace(/\/$/, '')}/api/records/tweets/query`, {
-            audience: this.mirrorUrl.replace(/\/$/, ''), method: 'POST',
+        const base = this.mirrorUrl.replace(/\/$/, '');
+        const body = JSON.stringify({ filter_sql: filter, columns: '*', limit: MIRROR_PAGE_LIMIT, ...(cursor ? { cursor } : {}) });
+        const response = await withFrontEndRetry(() => this.fetchFn(`${base}/api/records/tweets/query`, {
+            audience: base, method: 'POST',
             headers: { 'content-type': 'application/json' },
-            body: JSON.stringify({ filter_sql: filter, columns: '*', limit: MIRROR_PAGE_LIMIT, ...(cursor ? { cursor } : {}) }),
+            body,
             signal: AbortSignal.timeout(30_000),
-        });
+        }), { logger: this.opts.logger ?? { warn: () => { } }, event: 'mirror_tweets_query_retry', meta: { filter: filter.slice(0, 200), cursor: cursor ?? null } });
         if (!response.ok)
             throw new Error(`Mirror tweets query HTTP ${response.status}`);
         const data = await response.json();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@steve31415/baselib",
-  "version": "3.55.0",
+  "version": "3.57.0",
   "description": "Plasticine new-world shared platform library: logging, auth, service-to-service auth, db, HTTP, sync, app updates",
   "type": "module",
   "license": "MIT",
@@ -133,6 +133,7 @@
     "google-auth-library": "^10.5.0",
     "hono": "^4.7.0",
     "pg": "^8.14.0",
+    "undici": "^6.29.1",
     "web-vitals": "^6.1.1",
     "zod": "^4.6.5"
   },