@juspay/neurolink 12.35.0 → 12.35.2

package/dist/server/routes/claudeProxyRoutes.js

@@ -13,7 +13,6 @@ import { claudeOutputLogFields, observeClaudeJsonOutput, observeClaudeStreamOutp
 import { access, readFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { join } from "node:path";
-import { Agent } from "undici";
 import { buildStableClaudeCodeBillingHeader, CLAUDE_CLI_USER_AGENT, CLAUDE_CODE_OAUTH_BETAS, getOrCreateClaudeCodeIdentity, parseClaudeCodeUserId, } from "../../auth/anthropicOAuth.js";
 import { clearAccountCooldown, loadAccountCooldowns, saveAccountCooldown, } from "../../proxy/accountCooldown.js";
 import { anthropicAccountKeysEqual, ENV_ANTHROPIC_ACCOUNT_KEY, isAccountAllowed, LEGACY_ANTHROPIC_ACCOUNT_KEY, normalizeAnthropicAccountKey, shouldLoadFallbackCredential, } from "../../proxy/accountSelection.js";
@@ -184,6 +183,50 @@ function prepareAnthropicWire(ctx, bodyStr) {
     };
 }
 let anthropicUpstreamDispatcher;
+let anthropicUpstreamDispatcherPromise;
+/**
+ * Lazily construct (once) and cache the upstream Agent, reused across every
+ * request rather than rebuilt per call.
+ *
+ * `undici` is imported dynamically here — rather than as a static top-level
+ * import — so that requiring this module (and transitively, the package
+ * entry that re-exports `createClaudeProxyRoutes`) does not force-load undici
+ * until an upstream Anthropic request actually dispatches. The construction
+ * itself is guarded by a cached promise, not a bare `??=` on the Agent, so
+ * concurrent first callers await the same in-flight construction instead of
+ * each racing past the `undefined` check and building a duplicate Agent. A
+ * rejected construction (a bad undici install, an Agent constructor throwing)
+ * clears the cached promise rather than leaving it permanently rejected, so
+ * the next request gets a fresh attempt instead of every later request
+ * failing forever on a cached failure. See
+ * test/continuous-test-suite-import-cost.ts.
+ */
+async function getAnthropicUpstreamDispatcher() {
+    if (anthropicUpstreamDispatcher) {
+        return anthropicUpstreamDispatcher;
+    }
+    anthropicUpstreamDispatcherPromise ??= (async () => {
+        try {
+            const { Agent: UndiciAgent } = await import("undici");
+            // Node's global fetch applies Undici's 300s default headers timeout
+            // before the route's 15-minute abort signal. Keep both transport
+            // deadlines aligned with the proxy contract.
+            const agent = new UndiciAgent({
+                headersTimeout: UPSTREAM_FETCH_TIMEOUT_MS,
+                bodyTimeout: UPSTREAM_FETCH_TIMEOUT_MS,
+            });
+            anthropicUpstreamDispatcher = agent;
+            return agent;
+        }
+        catch (error) {
+            // Let a later request try again instead of every subsequent request
+            // failing forever against a cached rejection.
+            anthropicUpstreamDispatcherPromise = undefined;
+            throw error;
+        }
+    })();
+    return anthropicUpstreamDispatcherPromise;
+}
 async function fetchAnthropicUpstream(url, init, ctx, accountKey, dispatch) {
     clearClaudeFallbackTerminalEvidence(ctx);
     const prepared = dispatch.preparedContext;
@@ -203,15 +246,8 @@ async function fetchAnthropicUpstream(url, init, ctx, accountKey, dispatch) {
         ctx.metadata.tokenBudget = lease.snapshot;
         throw init.signal?.reason ?? ctx.abortSignal?.reason;
     }
-    // Node's global fetch applies Undici's 300s default headers timeout before
-    // the route's 15-minute abort signal. Keep both transport deadlines aligned
-    // with the proxy contract and instantiate lazily so importing routes has no
-    // open transport handles.
-    anthropicUpstreamDispatcher ??= new Agent({
-        headersTimeout: UPSTREAM_FETCH_TIMEOUT_MS,
-        bodyTimeout: UPSTREAM_FETCH_TIMEOUT_MS,
-    });
     try {
+        const upstreamDispatcher = await getAnthropicUpstreamDispatcher();
         const dispatchedBody = String(init.body);
         recordAttempt(dispatch.accountLabel, dispatch.accountType);
         dispatch.tracer?.logUpstreamRequestHeaders(init.headers);
@@ -230,7 +266,7 @@ async function fetchAnthropicUpstream(url, init, ctx, accountKey, dispatch) {
         const response = await fetch(url, {
             ...init,
             body: dispatchedBody,
-            dispatcher: anthropicUpstreamDispatcher,
+            dispatcher: upstreamDispatcher,
         });
         return observeAnthropicBudgetResponse(response, lease, () => {
             ctx.metadata.tokenBudget = lease.snapshot;

package/dist/telemetry/telemetryService.d.ts

@@ -20,6 +20,14 @@ export declare class TelemetryService {
     private requestCount;
     private totalResponseTime;
     private responseTimeCount;
+    private static readonly MAX_PENDING_CALLS;
+    private pendingCalls;
+    private isReady;
+    private droppedPendingCallWarned;
+    /** The in-flight (or already-settled) async init. Never rejects — see
+     * initializeTelemetry()'s catch block, which always resolves normally.
+     * `initialize()`/`shutdown()` await it so they don't race construction. */
+    private readyPromise?;
     private constructor();
     static getInstance(): TelemetryService;
     private isTelemetryEnabled;
@@ -27,6 +35,11 @@ export declare class TelemetryService {
     private adoptExternalTracerProvider;
     private initializeTelemetry;
     private initializeMetrics;
+    private bufferPendingCall;
+    /** Instruments now exist — drain anything buffered while we waited, in
+     * order, then flip fully sync for every call after this one. */
+    private markReady;
+    private discardPendingCalls;
     initialize(): Promise<void>;
     /**
      * @deprecated Vercel AI SDK's experimental_telemetry creates ai.generateText/ai.streamText
@@ -36,13 +49,21 @@ export declare class TelemetryService {
      */
     traceAIRequest<T>(provider: string, operation: () => Promise<T>, operationType?: string): Promise<T>;
     recordAIRequest(provider: string, model: string, tokens: number, duration: number, cost?: number): void;
+    private emitAIRequest;
     recordAIError(provider: string, error: Error): void;
+    private emitAIError;
     recordMCPToolCall(toolName: string, duration: number, success: boolean): void;
+    private emitMCPToolCall;
     recordConnection(type: "websocket" | "sse" | "http"): void;
+    private emitConnection;
     recordConnectionClosed(type: "websocket" | "sse" | "http"): void;
+    private emitConnectionClosed;
     recordResponseTime(endpoint: string, method: string, duration: number): void;
+    private emitResponseTime;
     recordCustomMetric(name: string, value: number, labels?: Record<string, string>): void;
+    private emitCustomMetric;
     recordCustomHistogram(name: string, value: number, labels?: Record<string, string>): void;
+    private emitCustomHistogram;
     getHealthMetrics(): Promise<HealthMetrics>;
     isEnabled(): boolean;
     getStatus(): {

package/dist/telemetry/telemetryService.js

@@ -1,8 +1,4 @@
 import { context, metrics, trace, } from "@opentelemetry/api";
-import { BasicTracerProvider, BatchSpanProcessor, } from "@opentelemetry/sdk-trace-base";
-import { OTLPTraceExporter } from "@opentelemetry/exporter-trace-otlp-http";
-import { resourceFromAttributes } from "@opentelemetry/resources";
-import { ATTR_SERVICE_NAME, ATTR_SERVICE_VERSION, } from "@opentelemetry/semantic-conventions";
 import { logger } from "../utils/logger.js";
 export class TelemetryService {
     static instance;
@@ -27,17 +23,52 @@ export class TelemetryService {
     requestCount = 0;
     totalResponseTime = 0;
     responseTimeCount = 0;
+    // Async-init readiness + buffering. Instruments above are constructed by
+    // an async initializeTelemetry() that the constructor fires but does not
+    // await (see getInstance()'s comment). A recording call can therefore
+    // legitimately arrive while telemetry is enabled but the instruments
+    // don't exist yet — that is NOT the same as telemetry being disabled, so
+    // it must not be dropped silently. `pendingCalls` buffers the OTEL side
+    // effect of such a call (never the whole method — see each recordX
+    // method's emitX split) until `markReady()` drains it. The cap and
+    // rate-limited warning below exist only for a pathological case (init
+    // that never resolves); the common case drains within milliseconds.
+    static MAX_PENDING_CALLS = 200;
+    pendingCalls = [];
+    isReady = false;
+    droppedPendingCallWarned = false;
+    /** The in-flight (or already-settled) async init. Never rejects — see
+     * initializeTelemetry()'s catch block, which always resolves normally.
+     * `initialize()`/`shutdown()` await it so they don't race construction. */
+    readyPromise;
     constructor() {
         // Check if telemetry is enabled
         this.enabled = this.isTelemetryEnabled();
         if (this.enabled) {
-            this.initializeTelemetry();
+            // initializeTelemetry() is async — it dynamically imports the OTel
+            // SDK packages and constructs the tracer/meter/instruments — but it
+            // is fired here WITHOUT an await. The constructor itself must stay
+            // fully synchronous and non-yielding, because getInstance() below is
+            // a plain, synchronous check-then-assign with no await in between.
+            // That is only race-free as long as nothing here yields control back
+            // to the event loop before `TelemetryService.instance` is assigned.
+            // Awaiting anything in the constructor (or making getInstance()
+            // async) would let two concurrent getInstance() callers both observe
+            // "not yet assigned" and each construct their own instance — the
+            // exact double-construction race that
+            // observability/instrumentation.ts's initializeOpenTelemetry() already
+            // hit and had to fix with a shared in-flight promise (see the
+            // "Initialize OpenTelemetry once and let concurrent callers share the
+            // work" comment there). Do not reintroduce it here.
+            this.readyPromise = this.initializeTelemetry();
         }
         else {
             logger.debug("[Telemetry] Disabled - set NEUROLINK_TELEMETRY_ENABLED=true or configure OTEL_EXPORTER_OTLP_ENDPOINT to enable");
         }
     }
     static getInstance() {
+        // Synchronous check-then-assign — see the constructor's comment above
+        // for why this must never gain an await before the assignment.
         if (!TelemetryService.instance) {
             TelemetryService.instance = new TelemetryService();
         }
@@ -84,12 +115,19 @@ export class TelemetryService {
             endpoint: process.env.OTEL_EXPORTER_OTLP_ENDPOINT,
         });
     }
-    initializeTelemetry() {
+    async initializeTelemetry() {
         try {
             if (this.hasExternalTracerProvider()) {
                 this.adoptExternalTracerProvider("global tracer provider already registered");
+                this.markReady();
                 return;
             }
+            const [{ BasicTracerProvider, BatchSpanProcessor }, { OTLPTraceExporter }, { resourceFromAttributes }, { ATTR_SERVICE_NAME, ATTR_SERVICE_VERSION },] = await Promise.all([
+                import("@opentelemetry/sdk-trace-base"),
+                import("@opentelemetry/exporter-trace-otlp-http"),
+                import("@opentelemetry/resources"),
+                import("@opentelemetry/semantic-conventions"),
+            ]);
             const resource = resourceFromAttributes({
                 [ATTR_SERVICE_NAME]: process.env.OTEL_SERVICE_NAME || "neurolink-ai",
                 [ATTR_SERVICE_VERSION]: process.env.OTEL_SERVICE_VERSION || "3.0.1",
@@ -106,6 +144,7 @@ export class TelemetryService {
             this.meter = metrics.getMeter("neurolink-ai");
             this.tracer = this.tracerProvider.getTracer("neurolink-ai");
             this.initializeMetrics();
+            this.markReady();
             logger.debug("[Telemetry] Initialized local telemetry exporter", {
                 endpoint: process.env.OTEL_EXPORTER_OTLP_ENDPOINT,
                 globalTracerProviderOwnedBy: "observability/instrumentation",
@@ -118,10 +157,16 @@ export class TelemetryService {
                 errorMessage.includes("already set");
             if (isDuplicateRegistration && this.hasExternalTracerProvider()) {
                 this.adoptExternalTracerProvider("duplicate global tracer registration detected");
+                this.markReady();
                 return;
             }
             logger.error("[Telemetry] Failed to initialize:", error);
             this.enabled = false;
+            // No instruments exist and none ever will for this instance — there
+            // is nothing left to drain a buffered call against, so the buffer is
+            // cleared rather than drained. Every recording method's `!this.enabled`
+            // guard now makes it a no-op anyway.
+            this.discardPendingCalls();
         }
     }
     initializeMetrics() {
@@ -153,10 +198,57 @@ export class TelemetryService {
             description: "Response time in milliseconds",
         });
     }
+    // ============================================================
+    // Pending-call buffer (see the field comment above pendingCalls)
+    // ============================================================
+    bufferPendingCall(call) {
+        if (this.pendingCalls.length >= TelemetryService.MAX_PENDING_CALLS) {
+            // Drop the oldest, not the newest — recent calls are more likely to
+            // still matter to whoever is about to read a dashboard.
+            this.pendingCalls.shift();
+            if (!this.droppedPendingCallWarned) {
+                this.droppedPendingCallWarned = true;
+                logger.warn(`[Telemetry] Pending metric buffer exceeded ${TelemetryService.MAX_PENDING_CALLS} entries — dropping the oldest buffered call(s). Logged once, not per drop: telemetry initialization may be unusually slow or stalled.`);
+            }
+        }
+        this.pendingCalls.push(call);
+    }
+    /** Instruments now exist — drain anything buffered while we waited, in
+     * order, then flip fully sync for every call after this one. */
+    markReady() {
+        this.isReady = true;
+        if (this.pendingCalls.length === 0) {
+            return;
+        }
+        const buffered = this.pendingCalls;
+        this.pendingCalls = [];
+        for (const call of buffered) {
+            try {
+                call();
+            }
+            catch (error) {
+                logger.warn("[Telemetry] A buffered metric call failed during drain:", error);
+            }
+        }
+    }
+    discardPendingCalls() {
+        this.pendingCalls = [];
+    }
     async initialize() {
         if (!this.enabled) {
             return;
         }
+        // The tracer/meter/instruments are constructed asynchronously (see the
+        // constructor's comment). Wait for that to settle before inspecting
+        // usingExternalTracerProvider/tracerProvider below, so this method's
+        // behavior doesn't depend on how many event-loop ticks have passed
+        // since getInstance() was called — without this, a caller invoking
+        // initialize() right after getInstance() would almost always observe
+        // `!this.tracerProvider` and return early, silently skipping the
+        // AsyncLocalStorageContextManager registration below.
+        if (this.readyPromise) {
+            await this.readyPromise;
+        }
         if (this.usingExternalTracerProvider) {
             this.initialized = true;
             logger.debug("[Telemetry] External TracerProvider already initialized by host");
@@ -227,7 +319,21 @@ export class TelemetryService {
         this.requestCount++;
         this.totalResponseTime += duration;
         this.responseTimeCount++;
-        if (!this.enabled || !this.aiRequestCounter) {
+        if (!this.enabled) {
+            return;
+        }
+        if (!this.isReady) {
+            // Instruments aren't constructed yet — buffer the OTEL side effect
+            // only (emitAIRequest), never this whole method: the runtime
+            // counters above must fire exactly once per call, not again when the
+            // buffer drains.
+            this.bufferPendingCall(() => this.emitAIRequest(provider, model, tokens, duration, cost));
+            return;
+        }
+        this.emitAIRequest(provider, model, tokens, duration, cost);
+    }
+    emitAIRequest(provider, model, tokens, duration, cost) {
+        if (!this.aiRequestCounter) {
             return;
         }
         const labels = { provider, model };
@@ -241,7 +347,17 @@ export class TelemetryService {
     recordAIError(provider, error) {
         // Track runtime metrics
         this.errorCount++;
-        if (!this.enabled || !this.aiProviderErrors) {
+        if (!this.enabled) {
+            return;
+        }
+        if (!this.isReady) {
+            this.bufferPendingCall(() => this.emitAIError(provider, error));
+            return;
+        }
+        this.emitAIError(provider, error);
+    }
+    emitAIError(provider, error) {
+        if (!this.aiProviderErrors) {
             return;
         }
         this.aiProviderErrors.add(1, {
@@ -251,7 +367,17 @@ export class TelemetryService {
         });
     }
     recordMCPToolCall(toolName, duration, success) {
-        if (!this.enabled || !this.mcpToolCalls) {
+        if (!this.enabled) {
+            return;
+        }
+        if (!this.isReady) {
+            this.bufferPendingCall(() => this.emitMCPToolCall(toolName, duration, success));
+            return;
+        }
+        this.emitMCPToolCall(toolName, duration, success);
+    }
+    emitMCPToolCall(toolName, duration, success) {
+        if (!this.mcpToolCalls) {
             return;
         }
         this.mcpToolCalls.add(1, {
@@ -263,7 +389,17 @@ export class TelemetryService {
     recordConnection(type) {
         // Track runtime metrics
         this.activeConnectionCount++;
-        if (!this.enabled || !this.connectionCounter) {
+        if (!this.enabled) {
+            return;
+        }
+        if (!this.isReady) {
+            this.bufferPendingCall(() => this.emitConnection(type));
+            return;
+        }
+        this.emitConnection(type);
+    }
+    emitConnection(type) {
+        if (!this.connectionCounter) {
             return;
         }
         this.connectionCounter.add(1, { connection_type: type });
@@ -271,7 +407,17 @@ export class TelemetryService {
     recordConnectionClosed(type) {
         // Track runtime metrics
         this.activeConnectionCount = Math.max(0, this.activeConnectionCount - 1);
-        if (!this.enabled || !this.connectionCounter) {
+        if (!this.enabled) {
+            return;
+        }
+        if (!this.isReady) {
+            this.bufferPendingCall(() => this.emitConnectionClosed(type));
+            return;
+        }
+        this.emitConnectionClosed(type);
+    }
+    emitConnectionClosed(type) {
+        if (!this.connectionCounter) {
             return;
         }
         // Optionally record disconnection metrics if needed
@@ -284,7 +430,17 @@ export class TelemetryService {
         // Track runtime metrics
         this.totalResponseTime += duration;
         this.responseTimeCount++;
-        if (!this.enabled || !this.responseTimeHistogram) {
+        if (!this.enabled) {
+            return;
+        }
+        if (!this.isReady) {
+            this.bufferPendingCall(() => this.emitResponseTime(endpoint, method, duration));
+            return;
+        }
+        this.emitResponseTime(endpoint, method, duration);
+    }
+    emitResponseTime(endpoint, method, duration) {
+        if (!this.responseTimeHistogram) {
             return;
         }
         this.responseTimeHistogram.record(duration, {
@@ -295,7 +451,17 @@ export class TelemetryService {
     }
     // Custom Metrics
     recordCustomMetric(name, value, labels) {
-        if (!this.enabled || !this.meter) {
+        if (!this.enabled) {
+            return;
+        }
+        if (!this.isReady) {
+            this.bufferPendingCall(() => this.emitCustomMetric(name, value, labels));
+            return;
+        }
+        this.emitCustomMetric(name, value, labels);
+    }
+    emitCustomMetric(name, value, labels) {
+        if (!this.meter) {
             return;
         }
         const counter = this.meter.createCounter(`custom_${name}`, {
@@ -304,7 +470,17 @@ export class TelemetryService {
         counter.add(value, labels || {});
     }
     recordCustomHistogram(name, value, labels) {
-        if (!this.enabled || !this.meter) {
+        if (!this.enabled) {
+            return;
+        }
+        if (!this.isReady) {
+            this.bufferPendingCall(() => this.emitCustomHistogram(name, value, labels));
+            return;
+        }
+        this.emitCustomHistogram(name, value, labels);
+    }
+    emitCustomHistogram(name, value, labels) {
+        if (!this.meter) {
             return;
         }
         const histogram = this.meter.createHistogram(`custom_${name}_histogram`, {
@@ -370,6 +546,16 @@ export class TelemetryService {
     }
     // Cleanup
     async shutdown() {
+        // See initialize()'s comment: wait for the async instrument
+        // construction to settle before deciding whether there is a
+        // tracerProvider to shut down. Without this, a shutdown() called
+        // immediately after getInstance() would see no tracerProvider yet and
+        // no-op, while construction — which is already in flight — finishes
+        // moments later and leaves a live exporter (with its background flush
+        // timers) behind with nothing left to ever shut it down.
+        if (this.readyPromise) {
+            await this.readyPromise;
+        }
         if (this.enabled &&
             this.tracerProvider &&
             !this.usingExternalTracerProvider) {

package/dist/utils/fileDetector.js

@@ -6,7 +6,6 @@
 import { open, readFile, realpath } from "fs/promises";
 import { STATUS_CODES } from "node:http";
 import { basename, isAbsolute as isAbsolutePath, relative as relativePath, resolve as resolvePath, sep, } from "path";
-import { request } from "undici";
 import { redirectFollowingDispatcher } from "./redirectDispatcher.js";
 // Lazy-loaded processor singletons — avoids loading heavy media deps
 // (mediabunny, fluent-ffmpeg, music-metadata, adm-zip) on every generate() call.
@@ -1609,8 +1608,13 @@ export class FileDetector {
         const timeout = options?.timeout || FileDetector.DEFAULT_NETWORK_TIMEOUT;
         return withRetry(async () => {
             try {
+                // Dynamic import keeps undici off the package's static import
+                // graph — it is only needed once a URL-referenced attachment
+                // actually has to be fetched. See
+                // test/continuous-test-suite-import-cost.ts.
+                const { request } = await import("undici");
                 const response = await request(url, {
-                    dispatcher: redirectFollowingDispatcher(5),
+                    dispatcher: await redirectFollowingDispatcher(5),
                     method: "GET",
                     headersTimeout: timeout,
                     bodyTimeout: timeout,
@@ -2375,8 +2379,13 @@ class MimeTypeStrategy {
                 // Wrap the whole HEAD (request + body drain) in withTimeout so a stalled
                 // dump() can't hang detection, per the project's async-timeout guideline.
                 contentType = await withTimeout((async () => {
+                    // Dynamic import keeps undici off the package's static import
+                    // graph — it is only needed once a URL-referenced attachment
+                    // actually has to be fetched. See
+                    // test/continuous-test-suite-import-cost.ts.
+                    const { request } = await import("undici");
                     const response = await request(input, {
-                        dispatcher: redirectFollowingDispatcher(5),
+                        dispatcher: await redirectFollowingDispatcher(5),
                         method: "HEAD",
                         headersTimeout: FileDetector.DEFAULT_HEAD_TIMEOUT,
                         bodyTimeout: FileDetector.DEFAULT_HEAD_TIMEOUT,

package/dist/utils/messageBuilder.js

@@ -1,7 +1,6 @@
 import { existsSync, readFileSync, statSync } from "fs";
 import { open as openAsync, readFile as readFileAsync, stat as statAsync, } from "fs/promises";
 import pLimit from "p-limit";
-import { request } from "undici";
 import { redirectFollowingDispatcher } from "./redirectDispatcher.js";
 import { MultimodalLogger, ProviderImageAdapter, } from "../adapters/providerImageAdapter.js";
 import { CONVERSATION_INSTRUCTIONS, STRUCTURED_OUTPUT_INSTRUCTIONS, } from "../config/conversationMemory.js";
@@ -1780,8 +1779,12 @@ async function downloadImageFromUrl(url) {
     // Apply rate limiting only if cache missed
     await urlDownloadRateLimiter.acquire();
     try {
+        // Dynamic import keeps undici off the package's static import graph —
+        // it is only needed once a URL-referenced image actually has to be
+        // fetched. See test/continuous-test-suite-import-cost.ts.
+        const { request } = await import("undici");
         const response = await request(url, {
-            dispatcher: redirectFollowingDispatcher(5),
+            dispatcher: await redirectFollowingDispatcher(5),
             method: "GET",
             headersTimeout: 10000, // 10 second timeout for headers
             bodyTimeout: 30000, // 30 second timeout for body,

package/dist/utils/redirectDispatcher.d.ts

@@ -34,6 +34,11 @@ import type { Dispatcher } from "undici";
  * requests. Losing a proxy on one Node version is recoverable; silently failing
  * every redirecting download is not.
  *
+ * `undici` itself is imported dynamically here (rather than at module scope)
+ * so that requiring this module — and transitively, messageBuilder.ts /
+ * fileDetector.ts — does not force-load undici until a URL attachment is
+ * actually fetched. See test/continuous-test-suite-import-cost.ts.
+ *
  * @param maxRedirections How many redirects to follow before giving up.
  */
-export declare function redirectFollowingDispatcher(maxRedirections: number): Dispatcher;
+export declare function redirectFollowingDispatcher(maxRedirections: number): Promise<Dispatcher>;

package/dist/utils/redirectDispatcher.js

@@ -1,4 +1,3 @@
-import { Agent, getGlobalDispatcher, interceptors } from "undici";
 /**
  * The major of the `undici` this package depends on.
  *
@@ -42,9 +41,15 @@ const NPM_UNDICI_MAJOR = 7;
  * requests. Losing a proxy on one Node version is recoverable; silently failing
  * every redirecting download is not.
  *
+ * `undici` itself is imported dynamically here (rather than at module scope)
+ * so that requiring this module — and transitively, messageBuilder.ts /
+ * fileDetector.ts — does not force-load undici until a URL attachment is
+ * actually fetched. See test/continuous-test-suite-import-cost.ts.
+ *
  * @param maxRedirections How many redirects to follow before giving up.
  */
-export function redirectFollowingDispatcher(maxRedirections) {
+export async function redirectFollowingDispatcher(maxRedirections) {
+    const { Agent, getGlobalDispatcher, interceptors } = await import("undici");
     const builtinMajor = Number.parseInt(process.versions.undici?.split(".")[0] ?? "", 10);
     const base = Number.isFinite(builtinMajor) && builtinMajor === NPM_UNDICI_MAJOR
         ? getGlobalDispatcher()

package/dist/utils/safeFetch.js

@@ -16,7 +16,6 @@
  *
  * @module utils/safeFetch
  */
-import { Agent, fetch as undiciFetch } from "undici";
 import { readBoundedBuffer } from "./sizeGuard.js";
 import { validateAndResolveUrl } from "./ssrfGuard.js";
 const DEFAULT_TIMEOUT_MS = 60_000;
@@ -30,8 +29,14 @@ const DEFAULT_TIMEOUT_MS = 60_000;
  * the OS resolver prefers AAAA, that broke every safeDownload (Replicate /
  * Runway / Kling asset fetches) while plain curl of the same URL succeeded —
  * curl races both families (Happy Eyeballs); a one-address pin cannot.
+ *
+ * `undici` is imported dynamically (this function is only ever called from
+ * the already-async `safeDownload`) so that requiring this module does not
+ * force-load undici until a download actually happens. See
+ * test/continuous-test-suite-import-cost.ts.
  */
-function buildPinnedAgent(hostname, addresses) {
+async function buildPinnedAgent(hostname, addresses) {
+    const { Agent } = await import("undici");
     const primary = addresses[0];
     if (!primary) {
         throw new Error(`safeFetch: no validated addresses to pin for "${hostname}"`);
@@ -85,7 +90,11 @@ export async function safeDownload(url, options) {
     const { url: validatedUrl, addresses } = await validateAndResolveUrl(url);
     const parsed = new URL(validatedUrl);
     const hostname = parsed.hostname.replace(/^\[|\]$/g, "");
-    const agent = buildPinnedAgent(hostname, addresses);
+    // Dynamic import keeps undici off the package's static import graph — it
+    // is only needed once a download actually happens. See
+    // test/continuous-test-suite-import-cost.ts.
+    const { fetch: undiciFetch } = await import("undici");
+    const agent = await buildPinnedAgent(hostname, addresses);
     const timeoutCtrl = new AbortController();
     const timeoutId = setTimeout(() => timeoutCtrl.abort(), options.timeoutMs ?? DEFAULT_TIMEOUT_MS);
     const composedSignal = options.signal

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@juspay/neurolink",
-  "version": "12.35.0",
+  "version": "12.35.2",
   "packageManager": "pnpm@10.15.1",
   "description": "The pipe layer of an AI nervous system: one interface connecting provider neurons to your application, across three inference types — generate, stream and decide. `decide` returns typed, calibrated judgements from a non-generative model (~400ms, ~$0.00002/call) for routing, tool selection and context budgeting. MCP-native (4 transports), voice TTS/STT/realtime, RAG, agents, memory, compaction, 9 observability exporters. OpenAI · Anthropic · Gemini · Bedrock · Azure · Ollama · TypeSafe Jev and more.",
   "author": {