@juspay/neurolink 12.35.1 → 12.35.3

package/dist/server/abstract/baseServerAdapter.d.ts

@@ -28,8 +28,12 @@ export declare abstract class BaseServerAdapter extends EventEmitter {
     constructor(neurolink: NeuroLink, config?: ServerAdapterConfig);
     /**
      * Initialize the underlying server framework
+     * May be async: adapters that dynamically import their framework package
+     * (e.g. Hono) return a Promise; adapters with a synchronous no-op stub that
+     * defer real setup to their own overridden `initialize()` (Express/Fastify/
+     * Koa) still return void.
      */
-    protected abstract initializeFramework(): void;
+    protected abstract initializeFramework(): void | Promise<void>;
     /**
      * Register a route with the framework
      */

package/dist/server/abstract/baseServerAdapter.js

@@ -145,7 +145,7 @@ export class BaseServerAdapter extends EventEmitter {
         const startTime = Date.now();
         try {
             // Initialize framework-specific setup
-            this.initializeFramework();
+            await this.initializeFramework();
             // Register built-in middleware
             this.registerBuiltInMiddleware();
             // Register built-in routes

package/dist/server/adapters/honoAdapter.d.ts

@@ -16,6 +16,8 @@ export declare class HonoServerAdapter extends BaseServerAdapter {
     private rateLimitStore;
     private rateLimitCleanupInterval?;
     private requestContextStore;
+    private HTTPExceptionCtor;
+    private streamSSEFn;
     constructor(neurolink: NeuroLink, config?: ServerAdapterConfig);
     /**
      * Create rate limiter middleware for Hono
@@ -27,8 +29,10 @@ export declare class HonoServerAdapter extends BaseServerAdapter {
     private cleanupRateLimitStore;
     /**
      * Initialize Hono framework
+     * Dynamically imports Hono and its middleware so requiring only another
+     * adapter (Express/Fastify/Koa) never pulls Hono's import graph in.
      */
-    protected initializeFramework(): void;
+    protected initializeFramework(): Promise<void>;
     /**
      * Register route with Hono
      */

package/dist/server/adapters/honoAdapter.js

@@ -3,13 +3,6 @@
  * Primary server adapter implementation using Hono framework
  * Hono is chosen for its performance, TypeScript-first design, and edge compatibility
  */
-import { Hono } from "hono";
-import { cors } from "hono/cors";
-import { HTTPException } from "hono/http-exception";
-import { logger as honoLogger } from "hono/logger";
-import { secureHeaders } from "hono/secure-headers";
-import { streamSSE } from "hono/streaming";
-import { timeout } from "hono/timeout";
 import { logger } from "../../utils/logger.js";
 import { AlreadyRunningError, ServerStopError, wrapError } from "../errors.js";
 import { BaseServerAdapter } from "../abstract/baseServerAdapter.js";
@@ -25,6 +18,11 @@ export class HonoServerAdapter extends BaseServerAdapter {
     rateLimitCleanupInterval;
     // Store context by request ID for sharing between middleware and route handlers
     requestContextStore = new Map();
+    // Populated by initializeFramework's dynamic imports; used by methods that
+    // run after initialization (route registration, streaming) and so cannot
+    // rely on initializeFramework's own local closure variables.
+    HTTPExceptionCtor;
+    streamSSEFn;
     constructor(neurolink, config = {}) {
         super(neurolink, config);
     }
@@ -113,8 +111,21 @@ export class HonoServerAdapter extends BaseServerAdapter {
     }
     /**
      * Initialize Hono framework
+     * Dynamically imports Hono and its middleware so requiring only another
+     * adapter (Express/Fastify/Koa) never pulls Hono's import graph in.
      */
-    initializeFramework() {
+    async initializeFramework() {
+        const [{ Hono }, { cors }, { HTTPException }, { logger: honoLogger }, { secureHeaders }, { streamSSE }, { timeout },] = await Promise.all([
+            this.importFrameworkDependency("hono", "hono"),
+            this.importFrameworkDependency("hono/cors", "hono"),
+            this.importFrameworkDependency("hono/http-exception", "hono"),
+            this.importFrameworkDependency("hono/logger", "hono"),
+            this.importFrameworkDependency("hono/secure-headers", "hono"),
+            this.importFrameworkDependency("hono/streaming", "hono"),
+            this.importFrameworkDependency("hono/timeout", "hono"),
+        ]);
+        this.HTTPExceptionCtor = HTTPException;
+        this.streamSSEFn = streamSSE;
         this.app = new Hono();
         // Add secure headers
         this.app.use("*", secureHeaders());
@@ -284,7 +295,7 @@ export class HonoServerAdapter extends BaseServerAdapter {
                     route: route.path,
                     error: errorMessage,
                 });
-                throw new HTTPException(500, { message: errorMessage });
+                throw new this.HTTPExceptionCtor(500, { message: errorMessage });
             }
             finally {
                 // Untrack connection when request completes
@@ -304,7 +315,7 @@ export class HonoServerAdapter extends BaseServerAdapter {
                 c.header(key, value);
             }
         }
-        return streamSSE(c, async (stream) => {
+        return this.streamSSEFn(c, async (stream) => {
             try {
                 // Get streaming result from handler
                 const result = await route.handler(ctx);

package/dist/server/routes/claudeProxyRoutes.js

@@ -13,7 +13,6 @@ import { claudeOutputLogFields, observeClaudeJsonOutput, observeClaudeStreamOutp
 import { access, readFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { join } from "node:path";
-import { Agent } from "undici";
 import { buildStableClaudeCodeBillingHeader, CLAUDE_CLI_USER_AGENT, CLAUDE_CODE_OAUTH_BETAS, getOrCreateClaudeCodeIdentity, parseClaudeCodeUserId, } from "../../auth/anthropicOAuth.js";
 import { clearAccountCooldown, loadAccountCooldowns, saveAccountCooldown, } from "../../proxy/accountCooldown.js";
 import { anthropicAccountKeysEqual, ENV_ANTHROPIC_ACCOUNT_KEY, isAccountAllowed, LEGACY_ANTHROPIC_ACCOUNT_KEY, normalizeAnthropicAccountKey, shouldLoadFallbackCredential, } from "../../proxy/accountSelection.js";
@@ -184,6 +183,50 @@ function prepareAnthropicWire(ctx, bodyStr) {
     };
 }
 let anthropicUpstreamDispatcher;
+let anthropicUpstreamDispatcherPromise;
+/**
+ * Lazily construct (once) and cache the upstream Agent, reused across every
+ * request rather than rebuilt per call.
+ *
+ * `undici` is imported dynamically here — rather than as a static top-level
+ * import — so that requiring this module (and transitively, the package
+ * entry that re-exports `createClaudeProxyRoutes`) does not force-load undici
+ * until an upstream Anthropic request actually dispatches. The construction
+ * itself is guarded by a cached promise, not a bare `??=` on the Agent, so
+ * concurrent first callers await the same in-flight construction instead of
+ * each racing past the `undefined` check and building a duplicate Agent. A
+ * rejected construction (a bad undici install, an Agent constructor throwing)
+ * clears the cached promise rather than leaving it permanently rejected, so
+ * the next request gets a fresh attempt instead of every later request
+ * failing forever on a cached failure. See
+ * test/continuous-test-suite-import-cost.ts.
+ */
+async function getAnthropicUpstreamDispatcher() {
+    if (anthropicUpstreamDispatcher) {
+        return anthropicUpstreamDispatcher;
+    }
+    anthropicUpstreamDispatcherPromise ??= (async () => {
+        try {
+            const { Agent: UndiciAgent } = await import("undici");
+            // Node's global fetch applies Undici's 300s default headers timeout
+            // before the route's 15-minute abort signal. Keep both transport
+            // deadlines aligned with the proxy contract.
+            const agent = new UndiciAgent({
+                headersTimeout: UPSTREAM_FETCH_TIMEOUT_MS,
+                bodyTimeout: UPSTREAM_FETCH_TIMEOUT_MS,
+            });
+            anthropicUpstreamDispatcher = agent;
+            return agent;
+        }
+        catch (error) {
+            // Let a later request try again instead of every subsequent request
+            // failing forever against a cached rejection.
+            anthropicUpstreamDispatcherPromise = undefined;
+            throw error;
+        }
+    })();
+    return anthropicUpstreamDispatcherPromise;
+}
 async function fetchAnthropicUpstream(url, init, ctx, accountKey, dispatch) {
     clearClaudeFallbackTerminalEvidence(ctx);
     const prepared = dispatch.preparedContext;
@@ -203,15 +246,8 @@ async function fetchAnthropicUpstream(url, init, ctx, accountKey, dispatch) {
         ctx.metadata.tokenBudget = lease.snapshot;
         throw init.signal?.reason ?? ctx.abortSignal?.reason;
     }
-    // Node's global fetch applies Undici's 300s default headers timeout before
-    // the route's 15-minute abort signal. Keep both transport deadlines aligned
-    // with the proxy contract and instantiate lazily so importing routes has no
-    // open transport handles.
-    anthropicUpstreamDispatcher ??= new Agent({
-        headersTimeout: UPSTREAM_FETCH_TIMEOUT_MS,
-        bodyTimeout: UPSTREAM_FETCH_TIMEOUT_MS,
-    });
     try {
+        const upstreamDispatcher = await getAnthropicUpstreamDispatcher();
         const dispatchedBody = String(init.body);
         recordAttempt(dispatch.accountLabel, dispatch.accountType);
         dispatch.tracer?.logUpstreamRequestHeaders(init.headers);
@@ -230,7 +266,7 @@ async function fetchAnthropicUpstream(url, init, ctx, accountKey, dispatch) {
         const response = await fetch(url, {
             ...init,
             body: dispatchedBody,
-            dispatcher: anthropicUpstreamDispatcher,
+            dispatcher: upstreamDispatcher,
         });
         return observeAnthropicBudgetResponse(response, lease, () => {
             ctx.metadata.tokenBudget = lease.snapshot;

package/dist/utils/fileDetector.js

@@ -6,7 +6,6 @@
 import { open, readFile, realpath } from "fs/promises";
 import { STATUS_CODES } from "node:http";
 import { basename, isAbsolute as isAbsolutePath, relative as relativePath, resolve as resolvePath, sep, } from "path";
-import { request } from "undici";
 import { redirectFollowingDispatcher } from "./redirectDispatcher.js";
 // Lazy-loaded processor singletons — avoids loading heavy media deps
 // (mediabunny, fluent-ffmpeg, music-metadata, adm-zip) on every generate() call.
@@ -1609,8 +1608,13 @@ export class FileDetector {
         const timeout = options?.timeout || FileDetector.DEFAULT_NETWORK_TIMEOUT;
         return withRetry(async () => {
             try {
+                // Dynamic import keeps undici off the package's static import
+                // graph — it is only needed once a URL-referenced attachment
+                // actually has to be fetched. See
+                // test/continuous-test-suite-import-cost.ts.
+                const { request } = await import("undici");
                 const response = await request(url, {
-                    dispatcher: redirectFollowingDispatcher(5),
+                    dispatcher: await redirectFollowingDispatcher(5),
                     method: "GET",
                     headersTimeout: timeout,
                     bodyTimeout: timeout,
@@ -2375,8 +2379,13 @@ class MimeTypeStrategy {
                 // Wrap the whole HEAD (request + body drain) in withTimeout so a stalled
                 // dump() can't hang detection, per the project's async-timeout guideline.
                 contentType = await withTimeout((async () => {
+                    // Dynamic import keeps undici off the package's static import
+                    // graph — it is only needed once a URL-referenced attachment
+                    // actually has to be fetched. See
+                    // test/continuous-test-suite-import-cost.ts.
+                    const { request } = await import("undici");
                     const response = await request(input, {
-                        dispatcher: redirectFollowingDispatcher(5),
+                        dispatcher: await redirectFollowingDispatcher(5),
                         method: "HEAD",
                         headersTimeout: FileDetector.DEFAULT_HEAD_TIMEOUT,
                         bodyTimeout: FileDetector.DEFAULT_HEAD_TIMEOUT,

package/dist/utils/messageBuilder.js

@@ -1,7 +1,6 @@
 import { existsSync, readFileSync, statSync } from "fs";
 import { open as openAsync, readFile as readFileAsync, stat as statAsync, } from "fs/promises";
 import pLimit from "p-limit";
-import { request } from "undici";
 import { redirectFollowingDispatcher } from "./redirectDispatcher.js";
 import { MultimodalLogger, ProviderImageAdapter, } from "../adapters/providerImageAdapter.js";
 import { CONVERSATION_INSTRUCTIONS, STRUCTURED_OUTPUT_INSTRUCTIONS, } from "../config/conversationMemory.js";
@@ -1780,8 +1779,12 @@ async function downloadImageFromUrl(url) {
     // Apply rate limiting only if cache missed
     await urlDownloadRateLimiter.acquire();
     try {
+        // Dynamic import keeps undici off the package's static import graph —
+        // it is only needed once a URL-referenced image actually has to be
+        // fetched. See test/continuous-test-suite-import-cost.ts.
+        const { request } = await import("undici");
         const response = await request(url, {
-            dispatcher: redirectFollowingDispatcher(5),
+            dispatcher: await redirectFollowingDispatcher(5),
             method: "GET",
             headersTimeout: 10000, // 10 second timeout for headers
             bodyTimeout: 30000, // 30 second timeout for body,

package/dist/utils/redirectDispatcher.d.ts

@@ -34,6 +34,11 @@ import type { Dispatcher } from "undici";
  * requests. Losing a proxy on one Node version is recoverable; silently failing
  * every redirecting download is not.
  *
+ * `undici` itself is imported dynamically here (rather than at module scope)
+ * so that requiring this module — and transitively, messageBuilder.ts /
+ * fileDetector.ts — does not force-load undici until a URL attachment is
+ * actually fetched. See test/continuous-test-suite-import-cost.ts.
+ *
  * @param maxRedirections How many redirects to follow before giving up.
  */
-export declare function redirectFollowingDispatcher(maxRedirections: number): Dispatcher;
+export declare function redirectFollowingDispatcher(maxRedirections: number): Promise<Dispatcher>;

package/dist/utils/redirectDispatcher.js

@@ -1,4 +1,3 @@
-import { Agent, getGlobalDispatcher, interceptors } from "undici";
 /**
  * The major of the `undici` this package depends on.
  *
@@ -42,9 +41,15 @@ const NPM_UNDICI_MAJOR = 7;
  * requests. Losing a proxy on one Node version is recoverable; silently failing
  * every redirecting download is not.
  *
+ * `undici` itself is imported dynamically here (rather than at module scope)
+ * so that requiring this module — and transitively, messageBuilder.ts /
+ * fileDetector.ts — does not force-load undici until a URL attachment is
+ * actually fetched. See test/continuous-test-suite-import-cost.ts.
+ *
  * @param maxRedirections How many redirects to follow before giving up.
  */
-export function redirectFollowingDispatcher(maxRedirections) {
+export async function redirectFollowingDispatcher(maxRedirections) {
+    const { Agent, getGlobalDispatcher, interceptors } = await import("undici");
     const builtinMajor = Number.parseInt(process.versions.undici?.split(".")[0] ?? "", 10);
     const base = Number.isFinite(builtinMajor) && builtinMajor === NPM_UNDICI_MAJOR
         ? getGlobalDispatcher()

package/dist/utils/safeFetch.js

@@ -16,7 +16,6 @@
  *
  * @module utils/safeFetch
  */
-import { Agent, fetch as undiciFetch } from "undici";
 import { readBoundedBuffer } from "./sizeGuard.js";
 import { validateAndResolveUrl } from "./ssrfGuard.js";
 const DEFAULT_TIMEOUT_MS = 60_000;
@@ -30,8 +29,14 @@ const DEFAULT_TIMEOUT_MS = 60_000;
  * the OS resolver prefers AAAA, that broke every safeDownload (Replicate /
  * Runway / Kling asset fetches) while plain curl of the same URL succeeded —
  * curl races both families (Happy Eyeballs); a one-address pin cannot.
+ *
+ * `undici` is imported dynamically (this function is only ever called from
+ * the already-async `safeDownload`) so that requiring this module does not
+ * force-load undici until a download actually happens. See
+ * test/continuous-test-suite-import-cost.ts.
  */
-function buildPinnedAgent(hostname, addresses) {
+async function buildPinnedAgent(hostname, addresses) {
+    const { Agent } = await import("undici");
     const primary = addresses[0];
     if (!primary) {
         throw new Error(`safeFetch: no validated addresses to pin for "${hostname}"`);
@@ -85,7 +90,11 @@ export async function safeDownload(url, options) {
     const { url: validatedUrl, addresses } = await validateAndResolveUrl(url);
     const parsed = new URL(validatedUrl);
     const hostname = parsed.hostname.replace(/^\[|\]$/g, "");
-    const agent = buildPinnedAgent(hostname, addresses);
+    // Dynamic import keeps undici off the package's static import graph — it
+    // is only needed once a download actually happens. See
+    // test/continuous-test-suite-import-cost.ts.
+    const { fetch: undiciFetch } = await import("undici");
+    const agent = await buildPinnedAgent(hostname, addresses);
     const timeoutCtrl = new AbortController();
     const timeoutId = setTimeout(() => timeoutCtrl.abort(), options.timeoutMs ?? DEFAULT_TIMEOUT_MS);
     const composedSignal = options.signal

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@juspay/neurolink",
-  "version": "12.35.1",
+  "version": "12.35.3",
   "packageManager": "pnpm@10.15.1",
   "description": "The pipe layer of an AI nervous system: one interface connecting provider neurons to your application, across three inference types — generate, stream and decide. `decide` returns typed, calibrated judgements from a non-generative model (~400ms, ~$0.00002/call) for routing, tool selection and context budgeting. MCP-native (4 transports), voice TTS/STT/realtime, RAG, agents, memory, compaction, 9 observability exporters. OpenAI · Anthropic · Gemini · Bedrock · Azure · Ollama · TypeSafe Jev and more.",
   "author": {