[sphilipse]

Summary

Several large libraries are loaded into server memory at plugin setup even though they are only needed when a specific feature is exercised. An idle-heap inventory (heap snapshot + full multi-parent require.cache graph) showed each of these has a single — or very few — eager import roots, so they can be deferred with contained changes:

Library	Modules	Eager root	Now loaded when
apache-arrow	146	alerting_v2 arrow response format	an arrow-format ES|QL query runs
@elastic/request-crypto + node-jose + node-forge	134	telemetry_collection_manager encryption	telemetry is sent
openpgp	25	fleet package signature verification	a key is read / signature verified
pdfmake + fontkit + brotli	~60	screenshotting main thread (bundle-inclusion import)	only in the PDF worker thread
@kbn/inference-langchain	(langchain tree)	inference chat-model factory	a chat model is requested
@kbn/agent-builder-genai-utils	(langchain tree)	esql NL-to-ES|QL + suggest-fix routes	those routes are called

Notes:

• All conversions sit inside already-async functions. The only signature change is decodeArrowBatch (internal to alerting_v2) receiving the arrow Type.Timestamp id instead of importing the enum at module scope.
• screenshotting previously executed import './worker_dependencies' on the main thread purely to keep pdfmake in the release bundle; this is now a never-invoked dynamic-import reference, so only the worker thread pays for it. Flagging for the owning team: please confirm the release-bundle scanner picks up dynamic import specifiers (pdfmake is also a root package.json dependency).
• The two langchain entry points only fully unload the langchain tree once the remaining eager roots (security_solution SIEM migrations, automatic_import, elastic_assistant, agent_builder — 114 importing files in security_solution alone) are also lazy or disabled. They are still worth fixing now so reduced configurations benefit immediately.

Testing

• node scripts/jest for all touched areas: alerting_v2 formats (22), esql routes (48), telemetry encryption (7), fleet package verification (3), screenshotting pdf (2), inference client (7) — all pass
• node scripts/type_check --project … for all six touched plugins — pass

🤖 Generated with Claude Code

Production measurements (cumulative)

Idle production source builds (node scripts/build, bin/kibana against a local ES, allocation-tracking preload, 2 min idle, GC-forced heap snapshot + full require graph; same machine and protocol for every row):

Build	Modules in require.cache	Heap snapshot self size	Idle heap_used	Δ self size
main (63948de)	31,175	698.4 MB	~629 MB	—
+ #300785 (swc fs-cache)	no production effect — dev-only tooling	698.4 MB	—	0
+ #300786 (lazy heavy deps)	30,885	697.4 MB	~632 MB	−1.0 MB
+ #300920 (EUI off the server)	28,932	614.7 MB	~580 MB	−82.7 MB
+ #300921 (GenAI stack lazy)	26,992	577.4 MB	~545 MB	−37.3 MB
total	−4,183	−121.0 MB	≈ −84 MB

Single-run samples; heap_used has ±10 MB run noise, snapshot self size is GC-forced and stabler.