SDK Size

[nkavian]

Context

• The jar dependency adds around 30MB to my final spring boot project, based on the main dependency and its child dependencies.
• The decompressed openai-java-core takes about 76MB.
• The ResponseStreamEvent.class is by itself 91KB. The contents of this file are more equivalent to a god function written in C than object oriented code written in Java. Maybe due to some sort of scripted code creation?

 62M	./com/openai/models
 10M	./com/openai/services

Concerns

• The first concern is the added size in terms of MB to the project size.
• The second concern is that when this code runs, it will instantiate larger than necessary objects that will consume more memory (compared to a better design).
  • For instance ResponseStreamEvent, it has: 51 member variables, leading to very large functions such as equals, hashcode, toString, and most other methods; across 2400 lines of code
• The third concern is about forcing integrators to have to pull in Kotlin into a server side project. Additionally, when there is no intention to run on Android.

Feature Request

Please consider to:

• refactor and remove the kotlin dependency
• refactor and reduce the overall SDK size.

[TomerAberbach]

Have you encountered performance issues from the size? If so, in what context? i.e. What prompted filing this issue?

It's hard to figure out how or whether to prioritize this issue without a motivating use-case.

Also, for what it's worth, Kotlin's purpose isn't just for Android. It's generally useful. And by the way, okhttp is written in Kotlin as well, so even if we rewrite the SDK in Java, that doesn't remove the Kotlin dependency.

[nkavian]

Have you encountered performance issues from the size?

Have I spent time to do performance and load testing, and be able to provide you with raw data -> I have not.

The principle is about not being forced to use larger EC2 instances simply because this library takes more run time memory.

If so, in what context? i.e. What prompted filing this issue?

My background is that I've worked at payment companies and were responsible for implementing and adhering to PCI payment security standards, OWASP, etc.

Larger libraries increase the attack surface and cause a larger security and compliance burden.

Also, for what it's worth, Kotlin's purpose isn't just for Android. It's generally useful. And by the way, okhttp is written in Kotlin as well, so even if we rewrite the SDK in Java, that doesn't remove the Kotlin dependency.

That's fair. I'm using retrofit which brings in okhttp which then brings in only kotlin-stdlib.

The openai-java brings in kotlin-stdlib, kotlin-stdlib-jdk7, kotlin-stdlib-jdk8, kotlin-common, jackson-module-kotlin, and kotlin-reflect.

A new concern after seeing kotlin-reflect could be to verify if user inputs are safely sanitize; but I would assume you guys already thought of that.