From 8b791d90bd38220b19f4973cfa92e1744174b3bd Mon Sep 17 00:00:00 2001
From: James Devine <devinejames@microsoft.com>
Date: Tue, 9 Jun 2026 21:36:52 +0100
Subject: [PATCH] fix(ado-script): inline azure-devops-node-api to avoid
 missing ncc chunk

auth.ts lazy-loaded the SDK via `await import()`. ncc 0.38 splits dynamic imports into separate webpack chunk files (e.g. `485.index.js`) that the flat release layout in `scripts/ado-script/` does not ship, so at runtime `getWebApi()` failed with `Cannot find module .../485.index.js`. Use a static `import * as azdev` so ncc inlines the SDK into every bundle, making each script self-contained. Also fixes the same latent bug in gate.js.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .../src/shared/__tests__/auth.test.ts         |  6 +----
 scripts/ado-script/src/shared/auth.ts         | 22 ++++++++++---------
 2 files changed, 13 insertions(+), 15 deletions(-)

diff --git a/scripts/ado-script/src/shared/__tests__/auth.test.ts b/scripts/ado-script/src/shared/__tests__/auth.test.ts
index 555c98e3..3a3e2705 100644
--- a/scripts/ado-script/src/shared/__tests__/auth.test.ts
+++ b/scripts/ado-script/src/shared/__tests__/auth.test.ts
@@ -34,9 +34,5 @@ describe("getWebApi", () => {
     const a = await getWebApi();
     const b = await getWebApi();
     expect(a).toBe(b);
-  }, 30_000);
-  // ^ explicit 30 s timeout: the first call dynamically imports the
-  // ~2.7 MB azure-devops-node-api chunk (see shared/auth.ts comment),
-  // which can take a few seconds when 20 vitest workers race for disk
-  // I/O. Subsequent calls hit the cache and are fast.
+  });
 });
diff --git a/scripts/ado-script/src/shared/auth.ts b/scripts/ado-script/src/shared/auth.ts
index f381f091..34f6be6c 100644
--- a/scripts/ado-script/src/shared/auth.ts
+++ b/scripts/ado-script/src/shared/auth.ts
@@ -5,15 +5,17 @@
  * `SYSTEM_ACCESSTOKEN` and `ADO_COLLECTION_URI` pipeline env vars via
  * `getPersonalAccessTokenHandler`.
  *
- * The `azure-devops-node-api` package is heavy (~1 MB; includes
- * `typed-rest-client` and `tunnel` transitive deps). Loading it eagerly
- * adds ~50–100 ms of startup latency that is wasted whenever the gate
- * is invoked for a code path that never touches the ADO REST API
- * (e.g. a manual build that hits the bypass branch in `bypass.ts`, or
- * a pipeline whose facts are all pipeline variables). The dynamic
- * `import()` below is statically analysable by ncc, so the SDK is
- * still bundled into `gate.js` — only its module-evaluation
- * cost is deferred until the first `getWebApi()` call.
+ * Import shape: the SDK is imported statically. An earlier revision
+ * deferred it via `await import(...)` to save ~50–100 ms of
+ * module-evaluation time on bypass paths, but ncc compiles dynamic
+ * `import()` into a separate webpack chunk file (`<id>.index.js`)
+ * that lives alongside the main bundle in `.ado-build/<name>/`. The
+ * release pipeline ships only the flat `<name>.js` files
+ * (see `scripts/ado-script/package.json`'s `build:*` targets, plus
+ * `src/compile/extensions/ado_script.rs`'s per-file download list),
+ * so at runtime the chunk was missing and `getWebApi()` failed with
+ * `Cannot find module '/tmp/ado-aw-scripts/ado-script/<id>.index.js'`.
+ * A static import keeps everything in a single self-contained bundle.
  *
  * Env-var contract (set by the compiler in
  * `src/compile/filter_ir.rs::compile_gate_step_external` /
@@ -21,6 +23,7 @@
  *   - `SYSTEM_ACCESSTOKEN` ← `$(System.AccessToken)`
  *   - `ADO_COLLECTION_URI` ← `$(System.CollectionUri)`
  */
+import * as azdev from "azure-devops-node-api";
 import type { WebApi } from "azure-devops-node-api";
 import { logError } from "./vso-logger.js";
 
@@ -47,7 +50,6 @@ export async function getWebApi(): Promise<WebApi> {
     throw new Error(msg);
   }
 
-  const azdev = await import("azure-devops-node-api");
   const handler = azdev.getPersonalAccessTokenHandler(token);
   cached = new azdev.WebApi(orgUrl, handler);
   return cached;