Enforce create-only semantics in the TypeScript SDK

[Arun G (ArunGopinathan)]

Why this is needed

The TypeScript SDK sends the nonstandard header If-Not-Match: * from createTunnel and createTunnelPort. The service does not recognize that spelling, so it ignores the intended create-if-absent precondition and falls through to its update path when the tunnel or port already exists.

As a result, methods named create* can silently overwrite existing resources instead of reporting a conflict. This also differs from the C# SDK, which already sends the standard If-None-Match: * header.

Using If-None-Match: * restores the intended atomic create-only contract:

• creating a new tunnel or port succeeds
• creating one that already exists returns 409 Conflict
• callers that intentionally want upsert behavior continue to use createOrUpdateTunnel or createOrUpdateTunnelPort

The service's Azure controller already implements this behavior through Request.Headers.IfNoneMatch, and the C# SDK relies on it in production.

What changed

• replace both If-Not-Match: * headers with If-None-Match: *
• copy request options before adding the precondition so a later update cannot inherit it
• verify both create paths emit the correct header and preserve caller-provided headers
• verify generated tunnel-ID conflicts retry with a new ID while retaining the precondition

Tests

• npm run build
• node .\build.js test --filter TunnelManagementTests (22 passed)
• npm run eslint

Security

The server evaluates the create-if-absent precondition atomically, closing the previous overwrite window. Request options and nested headers are copied so the precondition cannot leak into later update calls. Independent correctness reviews and a STRIDE review found no remaining issues.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.