@4cloudguru/pipeline-task-ado 0.1.1 → 0.2.0

package/README.md

@@ -42,7 +42,7 @@ Modules move here one family at a time, smallest first, so the migration pattern
 is proven on something harmless before anything security-bearing moves:
 
 - [x] `getBoolInputDefaultTrue` — fail-closed boolean input
-- [ ] `http-client` — proxy-aware, HTTPS-pinned client wiring over `-core`
+- [x] `http-client` — proxy-aware, HTTPS-pinned client wiring over `-core`
 - [ ] `registry-version-resolver`
 - [ ] `https-client`
 

package/dist/index.cjs

@@ -1,13 +1,40 @@
 'use strict';
 
 var task_js = require('azure-pipelines-task-lib/task.js');
+var undici = require('undici');
+var pipelineTaskCore = require('@4cloudguru/pipeline-task-core');
 
 // src/input/bool-input.ts
 function getBoolInputDefaultTrue(name) {
   const raw = task_js.getInput(name, false);
   return raw === void 0 || raw.trim() === "" ? true : raw.trim().toLowerCase() !== "false";
 }
+function buildAdoFetchOptions() {
+  const resolved = pipelineTaskCore.resolveProxy(task_js.getHttpProxyConfiguration());
+  if (!resolved) return {};
+  for (const secret of resolved.secrets) {
+    task_js.setSecret(secret);
+  }
+  return {
+    // @ts-expect-error Node's fetch accepts an undici dispatcher at runtime.
+    dispatcher: new undici.ProxyAgent(resolved.proxyUrl)
+  };
+}
+function createAdoHttpClient(options) {
+  return pipelineTaskCore.createHttpClient({
+    // Re-evaluated per attempt, so a proxy change between retries is picked up.
+    fetchOptions: buildAdoFetchOptions,
+    // Passed by reference rather than wrapped: a forwarding lambda would be an
+    // extra function no test can meaningfully reach, and task-lib's debug does
+    // not close over `this`.
+    debug: task_js.debug,
+    messages: options.messages,
+    ...options.redirectPolicy ? { redirectPolicy: options.redirectPolicy } : {}
+  });
+}
 
+exports.buildAdoFetchOptions = buildAdoFetchOptions;
+exports.createAdoHttpClient = createAdoHttpClient;
 exports.getBoolInputDefaultTrue = getBoolInputDefaultTrue;
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/input/bool-input.ts"],"names":["getInput"],"mappings":";;;;;AAYO,SAAS,wBAAwB,IAAA,EAAuB;AAC7D,EAAA,MAAM,GAAA,GAAMA,gBAAA,CAAS,IAAA,EAAM,KAAK,CAAA;AAChC,EAAA,OAAO,GAAA,KAAQ,MAAA,IAAa,GAAA,CAAI,IAAA,EAAK,KAAM,EAAA,GAAK,IAAA,GAAO,GAAA,CAAI,IAAA,EAAK,CAAE,WAAA,EAAY,KAAM,OAAA;AACtF","file":"index.cjs","sourcesContent":["// The `.js` extension is load-bearing: azure-pipelines-task-lib is CommonJS with\n// no `exports` map, so under ESM resolution the extensionless subpath does not\n// resolve at all (ERR_MODULE_NOT_FOUND). CJS is unaffected either way.\nimport { getInput } from 'azure-pipelines-task-lib/task.js'\n\n/**\n * Reads a boolean input whose intended default is TRUE (fail-closed). It reads the\n * raw input rather than getBoolInput(name, false) so the default still holds on an\n * agent that does not materialize task.json defaultValues into the input env var\n * (where getBoolInput would silently return false): unset/empty -> true; any value\n * other than \"false\" (case-insensitive) -> true.\n */\nexport function getBoolInputDefaultTrue(name: string): boolean {\n  const raw = getInput(name, false)\n  return raw === undefined || raw.trim() === '' ? true : raw.trim().toLowerCase() !== 'false'\n}\n"]}
+{"version":3,"sources":["../src/input/bool-input.ts","../src/http/ado-http.ts"],"names":["getInput","resolveProxy","getHttpProxyConfiguration","setSecret","ProxyAgent","createHttpClient","debug"],"mappings":";;;;;;;AAYO,SAAS,wBAAwB,IAAA,EAAuB;AAC7D,EAAA,MAAM,GAAA,GAAMA,gBAAA,CAAS,IAAA,EAAM,KAAK,CAAA;AAChC,EAAA,OAAO,GAAA,KAAQ,MAAA,IAAa,GAAA,CAAI,IAAA,EAAK,KAAM,EAAA,GAAK,IAAA,GAAO,GAAA,CAAI,IAAA,EAAK,CAAE,WAAA,EAAY,KAAM,OAAA;AACtF;ACOO,SAAS,oBAAA,GAAoC;AAClD,EAAA,MAAM,QAAA,GAAWC,6BAAA,CAAaC,iCAAA,EAA2B,CAAA;AACzD,EAAA,IAAI,CAAC,QAAA,EAAU,OAAO,EAAC;AAEvB,EAAA,KAAA,MAAW,MAAA,IAAU,SAAS,OAAA,EAAS;AACrC,IAAAC,iBAAA,CAAU,MAAM,CAAA;AAAA,EAClB;AAEA,EAAA,OAAO;AAAA;AAAA,IAEL,UAAA,EAAY,IAAIC,iBAAA,CAAW,QAAA,CAAS,QAAQ;AAAA,GAC9C;AACF;AAmBO,SAAS,oBAAoB,OAAA,EAA2C;AAC7E,EAAA,OAAOC,iCAAA,CAAiB;AAAA;AAAA,IAEtB,YAAA,EAAc,oBAAA;AAAA;AAAA;AAAA;AAAA,WAIdC,aAAA;AAAA,IACA,UAAU,OAAA,CAAQ,QAAA;AAAA,IAClB,GAAI,QAAQ,cAAA,GAAiB,EAAE,gBAAgB,OAAA,CAAQ,cAAA,KAAmB;AAAC,GAC5E,CAAA;AACH","file":"index.cjs","sourcesContent":["// The `.js` extension is load-bearing: azure-pipelines-task-lib is CommonJS with\n// no `exports` map, so under ESM resolution the extensionless subpath does not\n// resolve at all (ERR_MODULE_NOT_FOUND). CJS is unaffected either way.\nimport { getInput } from 'azure-pipelines-task-lib/task.js'\n\n/**\n * Reads a boolean input whose intended default is TRUE (fail-closed). It reads the\n * raw input rather than getBoolInput(name, false) so the default still holds on an\n * agent that does not materialize task.json defaultValues into the input env var\n * (where getBoolInput would silently return false): unset/empty -> true; any value\n * other than \"false\" (case-insensitive) -> true.\n */\nexport function getBoolInputDefaultTrue(name: string): boolean {\n  const raw = getInput(name, false)\n  return raw === undefined || raw.trim() === '' ? true : raw.trim().toLowerCase() !== 'false'\n}\n","import { debug, getHttpProxyConfiguration, setSecret } from 'azure-pipelines-task-lib/task.js'\nimport { ProxyAgent } from 'undici'\nimport {\n  createHttpClient,\n  resolveProxy,\n  type HttpClient,\n  type HttpMessages,\n  type RedirectPolicy,\n} from '@4cloudguru/pipeline-task-core'\n\n/**\n * Per-attempt fetch init carrying the agent's proxy.\n *\n * The ordering is the security property, not an implementation detail: the\n * agent's masker matches registered literals rather than derivations of them,\n * and resolveProxy returns every spelling of the credential it produced —\n * including the percent-encoded form the dispatcher URL actually embeds, and\n * any userinfo already inside Agent.ProxyUrl. All of them must be registered\n * BEFORE proxyUrl is handed to a dispatcher or interpolated into a message.\n * resolveProxy cannot do it itself; the package it lives in does not import\n * the task lib. That obligation is the reason this function exists here.\n */\nexport function buildAdoFetchOptions(): RequestInit {\n  const resolved = resolveProxy(getHttpProxyConfiguration())\n  if (!resolved) return {}\n\n  for (const secret of resolved.secrets) {\n    setSecret(secret)\n  }\n\n  return {\n    // @ts-expect-error Node's fetch accepts an undici dispatcher at runtime.\n    dispatcher: new ProxyAgent(resolved.proxyUrl),\n  }\n}\n\nexport interface AdoHttpClientOptions {\n  /**\n   * Failure text. Kept a parameter because it is the one genuinely per-task\n   * part: the strings come from each task's own resource file via tasks.loc,\n   * and \"registry request failed\" is wrong on a releases.hashicorp.com fetch.\n   */\n  messages: HttpMessages\n  /**\n   * Defaults to the core client's own same-host rule. Pass\n   * anyRedirectPolicy(sameHostOnly, githubAssetRedirects) only for callers that\n   * really do fetch GitHub release assets — enabling it estate-wide widens the\n   * redirect surface for callers that never need it.\n   */\n  redirectPolicy?: RedirectPolicy\n}\n\n/** An HTTPS-pinned client wired to this agent's proxy, debug channel and text. */\nexport function createAdoHttpClient(options: AdoHttpClientOptions): HttpClient {\n  return createHttpClient({\n    // Re-evaluated per attempt, so a proxy change between retries is picked up.\n    fetchOptions: buildAdoFetchOptions,\n    // Passed by reference rather than wrapped: a forwarding lambda would be an\n    // extra function no test can meaningfully reach, and task-lib's debug does\n    // not close over `this`.\n    debug,\n    messages: options.messages,\n    ...(options.redirectPolicy ? { redirectPolicy: options.redirectPolicy } : {}),\n  })\n}\n"]}

package/dist/index.d.mts

@@ -1,3 +1,5 @@
+import { HttpMessages, RedirectPolicy, HttpClient } from '@4cloudguru/pipeline-task-core';
+
 /**
  * Reads a boolean input whose intended default is TRUE (fail-closed). It reads the
  * raw input rather than getBoolInput(name, false) so the default still holds on an
@@ -7,4 +9,35 @@
  */
 declare function getBoolInputDefaultTrue(name: string): boolean;
 
-export { getBoolInputDefaultTrue };
+/**
+ * Per-attempt fetch init carrying the agent's proxy.
+ *
+ * The ordering is the security property, not an implementation detail: the
+ * agent's masker matches registered literals rather than derivations of them,
+ * and resolveProxy returns every spelling of the credential it produced —
+ * including the percent-encoded form the dispatcher URL actually embeds, and
+ * any userinfo already inside Agent.ProxyUrl. All of them must be registered
+ * BEFORE proxyUrl is handed to a dispatcher or interpolated into a message.
+ * resolveProxy cannot do it itself; the package it lives in does not import
+ * the task lib. That obligation is the reason this function exists here.
+ */
+declare function buildAdoFetchOptions(): RequestInit;
+interface AdoHttpClientOptions {
+    /**
+     * Failure text. Kept a parameter because it is the one genuinely per-task
+     * part: the strings come from each task's own resource file via tasks.loc,
+     * and "registry request failed" is wrong on a releases.hashicorp.com fetch.
+     */
+    messages: HttpMessages;
+    /**
+     * Defaults to the core client's own same-host rule. Pass
+     * anyRedirectPolicy(sameHostOnly, githubAssetRedirects) only for callers that
+     * really do fetch GitHub release assets — enabling it estate-wide widens the
+     * redirect surface for callers that never need it.
+     */
+    redirectPolicy?: RedirectPolicy;
+}
+/** An HTTPS-pinned client wired to this agent's proxy, debug channel and text. */
+declare function createAdoHttpClient(options: AdoHttpClientOptions): HttpClient;
+
+export { type AdoHttpClientOptions, buildAdoFetchOptions, createAdoHttpClient, getBoolInputDefaultTrue };

package/dist/index.d.ts

@@ -1,3 +1,5 @@
+import { HttpMessages, RedirectPolicy, HttpClient } from '@4cloudguru/pipeline-task-core';
+
 /**
  * Reads a boolean input whose intended default is TRUE (fail-closed). It reads the
  * raw input rather than getBoolInput(name, false) so the default still holds on an
@@ -7,4 +9,35 @@
  */
 declare function getBoolInputDefaultTrue(name: string): boolean;
 
-export { getBoolInputDefaultTrue };
+/**
+ * Per-attempt fetch init carrying the agent's proxy.
+ *
+ * The ordering is the security property, not an implementation detail: the
+ * agent's masker matches registered literals rather than derivations of them,
+ * and resolveProxy returns every spelling of the credential it produced —
+ * including the percent-encoded form the dispatcher URL actually embeds, and
+ * any userinfo already inside Agent.ProxyUrl. All of them must be registered
+ * BEFORE proxyUrl is handed to a dispatcher or interpolated into a message.
+ * resolveProxy cannot do it itself; the package it lives in does not import
+ * the task lib. That obligation is the reason this function exists here.
+ */
+declare function buildAdoFetchOptions(): RequestInit;
+interface AdoHttpClientOptions {
+    /**
+     * Failure text. Kept a parameter because it is the one genuinely per-task
+     * part: the strings come from each task's own resource file via tasks.loc,
+     * and "registry request failed" is wrong on a releases.hashicorp.com fetch.
+     */
+    messages: HttpMessages;
+    /**
+     * Defaults to the core client's own same-host rule. Pass
+     * anyRedirectPolicy(sameHostOnly, githubAssetRedirects) only for callers that
+     * really do fetch GitHub release assets — enabling it estate-wide widens the
+     * redirect surface for callers that never need it.
+     */
+    redirectPolicy?: RedirectPolicy;
+}
+/** An HTTPS-pinned client wired to this agent's proxy, debug channel and text. */
+declare function createAdoHttpClient(options: AdoHttpClientOptions): HttpClient;
+
+export { type AdoHttpClientOptions, buildAdoFetchOptions, createAdoHttpClient, getBoolInputDefaultTrue };

package/dist/index.js

@@ -1,11 +1,36 @@
-import { getInput } from 'azure-pipelines-task-lib/task.js';
+import { getInput, getHttpProxyConfiguration, setSecret, debug } from 'azure-pipelines-task-lib/task.js';
+import { ProxyAgent } from 'undici';
+import { resolveProxy, createHttpClient } from '@4cloudguru/pipeline-task-core';
 
 // src/input/bool-input.ts
 function getBoolInputDefaultTrue(name) {
   const raw = getInput(name, false);
   return raw === void 0 || raw.trim() === "" ? true : raw.trim().toLowerCase() !== "false";
 }
+function buildAdoFetchOptions() {
+  const resolved = resolveProxy(getHttpProxyConfiguration());
+  if (!resolved) return {};
+  for (const secret of resolved.secrets) {
+    setSecret(secret);
+  }
+  return {
+    // @ts-expect-error Node's fetch accepts an undici dispatcher at runtime.
+    dispatcher: new ProxyAgent(resolved.proxyUrl)
+  };
+}
+function createAdoHttpClient(options) {
+  return createHttpClient({
+    // Re-evaluated per attempt, so a proxy change between retries is picked up.
+    fetchOptions: buildAdoFetchOptions,
+    // Passed by reference rather than wrapped: a forwarding lambda would be an
+    // extra function no test can meaningfully reach, and task-lib's debug does
+    // not close over `this`.
+    debug,
+    messages: options.messages,
+    ...options.redirectPolicy ? { redirectPolicy: options.redirectPolicy } : {}
+  });
+}
 
-export { getBoolInputDefaultTrue };
+export { buildAdoFetchOptions, createAdoHttpClient, getBoolInputDefaultTrue };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/input/bool-input.ts"],"names":[],"mappings":";;;AAYO,SAAS,wBAAwB,IAAA,EAAuB;AAC7D,EAAA,MAAM,GAAA,GAAM,QAAA,CAAS,IAAA,EAAM,KAAK,CAAA;AAChC,EAAA,OAAO,GAAA,KAAQ,MAAA,IAAa,GAAA,CAAI,IAAA,EAAK,KAAM,EAAA,GAAK,IAAA,GAAO,GAAA,CAAI,IAAA,EAAK,CAAE,WAAA,EAAY,KAAM,OAAA;AACtF","file":"index.js","sourcesContent":["// The `.js` extension is load-bearing: azure-pipelines-task-lib is CommonJS with\n// no `exports` map, so under ESM resolution the extensionless subpath does not\n// resolve at all (ERR_MODULE_NOT_FOUND). CJS is unaffected either way.\nimport { getInput } from 'azure-pipelines-task-lib/task.js'\n\n/**\n * Reads a boolean input whose intended default is TRUE (fail-closed). It reads the\n * raw input rather than getBoolInput(name, false) so the default still holds on an\n * agent that does not materialize task.json defaultValues into the input env var\n * (where getBoolInput would silently return false): unset/empty -> true; any value\n * other than \"false\" (case-insensitive) -> true.\n */\nexport function getBoolInputDefaultTrue(name: string): boolean {\n  const raw = getInput(name, false)\n  return raw === undefined || raw.trim() === '' ? true : raw.trim().toLowerCase() !== 'false'\n}\n"]}
+{"version":3,"sources":["../src/input/bool-input.ts","../src/http/ado-http.ts"],"names":[],"mappings":";;;;;AAYO,SAAS,wBAAwB,IAAA,EAAuB;AAC7D,EAAA,MAAM,GAAA,GAAM,QAAA,CAAS,IAAA,EAAM,KAAK,CAAA;AAChC,EAAA,OAAO,GAAA,KAAQ,MAAA,IAAa,GAAA,CAAI,IAAA,EAAK,KAAM,EAAA,GAAK,IAAA,GAAO,GAAA,CAAI,IAAA,EAAK,CAAE,WAAA,EAAY,KAAM,OAAA;AACtF;ACOO,SAAS,oBAAA,GAAoC;AAClD,EAAA,MAAM,QAAA,GAAW,YAAA,CAAa,yBAAA,EAA2B,CAAA;AACzD,EAAA,IAAI,CAAC,QAAA,EAAU,OAAO,EAAC;AAEvB,EAAA,KAAA,MAAW,MAAA,IAAU,SAAS,OAAA,EAAS;AACrC,IAAA,SAAA,CAAU,MAAM,CAAA;AAAA,EAClB;AAEA,EAAA,OAAO;AAAA;AAAA,IAEL,UAAA,EAAY,IAAI,UAAA,CAAW,QAAA,CAAS,QAAQ;AAAA,GAC9C;AACF;AAmBO,SAAS,oBAAoB,OAAA,EAA2C;AAC7E,EAAA,OAAO,gBAAA,CAAiB;AAAA;AAAA,IAEtB,YAAA,EAAc,oBAAA;AAAA;AAAA;AAAA;AAAA,IAId,KAAA;AAAA,IACA,UAAU,OAAA,CAAQ,QAAA;AAAA,IAClB,GAAI,QAAQ,cAAA,GAAiB,EAAE,gBAAgB,OAAA,CAAQ,cAAA,KAAmB;AAAC,GAC5E,CAAA;AACH","file":"index.js","sourcesContent":["// The `.js` extension is load-bearing: azure-pipelines-task-lib is CommonJS with\n// no `exports` map, so under ESM resolution the extensionless subpath does not\n// resolve at all (ERR_MODULE_NOT_FOUND). CJS is unaffected either way.\nimport { getInput } from 'azure-pipelines-task-lib/task.js'\n\n/**\n * Reads a boolean input whose intended default is TRUE (fail-closed). It reads the\n * raw input rather than getBoolInput(name, false) so the default still holds on an\n * agent that does not materialize task.json defaultValues into the input env var\n * (where getBoolInput would silently return false): unset/empty -> true; any value\n * other than \"false\" (case-insensitive) -> true.\n */\nexport function getBoolInputDefaultTrue(name: string): boolean {\n  const raw = getInput(name, false)\n  return raw === undefined || raw.trim() === '' ? true : raw.trim().toLowerCase() !== 'false'\n}\n","import { debug, getHttpProxyConfiguration, setSecret } from 'azure-pipelines-task-lib/task.js'\nimport { ProxyAgent } from 'undici'\nimport {\n  createHttpClient,\n  resolveProxy,\n  type HttpClient,\n  type HttpMessages,\n  type RedirectPolicy,\n} from '@4cloudguru/pipeline-task-core'\n\n/**\n * Per-attempt fetch init carrying the agent's proxy.\n *\n * The ordering is the security property, not an implementation detail: the\n * agent's masker matches registered literals rather than derivations of them,\n * and resolveProxy returns every spelling of the credential it produced —\n * including the percent-encoded form the dispatcher URL actually embeds, and\n * any userinfo already inside Agent.ProxyUrl. All of them must be registered\n * BEFORE proxyUrl is handed to a dispatcher or interpolated into a message.\n * resolveProxy cannot do it itself; the package it lives in does not import\n * the task lib. That obligation is the reason this function exists here.\n */\nexport function buildAdoFetchOptions(): RequestInit {\n  const resolved = resolveProxy(getHttpProxyConfiguration())\n  if (!resolved) return {}\n\n  for (const secret of resolved.secrets) {\n    setSecret(secret)\n  }\n\n  return {\n    // @ts-expect-error Node's fetch accepts an undici dispatcher at runtime.\n    dispatcher: new ProxyAgent(resolved.proxyUrl),\n  }\n}\n\nexport interface AdoHttpClientOptions {\n  /**\n   * Failure text. Kept a parameter because it is the one genuinely per-task\n   * part: the strings come from each task's own resource file via tasks.loc,\n   * and \"registry request failed\" is wrong on a releases.hashicorp.com fetch.\n   */\n  messages: HttpMessages\n  /**\n   * Defaults to the core client's own same-host rule. Pass\n   * anyRedirectPolicy(sameHostOnly, githubAssetRedirects) only for callers that\n   * really do fetch GitHub release assets — enabling it estate-wide widens the\n   * redirect surface for callers that never need it.\n   */\n  redirectPolicy?: RedirectPolicy\n}\n\n/** An HTTPS-pinned client wired to this agent's proxy, debug channel and text. */\nexport function createAdoHttpClient(options: AdoHttpClientOptions): HttpClient {\n  return createHttpClient({\n    // Re-evaluated per attempt, so a proxy change between retries is picked up.\n    fetchOptions: buildAdoFetchOptions,\n    // Passed by reference rather than wrapped: a forwarding lambda would be an\n    // extra function no test can meaningfully reach, and task-lib's debug does\n    // not close over `this`.\n    debug,\n    messages: options.messages,\n    ...(options.redirectPolicy ? { redirectPolicy: options.redirectPolicy } : {}),\n  })\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@4cloudguru/pipeline-task-ado",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "description": "Azure DevOps-specific task primitives shared by the Azure Pipelines task extensions.",
   "license": "Apache-2.0",
   "private": false,
@@ -69,7 +69,7 @@
     "prettier": "3.9.6",
     "tsup": "^8.3.5",
     "typescript": "^5.9.3",
-    "undici": "^7.16.0",
+    "undici": "^8.10.0",
     "vitest": "^4.1.7"
   }
 }