feat: add CI deployment and live progress

tests/server/registry.test.ts

@@ -54,6 +54,69 @@ describe("OCI registry digest resolution", () => {
     ]);
   });
 
+  test("caches successful digest resolutions with deterministic expiry and bounds", async () => {
+    let now = 0;
+    let calls = 0;
+    const fetcher = async () => {
+      calls += 1;
+      return new Response("manifest", {
+        headers: { "docker-content-digest": `sha256:${"d".repeat(64)}` },
+      });
+    };
+    const options = {
+      fetch: fetcher,
+      cacheTtlMs: 100,
+      cacheMaxEntries: 1,
+      clock: () => now,
+    };
+
+    await resolveRegistryDigest("cache.example.com/team/first:v1", options);
+    await resolveRegistryDigest("cache.example.com/team/first:v1", options);
+    expect(calls).toBe(1);
+
+    now = 100;
+    await resolveRegistryDigest("cache.example.com/team/first:v1", options);
+    expect(calls).toBe(2);
+
+    await resolveRegistryDigest("cache.example.com/team/second:v1", options);
+    await resolveRegistryDigest("cache.example.com/team/first:v1", options);
+    expect(calls).toBe(4);
+  });
+
+  test("does not cache failed resolutions or share entries across credentials", async () => {
+    let calls = 0;
+    const failing = async () => {
+      calls += 1;
+      return new Response("unavailable", { status: 503 });
+    };
+    const options = { fetch: failing, cacheTtlMs: 1_000 };
+    await expect(
+      resolveRegistryDigest("failure.example.com/team/image:v1", options),
+    ).rejects.toThrow("503");
+    await expect(
+      resolveRegistryDigest("failure.example.com/team/image:v1", options),
+    ).rejects.toThrow("503");
+    expect(calls).toBe(2);
+
+    const authorizedCalls: string[] = [];
+    const authorized = async (
+      _input: string | URL | Request,
+      init?: RequestInit,
+    ) => {
+      authorizedCalls.push(new Headers(init?.headers).get("authorization")!);
+      return new Response("manifest", {
+        headers: { "docker-content-digest": `sha256:${"e".repeat(64)}` },
+      });
+    };
+    for (const username of ["one", "two"]) {
+      await resolveRegistryDigest("credentials.example.com/team/image:v1", {
+        fetch: authorized,
+        credentials: { username, password: "password" },
+      });
+    }
+    expect(authorizedCalls).toHaveLength(2);
+  });
+
   test("resolves through a trusted internal registry origin", async () => {
     const expected = `sha256:${"c".repeat(64)}` as const;
     let requested = "";