test: enforce production docker network invariants

tests/compose-invariants.test.mjs

@@ -0,0 +1,20 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import { parse } from 'yaml';
+import { verifyComposeInvariants } from '../scripts/verify-compose-invariants.mjs';
+
+test('production compose publishes exactly one edge port', () => {
+  const compose = parse(fs.readFileSync(new URL('../compose.yml', import.meta.url), 'utf8'));
+  assert.doesNotThrow(() => verifyComposeInvariants(compose));
+});
+
+test('invariant rejects a host port on postgres', () => {
+  const invalid = {
+    services: {
+      edge: { ports: ['443:443'] },
+      postgres: { ports: ['5432:5432'] },
+    },
+  };
+  assert.throws(() => verifyComposeInvariants(invalid), /postgres.*ports/i);
+});