Refuse a DATABASE_URL with a port of zero at start-up

[Ayush7614]

What this changes

postgres://…:0/… parsed through new URL as port "0" and travelled into new SQL({ port: 0 }) as 0. Boot succeeded and every query then failed against a port nothing listens on. Ports outside 1-65535 are now refused at start-up with a sentence naming DATABASE_URL, before a socket is ever opened. new URL already rejects :65536 and above, so :0 was the hole.

Verified with bun -e: :0 yields port "0", :65536/:99999 throw in new URL, empty yields "" (default 5432 unchanged).

Where it runs

OpenBot is deployed as several server processes behind a load balancer, serving a whole company. Consecutive requests from the same person reach different processes, and the process that answered a WebSocket upgrade is rarely the one that answers the next call on that conversation.

• New state that outlives a request? None. Pure function of the connection string at boot.
• What happens on the second replica? Same refusal on every replica: same input string, same range check, no coordination needed.
• Anything serialised? No. Refusal happens before any connection or migration.
• Anything fanned out to a browser? No.
• New listener, port, or schedule? No.

Boundary and audit

• Every acting call still goes through the gateway: resolve, decide, audit, then act. (No acting path touched; boot-time check only.)
• New refusals and new failures each write a row. N/A: start-up refusal, no request or audit row exists yet. Same as every other malformed-address refusal in this function.
• Nothing new is trusted from the client that the server can resolve itself. No client input involved.

Changelog

• A line in CHANGELOG.md under Unreleased: port-zero refusal entry.

Proof

• bun test server/tests/db-client-address.test.ts -t "port of zero": 1 pass.
• bun test server/tests/db-client-address.test.ts: 11 pass, 1 fail — the 1 failure is the pre-existing pg_stat_activity integration test needing a live Postgres with an openbot role (role openbot does not exist locally); CI provides the database.
• bun run format:check: clean. bun run lint: clean.
• bun run typecheck: server and worker pass; app fails on pre-existing missing embla-carousel-react types, identical on clean upstream main (verified via git stash).

[davidmckayv]

Deep-reviewed clean (validation, no secret leak, fail-closed, agrees with existing layers). CI green.