@@ -37,7 +37,14 @@
  *    non-empty `encryptionKey` in a local or replica mode, refused on
  *    `encryptionKey` — the fifth copy, one text per mode. Those rows used to
  *    be accepted everywhere, and the driver wrote the file in plaintext: its
- *    local engine (better-sqlite3) has no encryption codec.
+ *    local engine (better-sqlite3) has no encryption codec. And for the same
+ *    key beside a `file:` url or `:memory:` under a forced `mode: 'remote'`,
+ *    whose libSQL client is handed no key — the sixth copy, one text for a
+ *    file and one for an in-memory database. The mirror declares no `mode`, so
+ *    it judges those configs as the local database their url selects (it
+ *    refuses them on `encryptionKey` in the local arm's words); its own copy
+ *    of the remote arm is unreachable through it and kept byte-identical, as
+ *    its other forced-mode branches are.
  *
  * ⚠️ The mirror declares no `mode`, so zod strips an authored one before its
  * refinement runs: rows that FORCE a mode are judged by the constructor and the
@@ -121,6 +128,12 @@ const ROWS: Row[] = [
   // [#25020] An empty key is unset, as the loaders read it.
   { name: 'an empty encryptionKey (unset) beside a file: url', config: { url: FILE, encryptionKey: '' }, ctor: 'accept' },
   { name: 'an empty encryptionKey (unset) on a replica', config: { url: FILE, syncUrl: REMOTE, sync: { onConnect: false }, encryptionKey: '' }, ctor: 'accept' },
+  // [#25020, patch round 1] The forced-remote local-url arm's controls: no key, an empty key, and a
+  // remote url with a key — a remote server's storage, which this card does not judge.
+  { name: ":memory: under a forced mode: 'remote'", config: { url: ':memory:', mode: 'remote' }, ctor: 'accept' },
+  { name: "an empty encryptionKey (unset) beside file: under a forced mode: 'remote'", config: { url: FILE, mode: 'remote', encryptionKey: '' }, ctor: 'accept' },
+  { name: 'encryptionKey beside a libsql:// url (remote: not judged by this card)', config: { url: REMOTE, encryptionKey: KEY }, ctor: 'accept' },
+  { name: "encryptionKey beside libsql:// under a forced mode: 'remote' (not judged by this card)", config: { url: REMOTE, mode: 'remote', encryptionKey: KEY }, ctor: 'accept' },
 
   // ── a remote url in a local or replica mode ─────────────────────────────
   { name: 'libsql:// beside syncUrl', config: { url: REMOTE, syncUrl: REMOTE }, ctor: 'refuse', refusedOn: 'url' },
@@ -210,6 +223,19 @@ const ROWS: Row[] = [
   { name: 'encryptionKey beside sync with no syncUrl: the sync refusal first', config: { url: FILE, sync: { intervalSeconds: 60 }, encryptionKey: KEY }, ctor: 'refuse', refusedOn: 'sync', issues: 2 },
   { name: "encryptionKey under a forced mode: 'replica' with no syncUrl: the mode refusal first", config: { url: FILE, mode: 'replica', encryptionKey: KEY }, ctor: 'refuse', refusedOn: 'mode' },
   { name: "encryptionKey + syncUrl under a forced mode: 'local': the mode refusal first", config: { url: FILE, mode: 'local', syncUrl: REMOTE, encryptionKey: KEY }, ctor: 'refuse', refusedOn: 'mode' },
+
+  // ── the same key beside a local url under a forced mode: 'remote' (#25020, patch round 1) ──
+  // Judged by where the database lives, not by the mode: `connect()` hands the url to the libSQL
+  // client the driver builds, which is handed no key. The mirror declares no `mode`, so these rows
+  // are judged by the constructor and the spec contract only (see the header).
+  { name: "encryptionKey beside file: under a forced mode: 'remote'", config: { url: FILE, mode: 'remote', encryptionKey: KEY }, ctor: 'refuse', refusedOn: 'encryptionKey' },
+  { name: "encryptionKey beside an uppercase FILE: url under a forced mode: 'remote'", config: { url: `FILE:${DIR}/upper-remote-key.db`, mode: 'remote', encryptionKey: KEY }, ctor: 'refuse', refusedOn: 'encryptionKey' },
+  { name: "encryptionKey beside file: + timeoutMs under a forced mode: 'remote'", config: { url: FILE, mode: 'remote', timeoutMs: 5000, encryptionKey: KEY }, ctor: 'refuse', refusedOn: 'encryptionKey' },
+  { name: "encryptionKey beside :memory: under a forced mode: 'remote'", config: { url: ':memory:', mode: 'remote', encryptionKey: KEY }, ctor: 'refuse', refusedOn: 'encryptionKey' },
+  { name: "encryptionKey beside file::memory: under a forced mode: 'remote'", config: { url: 'file::memory:', mode: 'remote', encryptionKey: KEY }, ctor: 'refuse', refusedOn: 'encryptionKey' },
+  // ORDER against the forced-remote refusals: the spec contract raises BOTH issues (theirs first); the constructor throws the first.
+  { name: "encryptionKey + syncUrl beside file: under a forced mode: 'remote': the syncUrl refusal first", config: { url: FILE, mode: 'remote', syncUrl: REMOTE, encryptionKey: KEY }, ctor: 'refuse', refusedOn: 'syncUrl', issues: 2 },
+  { name: "encryptionKey + sync with no syncUrl beside file: under a forced mode: 'remote': the sync refusal first", config: { url: FILE, mode: 'remote', sync: { onConnect: true }, encryptionKey: KEY }, ctor: 'refuse', refusedOn: 'sync', issues: 2 },
 ];
 
 /**
@@ -285,9 +311,11 @@ describe('turso config: the constructor, the spec contract and this mirror agree
     expect(ROWS.filter((r) => r.refusedOn === 'mode' && r.config.mode === 'local').length).toBeGreaterThanOrEqual(8);
     // [#25020] Both modes of the `encryptionKey` refusal, floored apart so the
     // replica half cannot shrink behind the local half.
-    expect(ROWS.filter((r) => r.refusedOn === 'encryptionKey').length).toBeGreaterThanOrEqual(8);
+    expect(ROWS.filter((r) => r.refusedOn === 'encryptionKey').length).toBeGreaterThanOrEqual(13);
     expect(ROWS.filter((r) => r.refusedOn === 'encryptionKey' && (r.config.syncUrl || r.config.mode === 'replica')).length).toBeGreaterThanOrEqual(3);
-    expect(SYNC_KEY_REFUSALS.length).toBeGreaterThanOrEqual(31);
+    // [#25020, patch round 1] The forced-remote local-url half, floored on its own.
+    expect(ROWS.filter((r) => r.refusedOn === 'encryptionKey' && r.config.mode === 'remote').length).toBeGreaterThanOrEqual(5);
+    expect(SYNC_KEY_REFUSALS.length).toBeGreaterThanOrEqual(38);
     // [#20200] Exactly zero, not a floor: every key the constructor used to
     // build and ignore is refused at construction now (see the header).
     expect(ROWS.filter((r) => r.inert).length).toBe(0);
 
@@ -33,6 +33,13 @@
  * contract's issue byte for byte; that equality is pinned in
  * `spec/turso-config-constructor-parity.test.ts`, not here.
  *
+ * [#25020, patch round 1] The same key beside a `file:` url or `:memory:` under
+ * a forced `mode: 'remote'` is refused too, in its own words: that mode skipped
+ * every local-engine refusal, and `connect()` handed the local url to the
+ * libSQL client the driver builds, which is handed no key. Its controls: the
+ * same shape with no key or an empty one, and a `libsql://` url with a key,
+ * still construct.
+ *
  * The replica pins need no sync server: the refusal fires at construction,
  * before any client is built. A replica with the key and a REACHABLE sync
  * server was not measured — no libSQL sync server runs in this package's test
@@ -90,6 +97,17 @@ const REPLICA_FIRST_SENTENCE =
   'engine): nothing would encrypt the file, so it would be written in plaintext that any SQLite reader ' +
   'opens without the key — the turso driver refuses this configuration when it starts.';
 
+const REMOTE_FILE_FIRST_SENTENCE =
+  "`encryptionKey` asks for this datasource's database file to be encrypted, but `url` is a local `file:` " +
+  "url, and `mode: 'remote'` runs every read and write of that file through the libSQL client this driver " +
+  'builds, which is handed no key: nothing would encrypt the file, so it would be written in plaintext that ' +
+  'any SQLite reader opens without the key — the turso driver refuses this configuration when it starts.';
+const REMOTE_MEMORY_FIRST_SENTENCE =
+  "`encryptionKey` asks for this datasource's database to be encrypted, but `url` names an in-memory " +
+  "database, and `mode: 'remote'` runs every read and write of it through the libSQL client this driver " +
+  'builds, which is handed no key: there is no file for the key to encrypt, so it would change nothing — ' +
+  'the turso driver refuses this configuration when it starts.';
+
 /** A client that never touches a network: the replica arm takes it instead of building one. */
 const offlineClient = () => ({ close() {}, sync: async () => ({}) }) as unknown as TursoDriverConfig['client'];
 
@@ -159,6 +177,55 @@ describe('an embedded replica: `encryptionKey` is refused at construction', () =
   });
 });
 
+// [#25020, patch round 1] A forced `mode: 'remote'` answers first in `detectMode`, so this shape
+// skipped every local-engine refusal, and `connect()` handed the local url to the libSQL client the
+// driver builds, with no key. Judged by where the database lives, not by the mode.
+describe("a local url under a forced mode: 'remote': `encryptionKey` is refused at construction", () => {
+  it.each<[string, (path: string) => TursoDriverConfig]>([
+    ['a file: url', (path) => ({ url: `file:${path}`, mode: 'remote', encryptionKey: KEY })],
+    ['an uppercase FILE: url', (path) => ({ url: `FILE:${path}`, mode: 'remote', encryptionKey: KEY })],
+    ['a file: url beside timeout', (path) => ({ url: `file:${path}`, mode: 'remote', timeout: 5000, encryptionKey: KEY })],
+  ])('%s: VALIDATION_ERROR / 400, naming the forced remote mode, and no file is opened', (_name, configOf) => {
+    const path = nextPath();
+    const refusal = refusalOf(() => new TursoDriver(configOf(path)));
+
+    expect(refusal).not.toBeNull();
+    expect(refusal!.code).toBe('VALIDATION_ERROR');
+    expect(refusal!.status).toBe(400);
+    expect(refusal!.message.startsWith(REMOTE_FILE_FIRST_SENTENCE), refusal!.message).toBe(true);
+    expect(existsSync(path)).toBe(false);
+  });
+
+  it.each([':memory:', 'file::memory:'])('%s: refused in the in-memory words', (url) => {
+    const refusal = refusalOf(() => new TursoDriver({ url, mode: 'remote', encryptionKey: KEY }));
+
+    expect(refusal?.code).toBe('VALIDATION_ERROR');
+    expect(refusal?.status).toBe(400);
+    expect(refusal!.message.startsWith(REMOTE_MEMORY_FIRST_SENTENCE), refusal!.message).toBe(true);
+  });
+
+  it('createTursoDriver() refuses the same config, and the message names no url and no key', () => {
+    const refusal = refusalOf(
+      () => createTursoDriver({ url: `file:${join(DIR, 'private-dir.db')}`, mode: 'remote', encryptionKey: 'private-key-value' }),
+    );
+
+    expect(refusal?.code).toBe('VALIDATION_ERROR');
+    expect(refusal?.status).toBe(400);
+    expect(refusal!.message).not.toContain('private-dir');
+    expect(refusal!.message).not.toContain('private-key-value');
+  });
+
+  it.each<[string, TursoDriverConfig]>([
+    ['the same file: url with no key', { url: `file:${join(DIR, 'remote-no-key.db')}`, mode: 'remote' }],
+    ['the same file: url with an empty key (unset)', { url: `file:${join(DIR, 'remote-empty-key.db')}`, mode: 'remote', encryptionKey: '' }],
+    [':memory: with no key', { url: ':memory:', mode: 'remote' }],
+    ['a libsql:// url with a key (a remote server\'s storage: not judged by this card)', { url: 'libsql://db.example.invalid', encryptionKey: KEY }],
+    ["a libsql:// url with a key under a forced mode: 'remote'", { url: 'libsql://db.example.invalid', mode: 'remote', encryptionKey: KEY }],
+  ])('CONTROL: %s still constructs, in remote mode', (_name, config) => {
+    expect(new TursoDriver(config).transportMode).toBe('remote');
+  });
+});
+
 describe('CONTROLS — a datasource without a key works exactly as before', () => {
   const Database = createRequire(import.meta.url)('better-sqlite3') as new (
     filename: string,
 
@@ -579,6 +579,91 @@ describe('TursoConfigSchema refuses what the turso driver refuses', () => {
       const description = TursoConfigSchema.shape.encryptionKey.description ?? '';
       expect(description).not.toMatch(/AES-256/);
       expect(description).toContain('refused for a local or replica datasource');
+      expect(description).toContain('under a forced remote mode');
+    });
+  });
+
+  // #25020, patch round 1 — the same key beside a local url under a FORCED
+  // `mode: 'remote'`. The forced mode skipped every local-engine refusal, and
+  // `connect()` handed the url to the libSQL client the driver builds, which is
+  // handed no key: plaintext all the same. Judged by where the database lives,
+  // not by the mode, in its own words.
+  describe("a non-empty `encryptionKey` beside a `file:` url or `:memory:` under a forced `mode: 'remote'` — refused on `encryptionKey`", () => {
+    const FILE_FIRST_SENTENCE =
+      "`encryptionKey` asks for this datasource's database file to be encrypted, but `url` is a local `file:` "
+      + "url, and `mode: 'remote'` runs every read and write of that file through the libSQL client this driver "
+      + 'builds, which is handed no key: nothing would encrypt the file, so it would be written in plaintext that '
+      + 'any SQLite reader opens without the key — the turso driver refuses this configuration when it starts.';
+    const MEMORY_FIRST_SENTENCE =
+      "`encryptionKey` asks for this datasource's database to be encrypted, but `url` names an in-memory "
+      + "database, and `mode: 'remote'` runs every read and write of it through the libSQL client this driver "
+      + 'builds, which is handed no key: there is no file for the key to encrypt, so it would change nothing — '
+      + 'the turso driver refuses this configuration when it starts.';
+    const KEY = 'test-key-25020';
+
+    it('a `file:` url in any case, behind whitespace, beside `timeoutMs`', () => {
+      for (const config of [
+        { url: 'file:./data/app.db', mode: 'remote', encryptionKey: KEY },
+        { url: 'FILE:./data/app.db', mode: 'remote', encryptionKey: KEY },
+        { url: ' file:./data/app.db', mode: 'remote', encryptionKey: KEY },
+        { url: 'file:./data/app.db', mode: 'remote', timeoutMs: 5000, encryptionKey: KEY },
+      ]) {
+        const { path, message } = refusal(config);
+        expect(path, JSON.stringify(config)).toBe('encryptionKey');
+        expect(message.startsWith(FILE_FIRST_SENTENCE), message).toBe(true);
+        expect(message).toContain('Drop `encryptionKey`, and encrypt the disk or volume the file lives on instead');
+      }
+    });
+
+    it('an in-memory url — `:memory:`, `file::memory:`, a `:memory:?` query — in its own words', () => {
+      for (const url of [':memory:', 'file::memory:', 'FILE::memory:', 'file::memory:?cache=shared']) {
+        const { path, message } = refusal({ url, mode: 'remote', encryptionKey: KEY });
+        expect(path, url).toBe('encryptionKey');
+        expect(message.startsWith(MEMORY_FIRST_SENTENCE), message).toBe(true);
+      }
+    });
+
+    it('never echoes the key or the url', () => {
+      const { message } = refusal({ url: 'file:./private-dir/app.db', mode: 'remote', encryptionKey: 'private-key-value' });
+      expect(message).not.toContain('private-dir');
+      expect(message).not.toContain('private-key-value');
+    });
+
+    it('comes last in the remote arm: a `syncUrl` or a lone `sync` keeps its own refusal, first', () => {
+      for (const [config, first] of [
+        [{ url: 'file:./data/app.db', mode: 'remote', syncUrl: 'libsql://db.turso.io', encryptionKey: KEY }, 'syncUrl'],
+        [{ url: 'file:./data/app.db', mode: 'remote', sync: { onConnect: true }, encryptionKey: KEY }, 'sync'],
+      ] as const) {
+        const result = TursoConfigSchema.safeParse(config);
+        expect(result.success).toBe(false);
+        expect(result.error!.issues.map((i) => i.path.join('.')), JSON.stringify(config)).toEqual([first, 'encryptionKey']);
+      }
+    });
+
+    it('reaches both authoring doors: `DatasourceSchema` (re-pathed under `config`) and `validateDriverConfig`', () => {
+      const config = { url: 'file:./data/app.db', mode: 'remote', encryptionKey: KEY };
+      const datasource = DatasourceSchema.safeParse({ name: 'edge', driver: 'turso', config });
+      expect(datasource.success).toBe(false);
+      const issue = datasource.error!.issues.find((i) => i.path.join('.') === 'config.encryptionKey');
+      expect(issue, JSON.stringify(datasource.error!.issues)).toBeDefined();
+      expect(issue!.message.startsWith(FILE_FIRST_SENTENCE)).toBe(true);
+
+      const verdict = validateDriverConfig('turso', config);
+      expect(verdict.known).toBe(true);
+      expect(verdict.known && verdict.issues.map((i) => i.path.join('.'))).toEqual(['encryptionKey']);
+    });
+
+    it('controls: no key or an empty one, and a remote url with a key (not judged by this card), stay accepted', () => {
+      for (const config of [
+        { url: 'file:./data/app.db', mode: 'remote' },
+        { url: 'file:./data/app.db', mode: 'remote', encryptionKey: '' },
+        { url: ':memory:', mode: 'remote' },
+        { url: 'libsql://db.turso.io', encryptionKey: KEY },
+        { url: 'libsql://db.turso.io', mode: 'remote', encryptionKey: KEY },
+      ]) {
+        const result = TursoConfigSchema.safeParse(config);
+        expect(result.success, JSON.stringify(result.error?.issues)).toBe(true);
+      }
     });
   });