test(cli): pin the opaque-scheme refusal and the sqlite alias file on both hosts; changeset for both

Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FLwgbTSmGMrqsXkBDsiwfG

Author: claude

.changeset/23633-unrecognised-database-url-scheme.md

@@ -2,7 +2,7 @@
 '@objectstack/cli': patch
 ---
 
-fix(cli): `os serve` refuses an `OS_DATABASE_URL` whose scheme no driver recognises, and reads `pg://` and a scheme-less path as the runtime host does
+fix(cli): `os serve` refuses an `OS_DATABASE_URL` whose scheme no driver recognises, reads `pg://` and a scheme-less path as the runtime host does, and opens `sqlite://x.db` as `./x.db`
 
 Clause-②: no
 
@@ -11,5 +11,7 @@ This is the `os serve` path a host config takes (one whose `plugins` hold plugin
 - **Before, an unrecognised scheme (`OS_DATABASE_URL=redis://127.0.0.1:6399/0`).** `os serve --dev` and `os dev` printed `✓ Server is ready` and the banner `Driver: SqlDriver(better-sqlite3) → :memory:`. The database the operator named was dropped without a word, and every write was lost at restart. In production (`os serve`, `os start`) the boot met the no-storage refusal, which tells the operator to set `OS_DATABASE_URL` even though they had set it.
 - **After.** Both postures exit 1 before any plugin starts with `✗ Unsupported database URL scheme "redis://" (OS_DATABASE_URL / --database). Supported: …`. The message lists the recognised spellings and names only the scheme, never the URL, so credentials in the URL are not printed. The standalone runtime host (`os dev` / `os start` over a plain config, `os migrate`) already refused these schemes, so the two hosts now agree. A `.db` ending no longer rescues an unrecognised scheme: `redis://h/app.db` used to be handed to SQLite as a file path, and it is now refused too.
 - **`pg://…` and a path with no scheme (`./data/app`, `/var/lib/objectstack/app`).** The runtime host already reads these as postgres and as a SQLite file. Before, this path booted `--dev` on `:memory:` for them and production met the no-storage refusal. Now `pg://` is a postgres datasource and a scheme-less path is that SQLite file, in dev and production.
+- **An opaque scheme (two or more characters and a `:` with no `//`, such as `jdbc:postgresql://h/db` or `redis:h`).** Before, `--dev` booted on `:memory:` for these and production met the no-storage refusal. Now they get the same refusal, naming the scheme (`"jdbc:"`), in both postures. A one-letter drive is a path, not a scheme (`C:\data\app`, `C:/data/app`). A file name whose first segment contains a colon now reads as a scheme too: `backup:2026.db` was a SQLite file, and is now refused. Write `./backup:2026.db` or `file:backup:2026.db` for that file.
+- **`sqlite://x.db`.** Before, this path stripped `sqlite:` and opened `//x.db`, a file at the filesystem root. The banner read `→ sqlite://x.db`. The runtime host already reads `sqlite:` and `sqlite://` as aliases of `file:` and opens `./x.db`. This path now uses that same rule (`normalizeDatabaseUrl` from `@objectstack/runtime`), so `sqlite://x.db` and `sqlite:x.db` open `./x.db` and `sqlite:///abs/x.db` opens `/abs/x.db`, on both hosts.
 
-`postgres://`, `postgresql://`, `mysql://`, `mongodb://`, `libsql://`, `wasm-sqlite://`, `file:`, `sqlite:`, `:memory:` and `*.db` paths resolve as before. An unset or blank `OS_DATABASE_URL` keeps the dev SQLite default. An explicit `OS_DATABASE_DRIVER` still wins over the URL, which is then not classified.
+`postgres://`, `postgresql://`, `mysql://`, `mongodb://`, `libsql://`, `wasm-sqlite://`, `file:`, `:memory:` and `*.db` paths resolve as before. An unset or blank `OS_DATABASE_URL` keeps the dev SQLite default. An explicit `OS_DATABASE_DRIVER` still wins over the URL, which is then not classified.

packages/cli/src/utils/driver-vocabulary-parity.test.ts

@@ -486,20 +486,45 @@ describe('the OS_DATABASE_URL door: both hosts, one verdict per URL, dev and pro
     }
   });
 
-  // A value carrying a scheme with no `//` (`jdbc:postgresql://…`, `redis:h`)
-  // matches neither host's `<scheme>://` test, so the runtime host takes it as a
-  // SQLite file path and the CLI host mirrors it. Which answer is RIGHT is not
-  // this row's question; that the two hosts give the SAME one is — so a change
-  // to either host's scheme-less arm reddens here until the other follows.
-  it.each(['jdbc:postgresql://localhost:5432/db', 'redis:cache'])(
-    'both hosts give %s the same verdict, in dev and prod',
-    (url) => {
-      const runtime = runtimeUrlVerdict(url);
-      for (const isDev of [false, true]) {
-        const cli = cliUrlVerdict(url, isDev);
-        expect(cli.accepted, `the hosts disagree on ${url} (isDev=${isDev})`).toBe(runtime.accepted);
-        if (cli.accepted && runtime.accepted) expect(cli.driverId).toBe(runtime.driverId);
-      }
-    },
-  );
+  // An OPAQUE scheme — two or more characters and a `:`, no `//`
+  // (`jdbc:postgresql://…`, `redis:h`). The CLI host refuses it, typed, in dev
+  // and prod. The runtime host's answer is deliberately NOT pinned here: today
+  // its scheme-less arm opens these as a SQLite file at a path made of the URL,
+  // an implementation gap against its own "unknown schemes throw" rule that is
+  // #23765's to close, so asserting either agreement or its current answer
+  // would pin that gap.
+  it.each([
+    ['jdbc:postgresql://localhost:5432/db', 'jdbc:'],
+    ['redis:cache', 'redis:'],
+  ])('the CLI host REFUSES the opaque scheme of %s, in dev AND in prod', (url, scheme) => {
+    for (const isDev of [false, true]) {
+      const cli = cliUrlVerdict(url, isDev);
+      expect(cli.accepted, `the CLI host (isDev=${isDev}) accepted ${url}`).toBe(false);
+      const error = (cli as { error: unknown }).error;
+      expect(error, `the CLI host (isDev=${isDev}) did not refuse ${url} by type`).toBeInstanceOf(UnsupportedDriverError);
+      expect((error as UnsupportedDriverError).recognized).toBe(false);
+      expect((error as Error).message).toContain(`"${scheme}"`);
+      expect((error as Error).message).toContain('OS_DATABASE_URL');
+    }
+  });
+
+  // `sqlite:` / `sqlite://` are aliases of `file:` on both hosts, by ONE rule —
+  // the runtime host's `normalizeDatabaseUrl`, which the CLI host calls. Both
+  // hosts must name the same FILE: `sqlite://x.db` used to open `//x.db` (the
+  // filesystem root) on the CLI host while the runtime host opened `x.db`.
+  it.each([
+    ['sqlite://x.db', 'x.db'],
+    ['sqlite:x.db', 'x.db'],
+    ['sqlite:///var/lib/objectstack/x.db', '/var/lib/objectstack/x.db'],
+  ])('both hosts open %s as the sqlite file %s, in dev and prod', (url, file) => {
+    process.env.OS_DATABASE_URL = url;
+    const runtime = resolveStandaloneDatabase({ artifactPath: '/nonexistent/objectstack.json' });
+    expect(runtime.driver).toBe('sqlite');
+    expect(runtime.sqliteFile, `the runtime host's file for ${url}`).toBe(file);
+    for (const isDev of [false, true]) {
+      const definition = resolveStorageDefinition(resolveDriverType(undefined, url), { databaseUrl: url, isDev });
+      expect(definition!.driverId).toBe('sqlite');
+      expect(definition!.config.filename, `the CLI host's file for ${url} (isDev=${isDev})`).toBe(runtime.sqliteFile);
+    }
+  });
 });

packages/cli/src/utils/storage-driver.test.ts

@@ -85,9 +85,10 @@ describe('inferDriverTypeFromUrl', () => {
     expect(inferDriverTypeFromUrl(':memory:')).toBe('sqlite');
   });
 
-  // A value with no `<scheme>://` is a SQLite file path whatever its name — the
-  // runtime host's arm. These used to answer '' (dev booted `:memory:`).
-  it.each(['./data/app', 'data/app', '/var/lib/objectstack/app', 'C:\\data\\app'])(
+  // A value with no scheme is a SQLite file path whatever its name — the runtime
+  // host's arm. These used to answer '' (dev booted `:memory:`). A one-letter
+  // drive and a `:` is a drive, not a scheme.
+  it.each(['./data/app', 'data/app', '/var/lib/objectstack/app', 'C:\\data\\app', 'C:/data/app', './backup:2026.db'])(
     'classifies the scheme-less path %s as a sqlite file',
     (url) => {
       expect(inferDriverTypeFromUrl(url)).toBe('sqlite');
@@ -112,6 +113,10 @@ describe('inferDriverTypeFromUrl', () => {
     ['mssql://h/db', 'mssql://'],
     // A `.db` name does not rescue a scheme nothing recognises.
     ['redis://h/app.db', 'redis://'],
+    // An OPAQUE scheme (two or more characters and a `:`, no `//`) is refused
+    // too, rather than opened as a file at a path made of the URL.
+    ['jdbc:postgresql://localhost:5432/db', 'jdbc:'],
+    ['redis:cache', 'redis:'],
   ])('refuses %s at inference, naming the scheme and the recognised ones', (url, scheme) => {
     let err: unknown;
     try {
@@ -256,6 +261,23 @@ describe('resolveStorageDefinition (#3826 — a definition, not a driver)', () =
     expect(r!.sqliteFilePath).toBe('./app.db');
   });
 
+  // `sqlite:` / `sqlite://` are aliases of `file:` (the runtime host's
+  // `normalizeDatabaseUrl`): `sqlite://x.db` is `x.db`, never `//x.db`, which
+  // is the filesystem root. The cross-host equality is pinned in
+  // `driver-vocabulary-parity.test.ts`.
+  it.each([
+    ['sqlite://x.db', 'x.db'],
+    ['sqlite:x.db', 'x.db'],
+    ['sqlite:///var/lib/objectstack/x.db', '/var/lib/objectstack/x.db'],
+    ['SQLITE://x.db', 'x.db'],
+  ])('reads %s as the sqlite file %s', (url, file) => {
+    const r = resolveStorageDefinition(resolveDriverType(undefined, url), { databaseUrl: url, isDev: false });
+    expect(r!.config.filename).toBe(file);
+    expect(r!.sqliteFilePath).toBe(file);
+    // The banner keeps what the operator typed.
+    expect(r!.displayUrl).toBe(url);
+  });
+
   it('dev default (no driver) declares sqlite :memory: with NO telemetry sibling', () => {
     const r = resolveStorageDefinition('', { isDev: true });
     expect(r!.driverId).toBe('sqlite');