node:sqlite: backup() unwraps any object as a DatabaseSync, and a duck-typed URL aborts the process

Version

v27.0.0-pre (884f9cd62da)

Platform

Darwin 25.6.0 arm64

Subsystem

sqlite

What steps will reproduce the bug?

node:sqlite's backup() checks that its first argument is an object, then unwraps it. Passing anything other than a DatabaseSync results in a crash:

const { backup } = require('node:sqlite');
backup({}, '/tmp/c1a.db');

Similarly, the DatabaseSync constructor treats any object as a URL if it has a string href. If that href doesn't parse, it crashes:

const { DatabaseSync } = require('node:sqlite');
new DatabaseSync({ href: 'zzz' });

How often does it reproduce? Is there a required condition?

It's consistent.

What is the expected behavior? Why is that the expected behavior?

Both should raise a TypeError.

What do you see instead?

A segfault.

Additional information

No response

node:sqlite の backup() 実装と DatabaseSync コンストラクターから始め、Issue の両方の例を再現します。無効な backup 引数と不正な URL 形式のオブジェクトが segfault を引き起こすのではなく TypeError を発生させ、両方のケースに回帰テストがあることが作業完了の条件です。