fix(cli): match Go's config validation for inspect report rules

Three parity gaps in how custom `[experimental.inspect.rules]` are loaded, all
grounded in Go's `UnmarshalExact` (config.go:579) under viper's default
`WeaklyTypedInput: true` and its `PersistentPreRunE` config load:

- Validate the rule config BEFORE connecting or writing CSVs. Go loads/validates
  the whole config in PersistentPreRunE (via ParseDatabaseConfig → LoadConfig),
  so a malformed config aborts with zero side effects. The reader now runs at the
  top of the handler, before mkdir/connect/COPY (rules are still applied in the
  summary step). (review: validate-before-COPY)

- Reject a non-array `rules` value the way Go's decodeSlice does under weak
  typing: a scalar (`rules = "foo"`) aborts ("expected a map or struct"); a single
  inline table is wrapped into one rule; an empty table yields no custom rules.
  Previously any non-array silently fell through to the defaults. (review: non-array rules)

- Reject unknown/misspelled keys in a rule table. UnmarshalExact sets mapstructure
  ErrorUnused per-struct, so `fails = "bad"` aborts the load; the reader now fails
  with LegacyDbConfigLoadError instead of silently ignoring extra keys. (review: unknown keys)

Adds unit coverage (unknown key, single inline table, scalar rules) and an
integration test asserting a malformed config aborts before any connection or CSV.

Author: Coly010

apps/cli/src/legacy/commands/inspect/report/report.config.ts

@@ -85,27 +85,65 @@ export const legacyReadInspectRules = Effect.fnUntraced(function* (
 
   const inspect = asRecord(asRecord(doc?.["experimental"])?.["inspect"]);
   const rawRules = inspect?.["rules"];
-  if (!Array.isArray(rawRules)) return [] as ReadonlyArray<LegacyInspectRule>;
+
+  // Normalize `rules` into the list of entries to decode, mirroring Go's
+  // `decodeSlice` under viper's `WeaklyTypedInput: true` (which is NOT disabled in
+  // `config.Load`, `apps/cli-go/pkg/config/config.go:579-584`):
+  //   - absent            → no custom rules (defaults apply)
+  //   - array-of-tables   → decode each element as a rule
+  //   - a single table    → weak-typing wraps it into a 1-element slice → one rule
+  //   - an EMPTY table     → wraps into an empty slice → no custom rules (defaults)
+  //   - a scalar (string/number/…) → wrapped into `[scalar]`, then decoding a scalar
+  //     into a rule struct aborts ("expected a map or struct") — surfaced below.
+  let entries: ReadonlyArray<unknown>;
+  if (rawRules === undefined) {
+    return [] as ReadonlyArray<LegacyInspectRule>;
+  } else if (Array.isArray(rawRules)) {
+    entries = rawRules;
+  } else {
+    const asMap = asRecord(rawRules);
+    if (asMap !== undefined && Object.keys(asMap).length === 0) {
+      return [] as ReadonlyArray<LegacyInspectRule>;
+    }
+    entries = [rawRules];
+  }
+  if (entries.length === 0) return [] as ReadonlyArray<LegacyInspectRule>;
+
+  const RULE_FIELDS = ["query", "name", "pass", "fail"] as const;
 
   // Resolve `env(VAR)` against the shell env first, then the project `.env` files.
   const projectEnv = yield* legacyLoadProjectEnv(fs, path, workdir);
   const lookup = (name: string): string | undefined => process.env[name] ?? projectEnv[name];
 
   const rules: Array<LegacyInspectRule> = [];
-  for (let index = 0; index < rawRules.length; index++) {
-    const record = asRecord(rawRules[index]);
-    // A non-table array entry (e.g. `rules = ["foo"]`) is rejected by Go: mapstructure
-    // routes the element into `decodeStruct`, whose default branch returns "expected a
-    // map or struct", aborting `config.Load`. Match that rather than silently skipping.
+  for (let index = 0; index < entries.length; index++) {
+    const record = asRecord(entries[index]);
+    // A non-table entry (e.g. `rules = ["foo"]` or `rules = "foo"`) is rejected by Go:
+    // mapstructure routes it into `decodeStruct`, whose default branch returns
+    // "expected a map or struct", aborting `config.Load`. Match that, not silent skip.
     if (record === undefined) {
       return yield* Effect.fail(
         new LegacyDbConfigLoadError({
           message: `failed to load config: experimental.inspect.rules[${index}] expected a map or struct`,
         }),
       );
     }
+    // Go decodes with `UnmarshalExact` (`config.go:579`), which sets mapstructure's
+    // `ErrorUnused` per-struct: an unknown/misspelled key in a rule table (e.g.
+    // `fails = "bad"`) aborts the whole config load. The `rule` struct has no
+    // `,remain` field, so there is no escape hatch.
+    const unknownKeys = Object.keys(record).filter(
+      (key) => !(RULE_FIELDS as ReadonlyArray<string>).includes(key),
+    );
+    if (unknownKeys.length > 0) {
+      return yield* Effect.fail(
+        new LegacyDbConfigLoadError({
+          message: `failed to load config: experimental.inspect.rules[${index}] has invalid keys: ${unknownKeys.join(", ")}`,
+        }),
+      );
+    }
     const fields: Record<string, string> = {};
-    for (const field of ["query", "name", "pass", "fail"] as const) {
+    for (const field of RULE_FIELDS) {
       const coerced = coerceRuleField(record[field]);
       // A non-coercible field type (nested table/array/datetime) aborts in Go too.
       if (coerced === undefined) {

apps/cli/src/legacy/commands/inspect/report/report.config.unit.test.ts

@@ -121,6 +121,60 @@ describe("legacyReadInspectRules", () => {
     }),
   );
 
+  it.effect("rejects unknown keys in a rule table (Go's UnmarshalExact ErrorUnused)", () =>
+    Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        readRules(
+          makeWorkdir(
+            [
+              "[[experimental.inspect.rules]]",
+              'query = "SELECT 1"',
+              'name = "r"',
+              'pass = "ok"',
+              'fail = "bad"',
+              'fails = "typo"',
+              "",
+            ].join("\n"),
+          ),
+        ),
+      );
+      expect(exit._tag).toBe("Failure");
+      if (exit._tag === "Failure") {
+        expect(JSON.stringify(exit.cause)).toContain("invalid keys: fails");
+      }
+    }),
+  );
+
+  it.effect("accepts a single inline rules table as one rule (Go weak-typing wrap)", () =>
+    Effect.gen(function* () {
+      const rules = yield* readRules(
+        makeWorkdir(
+          [
+            "[experimental.inspect.rules]",
+            'query = "SELECT 1"',
+            'name = "solo"',
+            'pass = "ok"',
+            'fail = "bad"',
+            "",
+          ].join("\n"),
+        ),
+      );
+      expect(rules).toEqual([{ query: "SELECT 1", name: "solo", pass: "ok", fail: "bad" }]);
+    }),
+  );
+
+  it.effect("fails when rules is a scalar string (Go aborts)", () =>
+    Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        readRules(makeWorkdir('[experimental.inspect]\nrules = "oops"\n')),
+      );
+      expect(exit._tag).toBe("Failure");
+      if (exit._tag === "Failure") {
+        expect(JSON.stringify(exit.cause)).toContain("expected a map or struct");
+      }
+    }),
+  );
+
   it.effect("fails when a rule field is a non-coercible type (nested table)", () =>
     Effect.gen(function* () {
       const exit = yield* Effect.exit(

apps/cli/src/legacy/commands/inspect/report/report.handler.ts

@@ -85,6 +85,13 @@ const legacyRunInspectReport = Effect.fnUntraced(function* (
     );
   }
 
+  // Read + validate the custom `[experimental.inspect.rules]` BEFORE any DB work.
+  // Go loads and validates the whole config in `PersistentPreRunE` (via
+  // `flags.ParseDatabaseConfig` → `LoadConfig`, `cmd/root.go:118`), so a malformed
+  // `inspect.rules` config aborts before connecting or writing any CSV files. They
+  // are applied later (in `printSummary`), but validated here for parity.
+  const configRules = yield* legacyReadInspectRules(fs, path, cliConfig.workdir);
+
   // Go's `--linked` defaults to true, so absence of the others resolves to linked.
   const linked = flags.linked || (Option.isNone(flags.dbUrl) && !flags.local);
   const cfg = yield* resolver.resolve({
@@ -146,8 +153,8 @@ const legacyRunInspectReport = Effect.fnUntraced(function* (
     yield* output.raw(`Reports saved to ${legacyBold(outDir, tty.stdoutIsTty)}\n`, "stderr");
   }
 
-  // Custom `[experimental.inspect.rules]` replace the 7 defaults when present.
-  const configRules = yield* legacyReadInspectRules(fs, path, cliConfig.workdir);
+  // Custom `[experimental.inspect.rules]` (read + validated up front) replace the 7
+  // defaults when present.
   const rules = configRules.length > 0 ? configRules : LEGACY_DEFAULT_INSPECT_RULES;
   if (configRules.length === 0 && isText) {
     yield* output.raw("Loading default rules...\n", "stderr");

apps/cli/src/legacy/commands/inspect/report/report.integration.test.ts

@@ -340,6 +340,38 @@ describe("legacy inspect report", () => {
     }).pipe(Effect.provide(layer));
   });
 
+  it.live("aborts on a malformed config.toml before connecting or writing any CSV", () => {
+    const base = tempDir("supabase-report-out-");
+    const workdir = tempDir("supabase-report-workdir-");
+    mkdirSync(join(workdir, "supabase"), { recursive: true });
+    // An invalid rule config (unknown key) — Go loads config in PersistentPreRun, so
+    // it must abort before the DB connection and before any CSV files are written.
+    writeFileSync(
+      join(workdir, "supabase", "config.toml"),
+      [
+        "[[experimental.inspect.rules]]",
+        'query = "SELECT 1"',
+        'name = "r"',
+        'pass = "ok"',
+        'fail = "bad"',
+        'typo = "x"',
+        "",
+      ].join("\n"),
+    );
+    const { layer, connection } = setupLegacyReport({ workdir });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(legacyInspectReport(flags({ outputDir: base })));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(JSON.stringify(exit.cause)).toContain("invalid keys: typo");
+      }
+      // No connection and no dated output folder — config validation ran first,
+      // before mkdir / connect / COPY (base itself is the pre-created temp dir).
+      expect(connection.copiedSql.length).toBe(0);
+      expect(readdirSync(base).length).toBe(0);
+    }).pipe(Effect.provide(layer));
+  });
+
   it.live("emits a structured result and writes CSVs but no table in json mode", () => {
     const base = tempDir("supabase-report-out-");
     const { layer, out } = setupLegacyReport({ format: "json", csvs: DEFAULT_RULE_CSVS });