fix(ops): flag unreadable deploy dates and name the CLI's target

A function whose deploy date is missing or unreadable was compared as
current, so a stale function could pass unnoticed. It is now listed as
changed with "deploy date unknown".

The report label read the linked ref file, but the Supabase CLI prefers
SUPABASE_PROJECT_ID over it, so the label could name a different project
than the one inspected. The label now follows the CLI's order.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: Programcode

docs/operations.md

@@ -65,7 +65,7 @@ Do not enable the staging repository variable before every prerequisite is prese
 
 ## Backend drift check
 
-`npm run backend:status` shows what the current commit has that a Supabase project lacks. It inspects the linked project; `npm run backend:status -- --project-ref <ref>` inspects another one. It runs `supabase migration list` and `supabase functions list` and changes no schema, data, functions, or secrets. To connect to the database, the CLI creates its usual short-lived login role.
+`npm run backend:status` shows what the current commit has that a Supabase project lacks. It inspects the project the Supabase CLI resolves, which is `SUPABASE_PROJECT_ID` when that is set and the linked project otherwise; `npm run backend:status -- --project-ref <ref>` inspects another one. It runs `supabase migration list` and `supabase functions list` and changes no schema, data, functions, or secrets. To connect to the database, the CLI creates its usual short-lived login role.
 
 The comparison uses the committed tree at `HEAD`, so commit or stash local edits first. It reports:
 

scripts/backend-status.mjs

@@ -172,6 +172,11 @@ export function lastChange(root, paths) {
   return { sha: sha.slice(0, 7), time: Number(seconds) * 1000, subject };
 }
 
+/** Deploy time in milliseconds, or NaN when the CLI gave none or an unreadable one. */
+function deployTime(updatedAt) {
+  return typeof updatedAt === "number" ? updatedAt : Date.parse(updatedAt);
+}
+
 export function compareBackend({ local, remoteMigrations, deployedFunctions, changeOf }) {
   const applied = new Set(remoteMigrations);
   const known = new Set(local.migrations);
@@ -188,7 +193,8 @@ export function compareBackend({ local, remoteMigrations, deployedFunctions, cha
       continue;
     }
     const change = changeOf(fn);
-    if (change && change.time > remote.updated_at) stale.push({ name: fn.name, deployed: remote, change });
+    // A deploy date we cannot read must not make a changed function look current.
+    if (change && !(change.time <= deployTime(remote.updated_at))) stale.push({ name: fn.name, deployed: remote, change });
     const expected = local.verifyJwt[fn.name] ?? true;
     if (typeof remote.verify_jwt === "boolean" && remote.verify_jwt !== expected) {
       verifyJwt.push({ name: fn.name, deployed: remote.verify_jwt, expected });
@@ -210,6 +216,11 @@ function formatTime(milliseconds) {
   return `${new Date(milliseconds).toISOString().slice(0, 16).replace("T", " ")} UTC`;
 }
 
+function deployedDate(updatedAt) {
+  const time = deployTime(updatedAt);
+  return Number.isFinite(time) ? `deployed ${formatTime(time)}` : "deploy date unknown";
+}
+
 export function formatReport({ target, local, result, deployedCount, notes }) {
   const lines = [`Backend status: ${target} compared with commit ${local.commit}`, ""];
   const list = (title, items) => {
@@ -227,7 +238,7 @@ export function formatReport({ target, local, result, deployedCount, notes }) {
   list(
     "Changed on this commit after the last deploy",
     result.stale.map(({ name, deployed, change }) =>
-      `${name}: deployed ${formatTime(deployed.updated_at)} (v${deployed.version}); changed ${formatTime(change.time)} in ${change.sha} ${change.subject}`),
+      `${name}: ${deployedDate(deployed.updated_at)} (v${deployed.version}); changed ${formatTime(change.time)} in ${change.sha} ${change.subject}`),
   );
   list(
     "verify_jwt differs from supabase/config.toml",
@@ -260,8 +271,11 @@ export function backendStatus({ root, projectRef }) {
   if (dirty) notes.push("uncommitted changes under supabase/ are not part of this comparison.");
   notes.push("function change dates come from git. A function deployed from a branch before its merge shows as changed; one deployed from an out-of-date checkout looks current.");
 
+  // Same order the Supabase CLI uses: the flag, then SUPABASE_PROJECT_ID, then the linked ref.
   const linkedRefFile = join(root, "supabase/.temp/project-ref");
-  const ref = projectRef ?? (existsSync(linkedRefFile) ? readFileSync(linkedRefFile, "utf8").trim() : "linked project");
+  const ref = projectRef
+    ?? (process.env.SUPABASE_PROJECT_ID?.trim() || null)
+    ?? (existsSync(linkedRefFile) ? readFileSync(linkedRefFile, "utf8").trim() : "linked project");
   const label = KNOWN_PROJECTS[ref];
   const target = label ? `${ref} (${label})` : ref;
 

src/test/scripts/backend-status.test.ts

@@ -22,14 +22,30 @@ function commit(message: string, seconds: number): void {
   }
 }
 
-function runStatus(args: string[]) {
+function runStatus(args: string[], extraEnv: Record<string, string> = {}) {
+  const { SUPABASE_PROJECT_ID: _ignored, ...env } = process.env;
   return spawnSync("node", [SCRIPT, ...args], {
     cwd: root,
     encoding: "utf8",
-    env: { ...process.env, CALL_LOG: join(root, "calls.log"), PATH: `${join(root, "bin")}:${process.env.PATH ?? ""}` },
+    env: { ...env, CALL_LOG: join(root, "calls.log"), PATH: `${join(root, "bin")}:${process.env.PATH ?? ""}`, ...extraEnv },
   });
 }
 
+async function fakeFunctionsList(functions: unknown[]): Promise<void> {
+  const migrations = { migrations: [{ local: "20260101000000", remote: "20260101000000", time: "" }] };
+  await writeFile(
+    join(root, "bin/supabase"),
+    [
+      "#!/usr/bin/env bash",
+      'printf "%s\\n" "$*" >> "$CALL_LOG"',
+      `if [ "$1 $2" = "migration list" ]; then echo '${JSON.stringify(migrations)}'; exit 0; fi`,
+      `if [ "$1 $2" = "functions list" ]; then echo '${JSON.stringify({ functions })}'; exit 0; fi`,
+      "exit 99",
+      "",
+    ].join("\n"),
+  );
+}
+
 beforeEach(async () => {
   root = await mkdtemp(join(tmpdir(), "debatelab-backend-status-"));
   temporaryRoots.push(root);
@@ -119,6 +135,29 @@ it("passes --project-ref to both commands and names known projects", async () =>
   ]);
 });
 
+it("names the project chosen by SUPABASE_PROJECT_ID, which the CLI prefers over the linked ref", async () => {
+  await write("supabase/.temp/project-ref", "uziwdtkzofptihahfooo\n");
+
+  const result = runStatus([], { SUPABASE_PROJECT_ID: STAGING_REF });
+
+  expect(result.stdout).toContain(`Backend status: ${STAGING_REF} (staging) compared with commit`);
+});
+
+it("counts a function whose deploy date is missing or unreadable as changed", async () => {
+  await fakeFunctionsList([
+    { slug: "alpha", version: 4, verify_jwt: false },
+    { slug: "beta", version: 2, updated_at: "not a date", verify_jwt: true },
+    { slug: "gamma", version: 3, updated_at: 9_000_000, verify_jwt: true },
+  ]);
+
+  const result = runStatus([]);
+
+  expect(result.status).toBe(0);
+  expect(result.stdout).toMatch(/Changed on this commit after the last deploy:\n {4}alpha: deploy date unknown \(v4\); changed 1970-01-01 00:33 UTC in [0-9a-f]{7} change shared helper\n {4}beta: deploy date unknown \(v2\); changed 1970-01-01 00:16 UTC in [0-9a-f]{7} initial\n/);
+  expect(result.stdout).not.toMatch(/ {4}gamma:/);
+  expect(result.stdout).toContain("3 pending items.");
+});
+
 it("fails --check only when a migration on this commit is not applied", async () => {
   expect(runStatus(["--check"]).status).toBe(1);