@getxflow/cli 1.10.0 → 1.11.0

package/dist/commands/db.js

@@ -295,6 +295,9 @@ async function migrate(client, projectId, migrations, dryRun, allowDestructive,
             (0, ui_1.note)((0, ui_1.dim)(`  ${hit}`));
     }
     if (result.dry_run) {
+        if (result.failed) {
+            throw new errors_1.CliError(`${result.failed.name}: ${result.failed.error}`, 'Checked on a copy of the database: the database is unchanged');
+        }
         if (result.pending.length === 0) {
             (0, ui_1.ok)('Nothing to apply: every migration is already in the database');
             return;
@@ -303,12 +306,18 @@ async function migrate(client, projectId, migrations, dryRun, allowDestructive,
         (0, ui_1.out)(`Will be applied (${result.pending.length}):`);
         for (const name of result.pending)
             (0, ui_1.out)(`  ${name}`);
-        (0, ui_1.note)((0, ui_1.dim)('  Dry run: the database was not changed'));
+        (0, ui_1.note)((0, ui_1.dim)(result.checked
+            ? '  They ran on a copy of the database as it is now; the database was not changed'
+            : result.checked === false
+                ? '  Not checked: a copy of the database could not be made; the database was not changed'
+                : '  Dry run: the database was not changed'));
         return;
     }
     for (const dump of result.dumps) {
         (0, ui_1.note)((0, ui_1.dim)(`  Dump of ${dump.table}: ${dump.rows} rows${dump.truncated ? ' (cut at the cap)' : ''}, kept for ${result.dump_retention_days} days`));
     }
+    if (result.checked)
+        (0, ui_1.note)((0, ui_1.dim)('  Checked on a copy of the database first'));
     if (result.applied.length > 0) {
         (0, ui_1.ok)(`Applied: ${result.applied.join(', ')}`);
     }
@@ -318,7 +327,7 @@ async function migrate(client, projectId, migrations, dryRun, allowDestructive,
     if (result.failed) {
         throw new errors_1.CliError(`${result.failed.name}: ${result.failed.error}`, result.applied.length > 0
             ? `What ran before it stays in the database (${result.applied.join(', ')}), the rest did not run`
-            : 'The database is unchanged: the migration rolled back as a whole');
+            : 'The database is unchanged: nothing was applied');
     }
 }
 /** Time a branch has left, `5h` or `3d`. */

package/dist/commands/deploy.js

@@ -109,7 +109,7 @@ function printNotes(started) {
         (0, ui_1.note)(`  Unfinished: ${item.message}${item.file ? (0, ui_1.dim)(` (${item.file})`) : ''}`);
     }
 }
-async function finishFunctions(client, base, started) {
+async function finishFunctions(client, base, started, rollback) {
     printNotes(started);
     const build = await waitForBuild(client, base, started);
     if (build.phase === 'failed')
@@ -118,6 +118,9 @@ async function finishFunctions(client, base, started) {
     for (const line of openLines(build.log_tail))
         (0, ui_1.warn)(line);
     (0, ui_1.note)((0, ui_1.dim)('  Every app of the project calls the new code already: there is no publish step for functions'));
+    if (rollback) {
+        (0, ui_1.note)((0, ui_1.dim)(`  The database is not rolled back. As it was when this revision first went live: xflow db branch create rev-${build.revision} --at r${build.revision}`));
+    }
 }
 async function finishApp(client, base, started) {
     printNotes(started);
@@ -165,6 +168,7 @@ function targetsHint(projectRoot) {
 async function deployTarget(target, args, comment, revision) {
     const base = (0, sources_1.streamPath)(target);
     const { client } = target;
+    const rollback = revision !== undefined;
     if (revision === undefined) {
         if (!target.root)
             throw new errors_1.CliError('Nothing to send without a folder', 'Build a revision the platform holds: --revision <n>');
@@ -189,7 +193,7 @@ async function deployTarget(target, args, comment, revision) {
     if (target.kind === 'app')
         await finishApp(client, base, started);
     else
-        await finishFunctions(client, base, started);
+        await finishFunctions(client, base, started, rollback);
 }
 async function deploy(args) {
     const stated = statedRevision((0, args_1.flagNumber)(args, 'revision'), (0, args_1.flagBool)(args, 'force'));

package/dist/help.js

@@ -296,7 +296,8 @@ will work.`,
                                    1 on the Free plan (--limit, --cursor for older)
   xflow db branch [list]           branches of the database (--json)
   xflow db branch create <name>    a branch as the database is now; --at 2h, --at 14:05 or
-                                   --at 2026-10-30T14:05+03:00 for a moment of its history;
+                                   --at 2026-10-30T14:05+03:00 for a moment of its history,
+                                   --at r12 for when functions revision 12 went live;
                                    --ttl 12h or --ttl 3d to delete it sooner than the plan does
   xflow db branch extend <name>    more time from now: the plan's longest, or --ttl
   xflow db branch delete <name>    the branch goes, the database is unchanged
@@ -349,9 +350,10 @@ ${(0, ui_1.bold)('migrations/0002_orders.sql')} and so on). The order comes from
 is why the leading number is required. The command first stores the project root as a
 revision, so the migrations stay in its history and a clone gets them, then applies what is
 new. Every migration runs in its own transaction, the history is kept in the database
-itself, and anything already applied is not run again.
+itself, and anything already applied is not run again. New migrations run first, all of them,
+on a copy of the database as it is now: if one fails there, nothing is applied.
 
-  --dry-run              report what would be applied without touching the database
+  --dry-run              run the new migrations on that copy only; the database is not touched
   --allow-destructive    allow operations that destroy data
 
 About destructive ones. ${(0, ui_1.bold)('DROP TABLE')}, ${(0, ui_1.bold)('DROP COLUMN')}, ${(0, ui_1.bold)('TRUNCATE')} and deleting rows (judged by what

package/dist/moment.js

@@ -4,8 +4,10 @@ exports.parseMoment = parseMoment;
 exports.parseTtl = parseTtl;
 const errors_1 = require("./errors");
 const UNIT_MS = { m: 60_000, h: 3_600_000, d: 86_400_000 };
-/** `30m`/`2h`/`1d` ago, `14:05` local (yesterday if still ahead), or an ISO date. */
+/** `30m`/`2h`/`1d` ago, `14:05` local (yesterday if still ahead), an ISO date, or `r12` (the platform resolves it). */
 function parseMoment(text, now = new Date()) {
+    if (/^r\d{1,6}$/.test(text))
+        return text;
     const ago = /^(\d{1,4})([mhd])$/.exec(text);
     if (ago)
         return new Date(now.getTime() - Number(ago[1]) * UNIT_MS[ago[2]]).toISOString();
@@ -19,7 +21,7 @@ function parseMoment(text, now = new Date()) {
     }
     const at = new Date(text);
     if (!/^\d{4}-\d{2}-\d{2}/.test(text) || Number.isNaN(at.getTime())) {
-        throw new errors_1.CliError(`--at ${text} is not a moment`, 'For example: --at 2h (two hours ago), --at 14:05 (today), --at 2026-10-30T14:05+03:00');
+        throw new errors_1.CliError(`--at ${text} is not a moment`, 'For example: --at 2h (two hours ago), --at 14:05 (today), --at 2026-10-30T14:05+03:00, --at r12 (when functions revision 12 went live)');
     }
     return at.toISOString();
 }

package/dist/version.js

@@ -2,6 +2,6 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DEFAULT_API_URL = exports.CLI_VERSION = void 0;
 /** Keep in sync with cli/package.json. */
-exports.CLI_VERSION = '1.10.0';
+exports.CLI_VERSION = '1.11.0';
 /** Overridden by XFLOW_API_URL or the `api` field in xflow.json. */
 exports.DEFAULT_API_URL = 'https://app.getxflow.com';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getxflow/cli",
-  "version": "1.10.0",
+  "version": "1.11.0",
   "description": "CLI for the XFlow platform: projects with apps, functions and a database; source sync, deployment and publishing",
   "license": "UNLICENSED",
   "engines": {

package/skills/xflow/SKILL.md

@@ -28,7 +28,7 @@ instead of guessing; give the person https://docs.getxflow.com when they ask how
 
 ## Keeping these instructions current
 
-These instructions ship with xflow CLI 1.10.0, so the copy you are reading can be older than
+These instructions ship with xflow CLI 1.11.0, so the copy you are reading can be older than
 the CLI answering your commands.
 
 When the CLI says this file does not match it, run `xflow skills --refresh` and then **read
@@ -553,7 +553,8 @@ There is no undo: read the rows with `db query` first.
 
 A branch is a database of its own, as the project database is now or was at a moment of its
 history (6 hours back on Free, 3 days on Start, 7 days on Business), made in seconds without
-copying: `xflow db branch create try-orders [--at 2h|14:05|<ISO date>]`. Try a migration or a fix
+copying: `xflow db branch create try-orders [--at 2h|14:05|<ISO date>|r12]` (`r12`: when functions
+revision 12 went live; rolling functions back with `--revision` leaves the database as it is). Try a migration or a fix
 there first (`db migrate`, `db exec`, `db query` take `--branch <name>`); nothing reaches the
 project database. After a data mistake, do not roll anything back: branch as of a moment before
 it, check the rows with `db query --branch`, then `xflow db restore --from <branch> --table <t>
@@ -562,8 +563,8 @@ it, check the rows with `db query --branch`, then `xflow db restore --from <bran
 5, 15 by plan; delete them when done (`xflow db branch delete <name>`). A branch is deleted on its
 own when its lifetime ends: at most 1, 7 or 30 days by plan, shorter with `--ttl 12h`, more from
 now with `xflow db branch extend <name>`. A branch sleeps after a quiet minute, has no functions,
-and a branch of a branch is not made. People see the branches in Databases, open them there and
-read their data.
+and a branch of a branch is not made. People see the branches in Databases, open them there, read
+their data and bring missing rows back.
 
 Anything that destroys data
 (`DROP TABLE`, `DROP COLUMN`, `TRUNCATE`, `DELETE`) needs both the `--allow-destructive` flag and
@@ -573,7 +574,12 @@ or deleted rows is rolled back, however the SQL was written. `BEGIN`/`COMMIT` in
 refused: each one already runs in its own transaction. When the refusal is about the right, the flag changes nothing: say what
 needs deleting and why, and let the person decide. With both in place the affected tables are
 dumped first (up to 50 000 rows each) and kept for 7 days; getting a dump back is a request to
-the person, no command does it. Check with `--dry-run`.
+the person, no command does it.
+
+New migrations run first, all of them, on a copy of the database as it is now: if one fails
+there, nothing is applied and the database is unchanged, so a half-applied set does not happen.
+`--dry-run` runs only that check. A copy that could not be made is skipped, and the migration goes
+straight to the database as before.
 
 Pass `DATABASE_URL` as is, without an `ssl` option. The database is PostgreSQL 18, so do not
 tune it from migrations: