@getxflow/cli 1.9.0 → 1.11.0

package/dist/commands/db.js

@@ -295,6 +295,9 @@ async function migrate(client, projectId, migrations, dryRun, allowDestructive,
             (0, ui_1.note)((0, ui_1.dim)(`  ${hit}`));
     }
     if (result.dry_run) {
+        if (result.failed) {
+            throw new errors_1.CliError(`${result.failed.name}: ${result.failed.error}`, 'Checked on a copy of the database: the database is unchanged');
+        }
         if (result.pending.length === 0) {
             (0, ui_1.ok)('Nothing to apply: every migration is already in the database');
             return;
@@ -303,12 +306,18 @@ async function migrate(client, projectId, migrations, dryRun, allowDestructive,
         (0, ui_1.out)(`Will be applied (${result.pending.length}):`);
         for (const name of result.pending)
             (0, ui_1.out)(`  ${name}`);
-        (0, ui_1.note)((0, ui_1.dim)('  Dry run: the database was not changed'));
+        (0, ui_1.note)((0, ui_1.dim)(result.checked
+            ? '  They ran on a copy of the database as it is now; the database was not changed'
+            : result.checked === false
+                ? '  Not checked: a copy of the database could not be made; the database was not changed'
+                : '  Dry run: the database was not changed'));
         return;
     }
     for (const dump of result.dumps) {
         (0, ui_1.note)((0, ui_1.dim)(`  Dump of ${dump.table}: ${dump.rows} rows${dump.truncated ? ' (cut at the cap)' : ''}, kept for ${result.dump_retention_days} days`));
     }
+    if (result.checked)
+        (0, ui_1.note)((0, ui_1.dim)('  Checked on a copy of the database first'));
     if (result.applied.length > 0) {
         (0, ui_1.ok)(`Applied: ${result.applied.join(', ')}`);
     }
@@ -318,9 +327,14 @@ async function migrate(client, projectId, migrations, dryRun, allowDestructive,
     if (result.failed) {
         throw new errors_1.CliError(`${result.failed.name}: ${result.failed.error}`, result.applied.length > 0
             ? `What ran before it stays in the database (${result.applied.join(', ')}), the rest did not run`
-            : 'The database is unchanged: the migration rolled back as a whole');
+            : 'The database is unchanged: nothing was applied');
     }
 }
+/** Time a branch has left, `5h` or `3d`. */
+function left(iso) {
+    const h = Math.max(0, Math.round((Date.parse(iso) - Date.now()) / 3_600_000));
+    return h < 48 ? `${h}h left` : `${Math.round(h / 24)}d left`;
+}
 /** Branches of the project database: list, create, delete. */
 async function dbBranch(args) {
     const [sub, name] = args.words;
@@ -329,7 +343,7 @@ async function dbBranch(args) {
     if (sub === undefined || sub === 'list') {
         const data = await (0, api_1.apiJson)(client, path);
         if ((0, args_1.flagBool)(args, 'json')) {
-            (0, ui_1.out)(JSON.stringify(data.branches, null, 2));
+            (0, ui_1.out)(JSON.stringify(data, null, 2));
             return;
         }
         if (data.branches.length === 0) {
@@ -337,16 +351,18 @@ async function dbBranch(args) {
             (0, ui_1.note)((0, ui_1.dim)('  A copy to try things on: xflow db branch create <name> [--at 2h]'));
             return;
         }
-        (0, ui_1.table)(data.branches.map((b) => [b.name, b.at ? `as of ${new Date(b.at).toLocaleString()}` : 'as made', (0, ui_1.formatAge)(b.created_at)]));
+        (0, ui_1.table)(data.branches.map((b) => [b.name, b.at ? `as of ${new Date(b.at).toLocaleString()}` : 'as made', (0, ui_1.formatAge)(b.created_at), left(b.expires_at)]));
+        (0, ui_1.note)((0, ui_1.dim)(`  ${data.branches.length} of ${data.plan.branches}; a branch lives up to ${data.plan.ttl_hours / 24}d on this plan (xflow db branch extend <name>)`));
         return;
     }
     if (!name)
         throw new errors_1.CliError(`xflow db branch ${sub} needs a name`, `For example: xflow db branch ${sub} fix-orders`);
     if (sub === 'create') {
         const at = (0, args_1.flagString)(args, 'at');
+        const ttl = (0, args_1.flagString)(args, 'ttl');
         const data = await (0, api_1.apiJson)(client, path, {
             method: 'POST',
-            body: { name, at: at ? (0, moment_1.parseMoment)(at) : undefined },
+            body: { name, at: at ? (0, moment_1.parseMoment)(at) : undefined, ttl_hours: ttl ? (0, moment_1.parseTtl)(ttl) : undefined },
             timeoutMs: 180_000,
         });
         if ((0, args_1.flagBool)(args, 'json')) {
@@ -356,6 +372,20 @@ async function dbBranch(args) {
         (0, ui_1.ok)(`Branch ${name}: the project database ${data.branch.at ? `as of ${new Date(data.branch.at).toLocaleString()}` : 'as it is now'}`);
         (0, ui_1.note)((0, ui_1.dim)(`  Work in it: xflow db query --branch ${name} '...', db exec and db migrate take --branch too`));
         (0, ui_1.note)((0, ui_1.dim)(`  Rows back into the project database: xflow db restore --from ${name} --table <table>`));
+        (0, ui_1.note)((0, ui_1.dim)(`  Deleted on its own in ${left(data.branch.expires_at)}; more time: xflow db branch extend ${name}`));
+        return;
+    }
+    if (sub === 'extend') {
+        const ttl = (0, args_1.flagString)(args, 'ttl');
+        const data = await (0, api_1.apiJson)(client, `${path}/${encodeURIComponent(name)}`, {
+            method: 'PATCH',
+            body: { ttl_hours: ttl ? (0, moment_1.parseTtl)(ttl) : undefined },
+        });
+        if ((0, args_1.flagBool)(args, 'json')) {
+            (0, ui_1.out)(JSON.stringify(data.branch, null, 2));
+            return;
+        }
+        (0, ui_1.ok)(`Branch ${name}: ${left(data.branch.expires_at)}, until ${new Date(data.branch.expires_at).toLocaleString()}`);
         return;
     }
     if (sub === 'delete' || sub === 'rm') {
@@ -363,7 +393,7 @@ async function dbBranch(args) {
         (0, ui_1.ok)(`Branch ${name} deleted; the project database is unchanged`);
         return;
     }
-    throw new errors_1.CliError(`Unknown command: db branch ${sub}`, 'Available: list, create and delete');
+    throw new errors_1.CliError(`Unknown command: db branch ${sub}`, 'Available: list, create, extend and delete');
 }
 /** Rows of a table from a branch back into the project database, by primary key. */
 async function dbRestore(args) {

package/dist/commands/deploy.js

@@ -109,7 +109,7 @@ function printNotes(started) {
         (0, ui_1.note)(`  Unfinished: ${item.message}${item.file ? (0, ui_1.dim)(` (${item.file})`) : ''}`);
     }
 }
-async function finishFunctions(client, base, started) {
+async function finishFunctions(client, base, started, rollback) {
     printNotes(started);
     const build = await waitForBuild(client, base, started);
     if (build.phase === 'failed')
@@ -118,6 +118,9 @@ async function finishFunctions(client, base, started) {
     for (const line of openLines(build.log_tail))
         (0, ui_1.warn)(line);
     (0, ui_1.note)((0, ui_1.dim)('  Every app of the project calls the new code already: there is no publish step for functions'));
+    if (rollback) {
+        (0, ui_1.note)((0, ui_1.dim)(`  The database is not rolled back. As it was when this revision first went live: xflow db branch create rev-${build.revision} --at r${build.revision}`));
+    }
 }
 async function finishApp(client, base, started) {
     printNotes(started);
@@ -165,6 +168,7 @@ function targetsHint(projectRoot) {
 async function deployTarget(target, args, comment, revision) {
     const base = (0, sources_1.streamPath)(target);
     const { client } = target;
+    const rollback = revision !== undefined;
     if (revision === undefined) {
         if (!target.root)
             throw new errors_1.CliError('Nothing to send without a folder', 'Build a revision the platform holds: --revision <n>');
@@ -189,7 +193,7 @@ async function deployTarget(target, args, comment, revision) {
     if (target.kind === 'app')
         await finishApp(client, base, started);
     else
-        await finishFunctions(client, base, started);
+        await finishFunctions(client, base, started, rollback);
 }
 async function deploy(args) {
     const stated = statedRevision((0, args_1.flagNumber)(args, 'revision'), (0, args_1.flagBool)(args, 'force'));

package/dist/flags.js

@@ -82,8 +82,8 @@ exports.KNOWN = {
     'db exec': ['allow-destructive', 'json', 'project', 'branch'],
     'db logs': ['limit', 'project', 'cursor'],
     'db migrate': ['dry-run', 'allow-destructive', 'branch'],
-    'db branch': ['at', 'json', 'project'],
-    'db branches': ['at', 'json', 'project'],
+    'db branch': ['at', 'json', 'project', 'ttl'],
+    'db branches': ['at', 'json', 'project', 'ttl'],
     'db restore': ['from', 'table', 'where', 'overwrite', 'json', 'project'],
     storage: ['json', 'project'],
     'storage ls': ['json', 'project'],

package/dist/help.js

@@ -296,7 +296,10 @@ will work.`,
                                    1 on the Free plan (--limit, --cursor for older)
   xflow db branch [list]           branches of the database (--json)
   xflow db branch create <name>    a branch as the database is now; --at 2h, --at 14:05 or
-                                   --at 2026-10-30T14:05+03:00 for a moment of its history
+                                   --at 2026-10-30T14:05+03:00 for a moment of its history,
+                                   --at r12 for when functions revision 12 went live;
+                                   --ttl 12h or --ttl 3d to delete it sooner than the plan does
+  xflow db branch extend <name>    more time from now: the plan's longest, or --ttl
   xflow db branch delete <name>    the branch goes, the database is unchanged
   xflow db restore --from <branch> --table <table> [--where '...'] [--overwrite]
                                    rows of a table from a branch back into the database
@@ -331,7 +334,9 @@ ${(0, ui_1.bold)('query')}, ${(0, ui_1.bold)('exec')} and ${(0, ui_1.bold)('migr
 reaches the project database. A branch sleeps after a quiet minute, so its first query takes a
 second or two; it has no functions and no history of its own, and a branch of a branch is not
 made. Branches per project: 2 on Free, 5 on Start, 15 on Business; delete one you no longer need.
-The history reaches back 6 hours on Free, 3 days on Start, 7 days on Business.
+A branch is deleted on its own when its lifetime ends: at most 1 day on Free, 7 days on Start,
+30 days on Business, and ${(0, ui_1.bold)('extend')} gives it more from now within that. The history reaches
+back 6 hours on Free, 3 days on Start, 7 days on Business.
 
 ${(0, ui_1.bold)('restore')} puts rows back after a mistake without rolling the whole database back: make a
 branch as of a moment before it, check the rows there with ${(0, ui_1.bold)('query --branch')}, then restore
@@ -345,9 +350,10 @@ ${(0, ui_1.bold)('migrations/0002_orders.sql')} and so on). The order comes from
 is why the leading number is required. The command first stores the project root as a
 revision, so the migrations stay in its history and a clone gets them, then applies what is
 new. Every migration runs in its own transaction, the history is kept in the database
-itself, and anything already applied is not run again.
+itself, and anything already applied is not run again. New migrations run first, all of them,
+on a copy of the database as it is now: if one fails there, nothing is applied.
 
-  --dry-run              report what would be applied without touching the database
+  --dry-run              run the new migrations on that copy only; the database is not touched
   --allow-destructive    allow operations that destroy data
 
 About destructive ones. ${(0, ui_1.bold)('DROP TABLE')}, ${(0, ui_1.bold)('DROP COLUMN')}, ${(0, ui_1.bold)('TRUNCATE')} and deleting rows (judged by what

package/dist/limits.js

@@ -54,7 +54,7 @@ const QUOTA_LABELS = {
     people: 'People',
     space_mb: 'Space (databases and files together)',
     function_minutes: 'Function minutes',
-    db_hours: 'Database hours',
+    db_hours: 'Database GB-hours',
     builds: 'Builds this month',
 };
 /** Decimal units, 1000 MB per GB: matches how volumes are sold. */

package/dist/moment.js

@@ -1,10 +1,13 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.parseMoment = parseMoment;
+exports.parseTtl = parseTtl;
 const errors_1 = require("./errors");
 const UNIT_MS = { m: 60_000, h: 3_600_000, d: 86_400_000 };
-/** `30m`/`2h`/`1d` ago, `14:05` local (yesterday if still ahead), or an ISO date. */
+/** `30m`/`2h`/`1d` ago, `14:05` local (yesterday if still ahead), an ISO date, or `r12` (the platform resolves it). */
 function parseMoment(text, now = new Date()) {
+    if (/^r\d{1,6}$/.test(text))
+        return text;
     const ago = /^(\d{1,4})([mhd])$/.exec(text);
     if (ago)
         return new Date(now.getTime() - Number(ago[1]) * UNIT_MS[ago[2]]).toISOString();
@@ -18,7 +21,14 @@ function parseMoment(text, now = new Date()) {
     }
     const at = new Date(text);
     if (!/^\d{4}-\d{2}-\d{2}/.test(text) || Number.isNaN(at.getTime())) {
-        throw new errors_1.CliError(`--at ${text} is not a moment`, 'For example: --at 2h (two hours ago), --at 14:05 (today), --at 2026-10-30T14:05+03:00');
+        throw new errors_1.CliError(`--at ${text} is not a moment`, 'For example: --at 2h (two hours ago), --at 14:05 (today), --at 2026-10-30T14:05+03:00, --at r12 (when functions revision 12 went live)');
     }
     return at.toISOString();
 }
+/** A branch lifetime in whole hours: `12h` or `3d`. */
+function parseTtl(text) {
+    const m = /^(\d{1,4})([hd])$/.exec(text);
+    if (!m || Number(m[1]) < 1)
+        throw new errors_1.CliError(`--ttl ${text} is not a lifetime`, 'For example: --ttl 12h or --ttl 3d');
+    return Number(m[1]) * (m[2] === 'd' ? 24 : 1);
+}

package/dist/version.js

@@ -2,6 +2,6 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DEFAULT_API_URL = exports.CLI_VERSION = void 0;
 /** Keep in sync with cli/package.json. */
-exports.CLI_VERSION = '1.9.0';
+exports.CLI_VERSION = '1.11.0';
 /** Overridden by XFLOW_API_URL or the `api` field in xflow.json. */
 exports.DEFAULT_API_URL = 'https://app.getxflow.com';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getxflow/cli",
-  "version": "1.9.0",
+  "version": "1.11.0",
   "description": "CLI for the XFlow platform: projects with apps, functions and a database; source sync, deployment and publishing",
   "license": "UNLICENSED",
   "engines": {

package/skills/xflow/SKILL.md

@@ -28,7 +28,7 @@ instead of guessing; give the person https://docs.getxflow.com when they ask how
 
 ## Keeping these instructions current
 
-These instructions ship with xflow CLI 1.9.0, so the copy you are reading can be older than
+These instructions ship with xflow CLI 1.11.0, so the copy you are reading can be older than
 the CLI answering your commands.
 
 When the CLI says this file does not match it, run `xflow skills --refresh` and then **read
@@ -119,7 +119,8 @@ schedules may run, and which access levels an app may have. The number of functi
 and projects is not capped; at most 15 new projects a day (UTC) per organization, deleted ones count. Most are finite; a plan
 may leave one uncapped, and then `whoami` prints `no limit` instead of a ceiling.
 A paid plan comes in packages (Start S/M/L, Business M/L/XL): the package sets the space,
-database hours and function minutes, the plan sets the rest. More space is a bigger package
+database GB-hours (1 GB of memory a database actually uses for an hour awake; a sleeping
+one uses none) and function minutes, the plan sets the rest. More space is a bigger package
 chosen by a person in «Тариф» (Plan); there is no separate purchase of space.
 `xflow whoami` prints every one of them next to what is used, and the rights of your own key
 with them: destroying data (a migration or `db exec`), deleting files from storage, moving a database and
@@ -552,14 +553,18 @@ There is no undo: read the rows with `db query` first.
 
 A branch is a database of its own, as the project database is now or was at a moment of its
 history (6 hours back on Free, 3 days on Start, 7 days on Business), made in seconds without
-copying: `xflow db branch create try-orders [--at 2h|14:05|<ISO date>]`. Try a migration or a fix
+copying: `xflow db branch create try-orders [--at 2h|14:05|<ISO date>|r12]` (`r12`: when functions
+revision 12 went live; rolling functions back with `--revision` leaves the database as it is). Try a migration or a fix
 there first (`db migrate`, `db exec`, `db query` take `--branch <name>`); nothing reaches the
 project database. After a data mistake, do not roll anything back: branch as of a moment before
 it, check the rows with `db query --branch`, then `xflow db restore --from <branch> --table <t>
 [--where '...']` puts the missing rows back by primary key and keeps all newer data
 (`--overwrite` replaces rows still there and needs the destroy right). Branches per project: 2,
-5, 15 by plan; delete them when done (`xflow db branch delete <name>`). A branch sleeps after a
-quiet minute, has no functions, and a branch of a branch is not made.
+5, 15 by plan; delete them when done (`xflow db branch delete <name>`). A branch is deleted on its
+own when its lifetime ends: at most 1, 7 or 30 days by plan, shorter with `--ttl 12h`, more from
+now with `xflow db branch extend <name>`. A branch sleeps after a quiet minute, has no functions,
+and a branch of a branch is not made. People see the branches in Databases, open them there, read
+their data and bring missing rows back.
 
 Anything that destroys data
 (`DROP TABLE`, `DROP COLUMN`, `TRUNCATE`, `DELETE`) needs both the `--allow-destructive` flag and
@@ -569,7 +574,12 @@ or deleted rows is rolled back, however the SQL was written. `BEGIN`/`COMMIT` in
 refused: each one already runs in its own transaction. When the refusal is about the right, the flag changes nothing: say what
 needs deleting and why, and let the person decide. With both in place the affected tables are
 dumped first (up to 50 000 rows each) and kept for 7 days; getting a dump back is a request to
-the person, no command does it. Check with `--dry-run`.
+the person, no command does it.
+
+New migrations run first, all of them, on a copy of the database as it is now: if one fails
+there, nothing is applied and the database is unchanged, so a half-applied set does not happen.
+`--dry-run` runs only that check. A copy that could not be made is skipped, and the migration goes
+straight to the database as before.
 
 Pass `DATABASE_URL` as is, without an `ssl` option. The database is PostgreSQL 18, so do not
 tune it from migrations: