You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
**BREAKING (`os cloud login --json` stdout wire shape):** it is now an NDJSON
6
+
stream, one compact JSON document per line, and it emits a verification-URL
7
+
record it never used to emit at all (#6730).
8
+
9
+
`os cloud login --json` passed `silent: true` into the device flow and nothing
10
+
else. Formally that was impeccable — stdout carried exactly one JSON document
11
+
and `JSON.parse(<entire stdout>)` read it. Measured against a live RFC 8628
12
+
endpoint, the whole of stdout for an interactive `--json --no-browser` run was:
13
+
14
+
```
15
+
{
16
+
"success": true,
17
+
"email": "user@example.com",
18
+
"userId": "usr_…",
19
+
"url": "https://cloud.objectos.ai"
20
+
}
21
+
```
22
+
23
+
The verification URL appeared nowhere — not on stdout, not on stderr. `silent`
24
+
suppressed the human-readable print and put nothing in its place, so the one
25
+
thing device flow exists to give a script (the URL, while there is still time to
26
+
act on it) was withheld from the only caller that cannot ask a human for it. A
27
+
consumer received a well-formed document describing an authorization it had no
28
+
way to trigger.
29
+
30
+
`os cloud login --json` is now a **newline-delimited JSON stream**: one compact
31
+
document per line, on every path — the device-authorization record, the
32
+
`--email`/`--password` result, the already-logged-in notice, and the
33
+
`{"success":false,"error":"…"}` failure record alike. The device record is
34
+
field-identical to the one `os login --json` emits (#6531), so one consumer
35
+
reads both commands.
36
+
37
+
This is the second and last of the CLI's **declared exceptions** to "`--json`
38
+
means exactly one JSON document on stdout" (#6217) — `os login` is the other,
39
+
and they are now the same exception rather than two answers to one question.
40
+
Both are declared rather than silent: the `--json` flag's `--help` text says so,
41
+
and so do the CLI reference page (`os cloud login --json` is NDJSON) and the
42
+
cloud publish flow on the deployment page. **Parse this command's stdout line by
43
+
line.**
44
+
45
+
### What breaks, and what to change
46
+
47
+
Unlike `os login`, whose device-flow output was unparseable in any shape and so
48
+
had no consumers to break, `os cloud login --json` worked today. If you consume
49
+
it:
50
+
51
+
-**Interactive/device-flow runs now emit two lines instead of one.**
52
+
`JSON.parse(<entire stdout>)` throws on the second document. Read the stream a
53
+
line at a time and act on the record you care about — the device record is the
54
+
one carrying `verification_uri`, the result the one carrying `success`.
55
+
-**Unattended runs are the safest migration and were already correct.**
56
+
`os cloud login --email … --password …` never enters the device flow and still
57
+
emits exactly one record; the only change there is that it is compact rather
58
+
than 2-space indented, which `JSON.parse` reads identically.
59
+
-**Exit codes are unchanged**: `1` on a login failure, `0` otherwise.
60
+
61
+
### Why `minor` and not `patch`
62
+
63
+
Deliberately not the `patch`#6531/PR #6727 took. That bump rested on "nothing
64
+
that previously worked stops working", which was true there — the output was
65
+
unreadable before. It is false here: a single-document reader of
66
+
`os cloud login --json` works today and stops working on the device-flow path.
67
+
The bump follows the wire shape, not the size of the diff.
68
+
69
+
`major` is not the alternative: every publishable package versions in lockstep,
70
+
so during the launch window a breaking change ships as `minor` by convention and
71
+
`scripts/check-changeset-no-major.mjs` enforces it. `minor` is therefore the
72
+
highest bump this change can carry, and the disclosure above — not the number —
73
+
is what has to do the work of warning a consumer.
74
+
75
+
<!-- adr-0087: not-required (no-migration-prescription) what changes is one CLI command's stdout STREAM shape. No authorable key, no exported symbol and no stored value moves: `packages/spec` is untouched, no metadata schema gains or loses a key, and nothing an app authored or persisted becomes invalid or unparseable — so `objectstack migrate meta` has nothing to convert and neither `spec-changes.json` nor the generated upgrade guide has anything to carry. The consumer action prescribed above is rewriting a SCRIPT that reads this command's stdout (parse line by line instead of one `JSON.parse`), which is a channel the ADR-0087 ledger does not serve at all; the channels that do reach those readers are this changeset's own CHANGELOG text, the `--json` `--help` line, and the CLI reference page — all three shipped with this change. -->
description: 'Re-authenticate even if cloud credentials already exist',
94
167
default: false,
95
168
}),
96
-
json: Flags.boolean({description: 'Output as JSON'}),
169
+
json: Flags.boolean({
170
+
description:
171
+
'Machine-readable output as NDJSON — one compact JSON document per line. Unlike every other ObjectStack command, whose --json stdout is a single document, this one is a stream: the device flow reports the verification URL as its own record BEFORE you authorize, then the result as a second record. Parse stdout line by line. `os login --json` is the same exception with the same shape.',
0 commit comments