v0.11.0

This release consolidates Alteryx Server secrets under a single canonical source and hardens secret storage by eliminating the last paths that could write credentials to disk in plaintext.

Highlights

Server-API secret consolidation

server_api.client_secret is now the single authoritative secret for Alteryx Server connectivity. The legacy api.auth.client_secret and server.curator_api_secret fields are synthesized read-only views of the same value. Mixed-state configs (two representations with different values) are detected at the write boundary and reported without leaking the resolved secret.

Keyring scope stabilized

Keyring accounts are now keyed by the on-disk file stem (standalone profiles) or workspace.env (workspace environments) rather than the mutable profile_name. This prevents orphaned keyring entries when a profile is renamed.

AYX_FORCE_INLINE_SECRETS compile-time gated

The test seam for forcing inline-fallback behavior is now compiled out of release binaries via the test-inline-forcing Cargo feature (non-default, enabled only in ayx-rs dev-dependencies). Release builds have zero occurrences of the override path.

Breaking changes

Config files written by v0.11.0 use client_secret_ref / curator_api_secret_ref for indirect secret storage. They are not readable by older binaries that lack these fields. Existing plaintext configs load correctly on upgrade; the ref form is written on the next save (lazy migration).

Migration notes

After the first save with v0.11.0, a renamed keyring account entry may remain from the old profile_name-scoped scheme. It is harmless. Run ayx secret prune (shipped in v0.11.1, issue #4) to remove these orphaned accounts.

Validation

• cargo fmt --all
• cargo clippy --workspace --all-targets -- -D warnings
• cargo nextest run --workspace --locked (330 tests, 24 live-gated skips)