v0.21.0

This release delivers the Phase 3 operator-intake output contract and the canonical Alteryx One Job Library command family. It is the same code as v0.21.0-rc.1, promoted after that candidate passed its live Alteryx One read sweep.

Upgrade notes

These change what automation sees. See CHANGELOG.md for the full list.

• --output json-full and --error-format are removed. The compact ayx.output.v1 envelope (schema_version/kind) no longer exists; --output json always emits the full, recursively redacted envelope that json-full used to produce. Scripts told by the 0.18.0 or 0.20.0 notes to use json-full must switch to json — the retired flags now exit 2 with a usage error.
• command is a top-level field of every JSON and YAML envelope that has a resolved command, on success and on error (for example one.jobs.runs). Eleven ayx one leaves that used to share a family name now report their own id; the job-group leaves report the canonical one.jobs.* ids through either namespace.
• ayx one job-groups is now a hidden compatibility namespace. Use ayx one jobs. The legacy commands still work this release cycle but are absent from help, catalog and discovery.
• An HTTP 400 carrying ProfilingDataNotFoundException is now not_found (exit 6) instead of validation (exit 2). This is an allowlist, not a *NotFoundException suffix rule.
• ayx one jobs usage mistakes (a job id together with a subcommand, or --profile before the verb) are validation errors (exit 2) instead of internal (exit 70).
• ayx one person count is removed; its vendor endpoint is retired upstream.
• The hidden ayx tui stub that the 0.20.0 notes scheduled for deletion in this release is still present (it only returns a remediation envelope). Its removal moves to 0.22.0.

Job Library commands

Use the Jobs surface for aggregate Job Library entries and their child runs:

ayx one jobs list
ayx one jobs <JOB-ID>
ayx one jobs runs <JOB-ID>
ayx one jobs execute --body request.json

jobs <JOB-ID> shows who ran the job, what triggered it, the workspace, the failure reason, and its flow-run, dataset and snapshot references. jobs runs shows the complete lifecycle, status, timing, warning/error and execution metadata for every child run, including nested values such as the parent job id. jobs list has a single, always-populated NAME column; unnamed jobs get a stable label. JSON remains recursively redacted and carries the provider response without presentation-only labels.

There is no singular child-run detail command: the vendor exposes a child-run collection and a status-only direct child route, not a complete child record endpoint.

Output and operator intake

• Nested response values render as indented human output instead of embedded JSON; text and JSON use aligned canonical command labels.
• Human text escapes control, bidi-override and zero-width characters in provider strings, so an upstream error body cannot forge output lines such as error_code: … or inject terminal escape sequences. JSON is unchanged.
• Colour is decided per stream, so error output redirected to a file contains no ANSI codes.
• Timestamps are shortened for operators only in timestamp fields; machine output retains exact redacted timestamps.
• Named output collections remain explicit opt-in projections.
• Agent Assets remains hidden because its API contract does not support bearer authentication for the supported credential profiles.

Validation

The release is gated by formatting, generated command-surface validation, locked workspace Clippy and nextest on Linux, macOS and Windows, audit, and release builds. Before promotion, it passed code review, three adversarial reviews (command rename, output and redaction, release mechanics) and a re-check of their fixes, and a live Alteryx One read sweep of the packaged Windows v0.21.0-rc.1 artifact: 73 passed, 0 failed, with the two admin-only reads refused as expected for a non-admin profile. The sweep covered the Job Library family on an entry with multiple child runs and the hidden job-groups alias.