[kotapeter]

Fixes the findings from the agent skill work on 1.11.0.

Safety

• apps suspend, databases suspend, databases reset-password, databases backups restore, api-keys rotate, object-storage rotate-credentials, webhooks roll-secret, apps deployment-hook regenerate and apps deployment-hook disable now fail without --confirm, saying what can't be undone. The refusal goes through the error handler, so it's a JSON error in --json mode. --dry-run works without --confirm.
• env-vars list (apps, static sites, global) hides values unless --show-values is passed; the API returns them decrypted. env-vars create/update no longer echo the value.
• --dry-run masks passwords, secrets and env var values (e.g. databases create --db-password).

Correctness and agent use

• auth status checks the token with /api-keys/validate; a 401 gives logged_in: false, token_rejected: true, any other error exits 1.
• --data can't be combined with body flags (they used to be dropped silently), and now works without the flags it replaces. Before, apps create --data failed unless --name, --cluster and --source were also passed.
• List commands say on stderr when more pages exist (Showing 1-25 of 60. Use --page 2 for the next page.), so stdout stays a plain array.
• apps get includes primary_domain.
• --dry-run on apps processes update, apps env-vars update, static-sites env-vars update and apps deployments cancel; these also validate their IDs now.
• sevalla schema options report mandatory and takesValue instead of required, which only meant "takes a value".
• apps deployments trigger takes --commit, --skip-build-cache and --restart.
• CONTEXT.md lists exactly which commands need --confirm; its apps create examples and the README examples of the protected commands are fixed.

Release: 2.0.0. The second commit has a BREAKING CHANGE: footer, and the repo's squash merge puts the commit messages in the body, so semantic-release picks a major. Keep the title as feat:: this repo uses the default Angular preset, which doesn't parse feat!:, so that title would produce no release at all (checked with @semantic-release/commit-analyzer on the simulated squash message). Don't clear the squash body when merging.

Not included: commands for process exec, maintenance mode, rate limits and egress IPs (separate PR); 13 other mutation commands still lack --dry-run (they reject the flag and do nothing).

Testing

• Lint, typecheck, format, unit tests (98, 14 new: confirm gating and its JSON error, --data, dry-run masking, page hint, hidden env values, schema fields, auth status 401/200/500 with mocked fetch)
• Full e2e against the dev API: 186 passed, 1 skipped (backup restore: no backup on the dev cluster, existing skip)

[github-actions]

🎉 This PR is included in version 2.0.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀