feat(cli): move upload/download under kfl secrets

README.md

@@ -38,13 +38,13 @@ kfl projects create my-api
 kfl env create production --project my-api
 
 # Upload secrets from a .env file
-kfl upload .env.production --project my-api --env production
+kfl secrets upload .env.production --project my-api --env production
 
 # Inject secrets into a command
 kfl run --project my-api --env production -- npm run build
 
 # Download secrets as .env file
-kfl download --project my-api --env production --output .env
+kfl secrets download --project my-api --env production --output .env
 ```
 
 ## Documentation

docs/cli/overview.mdx

@@ -163,37 +163,26 @@ kfl secrets list --project <name> --env <env>
 
 # Delete a secret
 kfl secrets delete <KEY> --project <name> --env <env>
-```
-
----
 
-### `kfl upload`
+# Upload from .env (full override)
+kfl secrets upload <file> --project <name> --env <env>
 
-Upload a `.env` file (full override).
-
-```bash
-kfl upload <file> --project <name> --env <env>
+# Download secrets
+kfl secrets download --project <name> --env <env> [options]
 ```
 
 <Warning>
   Upload replaces ALL existing secrets in the target environment.
 </Warning>
 
----
-
-### `kfl download`
-
-Download secrets in various formats.
-
-```bash
-kfl download --project <name> --env <env> [options]
-```
 
 | Option            | Description                                             |
 | ----------------- | ------------------------------------------------------- |
 | `--format <fmt>`  | Output format: `env` (default), `json`, `yaml`, `shell` |
 | `--output <file>` | Write to file (default: stdout)                         |
 
+Legacy aliases are still available but deprecated: `kfl upload`, `kfl download`.
+
 ---
 
 ### `kfl run`
@@ -268,4 +257,4 @@ kfl keys revoke <prefix>
 | 2    | Authentication error |
 | 3    | Authorization error  |
 | 4    | Resource not found   |
-| 5    | Network error        |
+| 5    | Network error        |

docs/guides/secrets.mdx

@@ -32,7 +32,7 @@ kfl secrets set \
 Upload an entire `.env` file. **This is a full override** — all existing secrets are replaced.
 
 ```bash
-kfl upload .env.production --project my-api --env production
+kfl secrets upload .env.production --project my-api --env production
 ```
 
 <Warning>
@@ -113,4 +113,4 @@ kfl run -- npm run dev
   <Card href="/guides/api-keys" title="API Keys">
     Create scoped keys for CI/CD and services.
   </Card>
-</CardGroup>
+</CardGroup>

docs/guides/using-secrets.mdx

@@ -9,16 +9,16 @@ Download secrets in various formats:
 
 ```bash
 # As .env format (default)
-kfl download --project my-api --env production
+kfl secrets download --project my-api --env production
 
 # As JSON
-kfl download --project my-api --env production --format json
+kfl secrets download --project my-api --env production --format json
 
 # As YAML
-kfl download --project my-api --env production --format yaml
+kfl secrets download --project my-api --env production --format yaml
 
 # To a file
-kfl download --project my-api --env production --output .env
+kfl secrets download --project my-api --env production --output .env
 ```
 
 ## Format Examples
@@ -147,4 +147,4 @@ kfl run -- npm run dev
   <Card href="/guides/api-keys" title="API Keys">
     Create scoped keys for CI/CD and services.
   </Card>
-</CardGroup>
+</CardGroup>

packages/cli/README.md

@@ -25,13 +25,13 @@ kfl projects create my-api
 kfl env create production --project my-api
 
 # Upload secrets from a .env file
-kfl upload .env.production --project my-api --env production
+kfl secrets upload .env.production --project my-api --env production
 
 # Inject secrets into a command at runtime (no disk writes)
 kfl run --project my-api --env production -- npm start
 
 # Download secrets as a .env file
-kfl download --project my-api --env production --output .env
+kfl secrets download --project my-api --env production --output .env
 ```
 
 ## Configuration
@@ -55,8 +55,8 @@ After `kfl init`, credentials are stored in `~/.config/keyflare/`. You can overr
 | `kfl projects list/create/delete` | Manage projects |
 | `kfl env list/create/delete` | Manage environments |
 | `kfl secrets set/get/delete/list` | Manage individual secrets |
-| `kfl upload <file>` | Upload a `.env` file (full replace) |
-| `kfl download` | Download secrets (`.env`, JSON, YAML) |
+| `kfl secrets upload <file>` | Upload a `.env` file (full replace) |
+| `kfl secrets download` | Download secrets (`.env`, JSON, YAML) |
 | `kfl run -- <cmd>` | Inject secrets into a child process |
 | `kfl keys list/create/revoke` | Manage API keys |
 | `kfl dev init/server` | Local development helpers |

packages/cli/src/index.ts

@@ -32,7 +32,7 @@ import {
   runKeysUpdate,
 } from "./commands/keys.js";
 import { readConfig } from "./config.js";
-import { error } from "./output/log.js";
+import { error, warn } from "./output/log.js";
 import { makeDebug } from "./debug.js";
 
 const program = new Command();
@@ -203,8 +203,7 @@ secrets
     await runSecretsDelete(key, opts.project, opts.env).catch(handleError);
   });
 
-// ─── kfl upload ──────────────────────────────────────────────
-program
+secrets
   .command("upload <file>")
   .description(
     "Upload a .env file — REPLACES all secrets in the target environment"
@@ -216,8 +215,7 @@ program
     await runUpload(file, opts.project, opts.env, opts).catch(handleError);
   });
 
-// ─── kfl download ────────────────────────────────────────────
-program
+secrets
   .command("download")
   .description("Download secrets to stdout or a file")
   .requiredOption("--project <name>", "Project name", resolveProject())
@@ -228,6 +226,32 @@ program
     await runDownload(opts.project, opts.env, opts).catch(handleError);
   });
 
+// ─── Deprecated aliases: kfl upload/download ────────────────
+program
+  .command("upload <file>", { hidden: true })
+  .description(
+    "Upload a .env file — REPLACES all secrets in the target environment"
+  )
+  .requiredOption("--project <name>", "Project name", resolveProject())
+  .requiredOption("--env <name>", "Environment name", resolveEnvironment())
+  .option("--force", "Skip confirmation prompt")
+  .action(async (file: string, opts: { project: string; env: string; force?: boolean }) => {
+    warn("`kfl upload` is deprecated; use `kfl secrets upload`");
+    await runUpload(file, opts.project, opts.env, opts).catch(handleError);
+  });
+
+program
+  .command("download", { hidden: true })
+  .description("Download secrets to stdout or a file")
+  .requiredOption("--project <name>", "Project name", resolveProject())
+  .requiredOption("--env <name>", "Environment name", resolveEnvironment())
+  .option("--format <fmt>", "Output format: env, json, yaml, shell", "env")
+  .option("--output <file>", "Write to file instead of stdout")
+  .action(async (opts: { project: string; env: string; format?: string; output?: string }) => {
+    warn("`kfl download` is deprecated; use `kfl secrets download`");
+    await runDownload(opts.project, opts.env, opts).catch(handleError);
+  });
+
 // ─── kfl run ─────────────────────────────────────────────────
 program
   .command("run")