@keynv/cli 0.1.0-rc.18 → 0.1.0-rc.19

package/dist/index.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'module';
 import { createHash, randomBytes } from 'crypto';
-import { readFileSync, unlinkSync, existsSync, statSync, writeFileSync, readdirSync, mkdirSync, rmSync, lstatSync } from 'fs';
+import { readFileSync, existsSync, writeFileSync, statSync, realpathSync, readdirSync, renameSync, mkdirSync, rmSync, lstatSync } from 'fs';
 import { hostname, platform, homedir } from 'os';
 import * as nodePath from 'path';
-import { relative, join, isAbsolute, resolve, dirname, basename } from 'path';
+import { relative, join, isAbsolute, resolve, sep, dirname, basename } from 'path';
 import { Entry } from '@napi-rs/keyring';
 import { styleText, stripVTControlCharacters } from 'util';
 import j2, { stdin, stdout } from 'process';
@@ -1057,7 +1057,7 @@ var require_lib = __commonJS({
 var VERSION, AGENT;
 var init_version = __esm({
   "src/version.ts"() {
-    VERSION = "0.1.0-rc.18" ;
+    VERSION = "0.1.0-rc.19" ;
     AGENT = `keynv-cli/${VERSION}`;
   }
 });
@@ -5985,11 +5985,13 @@ var init_envFile = __esm({
 function aiContextBody() {
   return `## keynv (secrets)
 
-This project uses [keynv](https://keynv.dev) for secrets. There is a \`.keynv.env\` file at the project root containing **alias references** like \`OPENAI_API_KEY=@projectname.dev.openai-key\` \u2014 these are NOT real values, they are references to secrets stored in the keynv vault.
+This project uses [keynv](https://keynv.dev) for secrets. \`.keynv.env\` files contain **alias references** like \`OPENAI_API_KEY=@projectname.dev.openai-key\` \u2014 these are NOT real values, they are references to secrets stored in the keynv vault.
+
+In a monorepo, expect **one \`.keynv.env\` per app directory** (e.g. \`apps/api/.keynv.env\`, \`apps/web/.keynv.env\`) next to the original \`.env\` file that was migrated. \`keynv exec\` walks upward from the current directory and loads the nearest one, so running it from inside an app's folder picks up that app's aliases.
 
 ### Mental model
 
-- **\`.keynv.env\`** \u2014 checked into git, contains aliases. Safe to read, edit, commit.
+- **\`.keynv.env\`** \u2014 checked into git, contains aliases. Safe to read, edit, commit. May appear in subdirectories of a monorepo.
 - **Vault** \u2014 holds the real values. The \`keynv\` CLI reads it on demand.
 - **\`keynv exec -- <command>\`** \u2014 forks the command in a subprocess where the real values are injected into env vars. The parent process (where you, the AI agent, run) NEVER sees the real values.
 - **Redactor** \u2014 pipes subprocess stdout/stderr through a masker before they reach this terminal. Even if a script accidentally echoes a secret, you see \`<REDACTED:...>\` here.
@@ -6057,9 +6059,9 @@ ${block}
     writeFileSync(path, next);
     return "updated";
   }
-  const sep = existing.length === 0 ? "" : existing.endsWith("\n\n") ? "" : existing.endsWith("\n") ? "\n" : "\n\n";
+  const sep2 = existing.length === 0 ? "" : existing.endsWith("\n\n") ? "" : existing.endsWith("\n") ? "\n" : "\n\n";
   const trailingNewline = existing.endsWith("\n") ? "" : "\n";
-  writeFileSync(path, `${existing}${trailingNewline}${sep}${block}
+  writeFileSync(path, `${existing}${trailingNewline}${sep2}${block}
 `);
   return "appended";
 }
@@ -6071,6 +6073,175 @@ var init_ai_context = __esm({
     KEYNV_BLOCK_END = "<!-- keynv:end -->";
   }
 });
+function backupEnvFile(absolutePath, now = /* @__PURE__ */ new Date()) {
+  const plain = `${absolutePath}.backup`;
+  if (!existsSync(plain)) {
+    renameSync(absolutePath, plain);
+    return { renamedTo: plain, usedTimestamp: false };
+  }
+  const stamped = `${absolutePath}.backup-${timestampSlug(now)}`;
+  renameSync(absolutePath, stamped);
+  return { renamedTo: stamped, usedTimestamp: true };
+}
+function timestampSlug(d2 = /* @__PURE__ */ new Date()) {
+  const y = d2.getFullYear();
+  const mo = pad2(d2.getMonth() + 1);
+  const da = pad2(d2.getDate());
+  const h2 = pad2(d2.getHours());
+  const mi = pad2(d2.getMinutes());
+  return `${y}${mo}${da}-${h2}${mi}`;
+}
+function pad2(n) {
+  return n < 10 ? `0${n}` : String(n);
+}
+var init_backup = __esm({
+  "src/init/backup.ts"() {
+  }
+});
+
+// src/init/collision.ts
+function planVaultKeys(sources) {
+  const byDir = /* @__PURE__ */ new Map();
+  const shadowedAccum = /* @__PURE__ */ new Map();
+  for (const s of sources) {
+    const dirKey = `${s.envName}|${s.file.containingDir}`;
+    let perKey = byDir.get(dirKey);
+    if (!perKey) {
+      perKey = /* @__PURE__ */ new Map();
+      byDir.set(dirKey, perKey);
+    }
+    const prior = perKey.get(s.name);
+    if (prior) {
+      const shadowKey = `${s.envName}|${s.file.containingDir}|${s.name}`;
+      let note = shadowedAccum.get(shadowKey);
+      if (!note) {
+        note = {
+          envName: s.envName,
+          localKey: s.name,
+          containingDir: s.file.containingDir,
+          laterFile: s.file.name,
+          earlierFiles: [prior.source.name]
+        };
+        shadowedAccum.set(shadowKey, note);
+      } else {
+        note.earlierFiles.push(note.laterFile);
+        note.laterFile = s.file.name;
+      }
+    }
+    perKey.set(s.name, {
+      envName: s.envName,
+      containingDir: s.file.containingDir,
+      localKey: s.name,
+      value: s.value,
+      isAlias: s.isAlias,
+      source: s.file,
+      line: s.line
+    });
+  }
+  const intraResolved = [];
+  for (const perKey of byDir.values()) intraResolved.push(...perKey.values());
+  const groups = /* @__PURE__ */ new Map();
+  for (const e2 of intraResolved) {
+    const k2 = `${e2.envName}|${e2.localKey}`;
+    let g = groups.get(k2);
+    if (!g) {
+      g = [];
+      groups.set(k2, g);
+    }
+    g.push(e2);
+  }
+  const resolved = [];
+  const renamed = [];
+  const merged = [];
+  for (const group of groups.values()) {
+    if (group.length === 1) {
+      const e2 = group[0];
+      resolved.push({
+        envName: e2.envName,
+        localKey: e2.localKey,
+        value: e2.value,
+        isAlias: e2.isAlias,
+        vaultKey: toAliasKey(e2.localKey),
+        source: e2.source,
+        line: e2.line
+      });
+      continue;
+    }
+    const allSameValue = group.every((e2) => e2.value === group[0]?.value);
+    if (allSameValue) {
+      const vaultKey = toAliasKey(group[0].localKey);
+      merged.push({
+        envName: group[0].envName,
+        key: group[0].localKey,
+        sources: group.map((e2) => e2.source)
+      });
+      for (const e2 of group) {
+        resolved.push({
+          envName: e2.envName,
+          localKey: e2.localKey,
+          value: e2.value,
+          isAlias: e2.isAlias,
+          vaultKey,
+          source: e2.source,
+          line: e2.line
+        });
+      }
+      continue;
+    }
+    const initialSlugs = group.map((e2) => initialSlug(e2.source));
+    const initialUnique = new Set(initialSlugs).size === initialSlugs.length;
+    const slugs = initialUnique ? initialSlugs : group.map((e2) => fullSlug(e2.source));
+    for (let i = 0; i < group.length; i++) {
+      const e2 = group[i];
+      const slug = slugs[i];
+      const vaultKey = toAliasKey(`${slug}-${e2.localKey}`);
+      renamed.push({
+        envName: e2.envName,
+        localKey: e2.localKey,
+        vaultKey,
+        source: e2.source,
+        otherSources: group.filter((_, j3) => j3 !== i).map((g) => g.source)
+      });
+      resolved.push({
+        envName: e2.envName,
+        localKey: e2.localKey,
+        value: e2.value,
+        isAlias: e2.isAlias,
+        vaultKey,
+        source: e2.source,
+        line: e2.line
+      });
+    }
+  }
+  return {
+    resolved,
+    renamed,
+    merged,
+    shadowed: [...shadowedAccum.values()]
+  };
+}
+function initialSlug(file) {
+  if (file.relativeDir === "") return "root";
+  const parts = file.relativeDir.split("/");
+  return (parts[parts.length - 1] ?? "root").toLowerCase();
+}
+function fullSlug(file) {
+  if (file.relativeDir === "") return "root";
+  return file.relativeDir.toLowerCase().replace(/\//g, "-");
+}
+function toAliasKey(name) {
+  if (!name) return name;
+  if (KEY_RE3.test(name)) return name;
+  const normalised = name.toLowerCase().replace(/_/g, "-");
+  if (KEY_RE3.test(normalised)) return normalised;
+  return normalised.replace(/[^a-zA-Z0-9_-]/g, "").slice(0, 64) || "key";
+}
+var KEY_RE3;
+var init_collision = __esm({
+  "src/init/collision.ts"() {
+    KEY_RE3 = /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/;
+  }
+});
 function findProjectRoot(startDir) {
   const result = walkUp(startDir, (dir) => {
     for (const marker of PROJECT_MARKERS) {
@@ -6113,31 +6284,86 @@ function buildRoot(dir, marker) {
     packageJsonInvalid: invalid
   };
 }
-function findEnvFiles(rootDir) {
-  let entries;
+function findEnvFilesRecursive(rootDir, opts = {}) {
+  const maxDepth = Math.max(1, opts.maxDepth ?? DEFAULT_MAX_DEPTH);
+  const ignore = opts.ignore ?? IGNORE_DIRS;
+  let rootReal;
   try {
-    entries = readdirSync(rootDir);
+    rootReal = realpathSync(rootDir);
   } catch {
     return [];
   }
   const hits = [];
-  for (const name of entries) {
-    if (!ENV_GLOB.test(name)) continue;
-    if (ENV_EXAMPLE.test(name)) continue;
-    if (name === KEYNV_ENV_BASENAME) continue;
-    const full = join(rootDir, name);
+  const seen = /* @__PURE__ */ new Set([rootReal]);
+  const queue = [{ dir: rootDir, depth: 0 }];
+  while (queue.length > 0) {
+    const current = queue.shift();
+    if (!current) break;
+    const { dir, depth } = current;
+    let entries;
     try {
-      if (!statSync(full).isFile()) continue;
+      const raw = readdirSync(dir, { withFileTypes: true });
+      entries = raw.map((d2) => ({
+        name: d2.name,
+        isFile: d2.isFile(),
+        isDir: d2.isDirectory(),
+        isSymlink: d2.isSymbolicLink()
+      }));
     } catch {
       continue;
     }
-    const suffixMatch = name.match(/^\.env\.(.+)$/);
-    const suffix = suffixMatch ? suffixMatch[1] : null;
-    hits.push({ path: full, name, suffix, suggestedEnv: suggestedEnvForSuffix(suffix) });
+    for (const entry2 of entries) {
+      const full = join(dir, entry2.name);
+      let isFile = entry2.isFile;
+      let isDir = entry2.isDir;
+      if (entry2.isSymlink) {
+        try {
+          const st3 = statSync(full);
+          isFile = st3.isFile();
+          if (st3.isDirectory()) isDir = false;
+        } catch {
+          continue;
+        }
+      }
+      if (isFile) {
+        if (!ENV_GLOB.test(entry2.name)) continue;
+        if (ENV_EXAMPLE.test(entry2.name)) continue;
+        if (KEYNV_ENV_EXCLUDE.test(entry2.name)) continue;
+        const suffixMatch = entry2.name.match(/^\.env\.(.+)$/);
+        const suffix = suffixMatch ? suffixMatch[1] : null;
+        const rel = relative(rootDir, dir);
+        const relativeDir = rel === "" ? "" : rel.split(sep).join("/");
+        hits.push({
+          path: full,
+          name: entry2.name,
+          suffix,
+          suggestedEnv: suggestedEnvForSuffix(suffix),
+          relativeDir,
+          containingDir: dir
+        });
+        continue;
+      }
+      if (isDir && depth + 1 < maxDepth) {
+        if (ignore.has(entry2.name)) continue;
+        let realDir;
+        try {
+          realDir = realpathSync(full);
+        } catch {
+          continue;
+        }
+        if (seen.has(realDir)) continue;
+        seen.add(realDir);
+        queue.push({ dir: full, depth: depth + 1 });
+      }
+    }
   }
   hits.sort((a, b2) => {
-    if (a.suffix === null) return -1;
-    if (b2.suffix === null) return 1;
+    const aRoot = a.relativeDir === "";
+    const bRoot = b2.relativeDir === "";
+    if (aRoot !== bRoot) return aRoot ? -1 : 1;
+    if (a.relativeDir !== b2.relativeDir) return a.relativeDir.localeCompare(b2.relativeDir);
+    if (a.suffix === null && b2.suffix !== null) return -1;
+    if (a.suffix !== null && b2.suffix === null) return 1;
     return a.name.localeCompare(b2.name);
   });
   return hits;
@@ -6166,7 +6392,7 @@ function suggestedEnvForSuffix(suffix) {
 function hasExistingKeynvEnv(rootDir) {
   return existsSync(join(rootDir, KEYNV_ENV_BASENAME));
 }
-var PROJECT_MARKERS, GIT_MARKER, ENV_GLOB, ENV_EXAMPLE, KEYNV_ENV_BASENAME;
+var PROJECT_MARKERS, GIT_MARKER, ENV_GLOB, ENV_EXAMPLE, KEYNV_ENV_BASENAME, KEYNV_ENV_EXCLUDE, IGNORE_DIRS, DEFAULT_MAX_DEPTH;
 var init_detect = __esm({
   "src/init/detect.ts"() {
     init_fs();
@@ -6184,6 +6410,74 @@ var init_detect = __esm({
     ENV_GLOB = /^\.env(\.[A-Za-z0-9_-]+)?$/;
     ENV_EXAMPLE = /^\.env\.(example|sample|template|dist|defaults)$/;
     KEYNV_ENV_BASENAME = ".keynv.env";
+    KEYNV_ENV_EXCLUDE = /^\.keynv\.(.+\.)?env$/;
+    IGNORE_DIRS = /* @__PURE__ */ new Set([
+      // VCS + git hooks
+      ".git",
+      ".husky",
+      // Package managers / dep caches
+      "node_modules",
+      ".yarn",
+      // Yarn Berry / PnP cache
+      "bower_components",
+      // Generic build / output / coverage dirs
+      "dist",
+      "build",
+      "out",
+      "coverage",
+      ".cache",
+      ".nyc_output",
+      // Rust / Go / PHP
+      "target",
+      "vendor",
+      // JS / TS frameworks
+      ".next",
+      // Next.js
+      ".turbo",
+      // Turborepo
+      ".nuxt",
+      // Nuxt 2/3
+      ".output",
+      // Nitro / Nuxt 3 build output
+      ".svelte-kit",
+      // SvelteKit
+      ".astro",
+      // Astro
+      ".angular",
+      // Angular CLI cache
+      ".parcel-cache",
+      // Parcel bundler
+      ".docusaurus",
+      // Docusaurus
+      ".expo",
+      // Expo / React Native
+      // Deployment / serverless platforms
+      ".vercel",
+      ".netlify",
+      ".wrangler",
+      // Cloudflare Workers
+      ".serverless",
+      // Serverless framework
+      ".sst",
+      // SST
+      ".amplify",
+      // AWS Amplify
+      ".firebase",
+      // Firebase
+      // Python tooling (mixed-language monorepos)
+      ".venv",
+      "venv",
+      "__pycache__",
+      ".tox",
+      ".mypy_cache",
+      ".pytest_cache",
+      ".ruff_cache",
+      // IDE / editor state
+      ".idea",
+      ".vscode",
+      ".fleet"
+    ]);
+    DEFAULT_MAX_DEPTH = 5;
   }
 });
 
@@ -8601,15 +8895,16 @@ var init_pickProject = __esm({
 var init_exports = {};
 __export(init_exports, {
   UserCancelled: () => UserCancelled,
+  composeKeynvEnv: () => composeKeynvEnv,
   runInitFlow: () => runInitFlow
 });
-function toAliasKey(name) {
-  if (!name) return name;
-  const KEY_RE3 = /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/;
-  if (KEY_RE3.test(name)) return name;
-  const normalised = name.toLowerCase().replace(/_/g, "-");
-  if (KEY_RE3.test(normalised)) return normalised;
-  return normalised.replace(/[^a-zA-Z0-9_-]/g, "").slice(0, 64) || "key";
+function displayName(file) {
+  return file.relativeDir === "" ? file.name : `${file.relativeDir}/${file.name}`;
+}
+function relFromRoot(rootPath, absPath) {
+  const r = relative(rootPath, absPath);
+  if (r === "") return ".";
+  return r.split(/[\\/]/).filter(Boolean).join("/");
 }
 async function runInitFlow(client, opts) {
   ge("Set up this project");
@@ -8623,11 +8918,11 @@ async function runInitFlow(client, opts) {
   if (root.packageJsonInvalid) {
     R2.warn(`package.json at ${root.path} is not valid JSON \u2014 script wrapping will be skipped.`);
   }
-  const envFiles = findEnvFiles(root.path);
+  const envFiles = findEnvFilesRecursive(root.path);
   const intoExisting = hasExistingKeynvEnv(root.path);
   if (envFiles.length === 0 && !intoExisting) {
     R2.info(
-      `No .env files found in ${root.path}. There's nothing to migrate yet \u2014 create a .keynv.env by hand or run \`keynv exec\` once you have one.`
+      `No .env files found in ${root.path} (scanned root and subdirectories). There's nothing to migrate yet \u2014 create a .keynv.env by hand or run \`keynv exec\` once you have one.`
     );
     ye("Nothing to do.");
     return { exitCode: 0 };
@@ -8636,8 +8931,9 @@ async function runInitFlow(client, opts) {
     [
       `Project root: ${root.path}`,
       `Marker: ${root.marker}`,
-      envFiles.length > 0 ? `Found env files: ${envFiles.map((f) => f.name).join(", ")}` : "Found env files: (none)",
-      intoExisting ? "Existing .keynv.env detected \u2014 will merge new entries in." : ""
+      envFiles.length > 0 ? `Found env files:
+${envFiles.map((f) => `  ${displayName(f)}`).join("\n")}` : "Found env files: (none)",
+      intoExisting ? "Existing root .keynv.env detected \u2014 will merge new entries in." : ""
     ].filter(Boolean).join("\n"),
     "Detected"
   );
@@ -8652,62 +8948,118 @@ async function runInitFlow(client, opts) {
     return { exitCode: 130 };
   }
   const distinctEnvs = [...new Set(fileMapping.map((m) => m.envName))];
-  const perEnv = parseAndMergePerEnv(fileMapping);
+  const allSources = [];
   const skipped = [];
-  for (const env2 of distinctEnvs) {
-    const before = perEnv.get(env2) ?? [];
-    const kept = [];
-    for (const e2 of before) {
+  for (const { file, envName } of fileMapping) {
+    let parsed;
+    try {
+      parsed = parseEnvFile(readFileSync(file.path, "utf8"), file.path);
+    } catch (err) {
+      R2.warn(
+        `${displayName(file)}: ${err instanceof Error ? err.message : String(err)} \u2014 skipping file`
+      );
+      continue;
+    }
+    for (const e2 of parsed) {
       if (classifyEntry(e2.name, e2.value).verdict === "skip") {
-        skipped.push({ env: env2, entry: e2 });
-      } else {
-        kept.push(e2);
+        skipped.push({ env: envName, name: e2.name });
+        continue;
       }
+      allSources.push({
+        file,
+        envName,
+        name: e2.name,
+        value: e2.value,
+        isAlias: e2.isAlias,
+        line: e2.line
+      });
     }
-    perEnv.set(env2, kept);
   }
   if (skipped.length > 0) {
-    const names = [...new Set(skipped.map((s) => s.entry.name))];
+    const names = [...new Set(skipped.map((s) => s.name))];
     R2.info(
       `Skipped ${skipped.length} framework/shell-managed entr${skipped.length === 1 ? "y" : "ies"}: ${names.join(", ")}`
     );
   }
-  for (const env2 of distinctEnvs) {
-    const shadowed = (perEnv.get(env2) ?? []).filter((e2) => e2.shadowedBy.length > 0);
-    if (shadowed.length === 0) continue;
-    const detail = shadowed.map((e2) => `  [${env2}] ${e2.name}: ${e2.source} \u2192 ${e2.shadowedBy[e2.shadowedBy.length - 1]}`).join("\n");
+  const plan = planVaultKeys(allSources);
+  if (plan.shadowed.length > 0) {
+    const detail = plan.shadowed.map(
+      (s) => `  [${s.envName}] ${relFromRoot(root.path, s.containingDir)}/${s.localKey}: ${s.earlierFiles.join(", ")} -> ${s.laterFile}`
+    ).join("\n");
+    R2.warn(
+      `Some keys appear in multiple env files in the same directory mapped to the same env; using the last value (dotenv convention):
+${detail}`
+    );
+  }
+  if (plan.merged.length > 0) {
+    const detail = plan.merged.map(
+      (m) => `  [${m.envName}] ${m.key}: same value across ${m.sources.map((s) => displayName(s)).join(", ")} -> one vault entry shared`
+    ).join("\n");
+    R2.info(`Merged cross-app duplicates into a single vault entry:
+${detail}`);
+  }
+  if (plan.renamed.length > 0) {
+    const byLocal = /* @__PURE__ */ new Map();
+    for (const r of plan.renamed) {
+      const k2 = `${r.envName}|${r.localKey}`;
+      const arr = byLocal.get(k2) ?? [];
+      arr.push(r);
+      byLocal.set(k2, arr);
+    }
+    const detail = [...byLocal.values()].map((group) => {
+      const head = group[0];
+      if (!head) return "";
+      const sources = group.map((r) => `${displayName(r.source)} -> @vault:${r.vaultKey}`).join("\n      ");
+      return `  [${head.envName}] ${head.localKey} (values differ across apps):
+      ${sources}`;
+    }).filter(Boolean).join("\n");
     R2.warn(
-      `Some keys appear in multiple env files mapped to the same env; using the last value (dotenv convention):
+      `Vault keys were renamed to avoid cross-app collisions (your code keeps using the original names locally):
 ${detail}`
     );
   }
-  const totalEntries = [...perEnv.values()].reduce((n, arr) => n + arr.length, 0);
-  if (totalEntries === 0) {
+  if (plan.resolved.length === 0) {
     R2.info(
       "All env files were empty or only contained framework-managed vars. Nothing to upload."
     );
     ye("Done.");
     return { exitCode: 0 };
   }
-  const choices = [];
-  for (const env2 of distinctEnvs) {
-    for (const e2 of perEnv.get(env2) ?? []) {
-      const c2 = classifyEntry(e2.name, e2.value);
-      const hint = c2.hint || (e2.isAlias ? "looks like an alias literal" : "no signal");
-      const preview2 = e2.isAlias ? e2.value : previewValue(e2.value, 28);
-      const envTag = distinctEnvs.length > 1 ? `[${env2}] ` : "";
-      choices.push({
-        composite: `${env2}|${e2.name}`,
-        env: env2,
-        name: e2.name,
-        value: e2.value,
-        isAlias: e2.isAlias,
+  const groups = /* @__PURE__ */ new Map();
+  for (const r of plan.resolved) {
+    const composite = `${r.envName}|${r.vaultKey}`;
+    let g = groups.get(composite);
+    if (!g) {
+      const c2 = classifyEntry(r.localKey, r.value);
+      const hint = c2.hint || (r.isAlias ? "looks like an alias literal" : "no signal");
+      const preview2 = r.isAlias ? r.value : previewValue(r.value, 28);
+      const envTag = distinctEnvs.length > 1 ? `[${r.envName}] ` : "";
+      const renamedTag = r.localKey !== r.vaultKey ? ` -> vault:${r.vaultKey}` : "";
+      g = {
+        composite,
+        envName: r.envName,
+        vaultKey: r.vaultKey,
+        localKey: r.localKey,
+        value: r.value,
+        isAlias: r.isAlias,
         verdict: c2.verdict,
-        label: `${envTag}${e2.name}  ${preview2}`,
-        hint
-      });
+        label: `${envTag}${r.localKey}${renamedTag}  ${preview2}`,
+        hint,
+        sources: []
+      };
+      groups.set(composite, g);
+    }
+    g.sources.push(r);
+  }
+  for (const g of groups.values()) {
+    const dirs = [...new Set(g.sources.map((s) => s.source.relativeDir || "<root>"))];
+    if (dirs.length > 1) g.label = `${g.label}  (shared by ${dirs.join(", ")})`;
+    else if (envFiles.some((f) => f.relativeDir !== "")) {
+      const only = dirs[0];
+      if (only && only !== "<root>") g.label = `${g.label}  [${only}]`;
     }
   }
+  const choices = [...groups.values()];
   const initialSecretSelection = choices.filter((c2) => c2.verdict === "secret" && !c2.isAlias).map((c2) => c2.composite);
   const selectedComposites = unwrap(
     await ve({
@@ -8729,18 +9081,24 @@ ${detail}`
     scriptWrapSelection = scriptPlan.recommended.map((a) => a.name);
   }
   const perEnvCounts = distinctEnvs.map((env2) => {
-    const entries = perEnv.get(env2) ?? [];
-    const sec = entries.filter((e2) => selected.has(`${env2}|${e2.name}`)).length;
-    const lit = entries.length - sec;
-    return `  ${env2}: ${sec} secrets, ${lit} literals${env2 === defaultEnv ? " (default \u2014 written to .keynv.env)" : ""}`;
+    const envGroups = choices.filter((g) => g.envName === env2);
+    const sec = envGroups.filter((g) => selected.has(g.composite)).length;
+    const lit = envGroups.length - sec;
+    return `  ${env2}: ${sec} secrets, ${lit} literals${env2 === defaultEnv ? " (default \u2014 written to each app's .keynv.env)" : ""}`;
   }).join("\n");
+  const writeDirs = [...new Set(plan.resolved.map((r) => r.source.containingDir))];
+  const writeDirsLines = writeDirs.map((d2) => `  ${relFromRoot(root.path, d2)}`).join("\n");
+  const renameLine = plan.renamed.length > 0 ? `Renamed vault keys: ${plan.renamed.length} (to avoid cross-app collisions)` : "";
   const planSummary = [
     `Project:           ${projectChoice.name}${projectChoice.created ? " (will be created)" : ""}`,
     `Environments:      ${distinctEnvs.join(", ")}`,
     "Per-env breakdown:",
     perEnvCounts,
     `Script wraps:      ${scriptWrapSelection.length}`,
-    "Original .env:     delete after upload",
+    `.keynv.env files:  will be written under`,
+    writeDirsLines,
+    "Original .env files: rename to .env.backup after upload",
+    renameLine,
     opts.dryRun ? "Dry-run: no changes will be made." : ""
   ].filter(Boolean).join("\n");
   Se(planSummary, "About to apply");
@@ -8755,100 +9113,98 @@ ${detail}`
   }
   const projectId2 = await ensureProjectAndEnvs(client, projectChoice, distinctEnvs);
   if (projectId2 === null) return { exitCode: 1 };
-  const uploadedByEnv = /* @__PURE__ */ new Map();
+  const aliasByGroup = /* @__PURE__ */ new Map();
   const failed = [];
-  const totalToUpload = selected.size;
-  if (totalToUpload > 0) {
+  const groupsToUpload = choices.filter((g) => selected.has(g.composite));
+  if (groupsToUpload.length > 0) {
     const s = ft();
-    s.start(`Uploading ${totalToUpload} secret${totalToUpload === 1 ? "" : "s"}`);
+    s.start(
+      `Uploading ${groupsToUpload.length} secret${groupsToUpload.length === 1 ? "" : "s"}`
+    );
     let i = 0;
-    for (const env2 of distinctEnvs) {
-      const envUploaded = /* @__PURE__ */ new Map();
-      uploadedByEnv.set(env2, envUploaded);
-      for (const e2 of perEnv.get(env2) ?? []) {
-        if (!selected.has(`${env2}|${e2.name}`)) continue;
-        i++;
-        s.message(`Uploading (${i}/${totalToUpload}) [${env2}] ${e2.name}`);
-        const aliasKey = toAliasKey(e2.name);
-        try {
-          await client.request(`/v1/projects/${projectId2}/secrets`, {
-            method: "POST",
-            body: { env: env2, key: aliasKey, value: e2.value }
-          });
-          const alias2 = reference_exports.buildAlias({
-            project: projectChoice.name,
-            environment: env2,
-            key: aliasKey
-          });
-          if (alias2 === null) {
-            failed.push({
-              env: env2,
-              name: e2.name,
-              reason: `produced an invalid alias for project=${projectChoice.name} env=${env2} key=${aliasKey}`
-            });
-          } else {
-            envUploaded.set(e2.name, alias2.literal);
-          }
-        } catch (err) {
+    for (const g of groupsToUpload) {
+      i++;
+      s.message(`Uploading (${i}/${groupsToUpload.length}) [${g.envName}] ${g.vaultKey}`);
+      try {
+        await client.request(`/v1/projects/${projectId2}/secrets`, {
+          method: "POST",
+          body: { env: g.envName, key: g.vaultKey, value: g.value }
+        });
+        const alias2 = reference_exports.buildAlias({
+          project: projectChoice.name,
+          environment: g.envName,
+          key: g.vaultKey
+        });
+        if (alias2 === null) {
           failed.push({
-            env: env2,
-            name: e2.name,
-            reason: err instanceof Error ? err.message : String(err)
+            env: g.envName,
+            name: g.localKey,
+            reason: `produced an invalid alias for project=${projectChoice.name} env=${g.envName} key=${g.vaultKey}`
           });
+        } else {
+          aliasByGroup.set(g.composite, alias2.literal);
         }
+      } catch (err) {
+        failed.push({
+          env: g.envName,
+          name: g.localKey,
+          reason: err instanceof Error ? err.message : String(err)
+        });
       }
     }
     if (failed.length === 0) {
-      s.stop(`Uploaded ${totalToUpload} secret${totalToUpload === 1 ? "" : "s"}`);
+      s.stop(`Uploaded ${groupsToUpload.length} secret${groupsToUpload.length === 1 ? "" : "s"}`);
     } else {
       s.error(
-        `${totalToUpload - failed.length}/${totalToUpload} uploaded; ${failed.length} failed`
+        `${groupsToUpload.length - failed.length}/${groupsToUpload.length} uploaded; ${failed.length} failed`
       );
       for (const f of failed) R2.warn(`  [${f.env}] ${f.name}: ${f.reason}`);
     }
   }
-  const defaultUploaded = uploadedByEnv.get(defaultEnv) ?? /* @__PURE__ */ new Map();
-  const defaultLiterals = (perEnv.get(defaultEnv) ?? []).filter(
-    (e2) => !selected.has(`${defaultEnv}|${e2.name}`)
-  );
-  const keynvEnvPath = join(root.path, ".keynv.env");
-  try {
-    const lines = composeKeynvEnv({
-      uploadedAliases: defaultUploaded,
-      literals: defaultLiterals,
-      mergeWithExisting: intoExisting ? readFileSync(keynvEnvPath, "utf8") : null
-    });
-    writeFileSync(keynvEnvPath, `${lines.join("\n")}
-`);
-    R2.success(
-      `${intoExisting ? "Updated" : "Wrote"} ${keynvEnvPath} (${defaultUploaded.size + defaultLiterals.length} entries from "${defaultEnv}")`
-    );
-  } catch (err) {
-    R2.error(`Failed to write .keynv.env: ${err instanceof Error ? err.message : String(err)}`);
-    return { exitCode: 1 };
+  const bucketKey = (dir, env2) => `${dir}|${env2}`;
+  const buckets = /* @__PURE__ */ new Map();
+  for (const r of plan.resolved) {
+    const k2 = bucketKey(r.source.containingDir, r.envName);
+    let b2 = buckets.get(k2);
+    if (!b2) {
+      b2 = {
+        containingDir: r.source.containingDir,
+        envName: r.envName,
+        aliasLines: [],
+        literalEntries: []
+      };
+      buckets.set(k2, b2);
+    }
+    const groupKey = `${r.envName}|${r.vaultKey}`;
+    const alias2 = aliasByGroup.get(groupKey);
+    if (selected.has(groupKey) && alias2 !== void 0) {
+      b2.aliasLines.push([r.localKey, alias2]);
+    } else {
+      b2.literalEntries.push({ name: r.localKey, value: r.value });
+    }
   }
-  const otherEnvsWithAliases = distinctEnvs.filter(
-    (env2) => env2 !== defaultEnv && (uploadedByEnv.get(env2)?.size ?? 0) > 0
-  );
-  for (const env2 of otherEnvsWithAliases) {
-    const envUploaded = uploadedByEnv.get(env2) ?? /* @__PURE__ */ new Map();
-    const envLiterals = (perEnv.get(env2) ?? []).filter((e2) => !selected.has(`${env2}|${e2.name}`));
-    const envFilePath = join(root.path, `.keynv.${env2}.env`);
+  for (const b2 of buckets.values()) {
+    const targetName = b2.envName === defaultEnv ? ".keynv.env" : `.keynv.${b2.envName}.env`;
+    const targetPath = join(b2.containingDir, targetName);
+    const dirIntoExisting = existsSync(targetPath);
     try {
       const lines = composeKeynvEnv({
-        uploadedAliases: envUploaded,
-        literals: envLiterals,
-        mergeWithExisting: null
+        uploadedAliases: new Map(b2.aliasLines),
+        literals: b2.literalEntries.map((e2) => ({ name: e2.name, value: e2.value })),
+        mergeWithExisting: dirIntoExisting ? readFileSync(targetPath, "utf8") : null
       });
-      writeFileSync(envFilePath, `${lines.join("\n")}
+      writeFileSync(targetPath, `${lines.join("\n")}
 `);
+      const relTarget = relFromRoot(root.path, targetPath);
+      const total = b2.aliasLines.length + b2.literalEntries.length;
       R2.success(
-        `Wrote .keynv.${env2}.env (${envUploaded.size} secret alias${envUploaded.size === 1 ? "" : "es"} from "${env2}")`
+        `${dirIntoExisting ? "Updated" : "Wrote"} ${relTarget} (${total} entr${total === 1 ? "y" : "ies"} from "${b2.envName}")`
       );
     } catch (err) {
-      R2.warn(
-        `Could not write .keynv.${env2}.env: ${err instanceof Error ? err.message : String(err)}`
+      R2.error(
+        `Failed to write ${relFromRoot(root.path, targetPath)}: ${err instanceof Error ? err.message : String(err)}`
       );
+      return { exitCode: 1 };
     }
   }
   try {
@@ -8876,19 +9232,28 @@ ${detail}`
     }
   }
   for (const f of envFiles) {
+    const relSrc = relFromRoot(root.path, f.path);
     try {
-      unlinkSync(f.path);
-      R2.success(`Removed ${f.name}`);
+      const { renamedTo } = backupEnvFile(f.path);
+      const relTarget = relFromRoot(root.path, renamedTo);
+      R2.success(`Renamed ${relSrc} -> ${relTarget}`);
     } catch (err) {
-      R2.warn(`Could not remove ${f.name}: ${err instanceof Error ? err.message : String(err)}`);
+      R2.warn(`Could not rename ${relSrc}: ${err instanceof Error ? err.message : String(err)}`);
     }
   }
   const otherEnvs = distinctEnvs.filter((e2) => e2 !== defaultEnv);
   if (otherEnvs.length > 0) {
     const lines = otherEnvs.map((env2) => {
-      const count = uploadedByEnv.get(env2)?.size ?? 0;
-      const hasFile = count > 0;
-      return hasFile ? `  ${env2}: ${count} secret${count === 1 ? "" : "s"} \u2192 .keynv.${env2}.env (use \`keynv exec --from .keynv.${env2}.env -- <cmd>\`)` : `  ${env2}: 0 secrets in vault (no alias file written)`;
+      const dirsForEnv = [
+        ...new Set(
+          [...buckets.values()].filter((b2) => b2.envName === env2).map((b2) => b2.containingDir)
+        )
+      ];
+      if (dirsForEnv.length === 0) {
+        return `  ${env2}: 0 secrets in vault (no alias file written)`;
+      }
+      const fileList = dirsForEnv.map((d2) => `${relFromRoot(root.path, d2)}/.keynv.${env2}.env`).join(", ");
+      return `  ${env2}: ${fileList} (use \`keynv exec --from <file> -- <cmd>\`)`;
     });
     Se(lines.join("\n"), "Secrets in other envs");
   }
@@ -8953,7 +9318,7 @@ async function pickFileEnvMapping(files, project) {
     opts.push({ value: "__custom", label: "+ Custom env name\u2026" });
     let envName = unwrap(
       await Ee({
-        message: `Map ${f.name} to which keynv env?`,
+        message: `Map ${displayName(f)} to which keynv env?`,
         options: opts,
         initialValue: suggested
       })
@@ -8970,43 +9335,6 @@ async function pickFileEnvMapping(files, project) {
   }
   return assignments;
 }
-function parseAndMergePerEnv(mapping) {
-  const acc = /* @__PURE__ */ new Map();
-  for (const { file, envName } of mapping) {
-    let entries;
-    try {
-      entries = parseEnvFile(readFileSync(file.path, "utf8"), file.path);
-    } catch (err) {
-      R2.warn(`${file.name}: ${err instanceof Error ? err.message : String(err)} \u2014 skipping file`);
-      continue;
-    }
-    let envMap = acc.get(envName);
-    if (!envMap) {
-      envMap = /* @__PURE__ */ new Map();
-      acc.set(envName, envMap);
-    }
-    for (const e2 of entries) {
-      const existing = envMap.get(e2.name);
-      if (existing) {
-        existing.shadowedBy.push(file.name);
-        existing.value = e2.value;
-        existing.isAlias = e2.isAlias;
-      } else {
-        envMap.set(e2.name, {
-          name: e2.name,
-          value: e2.value,
-          isAlias: e2.isAlias,
-          source: file.name,
-          sourceLine: e2.line,
-          shadowedBy: []
-        });
-      }
-    }
-  }
-  const out = /* @__PURE__ */ new Map();
-  for (const [env2, m] of acc) out.set(env2, [...m.values()]);
-  return out;
-}
 function pickDefaultEnv(envs) {
   if (envs.length === 0) return "dev";
   if (envs.includes("dev")) return "dev";
@@ -9117,6 +9445,8 @@ var init_init = __esm({
     init_dist();
     init_envFile();
     init_ai_context();
+    init_backup();
+    init_collision();
     init_detect();
     init_heuristics();
     init_script_wrap();
@@ -9605,7 +9935,7 @@ var require_lib2 = __commonJS({
         return `'${escapedValue}${value.slice(chunkIndex)}'`;
       return `'${escapedValue}'`;
     };
-    var pad2 = (value) => value < 10 ? "0" + value : "" + value;
+    var pad22 = (value) => value < 10 ? "0" + value : "" + value;
     var pad3 = (value) => value < 10 ? "00" + value : value < 100 ? "0" + value : "" + value;
     var pad4 = (value) => value < 10 ? "000" + value : value < 100 ? "00" + value : value < 1e3 ? "0" + value : "" + value;
     var convertTimezone = (tz) => {
@@ -9648,7 +9978,7 @@ var require_lib2 = __commonJS({
         second = adjustedDate.getUTCSeconds();
         millisecond = adjustedDate.getUTCMilliseconds();
       }
-      return escapeString(pad4(year) + "-" + pad2(month) + "-" + pad2(day) + " " + pad2(hour) + ":" + pad2(minute) + ":" + pad2(second) + "." + pad3(millisecond));
+      return escapeString(pad4(year) + "-" + pad22(month) + "-" + pad22(day) + " " + pad22(hour) + ":" + pad22(minute) + ":" + pad22(second) + "." + pad3(millisecond));
     };
     exports.dateToString = dateToString;
     var escapeId = (value, forbidQualified) => {
@@ -46566,6 +46896,8 @@ init_dist();
 init_http();
 init_envFile();
 init_ai_context();
+init_backup();
+init_collision();
 init_detect();
 init_heuristics();
 init_init();
@@ -46719,15 +47051,31 @@ var ProjectDeleteCommand = class extends Command {
 // src/commands/init.ts
 function toAliasKey2(name) {
   if (!name) return name;
-  const KEY_RE3 = /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/;
-  if (KEY_RE3.test(name)) return name;
+  const KEY_RE4 = /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/;
+  if (KEY_RE4.test(name)) return name;
   const normalised = name.toLowerCase().replace(/_/g, "-");
-  if (KEY_RE3.test(normalised)) return normalised;
+  if (KEY_RE4.test(normalised)) return normalised;
   return normalised.replace(/[^a-zA-Z0-9_-]/g, "").slice(0, 64) || "key";
 }
 function escapeRegExp2(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
+function displayHit(rootPath, file) {
+  return relFromRootPath(rootPath, file.path);
+}
+function relFromRootPath(rootPath, absPath) {
+  const r = relative(rootPath, absPath);
+  if (r === "") return ".";
+  return r.split(/[\\/]/).filter(Boolean).join("/");
+}
+function envBodyFor2(name) {
+  const isProd = name === "prod" || name === "production";
+  return {
+    name,
+    tier: isProd ? "production" : "non-production",
+    require_approval: isProd
+  };
+}
 function writeKeynvEnvMappings(path, projectName, envName, secrets) {
   const existing = existsSync(path) ? readFileSync(path, "utf8") : "";
   const lines = [];
@@ -46921,9 +47269,15 @@ any prompts.
     return 0;
   }
   /**
-   * Auto-scan mode (--yes without explicit --env-file). Finds .env files
-   * in the project root, classifies entries, creates a project, uploads
-   * secrets, and writes .keynv.env — all without prompts.
+   * Auto-scan mode (--yes without explicit --env-file). Recursively
+   * finds .env files across the project (root, apps/*, packages/*, …),
+   * classifies entries, creates the project + needed envs, uploads
+   * secrets, writes a `.keynv.env` next to each source `.env`, and
+   * renames the originals to `.env.backup` — all without prompts.
+   *
+   * Multi-source key collisions are resolved by auto-prefixing the
+   * vault key with the source directory slug; the user's code keeps
+   * using the original env-var name locally.
    */
   async runAutoScan(client) {
     const root = findProjectRoot(process.cwd());
@@ -46931,74 +47285,207 @@ any prompts.
       this.context.stderr.write("keynv: no project root found (no package.json, .git, etc.).\n");
       return 1;
     }
-    const envFiles = findEnvFiles(root.path);
+    const envFiles = findEnvFilesRecursive(root.path);
     if (envFiles.length === 0) {
-      this.context.stdout.write("keynv: no .env files found. Nothing to migrate.\n");
+      this.context.stdout.write(
+        "keynv: no .env files found (scanned root and subdirectories). Nothing to migrate.\n"
+      );
       return 0;
     }
     const projectName = this.project ?? root.suggestedName;
-    const envName = this.env ?? suggestedEnvForSuffix(envFiles[0]?.suffix ?? null);
-    const secrets = [];
+    const cliEnv = this.env;
+    const allSources = [];
+    const isSecret = /* @__PURE__ */ new Set();
+    let skippedCount = 0;
     for (const f of envFiles) {
       try {
         const entries = parseEnvFile(readFileSync(f.path, "utf8"), f.path);
+        const envName = cliEnv ?? suggestedEnvForSuffix(f.suffix);
         for (const e2 of entries) {
-          if (classifyEntry(e2.name, e2.value).verdict === "secret") {
-            secrets.push({ name: e2.name, value: e2.value });
+          const verdict = classifyEntry(e2.name, e2.value).verdict;
+          if (verdict === "skip") {
+            skippedCount++;
+            continue;
           }
+          if (verdict === "secret" && !e2.isAlias) {
+            isSecret.add(`${f.path}|${e2.name}`);
+          }
+          allSources.push({
+            file: f,
+            envName,
+            name: e2.name,
+            value: e2.value,
+            isAlias: e2.isAlias,
+            line: e2.line
+          });
         }
       } catch {
-        this.context.stderr.write(`keynv: warning \u2014 could not parse ${f.name}, skipping.
-`);
+        this.context.stderr.write(
+          `keynv: warning \u2014 could not parse ${displayHit(root.path, f)}, skipping.
+`
+        );
       }
     }
-    if (secrets.length === 0) {
-      this.context.stdout.write("keynv: no secrets detected in .env files. Nothing to upload.\n");
+    if (allSources.length === 0) {
+      this.context.stdout.write("keynv: no migrable entries in .env files. Nothing to do.\n");
       return 0;
     }
+    const plan = planVaultKeys(allSources);
+    for (const r of plan.renamed) {
+      this.context.stderr.write(
+        `keynv: renamed ${r.localKey} -> ${r.vaultKey} in env ${r.envName} (collision with ${r.otherSources.map((s) => displayHit(root.path, s)).join(", ")})
+`
+      );
+    }
+    for (const m of plan.merged) {
+      this.context.stderr.write(
+        `keynv: merged ${m.key} in env ${m.envName} (same value in ${m.sources.map((s) => displayHit(root.path, s)).join(", ")})
+`
+      );
+    }
+    for (const s of plan.shadowed) {
+      this.context.stderr.write(
+        `keynv: dotenv last-wins: ${s.localKey} in ${relFromRootPath(root.path, s.containingDir)} (${s.earlierFiles.join(", ")} -> ${s.laterFile})
+`
+      );
+    }
+    const distinctEnvs = [...new Set(plan.resolved.map((r) => r.envName))];
+    const secretCount = plan.resolved.filter(
+      (r) => isSecret.has(`${r.source.path}|${r.localKey}`)
+    ).length;
+    const literalCount = plan.resolved.length - secretCount;
     this.context.stdout.write(
-      `keynv: auto-scan found ${secrets.length} secret(s) across ${envFiles.length} file(s).
+      `keynv: auto-scan found ${secretCount} secret(s) and ${literalCount} literal(s) across ${envFiles.length} file(s)${skippedCount > 0 ? `; skipped ${skippedCount} framework entr${skippedCount === 1 ? "y" : "ies"}` : ""}.
 `
     );
     if (this.dryRun) {
-      for (const { name } of secrets) {
-        const aliasKey = toAliasKey2(name);
-        this.context.stdout.write(`  ${name}=@${projectName}.${envName}.${aliasKey}
-`);
+      for (const r of plan.resolved) {
+        const tag = isSecret.has(`${r.source.path}|${r.localKey}`) ? "secret" : "literal";
+        const target = isSecret.has(`${r.source.path}|${r.localKey}`) ? `@${projectName}.${r.envName}.${r.vaultKey}` : r.value;
+        this.context.stdout.write(
+          `  ${displayHit(root.path, r.source)}: ${r.localKey}=${target}  [${tag}]
+`
+        );
       }
       return 0;
     }
     let projectId2;
     try {
       projectId2 = await resolveProjectId(client, projectName);
+      try {
+        const detail = await client.request(`/v1/projects/${projectId2}`);
+        const existing = new Set(detail.environments.map((e2) => e2.name));
+        const missing = distinctEnvs.filter((e2) => !existing.has(e2));
+        for (const env2 of missing) {
+          await client.request(`/v1/projects/${projectId2}/environments`, {
+            method: "POST",
+            body: envBodyFor2(env2)
+          });
+          this.context.stdout.write(`keynv: added env "${env2}" to project "${projectName}".
+`);
+        }
+      } catch (err) {
+        this.context.stderr.write(
+          `keynv: warning \u2014 could not reconcile envs for ${projectName}: ${err instanceof Error ? err.message : String(err)}
+`
+        );
+      }
     } catch {
       const created = await client.request("/v1/projects", {
         method: "POST",
         body: {
           name: projectName,
-          environments: [{ name: envName, tier: "non-production", require_approval: false }]
+          environments: distinctEnvs.map((name) => envBodyFor2(name))
         }
       });
       projectId2 = created.id;
-      this.context.stdout.write(`keynv: created project "${projectName}" (${projectId2}).
-`);
+      this.context.stdout.write(
+        `keynv: created project "${projectName}" (${projectId2}) with env(s): ${distinctEnvs.join(", ")}
+`
+      );
+    }
+    const aliasByGroup = /* @__PURE__ */ new Map();
+    const secretGroupMap = /* @__PURE__ */ new Map();
+    for (const r of plan.resolved) {
+      if (!isSecret.has(`${r.source.path}|${r.localKey}`)) continue;
+      const k2 = `${r.envName}|${r.vaultKey}`;
+      if (!secretGroupMap.has(k2)) {
+        secretGroupMap.set(k2, { envName: r.envName, vaultKey: r.vaultKey, value: r.value });
+      }
+    }
+    let uploaded = 0;
+    const failed = [];
+    for (const [composite, g] of secretGroupMap) {
+      const alias2 = reference_exports.buildAlias({
+        project: projectName,
+        environment: g.envName,
+        key: g.vaultKey
+      });
+      if (!alias2) {
+        failed.push({ name: g.vaultKey, reason: `invalid alias key: ${g.vaultKey}` });
+        continue;
+      }
+      try {
+        await client.request(`/v1/projects/${projectId2}/secrets`, {
+          method: "POST",
+          body: { env: g.envName, key: g.vaultKey, value: g.value }
+        });
+        aliasByGroup.set(composite, alias2.literal);
+        uploaded++;
+      } catch (err) {
+        failed.push({
+          name: g.vaultKey,
+          reason: err instanceof Error ? err.message : String(err)
+        });
+      }
     }
-    const secretsWithKeys = secrets.map((s) => ({ ...s, aliasKey: toAliasKey2(s.name) }));
-    const result = await this.uploadSecrets(
-      client,
-      projectId2,
-      projectName,
-      envName,
-      secretsWithKeys
-    );
-    if (result !== 0) return result;
-    const keynvEnvPath = join(root.path, ".keynv.env");
-    const written = writeKeynvEnvMappings(keynvEnvPath, projectName, envName, secretsWithKeys);
     this.context.stdout.write(
-      written > 0 ? `keynv: wrote ${keynvEnvPath}
-` : `keynv: ${keynvEnvPath} already up to date
+      `keynv: uploaded ${uploaded}/${secretGroupMap.size} secret(s) to ${projectName}.
 `
     );
+    if (failed.length > 0) {
+      for (const f of failed) this.context.stderr.write(`  failed: ${f.name} \u2014 ${f.reason}
+`);
+      return 1;
+    }
+    const defaultEnv = distinctEnvs.includes("dev") ? "dev" : distinctEnvs[0];
+    const buckets = /* @__PURE__ */ new Map();
+    for (const r of plan.resolved) {
+      const k2 = `${r.source.containingDir}|${r.envName}`;
+      let b2 = buckets.get(k2);
+      if (!b2) {
+        b2 = {
+          containingDir: r.source.containingDir,
+          envName: r.envName,
+          aliasLines: [],
+          literalEntries: []
+        };
+        buckets.set(k2, b2);
+      }
+      const isSec = isSecret.has(`${r.source.path}|${r.localKey}`);
+      const alias2 = aliasByGroup.get(`${r.envName}|${r.vaultKey}`);
+      if (isSec && alias2 !== void 0) {
+        b2.aliasLines.push([r.localKey, alias2]);
+      } else {
+        b2.literalEntries.push({ name: r.localKey, value: r.value });
+      }
+    }
+    for (const b2 of buckets.values()) {
+      const targetName = b2.envName === defaultEnv ? ".keynv.env" : `.keynv.${b2.envName}.env`;
+      const targetPath = join(b2.containingDir, targetName);
+      const dirIntoExisting = existsSync(targetPath);
+      const lines = composeKeynvEnv({
+        uploadedAliases: new Map(b2.aliasLines),
+        literals: b2.literalEntries,
+        mergeWithExisting: dirIntoExisting ? readFileSync(targetPath, "utf8") : null
+      });
+      writeFileSync(targetPath, `${lines.join("\n")}
+`);
+      this.context.stdout.write(
+        `keynv: ${dirIntoExisting ? "updated" : "wrote"} ${relFromRootPath(root.path, targetPath)}
+`
+      );
+    }
     try {
       const outcome = writeAiContext(root.path);
       if (outcome === "created") this.context.stdout.write("keynv: wrote AGENTS.md\n");
@@ -47006,9 +47493,19 @@ any prompts.
       this.context.stdout.write("keynv: warning \u2014 could not write AGENTS.md.\n");
     }
     for (const f of envFiles) {
-      unlinkSync(f.path);
-      this.context.stdout.write(`keynv: removed ${f.name} (secrets migrated to vault).
-`);
+      const relSrc = displayHit(root.path, f);
+      try {
+        const { renamedTo } = backupEnvFile(f.path);
+        this.context.stdout.write(
+          `keynv: renamed ${relSrc} -> ${relFromRootPath(root.path, renamedTo)}
+`
+        );
+      } catch (err) {
+        this.context.stderr.write(
+          `keynv: warning \u2014 could not rename ${relSrc}: ${err instanceof Error ? err.message : String(err)}
+`
+        );
+      }
     }
     this.context.stdout.write(
       "keynv: done. Use `keynv exec` to run commands with resolved secrets.\n"