17-May-2026 — self-heal missing AUTH_SECRET when resuming a pre-#258 environment ref: #260

build 647 — commit 33d25ff

env-setup: self-heal missing AUTH_SECRET when resuming a pre-#258 environment (#260)

Environments whose DB record was written before #258 can lack AUTH_SECRET in envConfig.secrets - the wizard generated it in memory and wrote it to a now-defunct non-vcs/secrets/ file but never persisted it. Resuming such an environment failed at the deployToFlyio pre-flight check with "missing required secrets [AUTH_SECRET]", forcing a destroy/recreate or a hand-backfill into the DB document.

resumeEnvironment now classifies missing REQUIRED_SECRETS before deploy:

• AUTH_SECRET is auto-generated, persisted back to the environment record, and reported on the wizard progress stream, then the deploy proceeds.

• Any other missing required secret (AWS_*, MONGODB_URI, NODE_ENV) throws fast with a message naming exactly what is missing and where to supply it.

• secrets.ts: classifyMissingRequiredSecrets splits missing required secrets into autoGeneratable vs unrecoverable.

• environments-config.ts: persistEnvironmentSecret deep-merges a single secret into one environment's secrets without touching the rest.

• environment.ts: healMissingRequiredSecrets orchestrates the recovery.

• secrets.spec.ts: unit tests for the classifier.