# 17-May-2026 — self-heal missing AUTH_SECRET when resuming a pre-[#258](https://github.com/nbarrett/ngx-ramblers/issues/258) environment [ref: #260](https://github.com/nbarrett/ngx-ramblers/issues/260)

## [build 647](https://github.com/nbarrett/ngx-ramblers/actions/runs/26005601269) — [commit 33d25ff](https://github.com/nbarrett/ngx-ramblers/commit/33d25fffbcc6d35afbf57751cf531df0e15bde23)

_____

### **env-setup**: self-heal missing AUTH_SECRET when resuming a pre-[#258](https://github.com/nbarrett/ngx-ramblers/issues/258) environment ([#260](https://github.com/nbarrett/ngx-ramblers/issues/260))

Environments whose DB record was written before #258 can lack AUTH_SECRET
in envConfig.secrets - the wizard generated it in memory and wrote it to a
now-defunct non-vcs/secrets/ file but never persisted it. Resuming such an
environment failed at the deployToFlyio pre-flight check with
"missing required secrets [AUTH_SECRET]", forcing a destroy/recreate or a
hand-backfill into the DB document.

resumeEnvironment now classifies missing REQUIRED_SECRETS before deploy:
- AUTH_SECRET is auto-generated, persisted back to the environment record,
and reported on the wizard progress stream, then the deploy proceeds.
- Any other missing required secret (AWS_*, MONGODB_URI, NODE_ENV) throws
fast with a message naming exactly what is missing and where to supply it.

- secrets.ts: classifyMissingRequiredSecrets splits missing required
secrets into autoGeneratable vs unrecoverable.
- environments-config.ts: persistEnvironmentSecret deep-merges a single
secret into one environment's secrets without touching the rest.
- environment.ts: healMissingRequiredSecrets orchestrates the recovery.
- secrets.spec.ts: unit tests for the classifier.