feat: extend publish-openapi pipeline to include VIN Decoder API

Add vin-decoder as 4th entry to the APIS array in scripts/publish-openapi.js
and add RAPIDAPI_VIN_API_ID / RAPIDAPI_VIN_VERSION_ID secrets to the
publish-openapi.yaml CI workflow env block.

Closes leeworks-agents/api-company#138

.gitea/workflows/publish-openapi.yaml

@@ -2,7 +2,8 @@
 # Requires secrets (configured once RapidAPI listings are live):
 #   RAPIDAPI_PLATFORM_KEY, RAPIDAPI_ZIP_API_ID, RAPIDAPI_ZIP_VERSION_ID,
 #   RAPIDAPI_HOLIDAYS_API_ID, RAPIDAPI_HOLIDAYS_VERSION_ID,
-#   RAPIDAPI_AQI_API_ID, RAPIDAPI_AQI_VERSION_ID
+#   RAPIDAPI_AQI_API_ID, RAPIDAPI_AQI_VERSION_ID,
+#   RAPIDAPI_VIN_API_ID, RAPIDAPI_VIN_VERSION_ID
 #
 # If RAPIDAPI_PLATFORM_KEY is not set the publish step exits 0 with a skip message.
 
@@ -55,4 +56,6 @@ jobs:
           RAPIDAPI_HOLIDAYS_VERSION_ID: ${{ secrets.RAPIDAPI_HOLIDAYS_VERSION_ID }}
           RAPIDAPI_AQI_API_ID: ${{ secrets.RAPIDAPI_AQI_API_ID }}
           RAPIDAPI_AQI_VERSION_ID: ${{ secrets.RAPIDAPI_AQI_VERSION_ID }}
+          RAPIDAPI_VIN_API_ID: ${{ secrets.RAPIDAPI_VIN_API_ID }}
+          RAPIDAPI_VIN_VERSION_ID: ${{ secrets.RAPIDAPI_VIN_VERSION_ID }}
         run: node scripts/publish-openapi.js

docs/dns.md

@@ -1,6 +1,6 @@
 # DNS Configuration
 
-**Last updated:** 2026-05-24  
+**Last updated:** 2026-05-30  
 **Status:** Planned (Phase 6 pre-launch)
 
 ---
@@ -28,6 +28,7 @@ kubectl get svc -n ingress-nginx ingress-nginx-controller -o jsonpath='{.status.
 | `status.leeworks.dev` | A | `<cluster-ingress-ip>` | Gatus status page | Yes (cert-manager) |
 | `registry.leeworks.dev` | A | `<cluster-ingress-ip>` | Container registry (Gitea) | Yes (cert-manager) |
 | `grafana.leeworks.dev` | A | `<cluster-ingress-ip>` | Grafana (internal/restricted) | Yes (cert-manager) |
+| `vin.leeworks.dev` | A | `<cluster-ingress-ip>` | VIN Decoder API | Yes (cert-manager) |
 
 ---
 
@@ -103,6 +104,7 @@ dig docs.leeworks.dev +short
 dig status.leeworks.dev +short
 dig registry.leeworks.dev +short
 dig grafana.leeworks.dev +short
+dig vin.leeworks.dev +short
 
 # Check TLS certificates (once services are deployed)
 curl -v https://zip.leeworks.dev/health 2>&1 | grep -E "SSL|certificate|issuer"
@@ -126,7 +128,7 @@ The following actions require human operator access to the DNS provider:
 
 1. Log into the DNS provider managing `leeworks.dev`
 2. Find the cluster ingress IP: `kubectl get svc -n ingress-nginx ingress-nginx-controller`
-3. Create/update the 7 A records listed in the table above
+3. Create/update the 8 A records listed in the table above
 4. Verify propagation: `dig +trace zip.leeworks.dev`
 
 DNS propagation typically takes 5–60 minutes.
@@ -143,4 +145,5 @@ DNS propagation typically takes 5–60 minutes.
 - [ ] `status.leeworks.dev` → DNS record created
 - [ ] `registry.leeworks.dev` → DNS record created
 - [ ] `grafana.leeworks.dev` → DNS record created
-- [ ] TLS certificates issued and valid for all 7 subdomains
+- [ ] `vin.leeworks.dev` → DNS record created
+- [ ] TLS certificates issued and valid for all 8 subdomains

docs/pre-launch-checklist.md

@@ -11,6 +11,7 @@ Use this checklist as the final go-live gate — run through every item the day
   - [ ] `zip-enrichment` pod `READY=1/1` (`kubectl get pods -n zip-enrichment`)
   - [ ] `holidays` pod `READY=1/1` (`kubectl get pods -n holidays`)
   - [ ] `air-quality` pod `READY=1/1` (`kubectl get pods -n air-quality`)
+  - [ ] `vin-decoder` pod `READY=1/1` (`kubectl get pods -n vin-decoder`)
 - [ ] `docs-site` pod Running and READY (`kubectl get pods -n docs-site`)
 - [ ] Prometheus scraping all three API services (check Prometheus Targets UI)
 - [ ] Grafana dashboard accessible at `grafana.leeworks.dev`
@@ -25,8 +26,9 @@ Use this checklist as the final go-live gate — run through every item the day
 - [ ] `docs.leeworks.dev` → cluster ingress IP
 - [ ] `status.leeworks.dev` → cluster ingress IP
 - [ ] `registry.leeworks.dev` → cluster ingress IP
+- [ ] `vin.leeworks.dev` → cluster ingress IP (`dig vin.leeworks.dev +short` + `curl -I https://vin.leeworks.dev`)
 - [ ] `grafana.leeworks.dev` → cluster ingress IP
-- [ ] TLS certificates issued for all 7 subdomains (`kubectl get certificates -A`)
+- [ ] TLS certificates issued for all 8 subdomains (`kubectl get certificates -A`)
 
 ---
 
@@ -38,9 +40,12 @@ Use this checklist as the final go-live gate — run through every item the day
 - [ ] `GET /zip/{zip}` returns correct data for a sample ZIP code (e.g. `curl https://zip.leeworks.dev/zip/10001`)
 - [ ] `GET /holidays/{year}` returns correct data (e.g. `curl https://holidays.leeworks.dev/holidays/2026`)
 - [ ] `GET /aqi/{city}` returns correct data (e.g. `curl https://aqi.leeworks.dev/aqi/New%20York`)
+- [ ] `GET /v1/health` returns HTTP 200 on **vin-decoder** (`curl https://vin.leeworks.dev/v1/health`)
+- [ ] `GET /v1/decode?vin=1HGCM82633A004352` returns correct make/model/year data
+- [ ] Request **without** `X-RapidAPI-Proxy-Secret` returns HTTP 403 on **vin-decoder** (`curl https://vin.leeworks.dev/v1/decode?vin=1HGCM82633A004352`)
 - [ ] Request **without** `X-RapidAPI-Proxy-Secret` returns HTTP 403 on all three APIs
 - [ ] `docs.leeworks.dev/pricing` loads correctly
-- [ ] `status.leeworks.dev` shows all three APIs as **UP**
+- [ ] `status.leeworks.dev` shows all **four** APIs as **UP**
 
 ---
 
@@ -50,6 +55,8 @@ Use this checklist as the final go-live gate — run through every item the day
 - [ ] `docs/legal/privacy-policy.md` committed and reachable at `docs.leeworks.dev/legal/privacy-policy`
 - [ ] `docs/legal/acceptable-use-policy.md` committed and reachable at `docs.leeworks.dev/legal/acceptable-use-policy`
 - [ ] All three APIs listed on RapidAPI with **Free + 3 paid tiers** (leeworks-agents/api-company#44)
+- [ ] VIN Decoder listed on RapidAPI with Free + 3 paid tiers (leeworks-agents/api-company#131)
+- [ ] `rapidapi-proxy-secret` updated with real RapidAPI value in `vin-decoder` namespace (leeworks-agents/api-company#128)
 - [ ] PayPal linked to RapidAPI (leeworks-agents/api-company#19)
 - [ ] `rapidapi-proxy-secret` updated with **real** RapidAPI values in all 3 namespaces (leeworks-agents/api-company#81)
 

docs/rapidapi-listings.md

@@ -193,6 +193,77 @@ air quality, AQI, PM2.5, PM10, air pollution, smog, ozone, nitrogen dioxide, env
 
 ---
 
+---
+
+## 4. VIN Decoder API
+
+### API Name
+VIN Decoder API
+
+### Tagline
+Decode any vehicle VIN into make, model, year, engine, and trim — powered by NHTSA vPIC.
+
+### Short Description (≤ 300 chars)
+Decode any 17-character Vehicle Identification Number into structured vehicle data: make, model, year, trim, body style, engine specs, transmission, and assembly plant. Backed by the NHTSA vPIC public database with 90-day result caching.
+
+### Long Description
+
+Unlock the full story behind any Vehicle Identification Number with a single API call.
+
+**What you get per VIN:**
+- Make, model, model year, and trim level
+- Body class (Sedan, SUV, Pickup, etc.) and drive type (FWD, RWD, AWD, 4WD)
+- Engine displacement (CC and litres) and cylinder count
+- Primary fuel type (Gasoline, Diesel, Electric, Hybrid, etc.)
+- Transmission style (Automatic, Manual, CVT) and speed count
+- Assembly plant city, state, and country
+- Full manufacturer name and NHTSA vehicle type classification
+- NHTSA decode error code and text for non-standard VINs
+
+**Data source:** NHTSA Product Information Catalog and Vehicle Listing (vPIC) — US federal government public-domain data, always current. No licensing fees.
+
+**Coverage:** Model years 1981–present. All major domestic and import manufacturers registered with NHTSA.
+
+**Caching:** Decoded VINs are cached for 90 days in a local SQLite store. The `X-Cache: HIT/MISS` response header tells you whether the result came from cache or a live NHTSA lookup.
+
+**Use cases:**
+- Used-car marketplaces — enrich listings with decoded specs at scale
+- Insurance platforms — auto-populate vehicle details from VIN at quote time
+- Fleet management — maintain structured vehicle inventories without manual entry
+- Automotive valuation tools — feed year/make/model/trim into pricing algorithms
+- Recall & warranty systems — match VINs to manufacturer service campaigns
+- Registration & titling apps — validate and enrich VIN data in DMV workflows
+
+**Endpoints:**
+- `GET /v1/decode` — decode a single VIN
+- `POST /v1/batch` — decode up to 50 VINs in one request
+- `GET /v1/health` — service health check (no auth required)
+
+### Category
+Data / Automotive / Transportation
+
+### Plan Table
+
+| Tier | Price/month | Requests/month | Rate limit |
+|------|-------------|----------------|------------|
+| Free | $0 | 100 req/mo | 5 req/min |
+| Basic | $9 | 5,000 req/mo | 60 req/min |
+| Pro | $19 | 20,000 req/mo | 200 req/min |
+| Ultra | $49 | 100,000 req/mo | 500 req/min |
+
+### Endpoint Descriptions
+
+| Endpoint | Description |
+|----------|-------------|
+| `GET /v1/decode?vin={vin}` | Decodes a single 17-character VIN. Returns structured vehicle attributes including make, model, year, engine, body, drivetrain, and plant info. Optional `?raw=true` includes the full NHTSA vPIC response. |
+| `POST /v1/batch` | Accepts a JSON body with a `vins` array (1–50 VINs). Returns one decoded result (or error) per VIN in input order, plus aggregate counts for `cached_count` and `error_count`. |
+| `GET /v1/health` | Returns service status, uptime, cache stats (entries, hit rate, size), and NHTSA upstream reachability. No `X-RapidAPI-Proxy-Secret` required. |
+
+### Keywords
+VIN decoder, vehicle identification number, car lookup, NHTSA, make model year, automotive API, vehicle data, VIN lookup, auto specs, fleet management
+
+---
+
 ## Tagline Length Validation
 
 Run to confirm all taglines are ≤ 120 characters:

docs/secrets-checklist.md

@@ -19,6 +19,9 @@ Follow this list top-to-bottom; each step unblocks the next.
 - [ ] 8. `gitea-registry` (zip-enrichment, holidays, air-quality, docs-site) — imagePullSecret for pods pulling from `registry.leeworks.dev`
 - [ ] 9. `gitea-image-automation-token` (flux-system) — write-scoped token for Flux ImageUpdateAutomation to push image-tag commits
 - [ ] 10. `rapidapi-proxy-secret` (zip-enrichment, holidays, air-quality) — RapidAPI Proxy Secret for server-side request validation
+- [ ] 11. `GITEA_TOKEN` Actions secret in `leeworks-agents/vin-decoder` repo — enables CI image push for VIN Decoder (leeworks-agents/api-company#126)
+- [ ] 12. `gitea-registry` imagePullSecret in `vin-decoder` namespace — enables pod image pulls from `registry.leeworks.dev` (leeworks-agents/api-company#127)
+- [ ] 13. `rapidapi-proxy-secret` in `vin-decoder` namespace — enables RapidAPI proxy-secret header validation (leeworks-agents/api-company#128)
 
 ---
 
@@ -194,6 +197,68 @@ done
 ```
 
 
+### 11. `GITEA_TOKEN` Actions secret in `leeworks-agents/vin-decoder`
+
+| Field    | Value |
+|----------|-------|
+| Name     | `GITEA_TOKEN` |
+| Scope    | Gitea Actions Secret — set in repo Settings |
+| Purpose  | CI workflow pushes container image to `registry.leeworks.dev/vin-decoder/api:<sha>` |
+| Source   | Gitea token with `write:packages` scope (reuse from item #5 if it has `write:packages`) |
+| Tracked  | leeworks-agents/api-company#126 |
+| Unblocks | CI image push for VIN Decoder |
+
+Path: **Gitea → leeworks-agents/vin-decoder → Settings → Secrets → `GITEA_TOKEN`**
+
+---
+
+### 12. `gitea-registry` imagePullSecret in `vin-decoder` namespace
+
+| Field     | Value |
+|-----------|-------|
+| Name      | `gitea-registry` |
+| Namespace | `vin-decoder` |
+| Type      | `kubernetes.io/dockerconfigjson` |
+| Purpose   | Allows VIN Decoder pods to pull images from `registry.leeworks.dev` without ImagePullBackOff |
+| Tracked   | leeworks-agents/api-company#127 |
+
+```bash
+kubectl create namespace vin-decoder --dry-run=client -o yaml | kubectl apply -f -
+kubectl create secret docker-registry gitea-registry \
+  --namespace=vin-decoder \
+  --docker-server=registry.leeworks.dev \
+  --docker-username=leeworks-agents \
+  --docker-password=<GITEA_TOKEN_WITH_READ_PACKAGES> \
+  --docker-email=agent@leeworks.dev
+```
+
+---
+
+### 13. `rapidapi-proxy-secret` in `vin-decoder` namespace
+
+| Field     | Value |
+|-----------|-------|
+| Name      | `rapidapi-proxy-secret` |
+| Namespace | `vin-decoder` |
+| Purpose   | VIN Decoder validates `X-RapidAPI-Proxy-Secret` header; returns HTTP 403 if missing/wrong |
+| Source    | RapidAPI dashboard → VIN Decoder listing → Settings → Security → Proxy Secret |
+| Tracked   | leeworks-agents/api-company#128 |
+
+```bash
+# Placeholder (unblocks deploy testing):
+kubectl create secret generic rapidapi-proxy-secret \
+  --namespace=vin-decoder \
+  --from-literal=X-RapidAPI-Proxy-Secret=PLACEHOLDER_REPLACE_AFTER_RAPIDAPI_LISTING
+
+# Update with real value after RapidAPI listing (#131) is live:
+kubectl create secret generic rapidapi-proxy-secret \
+  -n vin-decoder \
+  --from-literal=X-RapidAPI-Proxy-Secret=<VIN_RAPIDAPI_PROXY_SECRET> \
+  --save-config --dry-run=client -o yaml | kubectl apply -f -
+```
+
+---
+
 ## Dependency Order
 
 ```

flux/image-automation/imagepolicies.yaml

@@ -40,6 +40,18 @@ spec:
 ---
 apiVersion: image.toolkit.fluxcd.io/v1beta2
 kind: ImagePolicy
+metadata:
+  name: vin-decoder
+  namespace: flux-system
+spec:
+  imageRepositoryRef:
+    name: vin-decoder
+  policy:
+    semver:
+      range: ">=0.1.0"
+---
+apiVersion: image.toolkit.fluxcd.io/v1beta2
+kind: ImagePolicy
 metadata:
   name: docs-site
   namespace: flux-system

flux/image-automation/imagerepositories.yaml

@@ -35,6 +35,17 @@ spec:
 ---
 apiVersion: image.toolkit.fluxcd.io/v1beta2
 kind: ImageRepository
+metadata:
+  name: vin-decoder
+  namespace: flux-system
+spec:
+  image: registry.leeworks.dev/vin-decoder/api
+  interval: 5m
+  secretRef:
+    name: gitea-leeworks-agents-token
+---
+apiVersion: image.toolkit.fluxcd.io/v1beta2
+kind: ImageRepository
 metadata:
   name: docs-site
   namespace: flux-system

flux/monitoring/gatus-helmrelease.yaml

@@ -68,6 +68,15 @@ spec:
               description: "Air Quality API is down"
               send-on-resolved: true
 
+
+        - name: VIN Decoder API
+          url: https://vin.leeworks.dev/v1/health
+          interval: 1m
+          conditions:
+            - "[STATUS] == 200"
+            - "[RESPONSE_TIME] < 1000"
+          alerts:
+            - type: slack
         - name: Docs Site
           url: https://docs.leeworks.dev
           interval: 5m

scripts/publish-openapi.js

@@ -11,6 +11,8 @@
  *   RAPIDAPI_HOLIDAYS_VERSION_ID
  *   RAPIDAPI_AQI_API_ID
  *   RAPIDAPI_AQI_VERSION_ID
+ *   RAPIDAPI_VIN_API_ID
+ *   RAPIDAPI_VIN_VERSION_ID
  *
  * Usage: node scripts/publish-openapi.js
  */
@@ -45,6 +47,12 @@ const APIS = [
     apiId: process.env.RAPIDAPI_AQI_API_ID,
     versionId: process.env.RAPIDAPI_AQI_VERSION_ID,
   },
+  {
+    name: 'vin-decoder',
+    specPath: path.join(__dirname, '..', 'apis', 'vin-decoder', 'openapi.yaml'),
+    apiId: process.env.RAPIDAPI_VIN_API_ID,
+    versionId: process.env.RAPIDAPI_VIN_VERSION_ID,
+  },
 ];
 
 /**