Environment and Secrets Management

OneQuery now has two distinct config owners:

• workspace-dev for bun dev
• self-host for onequery gateway

The repo does not use a generated env-shaped local config file anymore, and startup does not round-trip config through committed env-shaped files.

The rewrite removed the old env-shaped local sync workflow. Repo-local development now starts from authored config files and derived projections only.

Profile Ownership

Workspace Dev

Workspace development is split across a pure config core and an explicit Node shell:

• fixed browser/API defaults in @onequery/config
• .onequery/dev/secrets.toml: untracked local secrets
• packages/config/src/workspace-dev.ts: schema, validation, and normalization
• packages/config/src/projections/*: Vite, runtime launch, and Drizzle projections
• packages/config-node/src/workspace-dev.ts: filesystem-backed loader
• packages/config-node/src/workspace-dev-init.ts: local secrets bootstrap

bun dev uses this profile only.

Default local ports:

• browser origin: http://localhost:4545
• Bun API listener: http://127.0.0.1:4555
• local PGlite data directory: .onequery/dev/pglite/onequery

Flow:

repo .onequery/dev/secrets.toml
                |
                v
      packages/config-node loadWorkspaceDev()
                |
                +--> Vite projection
                +--> Drizzle projection
                |
                v
   scripts/run-self-host-runtime.ts writes launch contract
                |
                v
          bun dev runtime startup

Self Host

Self-host is owned by the Rust CLI, not by the repo-local dev resolver:

• self-host/config.toml: authored operator config
• self-host/secrets.toml: generated/operator secrets
• run/launch.json: resolved startup contract written by the CLI
• apps/cli/.../config/self_host.rs: defaults, validation, and path rules

onequery gateway uses this profile only.

Overlapping secret keys stay aligned with workspace-dev while values stay independent:

• auth.secret
• crypto.master_encryption_key
• connectors.enrollment_token

Default self-host port:

• bundled public origin: http://127.0.0.1:5656

Flow:

self-host/config.toml + self-host/secrets.toml
                     |
                     v
       Rust resolve_self_host_config()
                     |
                     v
              run/launch.json
                     |
                     v
      packages/self-host-runtime startup reads it once

Practical Rules

• bun run dev:setup creates .onequery/dev/secrets.toml when it is missing and prepares the local PGlite data directory. It does not apply the application schema.
• bun dev reads repo-local workspace config and keeps browser/API listeners split on purpose. Its packaged runtime applies the application schema on startup.
• onequery gateway ignores repo-local .onequery/dev and starts from the resolved self-host launch contract.
• publicOrigin is the canonical public URL. Do not introduce separate public URL aliases alongside it.
• DATABASE_URL is a projection for consumers that need it. It is not the authored source of truth for workspace dev.
• onequery gateway does not support ambient DATABASE_URL; self-host storage is currently the bundled PGlite runtime only.
• Optional secrets for integrations can stay unset until you need them locally.

Commands

# Seed local workspace secrets and validate the workspace-dev config
bun run dev:setup

# Run the split browser/API workspace-dev flow
bun dev

# Start the packaged self-host runtime from the Rust-owned config roots
onequery gateway

For direct CLI development without a global install:

cargo run --manifest-path apps/cli/Cargo.toml --bin onequery -- gateway