spring:
  datasource:
    # createDatabaseIfNotExist=true — MySQL Connector/J 首次连接时若 DB 不存在则自动 CREATE DATABASE。
    # 本仓库所有建表语句都显式指定 utf8mb4 / utf8mb4_unicode_ci，不依赖 DB 默认字符集，所以即便
    # 自动创建的库用了 server 默认字符集也不会影响数据。要求 DB user 具备 CREATE 权限（默认 root 可）。
    # 如果使用受限账号，请提前手工执行：
    #   CREATE DATABASE mateclaw CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
    # characterEncoding takes a Java NIO charset name (UTF-8), not a MySQL
    # server charset name (utf8mb4) — passing utf8mb4 here throws
    # UnsupportedEncodingException at driver init. Java's UTF-8 already
    # encodes the full Unicode range including supplementary-plane chars
    # and emoji, so 4-byte characters travel intact. To make the server
    # treat the connection as utf8mb4, force the connection collation via
    # connectionCollation=utf8mb4_unicode_ci — that is what prevents the
    # `Data truncation: Incorrect string value` errors on emoji/CJK ext.
    url: jdbc:mysql://${DB_HOST:localhost}:${DB_PORT:3306}/${DB_NAME:mateclaw}?createDatabaseIfNotExist=true&useUnicode=true&characterEncoding=UTF-8&connectionCollation=utf8mb4_unicode_ci&useSSL=false&serverTimezone=Asia/Shanghai&allowPublicKeyRetrieval=true
    driver-class-name: com.mysql.cj.jdbc.Driver
    username: ${DB_USERNAME:root}
    password: ${DB_PASSWORD:mateclaw123}

  flyway:
    locations:
      - classpath:db/migration/mysql

  h2:
    console:
      enabled: false

# Production (multi-tenant server) hardening: fail closed on source-path
# validation. With no allowed-source-roots configured, every KB source
# directory is rejected rather than allowing full-filesystem reads — so a
# missing allow-list cannot silently re-open arbitrary directory scanning.
# Set MATE_WIKI_ALLOWED_SOURCE_ROOTS in .env (comma-separated paths):
#   MATE_WIKI_ALLOWED_SOURCE_ROOTS=/data/wiki,/opt/docs
# The default profile (H2 / desktop / single-tenant) leaves this off.
# Source watcher master switch (ops gate). Off by default; operators opt in.
# AND semantics: a KB is auto-scanned only when this global switch AND that
# KB's own auto-sync toggle are both on. Manual scans are unaffected.
#   MATE_WIKI_WATCHER_ENABLED=true
#   MATE_WIKI_WATCHER_INTERVAL_MS=300000   # scan interval, default 5 min
mate:
  wiki:
    require-allowed-roots: true
    allowed-source-roots: ${MATE_WIKI_ALLOWED_SOURCE_ROOTS:}
    watcher-enabled: ${MATE_WIKI_WATCHER_ENABLED:false}
    watcher-interval-ms: ${MATE_WIKI_WATCHER_INTERVAL_MS:300000}