# Application
APP_ENV=development

# MySQL
MYSQL_HOST=127.0.0.1
MYSQL_PORT=3306
MYSQL_DATABASE=jinrong_agent
MYSQL_CORE_DATABASE=jinrong_core
MYSQL_USER=root
MYSQL_PASSWORD=

# Redis
REDIS_URL=redis://127.0.0.1:6379/0

# Neo4j
NEO4J_URI=bolt://localhost:7687
NEO4J_USER=neo4j
NEO4J_PASSWORD=

# Milvus Lite
MILVUS_URI=./data/milvus.db

# Ollama Embedding
OLLAMA_BASE_URL=http://127.0.0.1:11434
EMBED_MODEL=bge-m3

# DeepSeek LLM
DEEPSEEK_API_KEY=
DEEPSEEK_BASE_URL=https://api.deepseek.com

# JWT (T-01): production uses RS256 public key from IdP; empty path -> HS256 dev secret
# (HS256 is rejected at startup when APP_ENV != development)
JWT_PUBLIC_KEY_PATH=
JWT_DEV_SECRET=change-me-in-dev-only
JWT_ISSUER=https://idp.jinrong.internal
JWT_AUDIENCE=agent-gateway

# Risk thresholds (defaults = frozen rules, see docs/PRD/附-风控规则表.md)
RISK_ASSESSMENT_VALID_DAYS=365
RISK_LARGE_AMOUNT=500000
RISK_DAILY_TOTAL=500000
RISK_FREQ_COUNT=3
RISK_PROBE_WINDOW_MINUTES=5
RISK_PROBE_COUNT=3
RISK_PROBE_AMOUNT=400000
RISK_SMALL_AMOUNT=10000
RISK_SMALL_COUNT=3
RISK_AML_DEFAULT_THRESHOLD=0.85