# Workspace ThothII — test (DWH remoto) per i test L2.
# Struttura allineata a workspaces/tht.example.yaml e tht/config.py.
# I segreti vivono SOLO in .env (${THT_*}).

database:
  host: ${THT_DB_HOST}
  port: ${THT_DB_PORT}
  database: ${THT_DB_NAME}
  schema: datawarehouse
  user: ${THT_DB_USER}
  password: ${THT_DB_PASSWORD}
  transport: rest

rest:
  base_url: ${THT_DWH_REST_URL}
  api_key: ${THT_DWH_API_KEY}
  ssl_ca: ${THT_SSL_CA}

paths:
  artifacts: artifacts
  indexes: indexes
  sessions: sessions

embeddings:
  base_url: ${THT_OLLAMA_URL}
  model: nomic-embed-text-v2-moe
  dim: 768
  batch_size: 64

# LOADING diretto del pgvector (server-only). Su workstation la lettura passa da
# vector_rest; i campi direct-transport non sono usati ma il modello DatabaseConfig
# li richiede, per cui si appoggiano alle stesse variabili del server (popolate nel
# .env del server; sul workstation restano dummy/inediti finche' transport=rest).
vector_db:
  host: ${THT_VEC_HOST}
  port: ${THT_VEC_PORT}
  database: postgres
  schema: vectors
  user: ${THT_VEC_USER}
  password: ${THT_VEC_PASSWORD}

# LETTURA del pgvector via REST remota (rpc search_similar), ruolo vector_reader.
vector_rest:
  base_url: ${THT_VEC_REST_URL}
  api_key: ${THT_VEC_API_KEY}
  ssl_ca: ${THT_SSL_CA}

# SCRITTURA controllata del pgvector via REST remota (upsert/hash via RPC allowlist),
# ruolo vector_writer. Path DEDICATO /vector/write/v1/ (diverso dal reader): la chiave
# writer vale solo qui, la reader solo su /vector/v1/. Key SEPARATA dalla lettura.
vector_write_rest:
  base_url: ${THT_VEC_WRITE_REST_URL}
  api_key: ${THT_VEC_WRITE_API_KEY}
  ssl_ca: ${THT_SSL_CA}

vector:
  max_chunk_chars: 4000

search:
  rrf_k: 60

execution:
  allow: [cte_test, explain, preview, aggregate, export]
  max_preview_rows: 10
  statement_timeout_ms: 5000
  forbidden_functions: [set_config, dblink, dblink_exec, lo_import]