# ============================================================
# AI PROVIDER (choose one)
# ============================================================

# Option 1: OpenRouter (default, cheapest, NOT HIPAA)
AI_PROVIDER=openrouter
OPENROUTER_API_KEY=sk-or-v1-your-key

# Option 2: AWS Bedrock (HIPAA compliant with BAA)
# AI_PROVIDER=bedrock
# AWS_BEDROCK_REGION=us-east-1
# AWS_ACCESS_KEY_ID=AKIA...
# AWS_SECRET_ACCESS_KEY=...
# (Or use IAM role — no keys needed if running on EC2/ECS)

# Option 3: Azure OpenAI (HIPAA compliant with BAA)
# AI_PROVIDER=azure
# AZURE_OPENAI_ENDPOINT=https://your-resource.openai.azure.com
# AZURE_OPENAI_API_KEY=your-key
# AZURE_DEPLOYMENT_NAME=gpt-4o-mini
# AZURE_OPENAI_API_VERSION=2024-02-01

# ============================================================
# TRANSCRIPTION (speech-to-text)
# ============================================================

# Option A: OpenAI Whisper (default if no AWS configured)
OPENAI_API_KEY=sk-your-openai-key

# Option B: Amazon Transcribe (HIPAA eligible, no S3 needed)
# Uses same AWS credentials as Bedrock above.
# Set TRANSCRIBE_PROVIDER=aws to force AWS even if OPENAI_API_KEY is set.
# Leave unset to auto-detect (uses AWS when AWS_BEDROCK_REGION is configured).
# TRANSCRIBE_PROVIDER=aws

# Amazon Transcribe Medical — better accuracy for clinical dictation
# Knows drug names, diagnoses, procedures, SOAP terminology
# HIPAA eligible (ensure your AWS account has a BAA)
# AWS_TRANSCRIBE_MEDICAL=true
# AWS_TRANSCRIBE_SPECIALTY=PRIMARYCARE
#   Other options: CARDIOLOGY, NEUROLOGY, ONCOLOGY, RADIOLOGY, UROLOGY

# Optional
ELEVENLABS_API_KEY=

# App
PORT=3000
APP_URL=https://your-domain.com
JWT_SECRET=generate-a-random-64-char-string-here
SESSION_SECRET=generate-another-random-string-here

# Email (for verification & password reset)
SMTP_HOST=smtp.gmail.com
SMTP_PORT=587
SMTP_USER=your-email@gmail.com
SMTP_PASS=your-app-password
SMTP_FROM=noreply@yourdomain.com

# Nextcloud (optional)
NEXTCLOUD_URL=https://cloud.yourdomain.com

# ============================================================
# DATABASE
# ============================================================
DATABASE_URL=postgresql://pedscribe:pedscribe_secret_change_me@postgres:5432/pedscribe
DB_PASSWORD=pedscribe_secret_change_me