# =============================================================================
# .env.example — copy to .env and fill in real values (.env is gitignored)
# Only variables actually consumed by code in this repo are listed.
# =============================================================================

# ── Flask core ───────────────────────────────────────────────────────────────
SESSION_SECRET=change-me-in-prod
STEP_UP_SECRET=change-me-hmac-secret
SQLALCHEMY_DATABASE_URI=sqlite:///mcp_server.db
LOG_LEVEL=DEBUG
# LOG_FORMAT=json

# ── Newsletter sign-up (Resend) ──────────────────────────────────────────────
# Required for POST /api/subscribe. Without these the endpoint returns 503.
# Domain must be verified in the Resend dashboard (use healthclaw.io — same
# DNS already serves privacy@/security@/legal@). Sender: updates@healthclaw.io.
RESEND_API_KEY=
RESEND_AUDIENCE_ID=

# ── Anthropic / agent client (optional) ──────────────────────────────────────
ANTHROPIC_API_KEY=

# ── Redis (optional — used for rate limiting + sessions when set) ────────────
REDIS_URL=redis://localhost:6379/0

# ── FHIR upstream proxy (optional — leave empty for local SQLite mode) ───────
# Examples:
#   FHIR_UPSTREAM_URL=https://hapi.fhir.org/baseR4
#   FHIR_UPSTREAM_URL=https://r4.smarthealthit.org
FHIR_UPSTREAM_URL=
FHIR_UPSTREAM_TIMEOUT=15
FHIR_LOCAL_BASE_URL=http://localhost:5000
FHIR_VALIDATOR_URL=http://localhost:8080

# ── Medplum upstream (optional — auto-OAuth client-credentials grant) ────────
MEDPLUM_BASE_URL=
MEDPLUM_CLIENT_ID=
MEDPLUM_CLIENT_SECRET=

# ── Fasten Connect (optional — exposes Stitch widget when set) ───────────────
FASTEN_PUBLIC_KEY=
FASTEN_PRIVATE_KEY=
FASTEN_CURATR_SCAN=false

# ── HealthEx export pipeline (used by scripts/export_healthex_mcp.py) ────────
HEALTHEX_AUTH_TOKEN=
HEALTHEX_MCP_URL=https://api.healthex.io/mcp
# Optional: salt for deterministic identifier hashing in PHI redaction
HEALTHCLAW_REDACT_SALT=

# ── Public demo gating ───────────────────────────────────────────────────────
# Comma-separated tenant IDs allowed without auth (e.g. "desktop-demo")
PUBLIC_TENANTS=desktop-demo
# Production must authenticate reads for every tenant outside the allowlist.
READ_AUTH_ENABLED=false
# Set to 1 on the public landing host to allow search-engine indexing
ALLOW_INDEXING=0
# Set to 1 on Vercel to skip Command Center routes (no persistent FS there)
DISABLE_COMMAND_CENTER=0

# ── MCP Orchestrator (services/agent-orchestrator/) ──────────────────────────
MCP_PORT=3001
MCP_AUTH_TOKEN=replace-with-a-long-random-token
FHIR_BASE_URL=http://localhost:5000/r6/fhir
ALLOWED_ORIGINS=
RATE_LIMIT_MAX=120
TENANT_ID=desktop-demo

# ── OpenClaw Telegram bot (openclaw/) ────────────────────────────────────────
TELEGRAM_BOT_TOKEN=
MCP_BASE_URL=http://localhost:3001