# Asnani-AI clinic — public Space shell. Contains no application code: at build time it downloads the private bundle from the
# dataset named in BUNDLE_REPO using the HF_TOKEN build secret, then serves it behind the platform's sign-in.
FROM python:3.12-slim

ENV PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1 PIP_NO_CACHE_DIR=1 \
    ORTHOAI_DATA_ROOT=/data PORT=7860 BUNDLE_REPO=VoxelCoreAI/asnani-clinic-bundle BUNDLE_FILE=asnani-clinic-bundle.tar.gz

RUN apt-get update && apt-get install -y --no-install-recommends curl ca-certificates && rm -rf /var/lib/apt/lists/* \
    && useradd -m -u 1000 asnani && mkdir -p /srv /data && chown -R asnani:asnani /srv /data

WORKDIR /srv
RUN pip install "huggingface_hub>=0.25"

ARG BUNDLE_REV=main
RUN --mount=type=secret,id=HF_TOKEN,mode=0444,required=true \
    python - <<'PY'
import os, tarfile, pathlib
from huggingface_hub import hf_hub_download
token = pathlib.Path("/run/secrets/HF_TOKEN").read_text().strip()
p = hf_hub_download(repo_id=os.environ["BUNDLE_REPO"], filename=os.environ["BUNDLE_FILE"], repo_type="dataset", token=token,
                    revision=os.environ.get("BUNDLE_REV", "main"))
with tarfile.open(p) as t:
    t.extractall("/srv", filter="data")
print("bundle extracted:", sorted(os.listdir("/srv/asnani-clinic")))
PY
RUN pip install -r /srv/asnani-clinic/requirements.txt && cp -r /srv/asnani-clinic/data/. /data/ && chown -R asnani:asnani /srv /data

USER asnani
# Claude Code CLI: the AI layer signs in with the Space secret CLAUDE_CODE_OAUTH_TOKEN (from `claude setup-token`).
RUN curl -fsSL https://claude.ai/install.sh | bash && ~/.local/bin/claude --version
ENV PATH="/home/asnani/.local/bin:${PATH}" CLAUDE_BIN=/home/asnani/.local/bin/claude HOME=/home/asnani
WORKDIR /srv/asnani-clinic
EXPOSE 7860
CMD ["python", "server.py"]