# Context Vault API image. Small by default (hash embedder, no torch); set
# VAULT_EMBEDDER=sentence-transformer + install the embeddings extra for semantic
# retrieval. The LLM judge activates automatically when ANTHROPIC_API_KEY is set.
FROM python:3.11-slim

RUN pip install --no-cache-dir uv

WORKDIR /app
COPY pyproject.toml README.md ./
COPY context_vault ./context_vault

# core deps + the `audit-encryption` extra (FastAPI, Neo4j, psycopg, mcp, numpy, cryptography) —
# still lean (no torch). The extra bakes `cryptography` so VAULT_AUDIT_ENCRYPTION (ADR-007)
# works on this published image with NO custom build — set it (postgres-keys) and the encryptor
# constructs. It costs nothing today: `cryptography` is already pulled transitively by `mcp`
# (mcp → pyjwt[crypto]), so the extra just makes that dependency EXPLICIT and durable (it won't
# silently vanish if a future mcp drops it). The app still fail-soft falls back to OFF if
# `cryptography` is somehow absent (a hand-trimmed image) — boot/health never crash. See docs/DEPLOY.md.
RUN uv pip install --system --no-cache '.[audit-encryption]'

EXPOSE 8000
CMD ["uvicorn", "context_vault.http_api:app", "--host", "0.0.0.0", "--port", "8000"]
