-- go/migrations/00078_ai_upload_analyze.sql
-- Smart upload assistant: admin toggle for pre-save AI analysis of uploads.
-- Default ON — the feature is already gated by the ai module license.
ALTER TABLE ai_settings
    ADD COLUMN upload_analyze_enabled BOOLEAN NOT NULL DEFAULT TRUE;

type Settings struct {
    ChatRetentionDays    int
    DailyTokenBudget     int64
    UploadAnalyzeEnabled bool
}

func (s *Store) GetSettings(ctx context.Context) (app.Settings, error) {
    var st app.Settings
    err := s.db.Exec(ctx).QueryRow(ctx,
        `SELECT chat_retention_days, daily_token_budget, upload_analyze_enabled FROM ai_settings WHERE id = 1`).
        Scan(&st.ChatRetentionDays, &st.DailyTokenBudget, &st.UploadAnalyzeEnabled)
    ...
}

    _, err := s.db.Exec(ctx).Exec(ctx,
        `UPDATE ai_settings SET chat_retention_days = $1, daily_token_budget = $2, upload_analyze_enabled = $3, updated_at = now() WHERE id = 1`,
        st.ChatRetentionDays, st.DailyTokenBudget, st.UploadAnalyzeEnabled)

        "upload_analyze_enabled": st.UploadAnalyzeEnabled,

    var body struct {
        ChatRetentionDays    int   `json:"chat_retention_days"`
        DailyTokenBudget     int64 `json:"daily_token_budget"`
        UploadAnalyzeEnabled bool  `json:"upload_analyze_enabled"`
    }
    ...
    if err := s.ai.PutSettings(r.Context(), aiapp.Settings{
        ChatRetentionDays:    body.ChatRetentionDays,
        DailyTokenBudget:     body.DailyTokenBudget,
        UploadAnalyzeEnabled: body.UploadAnalyzeEnabled,
    }); err != nil {

                  upload_analyze_enabled:
                    type: boolean
                    description: Auto-analyze uploads with AI before save (Smart Upload Assistant).

cd go && go build ./... && go vet ./...
cd ../web && npm run gen:api && npx tsc --noEmit

git add go/migrations/00078_ai_upload_analyze.sql go/internal/ai/app/store.go go/internal/ai/adapters/pg.go go/internal/httpapi/handlers_ai_admin.go api/openapi.yaml web/src/api/schema.ts
git commit -m "feat(ai): upload_analyze_enabled admin setting (migration 00078)"

import (
    "context"
    "fmt"
    "log/slog"
    "strings"

    aiapp "github.com/Virtue-Digital-Indonesia/obscura/internal/ai/app"
    "github.com/Virtue-Digital-Indonesia/obscura/internal/kernel"
)

// Analysis is an on-demand, pre-save enrichment result (the smart-upload path).
// Nothing is persisted — the HTTP layer caches it until the user confirms the upload.
type Analysis struct {
    Summary        string
    Classification string
    Tags           []string
    Model          string
}

// Analyze runs the summary + classification model calls over not-yet-saved text.
// Field extraction is deliberately skipped here (one less model call while the user
// waits); RecordConfirmed completes it off the response path.
func (s *Service) Analyze(ctx context.Context, title, text string) (Analysis, error) {
    if s.enabled != nil && !s.enabled() {
        return Analysis{}, &kernel.Error{Kind: kernel.ErrPermissionDenied, Code: "ai.module_disabled", Message: "the AI module is not enabled"}
    }
    summary, err := s.ai.Summarize(ctx, clip(text, summarySampleChars))
    if err != nil {
        return Analysis{}, err
    }
    cls, err := s.ai.ClassifyDocument(ctx, title, clip(text, classifySampleChars))
    if err != nil {
        return Analysis{}, err
    }
    info := s.ai.Info()
    return Analysis{
        Summary:        summary,
        Classification: cls.Sensitivity,
        Tags:           cls.Tags,
        Model:          info.Provider + "/" + info.Model,
    }, nil
}

// RecordConfirmed persists a user-confirmed upload analysis as the document's
// enrichment — the user-edited summary wins over the AI's. Fields are extracted here
// (callers run this detached from the upload response) so the stored row is complete
// and the hourly sweep — which would overwrite the user's edit with fresh AI output —
// skips this version. Field-extraction failure degrades to an empty list.
func (s *Service) RecordConfirmed(ctx context.Context, docID string, version int, a Analysis, summaryOverride, text string) error {
    sum := a.Summary
    if strings.TrimSpace(summaryOverride) != "" {
        sum = summaryOverride
    }
    fields := []aiapp.Field{}
    if s.enabled == nil || s.enabled() {
        if f, err := s.ai.ExtractFields(ctx, clip(text, summarySampleChars)); err == nil {
            fields = f
        } else {
            s.logger.Warn("upload analysis: field extraction failed", "doc", docID, "err", err)
        }
    }
    return s.store.Upsert(ctx, Enrichment{
        DocumentID:              docID,
        Version:                 version,
        Summary:                 sum,
        SuggestedClassification: a.Classification,
        SuggestedTags:           a.Tags,
        Fields:                  fields,
        Model:                   a.Model,
    })
}

cd go && go build ./... && go vet ./...

git add go/internal/enrich/app/service.go
git commit -m "feat(enrich): pre-save Analyze + user-confirmed RecordConfirmed"

package httpapi

import (
    "crypto/rand"
    "encoding/hex"
    "sync"
    "time"

    enrichapp "github.com/Virtue-Digital-Indonesia/obscura/internal/enrich/app"
)

// The pre-save upload-analysis cache: entries are consumed on save, expire after the
// TTL, and the oldest is evicted when full. Losing an entry (restart, TTL, eviction)
// silently degrades to the async extract/enrich pipeline — never an error.
const (
    analysisTTL      = 30 * time.Minute
    analysisCacheMax = 64
    // analysisMaxTextBytes mirrors dms's content_text bound (tsvector-safe 800 KiB) so
    // a cached text is always accepted by SetContentText on the confirm path.
    analysisMaxTextBytes = 800 << 10
)

// analysisEntry is one pre-save analysis: the extracted text plus the AI suggestions,
// owned by the principal who uploaded the bytes.
type analysisEntry struct {
    owner    string
    text     string
    analysis enrichapp.Analysis
    expires  time.Time
}

// analysisCache is an in-process, owner-scoped TTL map. Single-instance by design
// (Obscura is a single-tenant modular monolith).
type analysisCache struct {
    mu      sync.Mutex
    entries map[string]analysisEntry
}

func newAnalysisCache() *analysisCache {
    return &analysisCache{entries: make(map[string]analysisEntry)}
}

// Put stores an analysis (clipping text to the content_text bound) and returns its id.
func (c *analysisCache) Put(owner, text string, a enrichapp.Analysis) string {
    if len(text) > analysisMaxTextBytes {
        text = text[:analysisMaxTextBytes]
    }
    id := newAnalysisID()
    c.mu.Lock()
    defer c.mu.Unlock()
    now := time.Now()
    for k, e := range c.entries {
        if now.After(e.expires) {
            delete(c.entries, k)
        }
    }
    if len(c.entries) >= analysisCacheMax {
        oldestK, oldest := "", time.Time{}
        for k, e := range c.entries {
            if oldestK == "" || e.expires.Before(oldest) {
                oldestK, oldest = k, e.expires
            }
        }
        delete(c.entries, oldestK)
    }
    c.entries[id] = analysisEntry{owner: owner, text: text, analysis: a, expires: now.Add(analysisTTL)}
    return id
}

// Consume returns and removes the entry — only for its owner. Unknown, expired, or
// foreign ids report !ok without distinguishing why (nothing to enumerate or leak).
func (c *analysisCache) Consume(id, owner string) (analysisEntry, bool) {
    c.mu.Lock()
    defer c.mu.Unlock()
    e, ok := c.entries[id]
    if !ok {
        return analysisEntry{}, false
    }
    delete(c.entries, id)
    if e.owner != owner || time.Now().After(e.expires) {
        return analysisEntry{}, false
    }
    return e, true
}

// newAnalysisID returns a 128-bit random hex id (no dependency on a uuid package).
func newAnalysisID() string {
    b := make([]byte, 16)
    _, _ = rand.Read(b)
    return hex.EncodeToString(b)
}

cd go && go build ./... && go vet ./...

git add go/internal/httpapi/analysis_cache.go
git commit -m "feat(httpapi): owner-scoped TTL cache for pre-save upload analyses"

package httpapi

import (
    "io"
    "net/http"
    "path/filepath"
    "strings"

    "github.com/Virtue-Digital-Indonesia/obscura/internal/kernel"
)

// maxAnalyzeBytes caps how much of an upload the pre-save analyzer reads into memory
// (the sidecar client needs the full bytes). Oversized files answer no_text rather
// than erroring — analysis is optional decoration on the upload, never a gate.
const maxAnalyzeBytes = 64 << 20

// AnalyzeUpload extracts text from a not-yet-saved upload and returns AI suggestions
// (summary/classification/tags) plus an analysis_id the Save path redeems to reuse the
// extracted text. Nothing is persisted here; cancelling the modal leaves zero rows.
func (s *Server) AnalyzeUpload(w http.ResponseWriter, r *http.Request) {
    p, _ := PrincipalFrom(r.Context())

    st, err := s.ai.GetSettings(r.Context())
    if err != nil {
        writeProblem(w, err)
        return
    }
    if !st.UploadAnalyzeEnabled {
        writeProblem(w, &kernel.Error{Kind: kernel.ErrConflict, Code: "ai.upload_analyze_disabled", Message: "upload analysis is disabled by the administrator"})
        return
    }

    if err := r.ParseMultipartForm(maxUploadMemory); err != nil {
        writeProblem(w, &kernel.Error{Kind: kernel.ErrValidation, Code: "request.invalid_multipart", Message: "invalid multipart form"})
        return
    }
    file, header, err := r.FormFile("file")
    if err != nil {
        writeProblem(w, &kernel.Error{Kind: kernel.ErrValidation, Code: "request.file_required", Message: "file field is required"})
        return
    }
    defer file.Close()
    if ext := strings.ToLower(filepath.Ext(header.Filename)); !allowedUploadExt[ext] {
        writeProblem(w, &kernel.Error{Kind: kernel.ErrValidation, Code: "dms.version.filetype_not_allowed", Message: "this file type is not allowed"})
        return
    }

    noText := func() { writeJSON(w, http.StatusOK, map[string]any{"analysis_id": "", "no_text": true}) }

    // No extractor (EXTRACT_PROVIDER=none) or an oversized file: analysis simply
    // isn't available — same UX as an unreadable scan.
    if s.extractor == nil || header.Size > maxAnalyzeBytes {
        noText()
        return
    }
    data, err := io.ReadAll(io.LimitReader(file, maxAnalyzeBytes+1))
    if err != nil || len(data) > maxAnalyzeBytes {
        noText()
        return
    }
    mime := header.Header.Get("Content-Type")
    if mime == "" {
        mime = "application/octet-stream"
    }
    text, err := s.extractor.Extract(r.Context(), data, mime, header.Filename)
    if err != nil || strings.TrimSpace(text) == "" {
        noText()
        return
    }

    analysis, err := s.enrich.Analyze(r.Context(), r.FormValue("title"), text)
    if err != nil {
        writeProblem(w, err) // budget 429 / provider failures surface as problems (soft-fail client-side)
        return
    }
    id := s.analyses.Put(string(p.UserID), text, analysis)
    writeJSON(w, http.StatusOK, map[string]any{
        "analysis_id":    id,
        "summary":        analysis.Summary,
        "classification": analysis.Classification,
        "tags":           analysis.Tags,
        "text_chars":     len(text),
    })
}

            r.With(s.requireModule("ai")).Post("/ai/analyze-upload", s.AnalyzeUpload)

    extractor := extractadapters.SelectExtractor(cfg.Extract.Provider, cfg.Extract.SidecarURL)
    extractSvc := extractapp.NewService(
        extractor,
        ...

  /api/v1/ai/analyze-upload:
    post:
      operationId: analyzeUpload
      summary: Analyze a not-yet-saved upload
      description: >-
        Extracts text from the uploaded file and returns AI suggestions (summary,
        classification, tags) plus an analysis_id the Save path can redeem to reuse
        the extracted text. Nothing is persisted. Requires the `ai` module. 409 when
        the admin toggle is off; 429 when the daily token budget is exhausted.
      tags: [ai]
      requestBody:
        required: true
        content:
          multipart/form-data:
            schema:
              type: object
              required: [file]
              properties:
                file:
                  type: string
                  format: binary
                title:
                  type: string
                  description: Working title (improves classification).
      responses:
        '200':
          description: Suggestions, or no_text when the file has no extractable text.
          content:
            application/json:
              schema:
                type: object
                required: [analysis_id]
                properties:
                  analysis_id: {type: string}
                  no_text: {type: boolean}
                  summary: {type: string}
                  classification: {type: string}
                  tags:
                    type: array
                    items: {type: string}
                  text_chars: {type: integer}
        '400':
          $ref: '#/components/responses/Problem'
        '401':
          $ref: '#/components/responses/Problem'
        '403':
          $ref: '#/components/responses/Problem'
        '409':
          $ref: '#/components/responses/Problem'
        '429':
          $ref: '#/components/responses/Problem'

cd go && go build ./... && go vet ./...
cd ../web && npm run gen:api && npx tsc --noEmit && npx vite build

docker compose -f deploy/docker-compose.yml --env-file deploy/mekari.env up -d --build obscura
# modules intact:
TOKEN=$(curl -s -X POST http://localhost:38080/api/v1/auth/dev-login -H 'Content-Type: application/json' -d '{"email":"director@obscura.local"}' | python3 -c 'import json,sys;print(json.load(sys.stdin)["token"])')
curl -s http://localhost:38080/api/v1/me -H "Authorization: Bearer $TOKEN" | python3 -c 'import json,sys;print(sorted(json.load(sys.stdin)["enabled_modules"]))'
# expect: ['ai', 'correspondence', 'esign', 'semantic', 'watermarking']
# smoke the endpoint with a scratch text file:
printf 'Perjanjian kerja sama antara PT Alpha dan PT Beta tahun 2026.' > /tmp/claude-analyze-smoke.txt
curl -s -X POST http://localhost:38080/api/v1/ai/analyze-upload -H "Authorization: Bearer $TOKEN" -F file=@/tmp/claude-analyze-smoke.txt -F title=Smoke | python3 -m json.tool
# expect: analysis_id non-empty, summary/classification/tags populated (live model)
rm /tmp/claude-analyze-smoke.txt

git add go/internal/httpapi/handlers_ai_analyze.go go/internal/httpapi/server.go go/cmd/obscura-server/wire.go api/openapi.yaml web/src/api/schema.ts
git commit -m "feat(ai): POST /ai/analyze-upload — pre-save extract + AI suggestions"

// VersionOpt tunes AddVersion. WithoutExtractHook suppresses the async extract hook
// for callers that seed content_text themselves (the smart-upload confirm path) —
// otherwise the sidecar would re-extract, and the embed hook would fire twice.
type VersionOpt func(*versionOpts)

type versionOpts struct{ skipExtractHook bool }

// WithoutExtractHook suppresses the post-commit extract hook for this version.
func WithoutExtractHook() VersionOpt { return func(o *versionOpts) { o.skipExtractHook = true } }

func (s *Service) AddVersion(ctx context.Context, p kernel.Principal, docID string, content io.Reader, mime string, opts ...VersionOpt) (int, error) {

    var vo versionOpts
    for _, o := range opts {
        o(&vo)
    }
    if s.extractHook != nil && !vo.skipExtractHook {
        s.extractHook(docID, newVersion)
    }

    mime := header.Header.Get("Content-Type")
    if mime == "" {
        mime = "application/octet-stream"
    }

    // Smart-upload confirm path: a valid analysis_id redeems the pre-save analysis.
    // Consume BEFORE AddVersion so we know whether to suppress the async extract hook
    // (the seed below replaces it). Foreign/expired/unknown ids silently fall back to
    // the normal async pipeline — best-effort everywhere, the upload never fails
    // because of analysis.
    var analysis *analysisEntry
    if aid := r.FormValue("analysis_id"); aid != "" {
        if e, ok := s.analyses.Consume(aid, string(p.UserID)); ok {
            analysis = &e
        }
    }
    var vOpts []dmsapp.VersionOpt
    if analysis != nil {
        vOpts = append(vOpts, dmsapp.WithoutExtractHook())
    }

    v, err := s.dms.AddVersion(r.Context(), p, docID, file, mime, vOpts...)
    if err != nil {
        writeProblem(w, err)
        return
    }
    // Uploading new content supersedes any published state: a fresh version returns the
    // document to draft so it must be re-published (and re-approved) before it counts as
    // the official record. Best-effort — a failure here doesn't undo the version.
    _ = s.dms.SetDocumentStatus(r.Context(), docID, dmsdomain.StatusDraft)

    if analysis != nil {
        // Seed the already-extracted text (fires the embed hook → immediate semantic
        // indexing) and mark the version extracted so the backfill skips it. If the
        // seed fails the hourly backfill still covers the doc — only log.
        if err := s.dms.SetContentText(r.Context(), docID, analysis.text); err != nil {
            slog.Default().Warn("upload analysis: content seed failed", "doc", docID, "err", err)
        } else {
            _ = s.dms.MarkExtracted(r.Context(), docID, v)
        }
        // The confirmed enrichment includes a field-extraction model call — run it
        // detached so the upload response doesn't wait on it.
        summaryOverride := r.FormValue("summary")
        bg := context.WithoutCancel(r.Context())
        entry := *analysis
        go func() {
            defer func() {
                if rec := recover(); rec != nil {
                    slog.Default().Error("upload analysis: record panic", "doc", docID, "panic", rec)
                }
            }()
            if err := s.enrich.RecordConfirmed(bg, docID, v, entry.analysis, summaryOverride, entry.text); err != nil {
                slog.Default().Warn("upload analysis: record failed", "doc", docID, "err", err)
            }
        }()
    }

    writeJSON(w, http.StatusCreated, map[string]any{"version": v})

                analysis_id:
                  type: string
                  description: Redeems a pre-save AI analysis (Smart Upload Assistant); unknown/expired ids are ignored.
                summary:
                  type: string
                  description: User-confirmed summary override, stored with the enrichment.

cd go && go build ./... && go vet ./...
cd ../web && npm run gen:api && npx tsc --noEmit

git add go/internal/dms/app/service.go go/internal/httpapi/handlers_dms.go api/openapi.yaml web/src/api/schema.ts
git commit -m "feat(dms): AddVersion redeems pre-save analysis (seed text, confirmed enrichment, skip extract hook)"

    mutationFn: (v: { chatRetentionDays: number; dailyTokenBudget: number; uploadAnalyzeEnabled: boolean }) =>
      api
        .PUT('/api/v1/admin/ai/settings', {
          body: {
            chat_retention_days: v.chatRetentionDays,
            daily_token_budget: v.dailyTokenBudget,
            upload_analyze_enabled: v.uploadAnalyzeEnabled,
          },
        })
        .then(ok),

  const [uploadAnalyze, setUploadAnalyze] = useState(true)

        <Toggle
          id="ai-upload-analyze"
          labelText={t('admin.ai.settings.uploadAnalyze')}
          labelA={t('admin.ai.settings.uploadAnalyzeOff')}
          labelB={t('admin.ai.settings.uploadAnalyzeOn')}
          toggled={uploadAnalyze}
          onToggle={setUploadAnalyze}
        />

// en
'admin.ai.settings.uploadAnalyze': 'Analyze uploads with AI',
'admin.ai.settings.uploadAnalyzeOn': 'On',
'admin.ai.settings.uploadAnalyzeOff': 'Off',
// id
'admin.ai.settings.uploadAnalyze': 'Analisis unggahan dengan AI',
'admin.ai.settings.uploadAnalyzeOn': 'Aktif',
'admin.ai.settings.uploadAnalyzeOff': 'Nonaktif',

cd web && npx tsc --noEmit && npx vite build

git add web/src/features/admin/data.ts web/src/features/admin/AiTab.tsx web/src/features/admin/i18n.ts
git commit -m "feat(web): Admin → AI toggle for upload analysis"

// --- Smart upload assistant (pre-save analysis) ---

export interface UploadAnalysis {
  disabled?: boolean
  noText?: boolean
  analysisId: string
  summary: string
  classification: string
  tags: string[]
}

const EMPTY_ANALYSIS: UploadAnalysis = { analysisId: '', summary: '', classification: '', tags: [] }

// The admin can turn upload analysis off (409). Remember it for the session so later
// uploads skip the round-trip; a reload re-checks.
let uploadAnalyzeDisabled = false

// Analyze a not-yet-saved file: extracted text + AI suggestions. Raw fetch because
// openapi-fetch would JSON-serialise FormData. Soft-failure contract: callers treat a
// thrown error as "no suggestions", never as an upload blocker.
export async function analyzeUpload(file: File, title?: string, signal?: AbortSignal): Promise<UploadAnalysis> {
  if (uploadAnalyzeDisabled) return { ...EMPTY_ANALYSIS, disabled: true }
  const token = await getToken()
  const fd = new FormData()
  fd.append('file', file)
  if (title) fd.append('title', title)
  const res = await fetch('/api/v1/ai/analyze-upload', {
    method: 'POST',
    headers: token ? { Authorization: `Bearer ${token}` } : {},
    body: fd,
    signal,
  })
  if (res.status === 409) {
    uploadAnalyzeDisabled = true
    return { ...EMPTY_ANALYSIS, disabled: true }
  }
  if (!res.ok) {
    const p = (await res.json().catch(() => null)) as Problem | null
    throw toError(p ?? `HTTP ${res.status}`)
  }
  const d = (await res.json()) as {
    analysis_id?: string
    no_text?: boolean
    summary?: string
    classification?: string
    tags?: string[]
  }
  return {
    noText: !!d.no_text,
    analysisId: d.analysis_id ?? '',
    summary: d.summary ?? '',
    classification: d.classification ?? '',
    tags: d.tags ?? [],
  }
}

export async function uploadVersion(
  docID: string,
  file: File,
  extra?: { analysisId?: string; summary?: string },
): Promise<void> {
  const token = await getToken()
  const fd = new FormData()
  fd.append('file', file)
  if (extra?.analysisId) {
    fd.append('analysis_id', extra.analysisId)
    if (extra.summary) fd.append('summary', extra.summary)
  }
  const res = await fetch(`/api/v1/documents/${docID}/versions`, {
    method: 'POST',
    headers: token ? { Authorization: `Bearer ${token}` } : {},
    body: fd,
  })
  if (!res.ok) throw new Error(`HTTP ${res.status}`)
}

cd web && npx tsc --noEmit && npx vite build

git add web/src/api/ai.ts web/src/api/files.ts
git commit -m "feat(web): analyzeUpload API + uploadVersion analysis fields"

import { useEffect, useRef, useState } from 'react'
import { Dropdown, InlineLoading, InlineNotification, Modal, Tag, TextArea, TextInput, FileUploaderDropContainer } from '@carbon/react'
import { useMe } from '@/api/me'
import { moduleEnabled } from '@/lib/nav'
import { analyzeUpload } from '@/api/ai'

export interface UploadDocumentInput {
  title: string
  classification: Classification
  docType: string
  formatId: string
  customVars: Record<string, string>
  file: File
  folderId: string | null
  analysisId?: string
  summary?: string
  tags?: string[]
}

  const me = useMe()
  const aiOn = moduleEnabled(me.data?.enabledModules, 'ai')

  type AiState =
    | { status: 'idle' }
    | { status: 'analyzing' }
    | { status: 'none' } // no_text
    | { status: 'failed' }
    | { status: 'done'; analysisId: string; summary: string; tags: { name: string; selected: boolean }[]; classSuggested: boolean }
  const [ai, setAi] = useState<AiState>({ status: 'idle' })
  const aiAbort = useRef<AbortController | null>(null)

  const runAnalysis = (f: File, workingTitle: string) => {
    aiAbort.current?.abort()
    const ctrl = new AbortController()
    aiAbort.current = ctrl
    setAi({ status: 'analyzing' })
    analyzeUpload(f, workingTitle, ctrl.signal)
      .then((res) => {
        if (ctrl.signal.aborted) return
        if (res.disabled) { setAi({ status: 'idle' }); return }
        if (res.noText || !res.analysisId) { setAi({ status: 'none' }); return }
        // Apply the suggested classification only if it names a real registry entry
        // and the user hasn't already picked one.
        let classSuggested = false
        if (res.classification && CLASS_ITEMS.some((c) => c.id === res.classification)) {
          setClassification((prev) => {
            if (prev === 'none') { classSuggested = true; return res.classification as Classification }
            return prev
          })
        }
        setAi({
          status: 'done',
          analysisId: res.analysisId,
          summary: res.summary,
          tags: res.tags.map((name) => ({ name, selected: true })),
          classSuggested,
        })
      })
      .catch(() => { if (!ctrl.signal.aborted) setAi({ status: 'failed' }) })
  }

  const onFile = (f: File | null) => {
    setFile(f)
    if (f && !title.trim()) setTitle(stripExt(f.name))
    if (!f) { aiAbort.current?.abort(); setAi({ status: 'idle' }); return }
    if (aiOn) runAnalysis(f, title.trim() || stripExt(f.name))
  }

  const submit = () => {
    if (!canSubmit || !file) return
    const vars: Record<string, string> = {}
    for (const n of customNames) vars[n] = (customVars[n] ?? '').trim()
    const aiDone = ai.status === 'done' ? ai : null
    onSubmit({
      title: trimmed,
      classification,
      docType: docType.trim(),
      formatId,
      customVars: vars,
      file,
      folderId: folder.folderId,
      analysisId: aiDone?.analysisId,
      summary: aiDone?.summary.trim() || undefined,
      tags: aiDone ? aiDone.tags.filter((t) => t.selected).map((t) => t.name) : undefined,
    })
  }

            {aiOn && ai.status !== 'idle' && (
              <div className="newdoc__field upload__ai">
                <div className="upload__ai-head">
                  <span className="upload__ai-title">{t('newDoc.aiTitle')}</span>
                  {ai.status === 'done' && <Tag type="purple" size="sm">{t('newDoc.aiBadge')}</Tag>}
                </div>
                {ai.status === 'analyzing' && <InlineLoading description={t('newDoc.aiAnalyzing')} />}
                {ai.status === 'none' && <p className="upload__ai-note muted">{t('newDoc.aiNoText')}</p>}
                {ai.status === 'failed' && <p className="upload__ai-note muted">{t('newDoc.aiFailed')}</p>}
                {ai.status === 'done' && (
                  <>
                    <TextArea
                      id="upload-ai-summary"
                      labelText={t('newDoc.aiSummary')}
                      rows={3}
                      value={ai.summary}
                      onChange={(e) => setAi({ ...ai, summary: e.target.value })}
                    />
                    {ai.classSuggested && <p className="upload__ai-note muted">{t('newDoc.aiClassApplied')}</p>}
                    {ai.tags.length > 0 && (
                      <div className="upload__ai-tags">
                        <span className="upload__ai-tags-label">{t('newDoc.aiTags')}</span>
                        {ai.tags.map((tag, i) => (
                          <Tag
                            key={tag.name}
                            type={tag.selected ? 'blue' : 'gray'}
                            size="sm"
                            onClick={() => {
                              const tags = ai.tags.slice()
                              tags[i] = { ...tag, selected: !tag.selected }
                              setAi({ ...ai, tags })
                            }}
                          >
                            {tag.name}
                          </Tag>
                        ))}
                      </div>
                    )}
                  </>
                )}
              </div>
            )}

  const submitUpload = async ({ title, classification, docType, formatId, customVars, file, folderId, analysisId, summary, tags }: UploadDocumentInput) => {
    setSavingDoc(true)
    setUploadError(null)
    try {
      const id = await createDocument.mutateAsync({ title, folderId, classification, docType, formatId, customVars })
      if (!id) return
      setUploadOpen(false)
      try {
        await uploadVersion(id, file, analysisId ? { analysisId, summary } : undefined)
      } catch { /* stub created; retry from detail */ }
      if (tags && tags.length > 0) {
        // Confirmed AI tags — best-effort, never blocks navigation.
        try {
          await api.PUT('/api/v1/documents/{docID}/tags', { params: { path: { docID: id } }, body: { tags } })
        } catch { /* tags applied later from detail if needed */ }
      }
      navigate(`/documents/d/${id}?folder=${folderId ?? 'root'}`)
    } catch (e) {
      setUploadError(errMsg(e))
    } finally {
      setSavingDoc(false)
    }
  }

'newDoc.aiTitle': 'AI suggestions',
'newDoc.aiBadge': 'AI',
'newDoc.aiAnalyzing': 'Analyzing document…',
'newDoc.aiSummary': 'Summary',
'newDoc.aiTags': 'Suggested tags',
'newDoc.aiNoText': 'Couldn’t read any text from this file — fill in the details manually.',
'newDoc.aiFailed': 'AI suggestions unavailable right now.',
'newDoc.aiClassApplied': 'Classification pre-set from the AI suggestion — you can change it.',

'newDoc.aiTitle': 'Saran AI',
'newDoc.aiBadge': 'AI',
'newDoc.aiAnalyzing': 'Menganalisis dokumen…',
'newDoc.aiSummary': 'Ringkasan',
'newDoc.aiTags': 'Saran tag',
'newDoc.aiNoText': 'Tidak dapat membaca teks dari berkas ini — isi detail secara manual.',
'newDoc.aiFailed': 'Saran AI sedang tidak tersedia.',
'newDoc.aiClassApplied': 'Klasifikasi diisi dari saran AI — Anda dapat mengubahnya.',

/* Smart upload assistant panel (upload modal) */
.upload__ai { border: 1px solid var(--cds-border-subtle, #e0e0e0); border-radius: 6px; padding: 0.75rem; }
.upload__ai-head { display: flex; align-items: center; gap: 0.5rem; margin-bottom: 0.5rem; }
.upload__ai-title { font-weight: 600; font-size: 0.875rem; }
.upload__ai-note { font-size: 0.75rem; margin: 0.25rem 0 0; }
.upload__ai-tags { display: flex; flex-wrap: wrap; gap: 0.25rem; align-items: center; margin-top: 0.5rem; }
.upload__ai-tags .cds--tag { cursor: pointer; }
.upload__ai-tags-label { font-size: 0.75rem; margin-right: 0.25rem; }

cd web && npx tsc --noEmit && npx vite build

git add web/src/features/documents/UploadDocumentModal.tsx web/src/features/documents/DocumentsPage.tsx web/src/i18n/locales/en.ts web/src/i18n/locales/id.ts web/src/styles/app.css
git commit -m "feat(web): AI suggestions panel in the upload modal (confirm-before-save)"

docker compose -f deploy/docker-compose.yml --env-file deploy/mekari.env up -d --build obscura web

TOKEN=$(curl -s -X POST http://localhost:38080/api/v1/auth/dev-login -H 'Content-Type: application/json' -d '{"email":"director@obscura.local"}' | python3 -c 'import json,sys;print(json.load(sys.stdin)["token"])')
curl -s http://localhost:38080/api/v1/me -H "Authorization: Bearer $TOKEN" | python3 -c 'import json,sys;print(sorted(json.load(sys.stdin)["enabled_modules"]))'
# expect: ['ai', 'correspondence', 'esign', 'semantic', 'watermarking']

S=/tmp/claude-1001/-home-efran-remote-development-obscura/1e19bbce-4349-4592-8b5b-ce3bd72141ab/scratchpad
printf 'PERJANJIAN KERJA SAMA\nantara PT Alpha Nusantara dan PT Beta Sejahtera.\nNilai kontrak Rp 250.000.000, berlaku 2026-2027.\nDokumen ini bersifat rahasia untuk kalangan internal.' > $S/e2e-analyze.txt
curl -s -X POST http://localhost:38080/api/v1/ai/analyze-upload -H "Authorization: Bearer $TOKEN" -F file=@$S/e2e-analyze.txt -F 'title=Perjanjian Alpha-Beta' | tee $S/analyze.json | python3 -m json.tool
AID=$(python3 -c "import json;print(json.load(open('$S/analyze.json'))['analysis_id'])")
# assert: analysis_id non-empty, summary/classification/tags plausible
docker exec deploy-postgres-1 psql -U obscura -d obscura -tc "SELECT feature, requests FROM ai_usage WHERE day = CURRENT_DATE AND feature IN ('summarize','classify') ORDER BY feature"
# assert: both rows present with requests >= 1

DOCID=$(curl -s -X POST http://localhost:38080/api/v1/documents -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' -d '{"title":"E2E Smart Upload","classification":"internal"}' | python3 -c 'import json,sys;print(json.load(sys.stdin)["id"])')
curl -s -X POST "http://localhost:38080/api/v1/documents/$DOCID/versions" -H "Authorization: Bearer $TOKEN" -F file=@$S/e2e-analyze.txt -F "analysis_id=$AID" -F 'summary=EDITED BY USER: kontrak kerja sama Alpha-Beta.' | python3 -m json.tool
sleep 5   # detached RecordConfirmed runs a field-extraction model call
docker exec deploy-postgres-1 psql -U obscura -d obscura -tc "SELECT length(content_text) > 0, content_extracted_version = current_version FROM documents WHERE id = '$DOCID'"
# assert: t | t   (content seeded + marked — the async extractor was skipped)
docker exec deploy-postgres-1 psql -U obscura -d obscura -tc "SELECT summary FROM document_enrichment WHERE document_id = '$DOCID'"
# assert: 'EDITED BY USER: ...' (the user's edit won, not the AI summary)
curl -s "http://localhost:38080/api/v1/documents/$DOCID/ai/enrichment" -H "Authorization: Bearer $TOKEN" | python3 -m json.tool
# assert: exists=true, the edited summary + tags visible (AI Insights card source)

DOC2=$(curl -s -X POST http://localhost:38080/api/v1/documents -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' -d '{"title":"E2E Foreign AID","classification":"none"}' | python3 -c 'import json,sys;print(json.load(sys.stdin)["id"])')
curl -s -o /dev/null -w '%{http_code}\n' -X POST "http://localhost:38080/api/v1/documents/$DOC2/versions" -H "Authorization: Bearer $TOKEN" -F file=@$S/e2e-analyze.txt -F 'analysis_id=deadbeefdeadbeefdeadbeefdeadbeef'
# assert: 201 (upload unaffected; async pipeline covers extraction)

curl -s -X PUT http://localhost:38080/api/v1/admin/ai/settings -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' -d '{"chat_retention_days":30,"daily_token_budget":0,"upload_analyze_enabled":false}' -o /dev/null -w '%{http_code}\n'
curl -s -o /dev/null -w '%{http_code}\n' -X POST http://localhost:38080/api/v1/ai/analyze-upload -H "Authorization: Bearer $TOKEN" -F file=@$S/e2e-analyze.txt
# assert: 409
curl -s -X PUT http://localhost:38080/api/v1/admin/ai/settings -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' -d '{"chat_retention_days":30,"daily_token_budget":0,"upload_analyze_enabled":true}' -o /dev/null -w '%{http_code}\n'
# NOTE: read the CURRENT retention/budget from GET first and echo those values back —
# do not blind-write 30/0 if the live settings differ.

curl -s -X POST http://localhost:38080/api/v1/ai/analyze-upload -H "Authorization: Bearer $TOKEN" -F file=@$S/e2e-analyze.txt > /dev/null
docker exec deploy-postgres-1 psql -U obscura -d obscura -tc "SELECT count(*) FROM documents WHERE title LIKE 'E2E%'"
# assert: exactly the 2 e2e docs from steps 4-5 — analyzing alone persisted nothing

# trash + purge both e2e docs (existing endpoints; purge from trash for zero residue)
for D in $DOCID $DOC2; do
  curl -s -X POST "http://localhost:38080/api/v1/documents/$D/trash" -H "Authorization: Bearer $TOKEN" -o /dev/null
done
# then purge via the trash purge endpoint (check /trash routes) and re-assert:
docker exec deploy-postgres-1 psql -U obscura -d obscura -tc "SELECT count(*) FROM documents WHERE title LIKE 'E2E%'"
# assert: 0
rm -f $S/e2e-analyze.txt $S/analyze.json

curl -s http://localhost:38080/api/v1/me -H "Authorization: Bearer $TOKEN" | python3 -c 'import json,sys;print(sorted(json.load(sys.stdin)["enabled_modules"]))'