create-devoplus-one-app 0.0.0-stage → 0.1.0-next.158

package/templates/saha-denetimi/files/one.data.json

@@ -0,0 +1,87 @@
+{
+  "version": 1,
+  "entities": {
+    "checklists": {
+      "title": { "tr": "Kontrol listeleri", "en": "Checklists" },
+      "fields": {
+        "name": { "type": "text", "title": { "tr": "Ad", "en": "Name" }, "required": true, "unique": true, "maxLength": 120 },
+        "description": { "type": "longText", "title": { "tr": "Açıklama", "en": "Description" }, "maxLength": 2000 },
+        "active": { "type": "boolean", "title": { "tr": "Kullanımda", "en": "In use" }, "required": true, "default": true }
+      }
+    },
+    "checklist_items": {
+      "title": { "tr": "Kontrol maddeleri", "en": "Checklist items" },
+      "fields": {
+        "checklist_id": { "type": "text", "title": { "tr": "Kontrol listesi", "en": "Checklist" }, "required": true, "maxLength": 36, "index": true },
+        "position": { "type": "number", "title": { "tr": "Sıra", "en": "Order" }, "required": true, "default": 1, "min": 1, "max": 999 },
+        "section": { "type": "text", "title": { "tr": "Bölüm", "en": "Section" }, "maxLength": 80 },
+        "title": { "type": "text", "title": { "tr": "Madde", "en": "Item" }, "required": true, "maxLength": 200 },
+        "weight": { "type": "number", "title": { "tr": "Ağırlık", "en": "Weight" }, "required": true, "default": 1, "min": 1, "max": 10 },
+        "critical": { "type": "boolean", "title": { "tr": "Kritik", "en": "Critical" }, "required": true, "default": false }
+      }
+    },
+    "audits": {
+      "title": { "tr": "Denetimler", "en": "Audits" },
+      "fields": {
+        "checklist_id": { "type": "text", "title": { "tr": "Kontrol listesi (kimlik)", "en": "Checklist (id)" }, "required": true, "maxLength": 36, "index": true },
+        "checklist_name": { "type": "text", "title": { "tr": "Kontrol listesi", "en": "Checklist" }, "maxLength": 120 },
+        "location_id": { "type": "text", "title": { "tr": "İş yeri (kimlik)", "en": "Workplace (id)" }, "maxLength": 24, "index": true },
+        "location_code": { "type": "text", "title": { "tr": "Mağaza kodu", "en": "Store code" }, "maxLength": 40 },
+        "location_name": { "type": "text", "title": { "tr": "Denetlenen yer", "en": "Audited location" }, "required": true, "maxLength": 120, "index": true },
+        "auditor_name": { "type": "text", "title": { "tr": "Denetçi", "en": "Auditor" }, "maxLength": 120 },
+        "status": {
+          "type": "choice",
+          "title": { "tr": "Durum", "en": "Status" },
+          "required": true,
+          "default": "draft",
+          "index": true,
+          "choices": [
+            { "value": "draft", "title": { "tr": "Taslak", "en": "Draft" } },
+            { "value": "completed", "title": { "tr": "Tamamlandı", "en": "Completed" } }
+          ]
+        },
+        "submitted_at": { "type": "datetime", "title": { "tr": "Tamamlanma", "en": "Completed at" }, "index": true },
+        "score": { "type": "number", "title": { "tr": "Puan", "en": "Score" }, "min": 0, "max": 100 },
+        "result": {
+          "type": "choice",
+          "title": { "tr": "Sonuç", "en": "Result" },
+          "index": true,
+          "choices": [
+            { "value": "passed", "title": { "tr": "Başarılı", "en": "Passed" } },
+            { "value": "needs_improvement", "title": { "tr": "Geliştirilmeli", "en": "Needs improvement" } },
+            { "value": "failed", "title": { "tr": "Başarısız", "en": "Failed" } }
+          ]
+        },
+        "critical_failed": { "type": "boolean", "title": { "tr": "Kritik madde uygun değil", "en": "Critical item failed" }, "required": true, "default": false },
+        "compliant_count": { "type": "number", "title": { "tr": "Uygun", "en": "Compliant" }, "required": true, "default": 0, "min": 0 },
+        "noncompliant_count": { "type": "number", "title": { "tr": "Uygun değil", "en": "Non-compliant" }, "required": true, "default": 0, "min": 0 },
+        "not_applicable_count": { "type": "number", "title": { "tr": "Uygulanamaz", "en": "Not applicable" }, "required": true, "default": 0, "min": 0 },
+        "general_note": { "type": "longText", "title": { "tr": "Genel not", "en": "General note" }, "maxLength": 2000 }
+      }
+    },
+    "audit_answers": {
+      "title": { "tr": "Denetim cevapları", "en": "Audit answers" },
+      "fields": {
+        "audit_id": { "type": "text", "title": { "tr": "Denetim", "en": "Audit" }, "required": true, "maxLength": 36, "index": true },
+        "item_id": { "type": "text", "title": { "tr": "Madde (kimlik)", "en": "Item (id)" }, "required": true, "maxLength": 36 },
+        "position": { "type": "number", "title": { "tr": "Sıra", "en": "Order" }, "required": true, "default": 1, "min": 1 },
+        "section": { "type": "text", "title": { "tr": "Bölüm", "en": "Section" }, "maxLength": 80 },
+        "title": { "type": "text", "title": { "tr": "Madde", "en": "Item" }, "required": true, "maxLength": 200 },
+        "weight": { "type": "number", "title": { "tr": "Ağırlık", "en": "Weight" }, "required": true, "default": 1, "min": 1, "max": 10 },
+        "critical": { "type": "boolean", "title": { "tr": "Kritik", "en": "Critical" }, "required": true, "default": false },
+        "result": {
+          "type": "choice",
+          "title": { "tr": "Sonuç", "en": "Result" },
+          "choices": [
+            { "value": "compliant", "title": { "tr": "Uygun", "en": "Compliant" } },
+            { "value": "noncompliant", "title": { "tr": "Uygun değil", "en": "Non-compliant" } },
+            { "value": "not_applicable", "title": { "tr": "Uygulanamaz", "en": "Not applicable" } }
+          ]
+        },
+        "note": { "type": "text", "title": { "tr": "Not", "en": "Note" }, "maxLength": 500 },
+        "photo": { "type": "file", "title": { "tr": "Fotoğraf", "en": "Photo" } },
+        "photo_name": { "type": "text", "title": { "tr": "Fotoğraf adı", "en": "Photo name" }, "maxLength": 200 }
+      }
+    }
+  }
+}

package/templates/saha-denetimi/files/src/agent.ts.tpl

@@ -0,0 +1,41 @@
+// Devoplus yapay zekâsının bu uygulamada çağırabileceği araçların İŞLEYİCİLERİ. Adı, açıklaması, girdi şeması,
+// salt-okunurluğu ve izni `one.manifest.json` → `agent.tools`'tadır; rehber `AGENT_GUIDE.md`'dir. Yeni araç = üçü birlikte.
+// Araçlar yalnız TAMAMLANMIŞ denetimleri okur ve yalnız yöneticiye açıktır (manifest `permission`). Denetim açan, cevap
+// yazan ya da tamamlayan araç bilinçli olarak yoktur.
+import { defineAgentTools } from '@devoplus/one-sdk'
+import type { Env } from './app.ts'
+import { failedItems, locationScores, recentAudits } from './queries.ts'
+
+export const agentTools = defineAgentTools<Env>({
+  'recent-audit-results': {
+    handler: async ({ input, env }) => {
+      const limit = typeof input.limit === 'number' ? input.limit : 10
+      const audits = await recentAudits(env, limit, typeof input.location === 'string' ? input.location : undefined)
+      const failed = await failedItems(env, audits.map((a) => a.id))
+      return {
+        audits: audits.map((a) => ({
+          location: a.location_name,
+          checklist: a.checklist_name,
+          auditor: a.auditor_name,
+          completedAt: a.submitted_at,
+          score: a.score,
+          result: a.result,
+          criticalFailed: a.critical_failed,
+          failedItems: failed.get(a.id) ?? [],
+        })),
+      }
+    },
+  },
+  'location-scores': {
+    handler: async ({ env }) => ({
+      locations: (await locationScores(env, 50)).map((l) => ({
+        location: l.location,
+        audits: l.audits,
+        lastScore: l.last_score,
+        averageScore: l.average,
+        lastAuditAt: l.last_at,
+        criticalFailures: l.critical_failures,
+      })),
+    }),
+  },
+})

package/templates/saha-denetimi/files/src/app.ts.tpl

@@ -0,0 +1,444 @@
+// {{nameTr}} — saha denetimi (mağaza ve şube denetimi). Uçlar (hepsi oturum ister; kimlik platformdan gelir):
+//   GET    /api/checklists[?…] · POST · PATCH/DELETE /api/checklists/{id}         kontrol listeleri (yazma: yönetici)
+//   GET    /api/checklist_items[?…] · POST · PATCH/DELETE /api/checklist_items/{id}  maddeler (yazma: yönetici)
+//   GET    /api/workplaces                                 iş yerleri (organizasyon şemasından; okunamazsa boş + available:false)
+//   GET    /api/audits[?…]                                 denetimlerim (yalnız benim yaptıklarım) — hazır liste + Excel
+//   POST   /api/audits                                     { checklist_id, location_id? | location_name } — taslak açar
+//   GET    /api/audits/{id}/answers                        denetim + maddeler (denetçi ya da yönetici)
+//   PUT    /api/audits/{id}/answers                        { answers: [{ id, result?, note?, photo? }], general_note? } — yalnız taslak, yalnız denetçi
+//   POST   /api/audits/{id}/submit                         tamamla: puan SUNUCUDA hesaplanır; sonra denetim değişmez
+//   DELETE /api/audits/{id}                                taslağı sil (tamamlanmış denetim silinmez)
+//   GET    /api/audits/{id}/report.html                    yazdırılabilir denetim raporu
+//   GET    /api/audits/{id}/answers/{answerId}/photo       madde fotoğrafı
+//   GET    /api/all/audits[?…]                             bütün denetimler (yönetici) — hazır liste + Excel + yazdırma
+//   GET    /api/dashboard                                  pano: son 30 gün özeti, yerlere göre puan, son denetimler (yönetici)
+//   POST   /api/files                                      fotoğraf yükleme (yalnız kendi ön ekinize)
+// Puan, sonuç, sayılar ve durum istemciden ALINMAZ. Denetim başlarken kontrol listesinin maddeleri denetime KOPYALANIR:
+// liste sonradan değişse de geçmiş denetimler ve puanları değişmez.
+import {
+  DataValidationError,
+  OneError,
+  createCrudHandler,
+  foldSearchText,
+  getMyOrgContext,
+  getOrgSchema,
+  hasPermission,
+  localizedText,
+  logAudit,
+  logError,
+  renderPrintableReport,
+  reportResponse,
+  requirePermission,
+  requireUser,
+  type ExportColumn,
+  type OneContext,
+  type OneFilesBinding,
+} from '@devoplus/one-sdk'
+import manifest from '../one.manifest.json' with { type: 'json' }
+import { agentTools } from './agent.ts'
+import { dataModel } from './data/types.ts'
+import { fileResponse, uploadFile } from './lib/files.ts'
+import { fieldError, forward, matchId, nowIso, onlyFields, ownFileKey, readJsonObject } from './lib/http.ts'
+import { choices } from './lib/model.ts'
+import { applied, insertWhen, recordWrite, refuseActingSession, sql } from './lib/record.ts'
+import { createApp, json, type AppDefinition, type BaseEnv, type RouteInput } from './lib/server.ts'
+import { answersOf, findAudit, locationScores, recentAudits, summary, type AnswerRow, type AuditRow } from './queries.ts'
+import { CHECKLIST_ITEMS_MAX, NOTE_MAX, WEIGHT_MAX, WEIGHT_MIN, computeScore, isAnswerResult, isValidWeight, submitProblems } from './score.ts'
+import { renderShell, renderShellScript } from './shell.ts'
+
+export interface Env extends BaseEnv {
+  /** Bu kurulumun dosya deposu (manifest services.files) — madde fotoğrafları. */
+  FILES: OneFilesBinding
+}
+
+export const APP_NAME = { tr: {{nameTrJs}}, en: {{nameEnJs}} }
+/** Yönetici izni (manifest `permissions`): kontrol listelerini yönetir, bütün denetimleri ve panoyu görür. */
+export const MANAGE_PERMISSION = '{{permissionPrefix}}Manage'
+
+export const checklists = createCrudHandler({ model: dataModel, entity: 'checklists', records: 'shared', canWrite: MANAGE_PERMISSION })
+export const checklistItems = createCrudHandler({ model: dataModel, entity: 'checklist_items', records: 'shared', canWrite: MANAGE_PERMISSION })
+/** Denetimlerim: herkes yalnız KENDİ yaptığı denetimleri görür. */
+export const myAudits = createCrudHandler({ model: dataModel, entity: 'audits', records: 'own' })
+/** Bütün denetimler: yalnız yönetici; salt okunur. */
+export const allAudits = createCrudHandler({ model: dataModel, entity: 'audits', records: 'shared', basePath: '/api/all', canRead: MANAGE_PERMISSION })
+
+const ITEM_FIELDS = ['position', 'section', 'title', 'weight', 'critical'] as const
+const GENERAL_NOTE_MAX = 2000
+const LOCATION_MAX = 120
+const ORG_ID_RE = /^[0-9a-f]{24}$/i
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/
+const PHOTO_RE = /^\/api\/audits\/([0-9a-f-]{36})\/answers\/([0-9a-f-]{36})\/photo$/
+/** Satır sonu ve sekme dışındaki denetim karakterleri. */
+const CONTROL_RE = /[\u0000-\u0008\u000b-\u001f\u007f]/
+const RESULT_LABELS = Object.fromEntries(choices(dataModel, 'audit_answers', 'result').map((c) => [c.value, c.label]))
+const AUDIT_RESULT_LABELS = Object.fromEntries(choices(dataModel, 'audits', 'result').map((c) => [c.value, c.label]))
+
+async function myName(input: RouteInput<Env>): Promise<string | null> {
+  try {
+    return (await getMyOrgContext(input.api()))?.fullName ?? null
+  } catch (error) {
+    // Ad bir kolaylıktır: okunamazsa denetim yine açılır (denetçi adı boş kalır).
+    logError(input.ctx, 'kişi adı okunamadı', error)
+    return null
+  }
+}
+
+/** Denetimi görebilen: denetçinin kendisi ya da yönetici. Göremeyen için "yok" — kimlik yoklanamaz. */
+async function visibleAudit(env: Env, ctx: OneContext, id: string): Promise<{ audit: AuditRow; own: boolean }> {
+  const user = requireUser(ctx)
+  const audit = await findAudit(env, id)
+  const own = audit !== null && audit.created_by === user.sub
+  if (!audit || (!own && !hasPermission(ctx, MANAGE_PERMISSION))) throw new OneError(404, 'APP-E-404', 'Denetim bulunamadı.')
+  return { audit, own }
+}
+
+/** Değiştirme: yalnız denetçi ve yalnız taslak. */
+async function editableAudit(env: Env, ctx: OneContext, id: string): Promise<AuditRow> {
+  const { audit, own } = await visibleAudit(env, ctx, id)
+  if (!own) throw new OneError(403, 'APP-E-403', 'Denetimi yalnız denetimi yapan kişi doldurabilir.')
+  if (audit.status !== 'draft') throw new OneError(409, 'APP-E-020', 'Tamamlanmış denetim değiştirilemez.')
+  return audit
+}
+
+function text(raw: unknown, field: string, max: number, required: boolean, multiline = false): string | null {
+  if (raw === null || raw === undefined || raw === '') {
+    if (required) throw fieldError(field, 'Bu alan zorunlu.')
+    return null
+  }
+  if (typeof raw !== 'string') throw fieldError(field, 'Metin olmalı.')
+  const value = raw.trim()
+  if (value === '' && required) throw fieldError(field, 'Bu alan zorunlu.')
+  if ([...value].length > max) throw fieldError(field, `En çok ${max} karakter olabilir.`)
+  if (CONTROL_RE.test(value) || (!multiline && /[\r\n\t]/.test(value))) throw fieldError(field, 'Geçersiz karakter var.')
+  return value || null
+}
+
+/** Denetlenen yer: organizasyon şemasındaki iş yeri (sunucuda doğrulanır) ya da elle yazılmış ad. */
+async function resolveLocation(input: RouteInput<Env>, body: Record<string, unknown>): Promise<{ id: string | null; code: string | null; name: string }> {
+  const rawId = body.location_id
+  if (rawId !== undefined && rawId !== null && rawId !== '') {
+    if (typeof rawId !== 'string' || !ORG_ID_RE.test(rawId)) throw fieldError('location_id', 'Listeden bir iş yeri seçin.')
+    let workplaces
+    try {
+      workplaces = (await getOrgSchema(input.api())).workplaces
+    } catch (error) {
+      logError(input.ctx, 'organizasyon şeması okunamadı', error)
+      throw new OneError(503, 'APP-E-503', 'İş yeri listesi şu an okunamıyor; yerin adını elle yazın ya da biraz sonra yeniden deneyin.')
+    }
+    const wp = workplaces.find((w) => w.id.toLowerCase() === rawId.toLowerCase() && w.isActive !== false)
+    if (!wp) throw fieldError('location_id', 'İş yeri bulunamadı.')
+    const name = (localizedText(wp.workplaceName, 'tr') || wp.workplaceCode || '').slice(0, LOCATION_MAX)
+    return { id: wp.id.toLowerCase(), code: wp.storeCode ?? null, name: name || wp.id }
+  }
+  return { id: null, code: null, name: text(body.location_name, 'location_name', LOCATION_MAX, true)! }
+}
+
+async function workplaces(input: RouteInput<Env>): Promise<Response> {
+  requireUser(input.ctx)
+  try {
+    const schema = await getOrgSchema(input.api())
+    const items = schema.workplaces
+      .filter((w) => w.isActive !== false)
+      .map((w) => ({ id: w.id.toLowerCase(), code: w.storeCode ?? null, label: { tr: localizedText(w.workplaceName, 'tr') || w.workplaceCode, en: localizedText(w.workplaceName, 'en') || w.workplaceCode } }))
+      .sort((a, b) => a.label.tr.localeCompare(b.label.tr, 'tr'))
+    return json({ available: true, items })
+  } catch (error) {
+    // Şema okunamazsa ekran serbest metne döner; denetim yine açılabilir.
+    logError(input.ctx, 'iş yerleri okunamadı', error)
+    return json({ available: false, items: [] })
+  }
+}
+
+async function itemWrite(input: RouteInput<Env>, id: string | null): Promise<Response> {
+  const { request, env, ctx, method } = input
+  requirePermission(ctx, MANAGE_PERMISSION)
+  if (id && method === 'DELETE') return (await checklistItems.handle(request, env.DB, ctx))!
+  const body = onlyFields(await readJsonObject(request), id ? ITEM_FIELDS : ['checklist_id', ...ITEM_FIELDS])
+  if ('weight' in body && !isValidWeight(body.weight)) throw fieldError('weight', `Ağırlık ${WEIGHT_MIN}-${WEIGHT_MAX} arası bir tam sayı olmalı.`)
+  if (id) return (await checklistItems.handle(forward(request, `${checklistItems.path}/${id}`, 'PATCH', body), env.DB, ctx))!
+  const user = requireUser(ctx)
+  refuseActingSession(ctx)
+  const listId = typeof body.checklist_id === 'string' ? body.checklist_id : ''
+  if (!UUID_RE.test(listId)) throw fieldError('checklist_id', 'Kontrol listesi bulunamadı.')
+  const write = recordWrite(dataModel, 'checklist_items', body, 'create')
+  const itemId = crypto.randomUUID()
+  // ⛔ "Liste var" ve "madde sayısı sınırın altında" koşulları eklemeyle AYNI ifadededir: önce sayıp sonra eklemek, aynı
+  // anda gelen iki ekleme isteğinin ikisinin de sınırın altında görüp sınırı aşmasına ya da silinmiş bir listeye madde
+  // eklenmesine izin verirdi.
+  const when = sql(
+    'EXISTS (SELECT 1 FROM "checklists" c WHERE c.id = ? AND c.deleted_at IS NULL) AND (SELECT COUNT(*) FROM "checklist_items" WHERE checklist_id = ? AND deleted_at IS NULL) < ?',
+    listId,
+    listId,
+    CHECKLIST_ITEMS_MAX,
+  )
+  if (!(await applied(write, insertWhen(env.DB, write, { id: itemId, actor: user.sub, now: nowIso(), when })))) {
+    const list = await env.DB.prepare('SELECT id FROM "checklists" WHERE id = ? AND deleted_at IS NULL').bind(listId).first<{ id: string }>()
+    if (!list) throw fieldError('checklist_id', 'Kontrol listesi bulunamadı.')
+    throw new OneError(409, 'APP-E-021', `Bir kontrol listesinde en çok ${CHECKLIST_ITEMS_MAX} madde olabilir.`)
+  }
+  const res = (await checklistItems.handle(forward(request, `${checklistItems.path}/${itemId}`, 'GET'), env.DB, ctx))!
+  if (!res.ok) return res
+  const out = json(await res.json(), 201)
+  out.headers.set('location', `${checklistItems.path}/${itemId}`)
+  return out
+}
+
+async function createAudit(input: RouteInput<Env>): Promise<Response> {
+  const { request, env, ctx } = input
+  const user = requireUser(ctx)
+  refuseActingSession(ctx)
+  // ⛔ Puan, durum ve sayılar burada GÖNDERİLEMEZ (alan listesi dışındaki her ad 400).
+  const body = onlyFields(await readJsonObject(request), ['checklist_id', 'location_id', 'location_name'])
+  const listId = typeof body.checklist_id === 'string' ? body.checklist_id : ''
+  const list = UUID_RE.test(listId)
+    ? await env.DB.prepare('SELECT id, name, active FROM "checklists" WHERE id = ? AND deleted_at IS NULL').bind(listId).first<{ id: string; name: string; active: number }>()
+    : null
+  if (!list) throw fieldError('checklist_id', 'Kontrol listesi bulunamadı.')
+  if (list.active !== 1) throw new OneError(409, 'APP-E-021', 'Bu kontrol listesi kullanımda değil.')
+  const items = await env.DB.prepare(
+    'SELECT id, position, section, title, weight, critical FROM "checklist_items" WHERE checklist_id = ? AND deleted_at IS NULL ORDER BY position, created_at LIMIT ?',
+  )
+    .bind(listId, CHECKLIST_ITEMS_MAX + 1)
+    .all<{ id: string; position: number; section: string | null; title: string; weight: number; critical: number }>()
+  if (items.results.length === 0) throw new OneError(409, 'APP-E-022', 'Kontrol listesinde henüz madde yok.')
+  // ⛔ Maddeler KESİLMEZ: sınırı aşan liste (sınır sonradan düşürülmüş ya da veri elle eklenmiş) denetimi eksik maddeyle
+  // açıp puanı eksik kümeden hesaplatırdı. Bir fazla satır okunur; aşılmışsa denetim açılmaz ve nedeni söylenir.
+  if (items.results.length > CHECKLIST_ITEMS_MAX) {
+    const total = await env.DB.prepare('SELECT COUNT(*) AS n FROM "checklist_items" WHERE checklist_id = ? AND deleted_at IS NULL').bind(listId).first<{ n: number }>()
+    throw new OneError(409, 'APP-E-021', `Kontrol listesinde ${total?.n ?? items.results.length} madde var; bir denetim en çok ${CHECKLIST_ITEMS_MAX} madde taşır. Listeden madde çıkarın.`)
+  }
+  const location = await resolveLocation(input, body)
+  const auditor = await myName(input)
+  const now = nowIso()
+  const id = crypto.randomUUID()
+  const audit = recordWrite(
+    dataModel,
+    'audits',
+    { checklist_id: listId, checklist_name: list.name, location_id: location.id, location_code: location.code, location_name: location.name, auditor_name: auditor ? [...auditor.trim()].slice(0, 120).join('') || null : null, status: 'draft' },
+    'create',
+  )
+  // Denetim ve maddelerinin kopyası TEK toplu yazımdır: ya hepsi yazılır ya hiçbiri. ⛔ Denetim yalnız liste HÂLÂ
+  // kullanımda, silinmemiş ve adı okuduğumuz adsa açılır (aynı ifadede); maddeler yalnız denetim açıldıysa eklenir.
+  // Madde kopyaları okunduğu andaki listedir: arada değişen bir madde, denetim o değişiklikten önce açılmış gibi kalır.
+  const statements = [
+    insertWhen(env.DB, audit, {
+      id,
+      actor: user.sub,
+      now,
+      when: sql('EXISTS (SELECT 1 FROM "checklists" c WHERE c.id = ? AND c.active = 1 AND c.deleted_at IS NULL AND c.name = ?)', listId, list.name),
+    }),
+    ...items.results.map((item, index) => {
+      const answer = recordWrite(
+        dataModel,
+        'audit_answers',
+        { audit_id: id, item_id: item.id, position: index + 1, section: item.section, title: item.title, weight: item.weight, critical: item.critical === 1 },
+        'create',
+      )
+      return insertWhen(env.DB, answer, { id: crypto.randomUUID(), actor: user.sub, now, when: sql('EXISTS (SELECT 1 FROM "audits" WHERE id = ?)', id) })
+    }),
+  ]
+  const [opened] = await env.DB.batch(statements)
+  if (Number(opened?.meta.changes ?? 0) !== 1) throw new OneError(409, 'APP-E-012', 'Kontrol listesi bu arada değişti; sayfayı yenileyip yeniden deneyin.')
+  logAudit(ctx, 'audit.start', id, { items: items.results.length })
+  return json({ audit: await findAudit(env, id), answers: await answersOf(env, id) }, 201)
+}
+
+function answerView(a: AnswerRow) {
+  return { ...a, critical: a.critical === 1 }
+}
+
+function auditView(a: AuditRow) {
+  return { ...a, critical_failed: a.critical_failed === 1 }
+}
+
+async function readAnswers({ env, ctx }: RouteInput<Env>, id: string): Promise<Response> {
+  const { audit, own } = await visibleAudit(env, ctx, id)
+  return json({ audit: auditView(audit), answers: (await answersOf(env, id)).map(answerView), editable: own && audit.status === 'draft' })
+}
+
+const fold = (value: string | null): string | null => (value === null ? null : foldSearchText(value))
+
+async function saveAnswers(input: RouteInput<Env>, id: string): Promise<Response> {
+  const { request, env, ctx } = input
+  const user = requireUser(ctx)
+  refuseActingSession(ctx)
+  const body = onlyFields(await readJsonObject(request), ['answers', 'general_note'])
+  await editableAudit(env, ctx, id)
+  const existing = new Map((await answersOf(env, id)).map((a) => [a.id, a]))
+  const raw = body.answers ?? []
+  if (!Array.isArray(raw) || raw.length > CHECKLIST_ITEMS_MAX) throw fieldError('answers', 'Cevaplar bir liste olmalı.')
+  const now = nowIso()
+  const updates = raw.map((entry, index) => {
+    if (typeof entry !== 'object' || entry === null || Array.isArray(entry)) throw fieldError(`answers.${index}`, 'Cevap bir nesne olmalı.')
+    const answer = onlyFields(entry as Record<string, unknown>, ['id', 'result', 'note', 'photo'])
+    const target = typeof answer.id === 'string' ? existing.get(answer.id) : undefined
+    if (!target) throw fieldError(`answers.${index}.id`, 'Madde bu denetimde yok.')
+    const sets: string[] = []
+    const values: (string | number | null)[] = []
+    if ('result' in answer) {
+      const result = answer.result === '' || answer.result === null ? null : answer.result
+      if (result !== null && !isAnswerResult(result)) throw fieldError(`answers.${index}.result`, 'Uygun, uygun değil ya da uygulanamaz seçin.')
+      sets.push('result = ?')
+      values.push(result)
+    }
+    if ('note' in answer) {
+      const note = text(answer.note, `answers.${index}.note`, NOTE_MAX, false, true)
+      sets.push('note = ?', 'note_fold = ?')
+      values.push(note, fold(note))
+    }
+    if ('photo' in answer) {
+      const key = ownFileKey(answer.photo, user.sub, `answers.${index}.photo`)
+      const name = key && typeof answer.photo === 'object' && answer.photo !== null && typeof (answer.photo as { name?: unknown }).name === 'string' ? (answer.photo as { name: string }).name.slice(0, 200) : null
+      // Ad gönderilmediyse satırdaki ad KORUNUR (aynı ifadede; okunmuş bir değer geri yazılmaz). Fotoğraf silinince ad da silinir.
+      if (key) sets.push('photo = ?', 'photo_name = coalesce(?, photo_name)', 'photo_name_fold = coalesce(?, photo_name_fold)')
+      else sets.push('photo = ?', 'photo_name = ?', 'photo_name_fold = ?')
+      values.push(key, name, fold(name))
+    }
+    // ⛔ Madde yalnız denetim HÂLÂ bu kişinin taslağıysa güncellenir (aynı toplu yazımda tamamlanan denetim değişmez).
+    return env.DB.prepare(
+      `UPDATE "audit_answers" SET ${[...sets, 'updated_at = ?', 'updated_by = ?'].join(', ')} WHERE id = ? AND audit_id = ? AND deleted_at IS NULL ` +
+        `AND EXISTS (SELECT 1 FROM "audits" WHERE id = ? AND created_by = ? AND status = 'draft' AND deleted_at IS NULL)`,
+    ).bind(...values, now, user.sub, target.id, id, id, user.sub)
+  })
+  // Genel not yalnız GÖNDERİLDİYSE yazılır: başka bir sekmede kaydedilmiş notu okunmuş eski değerle ezmez.
+  const noteSet = 'general_note' in body ? text(body.general_note, 'general_note', GENERAL_NOTE_MAX, false, true) : undefined
+  // Denetimin `updated_at`'i her kayıtta ilerler: tamamlama, okuduğu cevaplar bu arada değiştiyse durur (409).
+  const touch = env.DB.prepare(
+    `UPDATE "audits" SET ${noteSet === undefined ? '' : 'general_note = ?, general_note_fold = ?, '}updated_at = ?, updated_by = ? WHERE id = ? AND created_by = ? AND status = 'draft' AND deleted_at IS NULL`,
+  ).bind(...(noteSet === undefined ? [] : [noteSet, fold(noteSet)]), now, user.sub, id, user.sub)
+  const [touched] = await env.DB.batch([touch, ...updates])
+  if (Number(touched?.meta.changes ?? 0) !== 1) throw new OneError(409, 'APP-E-020', 'Tamamlanmış denetim değiştirilemez.')
+  return readAnswers(input, id)
+}
+
+async function submit(input: RouteInput<Env>, id: string): Promise<Response> {
+  const { request, env, ctx } = input
+  const user = requireUser(ctx)
+  refuseActingSession(ctx)
+  // Gövde boş olmalıdır: puan, sonuç ya da sayı GÖNDERİLEMEZ (400).
+  if (request.body !== null) onlyFields(await readJsonObject(request), [])
+  const audit = await editableAudit(env, ctx, id)
+  const answers = await answersOf(env, id)
+  const scored = answers.map((a) => ({ weight: a.weight, critical: a.critical === 1, result: a.result, note: a.note }))
+  const problems = submitProblems(scored)
+  if (problems.length > 0) throw new DataValidationError(400, 'APP-E-400', 'Denetim tamamlanamadı: eksik maddeler var.', problems.map((message) => ({ field: 'answers', message })))
+  const s = computeScore(scored)
+  const now = nowIso()
+  const res = await env.DB.prepare(
+    "UPDATE \"audits\" SET status = 'completed', submitted_at = ?, score = ?, result = ?, critical_failed = ?, compliant_count = ?, noncompliant_count = ?, not_applicable_count = ?, updated_at = ?, updated_by = ? " +
+      "WHERE id = ? AND created_by = ? AND status = 'draft' AND updated_at = ? AND deleted_at IS NULL",
+  )
+    .bind(now, s.score, s.result, s.criticalFailed ? 1 : 0, s.compliant, s.noncompliant, s.notApplicable, now, user.sub, id, user.sub, audit.updated_at)
+    .run()
+  if (Number(res.meta.changes ?? 0) !== 1) throw new OneError(409, 'APP-E-012', 'Denetim bu arada değişti; sayfayı yenileyip yeniden deneyin.')
+  logAudit(ctx, 'audit.submit', id, { score: s.score, result: s.result })
+  const after = await findAudit(env, id)
+  return json(after ? auditView(after) : { id })
+}
+
+async function deleteDraft({ env, ctx }: RouteInput<Env>, id: string): Promise<Response> {
+  const user = requireUser(ctx)
+  refuseActingSession(ctx)
+  await editableAudit(env, ctx, id)
+  const now = nowIso()
+  const [audit] = await env.DB.batch([
+    env.DB.prepare("UPDATE \"audits\" SET deleted_at = ?, updated_at = ?, updated_by = ? WHERE id = ? AND created_by = ? AND status = 'draft' AND deleted_at IS NULL").bind(now, now, user.sub, id, user.sub),
+    env.DB.prepare(
+      "UPDATE \"audit_answers\" SET deleted_at = ? WHERE audit_id = ? AND deleted_at IS NULL AND EXISTS (SELECT 1 FROM \"audits\" WHERE id = ? AND deleted_at = ?)",
+    ).bind(now, id, id, now),
+  ])
+  if (Number(audit?.meta.changes ?? 0) !== 1) throw new OneError(409, 'APP-E-020', 'Tamamlanmış denetim silinemez.')
+  logAudit(ctx, 'audit.delete', id)
+  return new Response(null, { status: 204 })
+}
+
+const trDate = (iso: string): string => new Intl.DateTimeFormat('tr-TR', { timeZone: 'Europe/Istanbul', day: '2-digit', month: '2-digit', year: 'numeric' }).format(new Date(iso))
+
+async function report({ env, ctx, url }: RouteInput<Env>, id: string): Promise<Response> {
+  const { audit } = await visibleAudit(env, ctx, id)
+  const lang = url.searchParams.get('_lang') === 'en' ? 'en' : 'tr'
+  const answers = await answersOf(env, id)
+  const en = lang === 'en'
+  const columns: ExportColumn[] = [
+    { key: 'position', title: { tr: 'Sıra', en: 'No.' }, type: 'number', width: 6 },
+    { key: 'section', title: { tr: 'Bölüm', en: 'Section' } },
+    { key: 'title', title: { tr: 'Madde', en: 'Item' }, width: 40 },
+    { key: 'weight', title: { tr: 'Ağırlık', en: 'Weight' }, type: 'number', width: 8 },
+    { key: 'critical', title: { tr: 'Kritik', en: 'Critical' }, type: 'boolean', width: 8 },
+    { key: 'result', title: { tr: 'Sonuç', en: 'Result' }, labels: RESULT_LABELS },
+    { key: 'note', title: { tr: 'Not', en: 'Note' }, width: 40 },
+  ]
+  const rows = answers.map((a) => ({ position: a.position, section: a.section ?? '', title: a.title, weight: a.weight, critical: a.critical === 1, result: a.result ?? '', note: a.note ?? '' }))
+  const resultLabel = audit.result ? (AUDIT_RESULT_LABELS[audit.result]?.[lang] ?? audit.result) : ''
+  const subtitle = [
+    audit.checklist_name ?? '',
+    `${en ? 'Auditor' : 'Denetçi'}: ${audit.auditor_name ?? '-'}`,
+    audit.submitted_at ? `${en ? 'Date' : 'Tarih'}: ${trDate(audit.submitted_at)}` : en ? 'Draft (not completed)' : 'Taslak (tamamlanmadı)',
+    audit.score !== null ? `${en ? 'Score' : 'Puan'}: ${audit.score} - ${resultLabel}${audit.critical_failed === 1 ? (en ? ' (critical item failed)' : ' (kritik madde uygun değil)') : ''}` : '',
+  ]
+    .filter(Boolean)
+    .join(' - ')
+  const title = `${en ? 'Audit report' : 'Denetim raporu'}: ${audit.location_name}`
+  return reportResponse(renderPrintableReport({ title, subtitle, columns, rows, lang, orientation: 'landscape' }))
+}
+
+async function photo({ env, ctx }: RouteInput<Env>, auditId: string, answerId: string): Promise<Response> {
+  await visibleAudit(env, ctx, auditId)
+  const row = await env.DB.prepare('SELECT photo FROM "audit_answers" WHERE id = ? AND audit_id = ? AND deleted_at IS NULL').bind(answerId, auditId).first<{ photo: string | null }>()
+  if (!row?.photo) throw new OneError(404, 'APP-E-404', 'Bu maddede fotoğraf yok.')
+  return fileResponse(env.FILES, row.photo)
+}
+
+async function dashboard({ env, ctx }: RouteInput<Env>): Promise<Response> {
+  requirePermission(ctx, MANAGE_PERMISSION)
+  const since = new Date(Date.now() - 30 * 86_400_000).toISOString()
+  const [totals, locations, recent] = await Promise.all([summary(env, since), locationScores(env, 12), recentAudits(env, 20)])
+  return json({ summary: totals, locations, recent })
+}
+
+async function routes(input: RouteInput<Env>): Promise<Response | null> {
+  const { url, method, env, ctx } = input
+  const path = url.pathname
+  if (path === '/api/files' && method === 'POST') return uploadFile(input.request, env.FILES, ctx)
+  if (path === '/api/workplaces' && method === 'GET') return workplaces(input)
+  if (path === '/api/dashboard' && method === 'GET') return dashboard(input)
+  if (path === allAudits.path || path.startsWith(`${allAudits.path}/`)) {
+    if (method !== 'GET' && method !== 'HEAD') throw new OneError(405, 'APP-E-405', 'Bu liste yalnız okunur.')
+    return allAudits.handle(input.request, env.DB, ctx)
+  }
+  if (path === checklistItems.path && method === 'POST') return itemWrite(input, null)
+  const itemId = matchId(path, checklistItems.path)
+  if (itemId && (method === 'PATCH' || method === 'DELETE')) return itemWrite(input, itemId)
+  if (path === checklistItems.path || path.startsWith(`${checklistItems.path}/`)) return checklistItems.handle(input.request, env.DB, ctx)
+  if (path === checklists.path || path.startsWith(`${checklists.path}/`)) return checklists.handle(input.request, env.DB, ctx)
+
+  const photoMatch = PHOTO_RE.exec(path)
+  if (photoMatch && method === 'GET') return photo(input, photoMatch[1]!, photoMatch[2]!)
+  if (path === myAudits.path && method === 'POST') return createAudit(input)
+  let id = matchId(path, myAudits.path, 'answers')
+  if (id && method === 'GET') return readAnswers(input, id)
+  if (id && method === 'PUT') return saveAnswers(input, id)
+  id = matchId(path, myAudits.path, 'submit')
+  if (id && method === 'POST') return submit(input, id)
+  id = matchId(path, myAudits.path, 'report.html')
+  if (id && method === 'GET') return report(input, id)
+  id = matchId(path, myAudits.path)
+  if (id && method === 'DELETE') return deleteDraft(input, id)
+  if (path === myAudits.path || path.startsWith(`${myAudits.path}/`)) {
+    if (method !== 'GET' && method !== 'HEAD') throw new OneError(405, 'APP-E-405', 'Denetim bu adresten değiştirilemez; cevaplar için denetimin cevap ucunu kullanın.')
+    return myAudits.handle(input.request, env.DB, ctx)
+  }
+  return null
+}
+
+export const definition: Omit<AppDefinition<Env>, 'guide'> = {
+  manifest,
+  tools: agentTools,
+  page: renderShell,
+  script: renderShellScript,
+  routes,
+}
+
+export function buildApp(guide: string) {
+  return createApp<Env>({ ...definition, guide })
+}