hanoman 0.9.13 → 0.9.14

package/dist/server.js

@@ -8194,7 +8194,7 @@ var init_api = __esm({
       qaReportBacklog: (pid, rid) => `${API}/projects/${encodeURIComponent(pid)}/qa/reports/${encodeURIComponent(rid)}/backlog`,
       qaCasesImport: (pid, rid) => `${API}/projects/${encodeURIComponent(pid)}/qa/reports/${encodeURIComponent(rid)}/cases/import`,
       qaImport: (pid) => `${API}/projects/${encodeURIComponent(pid)}/qa/import`,
-      qaTemplate: `${API}/qa/template.md`,
+      qaTemplate: `${API}/qa/template.xlsx`,
       // SPEC-945 · ADR-0150 · papan tim. `members` GLOBAL (bukan per project) — task boleh tanpa
       // project, jadi direktori orang tak bisa digantung pada project.
       members: `${API}/members`,
@@ -17638,9 +17638,9 @@ import {
 import { dirname as dirname6, isAbsolute as isAbsolute6, join as join11, normalize, relative as relative4, sep as sep5 } from "node:path";
 function safeJoin(dir2, rel) {
   if (!rel || isAbsolute6(rel)) throw new SkillError(400, "path harus relatif terhadap skill");
-  const norm4 = normalize(rel);
-  if (norm4 === ".." || norm4.startsWith(".." + sep5)) throw new SkillError(400, "path keluar dari skill");
-  const full = join11(dir2, norm4);
+  const norm5 = normalize(rel);
+  if (norm5 === ".." || norm5.startsWith(".." + sep5)) throw new SkillError(400, "path keluar dari skill");
+  const full = join11(dir2, norm5);
   let probe = full;
   while (!existsSync7(probe) && probe !== dir2) probe = dirname6(probe);
   const realDir = realpathSync5(dir2);
@@ -54953,11 +54953,11 @@ async function listConflicts() {
     detectedAt: r.detectedAt.toISOString()
   }));
 }
-async function resolveConflict(entity, recordId, choice, push) {
+async function resolveConflict(entity, recordId, choice2, push) {
   if (!isEntity(entity)) return { ok: false, reason: "not-found" };
   const c = await prisma.syncConflict.findUnique({ where: { entity_recordId: { entity, recordId } } });
   if (!c || c.resolvedAt) return { ok: false, reason: "not-found" };
-  if (choice === "server") {
+  if (choice2 === "server") {
     await upsertLocal(entity, recordId, c.serverVersion, c.serverData);
   } else {
     let r = (await push([{ entity, id: recordId, baseVersion: c.serverVersion, data: c.localData }])).results?.[0];
@@ -55289,7 +55289,7 @@ function createRelayDispatcher(o) {
       send(i === 0 ? { t: "res", id: id2, status: status2, contentType, part, end: end2 } : { t: "res", id: id2, part, end: end2 });
     });
   };
-  const fail3 = (id2, status2, error) => reply(id2, status2, JSON_TYPE, JSON.stringify({ error }));
+  const fail4 = (id2, status2, error) => reply(id2, status2, JSON_TYPE, JSON.stringify({ error }));
   async function handleReq(f) {
     const started2 = now();
     const record2 = (status2, extra = {}) => audit({
@@ -55300,19 +55300,19 @@ function createRelayDispatcher(o) {
     });
     if (inflight3.has(f.id)) return;
     if (inflight3.size >= RELAY_MAX_INFLIGHT) {
-      fail3(f.id, 429, "relay-busy");
+      fail4(f.id, 429, "relay-busy");
       record2(429);
       return;
     }
     const payload = f.body === void 0 ? void 0 : JSON.stringify(f.body);
     if (payload !== void 0 && utf8Bytes(payload) > RELAY_REQUEST_BODY_MAX_BYTES) {
-      fail3(f.id, 413, "relay-body-too-large");
+      fail4(f.id, 413, "relay-body-too-large");
       record2(413);
       return;
     }
     const url2 = f.query ? `${f.path}?${f.query.replace(/^\?/, "")}` : f.path;
     if (!relayRouteAllowed(f.method, url2) || !relayBodyAllowed(f.method, f.path, f.body)) {
-      fail3(f.id, 403, "relay route not allowed");
+      fail4(f.id, 403, "relay route not allowed");
       record2(403);
       return;
     }
@@ -55360,13 +55360,13 @@ function createRelayDispatcher(o) {
       });
       if (entry2.cancelled) return;
       if (utf8Bytes(res.body) > RELAY_RESPONSE_MAX_BYTES) {
-        fail3(f.id, 502, "relay-response-too-large");
+        fail4(f.id, 502, "relay-response-too-large");
         return;
       }
       reply(f.id, res.statusCode, String(res.headers["content-type"] ?? "application/octet-stream"), res.body);
     } catch {
       record2(502);
-      if (!entry2.cancelled) fail3(f.id, 502, "relay-dispatch-failed");
+      if (!entry2.cancelled) fail4(f.id, 502, "relay-dispatch-failed");
     } finally {
       inflight3.delete(f.id);
     }
@@ -72960,20 +72960,20 @@ async function decide(req, deps = prodDecideDeps) {
   const resolved = resolveChoices(rawChoices, options2);
   const countProblem = options2.length && resolved.choices.length ? checkChoiceCount(resolved.choices.length, bounds) : null;
   const choices = countProblem ? [] : resolved.choices;
-  const choice = choices[0] ?? null;
+  const choice2 = choices[0] ?? null;
   const choiceRejected = options2.length > 0 && rawChoices.length > 0 && (resolved.rejected.length > 0 || !!countProblem);
   const missing = verdict.missing.map((m) => m.trim()).filter(Boolean);
   let action = allowed ? verdict.action : "none";
   let actionNote = "";
   let conflict = false;
-  if (allowed && choices.length === 1 && choice) {
-    const hint = optionActionHint(choice.option);
+  if (allowed && choices.length === 1 && choice2) {
+    const hint = optionActionHint(choice2.option);
     if (hint && action === "none" && hint !== "none") {
       action = hint;
       actionNote = `Tindakan diturunkan dari opsi terpilih ("${hint}") karena lead tak menyebutnya sendiri (SPEC-480).`;
     } else if (hint && action !== "none" && action !== hint) {
       conflict = true;
-      actionNote = `KONFLIK: lead memilih opsi "${choice.option}" tetapi menyetel action "${action}" \u2014 tindakan dibatalkan (SPEC-480).`;
+      actionNote = `KONFLIK: lead memilih opsi "${choice2.option}" tetapi menyetel action "${action}" \u2014 tindakan dibatalkan (SPEC-480).`;
       action = "none";
     }
   }
@@ -73006,8 +73006,8 @@ ${notes.join("\n\n")}` : "";
     confidence,
     action,
     weighty,
-    choice: choice?.option ?? null,
-    choiceIndex: choice?.index ?? null,
+    choice: choice2?.option ?? null,
+    choiceIndex: choice2?.index ?? null,
     choices,
     select: bounds,
     flowId: flow2.id,
@@ -73030,7 +73030,7 @@ ${notes.join("\n\n")}` : "";
     reason: `${clampProse(verdict.reason, LEAD_REASON_MAX)}${tail3}`,
     reply: verdict.reply,
     choices,
-    choice,
+    choice: choice2,
     missing
   });
   return row;
@@ -79614,16 +79614,13 @@ async function qaAttachments(app3) {
 // src/routes/qa-transfer.ts
 init_src();
 
-// src/services/qa-cases-import.ts
+// src/services/qa-workbook.ts
 init_src();
-init_db();
 
-// src/services/qa-transfer.ts
-init_src();
-init_db();
-import { basename as basename10 } from "node:path";
-init_qa_attachment_transfer();
-init_sync_notify();
+// src/services/ooxml.ts
+var xmlEsc = (s2) => s2.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+var xmlClean = (s2) => s2.replace(/[\u0000-\u0008\u000B\u000C\u000E-\u001F￾￿]/g, "");
+var XML_HEAD = '<?xml version="1.0" encoding="UTF-8" standalone="yes"?>\n';
 
 // src/services/zip.ts
 import { deflateRawSync, inflateRawSync } from "node:zlib";
@@ -79739,7 +79736,319 @@ function readZip(buf, o = {}) {
   return out4;
 }
 
+// src/services/xlsx.ts
+var XlsxError = class extends Error {
+};
+var MAX_ROWS = 5e3;
+var MAX_COLS = 60;
+var MAX_CELL = 32767;
+var esc2 = xmlEsc;
+var clean2 = (s2) => xmlClean(s2).slice(0, MAX_CELL);
+var colLetter = (i) => {
+  let s2 = "";
+  for (let n2 = i + 1; n2 > 0; n2 = Math.floor((n2 - 1) / 26)) s2 = String.fromCharCode(65 + (n2 - 1) % 26) + s2;
+  return s2;
+};
+var colIndex = (letters) => [...letters].reduce((n2, c) => n2 * 26 + (c.charCodeAt(0) - 64), 0) - 1;
+var sheetName = (n2, i) => n2.replace(/[[\]:*?/\\]/g, "_").trim().slice(0, 31) || `Sheet${i + 1}`;
+var NS = "http://schemas.openxmlformats.org/spreadsheetml/2006/main";
+var NS_R = "http://schemas.openxmlformats.org/officeDocument/2006/relationships";
+var HEAD = XML_HEAD;
+function writeXlsx(sheets) {
+  const parts = [];
+  const add = (name2, body) => parts.push({ name: name2, data: Buffer.from(HEAD + body, "utf8"), deflate: true });
+  add(
+    "[Content_Types].xml",
+    '<Types xmlns="http://schemas.openxmlformats.org/package/2006/content-types"><Default Extension="rels" ContentType="application/vnd.openxmlformats-package.relationships+xml"/><Default Extension="xml" ContentType="application/xml"/><Override PartName="/xl/workbook.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.sheet.main+xml"/><Override PartName="/xl/styles.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.styles+xml"/>' + sheets.map((_, i) => `<Override PartName="/xl/worksheets/sheet${i + 1}.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.worksheet+xml"/>`).join("") + "</Types>"
+  );
+  add(
+    "_rels/.rels",
+    '<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument" Target="xl/workbook.xml"/></Relationships>'
+  );
+  add(
+    "xl/workbook.xml",
+    `<workbook xmlns="${NS}" xmlns:r="${NS_R}"><sheets>` + sheets.map((s2, i) => `<sheet name="${esc2(sheetName(s2.name, i))}" sheetId="${i + 1}" r:id="rId${i + 1}"/>`).join("") + "</sheets></workbook>"
+  );
+  add(
+    "xl/_rels/workbook.xml.rels",
+    '<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships">' + sheets.map((_, i) => `<Relationship Id="rId${i + 1}" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/worksheet" Target="worksheets/sheet${i + 1}.xml"/>`).join("") + `<Relationship Id="rId${sheets.length + 1}" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/styles" Target="styles.xml"/></Relationships>`
+  );
+  add(
+    "xl/styles.xml",
+    `<styleSheet xmlns="${NS}"><fonts count="2"><font><sz val="11"/><name val="Calibri"/></font><font><b/><sz val="11"/><name val="Calibri"/></font></fonts><fills count="3"><fill><patternFill patternType="none"/></fill><fill><patternFill patternType="gray125"/></fill><fill><patternFill patternType="solid"><fgColor rgb="FFF1E6CC"/><bgColor indexed="64"/></patternFill></fill></fills><borders count="1"><border><left/><right/><top/><bottom/><diagonal/></border></borders><cellStyleXfs count="1"><xf numFmtId="0" fontId="0" fillId="0" borderId="0"/></cellStyleXfs><cellXfs count="3"><xf numFmtId="0" fontId="0" fillId="0" borderId="0" xfId="0"/><xf numFmtId="0" fontId="1" fillId="2" borderId="0" xfId="0" applyFont="1" applyFill="1" applyAlignment="1"><alignment vertical="top" wrapText="1"/></xf><xf numFmtId="0" fontId="0" fillId="0" borderId="0" xfId="0" applyAlignment="1"><alignment vertical="top" wrapText="1"/></xf></cellXfs><cellStyles count="1"><cellStyle name="Normal" xfId="0" builtinId="0"/></cellStyles></styleSheet>`
+  );
+  sheets.forEach((s2, si) => {
+    const cols = s2.widths?.length ? `<cols>${s2.widths.map((w, i) => `<col min="${i + 1}" max="${i + 1}" width="${w}" customWidth="1"/>`).join("")}</cols>` : "";
+    const data = s2.rows.map((r, ri) => {
+      const cells = r.map((v, ci) => {
+        const t = clean2(v);
+        return t === "" ? "" : `<c r="${colLetter(ci)}${ri + 1}" s="${ri === 0 ? 1 : 2}" t="inlineStr"><is><t xml:space="preserve">${esc2(t)}</t></is></c>`;
+      }).join("");
+      const lines2 = Math.max(1, ...r.map((v, ci) => v.split("\n").reduce((n2, line) => n2 + Math.max(1, Math.ceil(line.length / Math.max(8, (s2.widths?.[ci] ?? 24) - 2))), 0)));
+      const height = Math.min(240, Math.max(24, lines2 * 15 + 8));
+      return `<row r="${ri + 1}" ht="${height}" customHeight="1">${cells}</row>`;
+    }).join("");
+    const validations = s2.dropdowns?.length ? `<dataValidations count="${s2.dropdowns.length}">${s2.dropdowns.map(
+      (d) => `<dataValidation type="list" allowBlank="1" showErrorMessage="1" errorTitle="Nilai tidak valid" error="Pilih nilai dari daftar" sqref="${esc2(d.range)}"><formula1>${esc2(`"${d.values.join(",")}"`)}</formula1></dataValidation>`
+    ).join("")}</dataValidations>` : "";
+    add(
+      `xl/worksheets/sheet${si + 1}.xml`,
+      `<worksheet xmlns="${NS}"><sheetViews><sheetView workbookViewId="0"><pane ySplit="1" topLeftCell="A2" activePane="bottomLeft" state="frozen"/></sheetView></sheetViews><sheetFormatPr defaultRowHeight="15"/>${cols}<sheetData>${data}</sheetData>${validations}</worksheet>`
+    );
+  });
+  return writeZip(parts);
+}
+function unesc2(s2) {
+  return s2.replace(/&(#x[0-9a-fA-F]+|#\d+|lt|gt|amp|quot|apos);/g, (_, e) => {
+    if (e === "lt") return "<";
+    if (e === "gt") return ">";
+    if (e === "amp") return "&";
+    if (e === "quot") return '"';
+    if (e === "apos") return "'";
+    const cp = e[1] === "x" ? parseInt(e.slice(2), 16) : parseInt(e.slice(1), 10);
+    return Number.isFinite(cp) && cp > 0 && cp <= 1114111 ? String.fromCodePoint(cp) : "";
+  });
+}
+var attrs = (s2) => {
+  const out4 = {};
+  for (const m of s2.matchAll(/([\w:.-]+)\s*=\s*"([^"]*)"/g)) out4[m[1]] = unesc2(m[2]);
+  return out4;
+};
+var textOf = (xmlFragment) => [...xmlFragment.replace(/<rPh\b[\s\S]*?<\/rPh>/g, "").matchAll(/<t\b[^>]*>([\s\S]*?)<\/t>/g)].map((m) => unesc2(m[1])).join("");
+function readXlsx(buf, opts2 = {}) {
+  let files;
+  try {
+    files = readZip(buf, { maxEntries: 100, maxTotalBytes: 40 * 1024 * 1024 });
+  } catch (e) {
+    if (e instanceof ZipError) throw new XlsxError(`bukan berkas XLSX yang valid: ${e.message}`);
+    throw e;
+  }
+  const text2 = (name2) => files.get(name2)?.toString("utf8");
+  let target3 = "xl/worksheets/sheet1.xml";
+  const wb = text2("xl/workbook.xml");
+  const rels = text2("xl/_rels/workbook.xml.rels");
+  if (wb && rels) {
+    const all = [...wb.matchAll(/<sheet\b([^>]*)>/g)].map((m) => attrs(m[1]));
+    const want = opts2.sheet?.trim().toLowerCase();
+    if (want && opts2.required && !all.some((a) => (a.name ?? "").trim().toLowerCase() === want)) throw new XlsxError(`lembar "${opts2.sheet}" wajib ada \u2014 gunakan template QA Excel`);
+    const chosen = (want ? all.find((a) => (a.name ?? "").trim().toLowerCase() === want) : void 0) ?? all[0];
+    const rid = chosen?.["r:id"];
+    for (const m of rels.matchAll(/<Relationship\b([^>]*)>/g)) {
+      const a = attrs(m[1]);
+      if (rid && a.Id === rid && a.Target) {
+        target3 = a.Target.startsWith("/") ? a.Target.slice(1) : `xl/${a.Target}`;
+        break;
+      }
+    }
+  }
+  const sheet = text2(target3);
+  if (sheet === void 0) throw new XlsxError("lembar (worksheet) tak ditemukan di XLSX");
+  const shared = [];
+  const sst = text2("xl/sharedStrings.xml");
+  if (sst) for (const m of sst.matchAll(/<si\b[^>]*>([\s\S]*?)<\/si>/g)) shared.push(textOf(m[1]));
+  const rows = [];
+  let rowSeq = 0;
+  for (const rm9 of sheet.matchAll(/<row\b([^>]*?)(?:\/>|>([\s\S]*?)<\/row>)/g)) {
+    rowSeq++;
+    const rn = Number(attrs(rm9[1]).r) || rowSeq;
+    if (rn > MAX_ROWS) throw new XlsxError(`terlalu banyak baris (maks ${MAX_ROWS})`);
+    const row = rows[rn - 1] ?? [];
+    let colSeq = -1;
+    for (const cm of (rm9[2] ?? "").matchAll(/<c\b([^>]*?)(?:\/>|>([\s\S]*?)<\/c>)/g)) {
+      const a = attrs(cm[1]);
+      const ref = /^([A-Z]+)\d+$/.exec(a.r ?? "");
+      const ci = ref ? colIndex(ref[1]) : colSeq + 1;
+      colSeq = ci;
+      if (ci >= MAX_COLS) throw new XlsxError(`terlalu banyak kolom (maks ${MAX_COLS})`);
+      const inner = cm[2] ?? "";
+      const v = /<v\b[^>]*>([\s\S]*?)<\/v>/.exec(inner)?.[1];
+      let val = "";
+      if (a.t === "s") val = shared[Number(v)] ?? "";
+      else if (a.t === "inlineStr") val = textOf(inner);
+      else if (a.t === "str") val = v === void 0 ? "" : unesc2(v);
+      else if (a.t === "b") val = v === "1" ? "TRUE" : "FALSE";
+      else if (a.t === "e") val = "";
+      else val = v === void 0 ? "" : unesc2(v);
+      while (row.length < ci) row.push("");
+      row[ci] = val;
+    }
+    while (rows.length < rn - 1) rows.push([]);
+    rows[rn - 1] = row;
+  }
+  return rows;
+}
+
+// src/services/qa-workbook.ts
+var GUIDE2 = [
+  ["Bagian", "Cara mengisi"],
+  ["Mulai di sini", "Isi Ringkasan, lalu Test case dan Temuan. Hapus atau ganti baris contoh. Sheet Panduan tidak diimpor."],
+  ["Ringkasan", "Judul wajib. Kolom lain boleh kosong. Status: draft, submitted, closed. Keputusan: go (siap), no-go (belum siap), conditional (siap dengan catatan); wajib untuk submitted/closed."],
+  ["Test case", "Satu baris = satu pengujian. Status: belum, lulus, gagal, terblokir, dilewati (atau todo, pass, fail, blocked, skipped). Langkah: satu per baris di dalam sel (Alt+Enter)."],
+  ["Temuan", "Satu baris = satu masalah. Severity: blocker (tidak bisa dipakai), critical (kritis), major (fitur terganggu), minor (gangguan kecil), trivial (tampilan). Prioritas: P0 segera, P1 tinggi, P2 normal, P3 rendah."],
+  ["Lampiran", "Satu baris = satu berkas. Pemilik: Laporan, TC-01, atau F-01 sesuai Kode. Berkas: nama screenshot/log yang dipilih bersama Excel, atau attachments/nama.png dalam ZIP. Maks 10 MB/berkas, 30 berkas dan 100 MB/laporan."],
+  ["Impor dengan lampiran", "Pilih Excel dan berkas lampiran bersama-sama di dashboard, atau ZIP berisi report.xlsx dan folder attachments/. Gambar yang hanya ditempel di sel Excel tidak diimpor; sertakan berkas gambarnya."],
+  ["Ref", "Biarkan Ref laporan/test case/temuan hasil ekspor untuk memperbarui laporan asal. Kosongkan untuk entri baru. Kode harus unik; Test case pada Temuan merujuk Kode TC yang ada."],
+  ["Lingkungan", "Satu per baris: os=Windows 11, browser=Chrome, device=Laptop, url=https://\u2026 ."]
+];
+function writeQaWorkbook(d, paths2 = {}) {
+  const owner = (type, id2) => type === "report" ? "Laporan" : type === "case" ? d.cases.find((c) => c.id === id2)?.code ?? "" : d.findings.find((f) => f.id === id2)?.code ?? "";
+  return writeXlsx([
+    { name: "Panduan", rows: GUIDE2, widths: [24, 100] },
+    { name: "Ringkasan", widths: [24, 80], dropdowns: [{ range: "B7", values: QA_REPORT_STATUSES }, { range: "B8", values: QA_VERDICTS }], rows: [
+      ["Kolom", "Nilai"],
+      ["Judul", d.title],
+      ["Build / versi", d.buildVersion],
+      ["Penguji", d.tester],
+      ["Cakupan", d.scope],
+      ["Ringkasan", d.summary],
+      ["Status", d.status],
+      ["Keputusan", d.verdict ?? ""],
+      ["Lingkungan", Object.entries(d.environment).map(([k, v]) => `${k}=${v}`).join("\n")],
+      ["Ref", d.id]
+    ] },
+    { name: "Test case", dropdowns: [{ range: "F2:F5000", values: ["belum", "lulus", "gagal", "terblokir", "dilewati", "todo", "pass", "fail", "blocked", "skipped"] }], widths: [12, 34, 40, 32, 32, 14, 28], rows: [
+      ["Kode", "Judul", "Langkah", "Diharapkan", "Aktual", "Status", "Ref"],
+      ...d.cases.map((c) => [c.code, c.title, c.steps, c.expected, c.actual, c.status, c.id])
+    ] },
+    { name: "Temuan", dropdowns: [{ range: "C2:C5000", values: QA_SEVERITIES }, { range: "D2:D5000", values: QA_PRIORITIES }, { range: "E2:E5000", values: QA_FINDING_STATUSES }], widths: [12, 34, 14, 12, 14, 20, 14, 40, 32, 32, 14, 16, 28, 28], rows: [
+      ["Kode", "Judul", "Severity", "Prioritas", "Status", "Area", "Test case", "Langkah", "Expected", "Actual", "Backlog", "Stage backlog", "Lampiran", "Ref"],
+      ...d.findings.map((f) => [f.code, f.title, f.severity, f.priority, f.status, f.area, f.caseCode ?? "", f.steps.join("\n"), f.expected, f.actual, f.backlogId ?? "", f.spec?.stage ?? "", d.attachments.filter((a) => a.ownerType === "finding" && a.ownerId === f.id).map((a) => a.filename).join(", "), f.id])
+    ] },
+    { name: "Lampiran", widths: [20, 70], rows: [
+      ["Pemilik", "Berkas"],
+      ...d.attachments.map((a) => [owner(a.ownerType, a.ownerId), paths2[a.id] ?? a.filename])
+    ] }
+  ]);
+}
+function qaTemplateWorkbook() {
+  const p3 = parseQaMarkdown(qaTemplateMarkdown());
+  const at = (/* @__PURE__ */ new Date(0)).toISOString();
+  return writeQaWorkbook({
+    ...p3,
+    id: "",
+    projectId: "",
+    code: "QA-001",
+    createdAt: at,
+    updatedAt: at,
+    cases: p3.cases.map((c, i) => ({ ...c, id: "", reportId: "", order: i + 1, createdAt: at, updatedAt: at })),
+    findings: p3.findings.map((f) => ({ ...f, id: "", reportId: "", backlogId: null, spec: null, createdAt: at, updatedAt: at })),
+    attachments: [],
+    stats: qaStats(p3.cases, p3.findings)
+  });
+}
+var norm3 = (s2) => s2.trim().toLowerCase();
+function fail3(sheet, row, message) {
+  throw new XlsxError(`${sheet}, baris ${row}: ${message}`);
+}
+var choice = (s2, allowed, sheet, row) => {
+  const v = allowed.find((a) => norm3(a) === norm3(s2));
+  return v ?? fail3(sheet, row, `nilai "${s2}" tidak dikenal; pilih ${allowed.join(", ")}`);
+};
+function parseQaWorkbook(buf) {
+  const read2 = (sheet) => readXlsx(buf, { sheet, required: true });
+  const summary = read2("Ringkasan");
+  if (norm3(summary[0]?.[0] ?? "") !== "kolom" || norm3(summary[0]?.[1] ?? "") !== "nilai") fail3("Ringkasan", 1, "butuh kolom Kolom dan Nilai");
+  const fields = new Map(summary.slice(1).map((r) => [norm3(r[0] ?? ""), r[1] ?? ""]));
+  const val = (k) => fields.get(norm3(k)) ?? "";
+  const rowOf = (k) => Math.max(1, summary.findIndex((r) => norm3(r[0] ?? "") === norm3(k)) + 1);
+  if (!val("Judul").trim()) fail3("Ringkasan", rowOf("Judul"), "Judul wajib diisi");
+  const environment = /* @__PURE__ */ Object.create(null);
+  for (const line of val("Lingkungan").split("\n").filter((l) => l.trim())) {
+    const match = /^\s*([^=:]+)[=:]\s*(.*)$/.exec(line);
+    if (!match) fail3("Ringkasan", rowOf("Lingkungan"), "Lingkungan: gunakan kunci=nilai, satu per baris");
+    environment[match[1].trim()] = match[2];
+  }
+  const base3 = zCreateQaReport.safeParse({
+    title: val("Judul"),
+    buildVersion: val("Build / versi"),
+    tester: val("Penguji"),
+    scope: val("Cakupan"),
+    summary: val("Ringkasan"),
+    environment,
+    verdict: val("Keputusan") ? choice(val("Keputusan"), QA_VERDICTS, "Ringkasan", rowOf("Keputusan")) : null
+  });
+  if (!base3.success) fail3("Ringkasan", 1, base3.error.issues.map((e) => `${e.path.join(".")}: ${e.message}`).join("; "));
+  const parsed = {
+    ...base3.data,
+    reportId: val("Ref") || null,
+    status: choice(val("Status") || "draft", QA_REPORT_STATUSES, "Ringkasan", rowOf("Status")),
+    cases: [],
+    findings: [],
+    attachments: []
+  };
+  let cases;
+  try {
+    cases = parseCaseRows(read2("Test case"));
+  } catch (e) {
+    if (e instanceof QaTableError) throw new XlsxError(`Test case, ${e.message}`);
+    throw e;
+  }
+  const codes = /* @__PURE__ */ new Set();
+  const refs2 = /* @__PURE__ */ new Set();
+  for (const [i, c] of cases.entries()) {
+    const code = c.code || `TC-${String(i + 1).padStart(2, "0")}`;
+    if (!/^TC-\d+$/.test(code) || codes.has(code)) fail3("Test case", c.row, "Kode harus unik dan berformat TC-01");
+    if (c.ref && refs2.has(c.ref)) fail3("Test case", c.row, "Ref berulang");
+    codes.add(code);
+    if (c.ref) refs2.add(c.ref);
+    const result = zCreateQaCase.safeParse({ title: c.title, steps: c.steps ?? "", expected: c.expected ?? "", actual: c.actual ?? "", status: c.status ?? "todo" });
+    if (!result.success) fail3("Test case", c.row, result.error.issues.map((e) => `${e.path}: ${e.message}`).join("; "));
+    parsed.cases.push({ ...result.data, id: c.ref, code, attachments: [] });
+  }
+  const rows = read2("Temuan");
+  const headers = rows[0]?.map(norm3) ?? [];
+  for (const h2 of ["judul", "severity", "prioritas", "langkah", "expected", "actual"]) if (!headers.includes(h2)) fail3("Temuan", 1, `kolom ${h2} wajib ada`);
+  const findingCodes = /* @__PURE__ */ new Set();
+  const findingRefs = /* @__PURE__ */ new Set();
+  for (let i = 1; i < rows.length; i++) {
+    const r = rows[i];
+    if (r.every((v) => !v.trim())) continue;
+    const get = (k) => r[headers.indexOf(norm3(k))] ?? "";
+    const code = get("Kode") || `F-${String(parsed.findings.length + 1).padStart(2, "0")}`;
+    if (!/^F-\d+$/.test(code) || findingCodes.has(code)) fail3("Temuan", i + 1, "Kode harus unik dan berformat F-01");
+    findingCodes.add(code);
+    const id2 = get("Ref") || null;
+    if (id2 && findingRefs.has(id2)) fail3("Temuan", i + 1, "Ref berulang");
+    if (id2) findingRefs.add(id2);
+    const caseCode = get("Test case").trim() || null;
+    if (caseCode && !codes.has(caseCode)) fail3("Temuan", i + 1, `Test case ${caseCode} tidak ditemukan`);
+    const status2 = choice(get("Status") || "open", QA_FINDING_STATUSES, "Temuan", i + 1);
+    const result = zCreateQaFinding.safeParse({
+      title: get("Judul"),
+      severity: choice(get("Severity") || "major", QA_SEVERITIES, "Temuan", i + 1),
+      priority: choice(get("Prioritas") || "P2", QA_PRIORITIES, "Temuan", i + 1),
+      area: get("Area"),
+      steps: get("Langkah").split("\n").map((s2) => s2.trim().replace(/^\d+[.)]\s+/, "")).filter(Boolean),
+      expected: get("Expected"),
+      actual: get("Actual"),
+      status: status2 === "sent" ? "open" : status2
+    });
+    if (!result.success) fail3("Temuan", i + 1, result.error.issues.map((e) => `${e.path}: ${e.message}`).join("; "));
+    parsed.findings.push({ ...result.data, status: status2, id: id2, code, caseId: null, caseCode, attachments: [] });
+  }
+  const attachments = read2("Lampiran");
+  if (norm3(attachments[0]?.[0] ?? "") !== "pemilik" || norm3(attachments[0]?.[1] ?? "") !== "berkas") fail3("Lampiran", 1, "butuh kolom Pemilik dan Berkas");
+  for (let i = 1; i < attachments.length; i++) {
+    const [owner = "", path = ""] = attachments[i];
+    if (!owner.trim() && !path.trim()) continue;
+    if (!path.trim() || path.includes("\\") || path.startsWith("/") || path.split("/").some((p3) => p3 === ".." || p3 === "." || !p3)) fail3("Lampiran", i + 1, "Berkas harus nama berkas atau path relatif yang aman");
+    const target3 = norm3(owner) === "laporan" ? parsed.attachments : parsed.cases.find((c) => c.code === owner.trim())?.attachments ?? parsed.findings.find((f) => f.code === owner.trim())?.attachments;
+    if (!target3) fail3("Lampiran", i + 1, `Pemilik "${owner}" tidak ditemukan; gunakan Laporan atau Kode TC/F yang ada`);
+    target3.push(path.trim());
+  }
+  return parsed;
+}
+
+// src/services/qa-cases-import.ts
+init_src();
+init_db();
+
 // src/services/qa-transfer.ts
+init_src();
+init_db();
+import { basename as basename10 } from "node:path";
+init_qa_attachment_transfer();
+init_sync_notify();
 var QaImportError = class extends Error {
   constructor(status2, message) {
     super(message);
@@ -79779,23 +80088,31 @@ async function exportReport(projectId, reportId) {
     present.push(a);
   }
   const markdown = renderQaMarkdown({ ...full, attachments: present }, paths2);
-  const zip = writeZip([{ name: "report.md", data: Buffer.from(markdown, "utf8"), deflate: true }, ...files]);
+  const zip = writeZip([{ name: "report.xlsx", data: writeQaWorkbook({ ...full, attachments: present }, paths2), deflate: true }, { name: "report.md", data: Buffer.from(markdown, "utf8"), deflate: true }, ...files]);
   return { code: full.code, markdown, zip };
 }
-async function importReport(projectId, file) {
+async function importReport(projectId, file, companions = []) {
   if (!await prisma.project.findUnique({ where: { id: projectId }, select: { id: true } }))
     throw new QaImportError(404, "project tak ditemukan");
-  let markdown;
+  let markdown = "";
+  let workbook;
   let assets = /* @__PURE__ */ new Map();
   let dir2 = "";
   const isZip2 = file.buf.length >= 4 && file.buf.readUInt32LE(0) === 67324752;
-  if (isZip2) {
+  if (/\.xlsx$/i.test(file.name)) {
+    workbook = file.buf;
+  } else if (isZip2) {
     try {
       const entries3 = readZip(file.buf);
+      const xlsxNames = [...entries3.keys()].filter((k) => /\.xlsx$/i.test(k) && !/(^|\/)attachments\//.test(k));
+      if (xlsxNames.length > 1) throw new QaImportError(400, "ZIP harus memuat satu laporan Excel saja");
+      const xlsxName = xlsxNames[0];
       const mdName = [...entries3.keys()].find((k) => /(^|\/)report\.md$/i.test(k)) ?? [...entries3.keys()].find((k) => /\.md$/i.test(k) && !/(^|\/)attachments\//.test(k));
-      if (!mdName) throw new QaImportError(400, "ZIP tak memuat report.md");
-      markdown = entries3.get(mdName).toString("utf8");
-      dir2 = mdName.includes("/") ? mdName.slice(0, mdName.lastIndexOf("/") + 1) : "";
+      if (!mdName && !xlsxName) throw new QaImportError(400, "ZIP tak memuat report.xlsx atau report.md");
+      const reportName = xlsxName ?? mdName;
+      if (xlsxName) workbook = entries3.get(xlsxName);
+      else markdown = entries3.get(mdName).toString("utf8");
+      dir2 = reportName.includes("/") ? reportName.slice(0, reportName.lastIndexOf("/") + 1) : "";
       assets = entries3;
     } catch (e) {
       if (e instanceof ZipError) throw new QaImportError(400, `ZIP tak valid: ${e.message}`);
@@ -79805,10 +80122,14 @@ async function importReport(projectId, file) {
     markdown = file.buf.toString("utf8");
   }
   let parsed;
+  for (const c of companions) {
+    if (assets.has(c.name)) throw new QaImportError(400, `nama lampiran berulang: ${c.name}`);
+    assets.set(c.name, c.buf);
+  }
   try {
-    parsed = parseQaMarkdown(markdown);
+    parsed = workbook ? parseQaWorkbook(workbook) : parseQaMarkdown(markdown);
   } catch (e) {
-    if (e instanceof QaMarkdownError) throw new QaImportError(400, e.message);
+    if (e instanceof QaMarkdownError || e instanceof XlsxError) throw new QaImportError(400, e.message);
     throw e;
   }
   if ((parsed.status === "submitted" || parsed.status === "closed") && !parsed.verdict)
@@ -79872,13 +80193,13 @@ async function importReport(projectId, file) {
   for (const o of owners) {
     const uploads = [];
     for (const path of o.paths) {
-      const buf = assets.get(dir2 + path);
       const name2 = originalName(path);
+      if (have.some((h2) => h2.ownerType === o.ownerType && h2.ownerId === o.ownerId && h2.filename === name2)) continue;
+      const buf = assets.get(dir2 + path) ?? assets.get(path);
       if (!buf) {
         rejected.push({ filename: name2, reason: "missing" });
         continue;
       }
-      if (have.some((h2) => h2.ownerType === o.ownerType && h2.ownerId === o.ownerId && h2.filename === name2)) continue;
       const mime = MIME_BY_EXT[name2.split(".").pop()?.toLowerCase() ?? ""];
       if (!mime) {
         rejected.push({ filename: name2, reason: "type" });
@@ -79891,6 +80212,8 @@ async function importReport(projectId, file) {
     saved += r.saved.length;
     rejected.push(...r.rejected);
   }
+  const referenced = new Set(owners.flatMap((o) => o.paths));
+  for (const c of companions) if (!referenced.has(c.name)) rejected.push({ filename: c.name, reason: "Tidak tercantum pada sheet Lampiran atau tautan lampiran laporan" });
   return {
     reportId: out4.id,
     created: !existing,
@@ -79902,149 +80225,6 @@ async function importReport(projectId, file) {
 
 // src/services/qa-cases-import.ts
 init_sync_notify();
-
-// src/services/ooxml.ts
-var xmlEsc = (s2) => s2.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
-var xmlClean = (s2) => s2.replace(/[\u0000-\u0008\u000B\u000C\u000E-\u001F￾￿]/g, "");
-var XML_HEAD = '<?xml version="1.0" encoding="UTF-8" standalone="yes"?>\n';
-
-// src/services/xlsx.ts
-var XlsxError = class extends Error {
-};
-var MAX_ROWS = 5e3;
-var MAX_COLS = 60;
-var MAX_CELL = 32767;
-var esc2 = xmlEsc;
-var clean2 = (s2) => xmlClean(s2).slice(0, MAX_CELL);
-var colLetter = (i) => {
-  let s2 = "";
-  for (let n2 = i + 1; n2 > 0; n2 = Math.floor((n2 - 1) / 26)) s2 = String.fromCharCode(65 + (n2 - 1) % 26) + s2;
-  return s2;
-};
-var colIndex = (letters) => [...letters].reduce((n2, c) => n2 * 26 + (c.charCodeAt(0) - 64), 0) - 1;
-var sheetName = (n2, i) => n2.replace(/[[\]:*?/\\]/g, "_").trim().slice(0, 31) || `Sheet${i + 1}`;
-var NS = "http://schemas.openxmlformats.org/spreadsheetml/2006/main";
-var NS_R = "http://schemas.openxmlformats.org/officeDocument/2006/relationships";
-var HEAD = XML_HEAD;
-function writeXlsx(sheets) {
-  const parts = [];
-  const add = (name2, body) => parts.push({ name: name2, data: Buffer.from(HEAD + body, "utf8"), deflate: true });
-  add(
-    "[Content_Types].xml",
-    '<Types xmlns="http://schemas.openxmlformats.org/package/2006/content-types"><Default Extension="rels" ContentType="application/vnd.openxmlformats-package.relationships+xml"/><Default Extension="xml" ContentType="application/xml"/><Override PartName="/xl/workbook.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.sheet.main+xml"/><Override PartName="/xl/styles.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.styles+xml"/>' + sheets.map((_, i) => `<Override PartName="/xl/worksheets/sheet${i + 1}.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.worksheet+xml"/>`).join("") + "</Types>"
-  );
-  add(
-    "_rels/.rels",
-    '<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument" Target="xl/workbook.xml"/></Relationships>'
-  );
-  add(
-    "xl/workbook.xml",
-    `<workbook xmlns="${NS}" xmlns:r="${NS_R}"><sheets>` + sheets.map((s2, i) => `<sheet name="${esc2(sheetName(s2.name, i))}" sheetId="${i + 1}" r:id="rId${i + 1}"/>`).join("") + "</sheets></workbook>"
-  );
-  add(
-    "xl/_rels/workbook.xml.rels",
-    '<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships">' + sheets.map((_, i) => `<Relationship Id="rId${i + 1}" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/worksheet" Target="worksheets/sheet${i + 1}.xml"/>`).join("") + `<Relationship Id="rId${sheets.length + 1}" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/styles" Target="styles.xml"/></Relationships>`
-  );
-  add(
-    "xl/styles.xml",
-    `<styleSheet xmlns="${NS}"><fonts count="2"><font><sz val="11"/><name val="Calibri"/></font><font><b/><sz val="11"/><name val="Calibri"/></font></fonts><fills count="3"><fill><patternFill patternType="none"/></fill><fill><patternFill patternType="gray125"/></fill><fill><patternFill patternType="solid"><fgColor rgb="FFF1E6CC"/><bgColor indexed="64"/></patternFill></fill></fills><borders count="1"><border><left/><right/><top/><bottom/><diagonal/></border></borders><cellStyleXfs count="1"><xf numFmtId="0" fontId="0" fillId="0" borderId="0"/></cellStyleXfs><cellXfs count="3"><xf numFmtId="0" fontId="0" fillId="0" borderId="0" xfId="0"/><xf numFmtId="0" fontId="1" fillId="2" borderId="0" xfId="0" applyFont="1" applyFill="1" applyAlignment="1"><alignment vertical="top" wrapText="1"/></xf><xf numFmtId="0" fontId="0" fillId="0" borderId="0" xfId="0" applyAlignment="1"><alignment vertical="top" wrapText="1"/></xf></cellXfs><cellStyles count="1"><cellStyle name="Normal" xfId="0" builtinId="0"/></cellStyles></styleSheet>`
-  );
-  sheets.forEach((s2, si) => {
-    const cols = s2.widths?.length ? `<cols>${s2.widths.map((w, i) => `<col min="${i + 1}" max="${i + 1}" width="${w}" customWidth="1"/>`).join("")}</cols>` : "";
-    const data = s2.rows.map((r, ri) => {
-      const cells = r.map((v, ci) => {
-        const t = clean2(v);
-        return t === "" ? "" : `<c r="${colLetter(ci)}${ri + 1}" s="${ri === 0 ? 1 : 2}" t="inlineStr"><is><t xml:space="preserve">${esc2(t)}</t></is></c>`;
-      }).join("");
-      return `<row r="${ri + 1}">${cells}</row>`;
-    }).join("");
-    add(
-      `xl/worksheets/sheet${si + 1}.xml`,
-      `<worksheet xmlns="${NS}"><sheetViews><sheetView workbookViewId="0"><pane ySplit="1" topLeftCell="A2" activePane="bottomLeft" state="frozen"/></sheetView></sheetViews><sheetFormatPr defaultRowHeight="15"/>${cols}<sheetData>${data}</sheetData></worksheet>`
-    );
-  });
-  return writeZip(parts);
-}
-function unesc2(s2) {
-  return s2.replace(/&(#x[0-9a-fA-F]+|#\d+|lt|gt|amp|quot|apos);/g, (_, e) => {
-    if (e === "lt") return "<";
-    if (e === "gt") return ">";
-    if (e === "amp") return "&";
-    if (e === "quot") return '"';
-    if (e === "apos") return "'";
-    const cp = e[1] === "x" ? parseInt(e.slice(2), 16) : parseInt(e.slice(1), 10);
-    return Number.isFinite(cp) && cp > 0 && cp <= 1114111 ? String.fromCodePoint(cp) : "";
-  });
-}
-var attrs = (s2) => {
-  const out4 = {};
-  for (const m of s2.matchAll(/([\w:.-]+)\s*=\s*"([^"]*)"/g)) out4[m[1]] = unesc2(m[2]);
-  return out4;
-};
-var textOf = (xmlFragment) => [...xmlFragment.replace(/<rPh\b[\s\S]*?<\/rPh>/g, "").matchAll(/<t\b[^>]*>([\s\S]*?)<\/t>/g)].map((m) => unesc2(m[1])).join("");
-function readXlsx(buf, opts2 = {}) {
-  let files;
-  try {
-    files = readZip(buf, { maxEntries: 100, maxTotalBytes: 40 * 1024 * 1024 });
-  } catch (e) {
-    if (e instanceof ZipError) throw new XlsxError(`bukan berkas XLSX yang valid: ${e.message}`);
-    throw e;
-  }
-  const text2 = (name2) => files.get(name2)?.toString("utf8");
-  let target3 = "xl/worksheets/sheet1.xml";
-  const wb = text2("xl/workbook.xml");
-  const rels = text2("xl/_rels/workbook.xml.rels");
-  if (wb && rels) {
-    const all = [...wb.matchAll(/<sheet\b([^>]*)>/g)].map((m) => attrs(m[1]));
-    const want = opts2.sheet?.trim().toLowerCase();
-    const chosen = (want ? all.find((a) => (a.name ?? "").trim().toLowerCase() === want) : void 0) ?? all[0];
-    const rid = chosen?.["r:id"];
-    for (const m of rels.matchAll(/<Relationship\b([^>]*)>/g)) {
-      const a = attrs(m[1]);
-      if (rid && a.Id === rid && a.Target) {
-        target3 = a.Target.startsWith("/") ? a.Target.slice(1) : `xl/${a.Target}`;
-        break;
-      }
-    }
-  }
-  const sheet = text2(target3);
-  if (sheet === void 0) throw new XlsxError("lembar (worksheet) tak ditemukan di XLSX");
-  const shared = [];
-  const sst = text2("xl/sharedStrings.xml");
-  if (sst) for (const m of sst.matchAll(/<si\b[^>]*>([\s\S]*?)<\/si>/g)) shared.push(textOf(m[1]));
-  const rows = [];
-  let rowSeq = 0;
-  for (const rm9 of sheet.matchAll(/<row\b([^>]*?)(?:\/>|>([\s\S]*?)<\/row>)/g)) {
-    rowSeq++;
-    const rn = Number(attrs(rm9[1]).r) || rowSeq;
-    if (rn > MAX_ROWS) throw new XlsxError(`terlalu banyak baris (maks ${MAX_ROWS})`);
-    const row = rows[rn - 1] ?? [];
-    let colSeq = -1;
-    for (const cm of (rm9[2] ?? "").matchAll(/<c\b([^>]*?)(?:\/>|>([\s\S]*?)<\/c>)/g)) {
-      const a = attrs(cm[1]);
-      const ref = /^([A-Z]+)\d+$/.exec(a.r ?? "");
-      const ci = ref ? colIndex(ref[1]) : colSeq + 1;
-      colSeq = ci;
-      if (ci >= MAX_COLS) throw new XlsxError(`terlalu banyak kolom (maks ${MAX_COLS})`);
-      const inner = cm[2] ?? "";
-      const v = /<v\b[^>]*>([\s\S]*?)<\/v>/.exec(inner)?.[1];
-      let val = "";
-      if (a.t === "s") val = shared[Number(v)] ?? "";
-      else if (a.t === "inlineStr") val = textOf(inner);
-      else if (a.t === "str") val = v === void 0 ? "" : unesc2(v);
-      else if (a.t === "b") val = v === "1" ? "TRUE" : "FALSE";
-      else if (a.t === "e") val = "";
-      else val = v === void 0 ? "" : unesc2(v);
-      while (row.length < ci) row.push("");
-      row[ci] = val;
-    }
-    while (rows.length < rn - 1) rows.push([]);
-    rows[rn - 1] = row;
-  }
-  return rows;
-}
-
-// src/services/qa-cases-import.ts
 var isZip = (b) => b.length >= 4 && b.readUInt32LE(0) === 67324752;
 async function importCases(projectId, reportId, file) {
   const report = await prisma.qaReport.findFirst({ where: { id: reportId, projectId }, select: { id: true, status: true } });
@@ -80400,44 +80580,6 @@ var OFFICE_MIME = {
   docx: "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
   xlsx: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"
 };
-var sheetSummary = (d) => {
-  const s2 = d.stats;
-  return [
-    ["Kolom", "Nilai"],
-    ["Kode", d.code],
-    ["Judul", d.title],
-    ["Build / versi", d.buildVersion],
-    ["Penguji", d.tester],
-    ["Status", d.status],
-    ["Keputusan", d.verdict ?? "belum diputuskan"],
-    ["Cakupan", d.scope],
-    ["Lingkungan", Object.entries(d.environment).map(([k, v]) => `${k}: ${v}`).join("\n")],
-    ["Ringkasan", d.summary],
-    ["Test case", `${s2.cases.total} \xB7 pass ${s2.cases.pass} \xB7 fail ${s2.cases.fail} \xB7 blocked ${s2.cases.blocked} \xB7 skipped ${s2.cases.skipped} \xB7 todo ${s2.cases.todo} \xB7 pass rate ${s2.passRate === null ? "-" : `${Math.round(s2.passRate * 100)}%`}`],
-    ["Temuan", `${s2.findings.total} \xB7 blocker ${s2.findings.blocker} \xB7 critical ${s2.findings.critical} \xB7 major ${s2.findings.major} \xB7 minor ${s2.findings.minor} \xB7 trivial ${s2.findings.trivial} \xB7 open ${s2.findings.open}`],
-    ["Dibuat", d.createdAt],
-    ["Diubah", d.updatedAt]
-  ];
-};
-var sheetFindings = (d) => [
-  ["Kode", "Judul", "Severity", "Prioritas", "Status", "Area", "Test case", "Langkah", "Expected", "Actual", "Backlog", "Stage backlog", "Lampiran", "Ref"],
-  ...d.findings.map((f) => [
-    f.code,
-    f.title,
-    f.severity,
-    f.priority,
-    f.status,
-    f.area,
-    f.caseCode ?? "",
-    f.steps.map((t, i) => `${i + 1}. ${t}`).join("\n"),
-    f.expected,
-    f.actual,
-    f.backlogId ?? "",
-    f.spec?.stage ?? "",
-    d.attachments.filter((a) => a.ownerType === "finding" && a.ownerId === f.id).map((a) => a.filename).join(", "),
-    f.id
-  ])
-];
 async function renderExport(projectId, reportId, format) {
   const d = await reportDetail(projectId, reportId);
   if (!d) return null;
@@ -80451,11 +80593,7 @@ async function renderExport(projectId, reportId, format) {
       return { filename: `${d.code}.pdf`, mime: "application/pdf", body: await writeQaPdf(d, images) };
     }
     case "xlsx":
-      return { filename: `${d.code}.xlsx`, mime: OFFICE_MIME.xlsx, body: writeXlsx([
-        { name: "Ringkasan", rows: sheetSummary(d), widths: [18, 80] },
-        { name: "Test case", rows: casesToRows(d.cases), widths: [10, 34, 40, 32, 32, 11, 28] },
-        { name: "Temuan", rows: sheetFindings(d), widths: [8, 34, 11, 10, 9, 14, 10, 40, 30, 30, 11, 14, 28, 28] }
-      ]) };
+      return { filename: `${d.code}.xlsx`, mime: OFFICE_MIME.xlsx, body: writeQaWorkbook(d) };
     case "csv":
       return { filename: `${d.code}-testcase.csv`, mime: "text/csv; charset=utf-8", body: csvEncode(casesToRows(d.cases)) };
   }
@@ -80464,6 +80602,11 @@ async function renderExport(projectId, reportId, format) {
 // src/routes/qa-transfer.ts
 var IMPORT_MAX = QA_ATTACHMENT_LIMITS.reportBytes + 5 * 1024 * 1024;
 async function qaTransfer(app3) {
+  app3.get("/qa/template.xlsx", async (_req, reply) => {
+    reply.header("content-type", "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet");
+    reply.header("content-disposition", 'attachment; filename="qa-template.xlsx"');
+    return reply.send(qaTemplateWorkbook());
+  });
   app3.get("/qa/template.md", async (_req, reply) => {
     reply.header("content-type", "text/markdown; charset=utf-8");
     reply.header("content-disposition", 'attachment; filename="qa-template.md"');
@@ -80496,19 +80639,26 @@ async function qaTransfer(app3) {
     const { pid } = req.params;
     if (!req.isMultipart?.()) return reply.code(400).send({ error: "butuh multipart/form-data" });
     let file = null;
+    const companions = [];
+    let totalBytes = 0;
     try {
-      for await (const part of req.parts({ limits: { fileSize: IMPORT_MAX, files: 1 } })) {
-        if (part.type !== "file" || file) continue;
+      for await (const part of req.parts({ limits: { fileSize: IMPORT_MAX, files: 31 } })) {
+        if (part.type !== "file") continue;
         const buf = await part.toBuffer();
         if (part.file?.truncated) return reply.code(413).send({ error: "berkas terlalu besar" });
-        file = { name: String(part.filename ?? "import"), buf };
+        totalBytes += buf.length;
+        if (totalBytes > IMPORT_MAX) return reply.code(413).send({ error: "total unggahan terlalu besar (maks 105 MB)" });
+        const upload = { name: String(part.filename ?? "import"), buf };
+        if (part.fieldname === "attachments") companions.push(upload);
+        else if (file) return reply.code(400).send({ error: "pilih satu laporan Excel, ZIP, atau Markdown" });
+        else file = upload;
       }
     } catch {
       return reply.code(400).send({ error: "unggahan tak valid" });
     }
     if (!file || file.buf.length === 0) return reply.code(400).send({ error: "tak ada berkas" });
     try {
-      const r = await importReport(pid, file);
+      const r = await importReport(pid, file, companions);
       return reply.code(r.created ? 201 : 200).send(r);
     } catch (e) {
       if (e instanceof QaImportError) return reply.code(e.status).send({ error: e.message });
@@ -80748,7 +80898,7 @@ async function resolveGithubRepo(projectId) {
 init_config2();
 import { execFile as execFile18 } from "node:child_process";
 var labelNames = (l) => (l ?? []).map((x) => typeof x === "string" ? x : x.name ?? "").filter(Boolean);
-var norm3 = (s2) => s2.toLowerCase() === "closed" ? "closed" : "open";
+var norm4 = (s2) => s2.toLowerCase() === "closed" ? "closed" : "open";
 function issueFromGh(raw) {
   return {
     number: raw.number,
@@ -80757,7 +80907,7 @@ function issueFromGh(raw) {
     authorLogin: raw.author?.login ?? "",
     labels: labelNames(raw.labels),
     url: raw.url,
-    issueState: norm3(raw.state),
+    issueState: norm4(raw.state),
     issueCreatedAt: raw.createdAt,
     issueUpdatedAt: raw.updatedAt
   };
@@ -80777,7 +80927,7 @@ function issuesFromRest(raw) {
       authorLogin: r.user?.login ?? "",
       labels: labelNames(r.labels),
       url: r.html_url,
-      issueState: norm3(r.state),
+      issueState: norm4(r.state),
       issueCreatedAt: r.created_at,
       issueUpdatedAt: r.updated_at
     });
@@ -81443,13 +81593,13 @@ init_ssrf();
 init_safe_outbound_request();
 async function sendOnce(o, deps = {}) {
   const started2 = Date.now();
-  const fail3 = (error, httpStatus = null, gone = false) => ({ ok: false, httpStatus, durationMs: Date.now() - started2, error, gone });
+  const fail4 = (error, httpStatus = null, gone = false) => ({ ok: false, httpStatus, durationMs: Date.now() - started2, error, gone });
   const parsed = validateWebhookUrl(o.endpoint.url);
-  if (!parsed.ok) return fail3(`URL tak sah: ${parsed.error}`);
+  if (!parsed.ok) return fail4(`URL tak sah: ${parsed.error}`);
   const guard = await checkDestination(parsed.url, o.endpoint.allowPrivate, deps.lookup);
-  if (!guard.ok) return fail3(guard.error);
+  if (!guard.ok) return fail4(guard.error);
   const secret = secretOf(o.endpoint);
-  if (!secret) return fail3("secret tak bisa dibuka \u2014 rotasi secret endpoint ini");
+  if (!secret) return fail4("secret tak bisa dibuka \u2014 rotasi secret endpoint ini");
   const headers = signedHeaders({
     secret,
     body: o.body,
@@ -81492,7 +81642,7 @@ async function sendOnce(o, deps = {}) {
     return { ok: false, httpStatus: res.status, durationMs, error: `HTTP ${res.status}`, gone: false };
   } catch (e) {
     const msg = e.name === "AbortError" ? `timeout ${WEBHOOK_TIMEOUT_MS} ms` : e.message;
-    return fail3(msg);
+    return fail4(msg);
   } finally {
     clearTimeout(timer10);
   }