🎉 init: 小龙的工作空间

.benchmark/ticket/fullstack/apps/api/.gitignore

@@ -0,0 +1,7 @@
+node_modules/
+dist/
+data/
+.env
+*.db
+*.db-journal
+*.db-wal

.benchmark/ticket/fullstack/apps/api/README.md

@@ -0,0 +1,104 @@
+# OAFlow — Backend API
+
+> 一款支持审批流、考勤管理、部门协作的企业办公自动化系统。
+
+## Tech Stack
+
+- **Runtime**: Node.js
+- **Framework**: Fastify 5
+- **Language**: TypeScript
+- **Database**: SQLite (better-sqlite3)
+- **Auth**: JWT + bcrypt
+
+## Getting Started
+
+```bash
+# Install dependencies
+npm install
+
+# Development (hot reload)
+npm run dev
+
+# Build
+npm run build
+
+# Production start
+npm run start
+
+# Run tests
+npm test
+```
+
+## Project Structure
+
+```
+src/
+├── index.ts          # Server entry point
+├── db/
+│   ├── schema.ts     # SQLite schema
+│   └── client.ts     # Database client
+├── routes/
+│   ├── auth.ts       # Auth routes (register/login/me)
+│   └── *.ts          # CRUD routes
+├── services/
+│   └── *.ts          # Business logic
+├── middleware/
+│   └── auth.ts       # JWT middleware
+├── types/
+│   └── index.ts      # TypeScript types
+└── __tests__/
+    └── *.test.ts     # Tests
+```
+
+## API Endpoints
+
+### Auth
+- `POST /api/auth/register` — Register
+- `POST /api/auth/login` — Login
+- `GET  /api/auth/me` — Current user (auth required)
+
+### Resources
+#### contracts
+- `GET    /api/contracts` — List all
+- `GET    /api/contracts/:id` — Get by ID
+- `POST   /api/contracts` — Create
+- `PUT    /api/contracts/:id` — Update
+- `DELETE /api/contracts/:id` — Delete
+
+#### approvals
+- `GET    /api/approvals` — List all
+- `GET    /api/approvals/:id` — Get by ID
+- `POST   /api/approvals` — Create
+- `PUT    /api/approvals/:id` — Update
+- `DELETE /api/approvals/:id` — Delete
+
+#### customers
+- `GET    /api/customers` — List all
+- `GET    /api/customers/:id` — Get by ID
+- `POST   /api/customers` — Create
+- `PUT    /api/customers/:id` — Update
+- `DELETE /api/customers/:id` — Delete
+
+#### reminders
+- `GET    /api/reminders` — List all
+- `GET    /api/reminders/:id` — Get by ID
+- `POST   /api/reminders` — Create
+- `PUT    /api/reminders/:id` — Update
+- `DELETE /api/reminders/:id` — Delete
+
+#### tickets
+- `GET    /api/tickets` — List all
+- `GET    /api/tickets/:id` — Get by ID
+- `POST   /api/tickets` — Create
+- `PUT    /api/tickets/:id` — Update
+- `DELETE /api/tickets/:id` — Delete
+
+#### items
+- `GET    /api/items` — List all
+- `GET    /api/items/:id` — Get by ID
+- `POST   /api/items` — Create
+- `PUT    /api/items/:id` — Update
+- `DELETE /api/items/:id` — Delete
+
+### System
+- `GET /api/health` — Health check

.benchmark/ticket/fullstack/apps/api/package.json

@@ -0,0 +1,29 @@
+{
+  "name": "oaflow-api",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "dev": "tsx watch src/index.ts",
+    "build": "tsc",
+    "start": "node dist/index.js",
+    "test": "node --import tsx --test src/__tests__/*.test.ts",
+    "test:watch": "node --import tsx --test --watch src/__tests__/*.test.ts"
+  },
+  "dependencies": {
+    "fastify": "^5.0.0",
+    "@fastify/cors": "^10.0.0",
+    "@fastify/jwt": "^9.0.0",
+    "sql.js": "^1.12.0",
+    "bcrypt": "^5.1.0",
+    "@shared/types": "*",
+    "@shared/config": "*"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "@types/bcrypt": "^5.0.0",
+    "typescript": "^5.6.0",
+    "tsx": "^4.0.0",
+    "pino-pretty": "^11.0.0"
+  }
+}

.benchmark/ticket/fullstack/apps/api/src/__tests__/approval_steps.test.ts

@@ -0,0 +1,124 @@
+// ApprovalStep CRUD test
+import { describe, it, before, after } from "node:test";
+import assert from "node:assert/strict";
+import { buildApp } from "../index.js";
+import type { FastifyInstance } from "fastify";
+
+let app: FastifyInstance;
+let token: string;
+let createdId: string;
+
+before(async () => {
+  process.env.JWT_SECRET = "test-secret";
+  process.env.DATABASE_URL = ":memory:";
+  app = await buildApp();
+  await app.ready();
+
+  // Register and login to get a token
+  const regRes = await app.inject({
+    method: "POST",
+    url: "/api/auth/register",
+    payload: { username: `test_${Date.now()}`, password: "password123" },
+  });
+  token = regRes.json().token;
+});
+
+after(async () => {
+  await app.close();
+});
+
+describe("GET /api/approval_steps", () => {
+  it("returns empty list", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: "/api/approval_steps",
+      headers: { authorization: `Bearer ${token}` },
+    });
+    assert.equal(res.statusCode, 200);
+    const body = res.json();
+    assert.ok(Array.isArray(body.data));
+  });
+});
+
+describe("POST /api/approval_steps", () => {
+  it("creates a approval_step", async () => {
+    const res = await app.inject({
+      method: "POST",
+      url: "/api/approval_steps",
+      headers: { authorization: `Bearer ${token}` },
+      payload: {
+        "approvalId": "00000000-0000-0000-0000-000000000001",
+        "approverId": "00000000-0000-0000-0000-000000000001",
+        "stepOrder": 1,
+        "status": "sample-status",
+        "comment": "sample-comment",
+        "actedAt": "sample-actedat"
+      },
+    });
+    assert.equal(res.statusCode, 201);
+    const body = res.json();
+    assert.ok(body.data.id);
+    createdId = body.data.id;
+  });
+});
+
+describe("GET /api/approval_steps/:id", () => {
+  it("returns the created approval_step", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: `/api/approval_steps/${createdId}`,
+      headers: { authorization: `Bearer ${token}` },
+    });
+    assert.equal(res.statusCode, 200);
+    const body = res.json();
+    assert.equal(body.data.id, createdId);
+  });
+
+  it("returns 404 for nonexistent id", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: `/api/approval_steps/nonexistent`,
+      headers: { authorization: `Bearer ${token}` },
+    });
+    assert.equal(res.statusCode, 404);
+  });
+});
+
+describe("PUT /api/approval_steps/:id", () => {
+  it("updates the approval_step", async () => {
+    const res = await app.inject({
+      method: "PUT",
+      url: `/api/approval_steps/${createdId}`,
+      headers: { authorization: `Bearer ${token}` },
+      payload: {
+        "approvalId": "00000000-0000-0000-0000-000000000001",
+        "approverId": "00000000-0000-0000-0000-000000000001",
+        "stepOrder": 1,
+        "status": "sample-status",
+        "comment": "sample-comment",
+        "actedAt": "sample-actedat"
+      },
+    });
+    assert.equal(res.statusCode, 200);
+  });
+});
+
+describe("DELETE /api/approval_steps/:id", () => {
+  it("deletes the approval_step", async () => {
+    const res = await app.inject({
+      method: "DELETE",
+      url: `/api/approval_steps/${createdId}`,
+      headers: { authorization: `Bearer ${token}` },
+    });
+    assert.equal(res.statusCode, 204);
+  });
+
+  it("returns 404 after delete", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: `/api/approval_steps/${createdId}`,
+      headers: { authorization: `Bearer ${token}` },
+    });
+    assert.equal(res.statusCode, 404);
+  });
+});

.benchmark/ticket/fullstack/apps/api/src/__tests__/approvals.test.ts

@@ -0,0 +1,121 @@
+// Approval CRUD test
+import { describe, it, before, after } from "node:test";
+import assert from "node:assert/strict";
+import { buildApp } from "../index.js";
+import type { FastifyInstance } from "fastify";
+
+let app: FastifyInstance;
+let token: string;
+let createdId: string;
+let payload: Record<string, unknown>;
+
+before(async () => {
+  process.env.JWT_SECRET = "test-secret";
+  process.env.DATABASE_URL = ":memory:";
+  app = await buildApp();
+  await app.ready();
+
+  // Register and login to get a token
+  const regRes = await app.inject({
+    method: "POST",
+    url: "/api/auth/register",
+    payload: { username: `test_${Date.now()}`, password: "password123" },
+  });
+  token = regRes.json().token;
+
+  // Resolve user FK references with the registered user's real ID
+  payload = {
+          "userId": regRes.json().user.id,
+          "entityType": "sample-entitytype",
+          "entityId": "sample-entityid",
+          "applicantId": regRes.json().user.id,
+          "status": "sample-status",
+          "formData": "sample-formdata"
+      };
+});
+
+after(async () => {
+  await app.close();
+});
+
+describe("GET /api/approvals", () => {
+  it("returns empty list", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: "/api/approvals",
+      headers: { authorization: `Bearer ${token}` },
+    });
+    assert.equal(res.statusCode, 200);
+    const body = res.json();
+    assert.ok(Array.isArray(body.data));
+  });
+});
+
+describe("POST /api/approvals", () => {
+  it("creates a approval", async () => {
+    const res = await app.inject({
+      method: "POST",
+      url: "/api/approvals",
+      headers: { authorization: `Bearer ${token}` },
+      payload,
+    });
+    assert.equal(res.statusCode, 201);
+    const body = res.json();
+    assert.ok(body.data.id);
+    createdId = body.data.id;
+  });
+});
+
+describe("GET /api/approvals/:id", () => {
+  it("returns the created approval", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: `/api/approvals/${createdId}`,
+      headers: { authorization: `Bearer ${token}` },
+    });
+    assert.equal(res.statusCode, 200);
+    const body = res.json();
+    assert.equal(body.data.id, createdId);
+  });
+
+  it("returns 404 for nonexistent id", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: `/api/approvals/nonexistent`,
+      headers: { authorization: `Bearer ${token}` },
+    });
+    assert.equal(res.statusCode, 404);
+  });
+});
+
+describe("PUT /api/approvals/:id", () => {
+  it("updates the approval", async () => {
+    const res = await app.inject({
+      method: "PUT",
+      url: `/api/approvals/${createdId}`,
+      headers: { authorization: `Bearer ${token}` },
+      payload,
+    });
+    assert.equal(res.statusCode, 200);
+  });
+});
+
+describe("DELETE /api/approvals/:id", () => {
+  it("deletes the approval", async () => {
+    const res = await app.inject({
+      method: "DELETE",
+      url: `/api/approvals/${createdId}`,
+      headers: { authorization: `Bearer ${token}` },
+    });
+    assert.equal(res.statusCode, 204);
+  });
+
+  it("returns 404 after delete", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: `/api/approvals/${createdId}`,
+      headers: { authorization: `Bearer ${token}` },
+    });
+    assert.equal(res.statusCode, 404);
+  });
+});

.benchmark/ticket/fullstack/apps/api/src/__tests__/attendance.test.ts

@@ -0,0 +1,124 @@
+// Attendance CRUD test
+import { describe, it, before, after } from "node:test";
+import assert from "node:assert/strict";
+import { buildApp } from "../index.js";
+import type { FastifyInstance } from "fastify";
+
+let app: FastifyInstance;
+let token: string;
+let createdId: string;
+
+before(async () => {
+  process.env.JWT_SECRET = "test-secret";
+  process.env.DATABASE_URL = ":memory:";
+  app = await buildApp();
+  await app.ready();
+
+  // Register and login to get a token
+  const regRes = await app.inject({
+    method: "POST",
+    url: "/api/auth/register",
+    payload: { username: `test_${Date.now()}`, password: "password123" },
+  });
+  token = regRes.json().token;
+});
+
+after(async () => {
+  await app.close();
+});
+
+describe("GET /api/attendance", () => {
+  it("returns empty list", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: "/api/attendance",
+      headers: { authorization: `Bearer ${token}` },
+    });
+    assert.equal(res.statusCode, 200);
+    const body = res.json();
+    assert.ok(Array.isArray(body.data));
+  });
+});
+
+describe("POST /api/attendance", () => {
+  it("creates a attendance", async () => {
+    const res = await app.inject({
+      method: "POST",
+      url: "/api/attendance",
+      headers: { authorization: `Bearer ${token}` },
+      payload: {
+        "userId": "00000000-0000-0000-0000-000000000001",
+        "checkInAt": "sample-checkinat",
+        "checkOutAt": "sample-checkoutat",
+        "location": "sample-location",
+        "type": "sample-type",
+        "UNIQUE(userId, DATE(checkInAt))": "sample-unique(userid, date(checkinat))"
+      },
+    });
+    assert.equal(res.statusCode, 201);
+    const body = res.json();
+    assert.ok(body.data.id);
+    createdId = body.data.id;
+  });
+});
+
+describe("GET /api/attendance/:id", () => {
+  it("returns the created attendance", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: `/api/attendance/${createdId}`,
+      headers: { authorization: `Bearer ${token}` },
+    });
+    assert.equal(res.statusCode, 200);
+    const body = res.json();
+    assert.equal(body.data.id, createdId);
+  });
+
+  it("returns 404 for nonexistent id", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: `/api/attendance/nonexistent`,
+      headers: { authorization: `Bearer ${token}` },
+    });
+    assert.equal(res.statusCode, 404);
+  });
+});
+
+describe("PUT /api/attendance/:id", () => {
+  it("updates the attendance", async () => {
+    const res = await app.inject({
+      method: "PUT",
+      url: `/api/attendance/${createdId}`,
+      headers: { authorization: `Bearer ${token}` },
+      payload: {
+        "userId": "00000000-0000-0000-0000-000000000001",
+        "checkInAt": "sample-checkinat",
+        "checkOutAt": "sample-checkoutat",
+        "location": "sample-location",
+        "type": "sample-type",
+        "UNIQUE(userId, DATE(checkInAt))": "sample-unique(userid, date(checkinat))"
+      },
+    });
+    assert.equal(res.statusCode, 200);
+  });
+});
+
+describe("DELETE /api/attendance/:id", () => {
+  it("deletes the attendance", async () => {
+    const res = await app.inject({
+      method: "DELETE",
+      url: `/api/attendance/${createdId}`,
+      headers: { authorization: `Bearer ${token}` },
+    });
+    assert.equal(res.statusCode, 204);
+  });
+
+  it("returns 404 after delete", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: `/api/attendance/${createdId}`,
+      headers: { authorization: `Bearer ${token}` },
+    });
+    assert.equal(res.statusCode, 404);
+  });
+});

.benchmark/ticket/fullstack/apps/api/src/__tests__/auth.test.ts

@@ -0,0 +1,96 @@
+// Auth routes test
+import { describe, it, before, after } from "node:test";
+import assert from "node:assert/strict";
+import { buildApp } from "../index.js";
+import type { FastifyInstance } from "fastify";
+
+let app: FastifyInstance;
+let token: string;
+
+before(async () => {
+  process.env.JWT_SECRET = "test-secret";
+  process.env.DATABASE_URL = ":memory:";
+  app = await buildApp();
+  await app.ready();
+});
+
+after(async () => {
+  await app.close();
+});
+
+describe("POST /api/auth/register", () => {
+  it("registers a new user", async () => {
+    const res = await app.inject({
+      method: "POST",
+      url: "/api/auth/register",
+      payload: { username: "testuser", password: "password123" },
+    });
+    assert.equal(res.statusCode, 201);
+    const body = res.json();
+    assert.ok(body.token);
+    assert.equal(body.user.username, "testuser");
+    token = body.token;
+  });
+
+  it("rejects duplicate username", async () => {
+    const res = await app.inject({
+      method: "POST",
+      url: "/api/auth/register",
+      payload: { username: "testuser", password: "password123" },
+    });
+    assert.equal(res.statusCode, 409);
+  });
+
+  it("rejects short password", async () => {
+    const res = await app.inject({
+      method: "POST",
+      url: "/api/auth/register",
+      payload: { username: "user2", password: "123" },
+    });
+    assert.equal(res.statusCode, 400);
+  });
+});
+
+describe("POST /api/auth/login", () => {
+  it("logs in with correct credentials", async () => {
+    const res = await app.inject({
+      method: "POST",
+      url: "/api/auth/login",
+      payload: { username: "testuser", password: "password123" },
+    });
+    assert.equal(res.statusCode, 200);
+    const body = res.json();
+    assert.ok(body.token);
+    token = body.token;
+  });
+
+  it("rejects wrong password", async () => {
+    const res = await app.inject({
+      method: "POST",
+      url: "/api/auth/login",
+      payload: { username: "testuser", password: "wrongpassword" },
+    });
+    assert.equal(res.statusCode, 401);
+  });
+});
+
+describe("GET /api/auth/me", () => {
+  it("returns current user with valid token", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: "/api/auth/me",
+      headers: { authorization: `Bearer ${token}` },
+    });
+    assert.equal(res.statusCode, 200);
+    const body = res.json();
+    assert.equal(body.data.username, "testuser");
+  });
+
+  it("rejects without token", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: "/api/auth/me",
+    });
+    assert.equal(res.statusCode, 401);
+  });
+});

.benchmark/ticket/fullstack/apps/api/src/__tests__/departments.test.ts

@@ -0,0 +1,118 @@
+// Department CRUD test
+import { describe, it, before, after } from "node:test";
+import assert from "node:assert/strict";
+import { buildApp } from "../index.js";
+import type { FastifyInstance } from "fastify";
+
+let app: FastifyInstance;
+let token: string;
+let createdId: string;
+
+before(async () => {
+  process.env.JWT_SECRET = "test-secret";
+  process.env.DATABASE_URL = ":memory:";
+  app = await buildApp();
+  await app.ready();
+
+  // Register and login to get a token
+  const regRes = await app.inject({
+    method: "POST",
+    url: "/api/auth/register",
+    payload: { username: `test_${Date.now()}`, password: "password123" },
+  });
+  token = regRes.json().token;
+});
+
+after(async () => {
+  await app.close();
+});
+
+describe("GET /api/departments", () => {
+  it("returns empty list", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: "/api/departments",
+      headers: { authorization: `Bearer ${token}` },
+    });
+    assert.equal(res.statusCode, 200);
+    const body = res.json();
+    assert.ok(Array.isArray(body.data));
+  });
+});
+
+describe("POST /api/departments", () => {
+  it("creates a department", async () => {
+    const res = await app.inject({
+      method: "POST",
+      url: "/api/departments",
+      headers: { authorization: `Bearer ${token}` },
+      payload: {
+        "name": "sample-name",
+        "parentId": "00000000-0000-0000-0000-000000000001",
+        "managerId": "00000000-0000-0000-0000-000000000001"
+      },
+    });
+    assert.equal(res.statusCode, 201);
+    const body = res.json();
+    assert.ok(body.data.id);
+    createdId = body.data.id;
+  });
+});
+
+describe("GET /api/departments/:id", () => {
+  it("returns the created department", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: `/api/departments/${createdId}`,
+      headers: { authorization: `Bearer ${token}` },
+    });
+    assert.equal(res.statusCode, 200);
+    const body = res.json();
+    assert.equal(body.data.id, createdId);
+  });
+
+  it("returns 404 for nonexistent id", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: `/api/departments/nonexistent`,
+      headers: { authorization: `Bearer ${token}` },
+    });
+    assert.equal(res.statusCode, 404);
+  });
+});
+
+describe("PUT /api/departments/:id", () => {
+  it("updates the department", async () => {
+    const res = await app.inject({
+      method: "PUT",
+      url: `/api/departments/${createdId}`,
+      headers: { authorization: `Bearer ${token}` },
+      payload: {
+        "name": "sample-name",
+        "parentId": "00000000-0000-0000-0000-000000000001",
+        "managerId": "00000000-0000-0000-0000-000000000001"
+      },
+    });
+    assert.equal(res.statusCode, 200);
+  });
+});
+
+describe("DELETE /api/departments/:id", () => {
+  it("deletes the department", async () => {
+    const res = await app.inject({
+      method: "DELETE",
+      url: `/api/departments/${createdId}`,
+      headers: { authorization: `Bearer ${token}` },
+    });
+    assert.equal(res.statusCode, 204);
+  });
+
+  it("returns 404 after delete", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: `/api/departments/${createdId}`,
+      headers: { authorization: `Bearer ${token}` },
+    });
+    assert.equal(res.statusCode, 404);
+  });
+});

.benchmark/ticket/fullstack/apps/api/src/__tests__/users.test.ts

@@ -0,0 +1,118 @@
+// User CRUD test
+import { describe, it, before, after } from "node:test";
+import assert from "node:assert/strict";
+import { buildApp } from "../index.js";
+import type { FastifyInstance } from "fastify";
+
+let app: FastifyInstance;
+let token: string;
+let createdId: string;
+
+before(async () => {
+  process.env.JWT_SECRET = "test-secret";
+  process.env.DATABASE_URL = ":memory:";
+  app = await buildApp();
+  await app.ready();
+
+  // Register and login to get a token
+  const regRes = await app.inject({
+    method: "POST",
+    url: "/api/auth/register",
+    payload: { username: `test_${Date.now()}`, password: "password123" },
+  });
+  token = regRes.json().token;
+});
+
+after(async () => {
+  await app.close();
+});
+
+describe("GET /api/users", () => {
+  it("returns empty list", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: "/api/users",
+      headers: { authorization: `Bearer ${token}` },
+    });
+    assert.equal(res.statusCode, 200);
+    const body = res.json();
+    assert.ok(Array.isArray(body.data));
+  });
+});
+
+describe("POST /api/users", () => {
+  it("creates a user", async () => {
+    const res = await app.inject({
+      method: "POST",
+      url: "/api/users",
+      headers: { authorization: `Bearer ${token}` },
+      payload: {
+        "phone": "sample-phone",
+        "nickname": "sample-nickname",
+        "avatarUrl": "sample-avatarurl"
+      },
+    });
+    assert.equal(res.statusCode, 201);
+    const body = res.json();
+    assert.ok(body.data.id);
+    createdId = body.data.id;
+  });
+});
+
+describe("GET /api/users/:id", () => {
+  it("returns the created user", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: `/api/users/${createdId}`,
+      headers: { authorization: `Bearer ${token}` },
+    });
+    assert.equal(res.statusCode, 200);
+    const body = res.json();
+    assert.equal(body.data.id, createdId);
+  });
+
+  it("returns 404 for nonexistent id", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: `/api/users/nonexistent`,
+      headers: { authorization: `Bearer ${token}` },
+    });
+    assert.equal(res.statusCode, 404);
+  });
+});
+
+describe("PUT /api/users/:id", () => {
+  it("updates the user", async () => {
+    const res = await app.inject({
+      method: "PUT",
+      url: `/api/users/${createdId}`,
+      headers: { authorization: `Bearer ${token}` },
+      payload: {
+        "phone": "sample-phone",
+        "nickname": "sample-nickname",
+        "avatarUrl": "sample-avatarurl"
+      },
+    });
+    assert.equal(res.statusCode, 200);
+  });
+});
+
+describe("DELETE /api/users/:id", () => {
+  it("deletes the user", async () => {
+    const res = await app.inject({
+      method: "DELETE",
+      url: `/api/users/${createdId}`,
+      headers: { authorization: `Bearer ${token}` },
+    });
+    assert.equal(res.statusCode, 204);
+  });
+
+  it("returns 404 after delete", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: `/api/users/${createdId}`,
+      headers: { authorization: `Bearer ${token}` },
+    });
+    assert.equal(res.statusCode, 404);
+  });
+});

.benchmark/ticket/fullstack/apps/api/src/db/client.ts

@@ -0,0 +1,93 @@
+// SQLite database client (sql.js — pure WASM, no native deps)
+import initSqlJs, { type Database, type BindParams } from "sql.js";
+import { createTables } from "./schema.js";
+
+let db: Database | null = null;
+let initPromise: Promise<Database> | null = null;
+
+/** Initialize the database (call once at startup). */
+export async function initDb(dbPath?: string): Promise<Database> {
+  if (db) return db;
+  if (initPromise) return initPromise;
+
+  initPromise = (async () => {
+    const SQL = await initSqlJs();
+    const path = dbPath || process.env.DATABASE_URL || ":memory:";
+
+    // Try to load existing database from file
+    let buffer: ArrayLike<number> | undefined;
+    if (path !== ":memory:") {
+      try {
+        const fs = await import("node:fs/promises");
+        const data = await fs.readFile(path);
+        buffer = new Uint8Array(data);
+      } catch {
+        // File doesn't exist yet — start fresh
+      }
+    }
+
+    db = new SQL.Database(buffer);
+    db.run("PRAGMA foreign_keys = ON");
+    createTables(db);
+    return db;
+  })();
+
+  return initPromise;
+}
+
+/** Get the initialized database (must call initDb first). */
+export function getDb(): Database {
+  if (!db) throw new Error("Database not initialized. Call initDb() first.");
+  return db;
+}
+
+/** Save database to disk. */
+export async function saveDb(dbPath?: string): Promise<void> {
+  if (!db) return;
+  const path = dbPath || process.env.DATABASE_URL || "./data/app.db";
+  if (path === ":memory:") return;
+  const fs = await import("node:fs/promises");
+  const { dirname } = await import("node:path");
+  await fs.mkdir(dirname(path), { recursive: true });
+  const data = db.export();
+  await fs.writeFile(path, Buffer.from(data));
+}
+
+export async function closeDb(): Promise<void> {
+  if (db) {
+    await saveDb();
+    db.close();
+    db = null;
+    initPromise = null;
+  }
+}
+
+// Helper: run a query and return all rows as objects
+export function queryAll<T = Record<string, unknown>>(sql: string, params: BindParams = []): T[] {
+  const d = getDb();
+  const stmt = d.prepare(sql);
+  if (params) stmt.bind(params);
+  const results: T[] = [];
+  while (stmt.step()) {
+    const row = stmt.getAsObject();
+    results.push(row as unknown as T);
+  }
+  stmt.free();
+  return results;
+}
+
+// Helper: run a query and return the first row
+export function queryOne<T = Record<string, unknown>>(sql: string, params: BindParams = []): T | undefined {
+  const rows = queryAll<T>(sql, params);
+  return rows[0];
+}
+
+// Helper: run a mutation and return { changes, lastInsertRowid }
+export function execute(sql: string, params: BindParams = []): { changes: number; lastInsertRowid: number } {
+  const d = getDb();
+  d.run(sql, params);
+  return {
+    changes: d.getRowsModified(),
+    lastInsertRowid: 0,
+  };
+}

.benchmark/ticket/fullstack/apps/api/src/db/schema.ts

@@ -0,0 +1,18 @@
+// Auto-generated SQLite schema
+import type { Database } from "sql.js";
+
+export function createTables(db: Database): void {
+  const statements = [
+  "CREATE TABLE IF NOT EXISTS users (\n  id TEXT PRIMARY KEY DEFAULT (lower(hex(randomblob(16)))),\n  username TEXT NOT NULL UNIQUE,\n  password_hash TEXT NOT NULL,\n  nickname TEXT,\n  role TEXT DEFAULT 'user',\n  phone TEXT,\n  avatar_url TEXT,\n  created_at TEXT,\n  updated_at TEXT\n);",
+  "CREATE TABLE IF NOT EXISTS contracts (\n  id TEXT PRIMARY KEY DEFAULT (lower(hex(randomblob(16)))),\n  user_id TEXT NOT NULL REFERENCES users(id),\n  title TEXT NOT NULL,\n  party_a TEXT,\n  party_b TEXT,\n  amount REAL,\n  signed_at TEXT,\n  expires_at TEXT,\n  status TEXT DEFAULT 'draft',\n  file_url TEXT,\n  created_at TEXT,\n  updated_at TEXT\n);",
+  "CREATE TABLE IF NOT EXISTS approvals (\n  id TEXT PRIMARY KEY DEFAULT (lower(hex(randomblob(16)))),\n  user_id TEXT NOT NULL REFERENCES users(id),\n  entity_type TEXT NOT NULL,\n  entity_id TEXT,\n  applicant_id TEXT NOT NULL REFERENCES users(id),\n  status TEXT DEFAULT 'pending',\n  form_data TEXT,\n  created_at TEXT,\n  updated_at TEXT\n);",
+  "CREATE TABLE IF NOT EXISTS customers (\n  id TEXT PRIMARY KEY DEFAULT (lower(hex(randomblob(16)))),\n  user_id TEXT NOT NULL REFERENCES users(id),\n  name TEXT NOT NULL,\n  email TEXT,\n  phone TEXT,\n  company TEXT,\n  source TEXT,\n  tags TEXT DEFAULT '[]',\n  created_at TEXT,\n  updated_at TEXT\n);",
+  "CREATE TABLE IF NOT EXISTS reminders (\n  id TEXT PRIMARY KEY DEFAULT (lower(hex(randomblob(16)))),\n  user_id TEXT NOT NULL REFERENCES users(id),\n  entity_type TEXT NOT NULL,\n  entity_id TEXT,\n  remind_at TEXT NOT NULL,\n  message TEXT,\n  sent INTEGER DEFAULT 'false',\n  created_at TEXT,\n  updated_at TEXT\n);",
+  "CREATE TABLE IF NOT EXISTS tickets (\n  id TEXT PRIMARY KEY DEFAULT (lower(hex(randomblob(16)))),\n  user_id TEXT REFERENCES users(id),\n  title TEXT NOT NULL,\n  description TEXT,\n  priority TEXT,\n  status TEXT,\n  assignee_id TEXT REFERENCES assignees(id),\n  category TEXT,\n  created_at TEXT,\n  updated_at TEXT\n);",
+  "CREATE TABLE IF NOT EXISTS items (\n  id TEXT PRIMARY KEY DEFAULT (lower(hex(randomblob(16)))),\n  user_id TEXT REFERENCES users(id),\n  title TEXT NOT NULL,\n  description TEXT,\n  status TEXT,\n  data TEXT,\n  created_at TEXT,\n  updated_at TEXT\n);"
+  ];
+  for (const sql of statements) {
+    const trimmed = sql.trim();
+    if (trimmed) db.run(trimmed);
+  }
+}

.benchmark/ticket/fullstack/apps/api/src/index.ts

@@ -0,0 +1,75 @@
+// OAFlow — Fastify Backend Server
+import Fastify from "fastify";
+import cors from "@fastify/cors";
+import fjwt from "@fastify/jwt";
+import { initDb, closeDb } from "./db/client.js";
+import { authRoutes } from "./routes/auth.js";
+import { contractsRoutes } from "./routes/contracts.js";
+import { approvalsRoutes } from "./routes/approvals.js";
+import { customersRoutes } from "./routes/customers.js";
+import { remindersRoutes } from "./routes/reminders.js";
+import { ticketsRoutes } from "./routes/tickets.js";
+import { itemsRoutes } from "./routes/items.js";
+
+const JWT_SECRET = process.env.JWT_SECRET || "change-me-in-production-92569c16";
+
+export async function buildApp() {
+  const app = Fastify({
+    logger: {
+      level: process.env.LOG_LEVEL || "info",
+      transport: process.env.NODE_ENV !== "production"
+        ? { target: "pino-pretty", options: { colorize: true } }
+        : undefined,
+    },
+  });
+
+  // Init database
+  await initDb();
+
+  // Plugins
+  await app.register(cors, {
+    origin: process.env.CORS_ORIGIN || "*",
+    methods: ["GET", "POST", "PUT", "DELETE", "PATCH", "OPTIONS"],
+  });
+
+  await app.register(fjwt, { secret: JWT_SECRET });
+
+  // Routes
+  await app.register(authRoutes, { prefix: "/api/auth" });
+  await app.register(contractsRoutes, { prefix: "/api/contracts" });
+  await app.register(approvalsRoutes, { prefix: "/api/approvals" });
+  await app.register(customersRoutes, { prefix: "/api/customers" });
+  await app.register(remindersRoutes, { prefix: "/api/reminders" });
+  await app.register(ticketsRoutes, { prefix: "/api/tickets" });
+  await app.register(itemsRoutes, { prefix: "/api/items" });
+
+  // Health check
+  app.get("/api/health", async () => ({ status: "ok", timestamp: new Date().toISOString() }));
+
+  // Graceful shutdown
+  app.addHook("onClose", async () => {
+    closeDb();
+  });
+
+  return app;
+}
+
+// Start server if called directly (not when imported by tests)
+const port = parseInt(process.env.PORT || "3001", 10);
+const host = process.env.HOST || "0.0.0.0";
+
+async function main() {
+  const app = await buildApp();
+  try {
+    await app.listen({ port, host });
+  } catch (err) {
+    app.log.error(err);
+    process.exit(1);
+  }
+}
+
+// Guard: only run when executed directly, not when imported
+const isMain = process.argv[1] && (import.meta.url === `file://${process.argv[1]}` || import.meta.url.endsWith(process.argv[1]) || process.argv[1].endsWith("/src/index.ts") || process.argv[1].endsWith("/src/index.js"));
+if (isMain) {
+  main();
+}

.benchmark/ticket/fullstack/apps/api/src/middleware/auth.ts

@@ -0,0 +1,41 @@
+// JWT Authentication Middleware
+import type { FastifyRequest, FastifyReply } from "fastify";
+import type { JwtPayload } from "../types/index.js";
+
+/**
+ * Verify JWT token and attach user to request.
+ */
+export async function authenticate(request: FastifyRequest, reply: FastifyReply): Promise<void> {
+  try {
+    await request.jwtVerify();
+  } catch (err) {
+    reply.status(401).send({ error: "Unauthorized", message: "Invalid or expired token", statusCode: 401 });
+  }
+}
+
+/** Helper to get typed user from request (after authenticate). */
+export function getUser(request: FastifyRequest): JwtPayload {
+  return request.user as unknown as JwtPayload;
+}
+
+/**
+ * Require admin role.
+ * Must be used after authenticate.
+ */
+export async function requireAdmin(request: FastifyRequest, reply: FastifyReply): Promise<void> {
+  const user = request.user as unknown as JwtPayload | undefined;
+  if (!user || user.role !== "admin") {
+    reply.status(403).send({ error: "Forbidden", message: "Admin access required", statusCode: 403 });
+  }
+}
+
+/**
+ * Optional auth: attach user if token present, but don't fail if missing.
+ */
+export async function optionalAuth(request: FastifyRequest): Promise<void> {
+  try {
+    await request.jwtVerify();
+  } catch {
+    // No token or invalid — continue without user
+  }
+}

.benchmark/ticket/fullstack/apps/api/src/routes/approval_steps.ts

@@ -0,0 +1,51 @@
+// Auto-generated ApprovalStep routes
+import type { FastifyInstance } from "fastify";
+import { authenticate } from "../middleware/auth.js";
+import { ApprovalStepService } from "../services/approval_step.js";
+import type { CreateApprovalStepInput, UpdateApprovalStepInput } from "../types/index.js";
+
+const service = new ApprovalStepService();
+
+export async function approval_stepsRoutes(app: FastifyInstance): Promise<void> {
+  // All routes require authentication
+  app.addHook("onRequest", authenticate);
+
+  // GET /api/approval_steps — list
+  app.get("/", async (request, reply) => {
+    const items = service.list();
+    return { data: items };
+  });
+
+  // GET /api/approval_steps/:id — get by id
+  app.get<{ Params: { id: string } }>("/:id", async (request, reply) => {
+    const item = service.getById(request.params.id);
+    if (!item) {
+      return reply.status(404).send({ error: "Not Found", message: "ApprovalStep not found", statusCode: 404 });
+    }
+    return { data: item };
+  });
+
+  // POST /api/approval_steps — create
+  app.post<{ Body: CreateApprovalStepInput }>("/", async (request, reply) => {
+    const item = service.create(request.body);
+    return reply.status(201).send({ data: item });
+  });
+
+  // PUT /api/approval_steps/:id — update
+  app.put<{ Params: { id: string }; Body: UpdateApprovalStepInput }>("/:id", async (request, reply) => {
+    const item = service.update(request.params.id, request.body);
+    if (!item) {
+      return reply.status(404).send({ error: "Not Found", message: "ApprovalStep not found", statusCode: 404 });
+    }
+    return { data: item };
+  });
+
+  // DELETE /api/approval_steps/:id — delete
+  app.delete<{ Params: { id: string } }>("/:id", async (request, reply) => {
+    const deleted = service.delete(request.params.id);
+    if (!deleted) {
+      return reply.status(404).send({ error: "Not Found", message: "ApprovalStep not found", statusCode: 404 });
+    }
+    return reply.status(204).send();
+  });
+}

.benchmark/ticket/fullstack/apps/api/src/routes/approvals.ts

@@ -0,0 +1,51 @@
+// Auto-generated Approval routes
+import type { FastifyInstance } from "fastify";
+import { authenticate } from "../middleware/auth.js";
+import { ApprovalService } from "../services/approval.js";
+import type { CreateApprovalInput, UpdateApprovalInput } from "../types/index.js";
+
+const service = new ApprovalService();
+
+export async function approvalsRoutes(app: FastifyInstance): Promise<void> {
+  // All routes require authentication
+  app.addHook("onRequest", authenticate);
+
+  // GET /api/approvals — list
+  app.get("/", async (request, reply) => {
+    const items = service.list();
+    return { data: items };
+  });
+
+  // GET /api/approvals/:id — get by id
+  app.get<{ Params: { id: string } }>("/:id", async (request, reply) => {
+    const item = service.getById(request.params.id);
+    if (!item) {
+      return reply.status(404).send({ error: "Not Found", message: "Approval not found", statusCode: 404 });
+    }
+    return { data: item };
+  });
+
+  // POST /api/approvals — create
+  app.post<{ Body: CreateApprovalInput }>("/", async (request, reply) => {
+    const item = service.create(request.body);
+    return reply.status(201).send({ data: item });
+  });
+
+  // PUT /api/approvals/:id — update
+  app.put<{ Params: { id: string }; Body: UpdateApprovalInput }>("/:id", async (request, reply) => {
+    const item = service.update(request.params.id, request.body);
+    if (!item) {
+      return reply.status(404).send({ error: "Not Found", message: "Approval not found", statusCode: 404 });
+    }
+    return { data: item };
+  });
+
+  // DELETE /api/approvals/:id — delete
+  app.delete<{ Params: { id: string } }>("/:id", async (request, reply) => {
+    const deleted = service.delete(request.params.id);
+    if (!deleted) {
+      return reply.status(404).send({ error: "Not Found", message: "Approval not found", statusCode: 404 });
+    }
+    return reply.status(204).send();
+  });
+}

.benchmark/ticket/fullstack/apps/api/src/routes/attendance.ts

@@ -0,0 +1,51 @@
+// Auto-generated Attendance routes
+import type { FastifyInstance } from "fastify";
+import { authenticate } from "../middleware/auth.js";
+import { AttendanceService } from "../services/attendance.js";
+import type { CreateAttendanceInput, UpdateAttendanceInput } from "../types/index.js";
+
+const service = new AttendanceService();
+
+export async function attendanceRoutes(app: FastifyInstance): Promise<void> {
+  // All routes require authentication
+  app.addHook("onRequest", authenticate);
+
+  // GET /api/attendance — list
+  app.get("/", async (request, reply) => {
+    const items = service.list();
+    return { data: items };
+  });
+
+  // GET /api/attendance/:id — get by id
+  app.get<{ Params: { id: string } }>("/:id", async (request, reply) => {
+    const item = service.getById(request.params.id);
+    if (!item) {
+      return reply.status(404).send({ error: "Not Found", message: "Attendance not found", statusCode: 404 });
+    }
+    return { data: item };
+  });
+
+  // POST /api/attendance — create
+  app.post<{ Body: CreateAttendanceInput }>("/", async (request, reply) => {
+    const item = service.create(request.body);
+    return reply.status(201).send({ data: item });
+  });
+
+  // PUT /api/attendance/:id — update
+  app.put<{ Params: { id: string }; Body: UpdateAttendanceInput }>("/:id", async (request, reply) => {
+    const item = service.update(request.params.id, request.body);
+    if (!item) {
+      return reply.status(404).send({ error: "Not Found", message: "Attendance not found", statusCode: 404 });
+    }
+    return { data: item };
+  });
+
+  // DELETE /api/attendance/:id — delete
+  app.delete<{ Params: { id: string } }>("/:id", async (request, reply) => {
+    const deleted = service.delete(request.params.id);
+    if (!deleted) {
+      return reply.status(404).send({ error: "Not Found", message: "Attendance not found", statusCode: 404 });
+    }
+    return reply.status(204).send();
+  });
+}

.benchmark/ticket/fullstack/apps/api/src/routes/auth.ts

@@ -0,0 +1,121 @@
+// Authentication routes
+import type { FastifyInstance } from "fastify";
+import bcrypt from "bcrypt";
+import { queryOne, execute } from "../db/client.js";
+import { authenticate } from "../middleware/auth.js";
+import type { User, RegisterInput, LoginInput, AuthResponse } from "../types/index.js";
+
+const SALT_ROUNDS = 10;
+
+export async function authRoutes(app: FastifyInstance): Promise<void> {
+  // POST /api/auth/register
+  app.post<{ Body: RegisterInput }>("/register", async (request, reply) => {
+    const { username, password, nickname } = request.body;
+
+    if (!username || !password) {
+      return reply.status(400).send({
+        error: "Bad Request",
+        message: "Username and password are required",
+        statusCode: 400,
+      });
+    }
+
+    if (password.length < 6) {
+      return reply.status(400).send({
+        error: "Bad Request",
+        message: "Password must be at least 6 characters",
+        statusCode: 400,
+      });
+    }
+
+    const existing = queryOne("SELECT id FROM users WHERE username = ?", [username]);
+    if (existing) {
+      return reply.status(409).send({
+        error: "Conflict",
+        message: "Username already exists",
+        statusCode: 409,
+      });
+    }
+
+    const id = crypto.randomUUID();
+    const passwordHash = await bcrypt.hash(password, SALT_ROUNDS);
+    const now = new Date().toISOString();
+
+    execute(
+      "INSERT INTO users (id, username, password_hash, nickname, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?)",
+      [id, username, passwordHash, nickname || username, now, now]
+    );
+
+    const user = queryOne<User>(
+      "SELECT id, username, nickname, role, created_at, updated_at FROM users WHERE id = ?",
+      [id]
+    );
+    if (!user) {
+      return reply.status(500).send({ error: "Internal Error", message: "Failed to create user", statusCode: 500 });
+    }
+
+    const token = app.jwt.sign({ userId: id, username, role: user.role });
+
+    return reply.status(201).send({ token, user } satisfies AuthResponse);
+  });
+
+  // POST /api/auth/login
+  app.post<{ Body: LoginInput }>("/login", async (request, reply) => {
+    const { username, password } = request.body;
+
+    if (!username || !password) {
+      return reply.status(400).send({
+        error: "Bad Request",
+        message: "Username and password are required",
+        statusCode: 400,
+      });
+    }
+
+    const user = queryOne<User & { password_hash: string }>(
+      "SELECT * FROM users WHERE username = ?",
+      [username]
+    );
+
+    if (!user) {
+      return reply.status(401).send({
+        error: "Unauthorized",
+        message: "Invalid username or password",
+        statusCode: 401,
+      });
+    }
+
+    const valid = await bcrypt.compare(password, user.password_hash);
+    if (!valid) {
+      return reply.status(401).send({
+        error: "Unauthorized",
+        message: "Invalid username or password",
+        statusCode: 401,
+      });
+    }
+
+    const token = app.jwt.sign({ userId: user.id, username: user.username, role: user.role });
+
+    const { password_hash, ...safeUser } = user;
+
+    return { token, user: safeUser } satisfies AuthResponse;
+  });
+
+  // GET /api/auth/me — current user info
+  app.get("/me", { onRequest: [authenticate] }, async (request, reply) => {
+    const jwtUser = request.user as unknown as { userId: string };
+    const user = queryOne<User>(
+      "SELECT id, username, nickname, role, created_at, updated_at FROM users WHERE id = ?",
+      [jwtUser.userId]
+    );
+
+    if (!user) {
+      return reply.status(404).send({
+        error: "Not Found",
+        message: "User not found",
+        statusCode: 404,
+      });
+    }
+
+    return { data: user };
+  });
+}

.benchmark/ticket/fullstack/apps/api/src/routes/departments.ts

@@ -0,0 +1,51 @@
+// Auto-generated Department routes
+import type { FastifyInstance } from "fastify";
+import { authenticate } from "../middleware/auth.js";
+import { DepartmentService } from "../services/department.js";
+import type { CreateDepartmentInput, UpdateDepartmentInput } from "../types/index.js";
+
+const service = new DepartmentService();
+
+export async function departmentsRoutes(app: FastifyInstance): Promise<void> {
+  // All routes require authentication
+  app.addHook("onRequest", authenticate);
+
+  // GET /api/departments — list
+  app.get("/", async (request, reply) => {
+    const items = service.list();
+    return { data: items };
+  });
+
+  // GET /api/departments/:id — get by id
+  app.get<{ Params: { id: string } }>("/:id", async (request, reply) => {
+    const item = service.getById(request.params.id);
+    if (!item) {
+      return reply.status(404).send({ error: "Not Found", message: "Department not found", statusCode: 404 });
+    }
+    return { data: item };
+  });
+
+  // POST /api/departments — create
+  app.post<{ Body: CreateDepartmentInput }>("/", async (request, reply) => {
+    const item = service.create(request.body);
+    return reply.status(201).send({ data: item });
+  });
+
+  // PUT /api/departments/:id — update
+  app.put<{ Params: { id: string }; Body: UpdateDepartmentInput }>("/:id", async (request, reply) => {
+    const item = service.update(request.params.id, request.body);
+    if (!item) {
+      return reply.status(404).send({ error: "Not Found", message: "Department not found", statusCode: 404 });
+    }
+    return { data: item };
+  });
+
+  // DELETE /api/departments/:id — delete
+  app.delete<{ Params: { id: string } }>("/:id", async (request, reply) => {
+    const deleted = service.delete(request.params.id);
+    if (!deleted) {
+      return reply.status(404).send({ error: "Not Found", message: "Department not found", statusCode: 404 });
+    }
+    return reply.status(204).send();
+  });
+}

.benchmark/ticket/fullstack/apps/api/src/routes/users.ts

@@ -0,0 +1,51 @@
+// Auto-generated User routes
+import type { FastifyInstance } from "fastify";
+import { authenticate } from "../middleware/auth.js";
+import { UserService } from "../services/user.js";
+import type { CreateUserInput, UpdateUserInput } from "../types/index.js";
+
+const service = new UserService();
+
+export async function usersRoutes(app: FastifyInstance): Promise<void> {
+  // All routes require authentication
+  app.addHook("onRequest", authenticate);
+
+  // GET /api/users — list
+  app.get("/", async (request, reply) => {
+    const items = service.list();
+    return { data: items };
+  });
+
+  // GET /api/users/:id — get by id
+  app.get<{ Params: { id: string } }>("/:id", async (request, reply) => {
+    const item = service.getById(request.params.id);
+    if (!item) {
+      return reply.status(404).send({ error: "Not Found", message: "User not found", statusCode: 404 });
+    }
+    return { data: item };
+  });
+
+  // POST /api/users — create
+  app.post<{ Body: CreateUserInput }>("/", async (request, reply) => {
+    const item = service.create(request.body);
+    return reply.status(201).send({ data: item });
+  });
+
+  // PUT /api/users/:id — update
+  app.put<{ Params: { id: string }; Body: UpdateUserInput }>("/:id", async (request, reply) => {
+    const item = service.update(request.params.id, request.body);
+    if (!item) {
+      return reply.status(404).send({ error: "Not Found", message: "User not found", statusCode: 404 });
+    }
+    return { data: item };
+  });
+
+  // DELETE /api/users/:id — delete
+  app.delete<{ Params: { id: string } }>("/:id", async (request, reply) => {
+    const deleted = service.delete(request.params.id);
+    if (!deleted) {
+      return reply.status(404).send({ error: "Not Found", message: "User not found", statusCode: 404 });
+    }
+    return reply.status(204).send();
+  });
+}

.benchmark/ticket/fullstack/apps/api/src/services/approval.ts

@@ -0,0 +1,56 @@
+// Auto-generated Approval service
+import { queryAll, queryOne, execute } from "../db/client.js";
+import type { Approval, CreateApprovalInput, UpdateApprovalInput } from "../types/index.js";
+
+export class ApprovalService {
+  /** List all approvals */
+  list(): Approval[] {
+    return queryAll<Approval>("SELECT * FROM approvals ORDER BY created_at DESC");
+  }
+
+  /** Get by ID */
+  getById(id: string): Approval | undefined {
+    return queryOne<Approval>("SELECT * FROM approvals WHERE id = ?", [id]);
+  }
+
+  /** Create */
+  create(input: CreateApprovalInput): Approval {
+    const id = crypto.randomUUID();
+    const now = new Date().toISOString();
+    const cols = ["id", "user_id", "entity_type", "entity_id", "applicant_id", "status", "form_data", "created_at", "updated_at"];
+    const values = [id, input.userId ?? null, input.entityType ?? null, input.entityId ?? null, input.applicantId ?? null, input.status ?? null, input.formData ?? null, now, now];
+
+    execute(`INSERT INTO approvals (${cols.join(", ")}) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`, values);
+    return this.getById(id)!;
+  }
+
+  /** Update */
+  update(id: string, input: UpdateApprovalInput): Approval | undefined {
+    const existing = this.getById(id);
+    if (!existing) return undefined;
+
+    const sets: string[] = [];
+    const values: unknown[] = [];
+    if (input.userId !== undefined) { sets.push("user_id = ?"); values.push(input.userId); }
+    if (input.entityType !== undefined) { sets.push("entity_type = ?"); values.push(input.entityType); }
+    if (input.entityId !== undefined) { sets.push("entity_id = ?"); values.push(input.entityId); }
+    if (input.applicantId !== undefined) { sets.push("applicant_id = ?"); values.push(input.applicantId); }
+    if (input.status !== undefined) { sets.push("status = ?"); values.push(input.status); }
+    if (input.formData !== undefined) { sets.push("form_data = ?"); values.push(input.formData); }
+
+    if (sets.length === 0) return existing;
+
+    sets.push("updated_at = ?");
+    values.push(new Date().toISOString());
+
+    values.push(id);
+    execute(`UPDATE approvals SET ${sets.join(", ")} WHERE id = ?`, values);
+    return this.getById(id)!;
+  }
+
+  /** Delete */
+  delete(id: string): boolean {
+    const result = execute("DELETE FROM approvals WHERE id = ?", [id]);
+    return result.changes > 0;
+  }
+}

.benchmark/ticket/fullstack/apps/api/src/services/approval_step.ts

@@ -0,0 +1,58 @@
+// Auto-generated ApprovalStep service
+import { queryAll, queryOne, execute } from "../db/client.js";
+import type { ApprovalStep, CreateApprovalStepInput, UpdateApprovalStepInput } from "../types/index.js";
+
+export class ApprovalStepService {
+  /** List all approval_steps */
+  list(): ApprovalStep[] {
+    return queryAll<ApprovalStep>("SELECT * FROM approval_steps ORDER BY created_at DESC");
+  }
+
+  /** Get by ID */
+  getById(id: string): ApprovalStep | undefined {
+    return queryOne<ApprovalStep>("SELECT * FROM approval_steps WHERE id = ?", [id]);
+  }
+
+  /** Create */
+  create(input: CreateApprovalStepInput): ApprovalStep {
+    const id = crypto.randomUUID();
+    const now = new Date().toISOString();
+    const hasCreatedAt = false;
+    const hasUpdatedAt = false;
+    const cols = ["id", "approval_id", "approver_id", "step_order", "status", "comment", "acted_at"];
+    const placeholders = cols.map(() => "?").join(", ");
+    const values = [id, input.approvalId ?? null, input.approverId ?? null, input.stepOrder ?? null, input.status ?? null, input.comment ?? null, input.actedAt ?? null];
+
+    execute(`INSERT INTO approval_steps (${cols.join(", ")}) VALUES (${placeholders})`, values);
+    return this.getById(id)!;
+  }
+
+  /** Update */
+  update(id: string, input: UpdateApprovalStepInput): ApprovalStep | undefined {
+    const existing = this.getById(id);
+    if (!existing) return undefined;
+
+    const sets: string[] = [];
+    const values: unknown[] = [];
+    if (input.approvalId !== undefined) { sets.push("approval_id = ?"); values.push(input.approvalId); }
+    if (input.approverId !== undefined) { sets.push("approver_id = ?"); values.push(input.approverId); }
+    if (input.stepOrder !== undefined) { sets.push("step_order = ?"); values.push(input.stepOrder); }
+    if (input.status !== undefined) { sets.push("status = ?"); values.push(input.status); }
+    if (input.comment !== undefined) { sets.push("comment = ?"); values.push(input.comment); }
+    if (input.actedAt !== undefined) { sets.push("acted_at = ?"); values.push(input.actedAt); }
+
+    if (sets.length === 0) return existing;
+
+    
+
+    values.push(id);
+    execute(`UPDATE approval_steps SET ${sets.join(", ")} WHERE id = ?`, values);
+    return this.getById(id)!;
+  }
+
+  /** Delete */
+  delete(id: string): boolean {
+    const result = execute("DELETE FROM approval_steps WHERE id = ?", [id]);
+    return result.changes > 0;
+  }
+}

.benchmark/ticket/fullstack/apps/api/src/services/attendance.ts

@@ -0,0 +1,57 @@
+// Auto-generated Attendance service
+import { queryAll, queryOne, execute } from "../db/client.js";
+import type { Attendance, CreateAttendanceInput, UpdateAttendanceInput } from "../types/index.js";
+
+export class AttendanceService {
+  /** List all attendance */
+  list(): Attendance[] {
+    return queryAll<Attendance>("SELECT * FROM attendance ORDER BY created_at DESC");
+  }
+
+  /** Get by ID */
+  getById(id: string): Attendance | undefined {
+    return queryOne<Attendance>("SELECT * FROM attendance WHERE id = ?", [id]);
+  }
+
+  /** Create */
+  create(input: CreateAttendanceInput): Attendance {
+    const id = crypto.randomUUID();
+    const now = new Date().toISOString();
+    const hasCreatedAt = false;
+    const hasUpdatedAt = false;
+    const cols = ["id", "user_id", "check_in_at", "check_out_at", "location", "type"];
+    const placeholders = cols.map(() => "?").join(", ");
+    const values = [id, input.userId ?? null, input.checkInAt ?? null, input.checkOutAt ?? null, input.location ?? null, input.type ?? null];
+
+    execute(`INSERT INTO attendance (${cols.join(", ")}) VALUES (${placeholders})`, values);
+    return this.getById(id)!;
+  }
+
+  /** Update */
+  update(id: string, input: UpdateAttendanceInput): Attendance | undefined {
+    const existing = this.getById(id);
+    if (!existing) return undefined;
+
+    const sets: string[] = [];
+    const values: unknown[] = [];
+    if (input.userId !== undefined) { sets.push("user_id = ?"); values.push(input.userId); }
+    if (input.checkInAt !== undefined) { sets.push("check_in_at = ?"); values.push(input.checkInAt); }
+    if (input.checkOutAt !== undefined) { sets.push("check_out_at = ?"); values.push(input.checkOutAt); }
+    if (input.location !== undefined) { sets.push("location = ?"); values.push(input.location); }
+    if (input.type !== undefined) { sets.push("type = ?"); values.push(input.type); }
+
+    if (sets.length === 0) return existing;
+
+    
+
+    values.push(id);
+    execute(`UPDATE attendance SET ${sets.join(", ")} WHERE id = ?`, values);
+    return this.getById(id)!;
+  }
+
+  /** Delete */
+  delete(id: string): boolean {
+    const result = execute("DELETE FROM attendance WHERE id = ?", [id]);
+    return result.changes > 0;
+  }
+}

.benchmark/ticket/fullstack/apps/api/src/services/department.ts

@@ -0,0 +1,55 @@
+// Auto-generated Department service
+import { queryAll, queryOne, execute } from "../db/client.js";
+import type { Department, CreateDepartmentInput, UpdateDepartmentInput } from "../types/index.js";
+
+export class DepartmentService {
+  /** List all departments */
+  list(): Department[] {
+    return queryAll<Department>("SELECT * FROM departments ORDER BY created_at DESC");
+  }
+
+  /** Get by ID */
+  getById(id: string): Department | undefined {
+    return queryOne<Department>("SELECT * FROM departments WHERE id = ?", [id]);
+  }
+
+  /** Create */
+  create(input: CreateDepartmentInput): Department {
+    const id = crypto.randomUUID();
+    const now = new Date().toISOString();
+    const hasCreatedAt = false;
+    const hasUpdatedAt = false;
+    const cols = ["id", "name", "parent_id", "manager_id"];
+    const placeholders = cols.map(() => "?").join(", ");
+    const values = [id, input.name ?? null, input.parentId ?? null, input.managerId ?? null];
+
+    execute(`INSERT INTO departments (${cols.join(", ")}) VALUES (${placeholders})`, values);
+    return this.getById(id)!;
+  }
+
+  /** Update */
+  update(id: string, input: UpdateDepartmentInput): Department | undefined {
+    const existing = this.getById(id);
+    if (!existing) return undefined;
+
+    const sets: string[] = [];
+    const values: unknown[] = [];
+    if (input.name !== undefined) { sets.push("name = ?"); values.push(input.name); }
+    if (input.parentId !== undefined) { sets.push("parent_id = ?"); values.push(input.parentId); }
+    if (input.managerId !== undefined) { sets.push("manager_id = ?"); values.push(input.managerId); }
+
+    if (sets.length === 0) return existing;
+
+    
+
+    values.push(id);
+    execute(`UPDATE departments SET ${sets.join(", ")} WHERE id = ?`, values);
+    return this.getById(id)!;
+  }
+
+  /** Delete */
+  delete(id: string): boolean {
+    const result = execute("DELETE FROM departments WHERE id = ?", [id]);
+    return result.changes > 0;
+  }
+}

.benchmark/ticket/fullstack/apps/api/src/services/user.ts

@@ -0,0 +1,56 @@
+// Auto-generated User service
+import { queryAll, queryOne, execute } from "../db/client.js";
+import type { User, CreateUserInput, UpdateUserInput } from "../types/index.js";
+
+export class UserService {
+  /** List all users */
+  list(): User[] {
+    return queryAll<User>("SELECT * FROM users ORDER BY created_at DESC");
+  }
+
+  /** Get by ID */
+  getById(id: string): User | undefined {
+    return queryOne<User>("SELECT * FROM users WHERE id = ?", [id]);
+  }
+
+  /** Create */
+  create(input: CreateUserInput): User {
+    const id = crypto.randomUUID();
+    const now = new Date().toISOString();
+    const hasCreatedAt = true;
+    const hasUpdatedAt = true;
+    const cols = ["id", "phone", "nickname", "avatar_url", "created_at", "updated_at"];
+    const placeholders = cols.map(() => "?").join(", ");
+    const values = [id, input.phone ?? null, input.nickname ?? null, input.avatarUrl ?? null, now, now];
+
+    execute(`INSERT INTO users (${cols.join(", ")}) VALUES (${placeholders})`, values);
+    return this.getById(id)!;
+  }
+
+  /** Update */
+  update(id: string, input: UpdateUserInput): User | undefined {
+    const existing = this.getById(id);
+    if (!existing) return undefined;
+
+    const sets: string[] = [];
+    const values: unknown[] = [];
+    if (input.phone !== undefined) { sets.push("phone = ?"); values.push(input.phone); }
+    if (input.nickname !== undefined) { sets.push("nickname = ?"); values.push(input.nickname); }
+    if (input.avatarUrl !== undefined) { sets.push("avatar_url = ?"); values.push(input.avatarUrl); }
+
+    if (sets.length === 0) return existing;
+
+    sets.push("updated_at = ?");
+    values.push(new Date().toISOString());
+
+    values.push(id);
+    execute(`UPDATE users SET ${sets.join(", ")} WHERE id = ?`, values);
+    return this.getById(id)!;
+  }
+
+  /** Delete */
+  delete(id: string): boolean {
+    const result = execute("DELETE FROM users WHERE id = ?", [id]);
+    return result.changes > 0;
+  }
+}

.benchmark/ticket/fullstack/apps/api/src/types/fastify.d.ts

@@ -0,0 +1,8 @@
+// Augment Fastify request with JWT user
+import type { JwtPayload } from "./index.js";
+
+declare module "fastify" {
+  interface FastifyRequest {
+    user?: JwtPayload;
+  }
+}

.benchmark/ticket/fullstack/apps/api/src/types/index.ts

@@ -0,0 +1,183 @@
+// Import and re-export shared entity types
+import type {
+  User,
+  Contract,
+  Approval,
+  Customer,
+  Reminder,
+  Tickets,
+  Items,
+  ApiResponse,
+  PaginatedResponse,
+  ErrorResponse,
+} from "@shared/types";
+
+export type {
+  User,
+  Contract,
+  Approval,
+  Customer,
+  Reminder,
+  Tickets,
+  Items,
+  ApiResponse,
+  PaginatedResponse,
+  ErrorResponse,
+};
+
+// Auto-generated types (from Model Contract)
+
+export interface CreateUserInput {
+  username: string;
+  passwordHash: string;
+  nickname?: string;
+  role?: string;
+  phone?: string;
+  avatarUrl?: string;
+}
+
+export interface CreateContractInput {
+  userId: string;
+  title: string;
+  partyA?: string;
+  partyB?: string;
+  amount?: number;
+  signedAt?: string;
+  expiresAt?: string;
+  status?: string;
+  fileUrl?: string;
+}
+
+export interface CreateApprovalInput {
+  userId: string;
+  entityType: string;
+  entityId?: string;
+  applicantId: string;
+  status?: string;
+  formData?: Record<string, unknown>;
+}
+
+export interface CreateCustomerInput {
+  userId: string;
+  name: string;
+  email?: string;
+  phone?: string;
+  company?: string;
+  source?: string;
+  tags?: Record<string, unknown>;
+}
+
+export interface CreateReminderInput {
+  userId: string;
+  entityType: string;
+  entityId?: string;
+  remindAt: string;
+  message?: string;
+  sent?: boolean;
+}
+
+export interface CreateTicketsInput {
+  userId?: string;
+  title: string;
+  description?: string;
+  assigneeId?: string;
+  category?: string;
+}
+
+export interface CreateItemsInput {
+  userId?: string;
+  title: string;
+  description?: string;
+  data?: Record<string, unknown>;
+}
+
+export interface UpdateUserInput {
+  username?: string;
+  passwordHash?: string;
+  nickname?: string;
+  role?: string;
+  phone?: string;
+  avatarUrl?: string;
+}
+
+export interface UpdateContractInput {
+  userId?: string;
+  title?: string;
+  partyA?: string;
+  partyB?: string;
+  amount?: number;
+  signedAt?: string;
+  expiresAt?: string;
+  status?: string;
+  fileUrl?: string;
+}
+
+export interface UpdateApprovalInput {
+  userId?: string;
+  entityType?: string;
+  entityId?: string;
+  applicantId?: string;
+  status?: string;
+  formData?: Record<string, unknown>;
+}
+
+export interface UpdateCustomerInput {
+  userId?: string;
+  name?: string;
+  email?: string;
+  phone?: string;
+  company?: string;
+  source?: string;
+  tags?: Record<string, unknown>;
+}
+
+export interface UpdateReminderInput {
+  userId?: string;
+  entityType?: string;
+  entityId?: string;
+  remindAt?: string;
+  message?: string;
+  sent?: boolean;
+}
+
+export interface UpdateTicketsInput {
+  userId?: string;
+  title?: string;
+  description?: string;
+  assigneeId?: string;
+  category?: string;
+}
+
+export interface UpdateItemsInput {
+  userId?: string;
+  title?: string;
+  description?: string;
+  data?: Record<string, unknown>;
+}
+
+// ─── Auth ───────────────────────────────────────────
+export interface LoginInput {
+  username: string;
+  password: string;
+}
+
+export interface RegisterInput {
+  username: string;
+  password: string;
+  nickname?: string;
+}
+
+export interface AuthResponse {
+  token: string;
+  user: User;
+}
+
+// ─── API ────────────────────────────────────────────
+// ─── JWT ────────────────────────────────────────────
+export interface JwtPayload {
+  userId: string;
+  username: string;
+  role: string;
+  iat?: number;
+  exp?: number;
+}

.benchmark/ticket/fullstack/apps/api/src/types/sql.js.d.ts

@@ -0,0 +1,27 @@
+// Type declarations for sql.js (no native types package available)
+declare module "sql.js" {
+  export interface Database {
+    run(sql: string, params?: BindParams): void;
+    exec(sql: string): void;
+    prepare(sql: string): Statement;
+    export(): Uint8Array;
+    close(): void;
+    getRowsModified(): number;
+  }
+
+  export interface Statement {
+    bind(params?: BindParams): boolean;
+    step(): boolean;
+    getAsObject<T = Record<string, unknown>>(): T;
+    getColumnNames(): string[];
+    free(): boolean;
+  }
+
+  export type BindParams = unknown[] | Record<string, unknown>;
+
+  export interface SqlJsStatic {
+    Database: new (data?: ArrayLike<number>) => Database;
+  }
+
+  export default function initSqlJs(config?: Record<string, unknown>): Promise<SqlJsStatic>;
+}

.benchmark/ticket/fullstack/apps/api/tsconfig.json

@@ -0,0 +1,27 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "lib": [
+      "ES2022"
+    ],
+    "outDir": "./dist",
+    "rootDir": "./src",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "forceConsistentCasingInFileNames": true,
+    "resolveJsonModule": true,
+    "declaration": true,
+    "sourceMap": true
+  },
+  "include": [
+    "src/**/*"
+  ],
+  "exclude": [
+    "node_modules",
+    "dist",
+    "src/__tests__"
+  ]
+}