@repo/api

​

Exports

export const app;      // the Hono app, base path /api
export { router };     // the oRPC router
export type ApiRouterClient = RouterClient<typeof router>; // client type for the web app

​

The Hono app

​

Two transports for the same procedures

• RPC, under /api/rpc/.... This is what the typed oRPC client in the web app uses.
• OpenAPI style REST, under /api/..., at the path and method each procedure declares with .route({...}).

• SmartCoercionPlugin, which coerces query and path strings to the types the Zod schema expects.
• OpenAPIReferencePlugin, which serves an API reference at /api/docs. Its spec merges the oRPC routes with better-auth’s own OpenAPI schema (auth.api.generateOpenAPISchema()), with the auth paths prefixed by /auth.

​

Procedure builders

export const publicProcedure = os.$context<{ headers: Headers }>();

export const protectedProcedure = publicProcedure.use(async ({ context, next }) => {
  const session = await auth.api.getSession({ headers: context.headers });
  if (!session) throw new ORPCError('UNAUTHORIZED');
  return await next({ context: { session: session.session, user: session.user } });
});

export const adminProcedure = protectedProcedure.use(async ({ context, next }) => {
  if (context.user.role !== 'admin') throw new ORPCError('FORBIDDEN');
  return await next();
});

​

Locale middleware

​

The router

export const router = publicProcedure.router({
  admin: adminRouter,
  organizations: organizationsRouter,
  users: usersRouter,
  payments: paymentsRouter,
  notifications: notificationsRouter,
});

​

users

​

organizations

​

payments

​

notifications

​

admin

​

Errors

new ORPCError('BAD_REQUEST', { message, data: { reason: 'HAS_SUBSCRIPTION' } });

​

Rate limiting and body size

​

Files that look important and are not wired

• src/lib/backend-client.ts and src/lib/backend-config.ts: a client that signs requests to a separate backend with X-Service-Token headers and a different envelope (success, error). It comes from before the consolidation. Nothing in the package imports the client, and the config module would throw at import if BACKEND_URL, BACKEND_SERVICE_SECRET or BACKEND_LIFECYCLE_SECRET were missing.
• src/lib/openapi-schema.ts: mergeOpenApiSchemas, a helper to merge two OpenAPI documents. The handler builds its spec without it.
• src/config.ts: an empty config object kept for consistency with the other packages.

​

Adding a procedure

export const myProcedure = protectedProcedure
  .route({ method: 'POST', path: '/area/my-procedure', tags: ['Area'], summary: 'What it does' })
  .input(z.object({ organizationId: z.string() }))
  .handler(async ({ input, context: { user } }) => {
    await requireOrganizationMember(input.organizationId, user.id);
    return { ok: true };
  });