API overview

apps/api is a Bun + Hono server. Everything it serves is implemented once, in packages/core, and exposed through three surfaces.

Surface	Who calls it	Where it lives
tRPC at /api/trpc/*	The Next.js web app	packages/core/src/server/trpc/routers/
REST /v1	The mobile app (tcgkl repo)	apps/api/src/v1/routes/
HTTP handlers	Stripe, Autosend, the WhatsApp gateway, Coolify cron, uploads	packages/core/src/http/, mounted in apps/api/src/index.ts

Plus Better Auth on /api/auth/*, and /health for liveness.

/v1 is an adapter, never a second implementation

Every /v1 handler calls the matching tRPC procedure through createCaller (apps/api/src/v1/middleware.ts). A business rule lives in exactly one place, so web and mobile can never drift apart. If you find yourself re-checking a rule in a /v1 route, the rule belongs in the router.

What is mounted

/api/auth/one-tap/nonce        GET
/api/auth/one-tap/callback     POST
/api/auth/session              GET
/api/auth/logout               POST
/api/auth/*                    GET POST   Better Auth catch-all
/api/trpc/*                    ALL

/api/create-payment-intent     POST
/api/webhooks/stripe           POST
/api/webhooks/autosend         POST
/api/webhooks/whatsapp         POST

/api/cron/cleanup-expired      POST
/api/cron/send-reminders       POST
/api/cron/auction-close        POST
/api/cron/auction-lifecycle    POST
/api/cron/auction-chat-retention POST
/api/cron/sync-emails          POST
/api/cron/cdp-nightly          POST

/api/upload                    POST
/api/admin/upload              POST
/api/admin/upload/presign      POST
/api/profile/avatar            POST

/v1/*                          Mobile REST, OpenAPI at /v1/openapi.json
/health                        GET

Origins

Environment	API
Production	https://api.tcgkl.com
Beta	https://api-staging.tcgkl.com

The browser never calls those directly. The web app proxies the API-owned paths from its own origin (apps/web/src/proxy.ts), so cookies stay same-origin and CORS stays out of the picture. The mobile app calls the API host directly with a bearer token.