feat: implement API for AI interactions and authentication:

apps/api/.env.example

@@ -0,0 +1,30 @@
+# Server
+PORT=4000
+SUPERCODE_JSON_BODY_LIMIT=10mb
+
+# Auth (Better-Auth)
+BETTER_AUTH_URL=http://localhost:4000
+CLIENT_URL=http://localhost:3000
+
+# Database (terminal DB)
+DATABASE_URL=postgresql://user:password@localhost:5432/supercode_terminal
+
+# GitHub OAuth
+GITHUB_CLIENT_ID=
+GITHUB_CLIENT_SECRET=
+
+# Provider API Keys
+GOOGLE_GENERATIVE_AI_API_KEY=
+OPENROUTER_API_KEY=
+OPENROUTER_MODEL=openai/gpt-oss-120b:free
+MINIMAX_API_KEY=
+MINIMAX_MAX_TOKENS=4096
+NVIDIA_API_KEY=
+NVIDIA_BASE_URL=https://integrate.api.nvidia.com/v1
+NVIDIA_MODEL=minimaxai/minimax-m3
+NVIDIA_MAX_TOKENS=8192
+NVIDIA_TEMPERATURE=1
+NVIDIA_TOP_P=0.95
+MERGE_DEV_API_KEY=
+ORCAROUTER_API_KEY=
+CONCENTRATEAI_API_KEY=

apps/api/package.json

@@ -2,10 +2,28 @@
   "name": "api",
   "version": "0.1.0",
   "private": true,
+  "type": "module",
   "scripts": {
-    "dev": "echo 'api app scaffold pending'",
-    "build": "echo 'api build scaffold pending'",
+    "dev": "bun --watch src/index.ts",
+    "build": "bun build --target bun --outdir dist src/index.ts",
+    "start": "bun src/index.ts",
     "lint": "echo 'api lint scaffold pending'",
-    "typecheck": "echo 'api typecheck scaffold pending'"
+    "typecheck": "tsc --noEmit"
+  },
+  "dependencies": {
+    "@ai-sdk/google": "^3.0.80",
+    "@ai-sdk/openai-compatible": "^2.0.48",
+    "@hono/zod-validator": "^0.5.0",
+    "@openrouter/ai-sdk-provider": "^2.9.0",
+    "@super/db-terminal": "workspace:*",
+    "ai": "^7.0.37",
+    "better-auth": "^1.6.23",
+    "hono": "^4.7.0",
+    "vercel-minimax-ai-provider": "^0.0.2",
+    "zod": "^3.25.2"
+  },
+  "devDependencies": {
+    "@types/bun": "^1.3.14",
+    "typescript": "^5.7.0"
   }
 }

apps/api/src/app.ts

@@ -0,0 +1,29 @@
+import { Hono } from "hono"
+import { cors } from "hono/cors"
+import { logger } from "hono/logger"
+import { bodyLimit } from "hono/body-limit"
+import { healthRoute } from "./routes/health"
+import { authRoute } from "./routes/auth"
+import { aiRoute } from "./routes/ai"
+import type { AppEnv } from "./types"
+
+export function createApp() {
+  const app = new Hono<AppEnv>().basePath("/api")
+
+  app.use("*", logger())
+  app.use("*", cors())
+  app.use("*", bodyLimit({
+    maxSize: 10 * 1024 * 1024,
+  }))
+
+  app.onError((err, c) => {
+    console.error("[API Error]", err)
+    return c.json({ error: "Internal server error" }, 500)
+  })
+
+  app.route("/", healthRoute)
+  app.route("/", authRoute)
+  app.route("/", aiRoute)
+
+  return app
+}

apps/api/src/index.ts

@@ -0,0 +1,14 @@
+import { serve } from "bun"
+import { createApp } from "./app"
+
+const PORT = Number(process.env.PORT) || 4000
+
+serve({
+  fetch: createApp().fetch,
+  port: PORT,
+  development: {
+    hmr: true,
+  },
+})
+
+console.log(`[API] Server running on http://localhost:${PORT}`)

apps/api/src/lib/auth.ts

@@ -0,0 +1,21 @@
+import { betterAuth } from "better-auth"
+import { prismaAdapter } from "better-auth/adapters/prisma"
+import prisma from "./prisma"
+
+const serverUrl = process.env.BETTER_AUTH_URL || "http://localhost:4000"
+const clientUrl = process.env.CLIENT_URL || "http://localhost:3000"
+const isProduction = serverUrl.startsWith("https://")
+
+export const auth = betterAuth({
+  database: prismaAdapter(prisma, { provider: "postgresql" }),
+  baseURL: serverUrl,
+  basePath: "/api/auth",
+  trustedOrigins: [clientUrl, serverUrl],
+  socialProviders: {
+    github: {
+      clientId: process.env.GITHUB_CLIENT_ID as string,
+      clientSecret: process.env.GITHUB_CLIENT_SECRET as string,
+      ...(isProduction ? { redirectURI: `${clientUrl}/api/auth/callback/github` } : {}),
+    },
+  },
+})

apps/api/src/lib/pricing.ts

@@ -0,0 +1,37 @@
+export interface ModelPricing {
+  input: number
+  output: number
+  cacheRead: number
+  cacheWrite: number
+}
+
+const MODEL_PRICING: Record<string, ModelPricing> = {
+  "gemini-3-flash-preview": { input: 1, output: 4, cacheRead: 0.25, cacheWrite: 1 },
+  "gemini-3-pro-preview": { input: 1.25, output: 10, cacheRead: 0.315, cacheWrite: 1.25 },
+  "minimax-m3": { input: 0.15, output: 0.85, cacheRead: 0.015, cacheWrite: 0.15 },
+  "nvidia/minimax-m3": { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
+}
+
+export function lookupPricing(model: string): ModelPricing {
+  return (
+    MODEL_PRICING[model] ?? {
+      input: 0,
+      output: 0,
+      cacheRead: 0,
+      cacheWrite: 0,
+    }
+  )
+}
+
+export function computeCost(
+  model: string,
+  inputTokens: number,
+  outputTokens: number,
+  cachedInputTokens: number
+): number {
+  const p = lookupPricing(model)
+  const regularInput = inputTokens - cachedInputTokens
+  const cost =
+    (regularInput * p.input + cachedInputTokens * p.cacheRead + outputTokens * p.output) / 1_000_000
+  return Math.round(cost * 1_000_000) / 1_000_000
+}

apps/api/src/lib/prisma.ts

@@ -0,0 +1,2 @@
+import prisma from "@super/db-terminal"
+export default prisma

apps/api/src/lib/token-budget.ts

@@ -0,0 +1,47 @@
+import prisma from "./prisma"
+
+const DAILY_TOKEN_LIMIT = 128_000
+const DAILY_QUERY_LIMIT = 20
+
+export async function checkDailyTokenBudget(userId: string): Promise<{
+  allowed: boolean
+  used: number
+  limit: number
+  remaining: number
+  queriesUsed: number
+  queriesRemaining: number
+}> {
+  const today = new Date()
+  today.setHours(0, 0, 0, 0)
+  const tomorrow = new Date(today)
+  tomorrow.setDate(tomorrow.getDate() + 1)
+
+  const events = await prisma.usageEvent.findMany({
+    where: {
+      createdAt: { gte: today, lt: tomorrow },
+    },
+    select: {
+      inputTokens: true,
+      outputTokens: true,
+      cachedInputTokens: true,
+    },
+  })
+
+  const totalTokens = events.reduce(
+    (sum, e) => sum + e.inputTokens + e.outputTokens + (e.cachedInputTokens ?? 0),
+    0
+  )
+
+  const queriesUsed = events.length
+  const remaining = DAILY_TOKEN_LIMIT - totalTokens
+  const queriesRemaining = DAILY_QUERY_LIMIT - queriesUsed
+
+  return {
+    allowed: remaining > 0 && queriesRemaining > 0,
+    used: totalTokens,
+    limit: DAILY_TOKEN_LIMIT,
+    remaining: Math.max(0, remaining),
+    queriesUsed,
+    queriesRemaining: Math.max(0, queriesRemaining),
+  }
+}

apps/api/src/lib/track-usage.ts

@@ -0,0 +1,27 @@
+import prisma from "./prisma"
+
+export async function recordUsage(opts: {
+  provider: string
+  model: string
+  inputTokens: number
+  outputTokens: number
+  cachedInputTokens?: number
+  costUsd: number
+  durationMs: number
+}) {
+  try {
+    await prisma.usageEvent.create({
+      data: {
+        provider: opts.provider,
+        model: opts.model,
+        inputTokens: opts.inputTokens,
+        outputTokens: opts.outputTokens,
+        cachedInputTokens: opts.cachedInputTokens ?? 0,
+        costUsd: opts.costUsd,
+        durationMs: opts.durationMs,
+      },
+    })
+  } catch (e) {
+    console.error("[track-usage] Failed to record usage event:", e)
+  }
+}

apps/api/src/middleware/auth.ts

@@ -0,0 +1,28 @@
+import { createMiddleware } from "hono/factory"
+import prisma from "../lib/prisma"
+import type { AppEnv } from "../types"
+
+export const authenticate = createMiddleware<AppEnv>(async (c, next) => {
+  const authHeader = c.req.header("Authorization")
+  if (!authHeader?.startsWith("Bearer ")) {
+    return c.json({ error: "Unauthorized" }, 401)
+  }
+
+  const token = authHeader.slice(7)
+  try {
+    const session = await prisma.session.findUnique({
+      where: { token },
+      include: { user: true },
+    })
+
+    if (!session || session.expiresAt < new Date()) {
+      return c.json({ error: "Unauthorized" }, 401)
+    }
+
+    c.set("user", session.user)
+    c.set("session", session)
+    await next()
+  } catch {
+    return c.json({ error: "Unauthorized" }, 401)
+  }
+})