tRPC 11.18

Apply the Node.js 24, TypeScript 7, and JavaScript ES2026 prompts first. These rules target tRPC 11.18.0 on Node.js, including HTTP adapters, server-side callers, WebSockets, and Server-sent Events (SSE). Apply host-framework controls as well when mounting tRPC inside another framework.

Procedures and authorization

• Initialize one shared initTRPC instance per backend so routers use consistent context, transformer, and error policies. Keep server implementations out of browser bundles; share AppRouter through import type and leave allowOutsideOfServer disabled.
• Export a protectedProcedure built with t.procedure.use(...) and require it for protected queries, mutations, and subscriptions. Bare t.procedure is public; router nesting, an admin name, and .meta() declarations do not enforce access without executing a corresponding check.
• Authorize the requested operation and resource within its tenant after validating identifiers. An organization ID supplied to .input() is a selector to check against verified membership, not permission to enter that organization; scope data access to the authorized resource and derive ownership and privileged writable fields on the server.
• Keep .query() and subscription setup free of application state changes that require mutation authorization. Use .mutation() for those changes; HTTP queries and subscriptions accept GET, and clients may retry or reconnect them.

Context and middleware

• Resolve and verify credentials in createContext; treat headers, cookies, and info.connectionParams as untrusted until