tRPC 11.19

Apply the Node.js 24, TypeScript 7, and JavaScript ES2026 prompts first. These rules cover tRPC 11.19 HTTP procedures, local callers, WebSockets, and SSE. Also apply the prompt for the host framework when it mounts a tRPC adapter.

Procedures, identity, and access

• Build a reusable authenticated procedure with t.procedure.use(...) and use it for every protected query, mutation, and subscription. A router name, meta() value, or inferred AppRouter type does not enforce access. Treat a bare t.procedure as public.
• Verify tokens, cookies, and other credentials while constructing createContext; reject invalid or expired credentials before populating a trusted principal. Authorize each procedure's operation and selected resource against that principal, including tenant membership and object ownership. Derive privileged fields on the server instead of accepting them from .input().
• Use .mutation() for state changes. Queries and subscription setup can be sent with GET, retried, cached, or reconnected; do not put writes with mutation-level authorization requirements in them.
• Keep one server initTRPC configuration for routers that must share context, transformer, and error policy. Export only AppRouter as an import type to browser code; keep server modules out of client bundles and leave allowOutsideOfServer disabled.

Context, middleware, and validation

• Account for createContext running once for an HTTP request, including a batch, and once for a WebSocket connection. Never hold a principal or tenant in process-wide mutable state. Treat