---
package: "@trpc/server"
version: "^11.0.0"
tier: core
decision: approved
date: 2026-05-14
deciders: [scaffolded]
adr: null
filter-results:
  license: MIT
  types: native
  maintenance: active
  boundary-fit: pass
  shadow-check: pass
  eu-residency: n/a
  cve-scan: clean
  named-consumer: pass
verification-commands:
  - pnpm audit --audit-level=moderate
  - npm view @trpc/server license
accepted-cves: []
---

## Filter: license

MIT — on the workspace allowlist.

## Filter: types

Ships first-party TypeScript types; type-safe by design.

## Filter: maintenance

Active. Maintained by the tRPC team; v11 is the current stable line.

## Filter: boundary-fit

Core package. `@trpc/server` is also present in `core-api`; using the same version in `core-trpc` for router type inference is the intended usage pattern.

## Filter: shadow-check

`@trpc/server` is workspace-present via `core-api`. Same major version; no shadow.

## Filter: eu-residency

Server-side RPC framework; no vendor data transmission. n/a.

## Filter: cve-scan

No advisories at adoption time.

## Filter: named-consumer

`core-trpc` re-exports tRPC router types and the `t` initializer used by feature routers.

## Prompt: replaces

Nothing — tRPC is already the workspace API layer via `core-api`.

## Prompt: migration-cost-out

Hard: router types, procedure definitions, and middleware are tRPC-shaped across the entire workspace.

## Prompt: alternatives-considered

1. **REST + OpenAPI** — loses end-to-end type safety; see ADR-022 context for why this was rejected.
2. **GraphQL** — significantly heavier; not aligned with the workspace API shape.
tRPC is the locked workspace API library.
