---
package: "@trpc/server"
version: "^11.0.0"
tier: core
decision: approved
date: 2026-05-14
deciders: [scaffolded]
adr: adr-018
filter-results:
  license: MIT
  types: native
  maintenance: active
  boundary-fit: pass
  shadow-check: pass
  eu-residency: n/a
  cve-scan: clean
  named-consumer: pass
verification-commands:
  - pnpm audit --audit-level=moderate
  - npm view @trpc/server license
accepted-cves: []
---

## Filter: license

MIT — on the workspace allowlist.

## Filter: types

Ships first-party TypeScript types; fully type-safe by design.

## Filter: maintenance

Active. Maintained by the tRPC team; v11 is the current stable line.

## Filter: boundary-fit

Core package. `@trpc/server` is already present in `core-api` (workspace dependency). Using it in `core-audit` for the audit API router does not violate boundary rules.

## Filter: shadow-check

`@trpc/server` is workspace-present via `core-api`. Same major version; no shadow.

## Filter: eu-residency

Server-side RPC library; no vendor data transmission. n/a.

## Filter: cve-scan

No advisories at adoption time.

## Filter: named-consumer

`core-audit` exposes an audit-log tRPC router used by the `apps/web-next` API layer.

## Prompt: replaces

Nothing new — tRPC is already the API layer; this extends it to the audit surface.

## Prompt: migration-cost-out

Hard: router procedures, input schemas, and error-mapping middleware are tRPC-shaped. Removal would require replacing the audit API surface.

## Prompt: alternatives-considered

1. **REST endpoints** — loses end-to-end type safety already established via tRPC.
2. **GraphQL** — much heavier; not aligned with existing workspace API shape.
tRPC is the locked workspace API library; extending it to audit is the natural fit.
