tRPC Guidelines

Authentication

All authenticated procedures verify Ed25519 signatures:

• Verify signature matches pubkeyHash
• Verify timestamp is recent (prevent replay)
• Verify message matches request

Patterns

Router:

export const vaultRouter = router({
  create: authedProcedure
    .input(createVaultSchema)
    .mutation(async ({ ctx, input }) => { ... }),
});

Schema:

export const createVaultSchema = z.object({
  name: z.string().min(1).max(100),
  encryptedSnapshot: z.string(),
  wrappedKey: z.string(),
});

Critical Rules

1. Never trust client data - always validate with Zod
2. Never store unencrypted data - all sensitive data comes pre-encrypted
3. Verify signatures - every mutation must be signed
4. Check permissions - verify user has vault access
5. Use transactions - wrap multi-step operations

Error Handling

throw new TRPCError({
  code: "NOT_FOUND", // or "FORBIDDEN"
  message: "Vault not found",
});