# blitz-js/blitz — codebase unpack

> Canonical page: https://codevetter.com/unpack/blitz

This is a deterministic Repo Unpack scan of blitz-js/blitz — a structural map, not a review, security audit, or maintainer-endorsed description.

- Scanned commit: b18f81873e641934043f791fec06e22f5fe5a86e (2025-09-11)
- Last upstream commit: Version Packages (#4429)
- Generated by codevetter 1.15.0 on 2026-10-02
- 916 files scanned · 1.8 MB

Source inspection; upstream code and tests were not executed.

## Languages

- TypeScript: 596 files
- JavaScript: 73 files
- JSON: 72 files
- Markdown: 31 files
- SQL: 12 files
- TOML: 12 files
- CSS: 10 files
- YAML: 8 files

## Repository structure

- packages/ — 417 files
- integration-tests/ — 256 files
- apps/ — 208 files
- .github/ — 10 files
- assets/ — 2 files
- .husky/ — 2 files
- .changeset/ — 2 files

Probable source entrypoint: `packages/` (inferred from the tree, not upstream docs)

## Source layout — packages/

- packages/blitz-rpc/ — 12 files

## Package

- package.json: blitz-root v0.0.0 — 14 declared dependencies

## Structural health signals

Average score 8/10 across 96 files; 5 hotspots. These are deterministic review leads, not proof of a bug.

## Recent history

- b18f81873e64 (2025-09-11) Version Packages (#4429)
- 83b6be7ad52d (2025-09-11) Upgrade cookie-session dependency to v2.1.1 (#4442)
- 0ef8de04b371 (2025-03-03) fix:  Overriden custom cookies with pages router (#4427)
- 107254ece957 (2025-02-24) Version Packages (#4425)
- 816330b9d0a6 (2025-02-24) fix: Overriden custom cookies used inside `withBlitzAuth` (#4424)

## Overview

Blitz is a fullstack toolkit for Next.js developers, distributed as cooperating packages for application scaffolding, RPC, authentication, and Next.js integration. Its distinctive feature is a build-time transformation that turns imported query and mutation functions into browser RPC clients while retaining server implementations. This brief examines public source at commit b18f81873e641934043f791fec06e22f5fe5a86e, including application fixtures and tests; it is a bounded source investigation, not an executed validation or exhaustive inventory.

## System map

The repository separates shared Blitz facilities from authentication, RPC, and Next.js adaptation. Browser and server package entrypoints expose different runtime surfaces, while build loaders connect application resolver imports to HTTP endpoints. Example apps and integration projects consume the same versioned packages and own their databases. Root orchestration builds packages and applications and releases packages through Changesets.
- The workspace spans apps, packages, integration-tests, and recipes; package.json pins pnpm@8.6.6 and delegates build, lint, and test to Turbo. — [package.json#L5-18](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/package.json#L5-L18) [package.json#L41-42](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/package.json#L41-L42) [pnpm-workspace.yaml#L1-5](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/pnpm-workspace.yaml#L1-L5)
- The blitz executable loads dist/index.cjs; CLI dispatch lazily imports development, build, start, export, scaffolding, generation, codegen, database, console, and route commands. — [packages/blitz/bin/blitz#L1-2](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz/bin/blitz#L1-L2) [packages/blitz/src/cli/index.ts#L29-40](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz/src/cli/index.ts#L29-L40)
- blitz, @blitzjs/next, @blitzjs/rpc, and @blitzjs/auth declare server CJS/ESM entrypoints, a browser entrypoint, and server type declarations. — [packages/blitz/package.json#L18-21](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz/package.json#L18-L21) [packages/blitz-next/package.json#L19-22](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-next/package.json#L19-L22) [packages/blitz-rpc/package.json#L18-21](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/package.json#L18-L21) [packages/blitz-auth/package.json#L18-21](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/package.json#L18-L21)
- setupBlitzServer initializes logging, reduces server plugins, and returns gSSP, gSP, api, and plugin exports; setupBlitzClient returns a withBlitz app wrapper and client plugin exports. — [packages/blitz-next/src/index-server.ts#L140-154](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-next/src/index-server.ts#L140-L154) [packages/blitz-next/src/index-server.ts#L219-237](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-next/src/index-server.ts#L219-L237) [packages/blitz-next/src/index-browser.tsx#L77-94](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-next/src/index-browser.tsx#L77-L94)
- withBlitz installs RPC Webpack rules or Turbopack rules and starts route-manifest watching outside production and test modes. — [packages/blitz-next/src/index-server.ts#L250-278](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-next/src/index-server.ts#L250-L278) [packages/blitz-next/src/index-server.ts#L312-333](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-next/src/index-server.ts#L312-L333)
- Authentication storage is supplied by the application: PrismaStorage implements session CRUD, while the toolkit-app fixture models User, Session, and Token in SQLite. — [packages/blitz-auth/src/server/auth-plugin.ts#L42-70](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/server/auth-plugin.ts#L42-L70) [apps/toolkit-app/db/schema.prisma#L4-11](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/apps/toolkit-app/db/schema.prisma#L4-L11) [apps/toolkit-app/db/schema.prisma#L15-58](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/apps/toolkit-app/db/schema.prisma#L15-L58)
- Both Next router architectures are represented: toolkit-app wraps rpcHandler with api, whereas next13 exports GET, POST, and HEAD from withBlitzAuth(rpcAppHandler()). — [apps/toolkit-app/src/pages/api/rpc/[[...blitz]].ts#L1-16](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/apps/toolkit-app/src/pages/api/rpc/%5B%5B...blitz%5D%5D.ts#L1-L16) [apps/next13/src/app/api/rpc/[[...blitz]]/route.ts#L1-4](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/apps/next13/src/app/api/rpc/%5B%5B...blitz%5D%5D/route.ts#L1-L4)
- Turbo builds dependencies before build/buildapp/test tasks and records dist, .next, or coverage outputs; development tasks are persistent and uncached. — [turbo.json#L3-21](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/turbo.json#L3-L21)
- Deployment-related source includes Next build/start scripts in example apps and npm package publication through a main-branch Changesets release workflow. — [apps/toolkit-app-passportjs/package.json#L4-11](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/apps/toolkit-app-passportjs/package.json#L4-L11) [apps/next13/package.json#L5-9](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/apps/next13/package.json#L5-L9) [.github/workflows/release.yml#L3-6](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/.github/workflows/release.yml#L3-L6) [.github/workflows/release.yml#L37-53](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/.github/workflows/release.yml#L37-L53)

## Feature catalog

Blitz exposes developer-facing commands and application-facing APIs rather than one standalone product UI. Its primary capabilities are application creation, CRUD scaffolding, imported-function RPC, React Query integration, and session-based authentication. Next.js wrappers add server prefetching, serialized props, redirects, and error handling. Sample applications demonstrate password and OAuth flows, with explicit fixture limitations.
- The CLI supports dev, build, start, export, new, generate, codegen, db, console, and routes, with short aliases for common commands and an environment-information mode. — [packages/blitz/src/cli/index.ts#L29-51](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz/src/cli/index.ts#L29-L51) [packages/blitz/src/cli/index.ts#L87-125](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz/src/cli/index.ts#L87-L125)
- blitz new offers App Router full setup, Pages Router full setup, and minimal Pages Router setup, plus package-manager, form-library, language, dry-run, skip-install, and no-git options. — [packages/blitz/src/cli/commands/new.ts#L33-45](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz/src/cli/commands/new.ts#L33-L45) [packages/blitz/src/cli/commands/new.ts#L56-68](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz/src/cli/commands/new.ts#L56-L68) [packages/blitz/src/cli/commands/new.ts#L125-134](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz/src/cli/commands/new.ts#L125-L134)
- blitz generate maps all, crud, model, pages, queries, query, mutations, mutation, resource, and custom-templates to generator classes; page generation selects RouteGenerator when src/app/layout.tsx exists. — [packages/blitz/src/cli/commands/generate.ts#L28-39](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz/src/cli/commands/generate.ts#L28-L39) [packages/blitz/src/cli/commands/generate.ts#L73-103](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz/src/cli/commands/generate.ts#L73-L103)
- The routes command renders HTTP method, source file, route path, and route type; db seed imports a default seed function and disconnects the application database afterward. — [packages/blitz/src/cli/commands/routes.ts#L18-61](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz/src/cli/commands/routes.ts#L18-L61) [packages/blitz/src/cli/commands/db.ts#L24-56](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz/src/cli/commands/db.ts#L24-L56)
- RPC browser exports include invoke-related client APIs, query and suspense hooks, infinite and paginated queries, mutations, query keys, invalidation, and cache access. — [packages/blitz-rpc/src/index-browser.tsx#L1-35](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/index-browser.tsx#L1-L35)
- resolver.pipe composes ordered stages, resolver.zod selects synchronous or asynchronous parsing, and resolver.authorize delegates access checks to the initialized session. — [packages/blitz-rpc/src/server/resolvers/resolver.ts#L254-291](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/server/resolvers/resolver.ts#L254-L291) [packages/blitz-rpc/src/server/resolvers/resolver.ts#L294-320](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/server/resolvers/resolver.ts#L294-L320)
- gSSP and gSP provide resolver prefetch helpers, normalize redirects, dehydrate query state, and serialize props with SuperJSON. — [packages/blitz-next/src/index-server.ts#L110-137](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-next/src/index-server.ts#L110-L137) [packages/blitz-next/src/index-server.ts#L163-216](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-next/src/index-server.ts#L163-L216) [packages/blitz-next/src/index-server.ts#L345-367](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-next/src/index-server.ts#L345-L367)
- Client authentication exports useSession, useAuthorize, useAuthorizeIf, useRedirectAuthenticated, useAuthenticatedSession, and getAntiCSRFToken. — [packages/blitz-auth/src/client/index.tsx#L453-460](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/client/index.tsx#L453-L460)
- SessionContextClass exposes authorization, session creation and revocation, public-data updates, and private-data reads/writes; simpleRolesIsAuthorized accepts one role or an array of roles. — [packages/blitz-auth/src/server/auth-sessions.ts#L134-172](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/server/auth-sessions.ts#L134-L172) [packages/blitz-auth/src/server/auth-sessions.ts#L435-459](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/server/auth-sessions.ts#L435-L459) [packages/blitz-auth/src/server/auth-sessions.ts#L486-546](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/server/auth-sessions.ts#L486-L546)
- The sample password-recovery feature generates four-hour reset tokens, stores hashes, sends a mailer request, changes the password, deletes sessions, and logs the user in. — [apps/toolkit-app/src/auth/mutations/forgotPassword.ts#L7-34](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/apps/toolkit-app/src/auth/mutations/forgotPassword.ts#L7-L34) [apps/toolkit-app/src/auth/mutations/resetPassword.ts#L12-48](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/apps/toolkit-app/src/auth/mutations/resetPassword.ts#L12-L48)
- passportAuth supports configured strategies and callback session creation; NextAuthAdapter exposes provider-based login/callback handling using NextAuth internals. — [packages/blitz-auth/src/server/adapters/passport/adapter.ts#L73-105](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/server/adapters/passport/adapter.ts#L73-L105) [packages/blitz-auth/src/server/adapters/passport/adapter.ts#L149-165](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/server/adapters/passport/adapter.ts#L149-L165) [packages/blitz-auth/src/server/adapters/next-auth/adapter.ts#L47-65](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/server/adapters/next-auth/adapter.ts#L47-L65) [packages/blitz-auth/src/server/adapters/next-auth/adapter.ts#L109-129](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/server/adapters/next-auth/adapter.ts#L109-L129)
- Additional public utilities include bounded pagination, an ErrorBoundary that handles RedirectError and route resets, and codemod commands upgrade-legacy and secure-password. — [packages/blitz/src/paginate.ts#L13-64](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz/src/paginate.ts#L13-L64) [packages/blitz-next/src/error-boundary.tsx#L101-144](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-next/src/error-boundary.tsx#L101-L144) [packages/codemod/src/index.ts#L15-28](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/codemod/src/index.ts#L15-L28)

## Data flow

Resolver paths and implementations are established during bundling, while browser calls carry SuperJSON data through fetch and plugin middleware. Server handlers deserialize inputs, invoke the registered resolver, serialize results or errors, and propagate session changes. Authentication maintains separate server persistence and browser public-state representations. Generation has a different data path: template values become staged filesystem edits and optional installation operations.
- loader-client derives resolver name, type, route, and HTTP method from a resolver file and emits a replacement default export calling __internal_buildRpcClient. — [packages/blitz-rpc/src/server/loader/client/loader-client.ts#L48-91](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/server/loader/client/loader-client.ts#L48-L91)
- loader-server discovers resolver files recursively and appends __internal_addBlitzRpcResolver registrations using require or dynamic import. — [packages/blitz-rpc/src/server/loader/server/loader-server.ts#L65-98](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/server/loader/server/loader-server.ts#L65-L98) [packages/blitz-rpc/src/server/loader/server/loader-server.ts#L116-156](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/server/loader/server/loader-server.ts#L116-L156)
- useMutation sanitizes its resolver and forwards variables to the RPC client through TanStack mutateAsync; useQuery supplies query keys and an AbortSignal. — [packages/blitz-rpc/src/query/react-query/react-query.ts#L105-122](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/query/react-query/react-query.ts#L105-L122) [packages/blitz-rpc/src/query/react-query/react-query.ts#L496-515](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/query/react-query/react-query.ts#L496-L515)
- The RPC client serializes input with SuperJSON, places POST data in params/meta, includes cookies with fetch credentials, and runs beforeHttpRequest/beforeHttpResponse hooks. — [packages/blitz-rpc/src/client/rpc.ts#L66-108](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/client/rpc.ts#L66-L108)
- Pages rpcHandler selects a resolver using req.query.blitz, deserializes request data, executes with res.blitzCtx, and sends result plus SuperJSON metadata. — [packages/blitz-rpc/src/index-server.ts#L241-267](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/index-server.ts#L241-L267) [packages/blitz-rpc/src/index-server.ts#L286-320](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/index-server.ts#L286-L320)
- Browser success handling deserializes result metadata and can write directly invoked results to global queryClient; serialized errors dispatch blitz:rpc-error and are rethrown. — [packages/blitz-rpc/src/client/rpc.ts#L124-150](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/client/rpc.ts#L124-L150)
- AuthClientPlugin adds the anti-csrf header, backs up the CSRF cookie, updates PublicDataStore when response headers signal changes, and emits blitz:session-created. — [packages/blitz-auth/src/client/index.tsx#L419-443](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/client/index.tsx#L419-L443)
- Authenticated session creation stores a SHA-256 token hash, expiration, CSRF token, and JSON public/private data through the configured storage, then emits session, CSRF, and public-data cookies. — [packages/blitz-auth/src/server/auth-sessions.ts#L1005-1026](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/server/auth-sessions.ts#L1005-L1026) [packages/blitz-auth/src/server/auth-plugin.ts#L46-55](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/server/auth-plugin.ts#L46-L55)
- Anonymous session creation signs a JWT and emits cookies without a session-row creation in that branch; private-data writes can later create a row for the anonymous handle. — [packages/blitz-auth/src/server/auth-sessions.ts#L948-977](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/server/auth-sessions.ts#L948-L977) [packages/blitz-auth/src/server/auth-sessions.ts#L1182-1199](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/server/auth-sessions.ts#L1182-L1199)
- PublicDataStore decodes the browser public-data token and uses localStorage timestamps as a cross-tab notification bus; useSession subscribes React state to its observable. — [packages/blitz-auth/src/client/index.tsx#L43-87](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/client/index.tsx#L43-L87) [packages/blitz-auth/src/client/index.tsx#L100-115](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/client/index.tsx#L100-L115) [packages/blitz-auth/src/client/index.tsx#L175-184](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/client/index.tsx#L175-L184)
- Password recovery sends the plaintext reset token to the mailer while storing hash256(token); resetPassword hashes the submitted token before looking it up. — [apps/toolkit-app/src/auth/mutations/forgotPassword.ts#L13-34](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/apps/toolkit-app/src/auth/mutations/forgotPassword.ts#L13-L34) [apps/toolkit-app/src/auth/mutations/resetPassword.ts#L14-19](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/apps/toolkit-app/src/auth/mutations/resetPassword.ts#L14-L19)
- Generator.process applies conditional AST transforms, template substitution, optional TypeScript removal, and formatting; Generator.run stages edits, invokes preCommit, commits through ConflictChecker, and conditionally runs postWrite. — [packages/generator/src/generator.ts#L325-383](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/generator/src/generator.ts#L325-L383) [packages/generator/src/generator.ts#L477-528](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/generator/src/generator.ts#L477-L528)

## Behavior traces

The investigation followed startup, browser login, subsequent session validation, password recovery, and application generation through their actual implementations. Startup includes code generation before spawning Next.js. Login crosses build-time resolver substitution, browser transport, middleware, database access, and cookie propagation. Persistence is revisited on later requests, while password reset and scaffolding have their own ordered side effects.
- Startup begins at bin/blitz → CLI main → commands.dev; main establishes NODE_ENV, loads environment configuration, and dispatches the command after handling common flags. — [packages/blitz/bin/blitz#L1-2](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz/bin/blitz#L1-L2) [packages/blitz/src/cli/index.ts#L129-161](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz/src/cli/index.ts#L129-L161) [packages/blitz/src/cli/commands/next/dev.ts#L5-28](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz/src/cli/commands/next/dev.ts#L5-L28)
- dev command → next-commands.dev → normalize → codegenTasks → nextStartDev, unless a custom server exists, in which case startCustomServer is selected. — [packages/blitz/src/cli/commands/next/dev.ts#L20-28](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz/src/cli/commands/next/dev.ts#L20-L28) [packages/blitz/src/cli/utils/next-commands.ts#L22-35](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz/src/cli/utils/next-commands.ts#L22-L35)
- codegenTasks patches Next client recovery handling, calls generateManifest, and may run Prisma generate; generateManifest writes JS and type files under the located node_modules/.blitz. — [packages/blitz/src/cli/utils/codegen-tasks.ts#L17-71](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz/src/cli/utils/codegen-tasks.ts#L17-L71) [packages/blitz/src/cli/utils/codegen-tasks.ts#L74-104](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz/src/cli/utils/codegen-tasks.ts#L74-L104) [packages/blitz/src/cli/utils/routes-manifest.ts#L544-556](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz/src/cli/utils/routes-manifest.ts#L544-L556)
- nextStartDev detects a port, sets BLITZ_DEV_SERVER_ORIGIN, filters framework names from process arguments, and spawns the resolved Next executable with inherited stdio. — [packages/blitz/src/cli/utils/next-utils.ts#L155-188](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz/src/cli/utils/next-utils.ts#L155-L188)
- Login submission follows LoginForm.onSubmit → loginMutation from useMutation → enhancedResolverRpcClient → fetch, with the imported login module replaced by loader-client in browser builds. — [apps/toolkit-app/src/auth/components/LoginForm.tsx#L14-37](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/apps/toolkit-app/src/auth/components/LoginForm.tsx#L14-L37) [packages/blitz-rpc/src/query/react-query/react-query.ts#L496-515](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/query/react-query/react-query.ts#L496-L515) [packages/blitz-rpc/src/server/loader/client/loader-client.ts#L80-91](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/server/loader/client/loader-client.ts#L80-L91) [packages/blitz-rpc/src/client/rpc.ts#L82-105](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/client/rpc.ts#L82-L105)
- The sample Pages login request follows api → handleRequestWithMiddleware → auth session middleware/getSession → rpcHandler → login resolver; its default resolver reads the user by email and calls session.$create. — [packages/blitz-next/src/index-server.ts#L219-228](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-next/src/index-server.ts#L219-L228) [packages/blitz-auth/src/server/auth-plugin.ts#L114-121](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/server/auth-plugin.ts#L114-L121) [packages/blitz-rpc/src/index-server.ts#L286-304](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/index-server.ts#L286-L304) [apps/toolkit-app/src/auth/mutations/login.ts#L25-32](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/apps/toolkit-app/src/auth/mutations/login.ts#L25-L32)
- session.$create → createNewSession → storage.createSession persists the authenticated session and updates cookies; rpcHandler calls setSession before responding, and AuthClientPlugin converts the response signals into browser session updates. — [packages/blitz-auth/src/server/auth-sessions.ts#L486-499](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/server/auth-sessions.ts#L486-L499) [packages/blitz-auth/src/server/auth-sessions.ts#L1005-1026](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/server/auth-sessions.ts#L1005-L1026) [packages/blitz-rpc/src/index-server.ts#L308-320](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/index-server.ts#L308-L320) [packages/blitz-auth/src/client/index.tsx#L433-443](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/client/index.tsx#L433-L443)
- On a later authenticated request, getSession → getSessionKernel → parseSessionToken → storage.getSession checks version, persisted token hash, expiration, and CSRF; eligible non-GET requests can call refreshSession. — [packages/blitz-auth/src/server/auth-sessions.ts#L235-262](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/server/auth-sessions.ts#L235-L262) [packages/blitz-auth/src/server/auth-sessions.ts#L790-833](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/server/auth-sessions.ts#L790-L833) [packages/blitz-auth/src/server/auth-sessions.ts#L843-875](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/server/auth-sessions.ts#L843-L875)
- Password recovery follows resolver.zod(ForgotPassword) → user lookup → token generation/hash → deletion of prior reset tokens → token.create → forgotPasswordMailer.send; the absent-user branch waits 750 ms and returns the same result. — [apps/toolkit-app/src/auth/mutations/forgotPassword.ts#L9-41](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/apps/toolkit-app/src/auth/mutations/forgotPassword.ts#L9-L41) [apps/toolkit-app/mailers/forgotPasswordMailer.ts#L13-42](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/apps/toolkit-app/mailers/forgotPasswordMailer.ts#L13-L42)
- Password reset follows ResetPassword.parse → hash256/token.findFirst → token.delete → expiration check → SecurePassword.hash/user.update → session.deleteMany → login. — [apps/toolkit-app/src/auth/mutations/resetPassword.ts#L12-48](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/apps/toolkit-app/src/auth/mutations/resetPassword.ts#L12-L48)
- Application creation follows newApp's interactive selections → AppGenerator.run → write/preCommit/conflict checking → postWrite; postWrite updates dependency versions, optionally installs packages, invokes onPostInstall, formats, and commits Git changes. — [packages/blitz/src/cli/commands/new.ts#L209-268](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz/src/cli/commands/new.ts#L209-L268) [packages/generator/src/generator.ts#L477-528](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/generator/src/generator.ts#L477-L528) [packages/generator/src/generators/app-generator.ts#L144-178](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/generator/src/generators/app-generator.ts#L144-L178) [packages/generator/src/generators/app-generator.ts#L245-286](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/generator/src/generators/app-generator.ts#L245-L286)

## Testing signals

Tests and CI were inspected, not executed; no passing result is asserted. The examined suites mix Vitest unit tests, database-backed application tests, and integration tests that launch Next.js and browsers. CI describes package/app checks and dynamically selected integration projects on Linux and Windows. Coverage is uneven: some tests exercise real assertions, while an application-generator test is effectively a placeholder.
- Core toolkit package manifests define vitest run, and root test delegates to turbo run test; these commands were inspected only, not executed. — [package.json#L11-18](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/package.json#L11-L18) [packages/blitz/package.json#L9-16](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz/package.json#L9-L16) [packages/blitz-auth/package.json#L9-16](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/package.json#L9-L16) [packages/blitz-rpc/package.json#L9-16](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/package.json#L9-L16)
- The inspected resolver suite checks value propagation through default, synchronous, and asynchronous Zod stages using a mocked session.$authorize. — [packages/blitz-rpc/src/server/resolvers/resolver.test.ts#L6-15](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/server/resolvers/resolver.test.ts#L6-L15) [packages/blitz-rpc/src/server/resolvers/resolver.test.ts#L18-60](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/server/resolvers/resolver.test.ts#L18-L60)
- auth-sessions.test.ts tests append cookie merging, replacement, expiration-cookie combinations, and preservation of custom cookies; its named auth flows manipulate cookie strings rather than execute getSession or storage. — [packages/blitz-auth/src/server/auth-sessions.test.ts#L26-31](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/server/auth-sessions.test.ts#L26-L31) [packages/blitz-auth/src/server/auth-sessions.test.ts#L47-124](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/server/auth-sessions.test.ts#L47-L124) [packages/blitz-auth/src/server/auth-sessions.test.ts#L189-224](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/server/auth-sessions.test.ts#L189-L224)
- Plugin tests assert merge and pipe behavior and reducer exports/middleware presence, including distinct request-header hooks. — [packages/blitz/tests/plugin.test.ts#L7-23](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz/tests/plugin.test.ts#L7-L23) [packages/blitz/tests/plugin.test.ts#L26-43](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz/tests/plugin.test.ts#L26-L43) [packages/blitz/tests/plugin.test.ts#L92-99](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz/tests/plugin.test.ts#L92-L99)
- Loader utility tests assert default versus root resolver paths and include a Windows-path case. — [packages/blitz-rpc/src/server/loader/utils/loader-utils.test.ts#L4-51](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/server/loader/utils/loader-utils.test.ts#L4-L51)
- Forgot-password tests reset the database, mock token generation and email preview, and assert replacement token fields and a nonthrowing absent-user result. — [apps/toolkit-app/src/auth/mutations/forgotPassword.test.ts#L8-25](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/apps/toolkit-app/src/auth/mutations/forgotPassword.test.ts#L8-L25) [apps/toolkit-app/src/auth/mutations/forgotPassword.test.ts#L46-62](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/apps/toolkit-app/src/auth/mutations/forgotPassword.test.ts#L46-L62)
- Reset-password tests assert rejection for a non-existent-token input with empty passwords and for an expired token, and check successful token deletion and password verification; session.$create is mocked and this test does not assert session revocation. — [apps/toolkit-app/src/auth/mutations/resetPassword.test.ts#L11-15](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/apps/toolkit-app/src/auth/mutations/resetPassword.test.ts#L11-L15) [apps/toolkit-app/src/auth/mutations/resetPassword.test.ts#L55-82](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/apps/toolkit-app/src/auth/mutations/resetPassword.test.ts#L55-L82)
- The AppGenerator test's active 'runs' body immediately returns; Git-related expectations below it are commented out. — [packages/generator/test/generators/app-generator.test.ts#L69-94](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/generator/test/generators/app-generator.test.ts#L69-L94) [packages/generator/test/generators/app-generator.test.ts#L103-125](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/generator/test/generators/app-generator.test.ts#L103-L125)
- The App Router integration fixture checks unauthenticated client/server queries, cookie creation, RPC query results, login, and HEAD CSRF exemption, then runs its assertions in Webpack and Turbopack development modes. — [integration-tests/next-13-app-dir/test/index.test.ts#L29-88](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/integration-tests/next-13-app-dir/test/index.test.ts#L29-L88) [integration-tests/next-13-app-dir/test/index.test.ts#L91-152](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/integration-tests/next-13-app-dir/test/index.test.ts#L91-L152) [integration-tests/next-13-app-dir/test/index.test.ts#L157-188](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/integration-tests/next-13-app-dir/test/index.test.ts#L157-L188)
- Middleware integration tests verify response headers on API and RPC requests in development and built-server modes. — [integration-tests/middleware/test/index.test.ts#L19-44](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/integration-tests/middleware/test/index.test.ts#L19-L44) [integration-tests/middleware/test/index.test.ts#L47-74](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/integration-tests/middleware/test/index.test.ts#L47-L74)
- Inspected CI builds and lints, filters package/app tests, discovers integration folders, installs Playwright, and excludes next-13-app-dir steps on Windows; workflow definitions do not establish successful execution. — [.github/workflows/main.yml#L28-53](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/.github/workflows/main.yml#L28-L53) [.github/workflows/main.yml#L89-111](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/.github/workflows/main.yml#L89-L111) [.github/workflows/main.yml#L113-161](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/.github/workflows/main.yml#L113-L161)
- Test configuration needs package-level checking: toolkit-app exposes test:local rather than test and references ./test/setup.ts, while apps/web uses Jest; this bounded inspection does not establish comprehensive repository coverage. — [apps/toolkit-app/package.json#L4-12](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/apps/toolkit-app/package.json#L4-L12) [apps/toolkit-app/vitest.config.ts#L7-16](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/apps/toolkit-app/vitest.config.ts#L7-L16) [apps/web/package.json#L5-13](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/apps/web/package.json#L5-L13)

## Risk map

These are source observations and explicitly identified hypotheses, not confirmed vulnerabilities. The highest-impact boundaries are resolver exposure, authentication state, logging, and CLI filesystem/process side effects. Example applications contain behavior that differs materially from generated templates. Separate Pages and App Router implementations and upstream-internal imports create maintenance and verification obligations.
- The toolkit-app default login has authenticateUser commented out, ignores password after validation, creates a session for the email-matched user, and returns the full database user; this is sample-source behavior, not evidence about generated applications. — [apps/toolkit-app/src/auth/mutations/login.ts#L25-32](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/apps/toolkit-app/src/auth/mutations/login.ts#L25-L32) [packages/generator/templates/app/src/app/auth/mutations/login.ts#L8-28](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/generator/templates/app/src/app/auth/mutations/login.ts#L8-L28)
- RPC logging defaults to verbose and preResolver logs input data; a password-bearing resolver can therefore reach logging unless configured otherwise. Actual log exposure was not tested. — [packages/blitz-rpc/src/rpc-logger.ts#L19-35](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/rpc-logger.ts#L19-L35) [packages/blitz-rpc/src/rpc-logger.ts#L133-144](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/rpc-logger.ts#L133-L144) [packages/blitz-rpc/src/index-server.ts#L301-306](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/index-server.ts#L301-L306)
- Resolver discovery recursively registers query/mutation files, and rpcHandler executes registered defaults without automatically inserting resolver.authorize; authorization must be supplied by application code or its middleware. — [packages/blitz-rpc/src/server/loader/server/loader-server.ts#L116-156](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/server/loader/server/loader-server.ts#L116-L156) [packages/blitz-rpc/src/index-server.ts#L261-304](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/index-server.ts#L261-L304) [packages/blitz-rpc/src/server/resolvers/resolver.ts#L277-291](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/server/resolvers/resolver.ts#L277-L291)
- App Router GET handling is a source-level inconsistency: the branch permits GET but unconditionally calls req.json() and reads query payload fields from route params. Bodyless GET support requires runtime verification. — [packages/blitz-rpc/src/index-server.ts#L367-375](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/index-server.ts#L367-L375) [packages/blitz-rpc/src/index-server.ts#L401-425](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/index-server.ts#L401-L425) [packages/blitz-rpc/src/client/rpc.ts#L77-80](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/client/rpc.ts#L77-L80)
- App Router RPC invokes resolvers with only {session}, whereas Pages RPC passes res.blitzCtx; custom context fields do not follow the same handler path. — [packages/blitz-rpc/src/index-server.ts#L304-304](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/index-server.ts#L304-L304) [packages/blitz-rpc/src/index-server.ts#L428-430](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/index-server.ts#L428-L430) [packages/blitz-next/src/index-server.ts#L165-168](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-next/src/index-server.ts#L165-L168)
- CSRF protection can be disabled by DANGEROUSLY_DISABLE_CSRF_PROTECTION, and secure-cookie defaults can be disabled by DISABLE_SECURE_COOKIES; these switches are security-sensitive configuration inputs. — [packages/blitz-auth/src/server/auth-sessions.ts#L784-788](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/server/auth-sessions.ts#L784-L788) [packages/blitz-auth/src/server/auth-plugin.ts#L73-79](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/server/auth-plugin.ts#L73-L79)
- Core anonymous-session signing requires a production SESSION_SECRET_KEY of at least 32 characters, but OAuth cookie-session adapters directly include a default-dev-secret fallback; verify initialization and production configuration before assessing exposure. — [packages/blitz-auth/src/server/auth-sessions.ts#L608-627](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/server/auth-sessions.ts#L608-L627) [packages/blitz-auth/src/server/adapters/passport/adapter.ts#L38-41](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/server/adapters/passport/adapter.ts#L38-L41) [packages/blitz-auth/src/server/adapters/next-auth/adapter.ts#L67-70](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/server/adapters/next-auth/adapter.ts#L67-L70)
- Hypothesis: password reset can leave partial state on failures or concurrent consumption because token lookup/deletion, password update, and session deletion are separate awaited database operations in the inspected function. (inferred) — [apps/toolkit-app/src/auth/mutations/resetPassword.ts#L14-46](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/apps/toolkit-app/src/auth/mutations/resetPassword.ts#L14-L46)
- The sample forgotPasswordMailer throws in production and constructs an /auth/reset-password URL; its development preview is not evidence of production email delivery. — [apps/toolkit-app/mailers/forgotPasswordMailer.ts#L13-16](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/apps/toolkit-app/mailers/forgotPasswordMailer.ts#L13-L16) [apps/toolkit-app/mailers/forgotPasswordMailer.ts#L32-42](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/apps/toolkit-app/mailers/forgotPasswordMailer.ts#L32-L42)
- codegenTasks writes into the resolved Next installation using version-dependent regex patches and logs caught errors; startup codegen has effects beyond application source files. — [packages/blitz/src/cli/utils/codegen-tasks.ts#L17-29](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz/src/cli/utils/codegen-tasks.ts#L17-L29) [packages/blitz/src/cli/utils/codegen-tasks.ts#L31-71](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz/src/cli/utils/codegen-tasks.ts#L31-L71)
- AppGenerator postWrite retrieves dependency versions, installs packages, initializes Git, and can commit; newApp's post-install callback can migrate the database, so scaffolding is not a read-only inspection command. — [packages/generator/src/generators/app-generator.ts#L128-178](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/generator/src/generators/app-generator.ts#L128-L178) [packages/generator/src/generators/app-generator.ts#L298-309](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/generator/src/generators/app-generator.ts#L298-L309) [packages/blitz/src/cli/commands/new.ts#L239-252](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz/src/cli/commands/new.ts#L239-L252)
- Session capabilities have explicit incomplete branches: advanced mode throws during creation, and RSC mutation methods log unsupported operations and return. — [packages/blitz-auth/src/server/auth-sessions.ts#L486-526](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/server/auth-sessions.ts#L486-L526) [packages/blitz-auth/src/server/auth-sessions.ts#L539-543](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/server/auth-sessions.ts#L539-L543) [packages/blitz-auth/src/server/auth-sessions.ts#L1035-1040](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/server/auth-sessions.ts#L1035-L1040)
- NextAuthAdapter imports next-auth/core internals, and withBlitz locates/copies sodium-native prebuilds while swallowing copy-setup exceptions; both paths depend on external package layout. — [packages/blitz-auth/src/server/adapters/next-auth/adapter.ts#L18-34](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/server/adapters/next-auth/adapter.ts#L18-L34) [packages/blitz-next/src/index-server.ts#L280-302](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-next/src/index-server.ts#L280-L302)

## Extension points

The principal extension mechanisms are plugin factories and composition, storage contracts, resolver conventions, and generator subclasses. Applications choose their authentication storage and authorization policy. Bundler options control resolver naming and discovery, while handler callbacks control error reporting and formatting. New scaffolding behavior plugs into an existing lifecycle rather than requiring a separate generator framework.
- Server plugins supply requestMiddlewares, optional contextMiddleware, and exports; reduceBlitzServerPlugins flattens middleware and combines exports. — [packages/blitz/src/plugin.ts#L121-136](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz/src/plugin.ts#L121-L136)
- Client plugins supply request/response hooks, RPC/session events, exports, and provider wrappers; the reducer composes hooks, installs document listeners, and exposes withPlugins. — [packages/blitz/src/plugin.ts#L39-85](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz/src/plugin.ts#L39-L85) [packages/blitz/src/plugin.ts#L89-118](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz/src/plugin.ts#L89-L118)
- Plugin export-name precedence favors previously accumulated exports because reducers spread new plugin exports before existing ones; registration order is part of the composition contract. — [packages/blitz/src/plugin.ts#L72-73](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz/src/plugin.ts#L72-L73) [packages/blitz/src/plugin.ts#L128-134](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz/src/plugin.ts#L128-L134)
- AuthServerPlugin accepts a SessionConfigMethods storage implementation and an isAuthorized policy; PrismaStorage is one provided adapter. — [packages/blitz-auth/src/server/auth-plugin.ts#L42-70](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/server/auth-plugin.ts#L42-L70) [packages/blitz-auth/src/server/auth-plugin.ts#L82-94](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/server/auth-plugin.ts#L82-L94)
- BlitzServerMiddleware adapts a request middleware into a server plugin without additional exports. — [packages/blitz-next/src/index-server.ts#L381-391](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-next/src/index-server.ts#L381-L391)
- withBlitz exposes resolverPath, resolversDynamicImport, and includeRPCFolders; the RPC server defines resolverPath as conventional paths, root paths, or a custom mapping function. — [packages/blitz-next/src/index-server.ts#L239-247](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-next/src/index-server.ts#L239-L247) [packages/blitz-next/src/index-server.ts#L268-277](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-next/src/index-server.ts#L268-L277) [packages/blitz-rpc/src/index-server.ts#L34-42](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/index-server.ts#L34-L42)
- Resolvers plug in as default-exported functions; query modules can declare an HTTP-method configuration that loader-client extracts. — [packages/blitz-rpc/src/server/loader/client/loader-client.ts#L64-88](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/server/loader/client/loader-client.ts#L64-L88) [packages/blitz-rpc/src/index-server.ts#L261-267](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/index-server.ts#L261-L267)
- RPC handler configuration accepts onError, formatError, and logging; setupBlitzServer separately supports logger and error hooks. — [packages/blitz-rpc/src/index-server.ts#L235-241](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/index-server.ts#L235-L241) [packages/blitz-next/src/index-server.ts#L140-151](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-next/src/index-server.ts#L140-L151)
- Generator subclasses define sourceRoot, getTargetDirectory, templateValuesBuilder, and optional write/commit hooks; template variables can affect file contents and names. — [packages/generator/src/generator.ts#L250-291](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/generator/src/generator.ts#L250-L291) [packages/generator/src/generator.ts#L386-393](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/generator/src/generator.ts#L386-L393) [packages/generator/src/generator.ts#L446-475](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/generator/src/generator.ts#L446-L475) [packages/generator/README.md#L26-32](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/generator/README.md#L26-L32)
- The generatorMap is the CLI resource registry; custom-templates copies selected bundled templates and updates the exported cliConfig through an AST transform. — [packages/blitz/src/cli/commands/generate.ts#L41-68](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz/src/cli/commands/generate.ts#L41-L68) [packages/blitz/src/cli/commands/generate.ts#L77-103](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz/src/cli/commands/generate.ts#L77-L103) [packages/generator/src/generator.ts#L47-88](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/generator/src/generator.ts#L47-L88)
- Passport extension uses strategy objects with optional names and authenticateOptions; successful verification returns publicData/privateData for session creation. — [packages/blitz-auth/src/server/adapters/passport/adapter.ts#L73-105](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/server/adapters/passport/adapter.ts#L73-L105) [packages/blitz-auth/src/server/adapters/passport/adapter.ts#L149-161](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/server/adapters/passport/adapter.ts#L149-L161)
- The sample mailer explicitly reserves an integrations-based email-client boundary; implementing its production send method is application-owned work. — [apps/toolkit-app/mailers/forgotPasswordMailer.ts#L1-5](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/apps/toolkit-app/mailers/forgotPasswordMailer.ts#L1-L5) [apps/toolkit-app/mailers/forgotPasswordMailer.ts#L32-42](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/apps/toolkit-app/mailers/forgotPasswordMailer.ts#L32-L42)

## Contributor handoff

Start with the owning package and follow its browser/server boundary before changing behavior. Preserve the distinction between example applications, generated templates, and library implementations. Tests and CI were inspected, not executed; suggested checks require separate execution authority and isolated fixtures. This investigation is bounded, and identified risks remain source observations or labeled hypotheses.
- Read package.json and turbo.json first: pnpm is enforced, package builds precede tests, and build:apps deliberately runs with concurrency one. — [package.json#L11-18](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/package.json#L11-L18) [package.json#L41-42](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/package.json#L41-L42) [turbo.json#L4-14](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/turbo.json#L4-L14)
- For RPC edits, read the client loader, server loader, browser rpc.ts, and index-server.ts together; browser substitution and server registration must agree on resolver paths. — [packages/blitz-rpc/src/server/loader/client/loader-client.ts#L56-88](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/server/loader/client/loader-client.ts#L56-L88) [packages/blitz-rpc/src/server/loader/server/loader-server.ts#L80-94](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/server/loader/server/loader-server.ts#L80-L94) [packages/blitz-rpc/src/client/rpc.ts#L45-52](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/client/rpc.ts#L45-L52) [packages/blitz-rpc/src/index-server.ts#L251-261](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/index-server.ts#L251-L261)
- For auth edits, inspect auth-plugin.ts, auth-sessions.ts, and client/index.tsx together; storage persistence, cookie propagation, CSRF hooks, and browser state are distributed across them. — [packages/blitz-auth/src/server/auth-plugin.ts#L86-121](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/server/auth-plugin.ts#L86-L121) [packages/blitz-auth/src/server/auth-sessions.ts#L1005-1026](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/server/auth-sessions.ts#L1005-L1026) [packages/blitz-auth/src/client/index.tsx#L419-448](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/client/index.tsx#L419-L448)
- Keep the toolkit-app login fixture distinct from the generated App Router login: the former skips authenticateUser, while the latter verifies credentials and excludes hashedPassword from the returned user. — [apps/toolkit-app/src/auth/mutations/login.ts#L25-32](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/apps/toolkit-app/src/auth/mutations/login.ts#L25-L32) [packages/generator/templates/app/src/app/auth/mutations/login.ts#L8-28](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/generator/templates/app/src/app/auth/mutations/login.ts#L8-L28)
- Maintain both RPC handlers when changing protocol behavior; their request APIs and context construction differ, and the App Router route exports GET, POST, and HEAD. — [packages/blitz-rpc/src/index-server.ts#L241-249](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/index-server.ts#L241-L249) [packages/blitz-rpc/src/index-server.ts#L365-375](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/index-server.ts#L365-L375) [packages/blitz-rpc/src/index-server.ts#L428-430](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/index-server.ts#L428-L430) [packages/blitz-rpc/src/index-server.ts#L483-487](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/index-server.ts#L483-L487)
- For generation changes, read Generator.run and AppGenerator.preCommit/postWrite before editing templates: the lifecycle renames RPC endpoints, relocates auth files, installs dependencies, and may commit. — [packages/generator/src/generator.ts#L477-528](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/generator/src/generator.ts#L477-L528) [packages/generator/src/generators/app-generator.ts#L71-120](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/generator/src/generators/app-generator.ts#L71-L120) [packages/generator/src/generators/app-generator.ts#L171-178](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/generator/src/generators/app-generator.ts#L171-L178) [packages/generator/src/generators/app-generator.ts#L285-309](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/generator/src/generators/app-generator.ts#L285-L309)
- When test execution is separately authorized, start with the owning package's vitest run script and relevant resolver, loader-path, plugin, or cookie-append suite; no such tests were executed for this report. — [packages/blitz-rpc/package.json#L9-15](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/package.json#L9-L15) [packages/blitz-auth/package.json#L9-15](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/package.json#L9-L15) [packages/blitz-rpc/src/server/resolvers/resolver.test.ts#L6-15](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/server/resolvers/resolver.test.ts#L6-L15) [packages/blitz-auth/src/server/auth-sessions.test.ts#L26-31](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/server/auth-sessions.test.ts#L26-L31)
- Inspected CI uses filtered package/app tests and a generated integration matrix; CI configuration was read, not executed, and no current CI success is established. — [.github/workflows/main.yml#L89-111](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/.github/workflows/main.yml#L89-L111) [.github/workflows/main.yml#L113-161](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/.github/workflows/main.yml#L113-L161)
- Integration testing needs an isolated database and runtime: the inspected App Router setup invokes prisma migrate reset --force, launches servers, and opens browser sessions. — [integration-tests/next-13-app-dir/test/index.test.ts#L32-51](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/integration-tests/next-13-app-dir/test/index.test.ts#L32-L51) [integration-tests/next-13-app-dir/test/index.test.ts#L157-187](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/integration-tests/next-13-app-dir/test/index.test.ts#L157-L187)
- Do not use clean, format, lint, or publication scripts as harmless read-only checks: root clean removes node_modules, format writes files, package lint uses --fix, and pre-publish commits changes. — [package.json#L19-23](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/package.json#L19-L23) [packages/blitz/package.json#L12-15](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz/package.json#L12-L15)
- Verify package scripts before selecting application checks: toolkit-app uses test:local with Prisma generation, apps/web uses Jest, and next13's manifest lists no test script. — [apps/toolkit-app/package.json#L4-12](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/apps/toolkit-app/package.json#L4-L12) [apps/web/package.json#L5-13](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/apps/web/package.json#L5-L13) [apps/next13/package.json#L5-9](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/apps/next13/package.json#L5-L9)
- Prefer current manifests and CI over CONTRIBUTING.md's legacy test setup notes: the document mentions chromedriver, Rust/native Next packages, and Yarn, whereas inspected integration CI installs Playwright and uses pnpm. — [CONTRIBUTING.md#L5-18](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/CONTRIBUTING.md#L5-L18) [.github/workflows/main.yml#L130-161](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/.github/workflows/main.yml#L130-L161)

Source repository: https://github.com/blitz-js/blitz
Full evidence corpus: https://github.com/Codevetter/codevetter/tree/main/benchmarks/repo-unpacks/blitz.json

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)