CodeVetter · Repo Unpack · Contributor handoff
blitz-js/blitz
Start with the owning package and follow its browser/server boundary before changing behavior. Preserve the distinction between example applications, generated templates, and library implementations. Tests and CI were inspected, not executed; suggested checks require separate execution authority and isolated fixtures. This investigation is bounded, and identified risks remain source observations or labeled hypotheses.
- Read package.json and turbo.json first: pnpm is enforced, package builds precede tests, and build:apps deliberately runs with concurrency one.
- For RPC edits, read the client loader, server loader, browser rpc.ts, and index-server.ts together; browser substitution and server registration must agree on resolver paths.
- For auth edits, inspect auth-plugin.ts, auth-sessions.ts, and client/index.tsx together; storage persistence, cookie propagation, CSRF hooks, and browser state are distributed across them.
- Keep the toolkit-app login fixture distinct from the generated App Router login: the former skips authenticateUser, while the latter verifies credentials and excludes hashedPassword from the returned user.
- Maintain both RPC handlers when changing protocol behavior; their request APIs and context construction differ, and the App Router route exports GET, POST, and HEAD.
- For generation changes, read Generator.run and AppGenerator.preCommit/postWrite before editing templates: the lifecycle renames RPC endpoints, relocates auth files, installs dependencies, and may commit.
- When test execution is separately authorized, start with the owning package's vitest run script and relevant resolver, loader-path, plugin, or cookie-append suite; no such tests were executed for this report.
- Inspected CI uses filtered package/app tests and a generated integration matrix; CI configuration was read, not executed, and no current CI success is established.
- Integration testing needs an isolated database and runtime: the inspected App Router setup invokes prisma migrate reset --force, launches servers, and opens browser sessions.
- Do not use clean, format, lint, or publication scripts as harmless read-only checks: root clean removes node_modules, format writes files, package lint uses --fix, and pre-publish commits changes.
- Verify package scripts before selecting application checks: toolkit-app uses test:local with Prisma generation, apps/web uses Jest, and next13's manifest lists no test script.
- Prefer current manifests and CI over CONTRIBUTING.md's legacy test setup notes: the document mentions chromedriver, Rust/native Next packages, and Yarn, whereas inspected integration CI installs Playwright and uses pnpm.