# Contributor handoff — blitz-js/blitz

> Canonical page: https://codevetter.com/unpack/blitz/agent-handoff

# Contributor handoff — blitz-js/blitz

Scanned commit b18f81873e641934043f791fec06e22f5fe5a86e (2025-09-11). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

Start with the owning package and follow its browser/server boundary before changing behavior. Preserve the distinction between example applications, generated templates, and library implementations. Tests and CI were inspected, not executed; suggested checks require separate execution authority and isolated fixtures. This investigation is bounded, and identified risks remain source observations or labeled hypotheses.
- Read package.json and turbo.json first: pnpm is enforced, package builds precede tests, and build:apps deliberately runs with concurrency one. — [package.json#L11-18](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/package.json#L11-L18) [package.json#L41-42](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/package.json#L41-L42) [turbo.json#L4-14](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/turbo.json#L4-L14)
- For RPC edits, read the client loader, server loader, browser rpc.ts, and index-server.ts together; browser substitution and server registration must agree on resolver paths. — [packages/blitz-rpc/src/server/loader/client/loader-client.ts#L56-88](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/server/loader/client/loader-client.ts#L56-L88) [packages/blitz-rpc/src/server/loader/server/loader-server.ts#L80-94](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/server/loader/server/loader-server.ts#L80-L94) [packages/blitz-rpc/src/client/rpc.ts#L45-52](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/client/rpc.ts#L45-L52) [packages/blitz-rpc/src/index-server.ts#L251-261](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/index-server.ts#L251-L261)
- For auth edits, inspect auth-plugin.ts, auth-sessions.ts, and client/index.tsx together; storage persistence, cookie propagation, CSRF hooks, and browser state are distributed across them. — [packages/blitz-auth/src/server/auth-plugin.ts#L86-121](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/server/auth-plugin.ts#L86-L121) [packages/blitz-auth/src/server/auth-sessions.ts#L1005-1026](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/server/auth-sessions.ts#L1005-L1026) [packages/blitz-auth/src/client/index.tsx#L419-448](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/client/index.tsx#L419-L448)
- Keep the toolkit-app login fixture distinct from the generated App Router login: the former skips authenticateUser, while the latter verifies credentials and excludes hashedPassword from the returned user. — [apps/toolkit-app/src/auth/mutations/login.ts#L25-32](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/apps/toolkit-app/src/auth/mutations/login.ts#L25-L32) [packages/generator/templates/app/src/app/auth/mutations/login.ts#L8-28](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/generator/templates/app/src/app/auth/mutations/login.ts#L8-L28)
- Maintain both RPC handlers when changing protocol behavior; their request APIs and context construction differ, and the App Router route exports GET, POST, and HEAD. — [packages/blitz-rpc/src/index-server.ts#L241-249](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/index-server.ts#L241-L249) [packages/blitz-rpc/src/index-server.ts#L365-375](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/index-server.ts#L365-L375) [packages/blitz-rpc/src/index-server.ts#L428-430](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/index-server.ts#L428-L430) [packages/blitz-rpc/src/index-server.ts#L483-487](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/index-server.ts#L483-L487)
- For generation changes, read Generator.run and AppGenerator.preCommit/postWrite before editing templates: the lifecycle renames RPC endpoints, relocates auth files, installs dependencies, and may commit. — [packages/generator/src/generator.ts#L477-528](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/generator/src/generator.ts#L477-L528) [packages/generator/src/generators/app-generator.ts#L71-120](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/generator/src/generators/app-generator.ts#L71-L120) [packages/generator/src/generators/app-generator.ts#L171-178](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/generator/src/generators/app-generator.ts#L171-L178) [packages/generator/src/generators/app-generator.ts#L285-309](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/generator/src/generators/app-generator.ts#L285-L309)
- When test execution is separately authorized, start with the owning package's vitest run script and relevant resolver, loader-path, plugin, or cookie-append suite; no such tests were executed for this report. — [packages/blitz-rpc/package.json#L9-15](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/package.json#L9-L15) [packages/blitz-auth/package.json#L9-15](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/package.json#L9-L15) [packages/blitz-rpc/src/server/resolvers/resolver.test.ts#L6-15](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/server/resolvers/resolver.test.ts#L6-L15) [packages/blitz-auth/src/server/auth-sessions.test.ts#L26-31](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/server/auth-sessions.test.ts#L26-L31)
- Inspected CI uses filtered package/app tests and a generated integration matrix; CI configuration was read, not executed, and no current CI success is established. — [.github/workflows/main.yml#L89-111](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/.github/workflows/main.yml#L89-L111) [.github/workflows/main.yml#L113-161](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/.github/workflows/main.yml#L113-L161)
- Integration testing needs an isolated database and runtime: the inspected App Router setup invokes prisma migrate reset --force, launches servers, and opens browser sessions. — [integration-tests/next-13-app-dir/test/index.test.ts#L32-51](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/integration-tests/next-13-app-dir/test/index.test.ts#L32-L51) [integration-tests/next-13-app-dir/test/index.test.ts#L157-187](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/integration-tests/next-13-app-dir/test/index.test.ts#L157-L187)
- Do not use clean, format, lint, or publication scripts as harmless read-only checks: root clean removes node_modules, format writes files, package lint uses --fix, and pre-publish commits changes. — [package.json#L19-23](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/package.json#L19-L23) [packages/blitz/package.json#L12-15](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz/package.json#L12-L15)
- Verify package scripts before selecting application checks: toolkit-app uses test:local with Prisma generation, apps/web uses Jest, and next13's manifest lists no test script. — [apps/toolkit-app/package.json#L4-12](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/apps/toolkit-app/package.json#L4-L12) [apps/web/package.json#L5-13](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/apps/web/package.json#L5-L13) [apps/next13/package.json#L5-9](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/apps/next13/package.json#L5-L9)
- Prefer current manifests and CI over CONTRIBUTING.md's legacy test setup notes: the document mentions chromedriver, Rust/native Next packages, and Yarn, whereas inspected integration CI installs Playwright and uses pnpm. — [CONTRIBUTING.md#L5-18](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/CONTRIBUTING.md#L5-L18) [.github/workflows/main.yml#L130-161](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/.github/workflows/main.yml#L130-L161)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)