# Behavior traces — blitz-js/blitz

> Canonical page: https://codevetter.com/unpack/blitz/behavior-traces

# Behavior traces — blitz-js/blitz

Scanned commit b18f81873e641934043f791fec06e22f5fe5a86e (2025-09-11). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

The investigation followed startup, browser login, subsequent session validation, password recovery, and application generation through their actual implementations. Startup includes code generation before spawning Next.js. Login crosses build-time resolver substitution, browser transport, middleware, database access, and cookie propagation. Persistence is revisited on later requests, while password reset and scaffolding have their own ordered side effects.
- Startup begins at bin/blitz → CLI main → commands.dev; main establishes NODE_ENV, loads environment configuration, and dispatches the command after handling common flags. — [packages/blitz/bin/blitz#L1-2](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz/bin/blitz#L1-L2) [packages/blitz/src/cli/index.ts#L129-161](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz/src/cli/index.ts#L129-L161) [packages/blitz/src/cli/commands/next/dev.ts#L5-28](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz/src/cli/commands/next/dev.ts#L5-L28)
- dev command → next-commands.dev → normalize → codegenTasks → nextStartDev, unless a custom server exists, in which case startCustomServer is selected. — [packages/blitz/src/cli/commands/next/dev.ts#L20-28](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz/src/cli/commands/next/dev.ts#L20-L28) [packages/blitz/src/cli/utils/next-commands.ts#L22-35](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz/src/cli/utils/next-commands.ts#L22-L35)
- codegenTasks patches Next client recovery handling, calls generateManifest, and may run Prisma generate; generateManifest writes JS and type files under the located node_modules/.blitz. — [packages/blitz/src/cli/utils/codegen-tasks.ts#L17-71](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz/src/cli/utils/codegen-tasks.ts#L17-L71) [packages/blitz/src/cli/utils/codegen-tasks.ts#L74-104](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz/src/cli/utils/codegen-tasks.ts#L74-L104) [packages/blitz/src/cli/utils/routes-manifest.ts#L544-556](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz/src/cli/utils/routes-manifest.ts#L544-L556)
- nextStartDev detects a port, sets BLITZ_DEV_SERVER_ORIGIN, filters framework names from process arguments, and spawns the resolved Next executable with inherited stdio. — [packages/blitz/src/cli/utils/next-utils.ts#L155-188](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz/src/cli/utils/next-utils.ts#L155-L188)
- Login submission follows LoginForm.onSubmit → loginMutation from useMutation → enhancedResolverRpcClient → fetch, with the imported login module replaced by loader-client in browser builds. — [apps/toolkit-app/src/auth/components/LoginForm.tsx#L14-37](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/apps/toolkit-app/src/auth/components/LoginForm.tsx#L14-L37) [packages/blitz-rpc/src/query/react-query/react-query.ts#L496-515](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/query/react-query/react-query.ts#L496-L515) [packages/blitz-rpc/src/server/loader/client/loader-client.ts#L80-91](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/server/loader/client/loader-client.ts#L80-L91) [packages/blitz-rpc/src/client/rpc.ts#L82-105](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/client/rpc.ts#L82-L105)
- The sample Pages login request follows api → handleRequestWithMiddleware → auth session middleware/getSession → rpcHandler → login resolver; its default resolver reads the user by email and calls session.$create. — [packages/blitz-next/src/index-server.ts#L219-228](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-next/src/index-server.ts#L219-L228) [packages/blitz-auth/src/server/auth-plugin.ts#L114-121](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/server/auth-plugin.ts#L114-L121) [packages/blitz-rpc/src/index-server.ts#L286-304](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/index-server.ts#L286-L304) [apps/toolkit-app/src/auth/mutations/login.ts#L25-32](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/apps/toolkit-app/src/auth/mutations/login.ts#L25-L32)
- session.$create → createNewSession → storage.createSession persists the authenticated session and updates cookies; rpcHandler calls setSession before responding, and AuthClientPlugin converts the response signals into browser session updates. — [packages/blitz-auth/src/server/auth-sessions.ts#L486-499](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/server/auth-sessions.ts#L486-L499) [packages/blitz-auth/src/server/auth-sessions.ts#L1005-1026](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/server/auth-sessions.ts#L1005-L1026) [packages/blitz-rpc/src/index-server.ts#L308-320](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/index-server.ts#L308-L320) [packages/blitz-auth/src/client/index.tsx#L433-443](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/client/index.tsx#L433-L443)
- On a later authenticated request, getSession → getSessionKernel → parseSessionToken → storage.getSession checks version, persisted token hash, expiration, and CSRF; eligible non-GET requests can call refreshSession. — [packages/blitz-auth/src/server/auth-sessions.ts#L235-262](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/server/auth-sessions.ts#L235-L262) [packages/blitz-auth/src/server/auth-sessions.ts#L790-833](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/server/auth-sessions.ts#L790-L833) [packages/blitz-auth/src/server/auth-sessions.ts#L843-875](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/server/auth-sessions.ts#L843-L875)
- Password recovery follows resolver.zod(ForgotPassword) → user lookup → token generation/hash → deletion of prior reset tokens → token.create → forgotPasswordMailer.send; the absent-user branch waits 750 ms and returns the same result. — [apps/toolkit-app/src/auth/mutations/forgotPassword.ts#L9-41](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/apps/toolkit-app/src/auth/mutations/forgotPassword.ts#L9-L41) [apps/toolkit-app/mailers/forgotPasswordMailer.ts#L13-42](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/apps/toolkit-app/mailers/forgotPasswordMailer.ts#L13-L42)
- Password reset follows ResetPassword.parse → hash256/token.findFirst → token.delete → expiration check → SecurePassword.hash/user.update → session.deleteMany → login. — [apps/toolkit-app/src/auth/mutations/resetPassword.ts#L12-48](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/apps/toolkit-app/src/auth/mutations/resetPassword.ts#L12-L48)
- Application creation follows newApp's interactive selections → AppGenerator.run → write/preCommit/conflict checking → postWrite; postWrite updates dependency versions, optionally installs packages, invokes onPostInstall, formats, and commits Git changes. — [packages/blitz/src/cli/commands/new.ts#L209-268](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz/src/cli/commands/new.ts#L209-L268) [packages/generator/src/generator.ts#L477-528](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/generator/src/generator.ts#L477-L528) [packages/generator/src/generators/app-generator.ts#L144-178](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/generator/src/generators/app-generator.ts#L144-L178) [packages/generator/src/generators/app-generator.ts#L245-286](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/generator/src/generators/app-generator.ts#L245-L286)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)