# Data flow — blitz-js/blitz

> Canonical page: https://codevetter.com/unpack/blitz/data-flow

# Data flow — blitz-js/blitz

Scanned commit b18f81873e641934043f791fec06e22f5fe5a86e (2025-09-11). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

Resolver paths and implementations are established during bundling, while browser calls carry SuperJSON data through fetch and plugin middleware. Server handlers deserialize inputs, invoke the registered resolver, serialize results or errors, and propagate session changes. Authentication maintains separate server persistence and browser public-state representations. Generation has a different data path: template values become staged filesystem edits and optional installation operations.
- loader-client derives resolver name, type, route, and HTTP method from a resolver file and emits a replacement default export calling __internal_buildRpcClient. — [packages/blitz-rpc/src/server/loader/client/loader-client.ts#L48-91](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/server/loader/client/loader-client.ts#L48-L91)
- loader-server discovers resolver files recursively and appends __internal_addBlitzRpcResolver registrations using require or dynamic import. — [packages/blitz-rpc/src/server/loader/server/loader-server.ts#L65-98](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/server/loader/server/loader-server.ts#L65-L98) [packages/blitz-rpc/src/server/loader/server/loader-server.ts#L116-156](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/server/loader/server/loader-server.ts#L116-L156)
- useMutation sanitizes its resolver and forwards variables to the RPC client through TanStack mutateAsync; useQuery supplies query keys and an AbortSignal. — [packages/blitz-rpc/src/query/react-query/react-query.ts#L105-122](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/query/react-query/react-query.ts#L105-L122) [packages/blitz-rpc/src/query/react-query/react-query.ts#L496-515](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/query/react-query/react-query.ts#L496-L515)
- The RPC client serializes input with SuperJSON, places POST data in params/meta, includes cookies with fetch credentials, and runs beforeHttpRequest/beforeHttpResponse hooks. — [packages/blitz-rpc/src/client/rpc.ts#L66-108](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/client/rpc.ts#L66-L108)
- Pages rpcHandler selects a resolver using req.query.blitz, deserializes request data, executes with res.blitzCtx, and sends result plus SuperJSON metadata. — [packages/blitz-rpc/src/index-server.ts#L241-267](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/index-server.ts#L241-L267) [packages/blitz-rpc/src/index-server.ts#L286-320](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/index-server.ts#L286-L320)
- Browser success handling deserializes result metadata and can write directly invoked results to global queryClient; serialized errors dispatch blitz:rpc-error and are rethrown. — [packages/blitz-rpc/src/client/rpc.ts#L124-150](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/client/rpc.ts#L124-L150)
- AuthClientPlugin adds the anti-csrf header, backs up the CSRF cookie, updates PublicDataStore when response headers signal changes, and emits blitz:session-created. — [packages/blitz-auth/src/client/index.tsx#L419-443](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/client/index.tsx#L419-L443)
- Authenticated session creation stores a SHA-256 token hash, expiration, CSRF token, and JSON public/private data through the configured storage, then emits session, CSRF, and public-data cookies. — [packages/blitz-auth/src/server/auth-sessions.ts#L1005-1026](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/server/auth-sessions.ts#L1005-L1026) [packages/blitz-auth/src/server/auth-plugin.ts#L46-55](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/server/auth-plugin.ts#L46-L55)
- Anonymous session creation signs a JWT and emits cookies without a session-row creation in that branch; private-data writes can later create a row for the anonymous handle. — [packages/blitz-auth/src/server/auth-sessions.ts#L948-977](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/server/auth-sessions.ts#L948-L977) [packages/blitz-auth/src/server/auth-sessions.ts#L1182-1199](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/server/auth-sessions.ts#L1182-L1199)
- PublicDataStore decodes the browser public-data token and uses localStorage timestamps as a cross-tab notification bus; useSession subscribes React state to its observable. — [packages/blitz-auth/src/client/index.tsx#L43-87](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/client/index.tsx#L43-L87) [packages/blitz-auth/src/client/index.tsx#L100-115](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/client/index.tsx#L100-L115) [packages/blitz-auth/src/client/index.tsx#L175-184](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/client/index.tsx#L175-L184)
- Password recovery sends the plaintext reset token to the mailer while storing hash256(token); resetPassword hashes the submitted token before looking it up. — [apps/toolkit-app/src/auth/mutations/forgotPassword.ts#L13-34](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/apps/toolkit-app/src/auth/mutations/forgotPassword.ts#L13-L34) [apps/toolkit-app/src/auth/mutations/resetPassword.ts#L14-19](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/apps/toolkit-app/src/auth/mutations/resetPassword.ts#L14-L19)
- Generator.process applies conditional AST transforms, template substitution, optional TypeScript removal, and formatting; Generator.run stages edits, invokes preCommit, commits through ConflictChecker, and conditionally runs postWrite. — [packages/generator/src/generator.ts#L325-383](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/generator/src/generator.ts#L325-L383) [packages/generator/src/generator.ts#L477-528](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/generator/src/generator.ts#L477-L528)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)