# Extension points — blitz-js/blitz

> Canonical page: https://codevetter.com/unpack/blitz/extension-points

# Extension points — blitz-js/blitz

Scanned commit b18f81873e641934043f791fec06e22f5fe5a86e (2025-09-11). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

The principal extension mechanisms are plugin factories and composition, storage contracts, resolver conventions, and generator subclasses. Applications choose their authentication storage and authorization policy. Bundler options control resolver naming and discovery, while handler callbacks control error reporting and formatting. New scaffolding behavior plugs into an existing lifecycle rather than requiring a separate generator framework.
- Server plugins supply requestMiddlewares, optional contextMiddleware, and exports; reduceBlitzServerPlugins flattens middleware and combines exports. — [packages/blitz/src/plugin.ts#L121-136](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz/src/plugin.ts#L121-L136)
- Client plugins supply request/response hooks, RPC/session events, exports, and provider wrappers; the reducer composes hooks, installs document listeners, and exposes withPlugins. — [packages/blitz/src/plugin.ts#L39-85](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz/src/plugin.ts#L39-L85) [packages/blitz/src/plugin.ts#L89-118](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz/src/plugin.ts#L89-L118)
- Plugin export-name precedence favors previously accumulated exports because reducers spread new plugin exports before existing ones; registration order is part of the composition contract. — [packages/blitz/src/plugin.ts#L72-73](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz/src/plugin.ts#L72-L73) [packages/blitz/src/plugin.ts#L128-134](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz/src/plugin.ts#L128-L134)
- AuthServerPlugin accepts a SessionConfigMethods storage implementation and an isAuthorized policy; PrismaStorage is one provided adapter. — [packages/blitz-auth/src/server/auth-plugin.ts#L42-70](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/server/auth-plugin.ts#L42-L70) [packages/blitz-auth/src/server/auth-plugin.ts#L82-94](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/server/auth-plugin.ts#L82-L94)
- BlitzServerMiddleware adapts a request middleware into a server plugin without additional exports. — [packages/blitz-next/src/index-server.ts#L381-391](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-next/src/index-server.ts#L381-L391)
- withBlitz exposes resolverPath, resolversDynamicImport, and includeRPCFolders; the RPC server defines resolverPath as conventional paths, root paths, or a custom mapping function. — [packages/blitz-next/src/index-server.ts#L239-247](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-next/src/index-server.ts#L239-L247) [packages/blitz-next/src/index-server.ts#L268-277](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-next/src/index-server.ts#L268-L277) [packages/blitz-rpc/src/index-server.ts#L34-42](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/index-server.ts#L34-L42)
- Resolvers plug in as default-exported functions; query modules can declare an HTTP-method configuration that loader-client extracts. — [packages/blitz-rpc/src/server/loader/client/loader-client.ts#L64-88](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/server/loader/client/loader-client.ts#L64-L88) [packages/blitz-rpc/src/index-server.ts#L261-267](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/index-server.ts#L261-L267)
- RPC handler configuration accepts onError, formatError, and logging; setupBlitzServer separately supports logger and error hooks. — [packages/blitz-rpc/src/index-server.ts#L235-241](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-rpc/src/index-server.ts#L235-L241) [packages/blitz-next/src/index-server.ts#L140-151](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-next/src/index-server.ts#L140-L151)
- Generator subclasses define sourceRoot, getTargetDirectory, templateValuesBuilder, and optional write/commit hooks; template variables can affect file contents and names. — [packages/generator/src/generator.ts#L250-291](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/generator/src/generator.ts#L250-L291) [packages/generator/src/generator.ts#L386-393](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/generator/src/generator.ts#L386-L393) [packages/generator/src/generator.ts#L446-475](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/generator/src/generator.ts#L446-L475) [packages/generator/README.md#L26-32](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/generator/README.md#L26-L32)
- The generatorMap is the CLI resource registry; custom-templates copies selected bundled templates and updates the exported cliConfig through an AST transform. — [packages/blitz/src/cli/commands/generate.ts#L41-68](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz/src/cli/commands/generate.ts#L41-L68) [packages/blitz/src/cli/commands/generate.ts#L77-103](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz/src/cli/commands/generate.ts#L77-L103) [packages/generator/src/generator.ts#L47-88](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/generator/src/generator.ts#L47-L88)
- Passport extension uses strategy objects with optional names and authenticateOptions; successful verification returns publicData/privateData for session creation. — [packages/blitz-auth/src/server/adapters/passport/adapter.ts#L73-105](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/server/adapters/passport/adapter.ts#L73-L105) [packages/blitz-auth/src/server/adapters/passport/adapter.ts#L149-161](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/packages/blitz-auth/src/server/adapters/passport/adapter.ts#L149-L161)
- The sample mailer explicitly reserves an integrations-based email-client boundary; implementing its production send method is application-owned work. — [apps/toolkit-app/mailers/forgotPasswordMailer.ts#L1-5](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/apps/toolkit-app/mailers/forgotPasswordMailer.ts#L1-L5) [apps/toolkit-app/mailers/forgotPasswordMailer.ts#L32-42](https://github.com/blitz-js/blitz/blob/b18f81873e641934043f791fec06e22f5fe5a86e/apps/toolkit-app/mailers/forgotPasswordMailer.ts#L32-L42)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)