fix: generate production SaaS provider profiles

[kang-heewon]

Fixes #922.

Summary

• Adds selectable production SaaS provider profiles for create-croco-app: saas-node-postgres, saas-cloudflare, and saas-lambda.
• Generated SaaS apps now emit a deterministic croco-saas-profile.manifest.json, .env.example, deploy notes, secrets checklist, and generated TypeScript manifest source for drift checks.
• Profile selection now determines generated API package dependencies and runtime/provider capability metadata before generated smoke runs.
• Adds profile:check and profile:smoke:real so zero-credential smoke remains local while real-provider preflight fails with stable diagnostics for profile drift, missing packages, or missing env.

Verification

• pnpm --filter create-croco-app exec vitest run src/tests/options.spec.ts src/tests/templates-build.spec.ts src/tests/e2e-generation.spec.ts - passed, 55 tests.
• pnpm --filter create-croco-app test - passed, 72 tests.
• pnpm --filter create-croco-app typecheck - passed.
• CROCO_GENERATED_SMOKE_CASES=saas-golden-path,saas-cloudflare-profile,saas-lambda-profile pnpm create-croco-app:smoke - passed for all three generated SaaS profile cases, including the expected real-provider missing env diagnostic.
• pnpm check - passed.
• pnpm changeset-required:check -- --base origin/trunk --head HEAD - passed.
• git diff --check and git diff --cached --check - passed.
• Pre-commit hook passed: staged oxfmt and oxlint.
• Pre-push hook passed: full pnpm test passed with 209/209 Turbo tasks and full pnpm typecheck passed with 208/208 Turbo tasks.

Self-review gates

• Correctness/regression: PASS. The issue acceptance criteria are covered by CLI option tests, generator artifact assertions, manifest/package/env drift checks, SaaS template registry tests, and generated smoke for node/postgres, Cloudflare, and Lambda profile choices.
• API/security/compatibility/release: PASS. The CLI and GeneratorOptions changes are additive; provider package ranges use current published installable Croco ranges plus third-party ranges; real-provider mode only validates required env and does not call external services; a patch changeset is included.
• Maintainability/minimality: PASS. The change is scoped to create-croco-app profile metadata, SaaS generation artifacts, template profile checks, and the existing generated-smoke harness. It does not add provider runtime wiring beyond documented production profile contracts.

Independent review

• An independent review initially found that profile packages were only documented, Cloudflare/Lambda smoke coverage was too narrow, and the real-provider missing-env diagnostic lacked direct validation. The final patch injects manifest packages into generated API package dependencies, runs full generated-app smoke validations for all three profiles, and verifies the stable CROCO_SAAS_PROFILE_ENV_MISSING failure path.

Risk

Low-medium. The generated production profiles are contract artifacts and installable dependency/runtime declarations; actual external-provider calls remain opt-in behind profile:smoke:real with required env loaded.

[coderabbitai]

Warning

Review limit reached

@kang-heewon, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 8 minutes and 45 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan refill rate.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, the refill rate gradually slows as usage increases. The highest same-day bursts are limited more strictly.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: f8a978ab-fa5c-4df3-883a-da21ca79327a

📥 Commits

Reviewing files that changed from the base of the PR and between 73e430a and 719afbb.

📒 Files selected for processing (19)

• .changeset/saas-provider-profiles.md
• packages/create-croco-app/src/cli.ts
• packages/create-croco-app/src/generator.ts
• packages/create-croco-app/src/helpers/croco-ranges.ts
• packages/create-croco-app/src/options.ts
• packages/create-croco-app/src/prompts.ts
• packages/create-croco-app/src/saas-provider-profiles.ts
• packages/create-croco-app/src/supported-options.ts
• packages/create-croco-app/src/tests/e2e-generation.spec.ts
• packages/create-croco-app/src/tests/options.spec.ts
• packages/create-croco-app/src/tests/templates-build.spec.ts
• packages/create-croco-app/src/types.ts
• packages/create-croco-app/templates/saas/README.md.hbs
• packages/create-croco-app/templates/saas/apps/api-server/package.json.hbs
• packages/create-croco-app/templates/saas/apps/api-server/src/provider-profile-check.ts
• packages/create-croco-app/templates/saas/apps/api-server/src/providerProfiles.ts
• packages/create-croco-app/templates/saas/apps/api-server/src/tests/SaasDemo.spec.ts
• packages/create-croco-app/templates/saas/package.json.hbs
• scripts/create-croco-app-generated-smoke.mts

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/922-saas-provider-profiles

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

📊 Benchmark Results

❌ Some benchmarks failed

Gate failures

• CrocoApp constructor: p75 5.4μs exceeds baseline 3.4μs by more than 20%
• CrocoApp lambdaHandler (10 controllers): p75 186.6μs exceeds baseline 33.3μs by more than 20%
• Lambda cold-start simulation: p75 337.0μs exceeds baseline 70.2μs by more than 20%
• Lambda cold-start with headers: p75 304.6μs exceeds baseline 66.7μs by more than 20%
• Lambda cold-start with binary body: p75 263.1μs exceeds baseline 63.2μs by more than 20%
• Lambda cold-start with query params: p75 236.2μs exceeds baseline 63.9μs by more than 20%
• Lambda cold-start with authorizer context: p75 240.4μs exceeds baseline 59.8μs by more than 20%
• Lambda cold-start realistic scenario: p75 237.2μs exceeds baseline 60.2μs by more than 20%
• EventBusConfig.start (10 handlers): p75 1.3μs exceeds baseline 0.9μs by more than 20%
• EventPublisher.publishNow single event: p75 1.6μs exceeds baseline 1.1μs by more than 20%
• DefaultHandlerResolver.resolve × 10: p75 0.1μs exceeds baseline 0.0μs by more than 20%
• Container.get singleton (cold): p75 2.0μs exceeds baseline 0.6μs by more than 20%
• Container.get singleton (warm): p75 1.6μs exceeds baseline 0.3μs by more than 20%
• lambdaPreset config creation: p75 1.5μs exceeds baseline 1.0μs by more than 20%

Benchmark	p75	Threshold	Baseline	vs Baseline	Status	Notes
CrocoApp constructor	5.4μs	30.0ms	3.4μs	+60.9%	❌	-
CrocoApp lambdaHandler (10 controllers)	186.6μs	50.0ms	33.3μs	+460.4%	❌	-
Lambda cold-start simulation	337.0μs	80.0ms	70.2μs	+380.3%	❌	-
Lambda cold-start with headers	304.6μs	80.0ms	66.7μs	+356.3%	❌	-
Lambda cold-start with binary body	263.1μs	80.0ms	63.2μs	+316.5%	❌	-
Lambda cold-start with query params	236.2μs	80.0ms	63.9μs	+269.8%	❌	-
Lambda cold-start with authorizer context	240.4μs	80.0ms	59.8μs	+302.1%	❌	-
Lambda cold-start realistic scenario	237.2μs	80.0ms	60.2μs	+294.3%	❌	-
EventBusConfig.start (10 handlers)	1.3μs	10.0ms	0.9μs	+49.9%	❌	-
EventPublisher.publishNow single event	1.6μs	2.0ms	1.1μs	+43.4%	❌	-
DefaultHandlerResolver.resolve × 10	0.1μs	5.0ms	0.0μs	+69.0%	❌	-
Container.get singleton (cold)	2.0μs	5.0ms	0.6μs	+225.4%	❌	-
Container.register × 50 components	13.0μs	10.0ms	12.1μs	+6.9%	✅	-
Container.validate (50 components)	29.9μs	20.0ms	29.7μs	+0.6%	✅	-
Container.get singleton (warm)	1.6μs	500.0μs	0.3μs	+435.3%	❌	-
TelemetryRuntime.init (lambda preset)	1.1ms	200.0ms	69.3ms	-98.4%	✅	-
lambdaPreset config creation	1.5μs	2.0ms	1.0μs	+45.2%	❌	-

_{Updated: 2026-06-20T07:13:41.692Z · Commit: 596c7ab}