fix: keep generated app DI validation enabled

[kang-heewon]

Fixes #1641.

Outcome

• Shipped generated-app templates no longer disable HTTP DI bootstrap validation.
• Admin and split-SPA templates explicitly register required providers, and a deliberate missing-provider fixture proves the stable transports-http/di-missing-provider diagnostic.
• SaaS and AI-SaaS use documented warn mode for optional package-level components, with an observable bootstrap logger that preserves caller loggers, structured context, errors, and child bindings.
• The SaaS production bootstrap test runs without a validation override and verifies that DI warnings are emitted.

Verification

• pnpm --filter create-croco-app test: 136 tests passed.
• pnpm --filter create-croco-app typecheck: passed.
• pnpm --filter create-croco-app lint: 0 warnings and 0 errors.
• Affected generated-app smoke matrix passed for goal-saas-api, ai-saas-golden-path, meta-vite-fullstack-workers, production-app-starter, and admin-console-starter, including install, lint, typecheck, build, tests, browser journeys, contract generation, DI graph checks, demos, and failure drills.
• pnpm changeset-required:check -- --base origin/trunk --head HEAD: passed.
• Pre-push full test gate: 234/234 tasks passed.
• Pre-push full typecheck gate: 233/233 tasks passed.
• git diff --check: passed.

Review gates

• Correctness and regression: PASS. All issue acceptance criteria have direct test or generated-app smoke evidence.
• API, compatibility, security, and release: PASS. No framework policy/default changed; the publishable create-croco-app behavior has a patch changeset.
• Maintainability and minimality: PASS. Changes stay within shipped templates and their contract tests.
• Independent adversarial review: APPROVE with no remaining findings after the observable-logger path and structured logging semantics were tested.

Residual risk

• SaaS and AI-SaaS remain on documented DI warn mode because their package barrel imports register optional components outside the manually composed runtime. The warning is now observable and can be promoted to enforce once every optional component is explicitly supplied.
• The latest full repository evidence run passed 23 of 25 gates, with one gate not applicable; its only failure was the unrelated, load-sensitive Container.register benchmark threshold. The same code passed the full repository gate before the latest trunk rebase, and the benchmark failure reproduced in isolation while all affected functional, generated-app, full-test, and typecheck gates passed.

Summary by CodeRabbit

• 개선 사항

  • 새로 생성되는 애플리케이션에서 의존성 주입(DI) 검증이 기본 활성화됩니다.
  • 애플리케이션 시작 시 누락된 제공자를 진단하고 경고로 안내합니다.
  • SaaS 템플릿에 기본 로깅과 권한 관리 구성이 제공됩니다.
  • 기존에 등록한 로거 설정이 애플리케이션 실행 후에도 유지됩니다.

• 문서

  • DI 검증 모드, 부트스트랩 진단, 운영 환경 확인 방법을 템플릿 문서에 추가했습니다.

• 버그 수정

  • 일부 템플릿에서 발생할 수 있는 구성 요소 등록 누락 문제를 해결했습니다.

[coderabbitai]

Warning

Review limit reached

@kang-heewon, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 47 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: e4fc6d61-2a20-485c-ab0f-372963f2088f

📥 Commits

Reviewing files that changed from the base of the PR and between 370ccdb and 7bf4fe3.

📒 Files selected for processing (11)

• .changeset/enable-generated-app-di-validation.md
• packages/create-croco-app/src/tests/templates-build.spec.ts
• packages/create-croco-app/templates/addons/web-meta-vite-fullstack/api-worker/src/index.ts
• packages/create-croco-app/templates/admin-console/apps/api-server/src/app.ts.hbs
• packages/create-croco-app/templates/ai-saas/README.md.hbs
• packages/create-croco-app/templates/ai-saas/apps/api-server/src/app.ts.hbs
• packages/create-croco-app/templates/saas/README.md.hbs
• packages/create-croco-app/templates/saas/apps/api-server/src/app.ts
• packages/create-croco-app/templates/saas/apps/api-server/src/tests/SaasDemo.spec.ts
• packages/create-croco-app/templates/spa-be-split/apps/api-server/src/app.ts
• packages/create-croco-app/templates/spa-be-split/apps/api-server/src/tests/app.spec.ts

📝 Walkthrough

Walkthrough

생성 앱 템플릿에서 diValidation: "off" 설정을 제거했습니다. 필요한 HTTP 컴포넌트를 등록했습니다. SaaS 템플릿은 warn 모드 DI 검증, 기본 로거, EntitlementManager를 사용합니다. 부트스트랩 경고와 누락 provider 진단 테스트를 추가했습니다.

Changes

생성 앱 DI 검증

Layer / File(s)	Summary
템플릿 부트스트랩 검증 packages/create-croco-app/templates/**/apps/api-server/src/app.ts*, packages/create-croco-app/templates/addons/web-meta-vite-fullstack/api-worker/src/index.ts, packages/create-croco-app/templates/spa-be-split/apps/api-server/src/tests/app.spec.ts	템플릿에서 DI 검증 비활성화 설정을 제거했습니다. HttpExceptionFilter와 ProtectedRouteGuard를 컴포넌트로 등록했습니다. 누락 provider를 enforce 모드에서 진단하는 테스트를 추가했습니다.
SaaS 런타임 부트스트랩 packages/create-croco-app/templates/ai-saas/apps/api-server/src/app.ts.hbs, packages/create-croco-app/templates/saas/apps/api-server/src/app.ts	기본 BootstrapLogger와 EntitlementManager를 컨테이너에 등록했습니다. DI 검증을 warn 모드로 변경했습니다. 로거의 바인딩 병합, 오류 출력, 자식 로거 생성을 구현했습니다.
검증 문서와 템플릿 테스트 packages/create-croco-app/src/tests/templates-build.spec.ts, packages/create-croco-app/templates/*/README.md.hbs, packages/create-croco-app/templates/saas/apps/api-server/src/tests/SaasDemo.spec.ts, .changeset/enable-generated-app-di-validation.md	모든 템플릿의 diValidation: "off" 사용을 검사합니다. SaaS 부트스트랩 경고, /health 응답, 필수 provider 안내, 호출자 logger 보존을 검증합니다. DI 검증 운영 절차를 README와 changeset에 기록했습니다.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant GeneratedApp
  participant createCrocoApp
  participant DIContainer
  participant BootstrapLogger
  participant HealthEndpoint
  GeneratedApp->>createCrocoApp: 앱 생성 요청
  createCrocoApp->>DIContainer: logger와 EntitlementManager 등록
  DIContainer->>BootstrapLogger: DI bootstrap 경고 출력
  createCrocoApp->>HealthEndpoint: health 요청
  HealthEndpoint-->>GeneratedApp: health 응답

Loading

Possibly related PRs

• croco-dev/framework#1116: 생성 앱의 부트스트랩 템플릿과 검증 우회 제거를 함께 다룹니다.
• croco-dev/framework#1218: 생성 템플릿의 DI 그래프 검증과 누락 provider 진단에 연결됩니다.
• croco-dev/framework#1330: create-croco-app SaaS 템플릿과 smoke 검증을 공유합니다.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 생성 앱의 DI 검증을 활성화 상태로 유지하는 주요 변경을 정확하고 간결하게 설명합니다.
Linked Issues check	✅ Passed	[#1641] 템플릿의 검증 우회를 제거하고 필요한 등록, warn 문서, 누락 provider 진단 fixture와 테스트를 추가했습니다.
Out of Scope Changes check	✅ Passed	변경 사항은 [#1641]의 DI 검증 활성화, provider 등록, 진단 및 생성 앱 검증 범위에 포함됩니다.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/1641-enable-template-di-validation

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

📊 Benchmark Results

✅ All benchmarks passed

Benchmark	p75	Threshold	Baseline	vs Baseline	Status	Notes
CrocoApp constructor	9.2μs	30.0ms	8.2μs	+12.0%	✅	-
CrocoApp lambdaHandler (10 controllers)	228.7μs	50.0ms	258.4μs	-11.5%	✅	-
Lambda cold-start simulation	432.9μs	80.0ms	418.1μs	+3.6%	✅	-
Lambda cold-start with headers	374.4μs	80.0ms	369.7μs	+1.3%	✅	-
Lambda cold-start with binary body	350.7μs	80.0ms	339.1μs	+3.4%	✅	-
Lambda cold-start with query params	304.3μs	80.0ms	301.3μs	+1.0%	✅	-
Lambda cold-start with authorizer context	296.5μs	80.0ms	299.8μs	-1.1%	✅	-
Lambda cold-start realistic scenario	293.7μs	80.0ms	299.2μs	-1.8%	✅	-
EventBusConfig.start (10 handlers)	1.7μs	10.0ms	1.4μs	+18.1%	✅	-
EventPublisher.publishNow single event	2.0μs	2.0ms	1.7μs	+20.2%	❌	-
DefaultHandlerResolver.resolve × 10	0.1μs	5.0ms	0.1μs	+0.0%	✅	-
Container.get singleton (cold)	60.1μs	5.0ms	70.3μs	-14.4%	✅	-
Container.register × 50 components	3.1ms	10.0ms	3.2ms	-4.3%	✅	-
Container.validate (50 components)	3.5ms	20.0ms	3.4ms	+3.2%	✅	-
Container.get singleton (warm)	1.6μs	500.0μs	1.6μs	+0.0%	✅	-
TelemetryRuntime.init (lambda preset)	2.4μs	200.0ms	1.1ms	-99.8%	✅	-
lambdaPreset config creation	1.5μs	2.0ms	1.4μs	+4.9%	✅	-

_{Updated: 2026-08-01T16:15:47.672Z · Commit: 2e1ec16}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@packages/create-croco-app/templates/ai-saas/apps/api-server/src/app.ts.hbs`:
- Around line 2-8: Separate the mixed framework-context imports in
packages/create-croco-app/templates/ai-saas/apps/api-server/src/app.ts.hbs lines
2-8 and packages/create-croco-app/templates/saas/apps/api-server/src/app.ts
lines 2-3: keep Container and LOGGER_TOKEN in the value import, and add a
separate type-only import for Constructor and ILogger. Preserve the ordering of
external, internal `@croco/`*, and relative imports.

In
`@packages/create-croco-app/templates/saas/apps/api-server/src/tests/SaasDemo.spec.ts`:
- Around line 2-11: Update the imports in SaasDemo.spec.ts to place external
packages typedi and vitest before internal `@croco/`* imports, and separate the
type-only PendingMeteringDelivery import from the runtime metering-core imports.
Preserve the existing imported symbols and group ordering.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: d96ce887-91c9-4d61-9b5f-7571d0335c54

📥 Commits

Reviewing files that changed from the base of the PR and between 2a5a4af and 370ccdb.

📒 Files selected for processing (11)

• .changeset/enable-generated-app-di-validation.md
• packages/create-croco-app/src/tests/templates-build.spec.ts
• packages/create-croco-app/templates/addons/web-meta-vite-fullstack/api-worker/src/index.ts
• packages/create-croco-app/templates/admin-console/apps/api-server/src/app.ts.hbs
• packages/create-croco-app/templates/ai-saas/README.md.hbs
• packages/create-croco-app/templates/ai-saas/apps/api-server/src/app.ts.hbs
• packages/create-croco-app/templates/saas/README.md.hbs
• packages/create-croco-app/templates/saas/apps/api-server/src/app.ts
• packages/create-croco-app/templates/saas/apps/api-server/src/tests/SaasDemo.spec.ts
• packages/create-croco-app/templates/spa-be-split/apps/api-server/src/app.ts
• packages/create-croco-app/templates/spa-be-split/apps/api-server/src/tests/app.spec.ts

💤 Files with no reviewable changes (1)

• packages/create-croco-app/templates/addons/web-meta-vite-fullstack/api-worker/src/index.ts

[kang-heewon]

@coderabbitai resolve

[coderabbitai]

✅ Action performed

Comments resolved and changes approved.