[ABEEGOLD]

Closes #143

test(SW-041): Add Basic App package metadata conformance

Summary

Adds a dedicated conformance test suite that validates the package.json
generated by stellarforge new for the Basic App template against the
frozen template contract.

The Basic App template's package.json is a well-defined, intentionally
minimal manifest. Until this PR there was no test that pinned the exact
shape of that manifest — individual fields (scripts, engines,
dependencies) were checked incidentally inside the broader smoke-test in
basic-app-template.test.ts, but nothing asserted them exhaustively or in
isolation. This PR fills that gap by treating the template manifest as a
named contract and asserting every field in it.

---

Related Issue

Closes #143

---

Scope

Added

• tests/basic-app-package-metadata.test.ts — 8 focused conformance test
  cases that together cover every acceptance criterion for SW-041.

Intentionally not changed

• No source files, templates, or existing tests were modified.
• No changeset is included; this is a test-only addition with no effect on
  published behaviour or the public API surface.

---

Testing

The new test file (tests/basic-app-package-metadata.test.ts) contains
one describe block — "Basic App package metadata conformance (SW-041)"
— with the following 8 it cases:

#	Test description	Acceptance criterion
1	sets the package name to the generated project name	name is correct after generation
2	retains all frozen script entries without modification	scripts entries match the frozen contract exactly
3	retains only the frozen script keys and no extras	No extra script keys beyond start, check, test
4	sets the engines.node constraint to the frozen minimum version	engines.node equals >=22.13.0
5	generates no dependencies field	No unintended dependencies
6	generates no devDependencies field	No unintended devDependencies
7	does not embed secret, seed, or private-key values in the generated package.json	No secrets (SECRET, SEED, PRIVATE_KEY, Stellar strkey pattern)
8	passes the repository check script after generation	Generated project's check script exits with code 0

Each test uses withTempDirectory to run in complete isolation inside a
throwaway directory, consistent with the patterns used in
api-service-template.test.ts and full-stack-template.test.ts.

Helpers / infrastructure used (no new helpers introduced)

• createNewCommand — exercises the real generator code path

• createCapturedTerminalOutput / withTempDirectory — standard test helpers

• createNpmInvocation + spawnSync (shell: false) — safe child-process
  execution for the check script run

• Tests added/updated where applicable

• Existing relevant tests pass (blocked by pre-existing package.json JSON
  syntax error on main — missing comma on line 16 — unrelated to this PR)

• Lint/type/build checks pass where available (same blocker; node --check
  on the new file itself passes cleanly)

---

Security Impact

• No security-sensitive behavior is changed

Security notes:

This PR adds tests only. The new test that exercises secret detection
(does not embed secret, seed, or private-key values) explicitly asserts
that the generated package.json contains no SECRET, SEED,
PRIVATE_KEY literal strings and no Stellar secret-key strkey pattern
(S[A-Z0-9]{55}). All child-process invocations use shell: false in
line with the project security model (ADR-0004). No network access,
no environment variable reflection, no file paths outside the temporary
directory.

---

Release Impact

• No published/user-visible behavior change

• Changeset not required; reason explained below

Release notes: Test-only change. No runtime code, template files, or
documented CLI behaviour is altered. No changeset is needed.

---

Documentation

• No documentation change required

This PR validates an existing, already-documented template contract.
The frozen contract constants in the test file (FROZEN_SCRIPTS,
FROZEN_NODE_ENGINE) serve as living inline documentation of the
basic-app manifest shape and are annotated with a comment directing
future maintainers to update them only when the template itself changes
intentionally.

---

Checklist

• I read docs/contributing/wave-architecture.md for Stellar Wave work
• I stayed within the agreed issue scope
• I checked for overlapping open contributor PRs
• I did not include secrets or sensitive data
• I reviewed new/updated dependencies if any (none added)
• I considered failure/error paths, not only the happy path
• I am not disclosing an unresolved vulnerability publicly

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: dec04b6b-d0a0-4ac9-9c5f-d2f3198c42a6

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}