[ademolabiyi92-design]

Summary

Generated Smart Contract Cargo manifests previously had only a package-name smoke assertion. Add focused metadata conformance coverage that validates the generated structure, inherited dependencies and build/test configuration while preserving the existing template.

Related Issue

Closes #148

Scope

• Generate projects with hyphenated, dotted and mixed-case/underscore names; assert the virtual workspace, resolver, member glob, release profile and fixed package identity.
• Verify the non-publishable cdylib package, source/test files, SDK inheritance and testutils feature, documented build/test commands and the CLI Cargo test plan.
• Run bounded cargo metadata --offline --no-deps --format-version=1 and assert the resolved member IDs, default members, source paths, library target and normal/dev dependencies.
• Check both manifests for embedded signing material/registry credentials and unresolved substitutions; ensure no Cargo credentials files are generated.
• Document how to run the suite and its limits. Existing SW-039 helpers target package.json, so Cargo-specific assertions remain in the focused test file.

Acceptance criterion	Verification
Metadata matches generated structure	Manifest checks across three project names plus real Cargo semantic metadata assertions
Build/test commands remain valid	Source and target checks, release profile, testutils inheritance, README commands and CLI test-plan assertions; no command changes
No credentials embedded	Manifest checks and absence of Cargo credential files
Repository checks pass	Targeted checks pass; existing broad-check failures disclosed below

Testing

• Tests added/updated where applicable
• Existing relevant tests pass
• Lint/type/build checks pass where available

Windows / Node 24.21.0; Cargo semantic check ran with Rust/Cargo 1.98.1:

• npm ci --ignore-scripts --no-audit --no-fund: passed (168 packages).
• npx vitest run tests/smart-contract-cargo-metadata.test.ts tests/smart-contract-template.test.ts: 7 passed, including the real Cargo metadata checks; none skipped.
• ESLint and Prettier for the new test file: passed.
• git diff --check: passed.
• npx vitest run --maxWorkers=2: 1705 passed, 70 failed, 12 skipped across 85 files (59 passed, 26 failed). Failures are in unchanged suites, including diagnostic/redaction behavior, workflow checks and Windows symlink permissions.
• Repository typecheck: 24 diagnostics; build: 12 diagnostics, all in unchanged files. Examples include inconsistent diagnostic timeout outcomes, undefined redaction names, and missing src/types.js.
• Repository lint: 21 errors in existing files. Formatting: 143 existing files flagged, including Windows checkout line-ending differences.

The generated SDK was not installed/compiled; offline metadata and command/target conformance are not a substitute for cargo test or stellar contract build. The current upstream CI YAML also has an audit step outside its steps block; this PR does not modify protected workflow or unrelated baseline code.

Security Impact

• No security-sensitive behavior is changed
• Security-sensitive behavior is changed and explained below

Security notes: test-only generation uses temporary directories with deterministic cleanup. Cargo is invoked with an argument array, shell disabled, offline/no-deps flags and a timeout. No dependencies, deployment behavior, credentials, or production process handling are changed.

Release Impact

• No published/user-visible behavior change
• Patch
• Minor
• Breaking/pre-1.0 contract change
• Changeset included where required
• Changeset not required; reason explained below

Release notes: tests and contributor documentation only.

Documentation

• Documentation updated where applicable
• No documentation change required

Checklist

• I read docs/contributing/wave-architecture.md for Stellar Wave work
• I stayed within the agreed issue scope
• I checked for overlapping open contributor PRs
• I did not include secrets or sensitive data
• I reviewed new/updated dependencies if any (none added)
• I considered failure/error paths, not only the happy path
• I am not disclosing an unresolved vulnerability publicly

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 27ce795b-362e-4c6f-bb49-9f8f2159277c

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}