@stone-js/starters 0.8.8 → 0.8.9

package/basic-service-imperative/tests/Application.spec.ts

@@ -1,53 +1,28 @@
-import { IncomingHttpEvent } from '@stone-js/http-core'
-import { FunctionalEventHandler, ILogger } from '@stone-js/core'
-import { AppConfig, FactoryHandler, ResponseData } from '../app/Application'
-
-vi.mock('@stone-js/core', async (mod) => {
-  const actual: any = await mod()
-  return {
-    ...actual,
-    isNotEmpty: vi.fn(() => true),
-    defineConfig: (config: any) => config
-  }
-})
-
+import { createTestApp, makeIncomingHttpEvent } from '@stone-js/testing'
+
+/**
+ * The whole application, booted in memory and asked a real question.
+ *
+ * Nothing is mocked and nothing is listed: `createTestApp()` discovers `app/**`, and the event goes
+ * through the same kernel production runs. If this passes the application works; if it fails the
+ * application is broken. That is the only kind of test worth shipping in a starter — the previous one
+ * stubbed out the framework's own decorators, which meant it could pass while nothing worked.
+ */
 describe('Application', () => {
-  let mockedLogger: ILogger
-  let app: FunctionalEventHandler<IncomingHttpEvent, ResponseData>
-
-  beforeEach(() => {
-    mockedLogger = {
-      info: vi.fn(),
-    } as unknown as ILogger
+  it('answers the caller', async () => {
+    const app = await createTestApp()
 
-    app = FactoryHandler({ logger: mockedLogger })
-  })
-
-  it('should create an event handler instance', () => {
-    // Assert
-    expect(app).toBeTypeOf('function')
-  })
+    const response = await app.send(makeIncomingHttpEvent({ method: 'GET', url: '/?name=Ada' }))
 
-  it('should handle incoming http events', async () => {
-    // Arrange
-    const event = { get: () => 'World' } as unknown as IncomingHttpEvent
-    // Act
-    const response = await app(event)
-    // Assert
-    expect(response.message).toBe('Hello World! Welcome to Stone.js.')
-    expect(response.framework.name).toBe('Stone.js')
-    expect(mockedLogger.info).toHaveBeenCalledWith('Hello World! Welcome to Stone.js.')
+    expect(response.statusCode).toBe(200)
+    expect(response.json()).toMatchObject({ message: expect.stringContaining('Ada') })
   })
 
-  it('should get config', () => {
-    // Arrange
-    const config: any = AppConfig
-    const blueprint: any = { is: () => true, set: vi.fn() }
+  it('answers when nobody says who they are', async () => {
+    const app = await createTestApp()
 
-    // Act
-    config.afterConfigure(blueprint)
+    const response = await app.send(makeIncomingHttpEvent({ method: 'GET', url: '/' }))
 
-    // Assert
-    expect(blueprint.set).toHaveBeenCalled()
+    expect(response.statusCode).toBe(200)
   })
 })

package/continuum-showcase/package.json

@@ -9,25 +9,26 @@
     "build": "stone build",
     "build:ssr": "stone build --ssr",
     "preview": "stone preview",
-    "test": "vitest run",
-    "test:cvg": "npm run test -- --coverage"
+    "test": "stone test",
+    "test:cvg": "stone test --coverage"
   },
   "dependencies": {
     "react": "^19.0.0",
     "react-dom": "^19.0.0",
-    "@stone-js/core": "^0.8.8",
-    "@stone-js/router": "^0.8.8",
-    "@stone-js/use-react": "^0.8.8",
-    "@stone-js/http-core": "^0.8.8",
-    "@stone-js/pipeline": "^0.8.8",
-    "@stone-js/browser-adapter": "^0.8.8",
-    "@stone-js/node-http-adapter": "^0.8.8"
+    "@stone-js/core": "^0.8.9",
+    "@stone-js/router": "^0.8.9",
+    "@stone-js/use-react": "^0.8.9",
+    "@stone-js/http-core": "^0.8.9",
+    "@stone-js/pipeline": "^0.8.9",
+    "@stone-js/browser-adapter": "^0.8.9",
+    "@stone-js/node-http-adapter": "^0.8.9"
   },
   "devDependencies": {
     "@babel/plugin-proposal-decorators": "^7.25.9",
     "@babel/preset-env": "^7.26.9",
     "@babel/preset-typescript": "^7.27.0",
-    "@stone-js/cli": "^0.8.8",
+    "@stone-js/cli": "^0.8.9",
+    "@stone-js/testing": "^0.8.9",
     "@types/node": "^24.0.7",
     "@types/react": "^19.0.7",
     "@types/react-dom": "^19.0.3",

package/continuum-showcase/public/favicon.svg

@@ -0,0 +1,16 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 96 96" width="96" height="96" role="img" aria-label="Stone.js">
+  <title>Stone.js</title>
+  <style>
+    .ink { stroke: #1B1613; }
+    @media (prefers-color-scheme: dark) { .ink { stroke: #EFE8DC; } }
+  </style>
+  <defs>
+    <linearGradient id="braise" gradientUnits="userSpaceOnUse" x1="22" y1="14" x2="74" y2="26.1">
+      <stop offset="0" stop-color="#FFC46B" />
+      <stop offset="1" stop-color="#FF5A1F" />
+    </linearGradient>
+  </defs>
+  <path class="ink" d="M 79.96 36.4 A 34 34 0 0 1 53.9 81.5" fill="none" stroke-width="11" stroke-linecap="round" opacity=".85" />
+  <path class="ink" d="M 42.1 81.5 A 34 34 0 0 1 16.05 36.4" fill="none" stroke-width="11" stroke-linecap="round" opacity=".85" />
+  <path d="M 22 26.1 A 34 34 0 0 1 74 26.1" fill="none" stroke="url(#braise)" stroke-width="11" stroke-linecap="round" />
+</svg>

package/continuum-showcase/stone.config.mjs

@@ -1,4 +1,4 @@
-import { defineConfig } from '@stone-js/cli'
+import { defineBuilderConfig } from '@stone-js/cli'
 
 /**
  * Build configuration for the showcase.
@@ -6,7 +6,7 @@ import { defineConfig } from '@stone-js/cli'
  * - `target: 'react'` + `rendering: 'ssr'` exercises the server-rendered head pipeline.
  * - `assets` enables the `@img` / `@css` / `@assets` import aliases used in components.
  */
-export default defineConfig({
+export default defineBuilderConfig({
   target: 'react',
   rendering: 'ssr',
   assets: {

package/continuum-showcase/tests/application.spec.ts

@@ -0,0 +1,30 @@
+import { createTestApp, makeIncomingHttpEvent } from '@stone-js/testing'
+
+/**
+ * The whole application, booted in memory and asked a real question.
+ *
+ * Nothing is mocked and nothing is listed: `createTestApp()` discovers `app/**`, and the event goes
+ * through the same kernel production runs. If this passes the application works; if it fails the
+ * application is broken. That is the only kind of test worth shipping in a starter — the previous one
+ * stubbed out the framework's own decorators, which meant it could pass while nothing worked.
+ */
+describe('Pages', () => {
+  it('renders the home page, data included', async () => {
+    const app = await createTestApp()
+
+    const response = await app.send(makeIncomingHttpEvent({ method: 'GET', url: '/?name=Ada' }))
+
+    expect(response.statusCode).toBe(200)
+    // A page is a handler, so a rendered page is a response whose body is HTML. Query that HTML with
+    // whatever you already use (happy-dom, jsdom, Testing Library): none is bundled here.
+    expect(response.html()).toContain('Ada')
+  })
+
+  it('renders without a name', async () => {
+    const app = await createTestApp()
+
+    const response = await app.send(makeIncomingHttpEvent({ method: 'GET', url: '/' }))
+
+    expect(response.statusCode).toBe(200)
+  })
+})

package/full-react-declarative/app/Application.ts

@@ -2,7 +2,6 @@ import { Routing } from '@stone-js/router'
 import { Browser } from '@stone-js/browser-adapter'
 import { Hook, UseReact } from '@stone-js/use-react'
 import { NodeHttp } from '@stone-js/node-http-adapter'
-import { NodeConsole } from '@stone-js/node-cli-adapter'
 import { IBlueprint, IContainer, ILogger, LogLevel, Promiseable, StoneApp } from '@stone-js/core'
 
 /**
@@ -13,8 +12,6 @@ import { IBlueprint, IContainer, ILogger, LogLevel, Promiseable, StoneApp } from
  * @StoneApp() is used to enable the Stone application, it is mandatory.
  * @Routing() is used to enable the routing feature.
  * @NodeHttp() is used to enable the Node HTTP adapter.
- * @NodeConsole() is used to enable the Node Console adapter.
- * @NodeConsole() requires the incoming event type.
  * BodyEventMiddleware is used to parse the incoming event body.
  * BodyEventMiddleware is imported because it is not installed by default.
  *
@@ -25,7 +22,6 @@ import { IBlueprint, IContainer, ILogger, LogLevel, Promiseable, StoneApp } from
 @Routing()
 @Browser()
 @UseReact()
-@NodeConsole()
 @NodeHttp({ default: true, url: 'http://localhost:3100' })
 @StoneApp({ name: 'My Stone', logger: { level: LogLevel.DEBUG } })
 export class Application {

package/full-react-declarative/package.json

@@ -14,19 +14,18 @@
     "build": "stone build",
     "preview": "stone preview",
     "build:ssr": "stone build --ssr",
-    "test": "vitest run",
-    "test:cvg": "npm run test -- --coverage"
+    "test": "stone test",
+    "test:cvg": "stone test --coverage"
   },
   "dependencies": {
-    "@stone-js/env": "^0.8.8",
-    "@stone-js/http-core": "^0.8.8",
-    "@stone-js/node-http-adapter": "^0.8.8",
-    "@stone-js/router": "^0.8.8",
-    "@stone-js/filesystem": "^0.8.8",
-    "@stone-js/core": "^0.8.8",
-    "@stone-js/use-react": "^0.8.8",
-    "@stone-js/browser-adapter": "^0.8.8",
-    "@stone-js/node-cli-adapter": "^0.8.8",
+    "@stone-js/env": "^0.8.9",
+    "@stone-js/http-core": "^0.8.9",
+    "@stone-js/node-http-adapter": "^0.8.9",
+    "@stone-js/router": "^0.8.9",
+    "@stone-js/filesystem": "^0.8.9",
+    "@stone-js/core": "^0.8.9",
+    "@stone-js/use-react": "^0.8.9",
+    "@stone-js/browser-adapter": "^0.8.9",
     "axios": "^1.7.9",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
@@ -35,7 +34,8 @@
     "@babel/plugin-proposal-decorators": "^7.25.9",
     "@babel/preset-env": "^7.26.9",
     "@babel/preset-typescript": "^7.27.0",
-    "@stone-js/cli": "^0.8.8",
+    "@stone-js/cli": "^0.8.9",
+    "@stone-js/testing": "^0.8.9",
     "@types/axios": "^0.14.4",
     "@types/node": "^24.0.7",
     "@types/react": "^19.0.7",

package/full-react-declarative/public/favicon.svg

@@ -0,0 +1,16 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 96 96" width="96" height="96" role="img" aria-label="Stone.js">
+  <title>Stone.js</title>
+  <style>
+    .ink { stroke: #1B1613; }
+    @media (prefers-color-scheme: dark) { .ink { stroke: #EFE8DC; } }
+  </style>
+  <defs>
+    <linearGradient id="braise" gradientUnits="userSpaceOnUse" x1="22" y1="14" x2="74" y2="26.1">
+      <stop offset="0" stop-color="#FFC46B" />
+      <stop offset="1" stop-color="#FF5A1F" />
+    </linearGradient>
+  </defs>
+  <path class="ink" d="M 79.96 36.4 A 34 34 0 0 1 53.9 81.5" fill="none" stroke-width="11" stroke-linecap="round" opacity=".85" />
+  <path class="ink" d="M 42.1 81.5 A 34 34 0 0 1 16.05 36.4" fill="none" stroke-width="11" stroke-linecap="round" opacity=".85" />
+  <path d="M 22 26.1 A 34 34 0 0 1 74 26.1" fill="none" stroke="url(#braise)" stroke-width="11" stroke-linecap="round" />
+</svg>

package/full-react-declarative/stone.config.mjs

@@ -1,9 +1,9 @@
-import { defineConfig } from '@stone-js/cli'
+import { defineBuilderConfig } from '@stone-js/cli'
 
 /**
  * Stone build configuration.
  */
-export default defineConfig({
+export default defineBuilderConfig({
   dotenv: {
     private: {
       path: ['.env', '.env.public'],

package/full-react-declarative/tests/application.spec.ts

@@ -0,0 +1,30 @@
+import { createTestApp, makeIncomingHttpEvent } from '@stone-js/testing'
+
+/**
+ * The whole application, booted in memory and asked a real question.
+ *
+ * Nothing is mocked and nothing is listed: `createTestApp()` discovers `app/**`, and the event goes
+ * through the same kernel production runs. If this passes the application works; if it fails the
+ * application is broken. That is the only kind of test worth shipping in a starter — the previous one
+ * stubbed out the framework's own decorators, which meant it could pass while nothing worked.
+ */
+describe('Pages', () => {
+  it('renders the home page, data included', async () => {
+    const app = await createTestApp()
+
+    const response = await app.send(makeIncomingHttpEvent({ method: 'GET', url: '/?name=Ada' }))
+
+    expect(response.statusCode).toBe(200)
+    // A page is a handler, so a rendered page is a response whose body is HTML. Query that HTML with
+    // whatever you already use (happy-dom, jsdom, Testing Library): none is bundled here.
+    expect(response.html()).toContain('Ada')
+  })
+
+  it('renders without a name', async () => {
+    const app = await createTestApp()
+
+    const response = await app.send(makeIncomingHttpEvent({ method: 'GET', url: '/' }))
+
+    expect(response.statusCode).toBe(200)
+  })
+})

package/full-react-imperative/app/Application.ts

@@ -1,7 +1,6 @@
 import { routerBlueprint } from '@stone-js/router'
 import { browserAdapterBlueprint } from '@stone-js/browser-adapter'
 import { nodeHttpAdapterBlueprint } from '@stone-js/node-http-adapter'
-import { nodeConsoleAdapterBlueprint } from '@stone-js/node-cli-adapter'
 import { defineStoneReactApp, ReactLifecycleHookType } from '@stone-js/use-react'
 import { defineHookListeners, IBlueprint, IContainer, ILogger, LogLevel, Promiseable } from '@stone-js/core'
 
@@ -61,8 +60,7 @@ export const MyStoneReactApp = defineStoneReactApp(
   [
     routerBlueprint,
     browserAdapterBlueprint,
-    nodeHttpAdapterBlueprint,
-    nodeConsoleAdapterBlueprint
+    nodeHttpAdapterBlueprint
   ]
 )
 

package/full-react-imperative/package.json

@@ -14,19 +14,18 @@
     "build": "stone build",
     "preview": "stone preview",
     "build:ssr": "stone build --ssr",
-    "test": "vitest run",
-    "test:cvg": "npm run test -- --coverage"
+    "test": "stone test",
+    "test:cvg": "stone test --coverage"
   },
   "dependencies": {
-    "@stone-js/env": "^0.8.8",
-    "@stone-js/http-core": "^0.8.8",
-    "@stone-js/node-http-adapter": "^0.8.8",
-    "@stone-js/router": "^0.8.8",
-    "@stone-js/filesystem": "^0.8.8",
-    "@stone-js/core": "^0.8.8",
-    "@stone-js/use-react": "^0.8.8",
-    "@stone-js/browser-adapter": "^0.8.8",
-    "@stone-js/node-cli-adapter": "^0.8.8",
+    "@stone-js/env": "^0.8.9",
+    "@stone-js/http-core": "^0.8.9",
+    "@stone-js/node-http-adapter": "^0.8.9",
+    "@stone-js/router": "^0.8.9",
+    "@stone-js/filesystem": "^0.8.9",
+    "@stone-js/core": "^0.8.9",
+    "@stone-js/use-react": "^0.8.9",
+    "@stone-js/browser-adapter": "^0.8.9",
     "axios": "^1.7.9",
     "dayjs": "^1.11.13",
     "react": "^19.0.0",
@@ -36,7 +35,8 @@
     "@babel/plugin-proposal-decorators": "^7.25.9",
     "@babel/preset-env": "^7.26.9",
     "@babel/preset-typescript": "^7.27.0",
-    "@stone-js/cli": "^0.8.8",
+    "@stone-js/cli": "^0.8.9",
+    "@stone-js/testing": "^0.8.9",
     "@types/axios": "^0.14.4",
     "@types/node": "^24.0.7",
     "@types/react": "^19.0.7",

package/full-react-imperative/public/favicon.svg

@@ -0,0 +1,16 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 96 96" width="96" height="96" role="img" aria-label="Stone.js">
+  <title>Stone.js</title>
+  <style>
+    .ink { stroke: #1B1613; }
+    @media (prefers-color-scheme: dark) { .ink { stroke: #EFE8DC; } }
+  </style>
+  <defs>
+    <linearGradient id="braise" gradientUnits="userSpaceOnUse" x1="22" y1="14" x2="74" y2="26.1">
+      <stop offset="0" stop-color="#FFC46B" />
+      <stop offset="1" stop-color="#FF5A1F" />
+    </linearGradient>
+  </defs>
+  <path class="ink" d="M 79.96 36.4 A 34 34 0 0 1 53.9 81.5" fill="none" stroke-width="11" stroke-linecap="round" opacity=".85" />
+  <path class="ink" d="M 42.1 81.5 A 34 34 0 0 1 16.05 36.4" fill="none" stroke-width="11" stroke-linecap="round" opacity=".85" />
+  <path d="M 22 26.1 A 34 34 0 0 1 74 26.1" fill="none" stroke="url(#braise)" stroke-width="11" stroke-linecap="round" />
+</svg>

package/full-react-imperative/stone.config.mjs

@@ -1,9 +1,9 @@
-import { defineConfig } from '@stone-js/cli'
+import { defineBuilderConfig } from '@stone-js/cli'
 
 /**
  * Stone build configuration.
  */
-export default defineConfig({
+export default defineBuilderConfig({
   dotenv: {
     private: {
       path: ['.env', '.env.public'],

package/full-react-imperative/tests/application.spec.ts

@@ -0,0 +1,30 @@
+import { createTestApp, makeIncomingHttpEvent } from '@stone-js/testing'
+
+/**
+ * The whole application, booted in memory and asked a real question.
+ *
+ * Nothing is mocked and nothing is listed: `createTestApp()` discovers `app/**`, and the event goes
+ * through the same kernel production runs. If this passes the application works; if it fails the
+ * application is broken. That is the only kind of test worth shipping in a starter — the previous one
+ * stubbed out the framework's own decorators, which meant it could pass while nothing worked.
+ */
+describe('Pages', () => {
+  it('renders the home page, data included', async () => {
+    const app = await createTestApp()
+
+    const response = await app.send(makeIncomingHttpEvent({ method: 'GET', url: '/?name=Ada' }))
+
+    expect(response.statusCode).toBe(200)
+    // A page is a handler, so a rendered page is a response whose body is HTML. Query that HTML with
+    // whatever you already use (happy-dom, jsdom, Testing Library): none is bundled here.
+    expect(response.html()).toContain('Ada')
+  })
+
+  it('renders without a name', async () => {
+    const app = await createTestApp()
+
+    const response = await app.send(makeIncomingHttpEvent({ method: 'GET', url: '/' }))
+
+    expect(response.statusCode).toBe(200)
+  })
+})

package/full-service-declarative/app/Application.ts

@@ -1,11 +1,11 @@
 import {
+  Cors,
   IncomingHttpEvent,
   OutgoingHttpResponse,
   IncomingHttpEventOptions
 } from '@stone-js/http-core'
 import {
   NodeHttp,
-  MetaBodyEventMiddleware,
   MetaFilesEventMiddleware
 } from '@stone-js/node-http-adapter'
 import {
@@ -35,15 +35,18 @@ import { PipelineHookContext } from '@stone-js/pipeline'
  * @NodeHttp() is used to enable the Node HTTP adapter.
  * @NodeConsole() is used to enable the Node Console adapter.
  * @NodeConsole() requires the incoming event type.
+ * @Cors() answers cross-origin requests, on the kernel and the adapter alike.
+ *   Nothing is allowed until you name the origins you trust: add `origin: ['https://your-front']`.
  * BodyEventMiddleware is used to parse the incoming event body.
  * BodyEventMiddleware is imported because it is not installed by default.
  *
  * Note: In this example we implement the IBlueprintHook, IAdapterHook and IKernelHook interfaces for demonstration purposes.
  */
+@Cors({ preflightStop: true, allowedHeaders: ['*'] })
 @Routing()
 @NodeConsole()
 @StoneApp({ name: 'MyApps', logger: { level: LogLevel.INFO } })
-@NodeHttp({ default: true, middleware: [MetaBodyEventMiddleware, MetaFilesEventMiddleware], url: getString('BASE_URL', 'http://localhost:8080') })
+@NodeHttp({ default: true, middleware: [MetaFilesEventMiddleware], url: getString('BASE_URL', 'http://localhost:8080') })
 export class Application {
   /**
    * Run before the blueprint is prepared

package/full-service-declarative/app/configurations/AppConfiguration.ts

@@ -1,7 +1,6 @@
 import { Config } from '@libsql/client'
 import { getString } from '@stone-js/env'
-import { CORSHeadersMiddleware } from '@stone-js/http-core'
-import { Configuration, defineBlueprintMiddleware, IBlueprint, IConfiguration, LogLevel, Promiseable } from '@stone-js/core'
+import { Configuration, IBlueprint, IConfiguration, LogLevel, Promiseable } from '@stone-js/core'
 
 /**
  * User Implicit Configuration
@@ -23,7 +22,6 @@ export class AppConfiguration implements IConfiguration {
       .set('stone.logger.level', LogLevel.INFO)
       .set('stone.http.cors.preflightStop', true)
       .set('stone.http.cors.allowedHeaders', ['*'])
-      .set(defineBlueprintMiddleware(CORSHeadersMiddleware))
   }
 
   /**

package/full-service-declarative/package.json

@@ -17,28 +17,29 @@
     "db:setup": "drizzle-kit push",
     "db:generate": "drizzle-kit generate",
     "db:migrate": "drizzle-kit migrate",
-    "test": "vitest run",
-    "test:cvg": "npm run test -- --coverage"
+    "test": "stone test",
+    "test:cvg": "stone test --coverage"
   },
   "dependencies": {
     "@libsql/client": "^0.14.0",
-    "@stone-js/core": "^0.8.8",
-    "@stone-js/env": "^0.8.8",
-    "@stone-js/filesystem": "^0.8.8",
-    "@stone-js/http-core": "^0.8.8",
-    "@stone-js/node-cli-adapter": "^0.8.8",
-    "@stone-js/node-http-adapter": "^0.8.8",
-    "@stone-js/pipeline": "^0.8.8",
-    "@stone-js/router": "^0.8.8",
+    "@stone-js/core": "^0.8.9",
+    "@stone-js/env": "^0.8.9",
+    "@stone-js/filesystem": "^0.8.9",
+    "@stone-js/http-core": "^0.8.9",
+    "@stone-js/node-cli-adapter": "^0.8.9",
+    "@stone-js/node-http-adapter": "^0.8.9",
+    "@stone-js/pipeline": "^0.8.9",
+    "@stone-js/router": "^0.8.9",
     "bcryptjs": "^3.0.2",
-    "drizzle-orm": "^0.44.7",
+    "drizzle-orm": "^0.45.2",
     "jsonwebtoken": "^9.0.2"
   },
   "devDependencies": {
     "@babel/plugin-proposal-decorators": "^7.25.9",
     "@babel/preset-env": "^7.26.9",
     "@babel/preset-typescript": "^7.27.0",
-    "@stone-js/cli": "^0.8.8",
+    "@stone-js/cli": "^0.8.9",
+    "@stone-js/testing": "^0.8.9",
     "@types/jsonwebtoken": "^9.0.8",
     "@types/node": "^24.0.3",
     "@vitest/coverage-v8": "^3.0.9",

package/full-service-declarative/stone.config.mjs

@@ -1,9 +1,9 @@
-import { defineConfig } from '@stone-js/cli'
+import { defineBuilderConfig } from '@stone-js/cli'
 
 /**
  * Stone build configuration.
  */
-export default defineConfig({
+export default defineBuilderConfig({
   rollup: {
     bundle: {
       external: ['@libsql/client'],

package/full-service-declarative/tests/application.spec.ts

@@ -0,0 +1,30 @@
+import { createTestApp, makeIncomingHttpEvent } from '@stone-js/testing'
+
+/**
+ * The whole application, booted in memory and asked a real question.
+ *
+ * Nothing is mocked and nothing is listed: `createTestApp()` discovers `app/**`, and the event goes
+ * through the same kernel production runs. If this passes the application works; if it fails the
+ * application is broken. That is the only kind of test worth shipping in a starter — the previous one
+ * stubbed out the framework's own decorators, which meant it could pass while nothing worked.
+ */
+describe('Application', () => {
+  it('answers on the public welcome route', async () => {
+    const app = await createTestApp()
+
+    const response = await app.send(makeIncomingHttpEvent({ method: 'GET', url: '/' }))
+
+    expect(response.statusCode).toBe(200)
+    expect(response.json()).toMatchObject({ message: expect.stringContaining('Stone.js') })
+  })
+
+  it('refuses an unauthenticated request to a protected route', async () => {
+    // Substitute a repository with `bindings` when a route needs data:
+    // createTestApp({ bindings: { userRepository: fakeRepository } })
+    const app = await createTestApp()
+
+    const response = await app.send(makeIncomingHttpEvent({ method: 'GET', url: '/users' }))
+
+    expect(response.statusCode).toBeGreaterThanOrEqual(400)
+  })
+})

package/full-service-imperative/app/Application.ts

@@ -1,4 +1,5 @@
 import {
+  corsBlueprint,
   IncomingHttpEvent,
   OutgoingHttpResponse,
   IncomingHttpEventOptions
@@ -21,7 +22,7 @@ import { getString } from '@stone-js/env'
 import { routerBlueprint } from '@stone-js/router'
 import { PipelineHookContext } from '@stone-js/pipeline'
 import { nodeConsoleAdapterBlueprint } from '@stone-js/node-cli-adapter'
-import { MetaBodyEventMiddleware, MetaFilesEventMiddleware, NODE_HTTP_PLATFORM, nodeHttpAdapterBlueprint } from '@stone-js/node-http-adapter'
+import { MetaFilesEventMiddleware, NODE_HTTP_PLATFORM, nodeHttpAdapterBlueprint } from '@stone-js/node-http-adapter'
 
 /**
  * Run before the blueprint is prepared
@@ -288,6 +289,7 @@ export const onTerminate = defineHookListener((container: IContainer): void => {
 export const Application = defineStoneApp(
   { name: 'MyApp', logger: { level: LogLevel.INFO } },
   [
+    corsBlueprint,
     routerBlueprint,
     nodeHttpAdapterBlueprint,
     nodeConsoleAdapterBlueprint
@@ -308,10 +310,14 @@ export const AppConfig = defineConfig({
       })
   },
   afterConfigure (blueprint: IBlueprint) {
+    // Nothing is allowed cross-origin until you name the origins you trust:
+    // add `origin: ['https://your-front']` here.
+    blueprint.set('stone.http.cors', { preflightStop: true, allowedHeaders: ['*'] })
+
     if (blueprint.is('stone.adapter.platform', NODE_HTTP_PLATFORM)) {
       blueprint
         .set('stone.adapter.url', getString('BASE_URL', 'http://localhost:8080'))
-        .add('stone.adapter.middleware', [MetaBodyEventMiddleware, MetaFilesEventMiddleware])
+        .add('stone.adapter.middleware', [MetaFilesEventMiddleware])
     }
   }
 })

package/full-service-imperative/app/configurations/AppConfiguration.ts

@@ -1,7 +1,6 @@
 import { Config } from '@libsql/client'
 import { getString } from '@stone-js/env'
-import { CORSHeadersMiddleware } from '@stone-js/http-core'
-import { defineBlueprintMiddleware, defineConfig, IBlueprint, LogLevel, Promiseable } from '@stone-js/core'
+import { defineConfig, IBlueprint, LogLevel, Promiseable } from '@stone-js/core'
 
 /**
  * User Implicit Configuration
@@ -16,7 +15,6 @@ export const AppConfiguration = defineConfig((blueprint: IBlueprint): Promiseabl
     .set('stone.logger.level', LogLevel.INFO)
     .set('stone.http.cors.preflightStop', true)
     .set('stone.http.cors.allowedHeaders', ['*'])
-    .set(defineBlueprintMiddleware(CORSHeadersMiddleware))
 })
 
 /**