plugin-auth: always register better-auth bearer() for cross-origin / mobile token auth

[Copilot]

Session cookies are blocked third-party, so cross-origin SPAs (e.g. localhost:5173 → demo.objectstack.ai) and native mobile clients lose sessions on reload. better-auth's bearer() plugin solves this by accepting Authorization: ****** and emitting rotated tokens via the set-auth-token` response header — but it requires both server-plugin registration and CORS header plumbing.

Changes

• @objectstack/plugin-auth — AuthManager.buildPluginList() unconditionally prepends bearer(). Additive to cookie auth; no config surface change. AuthConfig.trustedOrigins was already wired through.
• @objectstack/plugin-hono-server — CORS middleware always exposes set-auth-token so the client SDK can capture rotated tokens. HonoCorsOptions gains allowHeaders / exposeHeaders; user-supplied exposeHeaders are merged (deduped) with the default rather than overriding it, so adding an app header can't accidentally break bearer auth.

// Default behavior — no config needed
new HonoServerPlugin({ cors: { origins: 'https://app.example.com', credentials: true } });
// → Access-Control-Expose-Headers: set-auth-token
// → Access-Control-Allow-Headers:   Content-Type, Authorization, X-Requested-With

// Extend without losing the bearer default
new HonoServerPlugin({
  cors: {
    exposeHeaders: ['X-Request-Id'],          // merged → [set-auth-token, X-Request-Id]
    allowHeaders:  ['Content-Type', 'Authorization', 'X-Tenant-Id'],
  },
});

Tests

• auth-manager.test.ts — new case asserting bearer is registered with no plugin config; existing plugin-count assertions updated (+1).
• hono-plugin.test.ts — new mock of hono/cors captures config; 3 cases covering the default expose, expose-header merging, and custom allow-headers.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
objectstack-demo	Ready	Preview, Comment	Apr 17, 2026 4:18am
spec	Building	Preview, Comment	Apr 17, 2026 4:18am