fix(hono-adapter): always expose set-auth-token via CORS

[Copilot]

Follow-up to #1177 and #1178. Those fixed CORS preflight and wildcard origin matching across the three Hono-based code paths, but cross-origin auth was still broken on Vercel: createHonoApp() defaulted exposeHeaders to [], diverging from plugin-hono-server (which sets ['set-auth-token'] since 151dd19c). Since apps/server routes all traffic through createHonoApp() on Vercel, browsers stripped set-auth-token from every response, preventing the better-auth bearer() plugin from delivering rotated session tokens — sessions silently broke on any cross-origin refresh even though preflight and the request both succeeded.

Changes

• packages/adapters/hono/src/index.ts — always include set-auth-token in exposeHeaders, merged and deduped with user-supplied values; mirrors plugin-hono-server lines 155–161.
• packages/adapters/hono/src/hono.test.ts — three new cases: default exposes set-auth-token, user-supplied exposeHeaders are merged (not replaced), no duplication when both include it.
• CHANGELOG.md — Unreleased / Fixed entry.

// Before
app.use('*', cors({
  exposeHeaders: corsOpts.exposeHeaders || [],
  ...
}));

// After — matches plugin-hono-server invariant
const exposeHeaders = Array.from(new Set([
  'set-auth-token',
  ...(corsOpts.exposeHeaders ?? []),
]));
app.use('*', cors({ exposeHeaders, ... }));

Invariant worth preserving

All three Hono-based CORS sites must default exposeHeaders to include set-auth-token:

1. packages/plugins/plugin-hono-server/src/hono-plugin.ts
2. packages/adapters/hono/src/index.ts — createHonoApp() ← this PR
3. Any future adapter wrapping Hono's cors()

apps/server/server/index.ts is unaffected — its short-circuit handles OPTIONS only, and Access-Control-Expose-Headers applies to actual responses, which flow through createHonoApp().

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
objectstack-demo	Ready	Preview, Comment	Apr 17, 2026 11:38am
spec	Ready	Preview, Comment	Apr 17, 2026 11:38am