Fix CORS_ORIGIN wildcard patterns in @objectstack/hono adapter

[Copilot]

PR #1177 unified wildcard matching across the Vercel OPTIONS short-circuit and plugin-hono-server, but missed a third path: createHonoApp() in @objectstack/hono. Since apps/server routes all non-OPTIONS traffic through this adapter on Vercel, preflights succeeded but the ensuing POST/GET responses shipped without Access-Control-Allow-Origin — the browser blocked every real request.

Root cause

createHonoApp() passed CORS_ORIGIN straight into Hono's cors() middleware, which does exact-string comparison and treats * as a literal character:

// CORS_ORIGIN="https://*.objectui.org,http://localhost:*"app.use('*',cors({origin: ['https://*.objectui.org','http://localhost:*']}));// → no match for https://app.objectui.org → no Access-Control-Allow-Origin header

Changes

• packages/adapters/hono/src/index.ts — detect wildcard patterns via hasWildcardPattern and swap in a createOriginMatcher function for Hono's origin option. Branch logic mirrors plugin-hono-server exactly, preserving the single source of truth established in Fix CORS_ORIGIN wildcard patterns on Vercel deployments #1177.
• packages/adapters/hono/package.json — add workspace dep on @objectstack/plugin-hono-server (no cycle; the plugin depends only on core + spec).
• packages/adapters/hono/src/hono.test.ts — 5 new tests covering subdomain wildcards, port wildcards, comma-separated lists, rejection of unmatched origins, and wildcard preflight.
• CHANGELOG.md — follow-up entry under Unreleased / Fixed.

Invariant worth preserving

All three Hono-based CORS sites must route wildcard handling through @objectstack/plugin-hono-server:

1. apps/server/server/index.ts — Vercel OPTIONS short-circuit
2. packages/plugins/plugin-hono-server/src/hono-plugin.ts
3. packages/adapters/hono/src/index.ts — createHonoApp() ← this PR

Any future CORS change needs to touch all three or risk the same split-brain failure mode.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
objectstack-demo	Ready	Preview, Comment	Apr 17, 2026 11:10am
spec	Ready	Preview, Comment	Apr 17, 2026 11:10am