@rebasepro/server-core 0.5.0 → 0.6.1

package/src/api/graphql/graphql-schema-generator.ts

@@ -184,8 +184,9 @@ export class GraphQLSchemaGenerator {
                     id: { type: new GraphQLNonNull(GraphQLString) }
                 },
                 resolve: async (_, args, context: unknown) => {
-                    const ctx = context as { driver: DataDriver };
-                    const ds = ctx.driver || this.driver;
+                    const ctx = context as { driver?: DataDriver } | undefined;
+                    const ds = ctx?.driver;
+                    if (!ds) throw new Error("Scoped driver not available");
                     const entity = await ds.fetchEntity({
                         path: collection.slug,
                         entityId: args.id,
@@ -207,8 +208,9 @@ defaultValue: 0 },
                     orderBy: { type: GraphQLString }
                 },
                 resolve: async (_, args, context: unknown) => {
-                    const ctx = context as { driver: DataDriver };
-                    const ds = ctx.driver || this.driver;
+                    const ctx = context as { driver?: DataDriver } | undefined;
+                    const ds = ctx?.driver;
+                    if (!ds) throw new Error("Scoped driver not available");
                     let filter: FetchCollectionProps["filter"] | undefined;
                     if (args.where) {
                         try {
@@ -259,8 +261,9 @@ defaultValue: 0 },
                     input: { type: new GraphQLNonNull(inputType) }
                 },
                 resolve: async (_, args, context: unknown) => {
-                    const ctx = context as { driver: DataDriver };
-                    const ds = ctx.driver || this.driver;
+                    const ctx = context as { driver?: DataDriver } | undefined;
+                    const ds = ctx?.driver;
+                    if (!ds) throw new Error("Scoped driver not available");
                     const path = collection.slug;
                     const entity = await ds.saveEntity({
                         path,
@@ -280,8 +283,9 @@ defaultValue: 0 },
                     input: { type: new GraphQLNonNull(inputType) }
                 },
                 resolve: async (_, args, context: unknown) => {
-                    const ctx = context as { driver: DataDriver };
-                    const ds = ctx.driver || this.driver;
+                    const ctx = context as { driver?: DataDriver } | undefined;
+                    const ds = ctx?.driver;
+                    if (!ds) throw new Error("Scoped driver not available");
                     const entity = await ds.saveEntity({
                         path: collection.slug,
                         entityId: args.id,
@@ -301,8 +305,9 @@ defaultValue: 0 },
                 },
                 resolve: async (_, args, context: unknown) => {
                     try {
-                        const ctx = context as { driver: DataDriver };
-                        const ds = ctx.driver || this.driver;
+                        const ctx = context as { driver?: DataDriver } | undefined;
+                        const ds = ctx?.driver;
+                        if (!ds) throw new Error("Scoped driver not available");
                         const existingEntity = await ds.fetchEntity({
                             path: collection.slug,
                             entityId: args.id,

package/src/api/logs-routes.ts

@@ -22,7 +22,8 @@ class LogRingBuffer {
 
     push(entry: Omit<LogEntry, "id">): void {
         const id = `log_${++this.idCounter}`;
-        this.buffer.push({ ...entry, id });
+        this.buffer.push({ ...entry,
+id });
         if (this.buffer.length > this.maxSize) {
             this.buffer.shift();
         }
@@ -95,11 +96,13 @@ export function logMiddleware(): MiddlewareHandler<HonoEnv> {
         const start = Date.now();
         await next();
         const duration = Date.now() - start;
+        const reqId = c.get("requestId");
         addLog("info", "api", `${c.req.method} ${c.req.path} ${c.res.status} ${duration}ms`, {
             method: c.req.method,
             path: c.req.path,
             status: c.res.status,
-            duration
+            duration,
+            ...(reqId && { requestId: reqId })
         });
     };
 }

package/src/api/rest/api-generator-count.test.ts

@@ -1,4 +1,5 @@
 import { jest } from "@jest/globals";
+import { Hono } from "hono";
 import { RestApiGenerator } from "./api-generator";
 import type { DataDriver, Entity, EntityCollection, FetchCollectionProps } from "@rebasepro/types";
 
@@ -27,6 +28,21 @@ function createTestCollection(slug: string): EntityCollection {
     } as unknown as EntityCollection;
 }
 
+/**
+ * Wraps generated routes in a parent Hono app that injects the driver
+ * into context — replicating what auth middleware does in production.
+ */
+function createApp(collections: EntityCollection[], driver: DataDriver): Hono {
+    const parent = new Hono();
+    parent.use("/*", async (c, next) => {
+        c.set("driver", driver);
+        await next();
+    });
+    const generator = new RestApiGenerator(collections, driver);
+    parent.route("/", generator.generateRoutes());
+    return parent;
+}
+
 describe("RestApiGenerator - Count Endpoint", () => {
     let driver: DataDriver;
     let collection: EntityCollection;
@@ -39,8 +55,7 @@ describe("RestApiGenerator - Count Endpoint", () => {
     });
 
     it("GET /products/count should return a count object", async () => {
-        const generator = new RestApiGenerator([collection], driver);
-        const app = generator.generateRoutes();
+        const app = createApp([collection], driver);
 
         const res = await app.request("/products/count");
         expect(res.status).toBe(200);
@@ -50,8 +65,7 @@ describe("RestApiGenerator - Count Endpoint", () => {
     });
 
     it("should pass filters to countEntities driver", async () => {
-        const generator = new RestApiGenerator([collection], driver);
-        const app = generator.generateRoutes();
+        const app = createApp([collection], driver);
 
         const res = await app.request("/products/count?status=eq.active");
         expect(res.status).toBe(200);
@@ -67,8 +81,7 @@ describe("RestApiGenerator - Count Endpoint", () => {
     });
 
     it("should pass searchString to countEntities driver", async () => {
-        const generator = new RestApiGenerator([collection], driver);
-        const app = generator.generateRoutes();
+        const app = createApp([collection], driver);
 
         const res = await app.request("/products/count?searchString=widget");
         expect(res.status).toBe(200);
@@ -83,8 +96,7 @@ describe("RestApiGenerator - Count Endpoint", () => {
 
     it("should return 0 when countEntities is not available on driver", async () => {
         const driverWithoutCount = createMockDriver({ countEntities: undefined });
-        const generator = new RestApiGenerator([collection], driverWithoutCount);
-        const app = generator.generateRoutes();
+        const app = createApp([collection], driverWithoutCount);
 
         const res = await app.request("/products/count");
         expect(res.status).toBe(200);
@@ -100,8 +112,7 @@ describe("RestApiGenerator - Count Endpoint", () => {
             countEntities: jest.fn<NonNullable<DataDriver["countEntities"]>>().mockResolvedValue(99),
             fetchEntity: fetchEntity as unknown as DataDriver["fetchEntity"]
         });
-        const generator = new RestApiGenerator([collection], driverCustom);
-        const app = generator.generateRoutes();
+        const app = createApp([collection], driverCustom);
 
         const res = await app.request("/products/count");
         expect(res.status).toBe(200);

package/src/api/rest/api-generator.ts

@@ -1,10 +1,11 @@
 import { Hono } from "hono";
-import { DataDriver, Entity, EntityCollection, FetchCollectionProps, DataHooks, BackendHookContext, RestFetchService } from "@rebasepro/types";
+import { AuthAdapter, DataDriver, Entity, EntityCollection, FetchCollectionProps, DataHooks, BackendHookContext, RestFetchService } from "@rebasepro/types";
 import { QueryOptions, HonoEnv } from "../types";
 import { ApiError, isRebaseApiError } from "../errors";
 import { parseQueryOptions } from "./query-parser";
 import { httpMethodToOperation, isOperationAllowed } from "../../auth/api-keys/api-key-permission-guard";
 import type { ApiKeyMasked } from "../../auth/api-keys/api-key-types";
+import { logger } from "../../utils/logger";
 
 
 /**
@@ -16,11 +17,18 @@ export class RestApiGenerator {
     private router: Hono<HonoEnv>;
     private driver: DataDriver;
     private dataHooks?: DataHooks;
-
-    constructor(collections: EntityCollection[], driver: DataDriver, dataHooks?: DataHooks) {
+    private authAdapter?: AuthAdapter;
+
+    constructor(
+        collections: EntityCollection[],
+        driver: DataDriver,
+        dataHooks?: DataHooks,
+        authAdapter?: AuthAdapter
+    ) {
         this.collections = collections;
         this.driver = driver;
         this.dataHooks = dataHooks;
+        this.authAdapter = authAdapter;
         this.router = new Hono<HonoEnv>();
     }
 
@@ -28,7 +36,8 @@ export class RestApiGenerator {
     private buildHookContext(c: { get: (key: string) => unknown }, method: BackendHookContext["method"]): BackendHookContext {
         const user = c.get("user") as { userId: string; roles?: string[] } | undefined;
         return {
-            requestUser: user ? { userId: user.userId, roles: user.roles ?? [] } : undefined,
+            requestUser: user ? { userId: user.userId,
+roles: user.roles ?? [] } : undefined,
             method
         };
     }
@@ -56,7 +65,7 @@ export class RestApiGenerator {
      */
     private enforceApiKeyPermission(
         c: { get: (key: string) => unknown; req: { method: string } },
-        collectionSlug: string,
+        collectionSlug: string
     ): void {
         const apiKey = c.get("apiKey") as ApiKeyMasked | undefined;
         if (!apiKey) return; // Not an API key request — skip
@@ -65,11 +74,21 @@ export class RestApiGenerator {
         if (!isOperationAllowed(apiKey.permissions, collectionSlug, operation)) {
             throw ApiError.forbidden(
                 `API key does not have "${operation}" permission for collection "${collectionSlug}"`,
-                "API_KEY_FORBIDDEN",
+                "API_KEY_FORBIDDEN"
             );
         }
     }
 
+    /**
+     * Get the request-scoped driver. Throws if none is set — never falls
+     * back to the unscoped `this.driver` to avoid bypassing RLS/auth.
+     */
+    private getScopedDriver(c: { get: (key: string) => unknown }): DataDriver {
+        const driver = c.get("driver") as DataDriver | undefined;
+        if (!driver) throw ApiError.internal("Scoped driver not available");
+        return driver;
+    }
+
     /**
      * Get the typed RestFetchService from a driver if it exposes one (for include support).
      */
@@ -90,7 +109,7 @@ export class RestApiGenerator {
             const queryDict = c.req.queries();
             const queryOptions = parseQueryOptions(queryDict);
             const searchString = Array.isArray(queryDict.searchString) ? queryDict.searchString[queryDict.searchString.length - 1] : undefined;
-            const driver = c.get("driver") || this.driver;
+            const driver = this.getScopedDriver(c);
 
             const total = await this.countRawEntities(driver, resolvedCollection, queryOptions, searchString);
             return c.json({ count: total });
@@ -103,7 +122,7 @@ export class RestApiGenerator {
             const queryOptions = parseQueryOptions(queryDict);
             const searchString = Array.isArray(queryDict.searchString) ? queryDict.searchString[queryDict.searchString.length - 1] : undefined;
 
-            const driver = c.get("driver") || this.driver;
+            const driver = this.getScopedDriver(c);
             const fetchService = this.getFetchService(driver);
             const hookCtx = this.buildHookContext(c, "GET");
 
@@ -163,7 +182,7 @@ export class RestApiGenerator {
             const id = c.req.param("id");
             const queryDict = c.req.queries();
             const queryOptions = parseQueryOptions(queryDict);
-            const driver = c.get("driver") || this.driver;
+            const driver = this.getScopedDriver(c);
             const fetchService = this.getFetchService(driver);
             const hookCtx = this.buildHookContext(c, "GET");
 
@@ -207,7 +226,7 @@ export class RestApiGenerator {
         this.router.post(basePath, async (c) => {
             try {
                 this.enforceApiKeyPermission(c, collection.slug);
-                const driver = c.get("driver") || this.driver;
+                const driver = this.getScopedDriver(c);
                 const path = collection.slug;
                 const hookCtx = this.buildHookContext(c, "POST");
 
@@ -217,6 +236,46 @@ export class RestApiGenerator {
                     body = await this.dataHooks.beforeSave(path, body, undefined, hookCtx);
                 }
 
+                const isAuth = collection.auth;
+                const isAuthCollection = isAuth === true || (isAuth && typeof isAuth === "object" && isAuth.enabled === true);
+
+                if (isAuthCollection && this.authAdapter?.prepareUserCreation) {
+                    const collectionAuthConfig = typeof isAuth === "object" ? isAuth : undefined;
+                    const prepared = await this.authAdapter.prepareUserCreation(body, collectionAuthConfig);
+
+                    const entity = await driver.saveEntity({
+                        path,
+                        values: prepared.values,
+                        collection: resolvedCollection,
+                        status: "new"
+                    });
+
+                    const result = prepared.hookHandledEmail
+                        ? { temporaryPassword: prepared.clearPassword,
+invitationSent: prepared.invitationSent }
+                        : this.authAdapter.finalizeUserCreation
+                            ? await this.authAdapter.finalizeUserCreation(
+                                { id: entity.id as string,
+values: entity.values as Record<string, unknown> },
+                                prepared.clearPassword
+                            )
+                            : { invitationSent: false };
+
+                    const response = this.formatResponse(entity) as Record<string, unknown>;
+
+                    if (this.dataHooks?.afterSave) {
+                        Promise.resolve(this.dataHooks.afterSave(path, response, hookCtx)).catch(err => {
+                            logger.error("[BackendHooks] data.afterSave error", { error: err instanceof Error ? err.message : err });
+                        });
+                    }
+
+                    return c.json({
+                        ...response,
+                        invitationSent: result.invitationSent,
+                        ...(result.temporaryPassword ? { temporaryPassword: result.temporaryPassword } : {})
+                    }, 201);
+                }
+
                 const entity = await driver.saveEntity({
                     path,
                     values: body,
@@ -228,14 +287,23 @@ export class RestApiGenerator {
 
                 if (this.dataHooks?.afterSave) {
                     Promise.resolve(this.dataHooks.afterSave(path, response as Record<string, unknown>, hookCtx)).catch(err => {
-                        console.error("[BackendHooks] data.afterSave error:", err instanceof Error ? err.message : err);
+                        logger.error("[BackendHooks] data.afterSave error", { error: err instanceof Error ? err.message : err });
                     });
                 }
 
                 return c.json(response, 201);
             } catch (error) {
                 if (isRebaseApiError(error) && !error.code) {
-                    error.code = "BAD_REQUEST";
+                    // Only classify as BAD_REQUEST if it's an operational error
+                    // (e.g. validation, DB constraints). Runtime bugs like TypeError,
+                    // RangeError etc. should remain as 500 INTERNAL_ERROR.
+                    const isRuntimeBug = error instanceof TypeError
+                        || error instanceof RangeError
+                        || error instanceof SyntaxError
+                        || error instanceof ReferenceError;
+                    if (!isRuntimeBug) {
+                        error.code = "BAD_REQUEST";
+                    }
                 }
                 throw error;
             }
@@ -246,7 +314,7 @@ export class RestApiGenerator {
             try {
                 this.enforceApiKeyPermission(c, collection.slug);
                 const id = c.req.param("id");
-                const driver = c.get("driver") || this.driver;
+                const driver = this.getScopedDriver(c);
                 const hookCtx = this.buildHookContext(c, "PUT");
 
                 const existingEntity = await driver.fetchEntity({
@@ -277,14 +345,22 @@ export class RestApiGenerator {
 
                 if (this.dataHooks?.afterSave) {
                     Promise.resolve(this.dataHooks.afterSave(collection.slug, response as Record<string, unknown>, hookCtx)).catch(err => {
-                        console.error("[BackendHooks] data.afterSave error:", err instanceof Error ? err.message : err);
+                        logger.error("[BackendHooks] data.afterSave error", { error: err instanceof Error ? err.message : err });
                     });
                 }
 
                 return c.json(response);
             } catch (error) {
                 if (isRebaseApiError(error) && !error.code) {
-                    error.code = "BAD_REQUEST";
+                    // Only classify as BAD_REQUEST if it's an operational error.
+                    // Runtime bugs (TypeError, RangeError, etc.) stay as 500.
+                    const isRuntimeBug = error instanceof TypeError
+                        || error instanceof RangeError
+                        || error instanceof SyntaxError
+                        || error instanceof ReferenceError;
+                    if (!isRuntimeBug) {
+                        error.code = "BAD_REQUEST";
+                    }
                 }
                 throw error;
             }
@@ -294,7 +370,7 @@ export class RestApiGenerator {
         this.router.delete(`${basePath}/:id`, async (c) => {
             this.enforceApiKeyPermission(c, collection.slug);
             const id = c.req.param("id");
-            const driver = c.get("driver") || this.driver;
+            const driver = this.getScopedDriver(c);
             const hookCtx = this.buildHookContext(c, "DELETE");
 
             const existingEntity = await driver.fetchEntity({
@@ -318,7 +394,7 @@ export class RestApiGenerator {
 
             if (this.dataHooks?.afterDelete) {
                 Promise.resolve(this.dataHooks.afterDelete(collection.slug, String(id), hookCtx)).catch(err => {
-                    console.error("[BackendHooks] data.afterDelete error:", err instanceof Error ? err.message : err);
+                    logger.error("[BackendHooks] data.afterDelete error", { error: err instanceof Error ? err.message : err });
                 });
             }
 
@@ -384,7 +460,7 @@ entityId };
             const parsed = parseSubPath(rawPath);
             if (!parsed) return next();
 
-            const driver = c.get("driver") || this.driver;
+            const driver = this.getScopedDriver(c);
 
             this.enforceApiKeyPermission(c, c.req.param("parent"));
 
@@ -395,13 +471,13 @@ entityId };
                 const queryDict = c.req.queries();
                 const queryOptions = parseQueryOptions(queryDict);
                 const searchString = Array.isArray(queryDict.searchString) ? queryDict.searchString[queryDict.searchString.length - 1] : undefined;
-                
+
                 const total = driver.countEntities ? await driver.countEntities({
                     path: parsed.collectionPath,
                     filter: queryOptions.where as FetchCollectionProps["filter"],
                     searchString
                 }) : 0;
-                
+
                 return c.json({ count: total });
             } else if (parsed.entityId) {
                 // GET /parent/:parentId/child/:id — single entity
@@ -459,7 +535,7 @@ entityId };
             const parsed = parseSubPath(rawPath);
             if (!parsed || parsed.entityId) return next();
 
-            const driver = c.get("driver") || this.driver;
+            const driver = this.getScopedDriver(c);
             const hookCtx = this.buildHookContext(c, "POST");
 
             this.enforceApiKeyPermission(c, c.req.param("parent"));
@@ -479,7 +555,7 @@ entityId };
 
             if (this.dataHooks?.afterSave) {
                 Promise.resolve(this.dataHooks.afterSave(parsed.collectionPath, response as Record<string, unknown>, hookCtx)).catch(err => {
-                    console.error("[BackendHooks] data.afterSave error:", err instanceof Error ? err.message : err);
+                    logger.error("[BackendHooks] data.afterSave error", { error: err instanceof Error ? err.message : err });
                 });
             }
 
@@ -494,7 +570,7 @@ entityId };
             const parsed = parseSubPath(rawPath);
             if (!parsed || !parsed.entityId) return next();
 
-            const driver = c.get("driver") || this.driver;
+            const driver = this.getScopedDriver(c);
             const hookCtx = this.buildHookContext(c, "PUT");
 
             this.enforceApiKeyPermission(c, c.req.param("parent"));
@@ -516,7 +592,7 @@ entityId };
 
             if (this.dataHooks?.afterSave) {
                 Promise.resolve(this.dataHooks.afterSave(parsed.collectionPath, response as Record<string, unknown>, hookCtx)).catch(err => {
-                    console.error("[BackendHooks] data.afterSave error:", err instanceof Error ? err.message : err);
+                    logger.error("[BackendHooks] data.afterSave error", { error: err instanceof Error ? err.message : err });
                 });
             }
 
@@ -531,7 +607,7 @@ entityId };
             const parsed = parseSubPath(rawPath);
             if (!parsed || !parsed.entityId) return next();
 
-            const driver = c.get("driver") || this.driver;
+            const driver = this.getScopedDriver(c);
             const hookCtx = this.buildHookContext(c, "DELETE");
 
             this.enforceApiKeyPermission(c, c.req.param("parent"));
@@ -551,7 +627,7 @@ entityId };
 
             if (this.dataHooks?.afterDelete) {
                 Promise.resolve(this.dataHooks.afterDelete(parsed.collectionPath, parsed.entityId, hookCtx)).catch(err => {
-                    console.error("[BackendHooks] data.afterDelete error:", err instanceof Error ? err.message : err);
+                    logger.error("[BackendHooks] data.afterDelete error", { error: err instanceof Error ? err.message : err });
                 });
             }
 

package/src/api/rest/query-parser.ts

@@ -31,17 +31,21 @@ export function parseLogicalString(str: string): FilterCondition | LogicalCondit
     str = str.trim();
     if (str.startsWith("or(") && str.endsWith(")")) {
         const inner = str.slice(3, -1);
-        return { type: "or", conditions: parseLogicalList(inner) };
+        return { type: "or",
+conditions: parseLogicalList(inner) };
     }
     if (str.startsWith("and(") && str.endsWith(")")) {
         const inner = str.slice(4, -1);
-        return { type: "and", conditions: parseLogicalList(inner) };
+        return { type: "and",
+conditions: parseLogicalList(inner) };
     }
-    
+
     // It's a leaf condition: field.op.val
     const firstDot = str.indexOf(".");
     if (firstDot === -1) {
-        return { column: str, operator: "==", value: true };
+        return { column: str,
+operator: "==",
+value: true };
     }
     const field = str.substring(0, firstDot);
     const rest = str.substring(firstDot + 1);
@@ -55,7 +59,7 @@ export function parseLogicalString(str: string): FilterCondition | LogicalCondit
         op = "eq";
         valStr = rest;
     }
-    
+
     const rebaseOp = (mapOperator(op) || "==") as FilterCondition["operator"];
     let parsedVal: unknown = valStr;
     if (valStr === "true") parsedVal = true;
@@ -73,20 +77,22 @@ export function parseLogicalString(str: string): FilterCondition | LogicalCondit
             return trimmed;
         });
     }
-    
-    return { column: field, operator: rebaseOp, value: parsedVal };
+
+    return { column: field,
+operator: rebaseOp,
+value: parsedVal };
 }
 
 function parseLogicalList(str: string): (FilterCondition | LogicalCondition)[] {
     const list: (FilterCondition | LogicalCondition)[] = [];
     let depth = 0;
     let current = "";
-    
+
     for (let i = 0; i < str.length; i++) {
         const char = str[i];
         if (char === "(") depth++;
         if (char === ")") depth--;
-        
+
         if (char === "," && depth === 0) {
             list.push(parseLogicalString(current));
             current = "";
@@ -109,10 +115,10 @@ export function parseQueryOptions(query: Record<string, unknown>): QueryOptions
     // Pagination
     const limitVal = getLastValue(query.limit);
     if (limitVal) options.limit = parseInt(String(limitVal));
-    
+
     const offsetVal = getLastValue(query.offset);
     if (offsetVal) options.offset = parseInt(String(offsetVal));
-    
+
     const pageVal = getLastValue(query.page);
     if (pageVal) {
         const page = parseInt(String(pageVal));
@@ -275,7 +281,7 @@ export function parseQueryOptions(query: Record<string, unknown>): QueryOptions
         const vectorSearch: VectorSearchParams = {
             property: String(vectorSearchVal),
             vector: queryVector,
-            distance: distanceParam,
+            distance: distanceParam
         };
 
         const thresholdVal = getLastValue(query.vector_threshold);

package/src/api/server.ts

@@ -12,6 +12,8 @@ import { createSchemaEditorRoutes } from "./schema-editor-routes";
 import { createAuthMiddleware, requireAuth, requireAdmin } from "../auth/middleware";
 import { errorHandler } from "./errors";
 import { generateOpenApiSpec } from "./openapi-generator";
+import { requestId } from "../utils/request-id";
+import { logger } from "../utils/logger";
 
 /**
  * Simplified API server that leverages existing Rebase infrastructure
@@ -69,6 +71,9 @@ export class RebaseApiServer {
      * Setup Hono middleware
      */
     private setupMiddleware(): void {
+        // Request ID — must be first so all downstream middleware can access it
+        this.router.use("/*", requestId());
+
         // Security headers — use same-origin-allow-popups for COOP so that
         // OAuth popup flows (Google, etc.) can postMessage back to the opener.
         this.router.use("/*", secureHeaders({
@@ -86,6 +91,12 @@ export class RebaseApiServer {
                     : (origin ?? "*"),
                 credentials: this.config.cors.credentials ?? false
             }));
+        } else if (process.env.NODE_ENV !== "production") {
+            logger.warn(
+                "⚠️  [RebaseApiServer] No CORS configuration provided. " +
+                "The API will accept requests from any origin. " +
+                "Pass a `cors` option or configure CORS on your Hono app."
+            );
         }
 
         // Auth middleware
@@ -179,7 +190,7 @@ export class RebaseApiServer {
         // Schema Editor endpoints
         if (this.config.collectionsDir) {
             if (process.env.NODE_ENV === "production") {
-                console.warn("[RebaseApiServer] Schema Editor is disabled in production environments for security.");
+                logger.warn("[RebaseApiServer] Schema Editor is disabled in production environments for security.");
             } else {
                 // Auth middlewares applied to schema-editor via the router prefix
                 // MUST be declared before .route() so they execute first

package/src/api/types.ts

@@ -14,6 +14,8 @@ export type HonoEnv = {
         driver?: DataDriver;
         /** Set when the request is authenticated via a Service API Key. */
         apiKey?: ApiKeyMasked;
+        /** Unique request correlation ID (generated or propagated from X-Request-ID header). */
+        requestId?: string;
     }
 };