@jessejoris/mcp-mysql-via-api 1.0.0

package/dist/server/apiServer.js

@@ -0,0 +1,1502 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createApiServer = createApiServer;
+const express_1 = __importDefault(require("express"));
+const cors_1 = __importDefault(require("cors"));
+const dbPool_js_1 = require("./dbPool.js");
+const permissionManager_js_1 = require("../permissions/permissionManager.js");
+function createApiServer(options = {}) {
+    const app = (0, express_1.default)();
+    const poolManager = options.poolManager || dbPool_js_1.DatabasePoolManager.getInstance();
+    const expectedApiKey = options.apiKey !== undefined ? options.apiKey : process.env.MYSQL_API_KEY || "";
+    const permissionsConfig = options.permissions !== undefined
+        ? options.permissions
+        : process.env.API_PERMISSIONS || process.env.MCP_PERMISSIONS || "all";
+    const apiPermissionManager = new permissionManager_js_1.PermissionManager(permissionsConfig);
+    app.use((0, cors_1.default)());
+    app.use(express_1.default.json({ limit: "50mb" }));
+    // Helper: sanitize identifier (table or column name)
+    const sanitizeIdentifier = (id) => {
+        if (!id || typeof id !== "string") {
+            throw new Error("Invalid identifier: identifier must be a non-empty string");
+        }
+        const clean = id.replace(/`/g, "").trim();
+        if (!/^[a-zA-Z0-9_$]+$/.test(clean)) {
+            throw new Error(`Invalid identifier format: ${id}`);
+        }
+        return `\`${clean}\``;
+    };
+    // Helper: qualified table identifier (optional database)
+    const getFullTableIdentifier = (table, db) => {
+        const safeTable = sanitizeIdentifier(table);
+        if (db && typeof db === "string" && db.trim().length > 0) {
+            return `${sanitizeIdentifier(db)}.${safeTable}`;
+        }
+        return safeTable;
+    };
+    // Helper: dangerous SQL check
+    const checkDangerousSql = (sql) => {
+        const upper = sql.toUpperCase();
+        for (const keyword of permissionManager_js_1.DANGEROUS_SQL_KEYWORDS) {
+            const regex = new RegExp(`\\b${keyword.replace(/\s+/g, "\\s+")}\\b`, "i");
+            if (regex.test(upper)) {
+                throw new Error(`Forbidden SQL: Statement contains blocked dangerous keyword '${keyword}'`);
+            }
+        }
+    };
+    // Helper: operator whitelist and normalization mapping
+    const OPERATOR_MAP = {
+        "=": "=",
+        "==": "=",
+        "eq": "=",
+        "!=": "!=",
+        "<>": "!=",
+        "neq": "!=",
+        ">": ">",
+        "gt": ">",
+        ">=": ">=",
+        "gte": ">=",
+        "<": "<",
+        "lt": "<",
+        "<=": "<=",
+        "lte": "<=",
+        "like": "LIKE",
+        "not like": "NOT LIKE",
+        "in": "IN",
+        "not in": "NOT IN",
+        "is null": "IS NULL",
+        "is not null": "IS NOT NULL",
+        "between": "BETWEEN",
+    };
+    // Helper: build safe parameterized WHERE clauses
+    const buildWhereClauses = (filters) => {
+        const whereClauses = [];
+        const values = [];
+        if (!Array.isArray(filters)) {
+            return { whereSql: "", values: [] };
+        }
+        for (const f of filters) {
+            if (!f || !f.field || f.operator === undefined)
+                continue;
+            const safeField = sanitizeIdentifier(f.field);
+            const rawOp = String(f.operator).trim().toLowerCase();
+            const canonicalOp = OPERATOR_MAP[rawOp];
+            if (!canonicalOp) {
+                throw new Error(`Unsupported or invalid filter operator: '${f.operator}'`);
+            }
+            if (canonicalOp === "IS NULL" || canonicalOp === "IS NOT NULL") {
+                whereClauses.push(`${safeField} ${canonicalOp}`);
+            }
+            else if (canonicalOp === "IN" || canonicalOp === "NOT IN") {
+                if (Array.isArray(f.value) && f.value.length > 0) {
+                    const placeholders = f.value.map(() => "?").join(", ");
+                    whereClauses.push(`${safeField} ${canonicalOp} (${placeholders})`);
+                    values.push(...f.value);
+                }
+                else {
+                    whereClauses.push(canonicalOp === "IN" ? "1=0" : "1=1");
+                }
+            }
+            else if (canonicalOp === "BETWEEN") {
+                whereClauses.push(`${safeField} BETWEEN ? AND ?`);
+                values.push(f.value, f.secondValue);
+            }
+            else {
+                whereClauses.push(`${safeField} ${canonicalOp} ?`);
+                values.push(f.value);
+            }
+        }
+        const whereSql = whereClauses.length > 0 ? `WHERE ${whereClauses.join(" AND ")}` : "";
+        return { whereSql, values };
+    };
+    // Helper: discover table primary key column
+    const getTablePrimaryKey = async (table, db) => {
+        const safeTable = getFullTableIdentifier(table, db);
+        const pool = poolManager.getPool();
+        try {
+            const [cols] = await pool.query(`DESCRIBE ${safeTable}`);
+            const pkCol = cols.find((c) => c.Key === "PRI");
+            return pkCol ? pkCol.Field : "id";
+        }
+        catch {
+            return "id";
+        }
+    };
+    // Auth Middleware
+    const authMiddleware = (req, res, next) => {
+        if (!expectedApiKey) {
+            return next();
+        }
+        const authHeader = req.headers["authorization"];
+        const xApiKey = req.headers["x-api-key"];
+        let token = "";
+        if (authHeader && authHeader.startsWith("Bearer ")) {
+            token = authHeader.slice(7).trim();
+        }
+        else if (xApiKey) {
+            token = xApiKey.trim();
+        }
+        if (!token || token !== expectedApiKey) {
+            return res.status(401).json({
+                success: false,
+                error: {
+                    code: "UNAUTHORIZED",
+                    message: "Invalid or missing API authentication credentials",
+                    timestamp: new Date().toISOString(),
+                },
+            });
+        }
+        next();
+    };
+    // Server-level Permission Middleware
+    const permissionMiddleware = (req, res, next) => {
+        if (!permissionsConfig ||
+            permissionsConfig === "all" ||
+            permissionsConfig === "admin" ||
+            permissionsConfig === "*") {
+            return next();
+        }
+        const path = req.path.toLowerCase();
+        const method = req.method.toUpperCase();
+        let requiredPerm = null;
+        if (method === "GET") {
+            if (path === "/info" || path === "/health") {
+                requiredPerm = null;
+            }
+            else if (path.startsWith("/databases") ||
+                path.startsWith("/tables/find") ||
+                path === "/tables" ||
+                path.includes("/schema") ||
+                path.startsWith("/schema")) {
+                requiredPerm = "list";
+            }
+            else if (path.includes("/records") ||
+                path.includes("/count") ||
+                path.includes("/columns") ||
+                path.startsWith("/tables/search-data")) {
+                requiredPerm = "read";
+            }
+            else if (path.includes("/export")) {
+                requiredPerm = "utility";
+            }
+        }
+        else if (method === "POST") {
+            if (path.includes("/records/bulk-delete")) {
+                requiredPerm = "delete";
+            }
+            else if (path.includes("/records")) {
+                requiredPerm = "create";
+            }
+            else if (path === "/query/select") {
+                requiredPerm = "read";
+            }
+            else if (path === "/query/write") {
+                requiredPerm = "execute";
+            }
+            else if (path === "/query/export") {
+                requiredPerm = "utility";
+            }
+            else if (path === "/ddl" || path === "/tables") {
+                requiredPerm = "ddl";
+            }
+        }
+        else if (method === "PUT") {
+            if (path.includes("/records")) {
+                requiredPerm = "update";
+            }
+            else if (path.startsWith("/tables/")) {
+                requiredPerm = "ddl";
+            }
+        }
+        else if (method === "DELETE") {
+            if (path.includes("/records")) {
+                requiredPerm = "delete";
+            }
+            else if (path.startsWith("/tables/")) {
+                requiredPerm = "ddl";
+            }
+        }
+        if (requiredPerm && !apiPermissionManager.isPermissionAllowed(requiredPerm)) {
+            return res.status(403).json({
+                success: false,
+                error: {
+                    code: "FORBIDDEN",
+                    message: `API endpoint '${method} ${req.originalUrl}' is blocked by server permission policy '${permissionsConfig}'. Required permission: '${requiredPerm}'.`,
+                    details: {
+                        requiredPermission: requiredPerm,
+                        activePermissions: apiPermissionManager.getActivePermissions(),
+                        policy: apiPermissionManager.getProfileSummary().preset,
+                    },
+                    timestamp: new Date().toISOString(),
+                },
+            });
+        }
+        next();
+    };
+    // Health endpoint (Public, measures DB ping latency)
+    app.get("/health", async (_req, res) => {
+        const startPing = Date.now();
+        try {
+            const pool = poolManager.getPool();
+            await pool.query("SELECT 1 as ping");
+            const latencyMs = Date.now() - startPing;
+            return res.json({
+                success: true,
+                data: {
+                    status: "healthy",
+                    timestamp: new Date().toISOString(),
+                    database: "connected",
+                    latencyMs,
+                },
+                meta: { timestamp: new Date().toISOString(), latencyMs },
+            });
+        }
+        catch (err) {
+            return res.status(503).json({
+                success: false,
+                error: {
+                    code: "DATABASE_UNAVAILABLE",
+                    message: err.message,
+                    timestamp: new Date().toISOString(),
+                },
+            });
+        }
+    });
+    // Apply Auth & Permission Middleware to all /api routes
+    app.use("/api", authMiddleware);
+    app.use("/api", permissionMiddleware);
+    // Server metadata
+    app.get("/api/info", (_req, res) => {
+        return res.json({
+            success: true,
+            data: {
+                name: "mysql-mcp-api-server",
+                version: "1.1.0",
+                authRequired: Boolean(expectedApiKey),
+                permissionPolicy: apiPermissionManager.getProfileSummary(),
+                timestamp: new Date().toISOString(),
+            },
+            meta: { timestamp: new Date().toISOString() },
+        });
+    });
+    // 1. List Databases
+    app.get("/api/databases", async (_req, res) => {
+        try {
+            const pool = poolManager.getPool();
+            const [rows] = await pool.query("SHOW DATABASES");
+            const databases = rows.map((r) => r.Database || Object.values(r)[0]);
+            return res.json({
+                success: true,
+                data: databases,
+                meta: { timestamp: new Date().toISOString(), count: databases.length },
+            });
+        }
+        catch (err) {
+            return res.status(500).json({
+                success: false,
+                error: { code: "QUERY_FAILED", message: err.message, timestamp: new Date().toISOString() },
+            });
+        }
+    });
+    // 2. List Tables
+    app.get("/api/tables", async (req, res) => {
+        try {
+            const pool = poolManager.getPool();
+            const db = req.query.database;
+            const sql = db ? `SHOW TABLES FROM ${sanitizeIdentifier(db)}` : "SHOW TABLES";
+            const [rows] = await pool.query(sql);
+            const tables = rows.map((r) => Object.values(r)[0]);
+            return res.json({
+                success: true,
+                data: tables,
+                meta: { timestamp: new Date().toISOString(), count: tables.length },
+            });
+        }
+        catch (err) {
+            return res.status(500).json({
+                success: false,
+                error: { code: "QUERY_FAILED", message: err.message, timestamp: new Date().toISOString() },
+            });
+        }
+    });
+    // 3. Find Tables by Keyword (ranked concept lookup)
+    app.get("/api/tables/find", async (req, res) => {
+        try {
+            const pool = poolManager.getPool();
+            const keyword = (req.query.keyword || "").toLowerCase();
+            const limit = parseInt(req.query.limit || "20", 10);
+            const db = req.query.database;
+            const sql = db ? `SHOW TABLES FROM ${sanitizeIdentifier(db)}` : "SHOW TABLES";
+            const [tableRows] = await pool.query(sql);
+            const tables = tableRows.map((r) => String(Object.values(r)[0]));
+            const matched = tables.filter((t) => t.toLowerCase().includes(keyword)).slice(0, limit);
+            return res.json({
+                success: true,
+                data: matched,
+                meta: { timestamp: new Date().toISOString(), count: matched.length },
+            });
+        }
+        catch (err) {
+            return res.status(500).json({
+                success: false,
+                error: { code: "FIND_TABLES_FAILED", message: err.message, timestamp: new Date().toISOString() },
+            });
+        }
+    });
+    // 4. Search Data Across Tables (Guarded text search)
+    app.get("/api/tables/search-data", async (req, res) => {
+        try {
+            const pool = poolManager.getPool();
+            const keyword = req.query.keyword;
+            if (!keyword) {
+                return res.status(400).json({
+                    success: false,
+                    error: { code: "BAD_REQUEST", message: "keyword query parameter is required", timestamp: new Date().toISOString() },
+                });
+            }
+            const db = req.query.database;
+            const maxTables = Math.min(100, Math.max(1, parseInt(req.query.max_tables || "20", 10)));
+            const limitPerTable = Math.min(50, Math.max(1, parseInt(req.query.limit_per_table || "5", 10)));
+            let targetTables = [];
+            if (req.query.tables) {
+                targetTables = typeof req.query.tables === "string"
+                    ? req.query.tables.split(",").map((s) => s.trim())
+                    : req.query.tables;
+            }
+            else {
+                const sql = db ? `SHOW TABLES FROM ${sanitizeIdentifier(db)}` : "SHOW TABLES";
+                const [tableRows] = await pool.query(sql);
+                targetTables = tableRows.map((r) => String(Object.values(r)[0]));
+            }
+            targetTables = targetTables.slice(0, maxTables);
+            const results = [];
+            for (const table of targetTables) {
+                const safeTable = getFullTableIdentifier(table, db);
+                const [cols] = await pool.query(`DESCRIBE ${safeTable}`);
+                const textCols = cols
+                    .filter((c) => /char|text|varchar|enum|set/i.test(c.Type))
+                    .map((c) => c.Field);
+                if (textCols.length === 0)
+                    continue;
+                const orClauses = textCols.map((c) => `${sanitizeIdentifier(c)} LIKE ?`).join(" OR ");
+                const searchPattern = `%${keyword}%`;
+                const params = textCols.map(() => searchPattern);
+                const [rows] = await pool.query(`SELECT * FROM ${safeTable} WHERE ${orClauses} LIMIT ${limitPerTable}`, params);
+                if (rows.length > 0) {
+                    results.push({
+                        table,
+                        matchedColumns: textCols,
+                        rows,
+                    });
+                }
+            }
+            return res.json({
+                success: true,
+                data: results,
+                meta: {
+                    timestamp: new Date().toISOString(),
+                    tablesSearched: targetTables.length,
+                    matchedTables: results.length,
+                },
+            });
+        }
+        catch (err) {
+            return res.status(500).json({
+                success: false,
+                error: { code: "SEARCH_DATA_FAILED", message: err.message, timestamp: new Date().toISOString() },
+            });
+        }
+    });
+    // 5. Read Table Schema
+    app.get("/api/tables/:table/schema", async (req, res) => {
+        try {
+            const pool = poolManager.getPool();
+            const table = req.params.table;
+            const db = req.query.database;
+            const safeTable = getFullTableIdentifier(table, db);
+            const [columns] = await pool.query(`DESCRIBE ${safeTable}`);
+            const [indexes] = await pool.query(`SHOW INDEX FROM ${safeTable}`);
+            return res.json({
+                success: true,
+                data: {
+                    table,
+                    database: db || undefined,
+                    columns: columns.map((c) => ({
+                        field: c.Field,
+                        type: c.Type,
+                        null: c.Null,
+                        key: c.Key,
+                        default: c.Default,
+                        extra: c.Extra,
+                    })),
+                    indexes: indexes.map((idx) => ({
+                        name: idx.Key_name,
+                        column: idx.Column_name,
+                        unique: idx.Non_unique === 0,
+                    })),
+                },
+                meta: { timestamp: new Date().toISOString() },
+            });
+        }
+        catch (err) {
+            return res.status(500).json({
+                success: false,
+                error: { code: "SCHEMA_FETCH_FAILED", message: err.message, timestamp: new Date().toISOString() },
+            });
+        }
+    });
+    // 6. Read Records with Default Pagination + Bypass
+    app.get("/api/tables/:table/records", async (req, res) => {
+        try {
+            const pool = poolManager.getPool();
+            const table = req.params.table;
+            const db = req.query.database;
+            const safeTable = getFullTableIdentifier(table, db);
+            let filters = [];
+            const rawFilters = req.query.filters || req.query.conditions;
+            if (rawFilters) {
+                try {
+                    filters = typeof rawFilters === "string" ? JSON.parse(rawFilters) : rawFilters;
+                }
+                catch {
+                    // ignore malformed
+                }
+            }
+            const columnsStr = req.query.columns;
+            const safeCols = columnsStr
+                ? columnsStr.split(",").map((c) => sanitizeIdentifier(c.trim())).join(", ")
+                : "*";
+            const sortField = req.query.sort_field;
+            const sortDir = req.query.sort_direction?.toUpperCase() === "DESC" ? "DESC" : "ASC";
+            const bypass = req.query.bypass === "true" ||
+                req.query.bypass === true ||
+                req.query.all === "true" ||
+                req.query.limit === "0";
+            const page = Math.max(1, parseInt(req.query.page || "1", 10));
+            const limit = Math.max(1, parseInt(req.query.limit || "50", 10));
+            const { whereSql, values } = buildWhereClauses(filters);
+            // Count total matching
+            const [countRows] = await pool.query(`SELECT COUNT(*) as total FROM ${safeTable} ${whereSql}`, values);
+            const total = Number(countRows[0]?.total || 0);
+            // Sorting
+            let orderSql = "";
+            if (sortField) {
+                orderSql = `ORDER BY ${sanitizeIdentifier(sortField)} ${sortDir}`;
+            }
+            // Pagination / Bypass
+            let limitSql = "";
+            if (!bypass) {
+                const offset = (page - 1) * limit;
+                limitSql = `LIMIT ${limit} OFFSET ${offset}`;
+            }
+            else if (limit) {
+                limitSql = `LIMIT ${limit}`;
+            }
+            const querySql = `SELECT ${safeCols} FROM ${safeTable} ${whereSql} ${orderSql} ${limitSql}`.trim();
+            const [records] = await pool.query(querySql, values);
+            const totalPages = bypass ? 1 : Math.ceil(total / limit) || 1;
+            const hasMore = bypass ? false : page * limit < total;
+            return res.json({
+                success: true,
+                data: records,
+                meta: {
+                    pagination: {
+                        page: bypass ? 1 : page,
+                        limit: bypass ? records.length : limit,
+                        total,
+                        totalPages,
+                        hasMore,
+                        bypassed: bypass,
+                    },
+                    timestamp: new Date().toISOString(),
+                },
+            });
+        }
+        catch (err) {
+            return res.status(500).json({
+                success: false,
+                error: { code: "READ_RECORDS_FAILED", message: err.message, timestamp: new Date().toISOString() },
+            });
+        }
+    });
+    // 7. Get Single Record by ID / Primary Key
+    app.get("/api/tables/:table/records/:id", async (req, res) => {
+        try {
+            const pool = poolManager.getPool();
+            const table = req.params.table;
+            const id = req.params.id;
+            const db = req.query.database;
+            const keyCol = req.query.key_column || (await getTablePrimaryKey(table, db));
+            const safeTable = getFullTableIdentifier(table, db);
+            const safeKey = sanitizeIdentifier(keyCol);
+            const [rows] = await pool.query(`SELECT * FROM ${safeTable} WHERE ${safeKey} = ? LIMIT 1`, [id]);
+            if (rows.length === 0) {
+                return res.status(404).json({
+                    success: false,
+                    error: {
+                        code: "RECORD_NOT_FOUND",
+                        message: `Record with ${keyCol}='${id}' not found in table '${table}'`,
+                        timestamp: new Date().toISOString(),
+                    },
+                });
+            }
+            return res.json({
+                success: true,
+                data: rows[0],
+                meta: { timestamp: new Date().toISOString() },
+            });
+        }
+        catch (err) {
+            return res.status(500).json({
+                success: false,
+                error: { code: "GET_RECORD_FAILED", message: err.message, timestamp: new Date().toISOString() },
+            });
+        }
+    });
+    // 8. Count Records
+    app.get("/api/tables/:table/count", async (req, res) => {
+        try {
+            const pool = poolManager.getPool();
+            const table = req.params.table;
+            const db = req.query.database;
+            const safeTable = getFullTableIdentifier(table, db);
+            let filters = [];
+            const rawFilters = req.query.filters || req.query.conditions;
+            if (rawFilters) {
+                try {
+                    filters = typeof rawFilters === "string" ? JSON.parse(rawFilters) : rawFilters;
+                }
+                catch {
+                    // ignore
+                }
+            }
+            const { whereSql, values } = buildWhereClauses(filters);
+            const [rows] = await pool.query(`SELECT COUNT(*) as total FROM ${safeTable} ${whereSql}`, values);
+            return res.json({
+                success: true,
+                data: { total: Number(rows[0]?.total || 0) },
+                meta: { timestamp: new Date().toISOString() },
+            });
+        }
+        catch (err) {
+            return res.status(500).json({
+                success: false,
+                error: { code: "COUNT_FAILED", message: err.message, timestamp: new Date().toISOString() },
+            });
+        }
+    });
+    // 9. Column Statistics (Data Analysis)
+    app.get("/api/tables/:table/columns/:column/stats", async (req, res) => {
+        try {
+            const pool = poolManager.getPool();
+            const table = req.params.table;
+            const column = req.params.column;
+            const db = req.query.database;
+            const safeTable = getFullTableIdentifier(table, db);
+            const safeCol = sanitizeIdentifier(column);
+            // Aggregate statistics
+            const [statsRows] = await pool.query(`
+        SELECT 
+          COUNT(*) as totalRows,
+          COUNT(${safeCol}) as nonNullCount,
+          COUNT(DISTINCT ${safeCol}) as distinctCount,
+          MIN(${safeCol}) as minValue,
+          MAX(${safeCol}) as maxValue
+        FROM ${safeTable}
+      `);
+            const stats = statsRows[0] || {};
+            const totalRows = Number(stats.totalRows || 0);
+            const nonNullCount = Number(stats.nonNullCount || 0);
+            const nullCount = totalRows - nonNullCount;
+            const nullPercentage = totalRows > 0 ? Number(((nullCount / totalRows) * 100).toFixed(2)) : 0;
+            // Top frequent values
+            const [freqRows] = await pool.query(`
+        SELECT ${safeCol} as value, COUNT(*) as frequency
+        FROM ${safeTable}
+        WHERE ${safeCol} IS NOT NULL
+        GROUP BY ${safeCol}
+        ORDER BY frequency DESC
+        LIMIT 5
+      `);
+            return res.json({
+                success: true,
+                data: {
+                    table,
+                    column,
+                    totalRows,
+                    nonNullCount,
+                    nullCount,
+                    nullPercentage,
+                    distinctCount: Number(stats.distinctCount || 0),
+                    minValue: stats.minValue,
+                    maxValue: stats.maxValue,
+                    topValues: freqRows,
+                },
+                meta: { timestamp: new Date().toISOString() },
+            });
+        }
+        catch (err) {
+            return res.status(500).json({
+                success: false,
+                error: { code: "STATS_FAILED", message: err.message, timestamp: new Date().toISOString() },
+            });
+        }
+    });
+    // 10. Create Record
+    app.post("/api/tables/:table/records", async (req, res) => {
+        try {
+            const pool = poolManager.getPool();
+            const table = req.params.table;
+            const db = req.body.database || req.query.database;
+            const safeTable = getFullTableIdentifier(table, db);
+            const data = req.body.data;
+            if (!data || typeof data !== "object" || Object.keys(data).length === 0) {
+                return res.status(400).json({
+                    success: false,
+                    error: { code: "BAD_REQUEST", message: "Data payload cannot be empty", timestamp: new Date().toISOString() },
+                });
+            }
+            const keys = Object.keys(data);
+            const safeCols = keys.map((k) => sanitizeIdentifier(k)).join(", ");
+            const placeholders = keys.map(() => "?").join(", ");
+            const values = keys.map((k) => data[k]);
+            const sql = `INSERT INTO ${safeTable} (${safeCols}) VALUES (${placeholders})`;
+            const [result] = await pool.query(sql, values);
+            return res.json({
+                success: true,
+                data: {
+                    insertedId: result.insertId,
+                    affectedRows: result.affectedRows,
+                },
+                meta: { timestamp: new Date().toISOString() },
+            });
+        }
+        catch (err) {
+            return res.status(500).json({
+                success: false,
+                error: { code: "INSERT_FAILED", message: err.message, timestamp: new Date().toISOString() },
+            });
+        }
+    });
+    // 11. Bulk Insert
+    app.post("/api/tables/:table/records/bulk", async (req, res) => {
+        try {
+            const pool = poolManager.getPool();
+            const table = req.params.table;
+            const db = req.body.database || req.query.database;
+            const safeTable = getFullTableIdentifier(table, db);
+            const records = req.body.records;
+            if (!Array.isArray(records) || records.length === 0) {
+                return res.status(400).json({
+                    success: false,
+                    error: { code: "BAD_REQUEST", message: "Records array cannot be empty", timestamp: new Date().toISOString() },
+                });
+            }
+            const keys = Object.keys(records[0]);
+            const safeCols = keys.map((k) => sanitizeIdentifier(k)).join(", ");
+            const rowPlaceholder = `(${keys.map(() => "?").join(", ")})`;
+            const allPlaceholders = records.map(() => rowPlaceholder).join(", ");
+            const values = [];
+            for (const rec of records) {
+                for (const k of keys) {
+                    values.push(rec[k] !== undefined ? rec[k] : null);
+                }
+            }
+            const sql = `INSERT INTO ${safeTable} (${safeCols}) VALUES ${allPlaceholders}`;
+            const [result] = await pool.query(sql, values);
+            return res.json({
+                success: true,
+                data: {
+                    affectedRows: result.affectedRows,
+                    count: records.length,
+                },
+                meta: { timestamp: new Date().toISOString() },
+            });
+        }
+        catch (err) {
+            return res.status(500).json({
+                success: false,
+                error: { code: "BULK_INSERT_FAILED", message: err.message, timestamp: new Date().toISOString() },
+            });
+        }
+    });
+    // 12. Update Record by ID / Primary Key
+    app.put("/api/tables/:table/records/:id", async (req, res) => {
+        try {
+            const pool = poolManager.getPool();
+            const table = req.params.table;
+            const id = req.params.id;
+            const db = req.body.database || req.query.database;
+            const keyCol = req.body.key_column || (await getTablePrimaryKey(table, db));
+            const safeTable = getFullTableIdentifier(table, db);
+            const safeKey = sanitizeIdentifier(keyCol);
+            const data = req.body.data || req.body;
+            delete data.database;
+            delete data.key_column;
+            if (!data || Object.keys(data).length === 0) {
+                return res.status(400).json({
+                    success: false,
+                    error: { code: "BAD_REQUEST", message: "Update data cannot be empty", timestamp: new Date().toISOString() },
+                });
+            }
+            const setClauses = [];
+            const values = [];
+            for (const [k, v] of Object.entries(data)) {
+                setClauses.push(`${sanitizeIdentifier(k)} = ?`);
+                values.push(v);
+            }
+            values.push(id);
+            const sql = `UPDATE ${safeTable} SET ${setClauses.join(", ")} WHERE ${safeKey} = ?`;
+            const [result] = await pool.query(sql, values);
+            return res.json({
+                success: true,
+                data: {
+                    affectedRows: result.affectedRows,
+                    changedRows: result.changedRows || result.affectedRows,
+                },
+                meta: { timestamp: new Date().toISOString() },
+            });
+        }
+        catch (err) {
+            return res.status(500).json({
+                success: false,
+                error: { code: "UPDATE_BY_ID_FAILED", message: err.message, timestamp: new Date().toISOString() },
+            });
+        }
+    });
+    // 13. Update Records by Filter Conditions
+    app.put("/api/tables/:table/records", async (req, res) => {
+        try {
+            const pool = poolManager.getPool();
+            const table = req.params.table;
+            const db = req.body.database || req.query.database;
+            const safeTable = getFullTableIdentifier(table, db);
+            const { data } = req.body;
+            const filters = req.body.filters || req.body.conditions;
+            if (!data || Object.keys(data).length === 0) {
+                return res.status(400).json({
+                    success: false,
+                    error: { code: "BAD_REQUEST", message: "Update data cannot be empty", timestamp: new Date().toISOString() },
+                });
+            }
+            if (!Array.isArray(filters) || filters.length === 0) {
+                return res.status(400).json({
+                    success: false,
+                    error: { code: "SAFETY_VIOLATION", message: "Filters are required for update to prevent accidental table-wide overwrite", timestamp: new Date().toISOString() },
+                });
+            }
+            const setClauses = [];
+            const values = [];
+            for (const [k, v] of Object.entries(data)) {
+                setClauses.push(`${sanitizeIdentifier(k)} = ?`);
+                values.push(v);
+            }
+            const { whereSql, values: filterValues } = buildWhereClauses(filters);
+            values.push(...filterValues);
+            const sql = `UPDATE ${safeTable} SET ${setClauses.join(", ")} ${whereSql}`;
+            const [result] = await pool.query(sql, values);
+            return res.json({
+                success: true,
+                data: {
+                    affectedRows: result.affectedRows,
+                    changedRows: result.changedRows || result.affectedRows,
+                },
+                meta: { timestamp: new Date().toISOString() },
+            });
+        }
+        catch (err) {
+            return res.status(500).json({
+                success: false,
+                error: { code: "UPDATE_FAILED", message: err.message, timestamp: new Date().toISOString() },
+            });
+        }
+    });
+    // 14. Bulk Update
+    app.put("/api/tables/:table/records/bulk", async (req, res) => {
+        try {
+            const pool = poolManager.getPool();
+            const table = req.params.table;
+            const db = req.body.database || req.query.database;
+            const safeTable = getFullTableIdentifier(table, db);
+            const { records, key_column } = req.body;
+            if (!Array.isArray(records) || records.length === 0 || !key_column) {
+                return res.status(400).json({
+                    success: false,
+                    error: { code: "BAD_REQUEST", message: "Records and key_column are required", timestamp: new Date().toISOString() },
+                });
+            }
+            const safeKey = sanitizeIdentifier(key_column);
+            let totalAffected = 0;
+            for (const rec of records) {
+                const keyValue = rec[key_column];
+                if (keyValue === undefined)
+                    continue;
+                const updateData = { ...rec };
+                delete updateData[key_column];
+                const setClauses = [];
+                const values = [];
+                for (const [k, v] of Object.entries(updateData)) {
+                    setClauses.push(`${sanitizeIdentifier(k)} = ?`);
+                    values.push(v);
+                }
+                if (setClauses.length > 0) {
+                    values.push(keyValue);
+                    const sql = `UPDATE ${safeTable} SET ${setClauses.join(", ")} WHERE ${safeKey} = ?`;
+                    const [result] = await pool.query(sql, values);
+                    totalAffected += result.affectedRows;
+                }
+            }
+            return res.json({
+                success: true,
+                data: { affectedRows: totalAffected, count: records.length },
+                meta: { timestamp: new Date().toISOString() },
+            });
+        }
+        catch (err) {
+            return res.status(500).json({
+                success: false,
+                error: { code: "BULK_UPDATE_FAILED", message: err.message, timestamp: new Date().toISOString() },
+            });
+        }
+    });
+    // 15. Delete Single Record by ID / Primary Key
+    app.delete("/api/tables/:table/records/:id", async (req, res) => {
+        try {
+            const pool = poolManager.getPool();
+            const table = req.params.table;
+            const id = req.params.id;
+            const db = req.body.database || req.query.database;
+            const keyCol = req.body.key_column || (await getTablePrimaryKey(table, db));
+            const safeTable = getFullTableIdentifier(table, db);
+            const safeKey = sanitizeIdentifier(keyCol);
+            const [result] = await pool.query(`DELETE FROM ${safeTable} WHERE ${safeKey} = ?`, [id]);
+            return res.json({
+                success: true,
+                data: { affectedRows: result.affectedRows },
+                meta: { timestamp: new Date().toISOString() },
+            });
+        }
+        catch (err) {
+            return res.status(500).json({
+                success: false,
+                error: { code: "DELETE_BY_ID_FAILED", message: err.message, timestamp: new Date().toISOString() },
+            });
+        }
+    });
+    // 16. Delete Records by Filter Conditions
+    app.delete("/api/tables/:table/records", async (req, res) => {
+        try {
+            const pool = poolManager.getPool();
+            const table = req.params.table;
+            const db = req.body.database || req.query.database;
+            const safeTable = getFullTableIdentifier(table, db);
+            const filters = req.body.filters || req.body.conditions;
+            if (!Array.isArray(filters) || filters.length === 0) {
+                return res.status(400).json({
+                    success: false,
+                    error: { code: "SAFETY_VIOLATION", message: "Filters are required for delete to prevent accidental table truncation", timestamp: new Date().toISOString() },
+                });
+            }
+            const { whereSql, values } = buildWhereClauses(filters);
+            const sql = `DELETE FROM ${safeTable} ${whereSql}`;
+            const [result] = await pool.query(sql, values);
+            return res.json({
+                success: true,
+                data: { affectedRows: result.affectedRows },
+                meta: { timestamp: new Date().toISOString() },
+            });
+        }
+        catch (err) {
+            return res.status(500).json({
+                success: false,
+                error: { code: "DELETE_FAILED", message: err.message, timestamp: new Date().toISOString() },
+            });
+        }
+    });
+    // 17. Bulk Delete
+    app.post("/api/tables/:table/records/bulk-delete", async (req, res) => {
+        try {
+            const pool = poolManager.getPool();
+            const table = req.params.table;
+            const db = req.body.database || req.query.database;
+            const safeTable = getFullTableIdentifier(table, db);
+            const { key_column, keys } = req.body;
+            if (!key_column || !Array.isArray(keys) || keys.length === 0) {
+                return res.status(400).json({
+                    success: false,
+                    error: { code: "BAD_REQUEST", message: "key_column and keys are required", timestamp: new Date().toISOString() },
+                });
+            }
+            const placeholders = keys.map(() => "?").join(", ");
+            const sql = `DELETE FROM ${safeTable} WHERE ${sanitizeIdentifier(key_column)} IN (${placeholders})`;
+            const [result] = await pool.query(sql, keys);
+            return res.json({
+                success: true,
+                data: { affectedRows: result.affectedRows, count: keys.length },
+                meta: { timestamp: new Date().toISOString() },
+            });
+        }
+        catch (err) {
+            return res.status(500).json({
+                success: false,
+                error: { code: "BULK_DELETE_FAILED", message: err.message, timestamp: new Date().toISOString() },
+            });
+        }
+    });
+    // 18. Run Select Query (with pagination or bypass)
+    app.post("/api/query/select", async (req, res) => {
+        try {
+            const pool = poolManager.getPool();
+            const { query, params = [], page = 1, limit = 50, bypass = false, database } = req.body;
+            if (!query || typeof query !== "string") {
+                return res.status(400).json({
+                    success: false,
+                    error: { code: "BAD_REQUEST", message: "Query string is required", timestamp: new Date().toISOString() },
+                });
+            }
+            let trimmed = query.trim();
+            while (trimmed.endsWith(";")) {
+                trimmed = trimmed.slice(0, -1).trim();
+            }
+            checkDangerousSql(trimmed);
+            if (!/^(SELECT|SHOW|DESCRIBE|DESC|EXPLAIN)/i.test(trimmed)) {
+                return res.status(400).json({
+                    success: false,
+                    error: { code: "READ_ONLY_VIOLATION", message: "Only read-only queries (SELECT, SHOW, DESCRIBE, EXPLAIN) are allowed on this endpoint", timestamp: new Date().toISOString() },
+                });
+            }
+            let finalSql = trimmed;
+            if (!bypass && limit && !/LIMIT\s+\d+/i.test(trimmed)) {
+                const offset = (page - 1) * limit;
+                finalSql = `${trimmed} LIMIT ${limit} OFFSET ${offset}`;
+            }
+            if (database) {
+                await pool.query(`USE ${sanitizeIdentifier(database)}`);
+            }
+            const [rows] = await pool.query(finalSql, params);
+            const hasMore = !bypass && Array.isArray(rows) && rows.length === limit;
+            return res.json({
+                success: true,
+                data: rows,
+                meta: {
+                    pagination: {
+                        page: bypass ? 1 : page,
+                        limit: bypass ? (rows ? rows.length : 0) : limit,
+                        total: rows ? rows.length : 0,
+                        totalPages: bypass ? 1 : (hasMore ? page + 1 : page),
+                        hasMore,
+                        bypassed: bypass,
+                    },
+                    timestamp: new Date().toISOString(),
+                },
+            });
+        }
+        catch (err) {
+            return res.status(500).json({
+                success: false,
+                error: { code: "SELECT_QUERY_FAILED", message: err.message, timestamp: new Date().toISOString() },
+            });
+        }
+    });
+    // 19. Execute Write Query
+    app.post("/api/query/write", async (req, res) => {
+        try {
+            const pool = poolManager.getPool();
+            const { query, params = [], database } = req.body;
+            if (!query || typeof query !== "string") {
+                return res.status(400).json({
+                    success: false,
+                    error: { code: "BAD_REQUEST", message: "Query string is required", timestamp: new Date().toISOString() },
+                });
+            }
+            checkDangerousSql(query);
+            if (database) {
+                await pool.query(`USE ${sanitizeIdentifier(database)}`);
+            }
+            const [result] = await pool.query(query, params);
+            return res.json({
+                success: true,
+                data: {
+                    affectedRows: result.affectedRows || 0,
+                    insertId: result.insertId || 0,
+                    warningCount: result.warningStatus || 0,
+                },
+                meta: { timestamp: new Date().toISOString() },
+            });
+        }
+        catch (err) {
+            return res.status(500).json({
+                success: false,
+                error: { code: "WRITE_QUERY_FAILED", message: err.message, timestamp: new Date().toISOString() },
+            });
+        }
+    });
+    // 20. Create Table
+    app.post("/api/tables", async (req, res) => {
+        try {
+            const pool = poolManager.getPool();
+            const { table_name, columns, primary_key, database } = req.body;
+            if (!table_name || !Array.isArray(columns) || columns.length === 0) {
+                return res.status(400).json({
+                    success: false,
+                    error: { code: "BAD_REQUEST", message: "table_name and columns are required", timestamp: new Date().toISOString() },
+                });
+            }
+            const colDefs = [];
+            for (const col of columns) {
+                let def = `${sanitizeIdentifier(col.name)} ${col.type}`;
+                if (col.nullable === false)
+                    def += " NOT NULL";
+                if (col.autoIncrement)
+                    def += " AUTO_INCREMENT";
+                if (col.defaultValue !== undefined)
+                    def += ` DEFAULT ${typeof col.defaultValue === "string" ? `'${col.defaultValue}'` : col.defaultValue}`;
+                if (col.primaryKey)
+                    def += " PRIMARY KEY";
+                colDefs.push(def);
+            }
+            if (primary_key) {
+                const pkCols = Array.isArray(primary_key)
+                    ? primary_key.map((k) => sanitizeIdentifier(k)).join(", ")
+                    : sanitizeIdentifier(primary_key);
+                colDefs.push(`PRIMARY KEY (${pkCols})`);
+            }
+            const safeTable = getFullTableIdentifier(table_name, database);
+            const sql = `CREATE TABLE ${safeTable} (${colDefs.join(", ")})`;
+            await pool.query(sql);
+            return res.json({
+                success: true,
+                data: { table: table_name, created: true },
+                meta: { timestamp: new Date().toISOString() },
+            });
+        }
+        catch (err) {
+            return res.status(500).json({
+                success: false,
+                error: { code: "CREATE_TABLE_FAILED", message: err.message, timestamp: new Date().toISOString() },
+            });
+        }
+    });
+    // 21. Alter Table
+    app.put("/api/tables/:table", async (req, res) => {
+        try {
+            const pool = poolManager.getPool();
+            const table = req.params.table;
+            const { action, column_definition, database } = req.body;
+            if (!action || !column_definition) {
+                return res.status(400).json({
+                    success: false,
+                    error: { code: "BAD_REQUEST", message: "action and column_definition are required", timestamp: new Date().toISOString() },
+                });
+            }
+            const safeTable = getFullTableIdentifier(table, database);
+            let sql = "";
+            if (action === "add_column") {
+                sql = `ALTER TABLE ${safeTable} ADD COLUMN ${sanitizeIdentifier(column_definition.name)} ${column_definition.type}`;
+            }
+            else if (action === "drop_column") {
+                sql = `ALTER TABLE ${safeTable} DROP COLUMN ${sanitizeIdentifier(column_definition.name)}`;
+            }
+            else if (action === "modify_column") {
+                sql = `ALTER TABLE ${safeTable} MODIFY COLUMN ${sanitizeIdentifier(column_definition.name)} ${column_definition.type}`;
+            }
+            else {
+                return res.status(400).json({
+                    success: false,
+                    error: { code: "BAD_REQUEST", message: `Unsupported action '${action}'`, timestamp: new Date().toISOString() },
+                });
+            }
+            await pool.query(sql);
+            return res.json({
+                success: true,
+                data: { table, action, altered: true },
+                meta: { timestamp: new Date().toISOString() },
+            });
+        }
+        catch (err) {
+            return res.status(500).json({
+                success: false,
+                error: { code: "ALTER_TABLE_FAILED", message: err.message, timestamp: new Date().toISOString() },
+            });
+        }
+    });
+    // 22. Drop Table
+    app.delete("/api/tables/:table", async (req, res) => {
+        try {
+            const pool = poolManager.getPool();
+            const table = req.params.table;
+            const db = req.body.database || req.query.database;
+            const ifExists = req.body.if_exists !== false;
+            const safeTable = getFullTableIdentifier(table, db);
+            const sql = `DROP TABLE ${ifExists ? "IF EXISTS " : ""}${safeTable}`;
+            await pool.query(sql);
+            return res.json({
+                success: true,
+                data: { table, dropped: true },
+                meta: { timestamp: new Date().toISOString() },
+            });
+        }
+        catch (err) {
+            return res.status(500).json({
+                success: false,
+                error: { code: "DROP_TABLE_FAILED", message: err.message, timestamp: new Date().toISOString() },
+            });
+        }
+    });
+    // 23. Execute DDL
+    app.post("/api/ddl", async (req, res) => {
+        try {
+            const pool = poolManager.getPool();
+            const { query, database } = req.body;
+            if (!query || typeof query !== "string") {
+                return res.status(400).json({
+                    success: false,
+                    error: { code: "BAD_REQUEST", message: "Query string is required", timestamp: new Date().toISOString() },
+                });
+            }
+            checkDangerousSql(query);
+            if (database) {
+                await pool.query(`USE ${sanitizeIdentifier(database)}`);
+            }
+            const [result] = await pool.query(query);
+            return res.json({
+                success: true,
+                data: { executed: true, result },
+                meta: { timestamp: new Date().toISOString() },
+            });
+        }
+        catch (err) {
+            return res.status(500).json({
+                success: false,
+                error: { code: "DDL_EXECUTION_FAILED", message: err.message, timestamp: new Date().toISOString() },
+            });
+        }
+    });
+    // 24. Schema Summary
+    app.get("/api/schema/summary", async (req, res) => {
+        try {
+            const pool = poolManager.getPool();
+            const db = req.query.database;
+            const maxTables = Math.min(200, Math.max(1, parseInt(req.query.max_tables || "50", 10)));
+            const sql = db ? `SHOW TABLES FROM ${sanitizeIdentifier(db)}` : "SHOW TABLES";
+            const [tableRows] = await pool.query(sql);
+            const tables = tableRows.map((r) => String(Object.values(r)[0]));
+            const summaries = [];
+            for (const t of tables.slice(0, maxTables)) {
+                const safeT = getFullTableIdentifier(t, db);
+                const [cols] = await pool.query(`DESCRIBE ${safeT}`);
+                const [cnt] = await pool.query(`SELECT COUNT(*) as total FROM ${safeT}`);
+                summaries.push({
+                    name: t,
+                    rowCount: cnt[0]?.total || 0,
+                    columnCount: cols.length,
+                    columns: cols.map((c) => ({ name: c.Field, type: c.Type })),
+                });
+            }
+            return res.json({
+                success: true,
+                data: {
+                    totalTables: tables.length,
+                    tables: summaries,
+                },
+                meta: { timestamp: new Date().toISOString() },
+            });
+        }
+        catch (err) {
+            return res.status(500).json({
+                success: false,
+                error: { code: "SUMMARY_FAILED", message: err.message, timestamp: new Date().toISOString() },
+            });
+        }
+    });
+    // 25. RAG Schema Context (Ultra-compact schema for LLM context windows)
+    app.get("/api/schema/rag-context", async (req, res) => {
+        try {
+            const pool = poolManager.getPool();
+            const db = req.query.database;
+            const maxTables = Math.min(200, Math.max(1, parseInt(req.query.max_tables || "50", 10)));
+            const maxColumns = Math.min(100, Math.max(1, parseInt(req.query.max_columns || "15", 10)));
+            const keywordFilter = (req.query.keyword_filter || "").toLowerCase();
+            const sql = db ? `SHOW TABLES FROM ${sanitizeIdentifier(db)}` : "SHOW TABLES";
+            const [tableRows] = await pool.query(sql);
+            let tables = tableRows.map((r) => String(Object.values(r)[0]));
+            if (keywordFilter) {
+                tables = tables.filter((t) => t.toLowerCase().includes(keywordFilter));
+            }
+            tables = tables.slice(0, maxTables);
+            const compactTables = [];
+            let compactText = `# Database Schema Context (Total Tables: ${tables.length})\n\n`;
+            for (const t of tables) {
+                const safeT = getFullTableIdentifier(t, db);
+                const [cols] = await pool.query(`DESCRIBE ${safeT}`);
+                const [cnt] = await pool.query(`SELECT COUNT(*) as total FROM ${safeT}`);
+                const rowCount = cnt[0]?.total || 0;
+                const tableCols = cols.slice(0, maxColumns).map((c) => {
+                    let flags = "";
+                    if (c.Key === "PRI")
+                        flags += " [PK]";
+                    if (c.Null === "NO")
+                        flags += " NOT NULL";
+                    return `${c.Field} (${c.Type}${flags})`;
+                });
+                compactTables.push({
+                    table: t,
+                    estimatedRows: rowCount,
+                    columns: tableCols,
+                });
+                compactText += `## Table: ${t} (~${rowCount} rows)\n`;
+                compactText += `Columns: ${tableCols.join(", ")}\n\n`;
+            }
+            return res.json({
+                success: true,
+                data: {
+                    tableCount: tables.length,
+                    tables: compactTables,
+                    compactContextString: compactText.trim(),
+                },
+                meta: { timestamp: new Date().toISOString() },
+            });
+        }
+        catch (err) {
+            return res.status(500).json({
+                success: false,
+                error: { code: "RAG_CONTEXT_FAILED", message: err.message, timestamp: new Date().toISOString() },
+            });
+        }
+    });
+    // 26. Schema ERD (Mermaid)
+    app.get("/api/schema/erd", async (req, res) => {
+        try {
+            const pool = poolManager.getPool();
+            const db = req.query.database;
+            const sql = db ? `SHOW TABLES FROM ${sanitizeIdentifier(db)}` : "SHOW TABLES";
+            const [tableRows] = await pool.query(sql);
+            const tables = tableRows.map((r) => String(Object.values(r)[0]));
+            let mermaid = "erDiagram\n";
+            for (const t of tables) {
+                mermaid += `  ${t} {\n`;
+                const safeT = getFullTableIdentifier(t, db);
+                const [cols] = await pool.query(`DESCRIBE ${safeT}`);
+                for (const c of cols) {
+                    mermaid += `    ${c.Type.split("(")[0]} ${c.Field}\n`;
+                }
+                mermaid += `  }\n`;
+            }
+            return res.json({
+                success: true,
+                data: {
+                    mermaidDiagram: mermaid,
+                    tableCount: tables.length,
+                },
+                meta: { timestamp: new Date().toISOString() },
+            });
+        }
+        catch (err) {
+            return res.status(500).json({
+                success: false,
+                error: { code: "ERD_FAILED", message: err.message, timestamp: new Date().toISOString() },
+            });
+        }
+    });
+    // 27. Schema Relationships
+    app.get("/api/schema/relationships", async (_req, res) => {
+        try {
+            const pool = poolManager.getPool();
+            const [rows] = await pool.query(`
+        SELECT 
+          TABLE_NAME as tableName,
+          COLUMN_NAME as columnName,
+          REFERENCED_TABLE_NAME as referencedTable,
+          REFERENCED_COLUMN_NAME as referencedColumn
+        FROM INFORMATION_SCHEMA.KEY_COLUMN_USAGE
+        WHERE REFERENCED_TABLE_SCHEMA = DATABASE()
+      `);
+            return res.json({
+                success: true,
+                data: rows,
+                meta: { timestamp: new Date().toISOString(), count: rows.length },
+            });
+        }
+        catch (err) {
+            return res.status(500).json({
+                success: false,
+                error: { code: "RELATIONSHIPS_FAILED", message: err.message, timestamp: new Date().toISOString() },
+            });
+        }
+    });
+    // 28. Schema Search
+    app.get("/api/schema/search", async (req, res) => {
+        try {
+            const pool = poolManager.getPool();
+            const query = (req.query.query || "").toLowerCase();
+            const db = req.query.database;
+            const sql = db ? `SHOW TABLES FROM ${sanitizeIdentifier(db)}` : "SHOW TABLES";
+            const [tableRows] = await pool.query(sql);
+            const tables = tableRows.map((r) => String(Object.values(r)[0]));
+            const matches = [];
+            for (const t of tables) {
+                const matchesTable = t.toLowerCase().includes(query);
+                const safeT = getFullTableIdentifier(t, db);
+                const [cols] = await pool.query(`DESCRIBE ${safeT}`);
+                const matchingCols = cols.filter((c) => c.Field.toLowerCase().includes(query));
+                if (matchesTable || matchingCols.length > 0) {
+                    matches.push({
+                        table: t,
+                        matchesTableName: matchesTable,
+                        matchingColumns: matchingCols.map((c) => c.Field),
+                    });
+                }
+            }
+            return res.json({
+                success: true,
+                data: matches,
+                meta: { timestamp: new Date().toISOString(), count: matches.length },
+            });
+        }
+        catch (err) {
+            return res.status(500).json({
+                success: false,
+                error: { code: "SCHEMA_SEARCH_FAILED", message: err.message, timestamp: new Date().toISOString() },
+            });
+        }
+    });
+    // 29. Export Table to CSV
+    app.get("/api/tables/:table/export", async (req, res) => {
+        try {
+            const pool = poolManager.getPool();
+            const table = req.params.table;
+            const db = req.query.database;
+            const limit = parseInt(req.query.limit || "1000", 10);
+            const safeTable = getFullTableIdentifier(table, db);
+            const [rows] = await pool.query(`SELECT * FROM ${safeTable} LIMIT ${limit}`);
+            if (!rows || rows.length === 0) {
+                return res.json({
+                    success: true,
+                    data: { csv: "", rowCount: 0 },
+                    meta: { timestamp: new Date().toISOString() },
+                });
+            }
+            const headers = Object.keys(rows[0]);
+            const csvLines = [headers.join(",")];
+            for (const row of rows) {
+                const line = headers
+                    .map((h) => {
+                    const val = row[h];
+                    if (val === null || val === undefined)
+                        return "";
+                    const str = String(val).replace(/"/g, '""');
+                    return str.includes(",") || str.includes('"') || str.includes("\n") ? `"${str}"` : str;
+                })
+                    .join(",");
+                csvLines.push(line);
+            }
+            return res.json({
+                success: true,
+                data: {
+                    csv: csvLines.join("\n"),
+                    rowCount: rows.length,
+                },
+                meta: { timestamp: new Date().toISOString() },
+            });
+        }
+        catch (err) {
+            return res.status(500).json({
+                success: false,
+                error: { code: "CSV_EXPORT_FAILED", message: err.message, timestamp: new Date().toISOString() },
+            });
+        }
+    });
+    // 30. Export Query to CSV (Strictly guarded to read-only queries)
+    app.post("/api/query/export", async (req, res) => {
+        try {
+            const pool = poolManager.getPool();
+            const { query, limit = 1000, database } = req.body;
+            if (!query || typeof query !== "string") {
+                return res.status(400).json({
+                    success: false,
+                    error: { code: "BAD_REQUEST", message: "Query is required", timestamp: new Date().toISOString() },
+                });
+            }
+            let trimmed = query.trim();
+            while (trimmed.endsWith(";")) {
+                trimmed = trimmed.slice(0, -1).trim();
+            }
+            checkDangerousSql(trimmed);
+            if (!/^(SELECT|SHOW|DESCRIBE|DESC|EXPLAIN)/i.test(trimmed)) {
+                return res.status(400).json({
+                    success: false,
+                    error: {
+                        code: "READ_ONLY_VIOLATION",
+                        message: "export_query_to_csv only supports read-only queries (SELECT, SHOW, DESCRIBE, EXPLAIN)",
+                        timestamp: new Date().toISOString(),
+                    },
+                });
+            }
+            if (database) {
+                await pool.query(`USE ${sanitizeIdentifier(database)}`);
+            }
+            const [rows] = await pool.query(`${trimmed} LIMIT ${limit}`);
+            if (!Array.isArray(rows) || rows.length === 0) {
+                return res.json({
+                    success: true,
+                    data: { csv: "", rowCount: 0 },
+                    meta: { timestamp: new Date().toISOString() },
+                });
+            }
+            const headers = Object.keys(rows[0]);
+            const csvLines = [headers.join(",")];
+            for (const row of rows) {
+                const line = headers
+                    .map((h) => {
+                    const val = row[h];
+                    if (val === null || val === undefined)
+                        return "";
+                    const str = String(val).replace(/"/g, '""');
+                    return str.includes(",") || str.includes('"') || str.includes("\n") ? `"${str}"` : str;
+                })
+                    .join(",");
+                csvLines.push(line);
+            }
+            return res.json({
+                success: true,
+                data: {
+                    csv: csvLines.join("\n"),
+                    rowCount: rows.length,
+                },
+                meta: { timestamp: new Date().toISOString() },
+            });
+        }
+        catch (err) {
+            return res.status(500).json({
+                success: false,
+                error: { code: "QUERY_EXPORT_FAILED", message: err.message, timestamp: new Date().toISOString() },
+            });
+        }
+    });
+    // 31. 404 Catch-All Handler (Strict JSON guarantee - no HTML error pages)
+    app.use((_req, res) => {
+        return res.status(404).json({
+            success: false,
+            error: {
+                code: "ROUTE_NOT_FOUND",
+                message: "Endpoint not found on MySQL API server",
+                timestamp: new Date().toISOString(),
+            },
+        });
+    });
+    // 32. Global Error Handler (Strict JSON guarantee - no HTML or uncaught crashes)
+    app.use((err, _req, res, _next) => {
+        return res.status(err.status || 500).json({
+            success: false,
+            error: {
+                code: err.code || "INTERNAL_SERVER_ERROR",
+                message: err.message || "An unhandled server error occurred",
+                timestamp: new Date().toISOString(),
+            },
+        });
+    });
+    return app;
+}