tina4ruby 3.13.97 → 3.13.99

data/lib/tina4/dev_admin.rb

@@ -383,6 +383,16 @@ module Tina4
         path = env["PATH_INFO"] || "/"
         method = env["REQUEST_METHOD"]
 
+        # DEVADMIN-DEC-01/02 (feature 127): fail-closed same-origin + loopback
+        # gate on every /__dev write, before ANY handler runs. Closes drive-by
+        # CSRF (a page the developer also has open POSTing to /file/save then
+        # /reload) and a network-exposed debug box. GET/HEAD/OPTIONS skip it;
+        # the MCP surface keeps its own richer 404 gate (with_mcp_gate), so the
+        # loopback arm skips the mcp prefixes. Mirrors Python's
+        # dev_admin._dev_mutation_denial wired into _handle_dev_admin.
+        denial = dev_mutation_denial(env)
+        return denial if denial
+
         # Dynamic-path routes can't live in the case-tuple below — match
         # them up front. /__dev/api/threads/{id}[/messages] is forwarded
         # verbatim to the Rust agent's /threads/{id}[/messages] surface
@@ -665,7 +675,10 @@ module Tina4
         when ["GET", "/__dev/api/files"]
           json_response(files_list(env))
         when ["GET", "/__dev/api/file"]
-          json_response(file_read_payload(query_param(env, "path")))
+          rel = query_param(env, "path")
+          # DEVADMIN-DEC-03: a secret path refuses with 403 (parity with Python);
+          # file_read_payload also guards so the body never carries the content.
+          json_response(file_read_payload(rel), secret_path?(rel) ? 403 : 200)
         when ["GET", "/__dev/api/file/raw"]
           file_raw_response(query_param(env, "path"))
         when ["POST", "/__dev/api/file/save"]
@@ -758,9 +771,9 @@ module Tina4
         JSON.parse(raw) rescue nil
       end
 
-      def json_response(data)
+      def json_response(data, status = 200)
         body = JSON.generate(data)
-        [200, { "content-type" => "application/json; charset=utf-8" }, [body]]
+        [status, { "content-type" => "application/json; charset=utf-8" }, [body]]
       end
 
       def version_check_payload
@@ -1036,7 +1049,12 @@ module Tina4
         url = grounding_env_value("TINA4_MCP_URL").to_s
         url = "https://mcp.tina4.com" if url.empty?
         configured = !token.empty?
-        { configured: configured, last4: configured ? token[-4..].to_s : "", url: url }
+        # source: the developer's own token → "personal"; otherwise the coder
+        # runs on the shared FREE-TOKEN trial the Rust agent falls back to →
+        # "free", which drives the "register" nudge. (Disabling the free rung
+        # is an agent-side concern.)
+        source = configured ? "personal" : "free"
+        { configured: configured, source: source, last4: configured ? token[-4..].to_s : "", url: url }
       end
 
       # POST /__dev/api/grounding/token — upsert TINA4_MCP_TOKEN into the
@@ -1349,13 +1367,22 @@ module Tina4
           # which a bare Tina4.seed_table call never trips (mirrors Python's
           # explicit `from tina4_python.seeder import seed_table`).
           require_relative "seeder"
+          # SEED-TABLE-SEED-INERT: seed_table no longer takes seed: (it has no
+          # generators of its own). Build the field map from the introspected
+          # columns using a CALLER-SEEDED FakeData closed over per generator —
+          # the same "auto_field_map(db, table, fake)" pattern Python/Node use
+          # for their dev-admin seed endpoints — so reproducibility comes from
+          # the closure, not a dead keyword.
+          fake = Tina4::FakeData.new(seed: seed)
+          field_map = Tina4._normalize_columns(db.columns(table_name)).each_with_object({}) do |(col_name, type_sym), map|
+            map[col_name] = -> { fake.for_field({ type: type_sym }, col_name) }
+          end
           # Delegate to the shared resilient seed_table helper so the endpoint
           # gets the exact same per-row wrap (P1) — no unhandled row failure can
-          # crash the endpoint — plus clear/seed/strict (P2/P3). _normalize_columns
-          # skips auto-increment id PKs from the introspected column list.
+          # crash the endpoint — plus clear/strict (P2/P1).
           summary = Tina4.seed_table(
-            table_name, db.columns(table_name),
-            count: count, seed: seed, clear: clear, strict: strict
+            table_name, field_map,
+            count: count, clear: clear, strict: strict
           )
           {
             table: table_name,
@@ -1718,7 +1745,10 @@ module Tina4
 
       def dev_files_hidden?(name)
         return true if DEV_FILES_IGNORED.include?(name)
-        name.start_with?(".") && name != ".env" && name != ".env.example"
+        # DEVADMIN-DEC-03: hide dotfiles INCLUDING .env (it carries TINA4_SECRET,
+        # the DB password and the MCP token). The .env.example template is
+        # placeholder-only and stays visible.
+        name.start_with?(".") && name != ".env.example"
       end
 
       # Same 4-status mapping Python/PHP use for a porcelain code.
@@ -1792,6 +1822,10 @@ module Tina4
           next if dev_files_hidden?(name)
           full = File.join(target, name)
           entry_rel = full[root.length..].to_s.sub(%r{\A/+}, "").tr("\\", "/")
+          # DEVADMIN-DEC-03: never surface secret material in the listing
+          # (.pem/.key, id_rsa, secrets/, .git/). The dotfile filter above
+          # already drops .env; this covers non-dotfile secrets too.
+          next if secret_path?(entry_rel)
           is_dir = File.directory?(full)
 
           # git status for this entry (same mapping PHP/Python use)
@@ -1856,6 +1890,12 @@ module Tina4
 
       def file_read_payload(rel)
         return { error: "path required" } if rel.nil? || rel.empty?
+        # DEVADMIN-DEC-03: never serve secret material (.env, keys, secrets/).
+        # The dispatch statuses this 403; the guard here keeps the helper safe
+        # for any other caller too. The secret content never enters the payload.
+        if secret_path?(rel)
+          return { error: "Refused: secret file", path: rel.to_s, content: "", language: "text", bytes: 0 }
+        end
         begin
           target = safe_project_path(rel)
           return { error: "Not found" } unless File.exist?(target)
@@ -1869,6 +1909,8 @@ module Tina4
 
       def file_raw_response(rel)
         return json_response({ error: "path required" }) if rel.nil? || rel.empty?
+        # DEVADMIN-DEC-03: never serve secret material (.env, keys, secrets/).
+        return json_response({ error: "Refused: secret file" }, 403) if secret_path?(rel)
         begin
           target = safe_project_path(rel)
           return json_response({ error: "Not found" }) unless File.file?(target)
@@ -2068,6 +2110,92 @@ module Tina4
         res.zero?
       end
 
+      # ── Dev-admin mutation security (feature 127, DEVADMIN-DEC-01/02/03) ──
+      # The dashboard writes files, runs SQL and installs gems, so it must
+      # assume the developer ALSO browses the web. Two fail-closed gates guard
+      # every /__dev write, and a secret denylist guards the file-read surface.
+      # Mirrors tina4_python/dev_admin _dev_same_origin_ok / _dev_mutation_denial
+      # / _is_secret_path.
+      DEV_SAFE_METHODS = %w[GET HEAD OPTIONS].freeze
+      # The MCP surface carries its own richer loopback+token gate
+      # (with_mcp_gate -> 404), so the REST loopback arm skips these prefixes and
+      # lets the MCP gate govern (keeps a disallowed mcp/call a 404, not a 403).
+      DEV_MCP_PREFIXES = ["/__dev/api/mcp", "/__dev/mcp"].freeze
+      # Private-key / credential basenames the file endpoints must never serve.
+      DEV_SECRET_BASENAMES = %w[.env .envrc id_rsa id_dsa id_ecdsa id_ed25519].freeze
+      DEV_SECRET_SUFFIXES = %w[.pem .key .pfx .p12 .keystore .jks].freeze
+
+      # DEVADMIN-DEC-01: fail-closed same-origin check for a dev-admin mutation.
+      #
+      # A drive-by CSRF is a BROWSER cross-origin request, and a modern browser
+      # always sends Sec-Fetch-Site (and any browser sends Origin on a
+      # cross-origin POST), so:
+      #   - Sec-Fetch-Site present -> trust the browser's own classification
+      #     (cross-site refused; same-origin / same-site / none allowed).
+      #   - else Origin present -> require its host to match the request Host.
+      #   - else neither -> not a browser cross-origin request at all (curl, a
+      #     test client, a server-side caller); it cannot be a drive-by, so it
+      #     is allowed here and the loopback gate still constrains the peer.
+      def dev_same_origin_ok?(env)
+        sfs = (env["HTTP_SEC_FETCH_SITE"] || "").strip.downcase
+        return %w[same-origin same-site none].include?(sfs) unless sfs.empty?
+
+        origin = (env["HTTP_ORIGIN"] || "").strip
+        unless origin.empty?
+          netloc = origin.include?("://") ? origin.split("://", 2)[1] : origin
+          host = (env["HTTP_HOST"] || "").strip
+          return !host.empty? && netloc.downcase == host.downcase
+        end
+        true
+      end
+
+      # Return a 403 Rack triple to REFUSE a dev-admin write, or nil to allow.
+      #
+      # Two independent fail-closed gates on every /__dev mutation:
+      #   DEC-01  same-origin (all writes, incl. mcp/call) - drive-by CSRF.
+      #   DEC-02  loopback peer (all writes EXCEPT the MCP surface, which carries
+      #           its own gate) - a network-exposed debug box.
+      # Uses the RAW socket peer (env["REMOTE_ADDR"]), never X-Forwarded-For.
+      def dev_mutation_denial(env)
+        method = (env["REQUEST_METHOD"] || "").to_s.upcase
+        return nil if DEV_SAFE_METHODS.include?(method)
+        path = (env["PATH_INFO"] || "").to_s
+        return nil unless path.start_with?("/__dev")
+
+        return dev_refused("dev-admin: refused (cross-origin request)") unless dev_same_origin_ok?(env)
+
+        unless path.start_with?(*DEV_MCP_PREFIXES)
+          remote_ip = (env["REMOTE_ADDR"] || "").to_s
+          unless Tina4.is_loopback?(remote_ip) || mcp_token_ok?(env)
+            return dev_refused("dev-admin: refused (non-loopback peer)")
+          end
+        end
+        nil
+      end
+
+      def dev_refused(message)
+        [403, { "content-type" => "application/json; charset=utf-8" },
+         [JSON.generate({ "ok" => false, "error" => message })]]
+      end
+
+      # DEVADMIN-DEC-03: true when +rel+ names secret material the file endpoints
+      # must never serve - .env / .env.* (the .env.example template is allowed),
+      # anything under .git/ or secrets/, and private-key material.
+      def secret_path?(rel)
+        norm = rel.to_s.tr("\\", "/").gsub(%r{\A/+|/+\z}, "").downcase
+        return false if norm.empty?
+
+        parts = norm.split("/")
+        return true if parts.any? { |p| p == ".git" || p == "secrets" }
+
+        base = parts.last
+        return false if base == ".env.example"
+        return true if base == ".env" || base.start_with?(".env.")
+        return true if DEV_SECRET_BASENAMES.include?(base)
+
+        base.end_with?(*DEV_SECRET_SUFFIXES)
+      end
+
       def mcp_tools_list
         return { tools: [], count: 0 } unless defined?(Tina4::McpServer)
         server = Tina4._default_mcp_server

data/lib/tina4/dispatch_pipeline.rb

@@ -1,5 +1,9 @@
 # frozen_string_literal: true
 
+require "zlib"
+require "stringio"
+require "digest"
+
 module Tina4
   # The dispatch pipeline: the concerns of RackApp#call, named and ordered.
   #
@@ -67,7 +71,15 @@ module Tina4
     # the swagger and static branches - which return early - skipped it, and
     # `HEAD /style.css` shipped the whole file body. Measured 2026-07-31: Ruby
     # returned 15 bytes where PHP, Python and Node all returned 0.
+    #
+    # `compress_and_tag` and `conditional_get` (feature 40, CE-DEC-01/02) run
+    # FIRST - before head_strip - so a HEAD response's preserved
+    # Content-Length reflects the (possibly compressed) body the equivalent
+    # GET would have sent, mirroring the Python master's build_headers() ->
+    # app() ordering (compress -> tag -> 304-decide -> strip-for-HEAD).
     ALWAYS_STAGES = %i[
+      compress_and_tag
+      conditional_get
       head_strip
       apply_cors
     ].freeze
@@ -286,12 +298,136 @@ module Tina4
         return static_response
       end
 
-      handle_404(ctx.path)
+      handle_404(ctx.path, ctx.env["HTTP_ACCEPT"])
     end
 
-    # ── RESPONSE STAGES ──────────────────────────────────────────────
+    # ── ALWAYS STAGES (compression / ETag / conditional-GET) ──────────
     # Each returns a replacement Rack triple, or nil to leave it unchanged.
 
+    # Gzip-compress + attach an ETag (feature 40, CE-DEC-01) - the ONE header
+    # builder every response funnels through (a static asset or a dynamic
+    # route), mirroring the Python master's build_headers(). A streaming body
+    # (an Enumerator, from Response#stream) is never touched - joining it
+    # would drain an SSE generator instead of letting it stream live.
+    #
+    # Compression: the body exceeds 1024 bytes AND Accept-Encoding offers
+    # gzip AND the content type is compressible. Uses stdlib Zlib - zero new
+    # dependency.
+    #
+    # ETag: a strong md5 hash (first 16 hex chars) over the FINAL
+    # (post-compression) body, UNLESS a validator is already set - a
+    # static-file response (#serve_static_file) pins its own weak
+    # size+mtime ETag before this runs (CE-DEC-02), so this never overwrites
+    # it with a content hash.
+    def compress_and_tag(ctx, response)
+      status, headers, body_parts = response
+      return nil unless body_parts.is_a?(Array)
+
+      body = body_parts.join
+      new_headers = headers.dup
+      changed = false
+
+      if should_gzip?(ctx, body, new_headers)
+        body = gzip_string(body)
+        new_headers["content-encoding"] = "gzip"
+        new_headers["vary"] = "Accept-Encoding"
+        new_headers["content-length"] = body.bytesize.to_s if new_headers["content-length"]
+        changed = true
+      end
+
+      if should_tag_etag?(new_headers, body, status)
+        new_headers["etag"] = %("#{Digest::MD5.hexdigest(body)[0, 16]}")
+        changed = true
+      end
+
+      return nil unless changed
+
+      [status, new_headers, [body]]
+    end
+
+    # Split out of compress_and_tag (metrics/6b) to hold the complexity gate:
+    # the body-size / Accept-Encoding / content-type gzip decision, named so
+    # the caller reads as one line per concern instead of one three-way &&.
+    def should_gzip?(ctx, body, headers)
+      accept_encoding = ctx.env["HTTP_ACCEPT_ENCODING"] || ""
+      content_type = headers["content-type"] || ""
+      body.bytesize > 1024 && accept_encoding.include?("gzip") && compressible_content_type?(content_type)
+    end
+
+    # Split out of compress_and_tag (metrics/6b): whether this response earns
+    # a content-hash ETag - no validator set already, a non-empty body, a 200.
+    def should_tag_etag?(headers, body, status)
+      !headers["etag"] && !body.empty? && status == 200
+    end
+
+    # Answer a matching conditional GET with a 304 that PRESERVES whichever
+    # validators (ETag / Last-Modified) the 200 would have carried (feature
+    # 40). A static-file 304 (#serve_static_file's own short-circuit) is
+    # already terminal by the time this runs (status is 304, not 200), so the
+    # guard below leaves it untouched.
+    def conditional_get(ctx, response)
+      status, headers, body_parts = response
+      return nil unless status == 200 && body_parts.is_a?(Array)
+
+      body = body_parts.join
+      return nil if body.empty?
+
+      etag = headers["etag"]
+      last_modified = headers["last-modified"]
+      return nil unless request_not_modified?(ctx, etag, last_modified)
+
+      not_modified_headers = {}
+      not_modified_headers["etag"] = etag if etag
+      not_modified_headers["last-modified"] = last_modified if last_modified
+      [304, not_modified_headers, [""]]
+    end
+
+    # Split out of conditional_get (metrics/6b) to hold the complexity gate.
+    # RFC 7232 S6: If-None-Match, when present, decides it alone; only when
+    # the request sends no If-None-Match does If-Modified-Since apply.
+    def request_not_modified?(ctx, etag, last_modified)
+      if_none_match = ctx.env["HTTP_IF_NONE_MATCH"]
+      return etag_matches?(if_none_match, etag) if if_none_match && !if_none_match.empty?
+
+      if_modified_since = ctx.env["HTTP_IF_MODIFIED_SINCE"]
+      return false unless if_modified_since && !if_modified_since.empty? && last_modified
+
+      begin
+        Time.httpdate(last_modified).to_i <= Time.httpdate(if_modified_since).to_i
+      rescue ArgumentError
+        false # Unparseable date -> serve the body (never 304 on garbage).
+      end
+    end
+
+    # Whether a content type benefits from gzip compression (text-ish, JSON,
+    # XML, JS, SVG). Mirrors the Python master's `_is_compressible`.
+    def compressible_content_type?(content_type)
+      %w[text/ application/json application/xml application/javascript image/svg].any? do |needle|
+        content_type.include?(needle)
+      end
+    end
+
+    # Gzip-compress a string at level 6, in memory. Stdlib Zlib - zero new
+    # dependency.
+    def gzip_string(str)
+      io = StringIO.new
+      writer = Zlib::GzipWriter.new(io, 6)
+      writer.write(str)
+      writer.close
+      io.string
+    end
+
+    # Match an If-None-Match header value against `etag` (RFC 7232 S3.2 weak
+    # comparison). Shared with the static-file conditional-GET
+    # (#static_not_modified?) so BOTH paths use IDENTICAL matching semantics.
+    def etag_matches?(if_none_match, etag)
+      return false if etag.nil? || etag.empty?
+      return true if if_none_match.strip == "*"
+
+      want = weak_etag_value(etag)
+      if_none_match.split(",").any? { |candidate| weak_etag_value(candidate) == want }
+    end
+
     # RFC 9110 s9.3.2: a HEAD response MUST NOT include content. Strip the body
     # unconditionally and record what Content-Length the GET would have sent -
     # cache validators, link checkers and monitoring probes use that header to
@@ -458,7 +594,12 @@ module Tina4
     # are only known now, so they are attached here.
     def prepare_route_request(ctx)
       ctx.request = ctx.pre_request || Tina4::Request.new(ctx.env)
-      ctx.request.path_params = ctx.path_params
+      ctx.request.params = ctx.path_params
+      # Attach the matched route so post-match middleware (CsrfMiddleware) can
+      # read its metadata -- e.g. auth_required to honour a public write route
+      # (.no_auth). Without this the CSRF no_auth skip is dead code, because the
+      # request otherwise carries no handler/route reference.
+      ctx.request.route = ctx.route
       ctx.env["tina4.request"] = ctx.request # Store for session save after response
       ctx.response = ctx.pre_response || Tina4::Response.new
       nil
@@ -485,7 +626,7 @@ module Tina4
       return nil unless ctx.route.auth_handler
       return nil if ctx.route.auth_handler.call(ctx.env)
 
-      handle_403(ctx.env["PATH_INFO"] || "/")
+      handle_403(ctx.env["PATH_INFO"] || "/", ctx.env["HTTP_ACCEPT"])
     end
 
     # Secure-by-default: enforce bearer-token auth on write routes.

data/lib/tina4/drivers/firebird_driver.rb

@@ -227,17 +227,25 @@ module Tina4
             @connection.query(:hash, sql, *params)
           end
         end
-        rows.map { |row| decode_blobs(stringify_keys(row)) }
+        rows.map { |row| decode_blobs(symbolize_keys(row)) }
       end
 
       def execute(sql, params = [])
-        with_reconnect do
+        result = with_reconnect do
           if params.empty?
             @connection.execute(sql)
           else
             @connection.execute(sql, *params)
           end
         end
+        # The fb gem's Connection#execute RETURNS the affected row count as an
+        # Integer for DML, so capture it for #affected_rows (FB-AFFECTED-FAB --
+        # the facade used to default it). Remember an INSERT's target table so
+        # #last_insert_id can read its GEN_<TABLE>_ID generator (FB-LASTID-GAP);
+        # a non-INSERT clears it so last_insert_id is nil there.
+        @affected_rows = result.is_a?(Integer) ? result : 0
+        @last_insert_table = insert_target_table(sql)
+        result
       end
 
       # Public so specs (and curious operators) can verify the matcher
@@ -249,10 +257,28 @@ module Tina4
         DEAD_CONN_MARKERS.any? { |m| lower.include?(m) }
       end
 
+      # Firebird has no generic last-insert-id, so read the GEN_<TABLE>_ID
+      # generator the row's BEFORE INSERT trigger drew from (FB-LASTID-GAP). The
+      # generator read is COLUMN-NAME-INDEPENDENT, so it is correct even for a
+      # non-`id` primary key. Returns nil when the last write was not an INSERT
+      # or the table has no such generator (GEN_ID then raises -> rescued).
       def last_insert_id
+        table = @last_insert_table
+        return nil if table.nil? || table.empty?
+        generator = "GEN_#{table.gsub('"', '').upcase}_ID"
+        row = execute_query("SELECT GEN_ID(#{generator}, 0) AS LID FROM RDB\$DATABASE").first
+        row && (row[:lid] || row[:LID])
+      rescue StandardError
         nil
       end
 
+      # Rows affected by the most recent write, read from the fb gem's execute()
+      # return (an Integer for DML). Best-effort 0 for DDL / a non-count return.
+      # The facade's write_affected reads this when the driver implements it.
+      def affected_rows
+        @affected_rows || 0
+      end
+
       def placeholder
         "?"
       end
@@ -317,10 +343,15 @@ module Tina4
         @in_transaction = false
       end
 
+      # ADR-0044 required adapter capability.
+      def get_database_type
+        'firebird'
+      end
+
       def tables
         sql = "SELECT RDB\$RELATION_NAME FROM RDB\$RELATIONS WHERE RDB\$SYSTEM_FLAG = 0 AND RDB\$VIEW_BLR IS NULL"
         rows = execute_query(sql)
-        rows.map { |r| (r["RDB\$RELATION_NAME"] || r["rdb\$relation_name"] || "").strip }
+        rows.map { |r| (r[:"RDB\$RELATION_NAME"] || r[:"rdb\$relation_name"] || "").strip }
       end
 
       def columns(table_name)
@@ -341,7 +372,7 @@ module Tina4
                  "ORDER BY SG.RDB\$FIELD_POSITION"
         pk_names = begin
           execute_query(pk_sql, [table_name.upcase]).map do |r|
-            (r["RDB\$FIELD_NAME"] || r["rdb\$field_name"] || "").strip.upcase
+            (r[:"RDB\$FIELD_NAME"] || r[:"rdb\$field_name"] || "").strip.upcase
           end.reject(&:empty?).to_set
         rescue StandardError
           # A table with no primary key is not an error.
@@ -349,12 +380,12 @@ module Tina4
         end
 
         rows.map do |r|
-          field_name = (r["RDB\$FIELD_NAME"] || r["rdb\$field_name"] || "").strip
+          field_name = (r[:"RDB\$FIELD_NAME"] || r[:"rdb\$field_name"] || "").strip
           {
             name: field_name,
-            type: r["RDB\$FIELD_TYPE"] || r["rdb\$field_type"],
-            nullable: (r["RDB\$NULL_FLAG"] || r["rdb\$null_flag"]).nil?,
-            default: r["RDB\$DEFAULT_SOURCE"] || r["rdb\$default_source"],
+            type: r[:"RDB\$FIELD_TYPE"] || r[:"rdb\$field_type"],
+            nullable: (r[:"RDB\$NULL_FLAG"] || r[:"rdb\$null_flag"]).nil?,
+            default: r[:"RDB\$DEFAULT_SOURCE"] || r[:"rdb\$default_source"],
             primary_key: pk_names.include?(field_name.upcase)
           }
         end
@@ -390,8 +421,24 @@ module Tina4
         yield
       end
 
-      def stringify_keys(hash)
-        hash.each_with_object({}) { |(k, v), h| h[column_name(k.to_s)] = v }
+      # Hydrate a raw fb-gem row into a SYMBOL-keyed Hash — parity with the
+      # sqlite/postgres/mssql drivers (SqliteDriver#symbolize_rows,
+      # PostgresDriver#symbolize_result, MssqlDriver's `symbolize_keys: true`),
+      # all three of which hand back symbol keys. This used to build a
+      # STRING-keyed row (hence the old name `stringify_keys`), the one
+      # Firebird-only divergence in the whole row-hydration contract:
+      # `db.fetch(...).first[:name]` worked on every engine except Firebird,
+      # where only `row["name"]` did. column_name's casing fold-back is
+      # unchanged — only the key TYPE changes here.
+      def symbolize_keys(hash)
+        hash.each_with_object({}) { |(k, v), h| h[column_name(k.to_s).to_sym] = v }
+      end
+
+      # The target table of an INSERT (so last_insert_id can read its
+      # GEN_<TABLE>_ID generator), or nil for any other statement.
+      def insert_target_table(sql)
+        match = sql.to_s.match(/\AINSERT\s+INTO\s+([^\s(]+)/i)
+        match && match[1]
       end
 
       # Firebird's stored column name, folded back only when it was folded.
@@ -399,8 +446,8 @@ module Tina4
       # Firebird's identifier folding is ASYMMETRIC. An unquoted `AS x` is
       # stored UPPERCASE, so the driver hands back "X" where every other engine
       # Tina4 supports gives "x" -- PostgreSQL folds to lower, and MySQL, SQLite
-      # and MSSQL preserve what you wrote. Portable code reading row["x"] broke
-      # on Firebird alone; the live URL examples in this repo asserted row["x"]
+      # and MSSQL preserve what you wrote. Portable code reading row[:x] broke
+      # on Firebird alone; the live URL examples in this repo asserted row[:x]
       # and could never have passed once they actually reached a server.
       #
       # A QUOTED `AS "MyCol"` is stored exactly as written, and that case is