@portll/cobolwork 0.2.117 → 0.2.140

package/lib/precompile.mjs

@@ -7,6 +7,7 @@
 // name routines nothing implements: the goal is a program that compiles.
 import { detectFormat, expandTabs } from './parser.mjs';
 import { EIB_LAYOUT } from './words.mjs';
+import { sqlTokens, sqlRoles } from './embedded-sql.mjs';
 import { builtinValue, translateCics, eibCopybook, CONSTANT_COPYBOOKS, constantsCopybook, symbolicMapCopybook } from './precompile-cics.mjs';
 
 const isFree = (format) => format === 'free' || format === 'terminal';
@@ -84,20 +85,6 @@ function findBlocks(lines, format) {
   return { blocks, builtins };
 }
 
-// The words, host variables and literals of a statement. A host variable is :NAME, qualified as
-// :GROUP.NAME, and may carry an indicator variable, :NAME:IND or :NAME INDICATOR :IND.
-function tokenize(sql) {
-  const toks = [];
-  const re = /'(?:[^']|'')*'|"(?:[^"]|"")*"|:\s*[A-Z0-9_$#@-]+(?:\.[A-Z0-9_$#@-]+)*|[A-Z0-9_$#@-]+|[(),=<>+*/;.]/gi;
-  for (const m of sql.matchAll(re)) {
-    const t = m[0];
-    if (t.startsWith(':')) toks.push({ host: t.slice(1).trim().toUpperCase() });
-    else if (/^['"]/.test(t)) toks.push({ lit: t });
-    else toks.push({ word: t.toUpperCase() });
-  }
-  return toks;
-}
-
 // How many subscripts a host variable needs: one for each OCCURS on it or on a group holding it.
 function subscriptCounter(items = []) {
   const byName = new Map();
@@ -116,76 +103,6 @@ function subscriptCounter(items = []) {
 // where the array starts.
 const cobolName = (host, subscripts = 0) => host.split('.').reverse().join(' OF ') + (subscripts ? ` (${Array(subscripts).fill(1).join(' ')})` : '');
 
-// Clauses that end an INTO list.
-const AFTER_INTO = new Set(['FROM', 'WHERE', 'GROUP', 'HAVING', 'ORDER', 'FETCH', 'FOR', 'WITH', 'OPTIMIZE', 'QUERYNO', 'SKIP', 'UNION', 'USING', 'VALUES']);
-
-// Which host variables a statement reads and which it writes, as Db2's SQL reference gives them. A
-// variable both read and written is in both lists. INTO a host variable writes it (INSERT INTO and
-// MERGE INTO name a table); so do SET's targets, GET DIAGNOSTICS' and ASSOCIATE LOCATORS' list. A
-// procedure's argument that is a lone variable may be IN, OUT or INOUT, which only the server knows.
-function roles(toks) {
-  const sending = [];
-  const receiving = [];
-  const read = (h) => { if (!sending.includes(h)) sending.push(h); };
-  const write = (h) => { if (!receiving.includes(h)) receiving.push(h); };
-  const verb = toks.find((t) => t.word)?.word;
-  if (verb === 'CALL') return callRoles(toks, read, write), { sending, receiving };
-  // DESCRIBE and PREPARE read the SQLDA's SQLN and write the rest of it.
-  const intoBoth = verb === 'DESCRIBE' || verb === 'PREPARE';
-  let into = false;
-  let assigning = verb === 'SET';
-  let depth = 0;
-  for (let i = 0; i < toks.length; i++) {
-    const t = toks[i];
-    const next = toks[i + 1];
-    if (t.word === '(') depth++;
-    else if (t.word === ')') depth--;
-    else if (verb === 'SET' && t.word === '=' && depth === 0) assigning = false;
-    else if (verb === 'SET' && t.word === ',' && depth === 0) assigning = true;
-    if (t.word === 'INTO' && next && (next.host || next.word === 'DESCRIPTOR')) { into = true; continue; }
-    if (into && t.word && AFTER_INTO.has(t.word)) into = false;
-    if (t.word === 'DESCRIPTOR' && next?.host) {
-      // FETCH ... INTO DESCRIPTOR and USING DESCRIPTOR are synonyms: the program fills the SQLDA and Db2 writes where it points.
-      if (verb === 'FETCH' || intoBoth) { read(next.host); write(next.host); } else read(next.host);
-      i++;
-      continue;
-    }
-    if (!t.host) continue;
-    const written = into || assigning
-      || (verb === 'GET' && next?.word === '=')
-      || (verb === 'ASSOCIATE' && !toks.slice(0, i).some((x) => x.word === 'WITH'));
-    if (!written || (into && intoBoth)) read(t.host);
-    if (written) write(t.host);
-  }
-  return { sending, receiving };
-}
-
-// CALL :name reads the name. Each argument that is a lone variable, with or without its indicator,
-// is read and may be written; any other argument is an expression, IN only.
-function callRoles(toks, read, write) {
-  let depth = 0;
-  let arg = [];
-  const close = () => {
-    const hosts = arg.filter((t) => t.host);
-    const lone = hosts.length && arg.every((t) => t.host || t.word === 'INDICATOR');
-    for (const h of hosts) { read(h.host); if (lone) write(h.host); }
-    arg = [];
-  };
-  for (let i = 1; i < toks.length; i++) {
-    const t = toks[i];
-    if (t.word === 'DESCRIPTOR' && toks[i + 1]?.host) { read(toks[i + 1].host); write(toks[i + 1].host); i++; continue; }
-    if (t.word === '(') { if (depth++ > 0) arg.push(t); continue; }
-    if (t.word === ')') { if (--depth > 0) arg.push(t); else close(); continue; }
-    if (depth === 0) { if (t.host) read(t.host); continue; }
-    if (depth === 1 && t.word === ',') { close(); continue; }
-    arg.push(t);
-  }
-}
-
-export function hostVariableRoles(sql) {
-  return roles(tokenize(sql));
-}
-
 // The WHENEVER tests after each executable statement, from Db2's definitions of the conditions. IBM
 // does not document which wins when two hold at once, so the order is fixed, not the source's.
 const WHENEVER_TEST = {
@@ -201,12 +118,12 @@ const declarative = (words) => words[0] === 'DECLARE' && words[1] !== 'GLOBAL';
 
 // What one block becomes, as COBOL text on one logical line, or '' to blank it.
 function translate(block, state) {
-  const toks = tokenize(block.text);
+  const toks = sqlTokens(block.text);
   const words = toks.filter((t) => t.word).map((t) => t.word);
   const verb = words[0] || '';
   if (verb === 'INCLUDE') return words[1] ? `COPY ${words[1]}` : '';
   if (!state.procedure) {
-    if (declarative(words) && words.includes('CURSOR')) state.cursors.set(words[1], roles(toks).sending);
+    if (declarative(words) && words.includes('CURSOR')) state.cursors.set(words[1], sqlRoles(toks).sending);
     return '';
   }
   if (verb === 'WHENEVER') {
@@ -220,11 +137,11 @@ function translate(block, state) {
     return 'CONTINUE';
   }
   if (declarative(words)) {
-    if (words.includes('CURSOR')) state.cursors.set(words[1], roles(toks).sending);
+    if (words.includes('CURSOR')) state.cursors.set(words[1], sqlRoles(toks).sending);
     return 'CONTINUE';
   }
   if (NOT_EXECUTABLE.has(verb)) return 'CONTINUE';
-  let { sending, receiving } = roles(toks);
+  let { sending, receiving } = sqlRoles(toks);
   let name = verb;
   if (verb === 'OPEN' && state.cursors.has(words[1])) sending = [...new Set([...state.cursors.get(words[1]), ...sending])];
   if (verb === 'EXECUTE' && words[1] === 'IMMEDIATE') name = 'EXECUTE-IMMEDIATE';

package/lib/revision.json

@@ -1 +1 @@
-{"commit":"b144074728e1b40f1c6a230b06f1a6b8b0758d51"}
+{"commit":"54c9654b8c13bc22c8d5683b02551362d95f0d0a","tag":"v0.2.140"}

package/lib/sbom.mjs

@@ -10,6 +10,7 @@ import { parseJcl } from './jcl.mjs';
 import { optionCards } from './options.mjs';
 import { inScope, isBms, isCopybook, isJcl, isProgram, readSource, relPath } from './sources.mjs';
 import { TOOL_VERSION } from './version.mjs';
+import { revisionOf } from './revision.mjs';
 import { treeFor } from './kernel/source-tree.mjs';
 
 // The namespace of cobolwork's version 5 UUIDs (RFC 4122 §4.3), fixed so a serial number repeats.
@@ -26,6 +27,50 @@ function uuidv5(name) {
 const sha256 = (b) => createHash('sha256').update(b).digest('hex');
 const order = (a, b) => (a < b ? -1 : a > b ? 1 : 0);
 
+// A routine a platform provides, which its platform component already stands for.
+const platformRoutine = (n) => n === 'CBLTDLI' || n === 'AIBTDLI' || /^MQ[A-Z0-9]{2,}$/.test(n) || /^CEE[A-Z0-9]+$/.test(n);
+
+// IBM programs a job step runs rather than one the estate builds.
+const SYSTEM_PROGRAMS = new Set(['ADRDSSU', 'AMASPZAP', 'ASMA90', 'BPXBATCH', 'DFHCSDUP', 'DFHEAP1$', 'DFHECP1$', 'DFSRRC00', 'DFSORT', 'DSNTEP2', 'DSNTEP4',
+  'DSNHPC', 'DSNTIAD', 'DSNTIAUL', 'DSNUTILB', 'FTP', 'HEWL', 'IEWBLINK', 'IEWL', 'ICEGENER', 'ICEMAN', 'ICETOOL', 'IDCAMS', 'IEBCOMPR',
+  'IEBCOPY', 'IEBDG', 'IEBGENER', 'IEBUPDTE', 'IEFBR14', 'IEHLIST', 'IEHPROGM', 'IGYCRCTL', 'IKJEFT01', 'IKJEFT1A', 'IKJEFT1B',
+  'SDSF', 'SORT']);
+const TSO_BATCH = new Set(['IKJEFT01', 'IKJEFT1A', 'IKJEFT1B']);
+// The IMS region types whose PARM names the application program second: PARM='BMP,PGM,PSB'.
+const IMS_REGIONS = new Set(['BMP', 'DLI', 'DBB', 'IFP', 'JBP', 'JMP']);
+
+// What a step runs beyond its PGM: the program a TSO batch step's DSN RUN names, or an IMS region's
+// application program.
+function programsRunBy(step) {
+  const pgm = String(step.pgm || '').toUpperCase();
+  const out = [];
+  if (TSO_BATCH.has(pgm)) {
+    for (const dd of step.dds || []) {
+      if (dd.name !== 'SYSTSIN') continue;
+      const text = (dd.inStream || []).map((l) => l.text).join(' ');
+      for (const m of text.matchAll(/\bRUN\s+PROG(?:RAM)?\s*\(\s*([A-Z0-9#@$]{1,8})\s*\)/gi)) out.push(m[1].toUpperCase());
+    }
+  } else if (pgm === 'DFSRRC00' && step.parm) {
+    const [region, app] = String(step.parm).replace(/^['(]|[')]$/g, '').split(',').map((x) => x.trim().toUpperCase());
+    if (IMS_REGIONS.has(region) && /^[A-Z0-9#@$]{1,8}$/.test(app || '')) out.push(app);
+  }
+  return out;
+}
+
+// The literal operand of a CICS option, `PROGRAM('X')`; the field's name where a field is given.
+function cicsOperand(toks, option) {
+  const at = toks.findIndex((t, i) => t.t === 'word' && t.u === option && toks[i + 1] && toks[i + 1].v === '(');
+  if (at < 0) return null;
+  const inner = [];
+  for (let i = at + 2, depth = 1; i < toks.length; i++) {
+    if (toks[i].v === '(') depth++;
+    else if (toks[i].v === ')' && --depth === 0) break;
+    inner.push(toks[i]);
+  }
+  if (inner.length === 1 && inner[0].t === 'lit') return { literal: String(inner[0].v).trim().toUpperCase() };
+  return inner.length ? { field: inner.map((t) => t.v).join('') } : null;
+}
+
 function platformsOf(src, calls) {
   const s = new Set();
   if (/EXEC\s+CICS\b/i.test(src)) s.add('CICS');
@@ -35,7 +80,7 @@ function platformsOf(src, calls) {
     if (c.kind !== 'L') continue;
     const n = String(c.name).toUpperCase();
     if (n === 'CBLTDLI' || n === 'AIBTDLI') s.add('IMS');
-    if (/^MQ[A-Z]{2,}$/.test(n)) s.add('MQ');
+    if (/^MQ[A-Z0-9]{2,}$/.test(n)) s.add('MQ');
     if (/^CEE[A-Z0-9]+$/.test(n)) s.add('Language Environment');
   }
   return [...s];
@@ -61,6 +106,8 @@ export function sbom(root, opts = {}) {
 
   const entries = [];
   const programIds = new Map();
+  const mapsets = new Map();
+  const procIds = new Map();
   for (const f of tree.list().filter(inScope(opts)).sort()) {
     let bytes;
     let src;
@@ -77,6 +124,13 @@ export function sbom(root, opts = {}) {
       } catch { entry.unparsed = true; }
     } else if (kind === 'jcl' || kind === 'proc') {
       try { entry.jcl = parseJcl(src, f); } catch { entry.unparsed = true; }
+      if (kind === 'proc') {
+        const m = /^\/\/([A-Z0-9#@$]{1,8})\s+PROC\b/im.exec(src);
+        procIds.set((m ? m[1] : basename(f, extname(f))).toUpperCase(), entry.ref);
+      }
+    } else if (kind === 'bms') {
+      const m = /^([A-Z0-9#@$]{1,8})\s+DFHMSD\b/im.exec(src);
+      mapsets.set((m ? m[1] : basename(f, extname(f))).toUpperCase(), entry.ref);
     }
     entries.push(entry);
   }
@@ -84,6 +138,17 @@ export function sbom(root, opts = {}) {
   const components = new Map();
   const dependencies = new Map();
   const depend = (from, to) => { if (!dependencies.has(from)) dependencies.set(from, new Set()); dependencies.get(from).add(to); };
+  // A program the estate does not hold is a component of its own, so an edge to it is not lost.
+  const runs = (from, name) => {
+    const target = programIds.get(name);
+    if (target) { if (target !== from) depend(from, target); return; }
+    if (platformRoutine(name)) return;
+    const ref = `program:${name}`;
+    depend(from, ref);
+    if (!components.has(ref)) {
+      components.set(ref, { 'bom-ref': ref, type: 'application', name, properties: [{ name: 'cobolwork:kind', value: SYSTEM_PROGRAMS.has(name) ? 'system-program' : 'external-program' }] });
+    }
+  };
 
   for (const e of entries) {
     const properties = [{ name: 'cobolwork:kind', value: e.kind }];
@@ -108,8 +173,19 @@ export function sbom(root, opts = {}) {
       const unresolved = new Set();
       for (const c of calls) {
         if (c.kind !== 'L') { unresolved.add(String(c.name)); continue; }
-        const target = programIds.get(String(c.name).toUpperCase());
-        if (target && target !== e.ref) depend(e.ref, target);
+        runs(e.ref, String(c.name).toUpperCase());
+      }
+      for (const x of e.programs.flatMap((p) => p.execs || [])) {
+        if (x.kind !== 'CICS') continue;
+        const words = x.toks.filter((t) => t.t === 'word').map((t) => t.u);
+        if (words[0] === 'LINK' || words[0] === 'XCTL') {
+          const op = cicsOperand(x.toks, 'PROGRAM');
+          if (op && op.literal) runs(e.ref, op.literal); else if (op) unresolved.add(op.field);
+        } else if ((words[0] === 'SEND' || words[0] === 'RECEIVE') && words[1] === 'MAP') {
+          const op = cicsOperand(x.toks, 'MAPSET') || cicsOperand(x.toks, 'MAP');
+          const target = op && op.literal ? mapsets.get(op.literal) : null;
+          if (target) depend(e.ref, target);
+        }
       }
       if (unresolved.size) properties.push({ name: 'cobolwork:unresolved-call', value: [...unresolved].sort(order).join(',') });
       for (const p of platformsOf(e.src, calls)) {
@@ -119,10 +195,17 @@ export function sbom(root, opts = {}) {
       }
     }
     if (e.jcl) {
+      const inStream = new Set((e.jcl.procs || []).map((p) => String(p.name || '').toUpperCase()));
+      const missing = new Set();
       for (const step of e.jcl.steps || []) {
-        const target = step.pgm ? programIds.get(String(step.pgm).toUpperCase()) : null;
-        if (target) depend(e.ref, target);
+        if (step.pgm && /^[A-Z0-9#@$]{1,8}$/i.test(step.pgm)) runs(e.ref, String(step.pgm).toUpperCase());
+        for (const name of programsRunBy(step)) runs(e.ref, name);
+        if (!step.proc) continue;
+        const name = String(step.proc).toUpperCase();
+        const proc = procIds.get(name);
+        if (proc) { if (proc !== e.ref) depend(e.ref, proc); } else if (!inStream.has(name)) missing.add(name);
       }
+      if (missing.size) properties.push({ name: 'cobolwork:unresolved-proc', value: [...missing].sort(order).join(',') });
     }
     components.set(e.ref, { 'bom-ref': e.ref, type: 'file', name: e.ref, hashes: [{ alg: 'SHA-256', content: sha256(e.bytes) }], properties });
   }
@@ -130,6 +213,8 @@ export function sbom(root, opts = {}) {
   const list = [...components.values()].sort((a, b) => order(a['bom-ref'], b['bom-ref']));
   const digests = list.filter((c) => c.hashes).map((c) => c.hashes[0].content).sort(order);
   const name = opts.name || basename(top);
+  let revision = null;
+  try { revision = revisionOf(top); } catch { /* not a repository, or git is missing */ }
   const epoch = process.env.SOURCE_DATE_EPOCH;
   return {
     bomFormat: 'CycloneDX',
@@ -139,7 +224,10 @@ export function sbom(root, opts = {}) {
     metadata: {
       ...(epoch && /^\d+$/.test(epoch) ? { timestamp: new Date(Number(epoch) * 1000).toISOString() } : {}),
       tools: { components: [{ type: 'application', name: 'cobolwork', version: TOOL_VERSION }] },
-      component: { 'bom-ref': `estate:${name}`, type: 'application', name },
+      component: {
+        'bom-ref': `estate:${name}`, type: 'application', name,
+        ...(revision ? { version: revision.commit, properties: [{ name: 'cobolwork:dirty', value: String(revision.dirty) }] } : {}),
+      },
     },
     components: list,
     dependencies: [...dependencies.entries()].sort(([a], [b]) => order(a, b)).map(([ref, set]) => ({ ref, dependsOn: [...set].sort(order) })),

package/lib/sets/cics.mjs

@@ -221,12 +221,15 @@ export function scanCics(root, opts = {}) {
         declared,
       });
     }
-    // A program that points DFHCOMMAREA at storage of its own is not reading a caller's area.
+    // A program that points DFHCOMMAREA at storage of its own is not reading a caller's area. Only
+    // the receiving side of SET, before TO, repoints it: SET P TO ADDRESS OF DFHCOMMAREA reads the
+    // caller's area's address.
     const tokens = (p.proc && p.proc.tokens) || [];
     const pointsItself = (p.statements || []).some((st) => {
       if (st.verb !== 'SET') return false;
       const w = tokens.slice(st.at + 1, st.end).filter((t) => t.t === 'word').map((t) => t.u);
-      return w.some((x, k) => x === 'ADDRESS' && w[k + 1] === 'OF' && w[k + 2] === 'DFHCOMMAREA');
+      const receiving = w.includes('TO') ? w.slice(0, w.indexOf('TO')) : w;
+      return receiving.some((x, k) => x === 'ADDRESS' && receiving[k + 1] === 'OF' && receiving[k + 2] === 'DFHCOMMAREA');
     });
     return {
       id: p.id, path,

package/lib/sets/copybook.mjs

@@ -7,6 +7,7 @@ import { finish } from '../kernel/findings.mjs';
 import { report } from '../kernel/ruleset.mjs';
 import { treeFor, noteUnread, noteUnparsed } from '../kernel/source-tree.mjs';
 import { eachWithinMemory } from '../kernel/memory.mjs';
+import { cobolCard } from '../card.mjs';
 
 // A copybook is resolved by name along a search path: the program's own directory first, then the
 // include directories, then the system library. Two files answering to one name mean the record
@@ -37,7 +38,7 @@ const SYSTEM_NAME = /^(DFHAID|DFHBMSCA|DFHEIBLK|DFHCOMMAREA|DFHRESP|SQLCA|SQLDA|
 function layout(src) {
   const fixed = detectFormat(src) === 'fixed';
   return src.split(/\r?\n/)
-    .map(l => (fixed ? l.slice(6, 72) : l).trimEnd())
+    .map(l => { const c = cobolCard(l, fixed ? 'fixed' : 'free'); return (c.indicator + c.text).trimEnd(); })
     .filter(l => l.trim() && !/^[*/]/.test(l.trimStart()))
     .join('\n')
     .toUpperCase();

package/lib/sets/hidden.mjs

@@ -1,5 +1,6 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 import { detectFormat, expandTabs } from '../parser.mjs';
+import { cobolCard } from '../card.mjs';
 import { decodeEbcdic, inScope, isJcl, isSource, looksEbcdic, relPath } from '../sources.mjs';
 import { report } from '../kernel/ruleset.mjs';
 import { treeFor, noteUnread } from '../kernel/source-tree.mjs';
@@ -69,14 +70,9 @@ const BANNER = /^[\s*\-=_+#/\\.]*$/;
 
 function areas(line, format) {
   const l = expandTabs(line);
-  if (format === 'free' || format === 'terminal') return { sequence: '', indicator: '', text: l, identification: '', ignored: '' };
-  return {
-    sequence: l.slice(0, 6),
-    indicator: l[6] || ' ',
-    text: l.slice(7, format === 'variable' ? 250 : 72),
-    identification: format === 'variable' ? '' : l.slice(72, 80),
-    ignored: format === 'variable' ? '' : l.slice(72),
-  };
+  const card = cobolCard(l, format);
+  const fixed = format === 'fixed';
+  return { ...card, identification: fixed ? card.ignored.slice(0, 8) : '', ignored: fixed ? card.ignored : '' };
 }
 
 // A floating comment, from the *> that starts it outside a literal to the end of the line.

package/lib/sets/jcl.mjs

@@ -7,7 +7,8 @@ import { inScope, isJcl, isProgram, relPath } from '../sources.mjs';
 import { report } from '../kernel/ruleset.mjs';
 import { treeFor, noteUnread, noteUnparsed } from '../kernel/source-tree.mjs';
 import { parseJcl, dispositionOf } from '../jcl.mjs';
-import { ddGroups } from '../utilities.mjs';
+import { ddGroups, tsoCommands } from '../utilities.mjs';
+import { ftpSession } from '../ftp.mjs';
 import { loadSite, productionQualifierOf, SITE_FILE } from '../site.mjs';
 import { loadPacks, programsOf } from '../packs.mjs';
 import { eachWithinMemory } from '../kernel/memory.mjs';
@@ -84,11 +85,16 @@ const SORTS = new Set(['SORT', 'ICEMAN', 'SYNCSORT']);
 const CONTROL_DDS = [
   [TSO, ['SYSTSIN']], [new Set(['BPXBATCH']), ['STDPARM']], [new Set(['IDCAMS']), ['SYSIN']],
   [SORTS, ['SYSIN', 'DFSPARM']], [new Set(['ICETOOL']), ['TOOLIN', 'DFSPARM']],
-  [new Set(['DSNTEP2', 'DSNTEP4', 'DSNTIAD']), ['SYSIN']],
 ];
 const TSO_RUNS = /^\s*(CALL|EXEC|EX|SUBMIT|ISPSTART|RUN)\b/i;
-// RUN PROGRAM(DSNTEP2) under the DSN command processor makes that step's SYSIN a program's SQL.
-const RUNS_SQL_PROGRAM = /\bRUN\s+PROGRAM\s*\(\s*(DSNTEP2|DSNTEP4|DSNTIAD)\s*\)/i;
+// Db2's sample programs read SQL statements from SYSIN, run as the step's program or under TSO by
+// DSN RUN PROGRAM. Those statements are the program's input, not commands to TSO or a security product.
+const SQL_PROGRAMS = new Set(['DSNTEP2', 'DSNTEP4', 'DSNTIAD']);
+const sqlInput = (step, groups) => {
+  const pgm = step.pgm ? step.pgm.toUpperCase() : null;
+  const runsSql = SQL_PROGRAMS.has(pgm) || tsoCommands(step).runs.some((x) => SQL_PROGRAMS.has(x.program));
+  return runsSql ? groups.get('SYSIN') || [] : [];
+};
 
 // Utilities whose commands come from a DD: a cataloged data set there is commands nobody reviewed
 // with the job; a MODS exit is a load module the sort runs; TSO commands say what else runs.
@@ -99,7 +105,7 @@ function controlCardFindings(r, path, findings) {
     const groups = ddGroups(step);
     const cards = (name) => (groups.get(name) || []).flatMap((dd) => dd.inStream || []);
     const ddNames = new Set(CONTROL_DDS.filter(([pgms]) => pgms.has(pgm)).flatMap(([, dds]) => dds));
-    if (TSO.has(pgm) && cards('SYSTSIN').some((l) => RUNS_SQL_PROGRAM.test(l.text))) ddNames.add('SYSIN');
+    if (sqlInput(step, groups).length) ddNames.add('SYSIN');
     for (const name of ddNames) {
       for (const dd of groups.get(name) || []) {
         if (dd.dsn && !dd.inStream && !dd.temporary) {
@@ -127,116 +133,6 @@ function controlCardFindings(r, path, findings) {
   }
 }
 
-// IBM's batch FTP client takes the host and its options on PARM, or the host as the first line of
-// its input, reads subcommands from INPUT, and logs on from NETRC or from its input. CardDemo's job
-// gives the same lines on SYSIN, which is read here when there is no INPUT, though the page below
-// does not say the client falls back to it.
-//   https://www.ibm.com/docs/api/v1/content/SSLTBW_2.4.0/com.ibm.zos.v2r4.halu001/ftpreq.htm
-// A session is in cleartext unless something asks for TLS: -a TLS or -r TLS on PARM, or
-// SECURE_MECHANISM TLS in an in-stream SYSFTPD. A SYSFTPD naming a data set is configuration this
-// reader cannot see, so that step is not called cleartext either way.
-//   https://www.ibm.com/docs/en/zos/2.1.0?topic=commands-ftp-command
-//   https://www.ibm.com/docs/api/v1/content/SSLTBW_2.4.0/com.ibm.zos.v2r4.halz002/ftp_cust_client_for_tls.htm
-// PUT, MPUT and APPEND send local files, and IBM's capitals - PUt, MPut, APpend, LCd - are the
-// shortest spellings. A local name in quotes is a whole data set name, //DD: names a DD of the
-// step, and anything else hangs off the local working directory, which only a quoted LCD fixes.
-//   https://www.ibm.com/docs/api/v1/content/SSLTBW_2.2.0/com.ibm.zos.v2r2.halu001/ftpsubcmd.htm
-//   https://www.ibm.com/docs/api/v1/content/SSLTBW_2.2.0/com.ibm.zos.v2r2.halu001/put.htm
-//   https://www.ibm.com/docs/api/v1/content/SSLTBW_2.2.0/com.ibm.zos.v2r2.halu001/mput.htm
-//   https://www.ibm.com/docs/api/v1/content/SSLTBW_2.2.0/com.ibm.zos.v2r2.halu001/append.htm
-//   https://www.ibm.com/docs/api/v1/content/SSLTBW_2.2.0/com.ibm.zos.v2r2.halu001/lcd.htm
-//   https://www.ibm.com/docs/api/v1/content/SSLTBW_2.2.0/com.ibm.zos.v2r2.halu001/dd_name_support.htm
-const FTP_SENDS = [[/^PUT?$/i, 'PUT'], [/^MP(?:UT?)?$/i, 'MPUT'], [/^AP(?:P(?:E(?:ND?)?)?)?$/i, 'APPEND']];
-
-// Every subcommand on the page above, in IBM's spelling.
-const FTP_SUBCOMMANDS = ['?', '!', 'ACCount', 'APpend', 'AUth', 'AScii', 'BIG5', 'BINary', 'BLock', 'CCc', 'CD',
-  'CDUp', 'CLEar', 'CLose', 'COMpress', 'CProtect', 'CWd', 'DEBug', 'DELEte', 'DELImit', 'DIr', 'DUMP', 'EBcdic',
-  'EUckanji', 'FEature', 'FIle', 'Get', 'GLob', 'HAngeul', 'HElp', 'Ibmkanji', 'JIS78kj', 'JIS83kj', 'Ksc5601',
-  'LANGuage', 'LCd', 'LOCSIte', 'LOCSTat', 'LMkdir', 'LPwd', 'LS', 'MDelete', 'MGet', 'MKdir', 'MKFifo', 'MOde',
-  'MPut', 'MVSGet', 'MVSPut', 'NOop', 'Open', 'PAss', 'PRIvate', 'PROMpt', 'PROTect', 'PROXy', 'PUt', 'PWd', 'QUIt',
-  'QUOte', 'RECord', 'REName', 'REStart', 'RMdir', 'SAfe', 'SChinese', 'SENDPort', 'SENDSite', 'SIte', 'SJiskanji',
-  'SRestart', 'STAtus', 'STREam', 'STRucture', 'SUnique', 'SYstem', 'TChinese', 'TSO', 'TYpe', 'UCs2', 'User', 'Verbose']
-  .map((name) => ({ full: name.toUpperCase(), min: name.match(/^[^a-z]*/)[0].length }));
-const subcommandOf = (word) => {
-  const w = word.toUpperCase();
-  const hit = FTP_SUBCOMMANDS.find((c) => w.length >= c.min && c.full.startsWith(w));
-  return hit ? hit.full : null;
-};
-// A value that stands for a password rather than being one: a symbolic, a mask, or the word itself.
-const PLACEHOLDER = /^(&.*|\*+|X+|\?+|<.*>|\{.*\}|PASSWORD|PASSWD|PWD|PASS|SECRET)$/i;
-
-function ftpSession(step) {
-  const dds = ddGroups(step);
-  let host = null, tls = null;
-  const words = (step.parm || '').split('(')[0].trim().split(/\s+/).filter(Boolean);
-  for (let i = 0; i < words.length; i++) {
-    if (/^-[ar]$/i.test(words[i])) {
-      const mechanism = (words[++i] || '').toUpperCase();
-      if (mechanism === 'TLS') tls = 'asked';
-      else if (mechanism === 'NEVER' && !tls) tls = 'never';
-    } else if (!words[i].startsWith('-') && !host) host = words[i];
-  }
-  let configUnread = null;
-  for (const dd of dds.get('SYSFTPD') || []) {
-    if (dd.inStream) { if (tls !== 'never' && dd.inStream.some((l) => /^\s*SECURE_MECHANISM\s+TLS\b/i.test(l.text))) tls = 'asked'; }
-    else if (dd.dsn && !configUnread) configUnread = dd.dsn;
-  }
-
-  const input = dds.get('INPUT') || dds.get('SYSIN') || [];
-  const hostLine = !host && input[0]?.inStream;
-  let inputUnread = null, lcd = null, unixDir = false;
-  const sends = [];
-  // With no NETRC to answer for it, the client asks for a user ID and a password and in batch reads
-  // them from its input after the host: "user password" on one line, or each on its own. A first
-  // line that is a subcommand means something else answered, a NETRC the client found for itself.
-  // USER and PASS give the same answers later in a session.
-  let expect = dds.has('NETRC') ? null : 'logon', user = null;
-  const passwords = [];
-  const password = (dd, line, value) => { if (!PLACEHOLDER.test(value)) passwords.push({ dd, line, user }); };
-  const local = (name) => {
-    const dd = /^\/\/DD:([A-Z$#@][A-Z0-9$#@]{0,7})$/i.exec(name);
-    if (dd) return { dd: dd[1].toUpperCase(), dsns: (dds.get(dd[1].toUpperCase()) || []).map((d) => d.dsn).filter(Boolean) };
-    const quoted = /^'(.+)'$/.exec(name);
-    if (quoted) return { dsns: [quoted[1].toUpperCase()] };
-    if (name.startsWith('/') || unixDir) return { dsns: [] };
-    return lcd ? { dsns: [`${lcd}.${name.toUpperCase()}`] } : { dsns: [], relative: name };
-  };
-  for (const dd of input) {
-    if (!dd.inStream) { if (dd.dsn && !inputUnread) inputUnread = dd.dsn; continue; }
-    for (const { line, text } of dd.inStream) {
-      const [verb, ...args] = text.slice(0, 72).trim().split(/\s+/);
-      if (!verb) continue;
-      if (hostLine && !host) { host = verb; continue; }
-      const sub = subcommandOf(verb);
-      if (expect && !sub) {
-        if (expect === 'logon') user = verb;
-        if (expect === 'password') password(dd, line, verb);
-        else if (args[0]) password(dd, line, args[0]);
-        expect = expect === 'logon' && !args[0] ? 'password' : null;
-        continue;
-      }
-      expect = null;
-      if (sub === 'USER' && args[0]) {
-        user = args[0];
-        if (args[1]) password(dd, line, args[1]); else expect = 'password';
-        continue;
-      }
-      if (sub === 'PASS' && args[0]) { password(dd, line, args[0]); continue; }
-      if (/^LCD?$/i.test(verb) && args[0]) {
-        const quoted = /^'(.+)'$/.exec(args[0]);
-        unixDir = args[0].startsWith('/');
-        lcd = quoted ? quoted[1].toUpperCase() : lcd && !unixDir ? `${lcd}.${args[0].toUpperCase()}` : null;
-        continue;
-      }
-      const sent = FTP_SENDS.find(([re]) => re.test(verb));
-      if (!sent) continue;
-      for (const name of sent[1] === 'MPUT' ? args : args.slice(0, 1)) sends.push({ line, verb: sent[1], name, ...local(name) });
-    }
-  }
-  const cleartext = tls === 'never' || (!tls && !configUnread);
-  return { host, cleartext, configUnread, inputUnread, logon: dds.has('NETRC') ? 'NETRC' : null, sends, passwords, input };
-}
-
 // Credentials, which are the reason this rule set is critical rather than merely interesting.
 // Each run of blanks follows the ( or = that separates it from the next, which keeps matching linear.
 const CREDENTIAL = /\b(?:PASSWORD|PASSWRD|PHRASE|PASSPHRASE)\s*(?:\(\s*)?(?:=\s*)?['"]?([A-Z0-9@#$_.-]{3,})/i;
@@ -247,7 +143,7 @@ const CREDENTIAL = /\b(?:PASSWORD|PASSWRD|PHRASE|PASSPHRASE)\s*(?:\(\s*)?(?:=\s*
 const SECURITY_COMMAND = /^\s*(?:TSS\s+)?(ADDUSER|ALTUSER|DELUSER|ADDGROUP|ALTGROUP|CONNECT|REMOVE|PERMIT|SETROPTS|RDEFINE|RALTER|RDELETE|ADDSD|ALTDSD|DELDSD|PASSWORD|ACFNRULE)\b/i;
 
 // ACF2 speaks differently: a mode change followed by INSERT or CHANGE against a logonid.
-const ACF2_COMMAND = /^\s*(?:SET\s+(?:LID|RULE|PROFILE)|INSERT\s+[A-Z0-9$#@]+|CHANGE\s+[A-Z0-9$#@]+\s)/i;
+const ACF2_COMMAND = /^\s*(?:SET\s+(?:LID|RULE|PROFILE)|INSERT\s+(?!INTO\b)[A-Z0-9$#@]+|CHANGE\s+[A-Z0-9$#@]+\s)/i;
 
 // Destruction in-stream. DELETE with a dataset name, or a REPRO that replaces its target. SQL's
 // DELETE FROM removes rows through a database utility, not a catalogued dataset.
@@ -370,9 +266,10 @@ export function scanJcl(root, opts = {}) {
       if (d && !stats.firstReadInPart) stats.firstReadInPart = `${path}${d.line ? `:${d.line}` : ''}: ${d.text}`;
     }
 
-    const ftpSteps = new Map(r.steps.filter((s) => s.pgm && s.pgm.toUpperCase() === 'FTP' && !defined.has('FTP')).map((s) => [s, ftpSession(s)]));
+    const ftpSteps = new Map(r.steps.filter((s) => s.pgm && s.pgm.toUpperCase() === 'FTP' && !defined.has('FTP')).map((s) => [s, ftpSession(s, ddGroups(s))]));
     const ftpInput = new Map();
     for (const ftp of ftpSteps.values()) for (const dd of ftp.input) ftpInput.set(dd, ftp);
+    const sqlDds = new Set(r.steps.flatMap((s) => sqlInput(s, ddGroups(s))));
 
     for (const dd of r.dds) {
       if (!dd.inStream) continue;
@@ -398,13 +295,13 @@ export function scanJcl(root, opts = {}) {
             detail: `in-stream FTP input gives the password ${logon.user ? `for ${logon.user} ` : ''}that step ${dd.step || '(none)'} logs on ${ftp.host ? `to ${ftp.host} ` : ''}with, in a file anyone who can read the repository can read` });
           continue;
         }
-        const sec = text.match(SECURITY_COMMAND);
+        const sec = !sqlDds.has(dd) && text.match(SECURITY_COMMAND);
         if (sec) {
           findings.push({ rule: 'jcl-instream-security-command', path, line: l.line, step: dd.step,
             detail: `in-stream data issues ${sec[1].toUpperCase()}, which grants or alters authority, from step ${dd.step || '(none)'}` });
           continue;
         }
-        if (ACF2_COMMAND.test(text)) {
+        if (!sqlDds.has(dd) && ACF2_COMMAND.test(text)) {
           findings.push({ rule: 'jcl-instream-security-command', path, line: l.line, step: dd.step,
             detail: `in-stream data issues an ACF2 administration command from step ${dd.step || '(none)'}` });
           continue;

package/lib/sets/recon.mjs

@@ -17,6 +17,7 @@ import { treeFor, noteUnread, noteUnparsed } from '../kernel/source-tree.mjs';
 import { eachWithinMemory } from '../kernel/memory.mjs';
 import { loadSite, classifyPath, productionQualifierOf, SITE_FILE } from '../site.mjs';
 import { parseJcl, dispositionOf } from '../jcl.mjs';
+import { statementCard } from '../card.mjs';
 
 
 // The production-dataset rules claim more than the name rule: that the job acts on production, not
@@ -93,7 +94,7 @@ function routableAddresses(text, jcl) {
   if (jcl) {
     for (const line of text.split(/\r?\n/)) {
       if (/^\/\/\*/.test(line)) continue;
-      collect(line.slice(0, 72), out);
+      collect(statementCard(line).text, out);
     }
     return out;
   }