@portll/cobolwork 0.2.75 → 0.2.117

package/lib/utilities.mjs

@@ -129,6 +129,12 @@ const who = (step) => `step ${step.name || '(unnamed)'}`;
 // Control statements only edit records or split members, so the copy is the DDs' alone.
 //   https://www.ibm.com/docs/api/v1/content/zosbasics/com.ibm.zos.zdatamgmt/zsysprogc_utilities_IEBGENER.htm
 //   https://www.ibm.com/docs/en/zos/3.1.0?topic=performance-use-icegener-instead-iebgener
+// IEBPTPCH reads SYSUT1 and writes its print or punch output to SYSUT2, and IEBUPDTE reads its old
+// master from SYSUT1 and writes SYSUT2. IEBUPDTE's control data set may also carry input data for the
+// new master, which is not followed here.
+//   https://www.ibm.com/docs/api/v1/content/SSLTBW_2.2.0/com.ibm.zos.v2r2.idau100/u1367.htm
+//   https://www.ibm.com/docs/api/v1/content/SSLTBW_2.2.0/com.ibm.zos.v2r2.idau100/u1427.htm
+//   https://www.ibm.com/docs/api/v1/content/SSLTBW_2.2.0/com.ibm.zos.v2r2.idau100/u1425.htm
 function generCopy(step, dds) {
   if (!dds.has('SYSUT1') || !dds.has('SYSUT2')) return { moves: [], notes: [] };
   return { moves: [{ from: [{ dd: 'SYSUT1' }], to: [{ dd: 'SYSUT2' }], line: step.line }], notes: [] };
@@ -174,29 +180,43 @@ function sortCopies(step, dds) {
 //   https://www.ibm.com/docs/en/zos/3.1.0?topic=commands-repro
 //   https://www.ibm.com/docs/api/v1/content/SSLTBW_2.3.0/com.ibm.zos.v2r3.idai200/da6i2253.htm
 //   https://www.ibm.com/docs/api/v1/content/SSLTBW_2.2.0/com.ibm.zos.v2r2.idai200/continu.htm
+// EXPORT writes the cluster its first parameter names, or the one INFILE(ddname) identifies, to the
+// portable data set OUTFILE(ddname) or OUTDATASET(entryname) gives, and may be abbreviated EXP.
+// IMPORT reads the portable data set INFILE(ddname) or INDATASET(entryname) names and writes the
+// cluster OUTFILE(ddname) or OUTDATASET(entryname) names.
+//   https://www.ibm.com/docs/api/v1/content/SSLTBW_2.3.0/com.ibm.zos.v2r3.idai200/export.htm
+//   https://www.ibm.com/docs/api/v1/content/SSLTBW_2.3.0/com.ibm.zos.v2r3.idai200/da6i2210.htm
+//   https://www.ibm.com/docs/api/v1/content/SSLTBW_2.3.0/com.ibm.zos.v2r3.idai200/da6i211.htm
+//   https://www.ibm.com/docs/api/v1/content/SSLTBW_2.3.0/com.ibm.zos.v2r3.idai200/import.htm
+//   https://www.ibm.com/docs/api/v1/content/SSLTBW_2.3.0/com.ibm.zos.v2r3.idai200/da6i2221.htm
 function reproCopies(step, dds) {
   const { lines, unread } = cards(dds.get('SYSIN'));
-  const notes = unread ? [{ line: step.line, text: `${who(step)} runs IDCAMS with commands in ${unread}, which this reader cannot see, so any REPRO it runs is not known` }] : [];
+  const notes = unread ? [{ line: step.line, text: `${who(step)} runs IDCAMS with commands in ${unread}, which this reader cannot see, so any REPRO, EXPORT or IMPORT it runs is not known` }] : [];
   const moves = [];
   for (const cmd of commands(lines)) {
-    if (!/^REPRO\b/i.test(cmd.text)) continue;
-    const end = (ddNames, dsNames) => {
+    const verb = /^(REPRO|EXPORT|EXP|IMPORT)\b/i.exec(cmd.text);
+    if (!verb) continue;
+    const entry = /^EXP/i.test(verb[1]) && /^\S+\s+([^\s(),]+)/.exec(cmd.text);
+    const end = (ddNames, dsNames, fallback) => {
       const dd = param(cmd.text, ddNames);
       if (dd) return [{ dd: dd[0] }];
       const ds = param(cmd.text, dsNames);
-      return ds ? [{ dsn: ds[0] }] : [];
+      if (ds) return [{ dsn: ds[0] }];
+      return fallback ? [{ dsn: upper(fallback.replace(/^'|'$/g, '')) }] : [];
     };
-    moves.push({ from: end(['INFILE', 'IFILE'], ['INDATASET', 'IDS']), to: end(['OUTFILE', 'OFILE'], ['OUTDATASET', 'ODS']), line: cmd.line });
+    moves.push({ from: end(['INFILE', 'IFILE'], ['INDATASET', 'IDS'], entry && entry[1]), to: end(['OUTFILE', 'OFILE'], ['OUTDATASET', 'ODS']), line: cmd.line });
   }
   return { moves, notes };
 }
 
-// IEBCOPY COPY and COPYGRP name their output with OUTDD and their inputs with INDD, where an input
+// IEBCOPY COPY, COPYGRP and COPYMOD name their output with OUTDD and their inputs with INDD, where an input
 // written (ddname,R) replaces members of the same name. An INDD= on a record of its own begins
 // another step of the COPY before it. A statement continues after a comma or a mark in column 72.
 //   https://www.ibm.com/docs/api/v1/content/SSLTBW_3.1.0/com.ibm.zos.v3r1.idau100/copy.htm
 //   https://www.ibm.com/docs/api/v1/content/SSLTBW_3.1.0/com.ibm.zos.v3r1.idau100/copygrp.htm
 //   https://www.ibm.com/docs/en/zos/2.4.0?topic=ie-example-15-copy-groups-from-pdse-pdse-replace
+//   https://www.ibm.com/docs/api/v1/content/SSLTBW_3.1.0/com.ibm.zos.v3r1.idau100/copymd.htm
+//   https://www.ibm.com/docs/api/v1/content/SSLTBW_3.1.0/com.ibm.zos.v3r1.idau100/u1055.htm
 function iebcopyCopies(step, dds) {
   const { lines, unread } = cards(dds.get('SYSIN'));
   const notes = unread ? [{ line: step.line, text: `${who(step)} runs IEBCOPY with statements in ${unread}, which this reader cannot see, so what it copies is not known` }] : [];
@@ -206,7 +226,7 @@ function iebcopyCopies(step, dds) {
   for (const st of statements) {
     // A record holding only INDD= has no operation, so what reads as its operation is its operand.
     const alone = /^INDD=/.test(st.op);
-    if (st.op === 'COPY' || st.op === 'COPYGRP') out = null;
+    if (st.op === 'COPY' || st.op === 'COPYGRP' || st.op === 'COPYMOD') out = null;
     else if (!alone) {
       if (st.op !== 'SELECT' && st.op !== 'EXCLUDE') out = null;
       continue;
@@ -227,35 +247,87 @@ function iebcopyCopies(step, dds) {
 // each OUTDDNAME, up to 255 of them. RESTORE reads the dump data set INDDNAME names and writes the
 // OUTDDNAME volumes. With no input DD a logical dump chooses its datasets by filter, and with no
 // output DD a logical restore puts them where the catalogue says, neither of which the job shows.
+// COPY reads the volumes INDDNAME or LOGINDDNAME name and writes the DASD volumes OUTDDNAME names.
 //   https://www.ibm.com/docs/en/zos/3.1.0?topic=commands-command-syntax
 //   https://www.ibm.com/docs/api/v1/content/SSLTBW_2.4.0/com.ibm.zos.v2r4.adru000/r2319.htm
 //   https://www.ibm.com/docs/api/v1/content/SSLTBW_2.4.0/com.ibm.zos.v2r4.adru000/r2321.htm
 //   https://www.ibm.com/docs/api/v1/content/SSLTBW_2.4.0/com.ibm.zos.v2r4.adru000/r2327.htm
 //   https://www.ibm.com/docs/api/v1/content/SSLTBW_2.2.0/com.ibm.zos.v2r2.adru000/dgt3u2165.htm
 //   https://www.ibm.com/docs/api/v1/content/SSLTBW_2.2.0/com.ibm.zos.v2r2.adru000/dgt3u2174.htm
+//   https://www.ibm.com/docs/api/v1/content/SSLTBW_2.2.0/com.ibm.zos.v2r2.adru000/r2172.htm
+//   https://www.ibm.com/docs/api/v1/content/SSLTBW_2.2.0/com.ibm.zos.v2r2.adru000/r2204.htm
+//   https://www.ibm.com/docs/api/v1/content/SSLTBW_2.2.0/com.ibm.zos.v2r2.adru000/r2206.htm
+//   https://www.ibm.com/docs/api/v1/content/SSLTBW_2.2.0/com.ibm.zos.v2r2.adru000/r2216.htm
 function dssCopies(step, dds) {
   const { lines, unread } = cards(dds.get('SYSIN'));
-  const notes = unread ? [{ line: step.line, text: `${who(step)} runs ADRDSSU with commands in ${unread}, which this reader cannot see, so what it dumps or restores is not known` }] : [];
+  const notes = unread ? [{ line: step.line, text: `${who(step)} runs ADRDSSU with commands in ${unread}, which this reader cannot see, so what it dumps, restores or copies is not known` }] : [];
   const moves = [];
   for (const cmd of commands(lines)) {
-    const op = /^(DUMP|RESTORE)\b/i.exec(cmd.text);
+    const op = /^(DUMP|RESTORE|COPY)\b/i.exec(cmd.text);
     if (!op) continue;
-    const dump = upper(op[1]) === 'DUMP';
-    const ins = param(cmd.text, ['INDDNAME', 'INDD', 'IDD']) || (dump && param(cmd.text, ['LOGINDDNAME', 'LOGINDD', 'LIDD'])) || [];
+    const verb = upper(op[1]);
+    const dump = verb === 'DUMP';
+    const ins = param(cmd.text, ['INDDNAME', 'INDD', 'IDD']) || (verb !== 'RESTORE' && param(cmd.text, ['LOGINDDNAME', 'LOGINDD', 'LIDD'])) || [];
     const outs = param(cmd.text, ['OUTDDNAME', 'OUTDD', 'ODD']) || [];
     if (dump && !ins.length) notes.push({ line: cmd.line, text: `${who(step)} dumps datasets chosen by filter from the catalogue, so which ones it copies is not known here` });
-    if (!dump && !outs.length) notes.push({ line: cmd.line, text: `${who(step)} restores datasets to where the catalogue puts them, so what it writes is not known here` });
+    if (verb === 'COPY' && !ins.length) notes.push({ line: cmd.line, text: `${who(step)} copies datasets whose input volume the command names no DD for, so where they come from is not known here` });
+    if (verb === 'COPY' && !outs.length) notes.push({ line: cmd.line, text: `${who(step)} copies datasets to an output volume the command names no DD for, so what it writes is not known here` });
+    if (verb === 'RESTORE' && !outs.length) notes.push({ line: cmd.line, text: `${who(step)} restores datasets to where the catalogue puts them, so what it writes is not known here` });
     moves.push({ from: ins.map((dd) => ({ dd })), to: outs.map((dd) => ({ dd })), line: cmd.line });
   }
   return { moves, notes };
 }
 
+// ICETOOL runs the operators in TOOLIN. COPY, SORT and MERGE read the DDs their FROM operands name
+// and write the DDs their TO operands name, several ddnames to an operand. A statement's operands
+// continue on the next line after a hyphen, and what follows the hyphen is ignored. USING(xxxx) reads
+// DFSORT control statements from the xxxxCNTL DD, whose OUTFIL statements can write further data sets.
+//   https://www.ibm.com/docs/en/zos/3.1.0?topic=icetool-copy-operator
+//   https://www.ibm.com/docs/en/zos/3.1.0?topic=icetool-sort-operator
+//   https://www.ibm.com/docs/en/zos/3.1.0?topic=icetool-merge-operator
+//   https://www.ibm.com/docs/en/zos/2.3.0?topic=icetool-job-control-language
+//   https://www.ibm.com/docs/api/v1/content/SSLTBW_3.1.0/com.ibm.zos.v3r1.icea100/ice2ca_General_coding_rules.htm
+function icetoolCopies(step, dds) {
+  const { lines, unread } = cards(dds.get('TOOLIN'));
+  const notes = unread ? [{ line: step.line, text: `${who(step)} runs ICETOOL with statements in ${unread}, which this reader cannot see, so what it copies is not known` }] : [];
+  const statements = [];
+  let cur = null;
+  for (const { line, text } of lines) {
+    const s = text.slice(0, 72);
+    if (!cur && (/^\*/.test(s) || !s.trim())) continue;
+    const tokens = s.trim().split(/\s+/);
+    const hyphen = tokens.findIndex((t) => t.endsWith('-'));
+    const used = hyphen < 0 ? tokens : tokens.slice(0, hyphen + 1);
+    if (!cur) cur = { line, op: upper(used.shift()), operands: [] };
+    cur.operands.push(...used.map((t) => t.replace(/-$/, '')).filter(Boolean));
+    if (hyphen < 0) { statements.push(cur); cur = null; }
+  }
+  if (cur) statements.push(cur);
+  const moves = [];
+  for (const st of statements) {
+    if (!['COPY', 'SORT', 'MERGE'].includes(st.op)) continue;
+    const named = (kw) => st.operands.flatMap((o) => {
+      const m = new RegExp(`^${kw}\\((.*)\\)$`, 'i').exec(o);
+      return m ? m[1].split(',').map((n) => upper(n.trim())).filter(Boolean) : [];
+    });
+    moves.push({ from: named('FROM').map((dd) => ({ dd })), to: named('TO').map((dd) => ({ dd })), line: st.line });
+    for (const using of named('USING')) {
+      const control = cards(dds.get(`${using}CNTL`));
+      if (control.unread || utilityStatements(control.lines, (ops) => /[,;:]$/.test(ops)).some((c) => c.op === 'OUTFIL')) {
+        notes.push({ line: st.line, text: `${who(step)} runs ICETOOL ${st.op} with control statements in ${using}CNTL that may write OUTFIL data sets, which are not followed here` });
+      }
+    }
+  }
+  return { moves, notes };
+}
+
 const TABLE = [
-  [['IEBGENER', 'ICEGENER'], generCopy],
+  [['IEBGENER', 'ICEGENER', 'IEBPTPCH', 'IEBUPDTE'], generCopy],
   [['SORT', 'ICEMAN', 'DFSORT', 'SYNCSORT'], sortCopies],
   [['IDCAMS'], reproCopies],
   [['IEBCOPY'], iebcopyCopies],
   [['ADRDSSU'], dssCopies],
+  [['ICETOOL'], icetoolCopies],
 ];
 const BY_PROGRAM = new Map(TABLE.flatMap(([names, fn]) => names.map((n) => [n, fn])));
 

package/lib/verify.mjs

@@ -0,0 +1,128 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// A verification plan for one path finding, for the estate to run in a test region it owns: the
+// entry to start, where the value goes in, a harmless value that shows the defect, and what to watch
+// for. Where letting the operation run would act - a command, a statement, a job, a connection - the
+// plan stops at the operation and reads a marker there, and never supplies a value that would run.
+// It is built only for `cobolwork explain`, never for a scan report. See docs/spec/reach.md §8.
+import { kindsOf } from './consequence.mjs';
+import { ALL_RULES } from './kernel/registry.mjs';
+import { entryName } from './reach.mjs';
+
+export const MARKER = 'CWVRFY01';
+
+const WHERE = 'a test region the estate owns, holding test data, under its own authorisation: never a production region, and never a system the estate does not own';
+
+const ABSENT = `${MARKER}, after checking that nothing by that name is defined where the program looks`;
+const END_TASK = 'end the task from CEDF or CEDX, or stop the program in the debugger, before the operation runs';
+
+// What goes in, and what reading it at the operation shows. `run` says what letting the operation run
+// shows; null means it would act on something, so the plan stops before it (`stopBefore`).
+const SINKS = {
+  arithmetic: (x) => ({ value: `a letter where ${x.item} expects a digit, such as A in its first position`, reads: `${x.item} holding the letter`, run: 'the task abends ASRA, a data exception (S0C7 in batch), at the operation' }),
+  subscript: (x) => bounds(x, `${x.table ? `${x.table + 1}, one more than the ${x.table} entries in the table` : 'one more than the entries in the table'}, or 0`),
+  'loop-bound': (x) => bounds(x, `${x.table ? `${x.table + 1}, one more than the ${x.table} entries in the table` : 'one more than the entries in the table'}`),
+  'reference-modification': (x) => bounds(x, 'one more than the length of the field, or 0'),
+  'occurs-depending-count': (x) => bounds(x, 'one more than the most entries the OCCURS clause allows, or 0'),
+  'storage-length': (x) => ({ value: 'a length above what the program means to acquire', reads: `the LENGTH or FLENGTH the command is given, from ${x.item}`, run: null, stopBefore: `acquiring that much storage can take the region short on storage: ${END_TASK}` }),
+  'record-key': (x) => ({ value: 'the key of a test record set up for a different test user', reads: `${x.item} holding that key`, run: 'the other user\'s test record comes back to the user who asked for it' }),
+  'record-update': (x) => ({ value: 'the key of a test record set up for a different test user', reads: `${x.item} holding that key`, run: 'the other user\'s test record is changed or deleted: set the record up for this test alone' }),
+  'dynamic-program-load': (x) => ({ value: ABSENT, reads: `${MARKER} as the program the CALL loads, from ${x.item}`, run: `the CALL fails to load ${MARKER} (an S806 abend in batch)` }),
+  'cics-dynamic-transfer': (x) => ({ value: ABSENT, reads: `${MARKER} as the program or transaction the command names, from ${x.item}`, run: `the command fails with PGMIDERR, or TRANSIDERR for a START` }),
+  'dynamic-file-path': (x) => ({ value: ABSENT, reads: `${MARKER} as the file the program assigns, from ${x.item}`, run: 'the OPEN fails with file status 35' }),
+  'cics-sysid': (x) => ({ value: ABSENT, reads: `${MARKER} as the SYSID the command is shipped to, from ${x.item}`, run: 'the command fails with SYSIDERR' }),
+  'queue-name': (x) => marker(x, 'as the queue the command acts on', 'the command would act on a queue the input chose'),
+  'web-response': (x) => ({ value: `${MARKER}<>`, reads: `${MARKER}<> in ${x.item}`, run: `the response body carries ${MARKER}<> as sent, not ${MARKER}&lt;&gt;` }),
+  screen: (x) => ({ value: MARKER, reads: `${MARKER} in ${x.item}`, run: `${MARKER} on the screen` }),
+  log: (x) => ({ value: MARKER, reads: `${MARKER} in ${x.item}`, run: `${MARKER} in the log as sent, which shows a line break would go in the same way` }),
+  'http-header': (x) => marker(x, 'in the header value', 'the header would go to the caller'),
+  'os-command': (x) => marker(x, 'in the command', 'the command would run'),
+  'dynamic-sql': (x) => marker(x, 'in the statement text', 'the statement would run'),
+  'internal-reader': (x) => marker(x, 'in the record written', 'the job would be submitted'),
+  'cics-system-resource': (x) => marker(x, 'as the resource the SET names', 'the command would change a region resource'),
+  'connection-target': (x) => marker(x, 'as the database or queue manager named', 'the connection would be made'),
+  'outbound-host': (x) => marker(x, 'as the host or path of the request', 'the request would go out'),
+  'outbound-http': (x) => marker(x, 'in what the request sends', 'the request would go out'),
+  'socket-send': (x) => marker(x, 'in what the socket sends', 'the data would leave the program'),
+  'message-queue': (x) => marker(x, 'in the message put', 'the message would be put'),
+  'extrapartition-queue': (x) => marker(x, 'in the record written', 'the record would leave the region through its DD'),
+  'xml-document': (x) => marker(x, 'in the document parsed', 'the parser would read it'),
+};
+
+function bounds(x, value) {
+  return {
+    value,
+    reads: `${x.item} out of range at the operation`,
+    ...(x.ssrange ? { run: 'the task abends with a Language Environment range message (IGZ0006S for a subscript), since the program is compiled with SSRANGE' }
+      : { run: null, stopBefore: `without SSRANGE the operation reaches the storage beside the table or field: ${END_TASK}` }),
+  };
+}
+
+function marker(x, where, acts) {
+  return { value: MARKER, reads: `${MARKER} ${where}, from ${x.item}`, run: null, stopBefore: `${acts}: ${END_TASK}` };
+}
+
+// Where the value goes in, by where the finding says the input comes from.
+function enterAt(source, f, src, loc) {
+  const field = f.screen ? `field ${f.screen.field} of map ${f.screen.map}${f.screen.mapset ? ` in mapset ${f.screen.mapset}` : ''}` : null;
+  switch (source) {
+    case 'cics-terminal': return field ? `${field}, received at ${loc}` : `the terminal input received at ${loc}`;
+    case 'cics-protected-field': return `${field || 'the protected field'}: the map protects it, so change it under CEDF in the data the RECEIVE MAP at ${loc} returns, not with a modified client`;
+    case 'cics-web': return `the web request read at ${loc}`;
+    case 'argv-or-env': return `the command line or environment of the run, read at ${loc}`;
+    case 'jcl-parm': return `${src?.detail || 'the PARM'}, in a copy of the job`;
+    case 'jcl-instream': return `${src?.detail || 'the in-stream data'}, in a copy of the job`;
+    case 'file-record': return `a test record in a test copy of the file read at ${loc}`;
+    case 'database': return `a test row in a test copy of the table read at ${loc}`;
+    default: return null;
+  }
+}
+
+// CEDF and CEDX stop at EXEC CICS and EXEC SQL; a CALL, a COMPUTE or a subscript needs a debugger.
+function toolFor(source, entries, program) {
+  const tran = entries.find((e) => e.transaction)?.transaction;
+  const debug = 'or a debugger such as z/OS Debugger where the operation is not an EXEC command';
+  if (source === 'cics-web') return `CEDX ${tran || `on the transaction that runs ${program}`}, since a web request has no terminal, ${debug}`;
+  if (tran || source === 'cics-terminal' || source === 'cics-protected-field') return `CEDF at the terminal that runs ${tran || program}, ${debug}`;
+  return 'a debugger such as z/OS Debugger';
+}
+
+export function verificationPlan(f) {
+  const kinds = ALL_RULES[f.rule]?.evidence === 'path' ? kindsOf(f.rule) : null;
+  if (!kinds || !SINKS[kinds.sink]) return null;
+  const entries = f.startedBy || [];
+  const src = f.related?.[0];
+  const loc = src ? `${src.path}:${src.line}` : 'the source';
+  const last = f.trace?.length ? f.trace[f.trace.length - 1] : null;
+  const table = Number(/a table of (\d+)$/.exec(f.detail || '')?.[1]) || null;
+  const x = { item: last?.item || 'the value', table, ssrange: !!f.ssrange };
+  const sink = `${f.path}:${f.line}`;
+  const tool = toolFor(kinds.source, entries, f.program || 'the program');
+  const start = entries.length
+    ? `${entries.map(entryName).join('; ')}${f.startedByMore ? `; or one of ${f.startedByMore} more not listed` : ''}`
+    : `nothing in this tree starts ${f.program || 'the program'}: start it the way the estate does`;
+
+  if (kinds.source === 'system-response') {
+    return {
+      where: WHERE, start, tool,
+      enter: `nothing: provoke the failure the program reports at ${loc}, such as a key that matches no test record`,
+      value: null,
+      observe: `stop at ${sink} and read ${x.item}: the response code or error text is in it`,
+      run: 'the code or error text reaches the caller in what the program sends back',
+      record: record(f),
+    };
+  }
+
+  const s = SINKS[kinds.sink](x);
+  return {
+    where: WHERE, start, tool,
+    enter: enterAt(kinds.source, f, src, loc),
+    value: s.value,
+    observe: `stop at ${sink} and read ${s.reads}: that is the defect, whatever the operation does next`,
+    run: s.run,
+    ...(s.stopBefore ? { stopBefore: s.stopBefore } : {}),
+    ...(f.guardedFrom && f.guard ? { check: `if the check on ${f.guard.item} at ${f.guard.file}:${f.guard.line} turns the value away first, record not-reproduced: the check stops it, and the finding can be judged a false positive` } : {}),
+    record: record(f),
+  };
+}
+
+const record = (f) => `bring the result in a COBOLWORK_WITNESS feed under "${f.fingerprint}": outcome "reproduced" or "not-reproduced", who ran it, the date and the system; what was entered is not recorded there`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@portll/cobolwork",
-  "version": "0.2.75",
+  "version": "0.2.117",
   "description": "COBOL, JCL and CICS security analysis with zero runtime dependencies: reference-format parser, cross-program data flow, mainframe credential rules. Plugs into commitwork.",
   "license": "AGPL-3.0-or-later",
   "author": "Portll <john@portll.net>",