@portll/cobolwork 0.2.76 → 0.2.140

package/lib/dataflow.mjs

@@ -4,6 +4,9 @@ import { parseBms, symbolicNames } from './bms.mjs';
 import { dirname, join } from 'node:path';
 import { parseSource, buildFileIndex } from './parser.mjs';
 import { parseJcl } from './jcl.mjs';
+import { holdsDecimal } from './layout.mjs';
+import { hostVariablesIn } from './embedded-sql.mjs';
+import { tsoCommands } from './utilities.mjs';
 import { parseCsd, ddOfQueue } from './csd.mjs';
 import { loadSite } from './site.mjs';
 import { ssrangeAbends } from './options.mjs';
@@ -12,7 +15,7 @@ import { eachWithinMemory, watchMemoryBuffer } from './kernel/memory.mjs';
 // A flow finding is located by source and sink rather than by one path and line, so it keeps its
 // own comparator. The text comparison underneath it is the shared one.
 import { byText } from './kernel/findings.mjs';
-import { buildControl, creditOf, hasFact } from './control.mjs';
+import { buildControl, creditOf, hasFact, within } from './control.mjs';
 import { directoryTree } from './kernel/source-tree.mjs';
 
 const OS_COMMAND_ROUTINE = /^(SYSTEM|C\$SYSTEM|CBL_EXEC_RUN_UNIT|CBL_GC_HOSTED|BXPSYSTM)$/i;
@@ -51,6 +54,12 @@ export const SINK_KINDS = {
   'record-key': 'the RIDFLD of EXEC CICS READ, STARTBR or RESETBR, which decides which record is read',
   'record-update': 'the RIDFLD of a READ UPDATE whose record the program then rewrites or deletes, or of a DELETE',
   'log': 'what a program in a CICS region writes to a log: DISPLAY, EXEC CICS WRITEQ TD to a queue that neither starts a transaction nor feeds the internal reader, WRITE JOURNALNAME or WRITE OPERATOR',
+  'storage-length': 'how much storage a program acquires: the FLENGTH or LENGTH of EXEC CICS GETMAIN, or the size CALL CEEGTST is given',
+  'xml-document': 'the document XML PARSE reads',
+  'connection-target': 'the database or queue manager a program connects to: the host variable EXEC SQL CONNECT TO or SET CONNECTION names, or the first argument of CALL MQCONN or MQCONNX',
+  'screen': 'what a CICS program shows its terminal: EXEC CICS SEND TEXT FROM, SEND MAP FROM, or the map\'s output record',
+  'cics-sysid': 'the SYSID of an EXEC CICS command, which decides the region the command is shipped to',
+  'cics-system-resource': 'the resource an EXEC CICS SET names, which a system-programming command then changes',
 };
 
 const ARITHMETIC = new Set(['COMPUTE', 'ADD', 'SUBTRACT', 'MULTIPLY', 'DIVIDE']);
@@ -62,6 +71,7 @@ STANDARD-DEVIATION RANDOM SQRT FACTORIAL LOG LOG10 EXP EXP10 PI E ACOS ASIN ATAN
 SECONDS-PAST-MIDNIGHT`.split(/\s+/));
 const computes = (st) => ARITHMETIC.has(st.verb) || st.counts === true || (st.fns || []).some((f) => NUMERIC_FUNCTIONS.has(f));
 const computedOnRoute = (state) => { for (let s = state; s; s = s.prev) if (s.why && s.why.computes) return true; return false; };
+const typedOnRoute = (state) => { for (let s = state; s; s = s.prev) if (s.node.typed) return true; return false; };
 
 // Every literal a program holds that could be a program name: its VALUE clauses and the literals its
 // statements and commands use. A menu that XCTLs through a table of names starts every one of them.
@@ -83,15 +93,6 @@ function lastOption(name, list) {
   return null;
 }
 
-// Whether an item's bytes are read as decimal digits: zoned (DISPLAY with a numeric picture) or
-// packed. A group, an edited picture, binary and floating point are not.
-function holdsDecimal(it) {
-  if ((it.children || []).some((c) => c.level !== 88)) return false;
-  const usage = String(it.effectiveUsage || 'DISPLAY').replace('COMPUTATIONAL', 'COMP');
-  if (usage === 'COMP-3' || usage === 'PACKED-DECIMAL' || usage === 'COMP-6') return true;
-  return usage === 'DISPLAY' && !!it.picture && /9/.test(it.picture) && /^[S9VP()0-9]+$/i.test(it.picture);
-}
-
 const RELATION = new Set(['>', '<', '>=', '<=', '=', '<>']);
 const RELATION_WORDS = new Set(['GREATER', 'LESS', 'EQUAL']);
 const FILLER_WORDS = new Set(['IS', 'NOT', 'THAN', 'TO', 'OR', 'GREATER', 'LESS', 'EQUAL', 'OF', 'IN']);
@@ -126,7 +127,7 @@ const IN_CICS = ['cics-web', 'cics-terminal', 'file-record', 'database'];
 const REFLECTED = ['cics-web', 'cics-terminal'];
 // What the system says about a failure: a command's RESP, the EIB's copy of it, the SQLCA. Sent to a
 // web client it describes the system behind the program (CWE-209); written anywhere else it is the
-// program's own business, so these reach only a response.
+// program's own business, so these reach only a response, and Db2's message text the terminal too.
 const SYSTEM_FIELDS = new Set(['EIBRESP', 'EIBRESP2', 'SQLCODE', 'SQLSTATE', 'SQLERRMC']);
 const TO_CLIENT = ['web-response', 'http-header'];
 
@@ -172,27 +173,6 @@ function execOptions(exec) {
   return { opts, words };
 }
 
-function sqlHostVars(exec) {
-  const out = [];
-  for (let i = 0; i < exec.toks.length; i++) {
-    const t = exec.toks[i];
-    if (t.t === 'op' && t.v === ':' && exec.toks[i + 1] && exec.toks[i + 1].t === 'word') out.push({ tok: exec.toks[i + 1], at: i + 1 });
-  }
-  return out;
-}
-
-// The host variables a SELECT or FETCH fills are the ones in its INTO list, which ends at FROM.
-// Taking every variable at or after the INTO line made the input parameters in a WHERE clause read
-// as database values — and they are whatever the caller sent, under a rule that says data at rest.
-function sqlIntoRange(exec) {
-  const words = exec.toks.map(t => (t.t === 'word' ? t.u : ''));
-  const into = words.indexOf('INTO');
-  if (into < 0) return null;
-  let end = exec.toks.length;
-  for (let i = into + 1; i < words.length; i++) if (words[i] === 'FROM') { end = i; break; }
-  return [into, end];
-}
-
 export function analyze(root, opts = {}) {
   const repos = opts.repos || [''];
   const stats = { files: 0, programs: 0, edges: 0, nodes: 0, threw: 0, overBudget: 0, unreadable: 0, ebcdic: 0,
@@ -219,11 +199,12 @@ export function analyze(root, opts = {}) {
   const jclPending = [];
   // CICS definitions, from CSD extracts and from DFHCSDUP job input, and the estate's own statement
   // of which DDs and queues reach the internal reader.
-  const csd = { tdqueues: new Map(), transactions: new Map() };
+  const csd = { tdqueues: new Map(), transactions: new Map(), urimaps: new Map() };
   const addCsd = (text, file, lineBase = 0) => {
     const c = parseCsd(text);
     for (const [k, v] of c.tdqueues) if (!csd.tdqueues.has(k)) csd.tdqueues.set(k, v);
     for (const [k, v] of c.transactions) if (!csd.transactions.has(k)) csd.transactions.set(k, { ...v, file, line: v.line + lineBase });
+    for (const [k, v] of c.urimaps) if (!csd.urimaps.has(k)) csd.urimaps.set(k, { ...v, file, line: v.line + lineBase });
   };
   const jobSteps = [];
   // The maps of the repository being read, by MAPSET/MAP and by MAP alone.
@@ -286,8 +267,11 @@ export function analyze(root, opts = {}) {
     // A system field the program never declares - the EIB's, or an SQLCA the precompiler supplies -
     // still holds a value, so it needs a node of its own, as an index name does.
     const systemNodes = new Map();
+    // A code on a terminal's error line is ordinary; Db2's message text names tables, columns and
+    // constraints, so only SQLERRMC reaches the screen sink.
     const systemSource = (n, detail, at) => {
-      if (!n.sources.some((x) => x.kind === 'system-response')) n.sources.push({ kind: 'system-response', onlyTo: TO_CLIENT, noCredit: true, ...at, detail });
+      const onlyTo = /^SQLERRMC\b/.test(detail) ? [...TO_CLIENT, 'screen'] : TO_CLIENT;
+      if (!n.sources.some((x) => x.kind === 'system-response')) n.sources.push({ kind: 'system-response', onlyTo, noCredit: true, ...at, detail });
     };
     const systemNode = (tok) => {
       let n = systemNodes.get(tok.u);
@@ -332,6 +316,13 @@ export function analyze(root, opts = {}) {
         if (n) n.sinks.push({ kind: 'log', onlyFrom: REFLECTED, file: st.file, line: st.line, point: pointOf(st), detail: `DISPLAY ${n.name}${device}` });
       }
     }
+    // The document XML PARSE reads is the operand after PARSE; what the parser does with a DTD in
+    // it is the compiler's XMLPARSE option, which nothing here reads.
+    for (const st of prog.statements) {
+      if (st.verb !== 'XML' || !st.sources[0] || st.sources[0].u !== 'PARSE') continue;
+      const n = st.sources[1] ? nodeOfToken(st.sources[1]) : null;
+      if (n) n.sinks.push({ kind: 'xml-document', onlyFrom: REFLECTED, file: st.file, line: st.line, point: pointOf(st), detail: `XML PARSE ${n.name}` });
+    }
     for (const it of prog.items) {
       const n = nodeOf(it);
       // A tainted child makes its group partly tainted; a tainted group taints every child. The
@@ -366,7 +357,7 @@ export function analyze(root, opts = {}) {
       for (const it of prog.items) { const top = recordOf(it); if (!byRecord.has(top)) byRecord.set(top, []); byRecord.get(top).push(it); }
       const extent = (it) => (it.offset != null && it.size != null ? [it.offset, it.offset + (it.contributes || it.size)] : null);
       for (const c of ctl.checks) {
-        const entry = { x: c.x, t: c.t, f: c.f, tCons: c.tCons, fCons: c.fCons, file: c.file, line: c.line, item: c.field.index || c.field.name, ...(c.bounds ? { bounds: c.bounds } : {}) };
+        const entry = { x: c.x, t: c.t, f: c.f, tCons: c.tCons, fCons: c.fCons, file: c.file, line: c.line, item: c.field.index || c.field.name, ...(c.bounds ? { bounds: c.bounds } : {}), ...(c.mono ? { mono: true } : {}) };
         if (c.field.index) { (indexNode(c.field.index).checks ||= []).push(entry); continue; }
         const span = extent(c.field);
         for (const it of byRecord.get(recordOf(c.field)) || [c.field]) {
@@ -411,9 +402,16 @@ export function analyze(root, opts = {}) {
       if (host.size == null || variable(host)) return null;
       return (host.children || []).some((c) => c.level !== 88) ? host.size / Math.max(1, host.occurs || 1) : host.size;
     };
+    // A whole number no sign is written on, which no value put in it can leave below 0.
+    const unsignedWhole = (it) => it.level !== 88 && !it.index && !(it.children || []).length
+      && /^9+$/.test(String(it.picture || '').toUpperCase().replace(/(\w)\((\d+)\)/g, (_, ch, n) => ch.repeat(Number(n))));
     const indexed = new Set();
     const subscripting = new Map();
+    // Each subscript use of a name, with the other indices of the same reference: the loop-bound
+    // credit needs every one of them kept in range.
+    const usesOf = new Map();
     for (const st of prog.statements) {
+      const refs = new Map();
       for (const x of st.indexes || []) {
         const host = itemOfToken(x.host);
         const idx = itemOfToken(x.tok);
@@ -426,17 +424,34 @@ export function analyze(root, opts = {}) {
         const key = `${kind}|${host.name}|${at.name}`;
         if (table && !subscripting.has(at.name)) subscripting.set(at.name, { host, table });
         const point = placeOf(x.tok, st);
-        const use = `${key}|${point ?? `s${st.at}`}`;
+        if (table) {
+          const rec = { at: st.at, node: at, point, limit: limitOf(host, table), offset: x.offset || 0, mates: refs.get(x.host) || (refs.set(x.host, []), refs.get(x.host)) };
+          rec.mates.push(rec);
+          if (!usesOf.has(at.name)) usesOf.set(at.name, []);
+          usesOf.get(at.name).push(rec);
+        }
+        const offset = x.offset || 0;
+        // A constant length past the start, or a constant start before the length, takes that many bytes off the top.
+        const base = limitOf(host, table);
+        const limit = kind === 'reference-modification' && base != null && x.span ? base - x.span + 1 : base;
+        const use = `${key}|${point ?? `s${st.at}`}|${offset}`;
         if (indexed.has(use)) continue;
         indexed.add(use);
         at.sinks.push({
-          kind, onlyFrom: FROM_OUTSIDE, file: st.file, line: st.line, point, group: `${pk}|${key}`, limit: limitOf(host, table), ...(ssrange ? { ssrange } : {}),
+          kind, onlyFrom: FROM_OUTSIDE, file: st.file, line: st.line, point, group: `${pk}|${key}`, limit, ...(offset ? { offset } : {}), ...(offset > 0 && idx && unsignedWhole(idx) ? { nonNeg: true } : {}), ...(ssrange ? { ssrange } : {}),
           detail: kind === 'subscript'
             ? `${at.name} subscripts ${host.name}, a table of ${table.occurs}`
             : `${at.name} sets the ${x.kind === 'refmod-offset' ? 'start' : 'length'} of a reference to ${host.name}, which is ${host.size} bytes`,
         });
       }
     }
+    // The subscript uses a loop's body makes; every use of the name when the body can run code
+    // elsewhere, and none for a loop whose body is a paragraph.
+    const bodyUses = (st, uses) => {
+      const body = ctl && ctl.loopBody.get(st);
+      if (!body || !uses) return null;
+      return body.leaves ? uses : uses.filter((u) => u.at >= body.from && u.at < body.to);
+    };
     // A counter that subscripts a table walks as far as its loop's condition lets it. PERFORM
     // VARYING I ... UNTIL I > N with N from outside puts the table's bound in the caller's hands, and
     // no subscript sink sees it: I itself is only ever a literal plus one. The subscript may be
@@ -454,7 +469,7 @@ export function analyze(root, opts = {}) {
           if (indexed.has(use)) continue;
           indexed.add(use);
           nodeOf(it).sinks.push({
-            kind: 'loop-bound', onlyFrom: FROM_OUTSIDE, file: st.file, line: st.line, point: pointOf(st), group: `${pk}|${key}`, limit: limitOf(walks.host, walks.table), ...(ssrange ? { ssrange } : {}),
+            kind: 'loop-bound', onlyFrom: FROM_OUTSIDE, file: st.file, line: st.line, point: pointOf(st), group: `${pk}|${key}`, limit: limitOf(walks.host, walks.table), counterUses: bodyUses(st, usesOf.get(counter)), ...(ssrange ? { ssrange } : {}),
             detail: `${it.name} decides where PERFORM VARYING ${counter} stops, and ${counter} subscripts ${walks.host.name}, a table of ${walks.table.occurs}`,
           });
         }
@@ -480,14 +495,27 @@ export function analyze(root, opts = {}) {
         });
       }
     }
-    for (const it of prog.items) {
-      if (!it.dependingOn) continue;
+    // The count matters wherever a statement names the table, a part of it, or a group holding it,
+    // so it is judged at each such statement; a table no statement names is judged where it is declared.
+    const odoTables = prog.items.filter((it) => it.dependingOn && byName.get(it.dependingOn));
+    const touching = new Map(odoTables.map((it) => [it, []]));
+    if (odoTables.length) {
+      const inside = (a, b) => { for (let x = a; x; x = x.parent) if (x === b) return true; return false; };
+      for (const st of prog.statements) {
+        const named = [...st.sources, ...st.targets, ...(st.indexes || []).map((x) => x.host)].map(itemOfToken).filter(Boolean);
+        for (const it of odoTables) if (named.some((n) => inside(n, it) || inside(it, n))) touching.get(it).push(st);
+      }
+    }
+    for (const it of odoTables) {
       const count = byName.get(it.dependingOn);
-      if (!count) continue;
-      nodeOf(count).sinks.push({
-        kind: 'occurs-depending-count', onlyFrom: FROM_OUTSIDE, file: it.file, line: it.line, ...(ssrange ? { ssrange } : {}),
-        detail: `${count.name} sets how many ${it.name} entries there are, up to ${it.occurs}`,
-      });
+      const sts = touching.get(it);
+      for (const st of sts.length ? sts : [null]) {
+        const point = st ? pointOf(st) : undefined;
+        nodeOf(count).sinks.push({
+          kind: 'occurs-depending-count', onlyFrom: FROM_OUTSIDE, file: it.file, line: it.line, ...(st ? { point, group: `${pk}|odo|${it.name}` } : {}), top: it.occurs, ...(ssrange ? { ssrange } : {}),
+          detail: `${count.name} sets how many ${it.name} entries there are, up to ${it.occurs}`,
+        });
+      }
     }
     for (const st of prog.statements) {
       if (st.verb !== 'READ' && st.verb !== 'RETURN') continue;
@@ -572,6 +600,16 @@ export function analyze(root, opts = {}) {
         const a = c.using[MQ_BUFFER_ARG[String(c.name).toUpperCase()]];
         const n = a && a.tok ? nodeOfToken(a.tok) : null;
         if (n) n.sinks.push({ kind: 'message-queue', onlyFrom: DATA_AT_REST, file: c.file, line: c.line, point, detail: `CALL '${c.name}' with buffer ${a.word}` });
+      } else if (/^MQCONNX?$/i.test(String(c.name))) {
+        // MQCONN(QMgrName, Hconn, CompCode, Reason); MQCONNX puts its options second.
+        const a = c.using[0];
+        const n = a && a.tok ? nodeOfToken(a.tok) : null;
+        if (n) n.sinks.push({ kind: 'connection-target', onlyFrom: FROM_OUTSIDE, file: c.file, line: c.line, point, detail: `CALL '${c.name}' with queue manager ${a.word}, which decides the queue manager the program connects to` });
+      } else if (String(c.name).toUpperCase() === 'CEEGTST') {
+        // CEEGTST(heap id, size, address, feedback code): the size is the second argument.
+        const a = c.using[1];
+        const n = a && a.tok ? nodeOfToken(a.tok) : null;
+        if (n) n.sinks.push({ kind: 'storage-length', onlyFrom: FROM_OUTSIDE, file: c.file, line: c.line, point, detail: `CALL 'CEEGTST' with size ${a.word}, which decides how much heap storage is acquired` });
       }
     }
     const transfers = [];
@@ -663,14 +701,16 @@ export function analyze(root, opts = {}) {
       walk(record);
       for (const field of map.fields) {
         if (!field.name) continue;
-        const marks = ['PROT', 'ASKIP', 'DRK', 'NUM'].filter((a) => field.effective.has(a));
-        if (!marks.length) continue;
         const iname = symbolicNames(map, field).find((n) => n.suffix === 'I');
         const item = iname && within.get(iname.name);
         if (!item) continue;
+        const marks = ['PROT', 'ASKIP', 'DRK', 'NUM'].filter((a) => field.effective.has(a));
+        const typed = !marks.includes('PROT') && !marks.includes('ASKIP');
+        if (typed) nodeOf(item).typed = true;
+        if (!marks.length) continue;
         const n = nodeOf(item);
         n.screen = { item: item.name, field: field.name, map: map.name, mapset: mapset.name, marks, declared: !!field.attrb };
-        if (!marks.includes('PROT') && !marks.includes('ASKIP')) continue;
+        if (typed) continue;
         stats.protectedFields++;
         const back = field.effective.has('FSET') ? ' with FSET' : '';
         n.sources.push({ kind: 'cics-protected-field', onlyTo: ['record-key', 'record-update'], ...at,
@@ -714,6 +754,14 @@ export function analyze(root, opts = {}) {
           }
           if (!isWeb && o.has('MAP')) receiveMap(e, o, itemOfToken(intoTok), at);
         }
+        // What the terminal shows: SEND TEXT's FROM, or the map's output record, <map>O without FROM.
+        if (verb === 'SEND' && (words[1] === 'TEXT' || words[1] === 'MAP')) {
+          const from = nodeOfToken((o.get('FROM') || [])[0]);
+          const map = words[1] === 'MAP' ? optionName(o, 'MAP') : null;
+          const sym = !from && map ? byName.get(`${map}O`) : null;
+          const n = from || (sym ? nodeOf(sym) : null);
+          if (n) n.sinks.push({ kind: 'screen', onlyFrom: ['system-response'], ...at, detail: `EXEC CICS SEND ${words[1]}${map ? `(${map})` : ''}${from ? ` FROM(${n.name})` : ', from its symbolic map'}, to the terminal` });
+        }
         // RIDFLD decides which record a READ or DELETE reaches, or where a browse starts. A key the
         // user types is how a lookup works; a key the program put in a protected field and read back
         // is its own state, held where a modified client can change it.
@@ -726,6 +774,12 @@ export function analyze(root, opts = {}) {
               : `EXEC CICS ${verb} RIDFLD(${k && k.name}), which decides which record it reaches`;
           if (k) k.sinks.push({ kind: verb === 'DELETE' || then ? 'record-update' : 'record-key', onlyFrom: ['cics-protected-field'], noCredit: true, ...at, detail });
         }
+        if (verb === 'GETMAIN') {
+          for (const opt of ['FLENGTH', 'LENGTH']) {
+            const n = nodeOfToken((o.get(opt) || [])[0]);
+            if (n) n.sinks.push({ kind: 'storage-length', onlyFrom: REFLECTED, ...at, detail: `EXEC CICS GETMAIN ${opt}(${n.name}), which decides how much storage is acquired` });
+          }
+        }
         if (verb === 'PUT' && o.has('CONTAINER')) {
           const name = optionName(o, 'CONTAINER');
           const from = nodeOfToken((o.get('FROM') || [])[0]);
@@ -794,6 +848,17 @@ export function analyze(root, opts = {}) {
             if (n) n.sinks.push({ kind: 'queue-name', onlyFrom: IN_CICS, ...at, detail: `EXEC CICS ${verb} ${ts ? 'TS' : 'TD'} ${opt}(...) names the queue` });
           }
         }
+        // SYSID ships a command to the region it names; SET's first option names the resource a
+        // system-programming command changes. A literal in either is the program's own choice. ASSIGN,
+        // INQUIRE and EXTRACT return SYSID into the field rather than read it.
+        if (o.has('SYSID') && !['ASSIGN', 'INQUIRE', 'EXTRACT'].includes(verb)) {
+          const n = nodeOfToken((o.get('SYSID') || [])[0]);
+          if (n) n.sinks.push({ kind: 'cics-sysid', onlyFrom: IN_CICS, ...at, detail: `EXEC CICS ${verb} SYSID(${n.name}), which decides the region the command is shipped to` });
+        }
+        if (verb === 'SET' && words[1] && o.has(words[1])) {
+          const n = nodeOfToken((o.get(words[1]) || [])[0]);
+          if (n) n.sinks.push({ kind: 'cics-system-resource', onlyFrom: IN_CICS, ...at, detail: `EXEC CICS SET ${words[1]}(${n.name}), which decides the resource the command changes` });
+        }
         if (verb === 'READ' || verb === 'READNEXT' || verb === 'READPREV') {
           const n = nodeOfToken(intoTok);
           if (n && (o.has('FILE') || o.has('DATASET'))) n.sources.push({ kind: 'file-record', ...at, detail: `EXEC CICS ${verb} FILE ... INTO` });
@@ -835,15 +900,22 @@ export function analyze(root, opts = {}) {
         }
       }
       if (e.kind === 'SQL') {
-        // The parser's host variables name the item a qualified :G.F resolves to, where the first
-        // word after the colon would name the group G and so every field in it.
-        const hv = e.hostVariables || sqlHostVars(e);
+        // A host variable names the item a qualified :G.F resolves to; the statement fills the ones
+        // Db2 writes, and those hold what the database held.
+        const hv = e.hostVariables || hostVariablesIn(e.toks);
         const verb = words[0];
-        const range = e.hostVariables ? null : ['SELECT', 'FETCH'].includes(verb) && sqlIntoRange(e);
         for (const h of hv) {
-          if (e.hostVariables ? !h.written : !range || h.at < range[0] || h.at > range[1]) continue;
+          if (!h.written) continue;
           const n = nodeOfToken(h.tok);
-          if (n) n.sources.push({ kind: 'database', ...at, detail: `EXEC SQL ${verb} INTO host variable` });
+          if (n) n.sources.push({ kind: 'database', ...at, detail: `EXEC SQL ${verb} ${verb === 'SELECT' || verb === 'FETCH' ? 'INTO' : 'writes'} host variable` });
+        }
+        // The location CONNECT TO or SET CONNECTION names, where a host variable holds it; what
+        // follows USER and USING is the credential, not the target.
+        if (verb === 'CONNECT' || (verb === 'SET' && words[1] === 'CONNECTION')) {
+          const to = e.toks.findIndex((t) => t.t === 'word' && (t.u === 'TO' || t.u === 'CONNECTION'));
+          const colon = to >= 0 ? e.toks[to + 1] : null;
+          const n = colon && colon.t === 'op' && colon.v === ':' && e.toks[to + 2] ? nodeOfToken(e.toks[to + 2]) : null;
+          if (n) n.sinks.push({ kind: 'connection-target', onlyFrom: FROM_OUTSIDE, ...at, detail: `EXEC SQL ${verb === 'SET' ? 'SET CONNECTION' : 'CONNECT TO'} :${n.name}, which decides the database the program connects to` });
         }
         const dynamic = words.some((w, i) => w === 'PREPARE' || (w === 'EXECUTE' && words[i + 1] === 'IMMEDIATE'));
         if (dynamic) for (const h of hv) {
@@ -860,7 +932,7 @@ export function analyze(root, opts = {}) {
     }
     const commareaItem = byName.get('DFHCOMMAREA');
     return {
-      id: prog.id, pk, callSites, transfers, ddFiles, tdWrites,
+      id: prog.id, pk, file, callSites, transfers, ddFiles, tdWrites,
       params: prog.paramTokens ? prog.paramTokens.map(p => {
         const it = itemOfToken(p.tok);
         const extent = extentOf(it);
@@ -929,27 +1001,55 @@ export function analyze(root, opts = {}) {
 
   const byId = new Map();
   const idCount = new Map();
+  const allById = new Map();
   for (const p of programs) {
     if (p.id && !byId.has(p.id)) byId.set(p.id, p);
-    if (p.id) idCount.set(p.id, (idCount.get(p.id) || 0) + 1);
+    if (p.id) { idCount.set(p.id, (idCount.get(p.id) || 0) + 1); (allById.get(p.id) || allById.set(p.id, []).get(p.id)).push(p); }
   }
+  // The programs a CALL or LINK may reach. A program id the repository holds once is that program.
+  // Held several times, the one in the caller's own source file is the one its executable links;
+  // with none there, the holders nearest in the directory tree are, since a copy of a program tree
+  // or a sibling executable's copy is farther than the caller's own build directory. Ties keep every
+  // holder, and the edge says how many candidates there were.
+  const sharedDirs = (a, b) => {
+    const x = a.split(/[\\/]/), y = b.split(/[\\/]/);
+    let n = 0;
+    while (n < x.length - 1 && n < y.length - 1 && x[n] === y[n]) n++;
+    return n;
+  };
+  const calleesOf = (name, fromFile) => {
+    const all = allById.get(name) || [];
+    if (all.length < 2) return { list: all, of: 0 };
+    const here = all.filter((q) => q.file === fromFile);
+    if (here.length) return { list: here, of: 0 };
+    const depth = all.map((q) => sharedDirs(q.file, fromFile));
+    const best = Math.max(...depth);
+    return { list: all.filter((_, i) => depth[i] === best), of: all.length };
+  };
+  const ofN = (r, name) => (r.of ? `, ${r.list.length === r.of ? 'any' : 'nearest'} of ${r.of} programs named ${name}` : '');
   const constructs = [];
   for (const p of programs) {
     for (const t of p.transfers) {
-      const callee = byId.get(t.callee);
-      if (!callee || !callee.commarea) continue;
-      edge(t.argNode, callee.commarea, `EXEC CICS ${t.verb} COMMAREA to ${t.callee}${t.through ? `, the program ${t.through} names` : ''}`, undefined, t.point);
-      if (t.verb === 'LINK') edge(callee.commarea, t.argNode, `COMMAREA returned from ${t.callee}`);
+      const r = calleesOf(t.callee, p.file);
+      for (const callee of r.list) {
+        if (!callee.commarea) continue;
+        edge(t.argNode, callee.commarea, `EXEC CICS ${t.verb} COMMAREA to ${t.callee}${t.through ? `, the program ${t.through} names` : ''}${ofN(r, t.callee)}`, undefined, t.point);
+        if (t.verb === 'LINK') edge(callee.commarea, t.argNode, `COMMAREA returned from ${t.callee}${ofN(r, t.callee)}`);
+      }
     }
     for (const c of p.callSites) {
-      const callee = byId.get(c.name);
+      const r = calleesOf(c.name, p.file);
+      for (const callee of r.list) {
+        if (!callee.params) continue;
+        c.args.forEach((arg, i) => {
+          const param = callee.params[i];
+          if (!param || !arg.node || !param.node) return;
+          edge(arg.node, param.node, `CALL '${c.display}' argument ${i + 1} at ${rel(c.file)}:${c.line}${ofN(r, c.display)}`, undefined, c.point);
+          if (arg.mode === 'REFERENCE' && param.mode === 'REFERENCE') edge(param.node, arg.node, `CALL '${c.display}' argument ${i + 1} written back${ofN(r, c.display)}`);
+        });
+      }
+      const callee = r.list.length === 1 ? r.list[0] : null;
       if (!callee || !callee.params) continue;
-      c.args.forEach((arg, i) => {
-        const param = callee.params[i];
-        if (!param || !arg.node || !param.node) return;
-        edge(arg.node, param.node, `CALL '${c.display}' argument ${i + 1} at ${rel(c.file)}:${c.line}`, undefined, c.point);
-        if (arg.mode === 'REFERENCE' && param.mode === 'REFERENCE') edge(param.node, arg.node, `CALL '${c.display}' argument ${i + 1} written back`);
-      });
       // A callee that declares more bytes than its caller passes reads and writes whatever follows
       // the argument in the caller's storage. Measured over 8,640 bound pairs in 125 repositories:
       // where the extra bytes stay inside the caller's own record they are its neighbouring fields,
@@ -1001,53 +1101,60 @@ export function analyze(root, opts = {}) {
         for (const dd of step.dds) if (dd.name && dd.name.toUpperCase() === 'SYSIN' && dd.inStream) addCsd(dd.inStream.map((l) => l.text).join('\n'), f, dd.inStream[0].line - 1);
       }
       jobSteps.push({ file: f, job: job.jobs[0]?.name || null, step: step.name, line: step.line, pgm: step.pgm.toUpperCase() });
-      // A TSO batch step starts a program by name in its commands: DSN ... RUN PROGRAM(X).
-      if (/^IKJEFT(01|1A|1B)$/i.test(step.pgm)) {
-        for (const dd of step.dds) for (const l of dd.inStream || []) {
-          const run = /\bRUN\s+PROGRAM\s*\(\s*([A-Z0-9$#@]{1,8})\s*\)/i.exec(l.text);
-          if (run) jobSteps.push({ file: f, job: job.jobs[0]?.name || null, step: step.name, line: l.line, pgm: run[1].toUpperCase() });
-        }
-      }
-      const callee = byId.get(step.pgm.toUpperCase());
-      if (!callee) continue;                    // a system utility, or a program not in this tree
-      stats.jclStepsResolved++;
-
-      // PARM arrives in the first PROCEDURE DIVISION USING item: on z/OS a halfword length
-      // followed by the text. A program with no USING cannot receive one, and saying it does
-      // would be a path nobody could follow.
-      if (step.parm !== null && callee.params && callee.params[0] && callee.params[0].node) {
-        callee.params[0].node.sources.push({
-          kind: 'jcl-parm', file: f, line: step.line,
-          detail: `PARM= on step ${step.name || '(unnamed)'} of ${rel(f)}, which runs ${step.pgm}`,
-        });
-        stats.jclCrossings++;
+      // A TSO batch step starts programs by name in its commands, TSO CALL and DSN RUN PROGRAM, and
+      // each is handed the step's DDs and its own parameter as EXEC PGM= would be.
+      const runs = [{ pgm: step.pgm.toUpperCase(), parm: step.parm, line: step.line, how: `PARM= on step ${step.name || '(unnamed)'} of ${rel(f)}` }];
+      for (const r of tsoCommands(step).runs) {
+        jobSteps.push({ file: f, job: job.jobs[0]?.name || null, step: step.name, line: r.line, pgm: r.program });
+        runs.push({ pgm: r.program, parm: r.parm, line: r.line, how: `the parameter ${r.via} passes in step ${step.name || '(unnamed)'} of ${rel(f)}` });
       }
+      for (const run of runs) {
+        const holders = allById.get(run.pgm) || [];
+        if (!holders.length) continue;            // a system utility, or a program not in this tree
+        stats.jclStepsResolved++;
+        // A program id held several times has no caller file to choose by, so each holder is a candidate.
+        const amb = holders.length > 1 ? `, any of ${holders.length} programs named ${run.pgm}` : '';
+        for (const callee of holders) {
 
-      // In-stream data reaches whatever record the program reads from that DD. The COBOL says
-      // ASSIGN TO SYSIN and the job says //SYSIN DD *; neither half names the other, and the
-      // join is the whole point of reading both.
-      for (const dd of step.dds) {
-        // The same join in the other direction: what the program writes through SELECT ... ASSIGN
-        // TO a DD the job sends to the internal reader is submitted as a job.
-        if (dd.name && dd.sysout && /\bINTRDR\b/i.test(dd.sysout)) {
-          for (const m of callee.ddFiles || []) {
-            if (m.dd !== dd.name.toUpperCase()) continue;
-            for (const n of m.nodes) {
-              n.sinks.push({ kind: 'internal-reader', file: m.file, line: m.line,
-                detail: `records written through SELECT ${m.select} to //${dd.name}, which step ${step.name || '(unnamed)'} of ${rel(f)} sends to the internal reader` });
-            }
-          }
-        }
-        if (!dd.inStream || !dd.inStream.length || !dd.name) continue;
-        for (const m of callee.ddFiles || []) {
-          if (m.dd !== dd.name.toUpperCase()) continue;
-          for (const n of m.nodes) {
-            n.sources.push({
-              kind: 'jcl-instream', file: f, line: dd.line,
-              detail: `${dd.inStream.length} lines of in-stream data on //${dd.name} in step ${step.name || '(unnamed)'}, read through SELECT ${m.select}`,
+          // PARM arrives in the first PROCEDURE DIVISION USING item: on z/OS a halfword length
+          // followed by the text. A program with no USING cannot receive one, and saying it does
+          // would be a path nobody could follow.
+          if (run.parm !== null && callee.params && callee.params[0] && callee.params[0].node) {
+            callee.params[0].node.sources.push({
+              kind: 'jcl-parm', file: f, line: run.line,
+              detail: `${run.how}, which runs ${run.pgm}${amb}`,
             });
             stats.jclCrossings++;
           }
+
+          // In-stream data reaches whatever record the program reads from that DD. The COBOL says
+          // ASSIGN TO SYSIN and the job says //SYSIN DD *; neither half names the other, and the
+          // join is the whole point of reading both.
+          for (const dd of step.dds) {
+            // The same join in the other direction: what the program writes through SELECT ... ASSIGN
+            // TO a DD the job sends to the internal reader is submitted as a job.
+            if (dd.name && dd.sysout && /\bINTRDR\b/i.test(dd.sysout)) {
+              for (const m of callee.ddFiles || []) {
+                if (m.dd !== dd.name.toUpperCase()) continue;
+                for (const n of m.nodes) {
+                  n.sinks.push({ kind: 'internal-reader', file: m.file, line: m.line,
+                    detail: `records written through SELECT ${m.select} to //${dd.name}, which step ${step.name || '(unnamed)'} of ${rel(f)} sends to the internal reader${amb}` });
+                }
+              }
+            }
+            if (!dd.inStream || !dd.inStream.length || !dd.name) continue;
+            for (const m of callee.ddFiles || []) {
+              if (m.dd !== dd.name.toUpperCase()) continue;
+              for (const n of m.nodes) {
+                n.sources.push({
+                  kind: 'jcl-instream', file: f, line: dd.line,
+                  detail: `${dd.inStream.length} lines of in-stream data on //${dd.name} in step ${step.name || '(unnamed)'}, read through SELECT ${m.select}${amb}`,
+                });
+                stats.jclCrossings++;
+              }
+            }
+
+          }
         }
       }
     }
@@ -1059,6 +1166,12 @@ export function analyze(root, opts = {}) {
   // in this tree reaches.
   const roots = [];
   for (const [name, t] of csd.transactions) if (t.program && byId.has(t.program)) roots.push({ transaction: name, file: rel(t.file), line: t.line, program: t.program });
+  // A URI map serves its program to an HTTP request under an alias transaction, CWBA unless it names
+  // one, and that transaction is what the region checks the caller may start.
+  for (const [name, u] of csd.urimaps) {
+    if ((u.usage && u.usage !== 'SERVER') || !u.program || !byId.has(u.program)) continue;
+    roots.push({ transaction: u.transaction || 'CWBA', urimap: name, ...(u.path ? { uri: u.path } : {}), file: rel(u.file), line: u.line, program: u.program });
+  }
   for (const j of jobSteps) if (byId.has(j.pgm)) roots.push({ job: j.job, step: j.step, file: rel(j.file), line: j.line, program: j.pgm });
   const STARTED_BY_LISTED = 8;
   for (const r of roots) {
@@ -1162,25 +1275,45 @@ export function analyze(root, opts = {}) {
   const moves = (e) => !(typeof e.why === 'string' && STRUCTURAL.has(e.why));
   const NONE = { level: 0, check: null };
   // `limit` is how many entries or bytes the sink's index may name, where one number says it.
-  function creditAt(n, point, kind, limit = null) {
+  function creditAt(n, point, kind, limit = null, offset = 0, nonNeg = false) {
     const p = programs[n.pk];
     if (!p || !p.ordered) return n.guard ? { level: 1, check: n.guard } : NONE;
     if (!n.checks || point == null) return NONE;
     const bits = p.facts.get(point);
-    return bits ? creditOf(n.checks, bits, kind, limit) : NONE;
+    return bits ? creditOf(n.checks, bits, kind, limit, offset, nonNeg) : NONE;
+  }
+  // A loop bound cannot push its counter out of the table when the loop's own condition or the
+  // body's checks keep every subscript the counter makes, and each index beside it, in range.
+  // That holds whatever the bound is, so it does not depend on the route the input took.
+  function counterCredit(sink) {
+    const uses = sink.kind === 'loop-bound' ? sink.counterUses : null;
+    if (!uses || !uses.length) return null;
+    let first = null;
+    for (const u of uses) {
+      for (const m of u.mates) {
+        const c = creditAt(m.node, m.point, 'subscript', m.limit, m.offset || 0);
+        if (c.level < 2 || m.limit == null || !within(c.cons, m.limit)) return null;
+        if (m === u && !first) first = { credit: c, node: m.node };
+      }
+    }
+    return first;
   }
   // The best credit on a route. Each node is judged at the statement its value leaves by, which for
   // the last is the sink's own. A structural hop - into a group, across a REDEFINES - moves no value
   // in time, so the node before it is judged where the value next moves.
   function routeCredit(hops, sink, src) {
     if (sink.noCredit || (src && src.noCredit)) return { best: NONE, by: null, missed: null };
+    const own = counterCredit(sink);
+    if (own) return { best: own.credit, by: own.node, missed: null, own: true };
     let best = NONE;
     let by = null;
     let missed = null;
     let point = sink.point;
     for (let h = hops.length - 1; h >= 0; h--) {
       const n = hops[h].node;
-      const c = creditAt(n, point, sink.kind, sink.limit);
+      let c = creditAt(n, point, sink.kind, sink.limit, sink.offset, sink.nonNeg);
+      // A count checked against a number above the table's maximum has been checked, not kept in range.
+      if (c.level === 2 && sink.top != null && !within(c.cons, sink.top, false)) c = { level: 1, check: c.check };
       if (c.level > best.level) { best = c; by = n; }
       const any = (n.checks && n.checks.find((c) => c.x != null)) || n.guard;
       if (!c.level && any && !missed) missed = { node: n, check: any };
@@ -1191,16 +1324,16 @@ export function analyze(root, opts = {}) {
   // The credited findings of one source whose sink can be reached without the credit: walking from
   // the source, a value may not leave a node - or any node it reached by a structural hop since it
   // last moved - at a point where the credit reaches `level`.
-  function refuse(start, reach, credited, level, kind) {
+  function refuse(start, reach, credited, level, kind, shift = 0) {
     walk++;
-    const want = credited.filter((c) => c.level >= level && c.sink.kind === kind);
+    const want = credited.filter((c) => c.level >= level && c.sink.kind === kind && (c.sink.offset || 0) === shift);
     // Past the budget no route can be ruled out, so every credit in question is lost: a finding
     // may be reported unchecked, never dropped.
     if (edgesWalked >= totalBudget) { stats.creditUndecided++; return new Set(want); }
     const at = new Map();
     for (const c of want) { if (!at.has(c.node.id)) at.set(c.node.id, []); at.get(c.node.id).push(c); }
     // Along the way no sink's limit applies, so a bound that holds only against one blocks nothing.
-    const holds = (since, point, k, limit = null) => since.some((n) => creditAt(n, point, k, limit).level >= level);
+    const holds = (since, point, k, limit = null, offset = 0, nonNeg = false) => since.some((n) => creditAt(n, point, k, limit, offset, nonNeg).level >= level);
     const lost = new Set();
     const dirty = new Map();
     const parts = new Map();
@@ -1209,13 +1342,13 @@ export function analyze(root, opts = {}) {
     const began = edgesWalked;
     for (let i = 0; i < open.length; i++) {
       const st = open[i];
-      for (const c of at.get(st.node.id) || []) if (!holds(st.since, c.sink.point, c.sink.kind, c.sink.limit)) lost.add(c);
+      for (const c of at.get(st.node.id) || []) if (!holds(st.since, c.sink.point, c.sink.kind, c.sink.limit, c.sink.offset, c.sink.nonNeg)) lost.add(c);
       for (const e of st.node.edgesOut) {
         edgesWalked++;
         const to = e.to;
         if (!(canReach[to.id] & reach)) continue;
         const mv = moves(e);
-        if (mv && holds(st.since, pointOfEdge(e), kind)) continue;
+        if (mv && holds(st.since, pointOfEdge(e), kind, null, shift)) continue;
         const t = cross(st, e);
         if (!t) continue;
         const since = mv ? [to] : [...st.since, to];
@@ -1341,6 +1474,9 @@ export function analyze(root, opts = {}) {
           // arithmetic or a numeric function carries no bad bytes to the next one. Only this route is
           // dropped: a later one that copies the bytes still reports.
           if (sink.kind === 'arithmetic' && computedOnRoute(state)) continue;
+          // A protected field's value carried through a field the terminal may type into reaches the
+          // key as typed input, which the user could have entered anyway: the protection was no control.
+          if (src.kind === 'cics-protected-field' && typedOnRoute(state)) continue;
           seen.add(key);
           // The ends of a long path are what a reader uses: where the value came from, and what it
           // reached. Keeping every hop of a thousand-hop chain, for a thousand findings, is the
@@ -1354,7 +1490,7 @@ export function analyze(root, opts = {}) {
             : [...hops.slice(0, TRACE_KEEP).map(hop),
               { program: null, item: null, file: null, via: `… ${hops.length - TRACE_KEEP * 2} hops not listed`, elided: hops.length - TRACE_KEEP * 2 },
               ...hops.slice(-TRACE_KEEP).map(hop)];
-          const { best, by, missed } = routeCredit(hops, sink, src);
+          const { best, by, missed, own } = routeCredit(hops, sink, src);
           const screen = hops.find((h) => h.node.screen)?.node.screen;
           findings.push({
             rule: `${src.kind}-to-${sink.kind}`,
@@ -1370,7 +1506,7 @@ export function analyze(root, opts = {}) {
             ...(best.level ? { guard: { program: by.program, item: by.name, file: rel(best.check.file), line: best.check.line, ...(best.level === 2 ? { stops: true } : {}) } } : {}),
             ...(!best.level && missed ? { checkElsewhere: { program: missed.node.program, item: missed.node.name, file: rel(missed.check.file), line: missed.check.line } } : {}),
           });
-          if (best.level) credited.push({ finding: findings[findings.length - 1], node: cur, sink, level: best.level });
+          if (best.level && !own) credited.push({ finding: findings[findings.length - 1], node: cur, sink, level: best.level });
           if (sink.group) useGroup.set(findings[findings.length - 1], `${src.kind}|${src.file}:${src.line}|${sink.kind}|${sink.group}`);
         }
         for (const e of cur.edgesOut) {
@@ -1399,16 +1535,23 @@ export function analyze(root, opts = {}) {
       // cross() like the first walk, so it cannot take a route the first would refuse.
       if (credited.length) {
         // Per kind of sink, because what a check leaves may stop one kind and say nothing to another.
+        // And per shift, because a value that stops a bare index does not stop one moved down by a constant.
+        const shiftsOf = (list, kind) => new Set(list.filter((c) => c.sink.kind === kind).map((c) => c.sink.offset || 0));
         for (const kind of new Set(credited.map((c) => c.sink.kind))) {
-          for (const c of refuse(start, reach, credited, 1, kind)) {
-            const g = c.finding.guard;
-            delete c.finding.guard;
-            c.finding.checkElsewhere = { program: g.program, item: g.item, file: g.file, line: g.line };
-            c.level = 0;
+          for (const shift of shiftsOf(credited, kind)) {
+            for (const c of refuse(start, reach, credited, 1, kind, shift)) {
+              const g = c.finding.guard;
+              delete c.finding.guard;
+              c.finding.checkElsewhere = { program: g.program, item: g.item, file: g.file, line: g.line };
+              c.level = 0;
+            }
           }
         }
         for (const kind of new Set(credited.filter((c) => c.level === 2).map((c) => c.sink.kind))) {
-          for (const c of refuse(start, reach, credited, 2, kind)) if (c.level === 2) { delete c.finding.guard.stops; c.level = 1; }
+          const two = credited.filter((c) => c.level === 2);
+          for (const shift of shiftsOf(two, kind)) {
+            for (const c of refuse(start, reach, credited, 2, kind, shift)) if (c.level === 2) { delete c.finding.guard.stops; c.level = 1; }
+          }
         }
       }
     }
@@ -1423,6 +1566,13 @@ export function analyze(root, opts = {}) {
       if (!k || rank(f) < rank(k) || (rank(f) === rank(k) && (byText(f.sink.file, k.sink.file) || f.sink.line - k.sink.line) < 0)) kept.set(key, f);
     }
     const keep = new Set(kept.values());
+    // The uses left out are named on the one kept, with how far each is checked, so a reader can see them.
+    const level = (f) => (f.guard ? (f.guard.stops ? 2 : 1) : 0);
+    for (const [f, key] of useGroup) {
+      if (keep.has(f)) continue;
+      const k = kept.get(key);
+      (k.also ||= []).push({ file: f.sink.file, line: f.sink.line, program: f.sink.program, detail: f.sink.detail, level: level(f), unreached: !!f.unreached, ...(f.guard ? { guardLine: f.guard.line } : {}) });
+    }
     let w = 0;
     for (const f of findings) if (!useGroup.has(f) || keep.has(f)) findings[w++] = f;
     findings.length = w;
@@ -1455,7 +1605,7 @@ export function analyze(root, opts = {}) {
     }
   }
   for (const c of constructs) { Object.assign(c, startedByOf(c.pk)); delete c.pk; }
-  stats.entryPoints = { transactions: csd.transactions.size, jobSteps: jobSteps.length, roots: roots.length, programsStarted: programs.filter((p) => p.startedBy).length, programsWithoutEntry: unstarted.length };
+  stats.entryPoints = { transactions: csd.transactions.size, uriMaps: csd.urimaps.size, jobSteps: jobSteps.length, roots: roots.length, programsStarted: programs.filter((p) => p.startedBy).length, programsWithoutEntry: unstarted.length };
   const startedBy = {};
   for (const p of programs) if (p.id && p.startedBy && !startedBy[p.id]) startedBy[p.id] = p.startedBy;
   return { findings, constructs, unstarted, startedBy, stats, sourceKinds: SOURCE_KINDS, sinkKinds: SINK_KINDS, ...(sinks ? { sinks } : {}), ...(sources ? { sources } : {}) };