exprforge 0.3.1 → 0.5.0

package/ast.js

@@ -11,24 +11,87 @@
 //   { type: "cmp",    op: ">" | "<" | ">=" | "<=" | "==" | "!=", left: Node, right: Node }
 //   { type: "select", cond: CmpNode, then: Node, else: Node }
 //   { type: "outputs", fields: { [name: string]: Node } }
+//   { type: "field",   target: Node, field: string }
+//
+// "field" is postfix "." access (e.g. b.rx) — parser sugar produced only
+// by expr.js/fn.js's grammar, and eliminated by macros.js's
+// expandMacros() before a tree ever reaches checkUnboundVars,
+// evaluate(), or any emitter. It only makes semantic sense when `target`
+// resolves to a name bound to a multi-output *macro* call (see
+// macros.js) — that's checked there, not here, same "defer semantic
+// validation to the consumer" precedent call() already follows for
+// function names. A "field" node reaching evaluate()/an emitter directly
+// means expandMacros() was skipped or didn't run to completion; both
+// throw their own "unknown node type" error in that case.
 //
 // Every "bin" node is emitted with explicit parens in every target, so
 // operation order (and therefore floating-point rounding behavior) is
 // identical everywhere.
+//
+// SECURITY: every builder below validates its own name/op/value
+// argument(s) -- see assertSafeIdentifier/assertSafeOp/assertFiniteNumber
+// just below. This is specifically about these builders being the "raw
+// AST" layer -- the one this project's own README recommends reaching
+// for when you want the least amount of magic between your formula and
+// the code it emits. Without validation, that would have been the LEAST
+// safe layer to build from untrusted input, not the most: fn`...`/
+// expr`...`'s own tokenizer already only ever produces safe identifier
+// characters, so these builders were the one place a malicious/malformed
+// name -- e.g. `v('x); process.exit(1); //')` -- could reach emitted
+// output completely unchecked, verbatim, in all 16 targets at once.
+// Confirmed, not assumed, before this existed.
+
+// Matches fn`...`/expr`...`'s own tokenizer IDENT rule exactly (see
+// expr.js's tokenizeSegment) -- anything that couldn't have come out of
+// the real parser isn't allowed in here either.
+const IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_]*$/;
+
+function assertSafeIdentifier(name, context) {
+    if (typeof name !== "string" || !IDENTIFIER.test(name)) {
+        throw new Error(
+            `${context}: ${JSON.stringify(name)} isn't a safe identifier -- must start with a letter or "_", ` +
+            `followed only by letters/digits/"_" (the same rule fn\`...\`/expr\`...\`'s own tokenizer already ` +
+            `enforces on anything parsed from text; this only matters when building a tree directly, bypassing ` +
+            `the parser)`,
+        );
+    }
+}
+
+const BIN_OPS = new Set(["+", "-", "*", "/"]);
+const CMP_OPS = new Set([">", "<", ">=", "<=", "==", "!="]);
+
+function assertSafeOp(op, allowed, context) {
+    if (!allowed.has(op)) {
+        throw new Error(`${context}: ${JSON.stringify(op)} isn't one of the allowed operators (${[...allowed].join(" ")})`);
+    }
+}
+
+function assertFiniteNumber(value, context) {
+    if (typeof value !== "number" || !Number.isFinite(value)) {
+        throw new Error(
+            `${context}: ${JSON.stringify(value)} isn't a finite number -- NaN/Infinity/non-numeric values ` +
+            `can't be emitted as a literal in every target`,
+        );
+    }
+}
 
 function num(value) {
+    assertFiniteNumber(value, "num()");
     return { type: "num", value };
 }
 
 function v(name) {
+    assertSafeIdentifier(name, "v()");
     return { type: "var", name };
 }
 
 function bin(op, left, right) {
+    assertSafeOp(op, BIN_OPS, "bin()");
     return { type: "bin", op, left, right };
 }
 
 function call(name, ...args) {
+    assertSafeIdentifier(name, "call()");
     return { type: "call", name, args };
 }
 
@@ -59,6 +122,7 @@ function neg(x) {
 // then divide three components by it). Lifted out by collectLets before
 // emission — see there for how `v(name)` ends up referring to it.
 function letIn(name, value, body) {
+    assertSafeIdentifier(name, "letIn()");
     return { type: "let", name, value, body };
 }
 
@@ -86,6 +150,7 @@ function letChain(bindings, body) {
 // Comparison predicate — only valid as the `cond` of a select(); not a
 // general boolean expression, and shouldn't appear anywhere else in a tree.
 function cmp(left, op, right) {
+    assertSafeOp(op, CMP_OPS, "cmp()");
     return { type: "cmp", op, left, right };
 }
 
@@ -107,9 +172,28 @@ function select(cond, thenNode, elseNode) {
 // return, an object literal, output parameters) — see formatSuite in each
 // emitters/<lang>.js.
 function outputs(fields) {
+    for (const name of Object.keys(fields)) assertSafeIdentifier(name, "outputs()");
     return { type: "outputs", fields };
 }
 
+// Postfix "." field access into a multi-output intrinsic's result — see
+// the "field" node-shape comment at the top of this file for what this
+// actually means and who consumes it.
+function field(target, name) {
+    assertSafeIdentifier(name, "field()");
+    return { type: "field", target, field: name };
+}
+
+// The prefix macros.js's own gensym'd internal let-names always start
+// with (see substituteAndRename's "let" case there) — defined HERE, not
+// there, specifically so collectLets below can recognize a collision
+// against one WITHOUT macros.js needing to require this file back (it
+// already does the other direction: macros.js requires ast.js). Kept as
+// one shared constant rather than a duplicated string literal in both
+// files, so it can't quietly drift out of sync between "the name this
+// generates" and "the name this recognizes".
+const MACRO_GENSYM_PREFIX = "efMacro_";
+
 // Lifts every `let` node out of the tree into a flat, ordered list of
 // { name, node } bindings, replacing each with a plain v(name) reference.
 // The list is in dependency order — safe to declare/assign top-to-bottom.
@@ -152,7 +236,23 @@ function collectLets(node) {
     const seen = new Set();
     for (const { name } of bindings) {
         if (seen.has(name)) {
-            throw new Error(`collectLets: duplicate let binding name "${name}" in one function`);
+            // A colliding name that happens to start with macros.js's own
+            // gensym prefix is almost certainly NOT something you wrote
+            // on purpose -- vanishingly unlikely to be an intentional
+            // collision, and confusing to debug as a plain "duplicate
+            // name" if you don't already know that prefix means
+            // "internally generated" -- named explicitly here rather
+            // than left for you to work out. The gensym'd name itself is
+            // never the one to rename (it's already unique per macro
+            // invocation, see toMacro's own comment in macros.js) -- only
+            // your OWN same-named binding actually needs to change.
+            const hint = name.startsWith(MACRO_GENSYM_PREFIX)
+                ? ` -- this looks like an internal name macro expansion generates automatically ` +
+                  `(see macros.js's own gensym'd "let" renaming), not something you wrote; if you ` +
+                  `have your own let/param actually named "${name}", rename YOURS to something that ` +
+                  `doesn't start with "${MACRO_GENSYM_PREFIX}"`
+                : "";
+            throw new Error(`collectLets: duplicate let binding name "${name}" in one function${hint}`);
         }
         seen.add(name);
     }
@@ -160,4 +260,92 @@ function collectLets(node) {
     return { bindings, body };
 }
 
-module.exports = { num, v, bin, call, add, mul, sub, div, neg, letIn, letChain, cmp, select, outputs, collectLets };
+// Every v(name) reference anywhere in `node`, regardless of whether
+// anything actually declares it -- a pure structural walk, no binding
+// awareness at all. `refs` accumulates across recursive calls so this
+// can be called repeatedly against several subtrees (e.g. once per
+// let-binding's own value, plus once for the final body) and still
+// build one combined set. Mirrors collectLets's own node-type walk
+// above exactly, since it needs to see the identical tree shape.
+function collectVarRefs(node, refs = new Set()) {
+    if (node.type === "var") {
+        refs.add(node.name);
+    } else if (node.type === "bin") {
+        collectVarRefs(node.left, refs);
+        collectVarRefs(node.right, refs);
+    } else if (node.type === "call") {
+        for (const a of node.args) collectVarRefs(a, refs);
+    } else if (node.type === "cmp") {
+        collectVarRefs(node.left, refs);
+        collectVarRefs(node.right, refs);
+    } else if (node.type === "select") {
+        collectVarRefs(node.cond, refs);
+        collectVarRefs(node.then, refs);
+        collectVarRefs(node.else, refs);
+    } else if (node.type === "let") {
+        collectVarRefs(node.value, refs);
+        collectVarRefs(node.body, refs);
+    } else if (node.type === "outputs") {
+        for (const fieldNode of Object.values(node.fields)) collectVarRefs(fieldNode, refs);
+    }
+    // num: nothing to add.
+    return refs;
+}
+
+// Confirms every var() reference anywhere in fn.body -- inside a
+// let-binding's own value, or in the final body/outputs -- corresponds
+// to something actually declared: a parameter, or a let binding
+// somewhere else in the same function. "Somewhere else", not
+// "somewhere earlier": collectLets's own doc comment already
+// establishes there's no real lexical scoping here -- every let-binding
+// is one flat, function-wide name -- so "declared anywhere in this
+// function" is the right, and only meaningful, check, not an
+// order-sensitive one.
+//
+// Catches a typo'd or forgotten identifier at the earliest possible
+// point, for every target and for evaluate() uniformly, rather than
+// relying on evaluate() happening to hit it at runtime (which it might
+// never do -- e.g. a reference inside a select() branch that a
+// particular call's arguments never take would never surface that way)
+// or on whichever target language's own compiler/runtime eventually
+// notices, with wildly inconsistent timing and clarity (a real compile
+// error in Java, a silent-until-called ReferenceError in JS). Confirmed
+// the gap first, not assumed: before this existed, emitAll() silently
+// succeeded across all 18 targets for a body referencing a completely
+// undeclared name.
+//
+// Also validates fn.name and every fn.params entry as safe identifiers
+// (see assertSafeIdentifier above) -- the SAME concern as every builder
+// above, just here instead of at a constructor call site, since
+// {name, params, body} is a plain object literal shape with no
+// constructor function of its own to hook into. This is the one place
+// every real consumption path (evaluate(), every emitter's
+// emitFunction(), cobol.js's own override) already runs unconditionally,
+// so it's the natural single checkpoint for this too.
+function checkUnboundVars(fn) {
+    assertSafeIdentifier(fn.name, "fn.name");
+    for (const p of fn.params) assertSafeIdentifier(p, "fn.params");
+
+    const { bindings, body } = collectLets(fn.body);
+    const declared = new Set([...fn.params, ...bindings.map((b) => b.name)]);
+
+    const referenced = new Set();
+    for (const { node } of bindings) collectVarRefs(node, referenced);
+    collectVarRefs(body, referenced);
+
+    for (const name of referenced) {
+        if (!declared.has(name)) {
+            throw new Error(
+                `checkUnboundVars: "${name}" is referenced in "${fn.name}" but never declared -- ` +
+                `not a parameter (${fn.params.length ? fn.params.join(", ") : "none"}) and no ` +
+                `"let ${name} = ..." binding exists anywhere in this function`,
+            );
+        }
+    }
+}
+
+module.exports = {
+    num, v, bin, call, add, mul, sub, div, neg, letIn, letChain, cmp, select, outputs, field, collectLets,
+    checkUnboundVars,
+    MACRO_GENSYM_PREFIX,
+};

package/emitters/base.js

@@ -26,7 +26,8 @@
 //                    suite gets emitted through this emitter; omitted
 //                    otherwise.
 
-const { collectLets } = require("../ast.js");
+const { collectLets, checkUnboundVars } = require("../ast.js");
+const { expandMacros, resolveExternForEmitter, withContext } = require("../macros.js");
 
 class Emitter {
     constructor(config) {
@@ -64,11 +65,23 @@ class Emitter {
             }
             case "call": {
                 const args = node.args.map((a) => this.emitExpr(a));
-                const template = this.calls[node.name];
+                // `this.lang` is injected by emitters/registry.js (the
+                // registered key, e.g. "js"/"cobol") -- not set for an
+                // Emitter built standalone outside the registry, in which
+                // case an extern simply never resolves here, same as an
+                // unmapped name.
+                const builtin = this.calls[node.name];
+                const template = builtin || (this.lang && resolveExternForEmitter(node.name, this.lang, this._registry));
                 if (!template) {
                     throw new Error(`emitter for .${this.ext}: no mapping for Math function "${node.name}"`);
                 }
-                return template(args);
+                // Only an extern's own per-target template is caller-
+                // supplied code that could have a bug worth attributing
+                // -- a built-in primitive's template is exprforge's own,
+                // not worth wrapping.
+                return builtin
+                    ? template(args)
+                    : withContext(`emitter for .${this.ext}: while emitting extern "${node.name}"`, () => template(args));
             }
             case "select": {
                 const thenStr = this.emitExpr(node.then);
@@ -89,7 +102,26 @@ class Emitter {
         }
     }
 
-    emitFunction(fn) {
+    // `registry` (see macros.js's createRegistry()) defaults to the
+    // process-wide default when omitted -- pass a session's own (see
+    // index.js's createSession()) to resolve macros/externs against that
+    // session instead. Stashed on `this` for emitExpr's "call" case to
+    // read, same instance-state pattern emitters/cobol.js's own
+    // `this._pool` already established.
+    emitFunction(fn, registry = undefined) {
+        this._registry = registry;
+        // Resolves every macro call and field() access into plain
+        // arithmetic first -- see macros.js's own header comment. Must
+        // run before checkUnboundVars: expansion is what introduces the
+        // flattened let-bindings a multi-output macro's fields become,
+        // and eliminates "field" nodes, which checkUnboundVars/
+        // collectLets don't know how to walk.
+        fn = expandMacros(fn, null, registry);
+        // Checked once, before any per-target work starts -- see
+        // checkUnboundVars's own comment in ast.js for why this matters
+        // (a typo'd/forgotten identifier used to silently succeed here,
+        // for every target, with no error at all).
+        checkUnboundVars(fn);
         const { bindings, body } = collectLets(fn.body);
         const letBindings = bindings.map(({ name, node }) => ({
             name,

package/emitters/cobol.js

@@ -34,6 +34,24 @@
 // machinery as select() itself, not a separate mechanism.
 const Emitter = require("./base.js");
 
+// Free-format COBOL (this file always emits >>SOURCE FORMAT FREE, see
+// formatFunction/formatSuite below) doesn't need or use the traditional
+// fixed-format column layout -- cols 1-6 sequence numbers, col 7
+// indicator area, content starting at col 8/"Area A" -- that's purely a
+// punch-card-era holdover, not something GnuCOBOL's free-format parser
+// requires. Confirmed by actually compiling with it removed (not just
+// reasoned about): the original 7/11/15-space margins compiled fine,
+// and so does this smaller scheme, run through the exact same
+// test/conformance.test.js COBOL checks. Kept a small, familiar
+// 4-space-per-nesting-level convention purely for readability's sake:
+// HDR (division/section/paragraph headers, 01-level declarations,
+// REPOSITORY entries) at column 1, STMT (top-level PROCEDURE DIVISION
+// statements) one level in, NESTED (statements inside an IF/ELSE, or a
+// wrapped line's continuation) one level deeper still.
+const HDR = "";
+const STMT = "    ";
+const NESTED = "        ";
+
 // COBOL reserved words plus every intrinsic-function name this emitter's
 // calls table depends on -- same role as QB64_RESERVED in emitters/qb64.js.
 // COBOL is case-insensitive, so names are checked lowercased. Not
@@ -91,6 +109,101 @@ function checkUsingClauseNames(names) {
     }
 }
 
+// See https://github.com/theraccoonbear/exprforge/issues/18 for the full
+// design rationale. Only PARAMETERS get this treatment, deliberately --
+// every one of this project's 18 targets calls functions positionally,
+// so a parameter's declared name is purely an internal binding, never
+// visible to a caller in ANY target, making a per-target rename here
+// completely invisible from the outside. fn.name and outputs() field
+// names are NOT included: both remain part of the actual calling
+// contract (CALL "name" USING ... for the function name; a suite's
+// field names are genuinely consumer-visible in every other target's
+// return shape -- a JS caller reads `result.c`), so those still throw
+// via checkUsingClauseNames above rather than silently diverging from
+// what the AST author wrote.
+//
+// The "EFLF_" prefix (ExprForge Language Fix) itself was verified
+// against a real compile+link+run before choosing it as-is, not
+// assumed safe just because it's a plausible-looking identifier: this
+// file already has a DIFFERENT confirmed finding that a COBOL
+// `FUNCTION` call breaks on an underscored name (see CMP_HELPERS above
+// -- why ef-cmp-* is hyphenated, never ef_cmp_*), which could easily
+// have meant the same restriction applies here too. It doesn't --
+// confirmed directly that `EFLF_c` compiles AND runs correctly used
+// exactly as a parameter name in a real `PROCEDURE DIVISION USING`
+// clause. That earlier finding was specifically about calling a
+// FUNCTION-ID *by name* (`FUNCTION word(...)`), not about declaring or
+// referencing a plain variable/parameter identifier, which is the only
+// thing this does.
+const RENAME_PREFIX = "EFLF_";
+
+// Rewrites every `v(name)` reference inside `node` to `v(renames.get(name))`
+// wherever `name` is a key in `renames`, recursively, leaving everything
+// else (including a nested let's OWN binding name -- only var REFERENCES
+// are ever renamed, never a let's declared name) untouched. Mirrors
+// collectLets's own node-type walk in ast.js exactly, since this needs to
+// see the identical tree shape before collectLets ever flattens it.
+function renameVarRefs(node, renames) {
+    const { v, bin, call, cmp, select, letIn, outputs } = require("../ast.js");
+    if (node.type === "var") {
+        return renames.has(node.name) ? v(renames.get(node.name)) : node;
+    }
+    if (node.type === "num") return node;
+    if (node.type === "bin") return bin(node.op, renameVarRefs(node.left, renames), renameVarRefs(node.right, renames));
+    if (node.type === "call") return call(node.name, ...node.args.map((a) => renameVarRefs(a, renames)));
+    if (node.type === "cmp") return cmp(renameVarRefs(node.left, renames), node.op, renameVarRefs(node.right, renames));
+    if (node.type === "select") {
+        return select(renameVarRefs(node.cond, renames), renameVarRefs(node.then, renames), renameVarRefs(node.else, renames));
+    }
+    if (node.type === "let") return letIn(node.name, renameVarRefs(node.value, renames), renameVarRefs(node.body, renames));
+    if (node.type === "outputs") {
+        const fields = {};
+        for (const [name, fieldNode] of Object.entries(node.fields)) {
+            fields[name] = renameVarRefs(fieldNode, renames);
+        }
+        return outputs(fields);
+    }
+    throw new Error(`emitter for .cob: renameConflictingParams: unknown node type "${node.type}"`);
+}
+
+// Returns a NEW {name, params, body} -- fn itself is never mutated -- with
+// any parameter colliding with `conflictSet` renamed to
+// `${RENAME_PREFIX}${originalName}` everywhere it's declared and
+// referenced. A no-op (returns fn unchanged) when nothing collides, so
+// this is always safe to call unconditionally at the top of
+// emitFunction.
+function renameConflictingParams(fn, conflictSet) {
+    const renames = new Map();
+    for (const p of fn.params) {
+        if (conflictSet.has(p.toLowerCase())) {
+            renames.set(p, `${RENAME_PREFIX}${p}`);
+        }
+    }
+    if (renames.size === 0) return fn;
+
+    const newParams = fn.params.map((p) => renames.get(p) ?? p);
+    // Defensive, not expected to ever actually fire given how narrow
+    // COBOL_USING_RESERVED is today -- but if a renamed param ever DID
+    // collide with another existing param (e.g. both "c" and "EFLF_c"
+    // used as real param names in the same function), that would
+    // silently produce a duplicate 01-level declaration and a real
+    // compiler error far from this code -- fail loudly here instead,
+    // at the actual point the ambiguity is introduced.
+    const seen = new Set();
+    for (const p of newParams) {
+        const lower = p.toLowerCase();
+        if (seen.has(lower)) {
+            throw new Error(
+                `emitter for .cob: renaming parameter to avoid a COBOL collision produced a duplicate ` +
+                `name ("${p}") -- rename your original "${p}"-colliding parameter directly instead`,
+            );
+        }
+        seen.add(lower);
+    }
+
+    return { name: fn.name, params: newParams, body: renameVarRefs(fn.body, renames) };
+}
+
 function fn1(name) {
     return ([x]) => `FUNCTION ${name}(${x})`;
 }
@@ -121,31 +234,31 @@ const CMP_HELPERS = {
 // statement per line -- confirmed against a real compiler that a missing
 // trailing period here breaks the DATA DIVISION that follows).
 const CMP_REPOSITORY =
-    `       REPOSITORY.\n` +
+    `${HDR}REPOSITORY.\n` +
     Object.values(CMP_HELPERS)
-        .map(({ suffix }, i, arr) => `           FUNCTION ef-cmp-${suffix}${i === arr.length - 1 ? "." : ""}`)
+        .map(({ suffix }, i, arr) => `${STMT}FUNCTION ef-cmp-${suffix}${i === arr.length - 1 ? "." : ""}`)
         .join("\n") +
     "\n";
 
 const CMP_HELPER_SOURCE = Object.values(CMP_HELPERS)
     .map(
-        ({ suffix, test }) => `       IDENTIFICATION DIVISION.
-       FUNCTION-ID. ef-cmp-${suffix}.
-       DATA DIVISION.
-       LINKAGE SECTION.
-       01 L USAGE COMP-2.
-       01 R USAGE COMP-2.
-       01 THEN-VAL USAGE COMP-2.
-       01 ELSE-VAL USAGE COMP-2.
-       01 RESULT USAGE COMP-2.
-       PROCEDURE DIVISION USING L R THEN-VAL ELSE-VAL RETURNING RESULT.
-           IF ${test}
-               MOVE THEN-VAL TO RESULT
-           ELSE
-               MOVE ELSE-VAL TO RESULT
-           END-IF
-           GOBACK.
-       END FUNCTION ef-cmp-${suffix}.
+        ({ suffix, test }) => `${HDR}IDENTIFICATION DIVISION.
+${HDR}FUNCTION-ID. ef-cmp-${suffix}.
+${HDR}DATA DIVISION.
+${HDR}LINKAGE SECTION.
+${HDR}01 L USAGE COMP-2.
+${HDR}01 R USAGE COMP-2.
+${HDR}01 THEN-VAL USAGE COMP-2.
+${HDR}01 ELSE-VAL USAGE COMP-2.
+${HDR}01 RESULT USAGE COMP-2.
+${HDR}PROCEDURE DIVISION USING L R THEN-VAL ELSE-VAL RETURNING RESULT.
+${STMT}IF ${test}
+${NESTED}MOVE THEN-VAL TO RESULT
+${STMT}ELSE
+${NESTED}MOVE ELSE-VAL TO RESULT
+${STMT}END-IF
+${STMT}GOBACK.
+${HDR}END FUNCTION ef-cmp-${suffix}.
 `,
     )
     .join("\n");
@@ -165,7 +278,7 @@ function wrapLine(line, maxWidth = 100) {
     for (const word of words) {
         if (current && current.length + 1 + word.length > maxWidth) {
             wrapped.push(current);
-            current = `               ${word}`;
+            current = `${NESTED}${word}`;
         } else {
             current = current ? `${current} ${word}` : word;
         }
@@ -200,14 +313,38 @@ class TempPool {
     spill(valueStr) {
         const name = `ef-tmp-${this.counter.next++}`;
         this.decls.push(name);
-        this.lines.push(wrapLine(`           COMPUTE ${name} = ${valueStr}`));
+        this.lines.push(wrapLine(`${STMT}COMPUTE ${name} = ${valueStr}`));
         return name;
     }
 }
 
 class CobolEmitter extends Emitter {
-    emitFunction(fn) {
-        const { collectLets } = require("../ast.js");
+    // `registry` -- see base.js's own emitFunction comment and
+    // macros.js's createRegistry()/index.js's createSession() -- same
+    // `this._registry` instance-state convention as base.js, read by the
+    // inherited emitExpr's "call" case for extern resolution.
+    emitFunction(fn, registry = undefined) {
+        this._registry = registry;
+        const { collectLets, checkUnboundVars } = require("../ast.js");
+        const { expandMacros } = require("../macros.js");
+        // This class overrides emitFunction entirely (never calls
+        // super.emitFunction), so it needs its own copy of the same two
+        // steps base.js's Emitter.emitFunction runs -- see
+        // expandMacros's and checkUnboundVars's own comments (in
+        // macros.js and ast.js respectively). Both run against the
+        // ORIGINAL fn, before renameConflictingParams runs below, so an
+        // error message reports whatever name the caller actually wrote,
+        // not an internally-renamed one (doesn't change which names are
+        // considered declared/resolved either way -- the rename is
+        // identity-preserving over the set of bound names, just changes
+        // their string).
+        fn = expandMacros(fn, null, registry);
+        checkUnboundVars(fn);
+        // Must run before collectLets, and before anything else in this
+        // function -- collectLets flattens the tree's let structure away,
+        // and every check/emission step below assumes fn.params is
+        // already COBOL-safe. See renameConflictingParams above.
+        fn = renameConflictingParams(fn, COBOL_USING_RESERVED);
         const { bindings, body } = collectLets(fn.body);
         const counter = { next: 0 };
 
@@ -219,7 +356,7 @@ class CobolEmitter extends Emitter {
             const valueStr = this.emitExpr(node);
             letLines.push(...this._pool.lines);
             letDecls.push(...this._pool.decls, name);
-            letLines.push(wrapLine(`           COMPUTE ${name} = ${valueStr}`));
+            letLines.push(wrapLine(`${STMT}COMPUTE ${name} = ${valueStr}`));
         }
 
         if (body.type === "outputs") {
@@ -426,52 +563,52 @@ const emitter = new CobolEmitter({
         checkReservedNames([fn.name, ...fn.params]);
         checkUsingClauseNames([fn.name, ...fn.params]);
         const linkageParams = [...fn.params, "ef-result"];
-        const paramDecls = linkageParams.map((p) => `       01 ${p} USAGE COMP-2.`).join("\n");
-        const wsDecls = letDecls.map((n) => `       01 ${n} USAGE COMP-2.`).join("\n");
-        return `       >>SOURCE FORMAT FREE\n` +
-               `      *> AUTO-GENERATED by ExprForge -- do not hand-edit.\n` +
+        const paramDecls = linkageParams.map((p) => `${HDR}01 ${p} USAGE COMP-2.`).join("\n");
+        const wsDecls = letDecls.map((n) => `${HDR}01 ${n} USAGE COMP-2.`).join("\n");
+        return `${HDR}>>SOURCE FORMAT FREE\n` +
+               `${HDR}*> AUTO-GENERATED by ExprForge -- do not hand-edit.\n` +
                CMP_HELPER_SOURCE + "\n" +
-               `       IDENTIFICATION DIVISION.\n` +
-               `       PROGRAM-ID. ${fn.name}.\n` +
-               `       ENVIRONMENT DIVISION.\n` +
-               `       CONFIGURATION SECTION.\n` +
+               `${HDR}IDENTIFICATION DIVISION.\n` +
+               `${HDR}PROGRAM-ID. ${fn.name}.\n` +
+               `${HDR}ENVIRONMENT DIVISION.\n` +
+               `${HDR}CONFIGURATION SECTION.\n` +
                CMP_REPOSITORY +
-               `       DATA DIVISION.\n` +
-               (wsDecls ? `       WORKING-STORAGE SECTION.\n${wsDecls}\n` : "") +
-               `       LINKAGE SECTION.\n` +
+               `${HDR}DATA DIVISION.\n` +
+               (wsDecls ? `${HDR}WORKING-STORAGE SECTION.\n${wsDecls}\n` : "") +
+               `${HDR}LINKAGE SECTION.\n` +
                paramDecls + "\n" +
-               `       PROCEDURE DIVISION USING ${linkageParams.join(" ")}.\n` +
+               `${HDR}PROCEDURE DIVISION USING ${linkageParams.join(" ")}.\n` +
                [...letLines, ...bodyLines].join("\n") + (letLines.length || bodyLines.length ? "\n" : "") +
-               wrapLine(`           COMPUTE ef-result = ${body}`) + "\n" +
-               `           GOBACK.\n` +
-               `       END PROGRAM ${fn.name}.\n`;
+               wrapLine(`${STMT}COMPUTE ef-result = ${body}`) + "\n" +
+               `${STMT}GOBACK.\n` +
+               `${HDR}END PROGRAM ${fn.name}.\n`;
     },
     formatSuite: (fn, outputStrs, letLines, letDecls, outputLines) => {
         const outputNames = Object.keys(outputStrs);
         checkReservedNames([fn.name, ...fn.params, ...outputNames]);
         checkUsingClauseNames([fn.name, ...fn.params, ...outputNames]);
         const linkageParams = [...fn.params, ...outputNames];
-        const paramDecls = linkageParams.map((p) => `       01 ${p} USAGE COMP-2.`).join("\n");
-        const wsDecls = letDecls.map((n) => `       01 ${n} USAGE COMP-2.`).join("\n");
-        const assigns = outputNames.map((n) => wrapLine(`           COMPUTE ${n} = ${outputStrs[n]}`)).join("\n");
-        return `       >>SOURCE FORMAT FREE\n` +
-               `      *> AUTO-GENERATED by ExprForge -- do not hand-edit.\n` +
+        const paramDecls = linkageParams.map((p) => `${HDR}01 ${p} USAGE COMP-2.`).join("\n");
+        const wsDecls = letDecls.map((n) => `${HDR}01 ${n} USAGE COMP-2.`).join("\n");
+        const assigns = outputNames.map((n) => wrapLine(`${STMT}COMPUTE ${n} = ${outputStrs[n]}`)).join("\n");
+        return `${HDR}>>SOURCE FORMAT FREE\n` +
+               `${HDR}*> AUTO-GENERATED by ExprForge -- do not hand-edit.\n` +
                CMP_HELPER_SOURCE + "\n" +
-               `       IDENTIFICATION DIVISION.\n` +
-               `       PROGRAM-ID. ${fn.name}.\n` +
-               `       ENVIRONMENT DIVISION.\n` +
-               `       CONFIGURATION SECTION.\n` +
+               `${HDR}IDENTIFICATION DIVISION.\n` +
+               `${HDR}PROGRAM-ID. ${fn.name}.\n` +
+               `${HDR}ENVIRONMENT DIVISION.\n` +
+               `${HDR}CONFIGURATION SECTION.\n` +
                CMP_REPOSITORY +
-               `       DATA DIVISION.\n` +
-               (wsDecls ? `       WORKING-STORAGE SECTION.\n${wsDecls}\n` : "") +
-               `       LINKAGE SECTION.\n` +
+               `${HDR}DATA DIVISION.\n` +
+               (wsDecls ? `${HDR}WORKING-STORAGE SECTION.\n${wsDecls}\n` : "") +
+               `${HDR}LINKAGE SECTION.\n` +
                paramDecls + "\n" +
-               `       PROCEDURE DIVISION USING ${linkageParams.join(" ")}.\n` +
+               `${HDR}PROCEDURE DIVISION USING ${linkageParams.join(" ")}.\n` +
                (letLines.length ? letLines.join("\n") + "\n" : "") +
                (outputLines.length ? outputLines.join("\n") + "\n" : "") +
                assigns + "\n" +
-               `           GOBACK.\n` +
-               `       END PROGRAM ${fn.name}.\n`;
+               `${STMT}GOBACK.\n` +
+               `${HDR}END PROGRAM ${fn.name}.\n`;
     },
 });