gitnexus 1.6.9 → 1.6.10-rc.10

package/dist/core/group/extractors/http-patterns/python.js

@@ -1,6 +1,7 @@
 import Python from 'tree-sitter-python';
 import { compilePatterns, runCompiledPatterns, unquoteLiteral, } from '../tree-sitter-scanner.js';
 import { normalizeExtractedRoutePath } from '../../../ingestion/route-extractors/route-path.js';
+import { extractPythonModuleConstants, parseConstOperands, resolveOperands, } from '../../../ingestion/route-extractors/python-const-resolver.js';
 /**
  * Python HTTP plugin. Handles:
  *   - FastAPI `@app.get("/path")` provider decorators
@@ -67,6 +68,44 @@ const FASTAPI_ROUTER_PATTERNS = compilePatterns({
         },
     ],
 });
+// #2391: `@router.<verb>` / `@app.<verb>` whose first argument is a non-literal
+// path — a bare imported constant or a `+`-concatenation. The path is resolved
+// against the repo-wide constant map (parity with the ingestion side) and, on
+// failure, the route is skipped (no provider contract) exactly like ingestion.
+const FASTAPI_ROUTER_EXPR_PATTERNS = compilePatterns({
+    name: 'python-fastapi-router-expr',
+    language: Python,
+    patterns: [
+        {
+            meta: {},
+            query: `
+        (decorator
+          (call
+            function: (attribute
+              object: (identifier) @obj (#eq? @obj "router")
+              attribute: (identifier) @method (#match? @method "^(get|post|put|delete|patch)$"))
+            arguments: (argument_list . [(identifier) (binary_operator)] @path)))
+      `,
+        },
+    ],
+});
+const FASTAPI_APP_EXPR_PATTERNS = compilePatterns({
+    name: 'python-fastapi-app-expr',
+    language: Python,
+    patterns: [
+        {
+            meta: {},
+            query: `
+        (decorator
+          (call
+            function: (attribute
+              object: (identifier) @obj (#eq? @obj "app")
+              attribute: (identifier) @method (#match? @method "^(get|post|put|delete|patch)$"))
+            arguments: (argument_list . [(identifier) (binary_operator)] @path)))
+      `,
+        },
+    ],
+});
 // ─── Provider: Flask `app.add_url_rule('/path', view_func=handler)` ───
 // The imperative Flask route registration: unlike `@app.route` (whose handler
 // is the decorated function, same-file), `view_func` is frequently an IMPORTED
@@ -830,111 +869,153 @@ function recordPrefix(target, key, prefix) {
     set.add(prefix);
     target.set(key, set);
 }
+// Cheap cost-gate pre-filter: a `@router`/`@app.<verb>(` call whose first
+// argument is non-literal — either it STARTS with an identifier (a bare constant
+// or the head of `CONST + "/x"`), or it is a string-literal-LEADING concat
+// (`"/api" + SUFFIX`) detected by a `+` before the decorator's closing paren
+// (#2393). `[^)]*` spans the whole argument, including a Black-formatted concat
+// that wraps across lines, but stays bounded by the decorator's own `)`. Gating
+// the literal-leading case on the `+` (not merely a leading quote) keeps a plain
+// string route `@router.get("/x")` OFF the gate, so a literal-only repo pays no
+// parse pass. Deliberately loose — a false positive only costs a parse; a false
+// negative would silently drop the feature.
+const NONLITERAL_ROUTE_DECORATOR_RE = /@\s*(?:app|router)\s*\.\s*(?:get|post|put|delete|patch)\s*\(\s*(?:[A-Za-z_]|["'][^)]*\+)/;
 function buildPythonRepoContext(files, parser, readFile, parseSource) {
     const prefixesByLongKey = new Map();
     const prefixesByShortKey = new Map();
-    // Cross-file pre-pass: only `include_router` sites need it — they bind a
-    // prefix declared in one file to a router defined in another. Same-file
-    // `APIRouter(prefix=...)` is resolved in scan() from the file's own tree, so
-    // APIRouter-only files are left out here and never parsed twice.
+    // Single read pass (#2393): slurp every `.py` file's content ONCE. This used to
+    // be two passes — the include_router pre-pass below and the #2391 constant cost
+    // gate each re-read every `.py` file. The composed-route cost gate is computed
+    // in the same pass so a literal-only repo still does exactly one read and zero
+    // parses.
+    const pyContents = new Map();
+    let hasComposedRoute = false;
     for (const rel of files) {
         if (!rel.endsWith('.py'))
             continue;
         const src = readFile(rel);
         if (!src)
             continue;
-        if (!src.includes('include_router'))
+        pyContents.set(rel, src);
+        if (!hasComposedRoute && NONLITERAL_ROUTE_DECORATOR_RE.test(src))
+            hasComposedRoute = true;
+    }
+    // Single PARSE pass (#2391): parse each `.py` at most once and feed BOTH the
+    // include_router prefix pre-pass and the composed-constant map below. This used
+    // to be two loops, so an include_router file in a composed repo was parsed
+    // twice. A file that needs neither pass is not parsed at all (cost gates intact).
+    //
+    // Cross-file pre-pass: only `include_router` sites need it — they bind a prefix
+    // declared in one file to a router defined in another. Same-file
+    // `APIRouter(prefix=...)` is resolved in scan() from the file's own tree.
+    const constantsByFile = new Map();
+    for (const [rel, src] of pyContents) {
+        const needsRouter = src.includes('include_router');
+        if (!needsRouter && !hasComposedRoute)
             continue;
         parser.setLanguage(Python);
         const tree = parseSource(parser, src);
         if (!tree)
             continue;
-        const localNameToModule = new Map();
-        for (const m of runCompiledPatterns(FROM_IMPORT_ROUTER_PATTERNS, tree)) {
-            const moduleNode = m.captures.module;
-            const aliasNode = m.captures.alias;
-            const importedNode = m.captures.imported;
-            if (!moduleNode || !importedNode)
-                continue;
-            const localName = aliasNode?.text ?? importedNode.text;
-            const moduleShort = lastSegmentOfDotted(moduleNode.text);
-            if (!moduleShort)
-                continue;
-            const moduleLong = lastTwoSegmentsAsLongKey(moduleNode.text);
-            localNameToModule.set(localName, { moduleShort, moduleLong });
-        }
-        // Module-alias map: name imported from a multi-segment package →
-        // long key. Lets Shape A look up the precise file for `<name>.router`
-        // even when `<name>` collides with another package's basename.
-        const localNameToModuleAlias = new Map();
-        for (const m of runCompiledPatterns(FROM_IMPORT_MODULE_PATTERNS, tree)) {
-            const moduleNode = m.captures.module;
-            const importedNode = m.captures.imported;
-            const aliasNode = m.captures.alias;
-            if (!moduleNode || !importedNode)
-                continue;
-            // Skip the `router` shape — already handled by FROM_IMPORT_ROUTER_PATTERNS
-            // above and stored under its router-aware semantics.
-            if (importedNode.text === 'router')
-                continue;
-            const moduleLong = lastTwoSegmentsAsLongKey(`${moduleNode.text}.${importedNode.text}`);
-            if (!moduleLong)
-                continue;
-            const localName = aliasNode?.text ?? importedNode.text;
-            localNameToModuleAlias.set(localName, moduleLong);
-        }
-        // Shape A: `<host>.include_router(<module>.router, prefix='/x')`.
-        // The call site gives us only a short module name. We promote to a
-        // long key when the same file imports `<module>` via either
-        // `from <pkg> import <module>` (recorded in `localNameToModuleAlias`
-        // — the typical pattern) or, less commonly, a router-aware import
-        // statement. Only fall back to the basename short key when neither
-        // alias is available.
-        for (const m of runCompiledPatterns(INCLUDE_ROUTER_ATTR_PATTERNS, tree)) {
-            const modNode = m.captures.router_module;
-            const prefixNode = m.captures.prefix;
-            if (!modNode || !prefixNode)
-                continue;
-            const prefix = unquoteLiteral(prefixNode.text);
-            if (prefix === null)
-                continue;
-            const moduleShort = modNode.text;
-            const aliasLong = localNameToModuleAlias.get(moduleShort);
-            const sameFileImport = localNameToModule.get(moduleShort);
-            const longKey = aliasLong ?? sameFileImport?.moduleLong;
-            if (longKey) {
-                recordPrefix(prefixesByLongKey, longKey, prefix);
+        if (needsRouter) {
+            const localNameToModule = new Map();
+            for (const m of runCompiledPatterns(FROM_IMPORT_ROUTER_PATTERNS, tree)) {
+                const moduleNode = m.captures.module;
+                const aliasNode = m.captures.alias;
+                const importedNode = m.captures.imported;
+                if (!moduleNode || !importedNode)
+                    continue;
+                const localName = aliasNode?.text ?? importedNode.text;
+                const moduleShort = lastSegmentOfDotted(moduleNode.text);
+                if (!moduleShort)
+                    continue;
+                const moduleLong = lastTwoSegmentsAsLongKey(moduleNode.text);
+                localNameToModule.set(localName, { moduleShort, moduleLong });
             }
-            else {
-                recordPrefix(prefixesByShortKey, moduleShort, prefix);
+            // Module-alias map: name imported from a multi-segment package →
+            // long key. Lets Shape A look up the precise file for `<name>.router`
+            // even when `<name>` collides with another package's basename.
+            const localNameToModuleAlias = new Map();
+            for (const m of runCompiledPatterns(FROM_IMPORT_MODULE_PATTERNS, tree)) {
+                const moduleNode = m.captures.module;
+                const importedNode = m.captures.imported;
+                const aliasNode = m.captures.alias;
+                if (!moduleNode || !importedNode)
+                    continue;
+                // Skip the `router` shape — already handled by FROM_IMPORT_ROUTER_PATTERNS
+                // above and stored under its router-aware semantics.
+                if (importedNode.text === 'router')
+                    continue;
+                const moduleLong = lastTwoSegmentsAsLongKey(`${moduleNode.text}.${importedNode.text}`);
+                if (!moduleLong)
+                    continue;
+                const localName = aliasNode?.text ?? importedNode.text;
+                localNameToModuleAlias.set(localName, moduleLong);
             }
-        }
-        // Shape B: `<host>.include_router(my_router, prefix='/x')` — resolve
-        // `my_router` via the import map built above. Whenever the import
-        // statement supplied a multi-segment module path the long key is
-        // recorded, eliminating cross-package collisions.
-        for (const m of runCompiledPatterns(INCLUDE_ROUTER_NAME_PATTERNS, tree)) {
-            const nameNode = m.captures.router_name;
-            const prefixNode = m.captures.prefix;
-            if (!nameNode || !prefixNode)
-                continue;
-            const localImp = localNameToModule.get(nameNode.text);
-            if (!localImp)
-                continue;
-            const prefix = unquoteLiteral(prefixNode.text);
-            if (prefix === null)
-                continue;
-            if (localImp.moduleLong) {
-                recordPrefix(prefixesByLongKey, localImp.moduleLong, prefix);
+            // Shape A: `<host>.include_router(<module>.router, prefix='/x')`.
+            // The call site gives us only a short module name. We promote to a
+            // long key when the same file imports `<module>` via either
+            // `from <pkg> import <module>` (recorded in `localNameToModuleAlias`
+            // — the typical pattern) or, less commonly, a router-aware import
+            // statement. Only fall back to the basename short key when neither
+            // alias is available.
+            for (const m of runCompiledPatterns(INCLUDE_ROUTER_ATTR_PATTERNS, tree)) {
+                const modNode = m.captures.router_module;
+                const prefixNode = m.captures.prefix;
+                if (!modNode || !prefixNode)
+                    continue;
+                const prefix = unquoteLiteral(prefixNode.text);
+                if (prefix === null)
+                    continue;
+                const moduleShort = modNode.text;
+                const aliasLong = localNameToModuleAlias.get(moduleShort);
+                const sameFileImport = localNameToModule.get(moduleShort);
+                const longKey = aliasLong ?? sameFileImport?.moduleLong;
+                if (longKey) {
+                    recordPrefix(prefixesByLongKey, longKey, prefix);
+                }
+                else {
+                    recordPrefix(prefixesByShortKey, moduleShort, prefix);
+                }
             }
-            else {
-                recordPrefix(prefixesByShortKey, localImp.moduleShort, prefix);
+            // Shape B: `<host>.include_router(my_router, prefix='/x')` — resolve
+            // `my_router` via the import map built above. Whenever the import
+            // statement supplied a multi-segment module path the long key is
+            // recorded, eliminating cross-package collisions.
+            for (const m of runCompiledPatterns(INCLUDE_ROUTER_NAME_PATTERNS, tree)) {
+                const nameNode = m.captures.router_name;
+                const prefixNode = m.captures.prefix;
+                if (!nameNode || !prefixNode)
+                    continue;
+                const localImp = localNameToModule.get(nameNode.text);
+                if (!localImp)
+                    continue;
+                const prefix = unquoteLiteral(prefixNode.text);
+                if (prefix === null)
+                    continue;
+                if (localImp.moduleLong) {
+                    recordPrefix(prefixesByLongKey, localImp.moduleLong, prefix);
+                }
+                else {
+                    recordPrefix(prefixesByShortKey, localImp.moduleShort, prefix);
+                }
+            }
+        }
+        // #2391: build the repo-wide constant map for resolving non-literal decorator
+        // paths (KTD6 cost gate: only when `hasComposedRoute`). Parse EVERY `.py` so
+        // the resolvable set matches the ingestion aggregate (R4 parity) — a narrower
+        // set would return null where ingestion resolves.
+        if (hasComposedRoute) {
+            const mc = extractPythonModuleConstants(tree);
+            if (mc.literals.size > 0 || mc.exprs.size > 0 || mc.imports.size > 0) {
+                constantsByFile.set(rel, mc);
             }
         }
     }
     return {
         prefixesByLongKey,
         prefixesByShortKey,
+        constantsByFile,
     };
 }
 function joinPrefix(prefix, route) {
@@ -971,32 +1052,67 @@ export const PYTHON_HTTP_PLUGIN = {
         // statements, so an imperatively-registered handler (Flask `view_func`) that
         // is an imported (possibly aliased) symbol resolves to its real definition.
         const importMap = buildPythonImportMap(tree);
-        // Providers: FastAPI @app.<verb>("/path") — already absolute path.
-        for (const match of runCompiledPatterns(FASTAPI_APP_PATTERNS, tree)) {
-            const methodNode = match.captures.method;
-            const pathNode = match.captures.path;
-            if (!methodNode || !pathNode)
-                continue;
-            const httpMethod = FASTAPI_VERBS[methodNode.text];
-            if (!httpMethod)
-                continue;
-            const path = unquoteLiteral(pathNode.text);
-            if (path === null)
-                continue;
+        // #2391: fold a non-literal decorator argument (bare constant or
+        // `+`-concatenation) to its literal path against the repo constant map, or
+        // `null` → skip (the same floor the ingestion side applies, so provider
+        // contracts and graph Route nodes agree on both resolved and dropped routes).
+        const resolveExprArg = (argNode) => {
+            const cbf = ctx?.constantsByFile;
+            if (!cbf || !fileRel)
+                return null;
+            // Build an operand list and fold via `resolveOperands` — the SAME entry the
+            // ingestion side uses (parse-impl folds `routePathOperands`). Using the
+            // by-name `resolveConstant` here would enter `foldName` one depth shallower,
+            // so at the MAX_RESOLVE_DEPTH boundary the group would resolve a chain
+            // ingestion drops, breaking R4 parity (#2393).
+            const operands = argNode.type === 'identifier'
+                ? [{ kind: 'ref', name: argNode.text }]
+                : parseConstOperands(argNode);
+            return operands ? resolveOperands(fileRel, operands, cbf) : null;
+        };
+        const emitAppProvider = (httpMethod, pathVal, line) => {
             out.push({
                 role: 'provider',
                 framework: 'fastapi',
                 method: httpMethod,
-                path,
+                path: pathVal,
                 name: null,
                 // The decorated handler has no captured name → resolve by line-span
                 // containment. Best-effort fallback: FastAPI routes are graph-backed
                 // (ingestion decorator routes) and the function span starts at `def`
                 // (decorators excluded), so this lands the single-decorator case and
                 // degrades to file-level for multi-decorator stacks.
-                line: pathNode.startPosition.row + 1,
+                line,
                 confidence: 0.8,
             });
+        };
+        // Providers: FastAPI @app.<verb>("/path") — already absolute path.
+        for (const match of runCompiledPatterns(FASTAPI_APP_PATTERNS, tree)) {
+            const methodNode = match.captures.method;
+            const pathNode = match.captures.path;
+            if (!methodNode || !pathNode)
+                continue;
+            const httpMethod = FASTAPI_VERBS[methodNode.text];
+            if (!httpMethod)
+                continue;
+            const path = unquoteLiteral(pathNode.text);
+            if (path === null)
+                continue;
+            emitAppProvider(httpMethod, path, pathNode.startPosition.row + 1);
+        }
+        // Providers: FastAPI @app.<verb>(CONST | A + "/x") — resolved composed path.
+        for (const match of runCompiledPatterns(FASTAPI_APP_EXPR_PATTERNS, tree)) {
+            const methodNode = match.captures.method;
+            const pathNode = match.captures.path;
+            if (!methodNode || !pathNode)
+                continue;
+            const httpMethod = FASTAPI_VERBS[methodNode.text];
+            if (!httpMethod)
+                continue;
+            const resolved = resolveExprArg(pathNode);
+            if (resolved === null)
+                continue; // skip floor
+            emitAppProvider(httpMethod, resolved, pathNode.startPosition.row + 1);
         }
         // Django providers come from the graph Route nodes (includes composed by
         // the ingestion route extractor), not a per-file source scan — see the note
@@ -1020,17 +1136,11 @@ export const PYTHON_HTTP_PLUGIN = {
         // change is strictly additive vs. the prior @app-only behaviour;
         // when the same router is mounted under multiple prefixes we emit
         // one detection per prefix.
-        for (const match of runCompiledPatterns(FASTAPI_ROUTER_PATTERNS, tree)) {
-            const methodNode = match.captures.method;
-            const pathNode = match.captures.path;
-            if (!methodNode || !pathNode)
-                continue;
-            const httpMethod = FASTAPI_VERBS[methodNode.text];
-            if (!httpMethod)
-                continue;
-            const rawPath = unquoteLiteral(pathNode.text);
-            if (rawPath === null)
-                continue;
+        // Join a `@router.<verb>` path with the include_router / APIRouter prefix(es)
+        // that apply to this file and emit one provider detection per prefix. Shared
+        // by the literal and the #2391 non-literal (resolved) router loops so both
+        // stack prefixes identically.
+        const emitRouterProvider = (httpMethod, rawPath, line) => {
             // Long key first (precise, package-aware), short key as fallback.
             // Mirrors the ingestion-side resolution in parse-impl.ts so the
             // graph nodes and group contracts agree on which prefix applies.
@@ -1053,10 +1163,38 @@ export const PYTHON_HTTP_PLUGIN = {
                     path: p,
                     name: null,
                     // Best-effort containment fallback — see the @app provider note above.
-                    line: pathNode.startPosition.row + 1,
+                    line,
                     confidence: 0.8,
                 });
             }
+        };
+        for (const match of runCompiledPatterns(FASTAPI_ROUTER_PATTERNS, tree)) {
+            const methodNode = match.captures.method;
+            const pathNode = match.captures.path;
+            if (!methodNode || !pathNode)
+                continue;
+            const httpMethod = FASTAPI_VERBS[methodNode.text];
+            if (!httpMethod)
+                continue;
+            const rawPath = unquoteLiteral(pathNode.text);
+            if (rawPath === null)
+                continue;
+            emitRouterProvider(httpMethod, rawPath, pathNode.startPosition.row + 1);
+        }
+        // Providers: FastAPI @router.<verb>(CONST | A + "/x") — resolved composed path
+        // (#2391). Null resolution → skip, so provider/graph parity holds.
+        for (const match of runCompiledPatterns(FASTAPI_ROUTER_EXPR_PATTERNS, tree)) {
+            const methodNode = match.captures.method;
+            const pathNode = match.captures.path;
+            if (!methodNode || !pathNode)
+                continue;
+            const httpMethod = FASTAPI_VERBS[methodNode.text];
+            if (!httpMethod)
+                continue;
+            const resolved = resolveExprArg(pathNode);
+            if (resolved === null)
+                continue;
+            emitRouterProvider(httpMethod, resolved, pathNode.startPosition.row + 1);
         }
         // Providers: Flask `app.add_url_rule('/path', view_func=handler, methods=[…])`.
         // The handler is a `view_func` identifier, frequently an imported (possibly

package/dist/core/group/extractors/manifest-extractor.js

@@ -7,6 +7,10 @@ import { logger } from '../../logger.js';
 // reserved-keyword labels `Macro` and `Union`, and LadybugDB's parser rejects
 // a disjunction that names a reserved keyword (#2325) — which the resolver's
 // try/catch then swallowed. `labels(n) IN` has no such collision.
+// This list overlaps `ingestion/utils/symbol-labels.ts` (SYMBOL_NODE_LABELS) but
+// is a deliberate SUBSET — it omits `Namespace`/`Variable`/`Module`. Unifying the
+// two would widen which nodes resolve as contract symbols and must update the
+// #2325 test, so they are intentionally kept separate for now.
 export const CUSTOM_CONTRACT_RESOLVE_QUERY = `MATCH (n)
    WHERE labels(n) IN ['Function','Method','Class','Interface','Struct','Enum','Trait','Constructor','TypeAlias','Impl','Macro','Union','Typedef','Property','Record','Delegate','Annotation','Template','Const','Static','CodeElement']
      AND n.name = $symbolName

package/dist/core/ingestion/cobol/jcl-processor.js

@@ -17,6 +17,7 @@
  */
 import { parseJcl } from './jcl-parser.js';
 import { generateId } from '../../../lib/utils.js';
+import { toZeroBasedLine } from '../utils/line-base.js';
 /**
  * Process JCL files and integrate into the knowledge graph.
  *
@@ -71,8 +72,8 @@ function integrateJclResults(graph, parsed, filePath, moduleNames) {
             properties: {
                 name: job.name,
                 filePath,
-                startLine: job.line,
-                endLine: job.line,
+                startLine: toZeroBasedLine(job.line),
+                endLine: toZeroBasedLine(job.line),
                 description: `jcl-job${classPart}${msgPart}`,
             },
         });
@@ -105,8 +106,8 @@ function integrateJclResults(graph, parsed, filePath, moduleNames) {
             properties: {
                 name: step.name,
                 filePath,
-                startLine: step.line,
-                endLine: step.line,
+                startLine: toZeroBasedLine(step.line),
+                endLine: toZeroBasedLine(step.line),
                 description: `jcl-step${pgmPart}${procPart}`,
             },
         });
@@ -170,8 +171,8 @@ function integrateJclResults(graph, parsed, filePath, moduleNames) {
                 properties: {
                     name: dd.dataset,
                     filePath,
-                    startLine: dd.line,
-                    endLine: dd.line,
+                    startLine: toZeroBasedLine(dd.line),
+                    endLine: toZeroBasedLine(dd.line),
                     description: `jcl-dataset${dispPart}`,
                 },
             });
@@ -202,8 +203,8 @@ function integrateJclResults(graph, parsed, filePath, moduleNames) {
             properties: {
                 name: proc.name,
                 filePath,
-                startLine: proc.line,
-                endLine: proc.line,
+                startLine: toZeroBasedLine(proc.line),
+                endLine: toZeroBasedLine(proc.line),
                 description: 'jcl-proc-instream',
             },
         });

package/dist/core/ingestion/cobol-processor.js

@@ -14,6 +14,7 @@
  */
 import path from 'node:path';
 import { generateId } from '../../lib/utils.js';
+import { toZeroBasedLine } from './utils/line-base.js';
 import { SupportedLanguages } from '../../_shared/index.js';
 import { preprocessCobolSource, extractCobolSymbolsWithRegex, } from './cobol/cobol-preprocessor.js';
 import { expandCopies } from './cobol/cobol-copy-expander.js';
@@ -275,8 +276,8 @@ function mapToGraph(graph, extracted, file, copyResolutions, moduleNodeIds) {
             properties: {
                 name: extracted.programName,
                 filePath,
-                startLine: 1,
-                endLine: lines.length,
+                startLine: toZeroBasedLine(1),
+                endLine: toZeroBasedLine(lines.length),
                 language: SupportedLanguages.Cobol,
                 isExported: true,
                 description: metaDesc || undefined,
@@ -310,8 +311,8 @@ function mapToGraph(graph, extracted, file, copyResolutions, moduleNodeIds) {
             properties: {
                 name: prog.name,
                 filePath,
-                startLine: prog.startLine,
-                endLine: prog.endLine,
+                startLine: toZeroBasedLine(prog.startLine),
+                endLine: toZeroBasedLine(prog.endLine),
                 language: SupportedLanguages.Cobol,
                 isExported: true,
                 description: `nested-program${prog.isCommon ? ' common' : ''}`,
@@ -349,8 +350,8 @@ function mapToGraph(graph, extracted, file, copyResolutions, moduleNodeIds) {
             properties: {
                 name: sec.name,
                 filePath,
-                startLine: sec.line,
-                endLine: nextLine,
+                startLine: toZeroBasedLine(sec.line),
+                endLine: toZeroBasedLine(nextLine),
                 language: SupportedLanguages.Cobol,
                 isExported: true,
             },
@@ -379,8 +380,8 @@ function mapToGraph(graph, extracted, file, copyResolutions, moduleNodeIds) {
             properties: {
                 name: para.name,
                 filePath,
-                startLine: para.line,
-                endLine: nextLine,
+                startLine: toZeroBasedLine(para.line),
+                endLine: toZeroBasedLine(nextLine),
                 language: SupportedLanguages.Cobol,
                 isExported: true,
             },
@@ -412,8 +413,8 @@ function mapToGraph(graph, extracted, file, copyResolutions, moduleNodeIds) {
             properties: {
                 name: item.name,
                 filePath,
-                startLine: item.line,
-                endLine: item.line,
+                startLine: toZeroBasedLine(item.line),
+                endLine: toZeroBasedLine(item.line),
                 language: SupportedLanguages.Cobol,
                 description: `level:${item.level} section:${item.section}${item.pic ? ` pic:${item.pic}` : ''}`,
             },
@@ -506,8 +507,8 @@ function mapToGraph(graph, extracted, file, copyResolutions, moduleNodeIds) {
                 properties: {
                     name: `CALL ${call.target}`,
                     filePath,
-                    startLine: call.line,
-                    endLine: call.line,
+                    startLine: toZeroBasedLine(call.line),
+                    endLine: toZeroBasedLine(call.line),
                     language: SupportedLanguages.Cobol,
                     description: 'dynamic-call (target is a data item, not resolvable statically)',
                 },
@@ -619,8 +620,8 @@ function mapToGraph(graph, extracted, file, copyResolutions, moduleNodeIds) {
             properties: {
                 name: `EXEC SQL ${sql.operation}`,
                 filePath,
-                startLine: sql.line,
-                endLine: sql.line,
+                startLine: toZeroBasedLine(sql.line),
+                endLine: toZeroBasedLine(sql.line),
                 language: SupportedLanguages.Cobol,
                 description: `tables:[${sql.tables.join(',')}] cursors:[${sql.cursors.join(',')}]`,
             },
@@ -691,8 +692,8 @@ function mapToGraph(graph, extracted, file, copyResolutions, moduleNodeIds) {
             properties: {
                 name: `EXEC CICS ${cics.command}`,
                 filePath,
-                startLine: cics.line,
-                endLine: cics.line,
+                startLine: toZeroBasedLine(cics.line),
+                endLine: toZeroBasedLine(cics.line),
                 language: SupportedLanguages.Cobol,
                 description: [
                     cics.mapName && `map:${cics.mapName}`,
@@ -726,8 +727,8 @@ function mapToGraph(graph, extracted, file, copyResolutions, moduleNodeIds) {
                     properties: {
                         name: `CICS ${cics.command} ${cics.programName}`,
                         filePath,
-                        startLine: cics.line,
-                        endLine: cics.line,
+                        startLine: toZeroBasedLine(cics.line),
+                        endLine: toZeroBasedLine(cics.line),
                         language: SupportedLanguages.Cobol,
                         description: `cics-dynamic-program (target is data item ${cics.programName})`,
                     },
@@ -879,8 +880,8 @@ function mapToGraph(graph, extracted, file, copyResolutions, moduleNodeIds) {
             properties: {
                 name: entry.name,
                 filePath,
-                startLine: entry.line,
-                endLine: entry.line,
+                startLine: toZeroBasedLine(entry.line),
+                endLine: toZeroBasedLine(entry.line),
                 language: SupportedLanguages.Cobol,
                 isExported: true,
                 description: entry.parameters.length > 0 ? `using:${entry.parameters.join(',')}` : undefined,
@@ -1014,8 +1015,8 @@ function mapToGraph(graph, extracted, file, copyResolutions, moduleNodeIds) {
             properties: {
                 name: `EXEC DLI ${dli.verb}`,
                 filePath,
-                startLine: dli.line,
-                endLine: dli.line,
+                startLine: toZeroBasedLine(dli.line),
+                endLine: toZeroBasedLine(dli.line),
                 language: SupportedLanguages.Cobol,
                 description: [
                     dli.segmentName && `segment:${dli.segmentName}`,
@@ -1148,8 +1149,8 @@ function mapToGraph(graph, extracted, file, copyResolutions, moduleNodeIds) {
             properties: {
                 name: fd.selectName,
                 filePath,
-                startLine: fd.line,
-                endLine: fd.line,
+                startLine: toZeroBasedLine(fd.line),
+                endLine: toZeroBasedLine(fd.line),
                 language: SupportedLanguages.Cobol,
                 description: `assign:${fd.assignTo}${fd.isOptional ? ' optional' : ''}${fd.organization ? ` org:${fd.organization}` : ''}${fd.access ? ` access:${fd.access}` : ''}`,
             },
@@ -1231,8 +1232,8 @@ function mapToGraph(graph, extracted, file, copyResolutions, moduleNodeIds) {
                 properties: {
                     name: `CANCEL ${cancel.target}`,
                     filePath,
-                    startLine: cancel.line,
-                    endLine: cancel.line,
+                    startLine: toZeroBasedLine(cancel.line),
+                    endLine: toZeroBasedLine(cancel.line),
                     language: SupportedLanguages.Cobol,
                     description: 'dynamic-cancel (target is a data item, not resolvable statically)',
                 },