al-sem 0.0.1

package/src/model/entities.ts

@@ -0,0 +1,628 @@
+import type { AttributeInfo } from "./attributes.ts";
+import type { Callee } from "./callee.ts";
+import type { ValueSource } from "./capability.ts";
+import type { ExpressionInfo } from "./expression.ts";
+import type { SourceAnchor } from "./identity.ts";
+import type {
+	CallsiteId,
+	CanonicalRoutineKey,
+	FieldId,
+	KeyId,
+	LoopId,
+	ObjectId,
+	OperationId,
+	RecordVariableId,
+	RoutineId,
+	RoutineKind,
+	TableId,
+} from "./ids.ts";
+import type { RoutineSummary } from "./summary.ts";
+
+/** Whether an entity is under analysis ("primary") or merged-in context only ("dependency"). */
+export type AnalysisRole = "primary" | "dependency";
+
+/** Resolve an entity's analysis role; an absent `analysisRole` means "primary". */
+export function roleOf(x: { analysisRole?: AnalysisRole }): AnalysisRole {
+	return x.analysisRole ?? "primary";
+}
+
+/** Output scope for CLI/report surfaces. "primary" keeps only the workspace's own
+ *  app(s); "all" keeps the full merged model (workspace + dependencies). */
+export type Scope = "primary" | "all";
+
+export type RecordOpType =
+	| "FindSet"
+	| "FindFirst"
+	| "FindLast"
+	| "Find"
+	| "Get"
+	| "CalcFields"
+	| "CalcSums"
+	| "TestField"
+	| "Modify"
+	| "ModifyAll"
+	| "Insert"
+	| "Delete"
+	| "DeleteAll"
+	| "SetLoadFields"
+	| "AddLoadFields"
+	| "SetRange"
+	| "SetFilter"
+	| "SetCurrentKey"
+	| "Reset"
+	| "Copy"
+	| "TransferFields"
+	| "Validate"
+	| "Init"
+	| "Next"
+	| "Count"
+	| "CountApprox"
+	| "IsEmpty"
+	| "LockTable";
+
+/**
+ * Whether a record variable is temporary. Can be caller-dependent when the record is a
+ * by-var/value parameter — see spec Section 2.
+ */
+export type TempState =
+	| { kind: "known"; value: boolean }
+	| { kind: "unknown" }
+	| { kind: "parameter-dependent"; parameterIndex: number };
+
+export interface ParameterSymbol {
+	index: number;
+	name: string;
+	typeText: string; // raw type string, e.g. 'Record "Sales Line"'
+	isVar: boolean; // passed by reference
+	isRecord: boolean;
+	tableName?: string; // when isRecord
+}
+
+export interface App {
+	appGuid: string;
+	publisher: string;
+	name: string;
+	version: string;
+	analysisRole?: AnalysisRole;
+}
+
+export interface ObjectDecl {
+	id: ObjectId;
+	appGuid: string;
+	objectType: string; // "Codeunit", "Table", "TableExtension", "Page", ...
+	objectNumber: number;
+	name: string;
+	sourceUnitId: string;
+	sourceHash: string;
+	sourceAnchor: SourceAnchor;
+	analysisRole?: AnalysisRole;
+	/**
+	 * Codeunit Subtype property value when declared (e.g. "Install", "Upgrade",
+	 * "Test", "Normal"). Undefined for non-codeunit objects or when not declared.
+	 * Verbatim from the AL source (preserves casing).
+	 */
+	objectSubtype?: string;
+	/**
+	 * Page PageType property value when declared (e.g. "API", "List", "Card").
+	 * Undefined for non-page objects or when not declared. Verbatim from the AL source.
+	 */
+	pageType?: string;
+}
+
+/** FieldClass + ownership. Ownership follows the declaring object (may be a tableextension). */
+export interface Field {
+	id: FieldId;
+	physicalTableId: TableId;
+	declaringObjectId: ObjectId;
+	declaringAppId: string; // appGuid
+	fieldNumber: number;
+	name: string;
+	fieldClass: "Normal" | "FlowField" | "FlowFilter";
+	dataType: string;
+	isBlobLike: boolean;
+}
+
+export interface Key {
+	id: KeyId;
+	physicalTableId: TableId;
+	declaringObjectId: ObjectId;
+	fields: FieldId[];
+	sumIndexFields?: FieldId[];
+	isEnabled?: boolean | "unknown";
+}
+
+export interface Table {
+	id: TableId;
+	appGuid: string;
+	tableNumber: number;
+	name: string;
+	fields: Field[];
+	keys: Key[];
+}
+
+export type LoopType = "repeat" | "for" | "foreach" | "while";
+
+export interface LoopNode {
+	id: LoopId;
+	type: LoopType;
+	sourceAnchor: SourceAnchor;
+}
+
+/**
+ * Per-argument structural binding at a CallSite. Replaces text-matching on
+ * argumentTexts (which is retained for display only). Populated by
+ * routine-indexer.ts when the callsite is constructed.
+ *
+ * Detectors must check `bindingResolution === "resolved"` before trusting
+ * `sourceParameterIndex` / `calleeParameterIsVar` for cross-call semantics —
+ * an unresolved callee still emits positional bindings, but the var-ness
+ * information is not authoritative.
+ */
+export interface CallArgumentBinding {
+	/** Positional 0-based index, callee-side. */
+	parameterIndex: number;
+
+	/** Where the argument value comes from on the caller side. */
+	sourceKind: "parameter" | "local" | "global" | "implicit-rec" | "expression" | "unknown";
+
+	/** Lowercased source variable name when sourceKind is parameter/local/global/implicit-rec.
+	 *  Diagnostic / cross-reference only — never used to drive semantics by name. */
+	sourceVariableName?: string;
+
+	/** Stable record-variable id from routine.features.recordVariables[].id, when the
+	 *  source is a record variable. Detectors should prefer this over sourceVariableName. */
+	sourceRecordVariableId?: string;
+
+	/** When sourceKind === "parameter", the source parameter's index in the enclosing
+	 *  routine. Drives entry-requirement composition (c1a). */
+	sourceParameterIndex?: number;
+
+	/** Whether the source-side variable is declared `var` (when sourceKind === "parameter").
+	 *  Drives exit-effect composition (c1b). */
+	callerSourceParameterIsVar?: boolean;
+
+	/** Whether the callee-side parameter is declared `var`. Drives exit-effect composition. */
+	calleeParameterIsVar: boolean;
+
+	/** Resolved table for the source record when available. */
+	sourceTableId?: TableId | "unknown";
+
+	/** Tempness of the source record when known. */
+	sourceTempState?: TempState;
+
+	/** Source anchor for the argument expression itself. Detectors anchor evidence at
+	 *  the argument level when emitting record-flow findings. */
+	argumentAnchor: SourceAnchor;
+
+	/** Did al-sem resolve enough to trust this binding for semantics?
+	 *    "resolved"          — callee signature known, positional binding sound.
+	 *    "unresolved-callee" — callee not resolved; var-ness must NOT be trusted.
+	 *    "ambiguous"         — overload ambiguity; same caveats.
+	 *    "non-record-arg"    — argument is not a record (literal/expression). */
+	bindingResolution: "resolved" | "unresolved-callee" | "ambiguous" | "non-record-arg";
+}
+
+export interface CallSite {
+	id: CallsiteId;
+	operationId: OperationId;
+	/** Raw callee expression text, e.g. 'EnrichLine' or 'Customer.Get'. Compatibility/
+	 *  display only — semantic consumers must read `callee` instead. */
+	calleeText: string;
+	/**
+	 * Structured, tree-sitter-derived classification of the callee. Built at L2 index
+	 * time from the `call_expression` node — bare / member / object-run / unknown.
+	 * Drives `resolve/call-resolver.ts` dispatch directly; no re-parsing of `calleeText`.
+	 */
+	callee: Callee;
+	/**
+	 * Raw text of each positional argument. Compatibility/display only — semantic
+	 * consumers must read `argumentInfos` (typed) instead.
+	 */
+	argumentTexts: string[];
+	/**
+	 * Structured, tree-sitter-derived classification of each positional argument —
+	 * same order as `argumentTexts`. Detectors that need literal-vs-non-literal
+	 * decisions (D18) or quoted-vs-unquoted name disambiguation read these via
+	 * `model/expression.ts` helpers. Avoid switching on `kind` in call sites —
+	 * use `isLiteralExpression` / `isStringLikeLiteral` / `unquotedFieldName`.
+	 */
+	argumentInfos: ExpressionInfo[];
+	/** Structural per-argument bindings. Populated by routine-indexer.ts;
+	 *  UPGRADED IN PLACE by src/resolve/call-resolver.ts after edge resolution
+	 *  (calleeParameterIsVar + bindingResolution become "resolved").
+	 *
+	 *  Mutation contract: ONLY upgradeBindings() in call-resolver.ts is permitted
+	 *  to write to existing entries. Detectors and downstream consumers must treat
+	 *  the array as readonly. Re-entrant resolution is not supported; any future
+	 *  incremental / parallel resolution must migrate ownership to CallEdge first.
+	 *
+	 *  `argumentTexts` is retained for display only — use bindings for any
+	 *  semantic reasoning. */
+	argumentBindings: CallArgumentBinding[];
+	loopStack: LoopId[]; // loops in THIS routine enclosing the call
+	sourceAnchor: SourceAnchor;
+}
+
+export interface FieldAccess {
+	recordVariableName: string;
+	fieldName: string;
+	sourceAnchor: SourceAnchor;
+}
+
+export interface RecordVariable {
+	id: RecordVariableId;
+	name: string;
+	tableName?: string;
+	tableId?: TableId; // resolved in Phase 2; undefined in Phase 1
+	tempState: TempState;
+	isParameter: boolean;
+	parameterIndex?: number;
+}
+
+/**
+ * A general variable in a routine's lexical scope — parameter or local declaration.
+ * Covers ALL declared types, not just records. Used by Phase 0b capability
+ * extractors to resolve member-call receivers structurally (`MyVar.Send(...)`)
+ * rather than by text matching the receiver name.
+ *
+ * `name` is lowercased per AL's case-insensitive identifier rules.
+ * `declaredType` is the normalized type string — `"HttpClient"`,
+ * `"Codeunit \"Sales-Post\""`, `"Record Customer"`, `"List of [Text]"`, etc.
+ * Use `declaredType` for dispatch (e.g. capability extractors match on the
+ * string prefix `"HttpClient"`, the prefix `"Codeunit "`, `"Record "`, etc.).
+ *
+ * `targetObjectId` is populated for object-typed variables (Codeunit, Page,
+ * Report, XmlPort, Query) when the object can be resolved at index time.
+ * `tableId` is populated for record-typed variables when the table can be
+ * resolved. Both are undefined when resolution fails (opaque dep, unknown
+ * object/table name).
+ *
+ * `initializer` is the simplest `ValueSource` describing the right-hand side
+ * of the variable's initial assignment, when there is one. Phase 0b-α resolves
+ * ONE HOP — chains like `A := B; B := 'literal'` resolve A's initializer to
+ * `{kind: "constant-var", varName: "B", initializer: {kind: "unknown"}}`.
+ * The `{kind: "unknown"}` placeholder is Phase 0b-β's `value-source.ts`
+ * classifier's job to chase (it looks up B in the same routine's
+ * `variables[]` and reads B's `initializer`). For "no initializer present"
+ * the field is `undefined`.
+ *
+ * Record variables also appear in `IntraproceduralFeatures.recordVariables` for
+ * backward compatibility — the two arrays overlap by design. New code should
+ * prefer `variables` and let `recordVariables` deprecate naturally.
+ */
+export interface VariableSymbol {
+	/** Lowercased per AL identifier rules. */
+	name: string;
+	/** Normalized type string — see JSDoc above. */
+	declaredType: string;
+	/** For object-typed variables, the resolved target object ID. */
+	targetObjectId?: ObjectId;
+	/** For record-typed variables, mirror of the corresponding
+	 *  `RecordVariable.tableId`. */
+	tableId?: TableId;
+	isParameter: boolean;
+	/** Set when `isParameter === true`. 0-based callee-side position. */
+	parameterIndex?: number;
+	/** Right-hand side of the initial assignment, as a one-hop ValueSource.
+	 *  Phase 0b-β chases chains; Phase 0b-α captures one level. */
+	initializer?: ValueSource;
+	sourceAnchor: SourceAnchor;
+}
+
+/**
+ * Identifier reference in a control-predicate position (if-test,
+ * while-test, repeat-until, case-of subject). Drives D43 dispatch-site
+ * guard recognition. The substrate is intentionally syntactic — it
+ * reports identifier participation, not guard semantics. Consumers
+ * (D43's slicer) interpret polarity (`if X` vs `if not X`).
+ *
+ * `identifier` is lowercased. `statementAnchor` is the owning if/while/
+ * repeat/case node; `referenceAnchor` is where the identifier appears.
+ */
+export interface ConditionReference {
+	identifier: string;
+	conditionKind: "if" | "while" | "repeat-until" | "case";
+	statementAnchor: SourceAnchor;
+	referenceAnchor: SourceAnchor;
+}
+
+/**
+ * Minimal var-assignment stream captured by the indexer. Covers
+ * `<identifier> := <expression>` AND `<member_expression> := <expression>`
+ * statements in the routine body. Phase 3 D43 (IsHandled-skip) consumes
+ * this to detect explicit `IsHandled := true` writes.
+ *
+ * `lhsName` is lowercased per AL identifier rules. `rhsLiteralValue` is
+ * the textual literal when the RHS parses as a boolean / integer / string
+ * literal; absent otherwise.
+ */
+export interface VarAssignment {
+	/** Lowercased LHS identifier. For member expressions (`Rec.Field := ...`),
+	 *  the trailing member name. */
+	lhsName: string;
+	/** Lowercased RHS literal text when the RHS is a `boolean` /
+	 *  `integer` / `string_literal`; absent otherwise. */
+	rhsLiteralValue?: string;
+	sourceAnchor: SourceAnchor;
+}
+
+export type OperationSiteKind =
+	| "record-op"
+	| "call"
+	| "event-publish"
+	| "commit"
+	| "lock"
+	| "external-call"
+	| "dynamic-dispatch";
+
+export interface OperationSite {
+	id: OperationId;
+	routineId: RoutineId;
+	kind: OperationSiteKind;
+	sourceAnchor: SourceAnchor;
+	loopStack: LoopId[];
+}
+
+/** An OperationSite specialized for record operations. */
+export interface RecordOperation {
+	id: OperationId;
+	routineId: RoutineId;
+	op: RecordOpType;
+	recordVariableName: string;
+	recordVariableId?: RecordVariableId;
+	tableId?: TableId; // resolved in Phase 2
+	tempState: TempState;
+	/**
+	 * Raw text of each positional argument for SetRange/SetFilter/SetLoadFields/
+	 * AddLoadFields/SetCurrentKey/CalcFields/Get/Find. Compatibility/display only —
+	 * semantic consumers must use `fieldArgumentInfos`.
+	 */
+	fieldArguments?: string[];
+	/**
+	 * Structured arguments — same order as `fieldArguments`. D4 / D18 / D22 read
+	 * these via `model/expression.ts` helpers (no quote/literal regex on the text).
+	 */
+	fieldArgumentInfos?: ExpressionInfo[];
+	loopStack: LoopId[];
+	sourceAnchor: SourceAnchor;
+}
+
+/**
+ * One position in a code_block where a statement (and any siblings after it) is
+ * guaranteed to never execute because a previous sibling unconditionally exits the
+ * routine. The indexer recognises:
+ *  - `exit_statement` (`Exit;` / `Exit(value);`)
+ *  - bare call `Error(...)` / `error(...)` — al-sem treats the call as runtime-fatal
+ *  - member call `CurrReport.Quit(...)` — report runtime exit
+ * The detector D20 walks these.
+ */
+export interface UnreachableStatement {
+	id: string;
+	exitKind: "exit" | "error" | "currreport-quit";
+	exitAnchor: SourceAnchor;
+	unreachableAnchor: SourceAnchor;
+}
+
+/**
+ * Compact representation of a routine body's control flow, used by the
+ * path-aware control-flow walker (src/engine/control-flow-walker.ts) in
+ * Phase 6+ to do branch-aware analysis.
+ *
+ * Each node represents one syntactic position. Branching nodes (if/case/case-branch)
+ * use `children` for the primary branch(es) and `elseChildren` for the else branch
+ * (only `if` populates elseChildren). Loop nodes use `children` for the body.
+ *
+ * `op` and `call` leaves link back to entries in `IntraproceduralFeatures.recordOperations`
+ * and `.callSites` via their ids — the walker uses these to interleave structural
+ * traversal with the existing flat feature lists.
+ *
+ * `other` is a catch-all for statement kinds the walker doesn't need to distinguish
+ * (assignment, message, etc.) — they're treated as straight-line opaque.
+ *
+ * Kind contracts:
+ *  - `if` nodes always have at least one of `children` (then-branch) or `elseChildren`
+ *    (else-branch) populated under normal parses. Both being empty implies a
+ *    parse-incomplete body and the walker should treat such a node conservatively.
+ *  - `try` nodes currently have empty `children` because the AL grammar
+ *    (tree-sitter-al) does not define a `try_statement` node — AL's TryFunction is an
+ *    [TryFunction] attribute on a procedure, not a statement. Reserved for future grammar
+ *    additions; the walker should treat `try` as opaque-with-possible-exit until the
+ *    grammar+CFN builder catch up.
+ *  - `error` covers ONLY bare unqualified `Error(...)` / `error(...)` / `ERROR(...)`
+ *    calls (case-insensitive callee identifier). Qualified calls (`System.Error(...)`,
+ *    codeunit-method dispatch, etc.) go through `call`. `CurrReport.Quit(...)` and
+ *    similar exit-equivalents are NOT classified as `error`; see `unconditionalExitKind`
+ *    in intraprocedural-body.ts for the full exit-shape inventory. P6.T2 walker should
+ *    cross-reference there if it needs to widen the set of "raises and never returns" leaves.
+ *  - `exit` is the bare `exit_statement` (covers `Exit;` and `Exit(value);`).
+ *
+ * Single-statement branch bodies: the AL grammar lets `if X then S` / `while X do S` /
+ * `case X of 1: S` omit `begin`/`end`. In those cases the `then_branch` / `body` field
+ * points DIRECTLY at the statement (not a wrapping `code_block`). The CFN builder
+ * synthesizes a `block` node wrapping the single statement so the walker can treat all
+ * branch bodies uniformly.
+ *
+ * Grammar notes (tree-sitter-al):
+ *  - `if_statement` exposes `then_branch` and `else_branch` named fields.
+ *  - `case_statement` children include `case_branch` and `case_else_branch` nodes.
+ *  - `case_branch` exposes a `body` field; `case_else_branch` has no named body field
+ *    (search namedChildren for a `code_block`, or fall back to the first non-keyword child).
+ *  - All loop kinds (`for_statement`, `foreach_statement`, `while_statement`) expose a `body` field.
+ *  - `repeat_statement` has no body field; its body children are all namedChildren before
+ *    the `until_keyword`.
+ */
+export interface ControlFlowNode {
+	kind:
+		| "block"
+		| "if"
+		| "case"
+		| "case-branch"
+		| "while"
+		| "repeat"
+		| "for"
+		| "foreach"
+		| "try"
+		| "exit"
+		| "error"
+		| "call"
+		| "op"
+		| "other";
+	sourceAnchor: SourceAnchor;
+	/** Children for branching/looping nodes' primary branch (then-branch of if; body of loops; cases of case). */
+	children?: ControlFlowNode[];
+	/** Else-branch children. Only `if` populates this. */
+	elseChildren?: ControlFlowNode[];
+	/** For `op` leaves: id of the RecordOperation (or OperationSite). */
+	operationId?: OperationId;
+	/** For `call` leaves: id of the CallSite. */
+	callsiteId?: CallsiteId;
+	/**
+	 * Expression-position record-ops / callsites harvested from condition
+	 * expressions, argument expressions, and chained receivers of this node (P7.5).
+	 *
+	 * Populated by the indexer for nodes whose AL syntax has expression-position
+	 * sub-trees that may contain record-ops or function calls — e.g.
+	 * `if Cust.FindSet() then ...`, `until Cust.Next() = 0`, `case Rec.Find('-') of`,
+	 * `Helper(Cust.FindSet())`, `Helper(C).FindSet()`. The walker processes these
+	 * leaves at the appropriate point relative to the node's main children:
+	 *
+	 *   - `if` / `case` / `while` / `for` / `foreach`: BEFORE walking `children` /
+	 *     `elseChildren`. For `if`/`case` the condition runs once before branch
+	 *     selection; for loops it's a virtual prefix to each iteration (the
+	 *     condition / range / iterable evaluates before each loop body iteration).
+	 *   - `repeat`: AFTER the body inside each iteration (the `until` expression
+	 *     evaluates at the END of each iteration).
+	 *   - `op` / `call` / `error`: BEFORE the leaf's own effect — argument-position
+	 *     and chained-receiver expressions evaluate before the outer call/op runs.
+	 *   - `other`: emitted by `buildCFNForStatement` as a fallback wrapper for
+	 *     expression-position call_expressions that the visit pass did NOT
+	 *     register as op or callsite (e.g. unresolved or AST-shape-mismatched
+	 *     calls). The wrapper carries the harvested argument/receiver leaves so
+	 *     they aren't dropped from the tree.
+	 *
+	 * Nesting is possible. A `call` leaf may itself carry `conditionLeaves` —
+	 * `Helper(Cust.FindSet())` produces a call-leaf for `Helper(...)` whose own
+	 * `conditionLeaves` includes the inner FindSet op-leaf (from the argument).
+	 * For chained-receiver shapes like `Helper(C).FindSet()`, the inner
+	 * `Helper(C)` callsite is harvested as a SIBLING of the outer FindSet op
+	 * leaf in the parent's `conditionLeaves` (AL evaluates the receiver before
+	 * the outer call, and the walker preserves that left-to-right order).
+	 *
+	 * The harvest never reaches into statement-position sub-trees — e.g. an
+	 * `if`-condition harvest stops at the boundary of the then-branch, which
+	 * has its own statement-tree children.
+	 */
+	conditionLeaves?: ControlFlowNode[];
+}
+
+/** Raw intraprocedural extraction for one routine body. */
+export interface IntraproceduralFeatures {
+	loops: LoopNode[];
+	operationSites: OperationSite[];
+	recordOperations: RecordOperation[];
+	callSites: CallSite[];
+	fieldAccesses: FieldAccess[];
+	recordVariables: RecordVariable[];
+	nestingDepth: number;
+	unreachableStatements: UnreachableStatement[];
+	/**
+	 * True when the routine body contains any branching control flow that simple
+	 * straight-line analyses (e.g. the Phase 4 control-flow walker) cannot soundly
+	 * reason about. Set by the indexer when it encounters an `if_statement`,
+	 * `case_statement`, `case_branch`, or `try_statement`.
+	 *
+	 * Loops are counted separately by `nestingDepth`; unconditional early exits
+	 * are counted by `unreachableStatements`. Consumers should treat
+	 * `hasBranching || nestingDepth > 0 || unreachableStatements.length > 0`
+	 * as "this routine is not straight-line".
+	 */
+	hasBranching: boolean;
+	/**
+	 * Compact control-flow tree for the routine body. Populated by the indexer
+	 * in P6.T1; consumed by the path-aware walker in P6.T2. Undefined for
+	 * routines without a body (symbol-only projections).
+	 */
+	statementTree?: ControlFlowNode;
+	/**
+	 * The set of identifier names referenced as VALUES anywhere in the routine
+	 * body — lowercased, sorted, deduped. Field names (member of
+	 * `member_expression`), enum member names (`value` of
+	 * `qualified_enum_value`), and bare type names in enum-type position are
+	 * excluded; receivers, callees, arguments, assignment targets, and loop
+	 * iteration variables are all included.
+	 *
+	 * Used by D19 (unused-parameter) instead of regex-scanning body fragment
+	 * text; future detectors that need name-reaches-routine should query this
+	 * set as well.
+	 */
+	identifierReferences: string[];
+	/**
+	 * Phase 0b-α addition (capability-stack roadmap §3.9). All declared
+	 * variables in the routine's lexical scope — parameters + local var
+	 * declarations, covering ALL types not just records. Record variables
+	 * also appear here (in addition to `recordVariables` for backward
+	 * compatibility). Phase 0b-β capability extractors use this for
+	 * structural receiver-type resolution (`MyVar.Send(...)`).
+	 *
+	 * Populated by `routine-indexer.ts` for primary routines and by
+	 * dependency-projection's symbol-only path (`variables: []`) for
+	 * opaque dep routines. Optional so pre-Phase-0b-α test mock-fixture
+	 * sites that haven't been updated continue to compile cleanly.
+	 */
+	variables?: VariableSymbol[];
+	/**
+	 * Var-assignment stream. Captured by the indexer in Phase 3 — drives
+	 * D43 IsHandled-skip detection. Sorted by sourceAnchor.
+	 */
+	varAssignments: VarAssignment[];
+	/**
+	 * Identifiers referenced in a control-predicate position. Captured by
+	 * the indexer in Phase 3.1 — drives D43 dispatch-site guard detection.
+	 * Sorted by referenceAnchor.
+	 */
+	conditionReferences: ConditionReference[];
+}
+
+/**
+ * The `local`/`internal`/`protected` modifier on a primary-app procedure declaration.
+ * Absent = AL's default ("public"). Detectors use this to distinguish demonstrably
+ * scope-limited procedures (local) from procedures that may be called externally
+ * (default/public). Triggers and dependency-role routines do not carry this.
+ */
+export type ProcedureAccessModifier = "local" | "internal" | "protected";
+
+export interface Routine {
+	id: RoutineId;
+	canonical: CanonicalRoutineKey;
+	objectId: ObjectId;
+	name: string;
+	kind: RoutineKind;
+	parameters: ParameterSymbol[];
+	/**
+	 * Raw text of each `attribute_item` immediately preceding the routine, in source order.
+	 * Compatibility/display only — semantic consumers must use `attributesParsed`.
+	 */
+	attributes: string[];
+	/**
+	 * Structured, tree-sitter-derived attributes — same order as `attributes`. Built at
+	 * L2 index time for native AL routines (from `attribute_item` nodes) and projected
+	 * from `SymbolReference.json` for dependency routines. Detectors and resolvers
+	 * query attributes through this field via `findAttribute` / `stringArg` /
+	 * `qualifiedArg` helpers in `model/attributes.ts` — no `[…]` text shredding.
+	 */
+	attributesParsed: AttributeInfo[];
+	/**
+	 * Declaration-visibility modifier. For primary-app source this is the `modifier`
+	 * field on a `procedure` node (`local`/`internal`/`protected`); for dependency
+	 * (.app symbol) routines it is projected from `IsInternal` / `IsLocal` flags.
+	 * Undefined = AL default ("public") or trigger.
+	 */
+	accessModifier?: ProcedureAccessModifier;
+	bodyAvailable: boolean; // false = opaque .app symbol
+	parseIncomplete: boolean;
+	sourceHash: string;
+	sourceAnchor: SourceAnchor;
+	features: IntraproceduralFeatures;
+	summary?: RoutineSummary; // computed in Phase 2
+	analysisRole?: AnalysisRole;
+}