feat(workflow): MDL workflow support - CREATE/DROP/DESCRIBE + BSON round-trip

.claude/skills/mendix/docker-workflow.md

@@ -50,6 +50,21 @@ mxcli docker run -p app.mpr --fresh --wait
 
 `docker run` handles everything: downloads MxBuild and runtime (if not cached), initializes the Docker stack (if needed), builds the PAD package, starts the containers, and optionally waits for the runtime to report successful startup.
 
+## Creating an Empty Mendix App
+
+To create a new blank Mendix project for testing (requires mxbuild to be downloaded first):
+
+```bash
+# Download mxbuild if not already cached
+mxcli setup mxbuild --version 11.6.4
+
+# Create a blank project
+mkdir -p /path/to/my-app
+~/.mxcli/mxbuild/{version}/modeler/mx create-project --app-name MyApp --output-dir /path/to/my-app
+```
+
+The `mx create-project` command creates an MPR v2 project with the standard Mendix module structure. You can then use the Docker workflow to build and run it.
+
 ## Step-by-Step Workflow
 
 If you prefer more control, use the individual commands:
@@ -65,13 +80,38 @@ mxcli setup mxbuild -p app.mpr
 # Download Mendix runtime matching the project version
 mxcli setup mxruntime -p app.mpr
 
+# Or specify version explicitly (without a project)
+mxcli setup mxbuild --version 11.6.4
+mxcli setup mxruntime --version 11.6.4
+
 # Or preview what would be downloaded
 mxcli setup mxbuild -p app.mpr --dry-run
 mxcli setup mxruntime -p app.mpr --dry-run
 ```
 
 MxBuild is cached at `~/.mxcli/mxbuild/{version}/` and the runtime at `~/.mxcli/runtime/{version}/`. Both are reused across builds.
 
+#### Runtime-to-MxBuild Copying (PAD Build Prerequisite)
+
+MxBuild 11.6.3+ expects runtime files (`pad/`, `lib/`, `launcher/`, `agents/`) inside its own `runtime/` directory, but `mxcli setup mxbuild` only downloads the build tools (not the full runtime). If the PAD build fails with `StudioPro.conf.hbs does not exist` or `ClassNotFoundException`, copy the runtime directories into mxbuild:
+
+```bash
+VERSION=11.6.4  # replace with your version
+
+# After downloading both mxbuild and mxruntime:
+cp -r ~/.mxcli/runtime/$VERSION/runtime/pad ~/.mxcli/mxbuild/$VERSION/runtime/pad
+cp -r ~/.mxcli/runtime/$VERSION/runtime/lib ~/.mxcli/mxbuild/$VERSION/runtime/lib
+cp -r ~/.mxcli/runtime/$VERSION/runtime/launcher ~/.mxcli/mxbuild/$VERSION/runtime/launcher
+cp -r ~/.mxcli/runtime/$VERSION/runtime/agents ~/.mxcli/mxbuild/$VERSION/runtime/agents
+```
+
+**Important:** The PAD build output may only include partial runtime bundles (5 jars instead of 354). If the runtime fails to start with `ClassNotFoundException: com.mendix.container.support.EventProcessor`, copy the full runtime into the PAD build output:
+
+```bash
+rm -rf /path/to/project/.docker/build/lib/runtime
+cp -r ~/.mxcli/runtime/$VERSION/runtime /path/to/project/.docker/build/lib/runtime
+```
+
 ### 2. Initialize Docker stack (first time only)
 
 ```bash
@@ -81,6 +121,16 @@ mxcli docker init -p app.mpr
 
 This creates a `.docker/` directory with Docker Compose configuration for the Mendix app + PostgreSQL.
 
+**Port conflicts:** If default ports (8080/8090/5432) are already in use, check with `ss -tlnp | grep -E '808|809|543'` and use `--port-offset N` to shift all ports:
+
+```bash
+# Check which ports are occupied
+ss -tlnp | grep -E '808[0-9]|809[0-9]|543[0-9]'
+
+# Use offset to avoid conflicts (e.g., offset 5 → 8085/8095/5437)
+mxcli docker init -p app.mpr --port-offset 5
+```
+
 ### 3. Check project for errors
 
 ```bash
@@ -346,6 +396,9 @@ All defaults can be overridden in `.docker/.env`.
 | Build fails with version error | Requires Mendix >= 11.6.1 for PAD support |
 | No Dockerfile in PAD output | Normal for MxBuild 11.6.3+ — `mxcli docker build` auto-generates one |
 | Runtime not found / runtimelauncher.jar missing | Run `mxcli setup mxruntime -p app.mpr` or let `docker build` auto-download |
+| `StudioPro.conf.hbs does not exist` | Runtime not linked into mxbuild — see "Runtime-to-MxBuild Copying" above |
+| `ClassNotFoundException: EventProcessor` | PAD has partial runtime bundles — copy full runtime into `.docker/build/lib/runtime/` (see above) |
+| Port already allocated | Check ports with `ss -tlnp \| grep 808` and use `docker init --port-offset N --force` |
 | `' etc/Default' is not a file` | Dockerfile CMD passes config arg — `docker build` patches this automatically |
 | `DatabasePassword has no value` | Ensure `RUNTIME_PARAMS_DATABASE*` env vars are in docker-compose.yml — re-run `mxcli docker init --force` |
 | `Password should not be empty (debugger)` | Add `RUNTIME_DEBUGGER_PASSWORD` — re-run `mxcli docker init --force` |

.claude/skills/mendix/generate-domain-model.md

@@ -326,6 +326,29 @@ COMMENT 'Additional documentation';
 
 **Naming Convention**: `{FromEntity}_{ToEntity}` (e.g., `Order_Customer`, `Transaction_Account`)
 
+#### Calculated Attributes
+
+Calculated attributes derive their value from a microflow at runtime. Use `CALCULATED BY Module.Microflow` to specify the calculation microflow.
+
+**IMPORTANT: CALCULATED attributes are only supported on PERSISTENT entities.** Using CALCULATED on non-persistent entities will produce a validation error.
+
+```sql
+@Position(100, 100)
+CREATE PERSISTENT ENTITY Module.OrderLine (
+  /** Unit price */
+  UnitPrice: Decimal NOT NULL,
+  /** Quantity ordered */
+  Quantity: Integer NOT NULL,
+  /** Total price, calculated by microflow */
+  TotalPrice: Decimal CALCULATED BY Module.CalcTotalPrice
+);
+```
+
+**Syntax variants:**
+- `CALCULATED BY Module.Microflow` — recommended, binds the calculation microflow directly
+- `CALCULATED Module.Microflow` — also valid (`BY` keyword is optional)
+- `CALCULATED` — bare form, marks as calculated but requires manual microflow binding in Studio Pro
+
 ### Data Types
 
 | Type | Example | Description |

.claude/skills/mendix/manage-security.md

@@ -171,13 +171,18 @@ ALTER PROJECT SECURITY DEMO USERS OFF;
 ### Demo Users
 
 ```sql
--- Create demo user with roles
+-- Create demo user (auto-detects entity that generalizes System.User)
 CREATE DEMO USER 'demo_admin' PASSWORD 'Admin123!' (Administrator, SuperAdmin);
 
+-- Create demo user with explicit entity
+CREATE DEMO USER 'demo_admin' PASSWORD 'Admin123!' ENTITY Administration.Account (Administrator, SuperAdmin);
+
 -- Remove demo user
 DROP DEMO USER 'demo_admin';
 ```
 
+The ENTITY clause specifies which entity (generalizing `System.User`) to use. If omitted, it auto-detects the unique System.User subtype in the project. If multiple subtypes exist, you must specify ENTITY explicitly.
+
 ## Starlark Lint Rule APIs
 
 Security data is available in Starlark lint rules (`.star` files):

.gitignore

@@ -54,3 +54,6 @@ grammardoc
 *.pptx
 # Excluded skills
 .claude/skills/mendix/migrate-outsystems.md
+
+# Snap tool binary (used for BSON fixture generation)
+snap-bson

CLAUDE.md

@@ -325,9 +325,11 @@ Full syntax tables for all MDL statements (microflows, pages, security, navigati
 - Data import from external databases into Mendix app DB (`IMPORT FROM ... INTO ... MAP ...`)
 - Database Connector generation from external schema (`SQL <alias> GENERATE CONNECTOR INTO <module>`)
 - EXECUTE DATABASE QUERY microflow action (static, dynamic SQL, parameterized, runtime connection override)
+- CREATE/DROP WORKFLOW with user tasks, decisions, parallel splits, and other activity types
+- CALCULATED BY microflow syntax for calculated attributes
 
 **Not Yet Implemented:**
-- 48 of 52 metamodel domains (workflows, REST, etc.)
+- 47 of 52 metamodel domains (REST, etc.)
 - Delta/change tracking system
 - Runtime type reflection
 

Makefile

@@ -23,7 +23,7 @@ VERSION ?= $(shell git describe --tags --always --dirty 2>/dev/null || echo "dev
 BUILD_TIME = $(shell date -u +"%Y-%m-%dT%H:%M:%SZ")
 LDFLAGS = -ldflags "-X main.Version=$(VERSION) -X main.BuildTime=$(BUILD_TIME)"
 
-.PHONY: build release clean test test-mdl grammar completions sync-skills sync-commands sync-lint-rules sync-changelog sync-all docs documentation vscode-ext vscode-install source-tree sbom sbom-report lint lint-go lint-ts fmt vet
+.PHONY: build build-debug release clean test test-mdl grammar completions sync-skills sync-commands sync-lint-rules sync-changelog sync-all docs documentation vscode-ext vscode-install source-tree sbom sbom-report lint lint-go lint-ts fmt vet
 
 # Helper: copy file only if content differs (avoids mtime updates that invalidate go build cache)
 # Usage: $(call copy-if-changed,src,dst)
@@ -101,6 +101,12 @@ build: sync-all completions
 	CGO_ENABLED=0 go build -o $(BUILD_DIR)/source_tree ./cmd/source_tree
 	@echo "Built $(BUILD_DIR)/$(BINARY_NAME) $(BUILD_DIR)/source_tree"
 
+# Build with debug tools (includes bson discover/compare/dump)
+build-debug: sync-all completions
+	@mkdir -p $(BUILD_DIR)
+	CGO_ENABLED=0 go build -tags debug $(LDFLAGS) -o $(BUILD_DIR)/$(BINARY_NAME)-debug $(CMD_PATH)
+	@echo "Built $(BUILD_DIR)/$(BINARY_NAME)-debug (debug build with bson tools)"
+
 # Build for all platforms (CGO_ENABLED=0 for cross-compilation)
 release: clean sync-all
 	@mkdir -p $(BUILD_DIR)

bson/classify.go

@@ -0,0 +1,48 @@
+package bson
+
+// FieldCategory classifies BSON fields by their role in serialization.
+type FieldCategory int
+
+const (
+	// Semantic fields carry business meaning (e.g., Name, Caption, Expression).
+	Semantic FieldCategory = iota
+	// Structural fields are BSON framing (e.g., $ID, $Type, PersistentId).
+	Structural
+	// Layout fields control visual positioning (e.g., RelativeMiddlePoint, Size).
+	Layout
+)
+
+func (c FieldCategory) String() string {
+	switch c {
+	case Semantic:
+		return "Semantic"
+	case Structural:
+		return "Structural"
+	case Layout:
+		return "Layout"
+	default:
+		return "Unknown"
+	}
+}
+
+var structuralFields = map[string]bool{
+	"$ID":          true,
+	"$Type":        true,
+	"PersistentId": true,
+}
+
+var layoutFields = map[string]bool{
+	"RelativeMiddlePoint": true,
+	"Size":                true,
+}
+
+// classifyField returns the FieldCategory for a given BSON storage name.
+func classifyField(storageName string) FieldCategory {
+	if structuralFields[storageName] {
+		return Structural
+	}
+	if layoutFields[storageName] {
+		return Layout
+	}
+	return Semantic
+}