docs: update documentation to reflect nanoflow implementation state

- Move JS action call and ELK layout from Future Work to Completed in proposal
- Fix stale action counts in proposal (25/32+ → actual ~16 case branches)
- Expand disallowed activities list in docs-site nanoflows.md (add DOWNLOAD FILE, REST, workflow, etc.)
- Add CALL JAVASCRIPT ACTION to docs-site calling examples
- Add CHANGELOG entries: LSP snippets, parser fixes, validation parity, DownloadFileStmt, flow cache, empty params
- Update feature matrix: nanoflow Tests column N → Y
- Document ValidateNanoflowBody/validateFlowBody and flow builder cache in parser architecture
- Add CALL JAVASCRIPT/JAVA ACTION and nanoflow restrictions to quick reference
- Update CLAUDE.md implementation status line

Author: retran

CHANGELOG.md

@@ -20,7 +20,13 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 - **Nanoflow bug fixes** — Module existence validation for SHOW NANOFLOWS/MICROFLOWS, numeric return literals no longer get spurious `$` prefix, empty nanoflow/microflow names rejected at create time, `NanoflowCallAction` error handling type resolved correctly, `not()` expression spacing preserved on roundtrip, JavaScript action call rendering in DESCRIBE output
 - **Nanoflow diff support** — `mxcli diff` now detects and displays nanoflow changes (previously silently skipped)
+- **Nanoflow validation parity** — `mxcli check` now runs full body validation on nanoflows (undeclared variables, missing returns, branch scoping) via shared `validateFlowBody` helper; `allNames()` includes nanoflows for forward-reference detection
+- **DownloadFileStmt denylist** — `DOWNLOAD FILE` added to nanoflow disallowed action list
 - **JavaScript action MDL syntax** — `call javascript action Module.ActionName(params)` now fully supported in CREATE NANOFLOW/MICROFLOW bodies: grammar, parser, builder, serializer, and roundtrip
+- **LSP snippet completions** — Added `CREATE NANOFLOW (with params)`, `CALL MICROFLOW`, `CALL NANOFLOW`, `CALL JAVASCRIPT ACTION`, `CALL JAVA ACTION` snippets
+- **Flow builder cache** — `lookupMicroflowReturnType` and `lookupNanoflowReturnType` now cache results with lazy-load bool flags, avoiding repeated `ListNanoflows`/`ListMicroflows` calls; nanoflow lookup uses `GetRawUnitByName` fast path
+- **Parser fixes** — Negative literals no longer greedily consumed by lexer (`-?` removed from `NUMBER_LITERAL`); XPath multi-predicate brackets correctly split and re-wrapped; multi-line string literals in change/create object expressions escaped; `ExclusiveSplit` (if/else) inside loop bodies now emits correct `end if;`
+- **Empty action params** — JS and Java action parameters with empty/nil values are omitted from DESCRIBE output instead of rendering as `...` or bare `= )`
 - **Association retrieve roundtrip fidelity** — `retrieve $X from $Y/Module.Association` syntax preserved on roundtrip (previously converted to `from Entity where Assoc = $Y`)
 - **DESCRIBE empty-then optimization** — If/else blocks with empty true branches are swapped and condition negated for readable output
 

CLAUDE.md

@@ -465,7 +465,7 @@ Full syntax tables for all MDL statements (microflows, pages, security, navigati
 - MPR v1/v2 reading and writing
 - Domain model (entities, attributes, associations)
 - ALTER ENTITY (add/rename/modify/drop attributes, indexes, documentation)
-- Microflows/Nanoflows with 60+ activity types
+- Microflows/Nanoflows with 60+ activity types, JavaScript action calls, nanoflow validation parity
 - Pages with 50+ widget types
 - ALTER PAGE/SNIPPET (SET, INSERT, DROP, REPLACE operations on widget trees)
 - Image widgets (IMAGE, STATICIMAGE, DYNAMICIMAGE) with Width/Height properties

docs-site/src/language/nanoflows.md

@@ -70,6 +70,9 @@ $Result = CALL NANOFLOW Sales.NAV_ValidateCart (Cart = $Cart);
 
 -- Call a microflow (triggers server round-trip)
 $ServerResult = CALL MICROFLOW Sales.ACT_SubmitOrder (Order = $Order);
+
+-- Call a JavaScript action
+$HasNetwork = CALL JAVASCRIPT ACTION NanoflowCommons.HasConnectivity();
 ```
 
 ### UI Activities
@@ -110,12 +113,15 @@ END IF;
 
 The following activities are server-only and cannot be used in nanoflows:
 
-- `RETRIEVE ... FROM Module.Entity WHERE ...` (database retrieval)
-- `COMMIT`
-- `DELETE`
-- `ROLLBACK`
-- `CALL JAVA ACTION`
-- `EXECUTE DATABASE QUERY`
+- `CALL JAVA ACTION` — Java actions cannot run client-side
+- `DOWNLOAD FILE` — file downloads require server-side processing
+- `CALL REST SERVICE` / `SEND REST REQUEST` — REST calls are server-side
+- `IMPORT FROM MAPPING` / `EXPORT TO MAPPING` — mapping operations are server-side
+- `EXECUTE DATABASE QUERY` — direct SQL requires server
+- `TRANSFORM JSON` — JSON transformations are server-side
+- `SHOW HOME PAGE` — home page navigation is server-side
+- `CALL EXTERNAL ACTION` — external actions are server-side
+- All **workflow actions** (create/open/complete workflow, user task, etc.)
 - `ON ERROR { ... }` (full error handler blocks)
 
 ## SHOW and DESCRIBE

docs/01-project/MDL_FEATURE_MATRIX.md

@@ -13,7 +13,7 @@ When adding a new MDL feature, use this matrix as a checklist to ensure complete
 | **Associations** | Y | Y | Y | N | Y | Y | 01 | Y | N | Y | Y | Y | Y | Y | Y | Y | N |
 | **Enumerations** | Y | Y | Y | Y | Y | Y | 01 | Y | Y | N | Y | Y | Y | N | Y | Y | Y |
 | **Microflows** | Y | Y | Y | Y | Y | N | 02 | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y |
-| **Nanoflows** | Y | Y | Y | Y | Y | N | N | N | Y | Y | Y | Y | Y | Y | P | N | N |
+| **Nanoflows** | Y | Y | Y | Y | Y | N | N | Y | Y | Y | Y | Y | Y | Y | P | N | N |
 | **Pages** | Y | Y | Y | N | Y | Y | 03 | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y |
 | **Snippets** | Y | Y | Y | N | Y | Y | 03 | Y | Y | Y | Y | Y | Y | N | Y | Y | Y |
 | **Layouts** | Y | Y | N | N | N | N | N | N | Y | Y | Y | N | Y | N | Y | N | N |

docs/01-project/MDL_QUICK_REFERENCE.md

@@ -207,6 +207,7 @@ authentication basic, session
 | Drop nanoflow | `drop nanoflow Module.Name;` | |
 | Create nanoflow | `create [or modify] nanoflow Module.Name (params) returns type [folder 'path'] begin ... end;` | Same body syntax as microflows |
 | Move nanoflow | `move nanoflow Module.Name to folder 'path';` | |
+| Nanoflow restrictions | N/A | No Java actions, REST calls, download file, workflow actions, import/export mappings, show home page |
 
 ## Microflows - Supported Statements
 
@@ -225,6 +226,8 @@ authentication basic, session
 | Retrieve (Assoc) | `retrieve $list from $Parent/Module.AssocName;` | Retrieve by association |
 | Call microflow | `$Result = call microflow Module.Name (Param = $value);` | |
 | Call nanoflow | `$Result = call nanoflow Module.Name (Param = $value);` | |
+| Call JS action | `$Result = call javascript action Module.Name (Param = $value);` | JavaScript action (nanoflow/microflow) |
+| Call Java action | `$Result = call java action Module.Name (Param = $value);` | Java action (microflow only) |
 | Show page | `show page Module.PageName ($Param = $value);` | Also accepts `(Param: $value)` |
 | Close page | `close page;` | |
 | Download file | `download file $FileDocument [show in browser];` | Streams a `System.FileDocument` |

docs/03-development/MDL_PARSER_ARCHITECTURE.md

@@ -515,11 +515,11 @@ The `microflowValidator` struct walks the body and checks:
 4. **Variable scope** — Variables declared inside IF/ELSE branches or ON ERROR bodies cannot be referenced after the branch ends. The `checkBranchScoping()` method collects variables declared inside branches and checks if subsequent statements reference them.
 5. **Validation feedback** — VALIDATION FEEDBACK must have a non-empty message template (CE0091).
 
-This is separate from `ValidateMicroflowBody()` (in `cmd_microflows_builder.go`), which checks undeclared variable usage and runs during `--references` validation.
+This is separate from `ValidateMicroflowBody()` and `ValidateNanoflowBody()` (in `cmd_microflows_builder_validate.go`), which check undeclared variable usage and run during `--references` validation. Both delegate to the shared `validateFlowBody()` helper that accepts `[]ast.MicroflowParam` and `[]ast.MicroflowStatement`.
 
 ## Microflow Builder Architecture
 
-The microflow builder (`cmd_microflows_builder.go`) converts MDL microflow AST nodes into Mendix microflow objects. A key aspect is **variable type tracking**.
+The microflow builder (`cmd_microflows_builder.go`) converts MDL microflow AST nodes into Mendix microflow objects. A key aspect is **variable type tracking**. The `flowBuilder` also maintains `microflowsCache`/`nanoflowsCache` (with `Loaded` bool flags) for lazy-cached return type lookups, and `allNames()` includes nanoflows for forward-reference detection in multi-statement scripts.
 
 ### Variable Type Tracking (`varTypes`)
 

docs/11-proposals/PROPOSAL_nanoflow_support.md

@@ -31,9 +31,9 @@ Nanoflows execute client-side (browser or native app). In the Mendix metamodel,
 
 ### Action Restrictions
 
-**Allowed in nanoflows** (25 actions): ChangeVariable, AggregateList, CreateVariable, Rollback, Retrieve, Delete, CreateChange, Commit, Cast, Change, LogMessage, ListOperation, CreateList, ChangeList, MicroflowCall, ValidationFeedback, ShowPage, ShowMessage, CloseForm, **NanoflowCall**, **JavaScriptActionCall**, **Synchronize**, **CancelSynchronization**, **ClearFromClient**.
+**Allowed in nanoflows**: ChangeVariable, AggregateList, CreateVariable, Rollback, Retrieve, Delete, CreateChange, Commit, Cast, Change, LogMessage, ListOperation, CreateList, ChangeList, MicroflowCall, ValidationFeedback, ShowPage, ShowMessage, CloseForm, NanoflowCall, JavaScriptActionCall, Synchronize, CancelSynchronization, ClearFromClient, and others not explicitly denied.
 
-**Disallowed** (32+ actions): All Java actions, REST calls, workflow actions, import/export, external object ops, download file, push to client, show home page, email, document generation, metrics, ML model calls.
+**Disallowed** (enforced by `checkDisallowedNanoflowAction` in `nanoflow_validation.go`, ~16 case branches): JavaActionCallAction, RestCallAction, SendRestRequestAction, ImportFromMappingAction, ExportToMappingAction, CallExternalActionAction, DownloadFileAction, ShowHomePageAction, TransformJsonAction, ExecuteDatabaseQueryAction, CallJavaActionStmt, and 9 workflow action types (CreateWorkflow, OpenWorkflow, OpenUserTask, CompleteUserTask, etc.).
 
 ## Supported Commands
 
@@ -87,7 +87,7 @@ revokeNanoflowAccessStatement
 
 ## Validation Rules
 
-1. **Disallowed actions** — Type-switch rejects 21 microflow-only action types with descriptive error messages
+1. **Disallowed actions** — Type-switch rejects ~16 case branches of microflow-only action types with descriptive error messages (workflow actions collapsed into multi-type case)
 2. **ErrorEvent forbidden** — `ErrorEvent is not allowed in nanoflows`
 3. **Binary return type rejected** — `Binary return type is not allowed in nanoflows`
 4. **Recursive validation** — Checks compound statements (IF/LOOP/WHILE bodies) and error handling blocks
@@ -118,11 +118,16 @@ revokeNanoflowAccessStatement
 | Feature | Priority | Notes |
 |---------|----------|-------|
 | Roundtrip tests with real `.mpr` baselines | P2 | CREATE → DESCRIBE → re-CREATE verification against App Gallery demos |
-| JavaScriptActionCall syntax | P2 | `call javascript action` in nanoflows |
 | SynchronizeAction | P3 | `synchronize` action for offline nanoflows |
-| ELK layout | P3 | Visual layout (low priority) |
 | Web/Native platform mixing check | P3 | CE6051 validation |
 
+### Completed (formerly Future Work)
+
+| Feature | Status | Notes |
+|---------|--------|-------|
+| JavaScriptActionCall syntax | Done | `call javascript action Module.ActionName(params)` fully supported in grammar, parser, builder, serializer, and roundtrip |
+| ELK layout | Done | `describe nanoflow --format elk` produces valid JSON layout |
+
 ## Testing
 
 Test plan: `docs/15-testing/nanoflow-test-cases.md` (19 sections, 100+ test cases covering all commands, validation, BSON round-trip, catalog, and edge cases).