feat(executor): MDL executor for workflows, calculated attributes, demo user entity

- Add SHOW/DESCRIBE WORKFLOW with full MDL-formatted output
- Add CREATE/DROP WORKFLOW executing AST against BSON writer
- Add GRANT/REVOKE EXECUTE ON WORKFLOW for security access control
- Add CALCULATED BY <microflow> support in CREATE/ALTER ENTITY
- Add ENTITY clause support in CREATE DEMO USER
- Add workflow entries to catalog (builder_modules, builder_strings)
- Extend LSP completions for workflow keywords
- Update help topics (entity, security, workflow)
- Fix DESCRIBE WORKFLOW round-trip: USER TASK due date, boundary events,
  multi-user task, CALL MICROFLOW WITH parameter mappings

Author: engalar

cmd/mxcli/docker/build.go

@@ -700,7 +700,7 @@ func ensureDemoUsers(projectPath string, w io.Writer) error {
 		}
 	}
 
-	if err := writer.AddDemoUser(ps.ID, "admin", "Admin123!", []string{roleName}); err != nil {
+	if err := writer.AddDemoUser(ps.ID, "admin", "Admin123!", "", []string{roleName}); err != nil {
 		return fmt.Errorf("creating demo user: %w", err)
 	}
 

cmd/mxcli/help_topics/entity.txt

@@ -34,6 +34,11 @@ Attribute Constraints:
   UNIQUE                - Value must be unique
   UNIQUE ERROR 'msg'    - Unique with custom error message
   DEFAULT value         - Default value (true, false, 0, 'text')
+  CALCULATED BY Module.Microflow - Calculated attribute (persistent entities only)
+  CALCULATED Module.Microflow    - Same as above (BY is optional)
+  CALCULATED            - Marks as calculated (bind microflow in Studio Pro)
+
+  Note: CALCULATED attributes are only supported on persistent entities.
 
 Complete Example:
   CREATE PERSISTENT ENTITY MyModule.Customer (
@@ -48,7 +53,10 @@ Complete Example:
     CreatedAt: DateTime,
 
     -- Enumeration reference
-    CustomerType: Enumeration(MyModule.CustomerType)
+    CustomerType: Enumeration(MyModule.CustomerType),
+
+    -- Calculated attribute (value computed by microflow)
+    FullName: String(200) CALCULATED BY MyModule.CalcFullName
   )
   INDEX (Email)
   COMMENT 'Stores customer information';

cmd/mxcli/help_topics/security.txt

@@ -43,7 +43,7 @@ PROJECT SECURITY:
   ALTER PROJECT SECURITY DEMO USERS ON|OFF;
 
 DEMO USERS:
-  CREATE DEMO USER '<name>' PASSWORD '<pass>' (<userrole> [, ...]);
+  CREATE DEMO USER '<name>' PASSWORD '<pass>' [ENTITY Module.Entity] (<userrole> [, ...]);
   DROP DEMO USER '<name>';
 
 Examples:

cmd/mxcli/help_topics/workflow.txt

@@ -47,6 +47,55 @@ CROSS-REFERENCES
   - user_targeting: user task targeting microflow
   - admin_page: workflow overview page
 
+CREATE WORKFLOW
+--------------
+
+  CREATE [OR MODIFY] WORKFLOW Module.WorkflowName
+    PARAMETER $Context: Module.Entity
+    [OVERVIEW PAGE Module.OverviewPage]
+    [DUE DATE '<expression>']
+  BEGIN
+    <activities>
+  END WORKFLOW;
+
+  Activity types:
+    USER TASK <name> '<caption>'
+      [PAGE Module.Page]
+      [TARGETING MICROFLOW Module.MF | TARGETING XPATH '<xpath>']
+      [ENTITY Module.Entity]
+      [OUTCOMES '<outcome1>' { <activities> } '<outcome2>' { <activities> }];
+
+    CALL MICROFLOW Module.MF [COMMENT '<text>']
+      [OUTCOMES '<outcome>' { <activities> } ...];
+
+    CALL WORKFLOW Module.WF [COMMENT '<text>'];
+
+    DECISION ['<caption>'] [COMMENT '<text>']
+      OUTCOMES '<outcome>' { <activities> } ...;
+
+    PARALLEL SPLIT [COMMENT '<text>']
+      PATH 1 { <activities> }
+      PATH 2 { <activities> };
+
+    JUMP TO <activity-name> [COMMENT '<text>'];
+    WAIT FOR TIMER ['<expression>'] [COMMENT '<text>'];
+    WAIT FOR NOTIFICATION [COMMENT '<text>'];
+    END;
+
+  Example:
+    CREATE WORKFLOW Module.ApprovalFlow
+      PARAMETER $Context: Module.Request
+    BEGIN
+      USER TASK ReviewTask 'Review the request'
+        PAGE Module.ReviewPage
+        OUTCOMES 'Approve' { } 'Reject' { };
+    END WORKFLOW;
+
+DROP WORKFLOW
+-------------
+
+  DROP WORKFLOW Module.WorkflowName;
+
 CODE NAVIGATION
 ---------------
 

cmd/mxcli/lsp_completions_gen.go

@@ -198,7 +198,7 @@ func (b *Builder) buildEntities() error {
 				isCalculated := 0
 				if attr.Value != nil {
 					defaultValue = attr.Value.DefaultValue
-					if attr.Value.MicroflowID != "" {
+					if attr.Value.MicroflowName != "" || attr.Value.MicroflowID != "" {
 						isCalculated = 1
 					}
 				}

mdl/catalog/builder_modules.go

@@ -4,6 +4,7 @@ package catalog
 
 import (
 	"github.com/mendixlabs/mxcli/sdk/microflows"
+	"github.com/mendixlabs/mxcli/sdk/workflows"
 )
 
 // buildStrings extracts string literals from documents into the FTS5 strings table.
@@ -89,10 +90,85 @@ func (b *Builder) buildStrings() error {
 		}
 	}
 
+	// Extract from workflows — using cached list
+	wfList, err := b.cachedWorkflows()
+	if err == nil {
+		for _, wf := range wfList {
+			moduleID := b.hierarchy.findModuleID(wf.ContainerID)
+			moduleName := b.hierarchy.getModuleName(moduleID)
+			qn := moduleName + "." + wf.Name
+
+			if wf.WorkflowName != "" {
+				insert(qn, "WORKFLOW", wf.WorkflowName, "workflow_name", moduleName)
+			}
+			if wf.WorkflowDescription != "" {
+				insert(qn, "WORKFLOW", wf.WorkflowDescription, "workflow_description", moduleName)
+			}
+			if wf.Documentation != "" {
+				insert(qn, "WORKFLOW", wf.Documentation, "documentation", moduleName)
+			}
+
+			if wf.Flow != nil {
+				extractWorkflowFlowStrings(wf.Flow, qn, moduleName, insert)
+			}
+		}
+	}
+
 	b.report("strings", count)
 	return nil
 }
 
+// extractWorkflowFlowStrings extracts strings from workflow activities recursively.
+func extractWorkflowFlowStrings(flow *workflows.Flow, qn, moduleName string, insert func(string, string, string, string, string)) {
+	for _, act := range flow.Activities {
+		if act.GetCaption() != "" {
+			insert(qn, "WORKFLOW", act.GetCaption(), "activity_caption", moduleName)
+		}
+
+		switch a := act.(type) {
+		case *workflows.UserTask:
+			if a.TaskName != "" {
+				insert(qn, "WORKFLOW", a.TaskName, "task_name", moduleName)
+			}
+			if a.TaskDescription != "" {
+				insert(qn, "WORKFLOW", a.TaskDescription, "task_description", moduleName)
+			}
+			for _, outcome := range a.Outcomes {
+				if outcome.Caption != "" {
+					insert(qn, "WORKFLOW", outcome.Caption, "outcome_caption", moduleName)
+				}
+				if outcome.Flow != nil {
+					extractWorkflowFlowStrings(outcome.Flow, qn, moduleName, insert)
+				}
+			}
+		case *workflows.SystemTask:
+			for _, outcome := range a.Outcomes {
+				if f := outcome.GetFlow(); f != nil {
+					extractWorkflowFlowStrings(f, qn, moduleName, insert)
+				}
+			}
+		case *workflows.CallMicroflowTask:
+			for _, outcome := range a.Outcomes {
+				if f := outcome.GetFlow(); f != nil {
+					extractWorkflowFlowStrings(f, qn, moduleName, insert)
+				}
+			}
+		case *workflows.ExclusiveSplitActivity:
+			for _, outcome := range a.Outcomes {
+				if f := outcome.GetFlow(); f != nil {
+					extractWorkflowFlowStrings(f, qn, moduleName, insert)
+				}
+			}
+		case *workflows.ParallelSplitActivity:
+			for _, outcome := range a.Outcomes {
+				if outcome.Flow != nil {
+					extractWorkflowFlowStrings(outcome.Flow, qn, moduleName, insert)
+				}
+			}
+		}
+	}
+}
+
 // extractActivityStrings extracts string literals from microflow/nanoflow activities.
 func extractActivityStrings(oc *microflows.MicroflowObjectCollection, qn, objType, moduleName string, insert func(string, string, string, string, string)) {
 	if oc == nil {