docs: update docs and skills for workflow, calculated attributes, security

- MDL_QUICK_REFERENCE.md: add Workflows section with all activity types
- MDL_FEATURE_MATRIX.md: mark workflow SHOW/DESCRIBE/CREATE/DROP/GRANT/REVOKE
- docs/language-reference.md: add CALCULATED attribute syntax
- Skills: docker-workflow (empty project, port conflicts, runtime copying)
- Skills: generate-domain-model (CALCULATED attribute docs)
- Skills: manage-security (ENTITY clause for CREATE DEMO USER)
- CLAUDE.md: update project status for implemented features

Author: engalar

.claude/skills/mendix/docker-workflow.md

@@ -50,6 +50,21 @@ mxcli docker run -p app.mpr --fresh --wait
 
 `docker run` handles everything: downloads MxBuild and runtime (if not cached), initializes the Docker stack (if needed), builds the PAD package, starts the containers, and optionally waits for the runtime to report successful startup.
 
+## Creating an Empty Mendix App
+
+To create a new blank Mendix project for testing (requires mxbuild to be downloaded first):
+
+```bash
+# Download mxbuild if not already cached
+mxcli setup mxbuild --version 11.6.4
+
+# Create a blank project
+mkdir -p /path/to/my-app
+~/.mxcli/mxbuild/{version}/modeler/mx create-project --app-name MyApp --output-dir /path/to/my-app
+```
+
+The `mx create-project` command creates an MPR v2 project with the standard Mendix module structure. You can then use the Docker workflow to build and run it.
+
 ## Step-by-Step Workflow
 
 If you prefer more control, use the individual commands:
@@ -65,13 +80,38 @@ mxcli setup mxbuild -p app.mpr
 # Download Mendix runtime matching the project version
 mxcli setup mxruntime -p app.mpr
 
+# Or specify version explicitly (without a project)
+mxcli setup mxbuild --version 11.6.4
+mxcli setup mxruntime --version 11.6.4
+
 # Or preview what would be downloaded
 mxcli setup mxbuild -p app.mpr --dry-run
 mxcli setup mxruntime -p app.mpr --dry-run
 ```
 
 MxBuild is cached at `~/.mxcli/mxbuild/{version}/` and the runtime at `~/.mxcli/runtime/{version}/`. Both are reused across builds.
 
+#### Runtime-to-MxBuild Copying (PAD Build Prerequisite)
+
+MxBuild 11.6.3+ expects runtime files (`pad/`, `lib/`, `launcher/`, `agents/`) inside its own `runtime/` directory, but `mxcli setup mxbuild` only downloads the build tools (not the full runtime). If the PAD build fails with `StudioPro.conf.hbs does not exist` or `ClassNotFoundException`, copy the runtime directories into mxbuild:
+
+```bash
+VERSION=11.6.4  # replace with your version
+
+# After downloading both mxbuild and mxruntime:
+cp -r ~/.mxcli/runtime/$VERSION/runtime/pad ~/.mxcli/mxbuild/$VERSION/runtime/pad
+cp -r ~/.mxcli/runtime/$VERSION/runtime/lib ~/.mxcli/mxbuild/$VERSION/runtime/lib
+cp -r ~/.mxcli/runtime/$VERSION/runtime/launcher ~/.mxcli/mxbuild/$VERSION/runtime/launcher
+cp -r ~/.mxcli/runtime/$VERSION/runtime/agents ~/.mxcli/mxbuild/$VERSION/runtime/agents
+```
+
+**Important:** The PAD build output may only include partial runtime bundles (5 jars instead of 354). If the runtime fails to start with `ClassNotFoundException: com.mendix.container.support.EventProcessor`, copy the full runtime into the PAD build output:
+
+```bash
+rm -rf /path/to/project/.docker/build/lib/runtime
+cp -r ~/.mxcli/runtime/$VERSION/runtime /path/to/project/.docker/build/lib/runtime
+```
+
 ### 2. Initialize Docker stack (first time only)
 
 ```bash
@@ -81,6 +121,16 @@ mxcli docker init -p app.mpr
 
 This creates a `.docker/` directory with Docker Compose configuration for the Mendix app + PostgreSQL.
 
+**Port conflicts:** If default ports (8080/8090/5432) are already in use, check with `ss -tlnp | grep -E '808|809|543'` and use `--port-offset N` to shift all ports:
+
+```bash
+# Check which ports are occupied
+ss -tlnp | grep -E '808[0-9]|809[0-9]|543[0-9]'
+
+# Use offset to avoid conflicts (e.g., offset 5 → 8085/8095/5437)
+mxcli docker init -p app.mpr --port-offset 5
+```
+
 ### 3. Check project for errors
 
 ```bash
@@ -346,6 +396,9 @@ All defaults can be overridden in `.docker/.env`.
 | Build fails with version error | Requires Mendix >= 11.6.1 for PAD support |
 | No Dockerfile in PAD output | Normal for MxBuild 11.6.3+ — `mxcli docker build` auto-generates one |
 | Runtime not found / runtimelauncher.jar missing | Run `mxcli setup mxruntime -p app.mpr` or let `docker build` auto-download |
+| `StudioPro.conf.hbs does not exist` | Runtime not linked into mxbuild — see "Runtime-to-MxBuild Copying" above |
+| `ClassNotFoundException: EventProcessor` | PAD has partial runtime bundles — copy full runtime into `.docker/build/lib/runtime/` (see above) |
+| Port already allocated | Check ports with `ss -tlnp \| grep 808` and use `docker init --port-offset N --force` |
 | `' etc/Default' is not a file` | Dockerfile CMD passes config arg — `docker build` patches this automatically |
 | `DatabasePassword has no value` | Ensure `RUNTIME_PARAMS_DATABASE*` env vars are in docker-compose.yml — re-run `mxcli docker init --force` |
 | `Password should not be empty (debugger)` | Add `RUNTIME_DEBUGGER_PASSWORD` — re-run `mxcli docker init --force` |

.claude/skills/mendix/generate-domain-model.md

@@ -326,6 +326,29 @@ COMMENT 'Additional documentation';
 
 **Naming Convention**: `{FromEntity}_{ToEntity}` (e.g., `Order_Customer`, `Transaction_Account`)
 
+#### Calculated Attributes
+
+Calculated attributes derive their value from a microflow at runtime. Use `CALCULATED BY Module.Microflow` to specify the calculation microflow.
+
+**IMPORTANT: CALCULATED attributes are only supported on PERSISTENT entities.** Using CALCULATED on non-persistent entities will produce a validation error.
+
+```sql
+@Position(100, 100)
+CREATE PERSISTENT ENTITY Module.OrderLine (
+  /** Unit price */
+  UnitPrice: Decimal NOT NULL,
+  /** Quantity ordered */
+  Quantity: Integer NOT NULL,
+  /** Total price, calculated by microflow */
+  TotalPrice: Decimal CALCULATED BY Module.CalcTotalPrice
+);
+```
+
+**Syntax variants:**
+- `CALCULATED BY Module.Microflow` — recommended, binds the calculation microflow directly
+- `CALCULATED Module.Microflow` — also valid (`BY` keyword is optional)
+- `CALCULATED` — bare form, marks as calculated but requires manual microflow binding in Studio Pro
+
 ### Data Types
 
 | Type | Example | Description |

.claude/skills/mendix/manage-security.md

@@ -171,13 +171,18 @@ ALTER PROJECT SECURITY DEMO USERS OFF;
 ### Demo Users
 
 ```sql
--- Create demo user with roles
+-- Create demo user (auto-detects entity that generalizes System.User)
 CREATE DEMO USER 'demo_admin' PASSWORD 'Admin123!' (Administrator, SuperAdmin);
 
+-- Create demo user with explicit entity
+CREATE DEMO USER 'demo_admin' PASSWORD 'Admin123!' ENTITY Administration.Account (Administrator, SuperAdmin);
+
 -- Remove demo user
 DROP DEMO USER 'demo_admin';
 ```
 
+The ENTITY clause specifies which entity (generalizing `System.User`) to use. If omitted, it auto-detects the unique System.User subtype in the project. If multiple subtypes exist, you must specify ENTITY explicitly.
+
 ## Starlark Lint Rule APIs
 
 Security data is available in Starlark lint rules (`.star` files):

.gitignore

@@ -54,3 +54,6 @@ grammardoc
 *.pptx
 # Excluded skills
 .claude/skills/mendix/migrate-outsystems.md
+
+# Snap tool binary (used for BSON fixture generation)
+snap-bson

CLAUDE.md

@@ -325,9 +325,11 @@ Full syntax tables for all MDL statements (microflows, pages, security, navigati
 - Data import from external databases into Mendix app DB (`IMPORT FROM ... INTO ... MAP ...`)
 - Database Connector generation from external schema (`SQL <alias> GENERATE CONNECTOR INTO <module>`)
 - EXECUTE DATABASE QUERY microflow action (static, dynamic SQL, parameterized, runtime connection override)
+- CREATE/DROP WORKFLOW with user tasks, decisions, parallel splits, and other activity types
+- CALCULATED BY microflow syntax for calculated attributes
 
 **Not Yet Implemented:**
-- 48 of 52 metamodel domains (workflows, REST, etc.)
+- 47 of 52 metamodel domains (REST, etc.)
 - Delta/change tracking system
 - Runtime type reflection
 

cmd/mxcli/skills/generate-domain-model.md

@@ -326,6 +326,29 @@ COMMENT 'Additional documentation';
 
 **Naming Convention**: `{FromEntity}_{ToEntity}` (e.g., `Order_Customer`, `Transaction_Account`)
 
+#### Calculated Attributes
+
+Calculated attributes derive their value from a microflow at runtime. Use `CALCULATED BY Module.Microflow` to specify the calculation microflow.
+
+**IMPORTANT: CALCULATED attributes are only supported on PERSISTENT entities.** Using CALCULATED on non-persistent entities will produce a validation error.
+
+```sql
+@Position(100, 100)
+CREATE PERSISTENT ENTITY Module.OrderLine (
+  /** Unit price */
+  UnitPrice: Decimal NOT NULL,
+  /** Quantity ordered */
+  Quantity: Integer NOT NULL,
+  /** Total price, calculated by microflow */
+  TotalPrice: Decimal CALCULATED BY Module.CalcTotalPrice
+);
+```
+
+**Syntax variants:**
+- `CALCULATED BY Module.Microflow` — recommended, binds the calculation microflow directly
+- `CALCULATED Module.Microflow` — also valid (`BY` keyword is optional)
+- `CALCULATED` — bare form, marks as calculated but requires manual microflow binding in Studio Pro
+
 ### Data Types
 
 | Type | Example | Description |

docs/01-project/MDL_FEATURE_MATRIX.md

@@ -204,7 +204,7 @@ Document types that exist in Mendix but have no MDL support:
 | **JSON transformations** | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | JSON structure definitions |
 | **Message definitions** | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | Message definition documents |
 | **XML schemas** | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | Imported XML schema documents |
-| **Workflows** | Y | Y | N | N | N | N | N | N | Y | Y | N | N | Y | N | N | Y | N | SHOW/DESCRIBE work; CREATE/DROP not implemented |
+| **Workflows** | Y | Y | Y | N | Y | N | N | N | Y | Y | N | N | Y | N | Y | Y | N | SHOW/DESCRIBE/CREATE/DROP/GRANT/REVOKE implemented |
 | **Module settings** | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | Module-level configuration |
 | **Image collection** | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | Image document collections |
 | **Icon collection** | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | Icon/glyph collections |

docs/01-project/MDL_QUICK_REFERENCE.md

@@ -208,9 +208,43 @@ Nested folders use `/` separator: `'Parent/Child/Grandchild'`. Missing folders a
 | Revoke entity access | `REVOKE Mod.Role ON Mod.Entity;` | |
 | Set security level | `ALTER PROJECT SECURITY LEVEL OFF\|PROTOTYPE\|PRODUCTION;` | |
 | Toggle demo users | `ALTER PROJECT SECURITY DEMO USERS ON\|OFF;` | |
-| Create demo user | `CREATE DEMO USER 'name' PASSWORD 'pass' (UserRole, ...);` | |
+| Create demo user | `CREATE DEMO USER 'name' PASSWORD 'pass' [ENTITY Module.Entity] (UserRole, ...);` | |
 | Drop demo user | `DROP DEMO USER 'name';` | |
 
+## Workflows
+
+| Statement | Syntax | Notes |
+|-----------|--------|-------|
+| Show workflows | `SHOW WORKFLOWS [IN Module];` | List all or filter by module |
+| Describe workflow | `DESCRIBE WORKFLOW Module.Name;` | Full MDL output |
+| Create workflow | `CREATE [OR MODIFY] WORKFLOW Module.Name PARAMETER $Ctx: Module.Entity BEGIN ... END WORKFLOW;` | See activity types below |
+| Drop workflow | `DROP WORKFLOW Module.Name;` | |
+| Grant workflow access | `GRANT EXECUTE ON WORKFLOW Module.Name TO Mod.Role, ...;` | |
+| Revoke workflow access | `REVOKE EXECUTE ON WORKFLOW Module.Name FROM Mod.Role, ...;` | |
+
+**Workflow Activity Types:**
+- `USER TASK <name> '<caption>' [PAGE Mod.Page] [TARGETING MICROFLOW Mod.MF] [OUTCOMES '<out>' { } ...];`
+- `CALL MICROFLOW Mod.MF [COMMENT '<text>'] [OUTCOMES '<out>' { } ...];`
+- `CALL WORKFLOW Mod.WF [COMMENT '<text>'];`
+- `DECISION ['<caption>'] OUTCOMES '<out>' { } ...;`
+- `PARALLEL SPLIT PATH 1 { } PATH 2 { };`
+- `JUMP TO <activity-name>;`
+- `WAIT FOR TIMER ['<expr>'];`
+- `WAIT FOR NOTIFICATION;`
+- `END;`
+
+**Example:**
+```sql
+CREATE WORKFLOW Module.ApprovalFlow
+  PARAMETER $Context: Module.Request
+  OVERVIEW PAGE Module.WorkflowOverview
+BEGIN
+  USER TASK ReviewTask 'Review the request'
+    PAGE Module.ReviewPage
+    OUTCOMES 'Approve' { } 'Reject' { };
+END WORKFLOW;
+```
+
 ## Project Structure
 
 | Statement | Syntax | Notes |
@@ -417,6 +451,8 @@ Both double-quote (ANSI SQL) and backtick (MySQL) styles are supported. You can
 
 **Boolean attributes** auto-default to `false` when no `DEFAULT` is specified.
 
+**CALCULATED** marks an attribute as calculated (not stored). Use `CALCULATED BY Module.Microflow` to specify the calculation microflow. Calculated attributes derive their value from a microflow at runtime.
+
 **ButtonStyle** supports all values: `Primary`, `Default`, `Success`, `Danger`, `Warning`, `Info`.
 
 ## External SQL Statements

docs/05-mdl-specification/01-language-reference.md

@@ -405,7 +405,7 @@ CREATE [OR MODIFY] <entity-type> ENTITY <qualified-name> (
 **Attribute Definition:**
 ```sql
 [/** <documentation> */]
-<name>: <type> [NOT NULL [ERROR '<message>']] [UNIQUE [ERROR '<message>']] [DEFAULT <value>]
+<name>: <type> [NOT NULL [ERROR '<message>']] [UNIQUE [ERROR '<message>']] [DEFAULT <value>] [CALCULATED]
 ```
 
 **Examples:**
@@ -1084,12 +1084,15 @@ Creates a demo user for development/testing.
 
 **Syntax:**
 ```sql
-CREATE DEMO USER '<username>' PASSWORD '<password>' (<userrole> [, ...])
+CREATE DEMO USER '<username>' PASSWORD '<password>' [ENTITY <Module.Entity>] (<userrole> [, ...])
 ```
 
+The optional `ENTITY` clause specifies the entity that generalizes `System.User` (e.g., `Administration.Account`). If omitted, the system auto-detects the unique `System.User` subtype.
+
 **Example:**
 ```sql
 CREATE DEMO USER 'demo_admin' PASSWORD 'Admin123!' (AppAdmin);
+CREATE DEMO USER 'demo_admin' PASSWORD 'Admin123!' ENTITY Administration.Account (AppAdmin);
 ```
 
 ### DROP DEMO USER