feat: comprehensive nanoflow support — CREATE, DROP, CALL, GRANT/REVOKE, SHOW ACCESS, MERMAID

[retran]

Why

Nanoflows are a core Mendix document type used heavily in mobile and offline-first apps. Until this PR, mxcli had read-only support (SHOW/DESCRIBE) but no ability to create, modify, or manage nanoflows programmatically. This blocked agentic workflows that need to scaffold or refactor nanoflow logic — a gap visible in the feature matrix where nanoflows lagged far behind microflows.

This PR closes that gap by bringing nanoflows to full feature parity with microflows across all mxcli layers: grammar, executor, SDK, validation, visualization, and security management.

Summary

52 files changed across grammar, AST, visitor, executor, SDK, and docs.

New commands:

• CREATE [OR MODIFY] NANOFLOW — with body, parameters, return type, folder placement
• DROP NANOFLOW
• CALL NANOFLOW (inside flow bodies — valid in both microflows and nanoflows)
• GRANT/REVOKE EXECUTE ON NANOFLOW
• SHOW ACCESS ON NANOFLOW
• DESCRIBE MERMAID NANOFLOW

Key implementation details:

• Type-switch validation for 21 disallowed nanoflow actions (compiler-checked denylist)
• Entity resolver errors propagated upfront (no silent failures)
• NanoflowCallAction with correct OutputVariableName BSON field (differs from MicroflowCallAction.ResultVariableName per Mendix metamodel)
• Shared buildEntityNames helper eliminating duplication in Mermaid rendering
• Full serializeNanoflow() rewrite — now serializes body, flows, return type, parameters (was incomplete)

Bug fixes included:

• serializeNanoflow() was missing ReturnType, ObjectCollection, and Flows — created nanoflows lost their body when written to .mpr
• NanoflowCallAction BSON field name corrected from ResultVariableName to OutputVariableName (verified against metamodel)
• Mermaid renderer now handles NanoflowCallAction (was showing generic "Action" label)

Tests:

• 33 integration tests (roundtrip_nanoflow_test.go) — CREATE, DROP, CALL, GRANT/REVOKE, SHOW, MOVE, RENAME, MERMAID, validation, error paths
• 36 mock tests (cmd_nanoflows_mock_test.go) — not-connected guards, duplicate handling, idempotent grant/revoke, validation of all disallowed actions, nested body validation
• 5 BSON roundtrip tests (roundtrip_test.go) — parse→serialize→parse cycle for nanoflows with activities, flows, and roles

Docs updated:

• MDL_FEATURE_MATRIX.md — nanoflow row updated to reflect implemented state
• MDL_QUICK_REFERENCE.md — added CREATE, MOVE, GRANT/REVOKE, SHOW ACCESS
• 01-language-reference.md — added CREATE/DROP/GRANT/REVOKE nanoflow sections
• grammar-reference.md — added createNanoflowStatement
• PROPOSAL_nanoflow_support.md — rewritten as feature description
• Comprehensive test plan: docs/15-testing/nanoflow-test-cases.md (19 sections, 100+ cases)

All tests pass (make build && make test && make lint-go).

[Copilot]

Pull request overview

Adds end-to-end nanoflow support to mxcli/MDL to reach parity with existing microflow functionality, spanning grammar/AST, executor behavior, SDK BSON parsing/writing, Mermaid rendering, and test/docs updates.

Changes:

• Extends MDL grammar + AST + visitors to support CREATE/DROP NANOFLOW, CALL NANOFLOW (in flow bodies), GRANT/REVOKE EXECUTE ON NANOFLOW, and SHOW ACCESS ON NANOFLOW.
• Implements executor handlers for nanoflow lifecycle + access control + Mermaid rendering, plus validation and reference-checking updates.
• Adds SDK nanoflow parsing/serialization (including NanoflowCallAction) and roundtrip tests, plus new documentation and test plans.

Reviewed changes

Copilot reviewed 53 out of 56 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
sdk/mpr/writer_security_test.go	Minor formatting fix in existing security writer test.
sdk/mpr/writer_microflow_actions.go	Adds BSON serialization for Microflows$NanoflowCallAction.
sdk/mpr/writer_microflow.go	Implements nanoflow BSON serialization including flows/return type/object collection.
sdk/mpr/roundtrip_test.go	Adds nanoflow roundtrip tests (baseline + synthetic).
sdk/mpr/parser_nanoflow.go	Parses AllowedModuleRoles for nanoflows.
sdk/mpr/parser_microflow_actions.go	Adds parser for NanoflowCallAction.
sdk/mpr/parser_microflow.go	Registers Microflows$NanoflowCallAction parser.
sdk/microflows/microflows_actions.go	Introduces SDK types: NanoflowCallAction, NanoflowCall, mappings.
sdk/microflows/microflows.go	Adds AllowedModuleRoles to Nanoflow model.
mdl/visitor/visitor_security.go	Builds GRANT/REVOKE nanoflow access AST statements.
mdl/visitor/visitor_query.go	Extends SHOW ACCESS to include NANOFLOW.
mdl/visitor/visitor_microflow_statements.go	Allows CALL NANOFLOW in flow body statements + annotations wiring.
mdl/visitor/visitor_microflow_actions.go	Builds CallNanoflowStmt from parse tree.
mdl/visitor/visitor_microflow.go	Builds CreateNanoflowStmt from parse tree.
mdl/visitor/visitor_entity.go	Extends DROP to include NANOFLOW.
mdl/grammar/parser/mdlparser_listener.go	Generated listener interface updates for new productions.
mdl/grammar/parser/mdlparser_base_listener.go	Generated base listener updates for new productions.
mdl/grammar/MDLParser.g4	Adds grammar for create/call nanoflow + access grant/revoke + SHOW ACCESS ON NANOFLOW.
mdl/executor/validate_microflow.go	Treats CallNanoflowStmt like other statements for naming/vars/error-handling.
mdl/executor/validate.go	Tracks nanoflow defs; validates nanoflow bodies; adds nanoflow forward-ref/ref checks.
mdl/executor/stmt_summary.go	Adds summaries for nanoflow grant/revoke statements.
mdl/executor/roundtrip_nanoflow_test.go	Integration tests (build tag) covering nanoflow commands end-to-end.
mdl/executor/registry_test.go	Registers new nanoflow statement types in known-statement list.
mdl/executor/registry.go	Routes registration via combined microflow/nanoflow handler registrar.
mdl/executor/register_stubs.go	Registers create/drop nanoflow and security handlers.
mdl/executor/nanoflow_validation.go	Adds nanoflow-specific body/return-type validation.
mdl/executor/executor_query.go	Wires SHOW ACCESS ON NANOFLOW execution.
mdl/executor/executor.go	Adds executor caches for created/dropped nanoflows.
mdl/executor/exec_context.go	Tracks created nanoflows in executor session cache.
mdl/executor/cmd_security_write.go	Implements GRANT/REVOKE EXECUTE ON NANOFLOW.
mdl/executor/cmd_security.go	Implements SHOW ACCESS ON NANOFLOW.
mdl/executor/cmd_nanoflows_mock_test.go	Adds mock-based unit tests for nanoflow commands/validation.
mdl/executor/cmd_nanoflows_drop.go	Implements DROP NANOFLOW execution.
mdl/executor/cmd_nanoflows_create.go	Implements CREATE (OR MODIFY) NANOFLOW execution + graph building.
mdl/executor/cmd_microflows_format_action.go	Formats NanoflowCallAction in DESCRIBE output.
mdl/executor/cmd_microflows_builder_validate.go	Adds builder validation for CallNanoflowStmt outputs/error blocks.
mdl/executor/cmd_microflows_builder_graph.go	Adds graph builder dispatch for CallNanoflowStmt.
mdl/executor/cmd_microflows_builder_calls.go	Builds NanoflowCallAction from CALL NANOFLOW statements.
mdl/executor/cmd_microflows_builder_annotations.go	Exposes annotations for CallNanoflowStmt.
mdl/executor/cmd_microflows_builder.go	Adds backend lookup for nanoflow return types.
mdl/executor/cmd_mermaid_mock_test.go	Updates Mermaid unsupported-type test now that nanoflow is supported.
mdl/executor/cmd_mermaid.go	Adds Mermaid rendering for nanoflows and shares entity-name building logic.
mdl/executor/cmd_diff_mdl.go	Adds diff rendering for CallNanoflowStmt.
mdl/ast/ast_security.go	Adds AST statement types for nanoflow grant/revoke access.
mdl/ast/ast_query.go	Adds ShowAccessOnNanoflow enum value.
mdl/ast/ast_microflow.go	Adds CreateNanoflowStmt, DropNanoflowStmt, CallNanoflowStmt.
docs/15-testing/nanoflow-test-cases.md	Adds comprehensive manual test plan (needs updates per review comments).
docs/11-proposals/show-describe-nanoflows.md	Marks older proposal as superseded.
docs/11-proposals/PROPOSAL_nanoflow_support.md	Adds consolidated proposal doc (needs updates per review comments).
docs/06-mdl-reference/grammar-reference.md	Documents createNanoflowStatement in grammar reference.
docs/05-mdl-specification/01-language-reference.md	Adds language-reference entries for nanoflow commands (needs updates per review comments).
docs/01-project/MDL_QUICK_REFERENCE.md	Adds quick reference entries for nanoflow commands (needs updates per review comments).
docs/01-project/MDL_FEATURE_MATRIX.md	Updates feature matrix to reflect nanoflow support + Mermaid.
.claude/skills/mendix/write-nanoflows.md	Adds “write nanoflows” skill doc (contains inaccuracies per review comments).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 53 out of 56 changed files in this pull request and generated 3 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 53 out of 56 changed files in this pull request and generated 3 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 53 out of 56 changed files in this pull request and generated no new comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.