check -p --references does not type a call microflow result, so a Hidden attribute of a Protected module read on it passes (CE1406) #1654

Description

Follow-up on #1498 (closed) and companion to #1652. check -p --references does not type the output variable of call microflow. A Hidden attribute of a Protected module read on such a variable is therefore not reported, while the same read through a parameter is. mxbuild refuses it with CE1406. The same gap makes the general member check silent on a call result.

Steps to reproduce

1. Create a module AddOn and switch it to export level Protected (module type Add-on) in the module settings:

   mdl 1;
   create module AddOn;
   create persistent entity AddOn.Request (Code: String(50), Secret: String(50));
   alter entity AddOn.Request set export level api;
   alter entity AddOn.Request modify attribute Code: String(50) export level api;
   
   create microflow AddOn.Request_GetFirst ()
     returns AddOn.Request as $Request
     export level api
   begin
     $Request = create AddOn.Request (Code = 'A');
     return $Request;
   end;

   AddOn.Request, AddOn.Request.Code and AddOn.Request_GetFirst are Usable; AddOn.Request.Secret is Hidden.

2. Run cases.mdl against it (ordinary module):

   mdl 1;
   -- Control: the Hidden attribute through a parameter. Reported today.
   create microflow MyFirstModule.Case0_Control ($Request: AddOn.Request)
     returns String as $Secret
   begin
     declare $Secret String = $Request/Secret;
     return $Secret;
   end;
   
   -- The same attribute on the result of a call of a Usable microflow.
   create microflow MyFirstModule.Case1_CallResultMember ()
     returns String as $Secret
   begin
     $Request = call microflow AddOn.Request_GetFirst();
     declare $Secret String = $Request/Secret;
     return $Secret;
   end;

3. mxcli check cases.mdl -p App.mpr --references, then (without the control) mxcli exec and mx check App.mpr.

Expected behavior

CE1406 for Case1, like for the control.

Actual behavior

Only the control (statement 1) is reported. Without it: ✓ All references valid, exec writes the microflow, and then:

$ mx check App.mpr
[error] [CE1406] "Create variable activity 'Create String variable' is not allowed to use attribute 'AddOn.Request.Secret' because app modules cannot reference hidden elements in add-on modules."

Environment

• mxcli v0.28.0 (2026-10-23), macOS arm64
• mx check: Mendix 11.12.4 (fresh app)
• check also reproduced on the repository's testdata/testapp (Mendix 11.14.0, clean HOME)
• validate_member_refs.go on main is unchanged since 2026-10-21

Root cause

walkTypedFlow (mdl/executor/validate_member_refs.go) types the variables of parameters, create, retrieve and loop iterators, but not the output variable of call microflow. $Request/Secret then has no entity, and pathMembers("") returns nothing, both in checkFlowMembers and in checkMembers.

Proposed fix

In walkTypedFlow, type the output of call microflow from the callee's return type (an ObjectType or ListType carries EntityQualifiedName):

case *ast.CallMicroflowStmt:
    if s.OutputVariable != "" {
        if qn, ok := microflowReturnEntity(ctx, s.MicroflowName); ok { // stored microflow, via microflowsNamed
            vars[s.OutputVariable] = qn
        }
    }

A callee the same script creates is not in the backend yet; resolving it from the script's CreateMicroflowStmt.ReturnType would close that too, but it can stay silent as today.

Test in TestValidateProtectedModuleRefs (needs a Usable microflow in the fixture that returns MyAddOn.Pub, e.g. API_GetPub):

{"hidden attribute on a call result",
    "create microflow MyFirstModule.G () returns String begin $p = call microflow MyAddOn.API_GetPub(); return $p/Inner; end;",
    []string{"CE1406", "attribute 'MyAddOn.Pub.Inner'"}},

plus the same in an ordinary module as the control that stays clean.

I have a fix with tests ready and will open a PR referencing this issue shortly.