feat(plugins): add Snowflake database driver (#1420)

[xantiagoma]

Summary

Adds a Snowflake database driver plugin, addressing #1420.

The driver speaks the Snowflake connector REST protocol (/session/v1/login-request + /queries/v1/query-request) — the same wire protocol the official drivers use — and supports every authentication method from the issue:

• Username & password, including MFA TOTP passcodes and MFA token caching (CLIENT_REQUEST_MFA_TOKEN), so a code is only needed once per token lifetime when the account allows caching
• Key pair (.p8) via SNOWFLAKE_JWT, including encrypted keys (passphrase) and SPKI public-key fingerprints
• External browser SSO (EXTERNALBROWSER) with a localhost callback listener for the IdP redirect
• OAuth / programmatic access tokens
• Optional prefill from the Snowflake CLI's ~/.snowflake/connections.toml / config.toml by connection name

Also implements session token renewal on expiry (390112), query cancellation via abort-request, encrypted (SSE-C) result-chunk download with gzip inflation, database/schema navigation with USE, DDL via GET_DDL, and a Snowflake SQL dialect (375 functions / 172 keywords / 43 data types harvested from the official SQL reference) for highlighting and completions. scripts/add-snowflake-to-xcode.rb wires the .tableplugin target, and the registry release workflow gets a snowflake case.

One protocol gotcha worth recording: /queries/v1/query-request silently rejects UPPERCASE UUIDs in requestId with an empty HTTP 400 (Swift's UUID().uuidString default), while the login endpoint accepts them — every official connector emits lowercase by language convention, so their code never mentions it.

The second commit adds two DEBUG-only development affordances (both compiled out of Release builds): TABLEPRO_ALLOW_UNSIGNED_PLUGINS=1 to load locally built plugins past the team-signature check, and a file-based keychain fallback when the build lacks an application identifier. Without these, contributors cannot run a plugin they build, since only CI holds the team certificate. Happy to drop or rework that commit if you prefer another approach.

Testing

• Live-tested against a real Snowflake account: password, password+TOTP, and PAT authentication; schema/table browsing; 3.2B-row table pagination; full result sets via encrypted chunk downloads (7k+ rows in one query); query cancellation; reconnects and session persistence
• swiftlint lint --strict clean on all changed files
• DatabaseType package tests updated and passing (18 known types)
• Pre-existing note: SQLCompletionProviderTests/testProviderAcceptsDatabaseType and testMySQLProviderTypes fail order-dependently when the autocomplete suites run together — reproduces identically on main, unrelated to this PR (can file a separate issue)

Checklist

• Tests added or updated
• CHANGELOG.md updated under [Unreleased]
• Docs updated (docs/databases/snowflake.mdx + navigation)
• User-facing strings localized
• No SwiftLint violations (swiftformat skipped: the repo .swiftformat uses --ifdefindent, which current Homebrew swiftformat doesn't recognize)

Closes #1420

🤖 Generated with Claude Code

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4e90b05ba2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Disable drop-database support or implement it

When the Snowflake metadata advertises database dropping, the app can enable the database-delete flow for Snowflake connections, but SnowflakePluginDriver does not override dropDatabase(name:), so it falls back to the PluginDatabaseDriver default that throws “Drop database is not supported.” Either implement DROP DATABASE for this driver or set this capability (and the mirrored CloudDefaults flag) to false so users are not offered an action that always fails.

Useful? React with 👍 / 👎.

[xantiagoma]

Good catch — implemented createDatabase/dropDatabase (plus the create-database form spec) in aabf4c7, mirroring the BigQuery driver: CREATE DATABASE / DROP DATABASE IF EXISTS with quoted identifiers.

[xantiagoma]

I have read the CLA Document and I hereby sign the CLA.

[xantiagoma]

Triage of the macOS App Tests failure on this PR — none of the failures originate here:

• SQL Context Analyzer ("Strips quoting from the captured schema segment"): fails on main itself since the feat(editor): complete database, schema, and table segments in qualified names #1581 squash — the table-ref regex couldn't cross quoted segments. Fix: fix(editor): capture quoted identifiers in qualified table references #1586.
• ExecuteQueryTool (2 issues): pre-existing on main's last several runs, predates this PR.
• PasswordSourceResolver (3 issues): passes locally on this branch (41/41); the failing cases spawn shell subprocesses, so this looks like runner flakiness — a re-run should clear it.

Will update the branch from main once #1586 lands to get a clean run.

🤖 Generated with Claude Code