Add Athena SSO connector and data cell context menu

README.it.md

@@ -25,11 +25,11 @@ Il selettore di lingua offre **inglese, italiano, francese, tedesco e spagnolo**
 
 ## Database
 
-13 profili: **SQLite, PostgreSQL, Aurora PostgreSQL, CockroachDB, Redshift, MySQL, MariaDB, Aurora MySQL, Databricks SQL, SQL Server, ClickHouse, MongoDB e Redis**. Gli adapter usano driver reali; Aurora usa il protocollo del proprio engine. Databricks, Redshift e ClickHouse sono in lettura. MongoDB e Redis usano operazioni JSON consentite, con scritture revisionate e senza rollback comune.
+14 profili: **SQLite, Amazon Athena, PostgreSQL, Aurora PostgreSQL, CockroachDB, Redshift, MySQL, MariaDB, Aurora MySQL, Databricks SQL, SQL Server, ClickHouse, MongoDB e Redis**. Gli adapter usano driver reali; Aurora usa il protocollo del proprio engine. Athena usa il profilo AWS locale, un ruolo IAM facoltativo e un workgroup. Athena, Databricks, Redshift e ClickHouse sono in lettura. MongoDB e Redis usano operazioni JSON consentite, con scritture revisionate e senza rollback comune.
 
 SQLite, PostgreSQL, MySQL, MongoDB, Redis e ClickHouse hanno prove su fixture locali reali. Account cloud Databricks/Aurora/Redshift e server CockroachDB, MariaDB e SQL Server richiedono una verifica specifica. Consulta [capacità e limiti](docs/DATABASES.md) e [validazione](docs/VALIDATION.md).
 
-Le nuove connessioni sono in lettura. TLS verifica i certificati remoti quando attivo; i ruoli nel database restano l'autorità sul server. Questa versione non implementa tunnel SSH, IAM/OAuth dei database, Oracle, Snowflake, BigQuery, Cassandra, DuckDB, Elasticsearch, DDL, backup/restore o importazioni massive.
+Le nuove connessioni sono in lettura. Prima di usare Athena completa il login AWS SSO per il profilo scelto. TLS verifica i certificati remoti quando attivo; i ruoli nel database restano l'autorità sul server. Questa versione non implementa tunnel SSH, IAM/OAuth per gli altri database, Oracle, Snowflake, BigQuery, Cassandra, DuckDB, Elasticsearch, DDL, backup/restore o importazioni massive.
 
 ## Assistente
 

README.md

@@ -29,12 +29,12 @@ Open **Local demo** to use a real SQLite database with 120 customers, 36 product
 | PostgreSQL | PostgreSQL, Aurora PostgreSQL, CockroachDB | Reviewed transactional writes |
 | MySQL | MySQL, MariaDB, Aurora MySQL | Reviewed transactional writes; InnoDB required |
 | SQL Server | SQL Server | Reviewed transactional writes |
-| Analytics | Databricks SQL, Redshift, ClickHouse | Read-only |
+| Analytics | Amazon Athena, Databricks SQL, Redshift, ClickHouse | Read-only |
 | Document / key-value | MongoDB, Redis | Reviewed allowlisted JSON operations; no shared rollback |
 
 Adapters use real client libraries. Aurora profiles use their engine's protocol. The catalog exposes each adapter's capabilities; it does not imply live cloud certification. Local fixture checks cover SQLite, PostgreSQL, MySQL, MongoDB, Redis and ClickHouse. Live Databricks/Aurora/Redshift accounts, CockroachDB, MariaDB and SQL Server need separate acceptance tests. See [database capabilities](docs/DATABASES.md) and [validation](docs/VALIDATION.md).
 
-New connections start read-only. TLS verifies remote certificates when enabled. Database principals remain the server-side authority. SSH tunnels, database IAM/OAuth, Oracle, Snowflake, BigQuery, Cassandra, DuckDB, Elasticsearch, DDL, backup/restore and bulk import are not implemented in this release.
+New connections start read-only. Athena uses a local AWS profile, an optional assumed role, and a selected workgroup; complete AWS SSO login before connecting. TLS verifies remote certificates when enabled. Database principals remain the server-side authority. SSH tunnels, database IAM/OAuth for other engines, Oracle, Snowflake, BigQuery, Cassandra, DuckDB, Elasticsearch, DDL, backup/restore and bulk import are not implemented in this release.
 
 ## Assistant
 

THIRD_PARTY_NOTICES.md

@@ -53,9 +53,9 @@ The application uses the following main open-source packages. Their source distr
 | ClickHouse JavaScript client | Apache-2.0 |
 | AWS SDK for JavaScript v3 | Apache-2.0 |
 | Google Auth Library for Node.js | Apache-2.0 |
-| Databricks native SQL kernel and FlatBuffers | Apache-2.0 |
+| FlatBuffers JavaScript runtime | Apache-2.0 |
 | LZ4 N-API native bindings | MIT |
 | TypeScript, Playwright | Apache-2.0; build and test tooling |
 | Vite, electron-builder | MIT; build tooling |
 
-`package-lock.json` identifies exact dependency versions. The installed runtime dependency license inventory uses MIT, Apache-2.0, ISC, BSD-2-Clause, BSD-3-Clause and 0BSD, including the Apache-2.0 text in FlatBuffers' `LICENSE`. Platform-specific optional packages differ by installation. Transitive packages keep their distributed copyright and license notices; Electron's Chromium notices must remain in distributed bundles. No third-party service grants or account rights are implied by the integration adapters.
+`package-lock.json` identifies exact dependency versions. The installed runtime dependency license inventory uses MIT, Apache-2.0, ISC, BSD-2-Clause, BSD-3-Clause and 0BSD, including the Apache-2.0 text in FlatBuffers' `LICENSE`. The Databricks SQL JavaScript Thrift backend is included; its optional native SQL kernel binary and platform package are excluded from Tableline 0.2.2. Platform-specific optional packages differ by installation. Transitive packages keep their distributed copyright and license notices; Electron's Chromium notices must remain in distributed bundles. No third-party service grants or account rights are implied by the integration adapters.

assets/electron-notices.json

@@ -1,82 +1,82 @@
 {
   "version": 2,
-  "electronVersion": "44.5.1",
+  "electronVersion": "44.10.0",
   "distributions": {
     "darwin-arm64": {
-      "upstreamArchiveSha256": "1d75703019bb16461ae65f3081d7e6f5c0b11e901d0ccb5c343bcf7bcdd6435c",
+      "upstreamArchiveSha256": "8e9f6041d3aa62229332b033d0390fd213a9b10cd078163f3f5fe988ee91baf7",
       "licenses": {
         "LICENSE.electron.txt": {
           "sha256": "5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d",
           "bytes": 1096
         },
         "LICENSES.chromium.html": {
-          "sha256": "a62dabd1c6ef1327365b2a3fdffb806222684a746dcb8f4afd1c1f690eba5535",
-          "bytes": 20111209
+          "sha256": "3375e2a9bd7bc631738fde10be6548a76efe8cf5e4b8826b8140ba8b0c4d6353",
+          "bytes": 20115518
         }
       }
     },
     "darwin-x64": {
-      "upstreamArchiveSha256": "e567d13833d0e161d7749727355b98643461df3395b537cfa7bdddf8a8bfedff",
+      "upstreamArchiveSha256": "0d52465c24865981a9a68621c7068f124ef9f2a4caf5119afde62b04fffea66d",
       "licenses": {
         "LICENSE.electron.txt": {
           "sha256": "5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d",
           "bytes": 1096
         },
         "LICENSES.chromium.html": {
-          "sha256": "a62dabd1c6ef1327365b2a3fdffb806222684a746dcb8f4afd1c1f690eba5535",
-          "bytes": 20111209
+          "sha256": "3375e2a9bd7bc631738fde10be6548a76efe8cf5e4b8826b8140ba8b0c4d6353",
+          "bytes": 20115518
         }
       }
     },
     "linux-arm64": {
-      "upstreamArchiveSha256": "ee1790d743af1abd6a7e3971589dcd8635b58dab51ca1359123ba5216ce3a453",
+      "upstreamArchiveSha256": "558ae899d98b70236325d81da44bb6b2c988dd9a7bd16be17cea25f06e56cc14",
       "licenses": {
         "LICENSE.electron.txt": {
           "sha256": "5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d",
           "bytes": 1096
         },
         "LICENSES.chromium.html": {
-          "sha256": "a62dabd1c6ef1327365b2a3fdffb806222684a746dcb8f4afd1c1f690eba5535",
-          "bytes": 20111209
+          "sha256": "3375e2a9bd7bc631738fde10be6548a76efe8cf5e4b8826b8140ba8b0c4d6353",
+          "bytes": 20115518
         }
       }
     },
     "linux-x64": {
-      "upstreamArchiveSha256": "5bcd217611d6843ececd6c9e9c1fcd1da3ab066c43d8b1a9e4b44689a1fba6f5",
+      "upstreamArchiveSha256": "62df9375ef035f2835a18cd7f9bff1959a185da22f2ecba1daa37cd9caee1dc5",
       "licenses": {
         "LICENSE.electron.txt": {
           "sha256": "5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d",
           "bytes": 1096
         },
         "LICENSES.chromium.html": {
-          "sha256": "a62dabd1c6ef1327365b2a3fdffb806222684a746dcb8f4afd1c1f690eba5535",
-          "bytes": 20111209
+          "sha256": "3375e2a9bd7bc631738fde10be6548a76efe8cf5e4b8826b8140ba8b0c4d6353",
+          "bytes": 20115518
         }
       }
     },
     "win32-arm64": {
-      "upstreamArchiveSha256": "6ba86d5d5cfdf4ce61d51e2d270eaca464a7f88c143d14c6d9b3f43bb0760e9e",
+      "upstreamArchiveSha256": "331a59951738402c25525806e515a49d37d39c5a813d72f572a5653428bd57bd",
       "licenses": {
         "LICENSE.electron.txt": {
           "sha256": "5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d",
           "bytes": 1096
         },
         "LICENSES.chromium.html": {
-          "sha256": "7b328b8c7463ac9bfc7dc648c751533517c8441a0b5b21047d6c0b2620e60d70",
-          "bytes": 20472830
+          "sha256": "e6e6b1f9cb0f32235412be113de7716333e88121f9159a0ea0ff3be652021af7",
+          "bytes": 20477229
         }
       }
     },
     "win32-x64": {
-      "upstreamArchiveSha256": "9b382492dcfee91f8f9e92c91f7972550a1b95d2299cac72279dab33a600d7db",
+      "upstreamArchiveSha256": "64c2d874fea1bd4c8d2e1f2df3a547497044159a6b853dee7fcdff357ff0e3cd",
       "licenses": {
         "LICENSE.electron.txt": {
           "sha256": "5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d",
           "bytes": 1096
         },
         "LICENSES.chromium.html": {
-          "sha256": "7b328b8c7463ac9bfc7dc648c751533517c8441a0b5b21047d6c0b2620e60d70",
-          "bytes": 20472830
+          "sha256": "e6e6b1f9cb0f32235412be113de7716333e88121f9159a0ea0ff3be652021af7",
+          "bytes": 20477229
         }
       }
     }

docs/DATABASES.md

@@ -3,6 +3,7 @@
 | Profilo           | Driver reale                     | Query                      | Scritture                                     | Verifica                                                 |
 | ----------------- | -------------------------------- | -------------------------- | --------------------------------------------- | -------------------------------------------------------- |
 | SQLite            | `node:sqlite`, processo dedicato | SQL                        | INSERT, UPDATE, DELETE con anteprima e commit | File reale, servizio e app desktop                       |
+| Amazon Athena     | `@aws-sdk/client-athena`         | SQL, AWS SSO e workgroup   | Disabilitate                                  | SDK e account AWS da verificare                          |
 | PostgreSQL        | `pg`                             | SQL, transazione READ ONLY | Proposta non eseguita, transazione al commit  | Server Docker isolato                                    |
 | Aurora PostgreSQL | `pg`                             | SQL                        | Come PostgreSQL                               | Contratto; cluster AWS non verificato                    |
 | CockroachDB       | `pg`                             | SQL                        | Come PostgreSQL                               | Contratto; server non verificato                         |
@@ -64,3 +65,5 @@ MongoDB e Redis mostrano una stima o lo stato attuale. Le scritture non hanno ro
 I profili nuovi sono in lettura. TLS verifica i certificati remoti; per i server locali di test puoi configurare esplicitamente una connessione senza TLS. Non vengono modificati i ruoli nel database. SQL Server non offre una transazione READ ONLY: usa un principal di sola lettura per applicare la policy anche sul server.
 
 Databricks richiede un warehouse, host, HTTP path e token. Aurora usa host/porta/database/utente del cluster e TLS; IAM e tunnel SSH non sono implementati. I provider LLM e i database hanno vault namespace separati.
+
+Athena usa il profilo AWS locale, la regione e un workgroup. Puoi indicare un ARN di ruolo IAM: Tableline lo assume con le credenziali del profilo e rinnova automaticamente le credenziali temporanee. Per i profili SSO devi prima completare il login con `aws sso login --profile <profilo>`; quando scade, ripeti il login. Il database predefinito è facoltativo: se lo lasci vuoto, lo schema elenca i database visibili al ruolo. I permessi AWS, il limite di scansione e la cifratura dei risultati devono essere configurati nel workgroup e nel ruolo. Tableline esegue solo letture e non salva copie delle tabelle; esportazioni, cronologia SQL e richieste esplicite all'assistente possono comunque contenere dati.

docs/PLATFORMS.md

@@ -11,7 +11,7 @@ Tableline 0.2.2 targets six native desktop combinations. Compatibility is tied t
 | Windows | x64 | Windows Server 2025 |
 | Windows | arm64 | Windows 11 ARM |
 
-Electron 44.5.1 requires macOS 13 or later and supports 64-bit desktop targets. The runtime's [versioned platform requirements](https://github.com/electron/electron/blob/v44.5.1/README.md) are a minimum; the table identifies the systems actually exercised by CI. Linux checks use Ubuntu 24.04 with glibc and X11/Xvfb. GPU drivers and Wayland configurations are not certified. Alpine/musl, 32-bit systems, FreeBSD and old unsupported OS releases are outside this matrix. Windows Server CI does not establish every Windows desktop build or enterprise policy configuration.
+Electron 44.10.0 requires macOS 13 or later and supports 64-bit desktop targets. The runtime's [versioned platform requirements](https://github.com/electron/electron/blob/v44.10.0/README.md) are a minimum; the table identifies the systems actually exercised by CI. Linux checks use Ubuntu 24.04 with glibc and X11/Xvfb. GPU drivers and Wayland configurations are not certified. Alpine/musl, 32-bit systems, FreeBSD and old unsupported OS releases are outside this matrix. Windows Server CI does not establish every Windows desktop build or enterprise policy configuration.
 
 ## Required checks
 

docs/PUBLIC_RELEASE.md

@@ -33,3 +33,5 @@ Download the published archive, verify its checksum, extract it and inspect its
 Before publishing the first GPL binary after v0.2.0, review the exact native dependency sources as well as Tableline's tagged archive. The optional Databricks kernel's exact compiled source was unavailable during the 0.2.1 audit. From 0.2.2, packages exclude that unused kernel and verify its absence. Tableline retains the connector's JavaScript Thrift backend; SEA/Reyden warehouses that require the kernel are explicitly unsupported. The supported route and native LZ4 binding must pass packaged runtime checks on the release target.
 
 LZ4 NAPI 2.10.0 identifies its source commit as [`ec869f7de3aab4d07cadfd6796d06af30e386fdc`](https://github.com/antoniomuso/lz4-napi/tree/ec869f7de3aab4d07cadfd6796d06af30e386fdc). Keep this exact source and its build dependencies, the pinned Electron/runtime sources and other required dependency sources accessible beside a release download. An npm tarball containing only native code is not a substitute for its source. Do not silently add a GPL exception or replace historical MIT assets to work around this requirement. A signed local build and a published source fix are separate from a public binary release.
+
+The [0.2.2 source references](releases/0.2.2-sources.md) identify the pinned upstream sources, build workflow and binary provenance, and disclose the upstream LZ4 Rust lockfile limitation. Link that manifest from the GitHub release notes along with the exact Tableline source tag.

docs/VALIDATION.md

@@ -66,6 +66,8 @@ The renderer is sandboxed with context isolation, no Node access, a restrictive
 
 On 5 October 2026, both the complete dependency audit and production audit recorded zero advisories after removing the build-only `got → cacheable-request → http-cache-semantics` chain. The override is limited to `app-builder-lib` 26.15.3's downloader, using the official `@electron/get` 5.1.0 already used by Electron. A build-process preload preserves request deadlines, proxy/NO_PROXY routing, progress and retry error codes while retaining upstream artifact caching and SHA-256 checks. TLS verification remains required. CI audits development dependencies as well as production dependencies.
 
+On 31 October 2026, the new [minimatch advisory GHSA-g3hv-75wg-m249](https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249) caused `npm audit` to report 15 moderate findings through the development-only Electron Builder dependency tree; `npm audit --omit=dev` still reports zero. The patched minimatch 11 API is incompatible with several legacy build-tool callers, so Tableline's audit gate permits only this advisory and its development-only transitive chain through 30 November 2026. `npm run audit` still runs both full and production audits, prints the findings and fails on any production finding, any other advisory, a higher severity, an unexpected dependency path or expiration. The exception does not apply to bundled application dependencies.
+
 The published `http-cache-semantics` 4.3.0 still reproduced the synthetic cross-user `max-stale` behavior; moving beyond the advisory's version range alone was not accepted as remediation. The affected packages are absent from the resolved lockfile and installed tree. See [GHSA-ch52-4w7c-c8xp](https://github.com/advisories/GHSA-ch52-4w7c-c8xp) and the [upstream report](https://github.com/kornelski/http-cache-semantics/issues/56). Dependency licenses and public source/history scans are reviewed before publishing; generated reports and user data are excluded from Git.
 
 Local macOS arm64 acceptance after this change passed 328 unit tests (two optional tests skipped), an actual cold Electron download matched the reviewed upstream SHA-256, and the packaged app passed all nine platform checks, 35 locale checks and nine AI selection checks. The eleven loopback download regressions cover checksums, cache repair, HTTP 503 retry, stalled responses, cancellation, authenticated proxy routing, redirects and isolation between synthetic users. A separate temporary HTTPS fixture confirmed rejection of a self-signed certificate. These checks use synthetic credentials, make no macOS Keychain calls and do not establish Developer ID signing or public installer trust.