Merge pull request #18 from davidsmfreire/feat/roadmap-and-review-fixes

fix(deps): bump pyo3 to clear RUSTSEC-2025-0020 + docs refresh

Author: davidsmfreire

CHANGELOG.md

@@ -16,6 +16,23 @@ From the first tagged release onward, this file is maintained by
 - CI matrix across ubuntu/macos/windows with fmt + clippy + cargo-deny gates.
 - `dependabot`, `release-plz`, `cargo-deny`, and `CHANGELOG.md` infrastructure.
 - MSRV declared as 1.80 (earliest version supporting `std::sync::LazyLock`).
+- Go SQL extractor (`finder/go.rs`): raw / interpreted string literals
+  and `fmt.Sprintf`-style verbs.
+- JavaScript / TypeScript SQL extractor (`finder/javascript.rs`):
+  single-, double-, and template-string literals across `.js`, `.ts`,
+  and `.tsx`; `${…}` substitutions stripped before parsing.
+- `MERGE INTO … USING … ON … WHEN [NOT] MATCHED` validation
+  (`validation/clauses/merge.rs`).
+- Postgres-aware identifier folding (`schema::sql::fold_ident`):
+  unquoted identifiers fold to lower case, quoted identifiers preserve
+  case. Other dialects keep ASCII case-insensitive matching.
+- `sqlshield-introspect` crate: live schema reader for Postgres and
+  SQLite. Wired into the CLI as `--db-url` (and `db_url` in
+  `.sqlshield.toml`); mutually exclusive with `--schema`.
+- First-party VS Code extension under `editors/vscode/` wrapping
+  `sqlshield-lsp` over stdio.
+- LSP filetype coverage extended to `go`, `javascript`, `typescript`,
+  and `typescriptreact` alongside `python`, `rust`, and `sql`.
 
 ### Changed
 - `validate_files` now returns `Result` rather than panicking on schema load.

CONTRIBUTING.md

@@ -50,10 +50,10 @@ Rough recipe:
 ## Architecture at a glance
 
 ```
-Source file (*.py, *.rs)
+Source file (*.py, *.rs, *.go, *.js, *.ts, *.tsx)
    │ tree-sitter extracts string literals
    ▼
-SQL string (with {…} placeholders replaced by `1`)
+SQL string (with {…} / ${…} / fmt verbs replaced by `1`)
    │ sqlparser parses
    ▼
 AST (Vec<Statement>)
@@ -66,6 +66,9 @@ Vec<SqlValidationError>
 - `sqlshield-cli` — thin clap-based CLI wrapper
 - `sqlshield-py` — PyO3 bindings exposing `validate_query` / `validate_files`
 - `sqlshield-lsp` — Language Server for editor integration
+- `sqlshield-introspect` — live schema reader for Postgres / SQLite,
+  consumed by the CLI's `--db-url` flag
+- `editors/vscode` — first-party VS Code extension wrapping `sqlshield-lsp`
 
 ## Releases