docs: refresh feature coverage across READMEs and CHANGELOG

Recent feature work — Go and JS/TS extractors, MERGE validation,
Postgres identifier folding, live database introspection, the
first-party VS Code extension, and expanded LSP filetype coverage —
hadn't been reflected in the user-facing docs yet. Update the language
list, feature matrix, workspace layout, CLI flag table, LSP filetype
list, and CHANGELOG so the docs match what ships.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: davidsmfreire

CHANGELOG.md

@@ -16,6 +16,23 @@ From the first tagged release onward, this file is maintained by
 - CI matrix across ubuntu/macos/windows with fmt + clippy + cargo-deny gates.
 - `dependabot`, `release-plz`, `cargo-deny`, and `CHANGELOG.md` infrastructure.
 - MSRV declared as 1.80 (earliest version supporting `std::sync::LazyLock`).
+- Go SQL extractor (`finder/go.rs`): raw / interpreted string literals
+  and `fmt.Sprintf`-style verbs.
+- JavaScript / TypeScript SQL extractor (`finder/javascript.rs`):
+  single-, double-, and template-string literals across `.js`, `.ts`,
+  and `.tsx`; `${…}` substitutions stripped before parsing.
+- `MERGE INTO … USING … ON … WHEN [NOT] MATCHED` validation
+  (`validation/clauses/merge.rs`).
+- Postgres-aware identifier folding (`schema::sql::fold_ident`):
+  unquoted identifiers fold to lower case, quoted identifiers preserve
+  case. Other dialects keep ASCII case-insensitive matching.
+- `sqlshield-introspect` crate: live schema reader for Postgres and
+  SQLite. Wired into the CLI as `--db-url` (and `db_url` in
+  `.sqlshield.toml`); mutually exclusive with `--schema`.
+- First-party VS Code extension under `editors/vscode/` wrapping
+  `sqlshield-lsp` over stdio.
+- LSP filetype coverage extended to `go`, `javascript`, `typescript`,
+  and `typescriptreact` alongside `python`, `rust`, and `sql`.
 
 ### Changed
 - `validate_files` now returns `Result` rather than panicking on schema load.

CONTRIBUTING.md

@@ -50,10 +50,10 @@ Rough recipe:
 ## Architecture at a glance
 
 ```
-Source file (*.py, *.rs)
+Source file (*.py, *.rs, *.go, *.js, *.ts, *.tsx)
    │ tree-sitter extracts string literals
    ▼
-SQL string (with {…} placeholders replaced by `1`)
+SQL string (with {…} / ${…} / fmt verbs replaced by `1`)
    │ sqlparser parses
    ▼
 AST (Vec<Statement>)
@@ -66,6 +66,9 @@ Vec<SqlValidationError>
 - `sqlshield-cli` — thin clap-based CLI wrapper
 - `sqlshield-py` — PyO3 bindings exposing `validate_query` / `validate_files`
 - `sqlshield-lsp` — Language Server for editor integration
+- `sqlshield-introspect` — live schema reader for Postgres / SQLite,
+  consumed by the CLI's `--db-url` flag
+- `editors/vscode` — first-party VS Code extension wrapping `sqlshield-lsp`
 
 ## Releases
 

README.md

@@ -28,6 +28,10 @@ It works on:
 - Plain `"…"` and raw `r#"…"#` Rust string literals (sqlx-idiomatic).
 - Python f-strings (`f"…{x}…"`) and `.format()` strings (`{{` / `}}`
   escapes preserved).
+- Go raw / interpreted string literals, including `fmt.Sprintf` verbs.
+- JavaScript / TypeScript single-, double-, and template-string literals
+  (`.js`, `.ts`, `.tsx`); `${…}` template substitutions are stripped
+  before parsing.
 - Standalone `.sql` files (via the LSP).
 
 It checks:
@@ -118,8 +122,16 @@ config; the config overrides defaults.
 schema = "db/schema.sql"
 directory = "src"
 dialect = "postgres"
+# Or pull the schema from a live database instead of a file:
+# db_url = "postgres://user:pass@localhost/mydb"
+# db_url = "sqlite:///abs/path/to/db.sqlite"
 ```
 
+Live introspection is feature-gated; the published binary ships with it
+on. To validate against a running database without a `.sql` file, pass
+`--db-url` (or set `db_url` in the config). Postgres and SQLite are
+supported today; MySQL is pending a Rust toolchain bump.
+
 Supported dialects: `generic` (default), `postgres` / `postgresql` / `pg`,
 `mysql`, `sqlite`, `mssql` / `sqlserver`, `snowflake`, `bigquery` / `bq`,
 `redshift`, `clickhouse`, `duckdb`, `hive`, `ansi`. The dialect controls
@@ -134,10 +146,14 @@ The walker prunes `target/`, `.git/`, `node_modules/`, `.venv/`, `venv/`,
 
 [`sqlshield-lsp`](sqlshield-lsp/README.md) is a Language Server that
 publishes diagnostics for embedded SQL on every `didOpen` / `didChange`.
-Any LSP-aware editor (VS Code, Neovim, Helix, Emacs, Zed) can show inline
+Any LSP-aware editor (Neovim, Helix, Emacs, Zed, …) can show inline
 squiggles on the offending SQL string. The crate's README has the wiring
 recipes.
 
+A first-party VS Code extension lives at
+[`editors/vscode/`](editors/vscode/README.md) — it spawns `sqlshield-lsp`
+over stdio and forwards diagnostics as you type.
+
 ## Python integration
 
 [`sqlshield-py`](sqlshield-py/) exposes `validate_query` and
@@ -176,9 +192,10 @@ errors = sqlshield.validate_query(
 | Function args / `CASE` / `CAST` / arithmetic         |   ✅   |
 | Case-insensitive identifier matching                 |   ✅   |
 | 12 SQL dialects via `--dialect`                      |   ✅   |
-| Live database introspection                          |   ✗    |
-| Quoted-vs-unquoted identifier folding (Postgres rules) |   ✗  |
-| `MERGE`                                              |   ✗    |
+| `MERGE INTO … USING … WHEN [NOT] MATCHED`            |   ✅   |
+| Postgres quoted-vs-unquoted identifier folding       |   ✅   |
+| Live database introspection (Postgres + SQLite)      |   ✅   |
+| MySQL live introspection                             |   ✗    |
 
 ## Limitations
 
@@ -219,6 +236,10 @@ Workspace layout:
 - [`sqlshield-cli/`](sqlshield-cli/) — clap-based CLI wrapper.
 - [`sqlshield-py/`](sqlshield-py/) — PyO3 bindings.
 - [`sqlshield-lsp/`](sqlshield-lsp/) — `tower-lsp` Language Server.
+- [`sqlshield-introspect/`](sqlshield-introspect/) — live schema reader
+  for Postgres and SQLite (consumed by `--db-url`).
+- [`editors/vscode/`](editors/vscode/) — first-party VS Code extension
+  wrapping `sqlshield-lsp`.
 
 ## Similar tools
 
@@ -233,9 +254,9 @@ Workspace layout:
   linter; complementary, not overlapping (squawk lints DDL, sqlshield
   lints embedded DML/SELECT).
 
-sqlshield's niche: language-agnostic extraction (Python + Rust today,
-extensible) with a multi-dialect parser, no database connection
-required.
+sqlshield's niche: language-agnostic extraction (Python, Rust, Go, and
+JavaScript / TypeScript today, extensible) with a multi-dialect parser,
+no database connection required (live introspection optional).
 
 ## Contributing
 

sqlshield-cli/README.md

@@ -1,8 +1,9 @@
 # sqlshield-cli
 
 Command-line linter for [sqlshield](https://github.com/davidsmfreire/sqlshield) —
-validates raw SQL strings embedded in Python and Rust source files
-against a declared schema, without touching a database.
+validates raw SQL strings embedded in Python, Rust, Go, and
+JavaScript / TypeScript source files against a declared schema (or a
+live Postgres / SQLite database).
 
 ## Install
 
@@ -23,7 +24,13 @@ sqlshield --directory src --schema schema.sql
 sqlshield [OPTIONS]
 
   -d, --directory <DIRECTORY>  Default: "."
-  -s, --schema    <SCHEMA>     Default: "schema.sql"
+  -s, --schema    <SCHEMA>     Default: "schema.sql".
+                               Mutually exclusive with --db-url.
+      --db-url    <URL>        Read schema from a live database instead
+                               of a file. Examples:
+                                 postgres://user:pass@localhost/mydb
+                                 sqlite:///abs/path/to/db.sqlite
+                                 ./relative.sqlite
       --dialect   <DIALECT>    generic | postgres | mysql | sqlite |
                                mssql | snowflake | bigquery | redshift |
                                clickhouse | duckdb | hive | ansi
@@ -46,6 +53,8 @@ for full details.
 schema = "db/schema.sql"
 directory = "src"
 dialect = "postgres"
+# Optional: introspect a running DB instead of reading schema.sql
+# db_url = "postgres://user:pass@localhost/mydb"
 ```
 
 ### Exit codes

sqlshield-lsp/README.md

@@ -1,9 +1,10 @@
 # sqlshield-lsp
 
 Language Server Protocol frontend for [sqlshield](../README.md). Emits
-schema-aware SQL diagnostics for embedded queries in `.py` and `.rs` files as
-well as plain `.sql` files. Every editor that speaks LSP (VS Code, Neovim,
-Helix, Emacs, Zed, …) can show squiggles on the offending SQL string.
+schema-aware SQL diagnostics for embedded queries in `.py`, `.rs`, `.go`,
+`.js`, `.ts`, and `.tsx` files as well as plain `.sql` files. Every
+editor that speaks LSP (VS Code, Neovim, Helix, Emacs, Zed, …) can show
+squiggles on the offending SQL string.
 
 > **Status:** experimental — full-document sync, diagnostics only. No
 > completion, hover, or code actions yet.
@@ -42,7 +43,10 @@ if not configs.sqlshield_lsp then
   configs.sqlshield_lsp = {
     default_config = {
       cmd = { "sqlshield-lsp" },
-      filetypes = { "python", "rust", "sql" },
+      filetypes = {
+        "python", "rust", "go", "javascript",
+        "typescript", "typescriptreact", "sql",
+      },
       root_dir = require("lspconfig.util").root_pattern(".sqlshield.toml", ".git"),
       settings = {},
     },
@@ -53,8 +57,10 @@ require("lspconfig").sqlshield_lsp.setup({})
 
 ### VS Code
 
-Any generic LSP extension (for example, `llllvvuu.llmvm-lsp-client`) can
-launch `sqlshield-lsp`. A first-party VS Code extension is future work.
+A first-party VS Code extension lives at
+[`editors/vscode/`](../editors/vscode/README.md). It spawns
+`sqlshield-lsp` over stdio and forwards diagnostics to the editor as you
+type. Set `sqlshield.serverPath` if the binary isn't on `PATH`.
 
 ## Debugging
 

sqlshield-py/README.md

@@ -37,10 +37,11 @@ for err in errors:
 # ./src/queries.py:7: Column `nickname` not found in table `users`
 ```
 
-`validate_files` walks `.py` and `.rs` source files, extracts every
-embedded SQL string, and validates each against the schema. Generated
-and vendored directories (`.git`, `target`, `node_modules`, `.venv`,
-`__pycache__`, …) are skipped automatically.
+`validate_files` walks `.py`, `.rs`, `.go`, `.js`, `.ts`, and `.tsx`
+source files, extracts every embedded SQL string, and validates each
+against the schema. Generated and vendored directories (`.git`,
+`target`, `node_modules`, `.venv`, `__pycache__`, …) are skipped
+automatically.
 
 Each `SqlValidationError` exposes: