[divyanshujethi]

🛡️ DBShield Enterprise-Grade Hardening & npm Package Readiness

This pull request brings DBShield to parity with AgentShield's enterprise standard across npm packaging, CI/CD, security posture, and compliance assurance:

📦 1. npm Package & CLI Parity

• Configured @ritualdev-lab/dbshield packaging manifest with prepublishOnly, benchmark scripts, and dual CLI binaries (dbshield, dbs).
• Exported complete dual typings (dist/index.d.ts), CLI tools, and metadata.
• Validated tarball integrity via npm pack --dry-run (195 files, 167 kB, 0 errors).

🤖 2. Agent Skill & GitHub Action Gate

• SKILL.md: Directives for autonomous agents (Antigravity, Cursor, Windsurf, Claude Code) detailing two-phase mutation (db_dry_run before db_commit), virtual schema masking, and AST tautology traps.
• action.yml: Pre-deployment composite GitHub Action gate for automated SQL migration audits and unindexed cascade lock detection.

🏛️ 3. Formal Enterprise Governance

• ENTERPRISE_SLA.md: Master Service Agreement response guarantees (< 1 hr P1 24/7/365, < 4 hr P2, 99.95% availability target).
• SOC2_ISO27001_COMPLIANCE.md: Full AICPA Trust Services Criteria (CC1–CC9, A1, C1, PI1, P1–P8) and ISO/IEC 27001:2022 Annex A control mapping.

🔒 4. CI/CD & Supply-Chain Hardening

• CodeQL SAST: Added .github/workflows/codeql.yml for automated JavaScript/TypeScript vulnerability scanning.
• OpenSSF Scorecard: Added .github/workflows/scorecard.yml for supply-chain security analysis.
• Matrix CI Testing: Added .github/workflows/ci.yml evaluating Node 20, 22, 24 across Ubuntu and Windows runners.
• Dual-Publish Workflow: Added .github/workflows/publish-package.yml for Sigstore provenance signing and GitHub Packages publishing.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.