Release 1.4.0: universal middleware and scoped tool boundaries

[umudhasanli]

Summary

• add flare-redact/middleware, a policy-first integration boundary for any SDK or framework with redact, observe, and block modes
• add createScopedToolBoundary() so each trusted tool scope can restore only its own placeholders, closing cross-tool placeholder transplantation
• document safe integrations, migration guidance, a runnable universal example, and the 1.4.0 release notes
• extend CI and benchmarks for the new integration surface

Security model

The authorization scope is resolved by trusted application routing, never from a model-supplied tool name. Legacy createToolBoundary() remains compatible and is explicitly documented for a single tool or trust domain.

Verification

• npm test — 194 tests passed
• npm audit — 0 vulnerabilities
• npm pack --dry-run — middleware JavaScript and declarations included
• fresh tarball consumer smoke test passed
• OpenAI privacy, Express/Pino, and universal-boundaries examples passed
• performance and adversarial benchmark suites passed