The Tier 1 encoding detector runs on every risky field with no length cap,
and its Morse regex `(?:[.-]+[ ]){4,}[.-]+` backtracked catastrophically on
long dot/dash runs (200k dots ≈ 30s of blocked event loop). A remotely
supplied email/document body could freeze the host process.

- Linearize the Morse regex by bounding each symbol group to {1,8} (longer
  runs are not valid Morse anyway).
- Bound the markdown_hidden_instruction regex with negated char classes
  instead of lazy `.*?` spans (defense-in-depth; it was already capped by the
  detector's 50k input limit).
- Add `maxFieldAnalysisLength` (default 50000): cap the text Tier 1 runs heavy
  regex/encoding detection over; flag `metadata.analysisTruncated` past the cap.
- Fix the size-metrics bypass: risky-field strings now count toward the
  traversal `maxSize` budget (they previously skipped updateSizeMetrics).

Regression test: a 200k-char dot field now completes in <2s (was ~30s).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Tier 2 is on by default, but onnxruntime-node / @huggingface/transformers are
optional peer deps. Previously, if they were missing the model load failure was
swallowed to a per-string skipReason with no top-level signal — consumers who
set blockHighRisk believed they had ML defense but silently ran Tier 1 only.

- Add `result.tier2Available` — set to `false` when Tier 2 is enabled but the
  model/runtime can't load, so monitoring can alert on degraded ML defense.
- Warn once per instance (was: once per failed call — removed the per-call
  warn in onnx-classifier.loadModel; the caller now owns messaging).
- Add `requireTier2` option: when true, defendToolResult and warmupTier2 throw
  instead of degrading (fail-closed).
- warmupTier2 now fails open by default (warn) rather than throwing, matching
  the lazy path; it throws only under requireTier2.
- README: add a Requirements section documenting the peer deps + requireTier2.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…rray data (H1, H6)

- H1: object KEYS are now scanned by the Tier 1 detector (detect-only — keys
  are never rewritten, which would change the object shape). An injection
  hidden in a key now contributes to detections/risk/allowed; previously keys
  were copied verbatim and invisible to every tier.
- H6: large arrays (> largeArrayThreshold) no longer drop items. The previous
  behavior returned only the first 100 items plus a notice, silently losing the
  rest of the payload. Now all items are returned; only Tier 1 detection is
  capped to the first 100, and coverage is flagged.
- Add result.coverageDegraded: true when Tier 1 detection coverage was reduced
  (field over maxFieldAnalysisLength, large-array partial scan, or a depth/size
  traversal limit). Content is always returned in full.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

- M7: remove the now-inert blockHighRisk from the sanitizer layer (detect-and-gate
  made it dead). The only remaining flag is PromptDefenseConfig.blockHighRisk,
  resolved once; config:{blockHighRisk} and the blockHighRisk option now gate
  identically.
- M15: guard Tier2Classifier.classify() against a NaN logit (matches the batch
  paths) so a broken model output isn't silently treated as benign.
- L1: overallRiskLevel now propagates a per-field critical (via a raiseOverallRisk
  max-helper) instead of capping at high; cumulative escalation raises rather than
  overwrites.
- L3: riskLevel floor is now low (was medium), so benign payloads report low and the
  full low..critical range is reachable. riskLevel is diagnostic only; blocking
  logic is unchanged.
- L2 (already fixed in Phase 0): regression test that a medium-severity match appears
  in detections.
- README: update the risk-level section/table (starts at low; drop stale
  stripped/redacted language).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…er 3 registry (M9/M10/M11)

- M9: load the optional peers (onnxruntime-node, @huggingface/transformers) via a
  shared dynamicImport() helper that passes a runtime specifier to the real
  import() operator, so bundlers (webpack/esbuild) don't try to resolve them at
  build time. Refactor the SFE fasttext.wasm load onto the same helper — its old
  `new Function("return import(spec)")` trick threw "A dynamic import callback was
  not specified" and silently failed open, so SFE never actually loaded; it works
  now.
- Because the peers are no longer statically imported, tsc lost the transitive
  @types/node; declare @types/node explicitly and add "node" to tsconfig types.
- M10: per-condition types in the exports map so ESM consumers resolve
  dist/index.d.mts instead of the CJS-flavored .d.cts.
- M11: back the Tier 3 provider registry with a globalThis Symbol slot so an app
  that loads both the CJS and ESM builds shares one registry (a module-level
  singleton gave each build its own, so a registered provider was invisible to the
  other realm).

Verified: build emits no literal peer specifiers in dist; dist/index.d.mts present
and wired; 353 tests + typecheck + lint green.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Detect-and-gate (Phase 0) unwired the entire content-mutation path. This removes
the now-unreachable code — traced to spec-only usage; none of it is exported from
the package entry, so it's non-breaking for consumers and was already tree-shaken
out of the shipped bundle.

Deleted (whole files, the mutation path):
- src/sanitizers/sanitizer.ts (Sanitizer, createSanitizer, sanitizeText, suggestRiskLevel)
- src/sanitizers/pattern-remover.ts (removePatterns + variants)
- src/sanitizers/role-stripper.ts (stripRoleMarkers, containsRoleMarkers, findRoleMarkers)

Trimmed dead exports from files that stay:
- encoding-detector: redactAllEncoding, decodeAllEncoding, containsEncodedContent
- normalizer: containsSuspiciousUnicode, analyzeSuspiciousUnicode
- boundary: generateXMLBoundary

Docs (M18): fix the tier3_only line (T1 detects, doesn't strip) and the Risky Field
Detection section (clarify Tier 1 value scoping vs Tier 2 scan-all + key scanning).

Specs updated to drop deleted-symbol tests; detection coverage (normalizer / leet /
encoding-detection) retained. 313 tests + typecheck + lint + build green.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>