@doccloak/core 0.8.0 → 0.9.0

package/CHANGELOG.md

@@ -4,6 +4,114 @@ All notable changes to `@doccloak/core` are documented here. The format is
 based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and the
 project follows [Semantic Versioning](https://semver.org/).
 
+## [0.9.0] - 2026-08-21
+
+### Added
+
+- **Secrets & credentials detection (T099/T116):** new `SECRET` and
+  `API_KEY` entity types plus eleven universal regex rules covering AWS
+  access keys, GitHub/Slack tokens, OpenAI/Anthropic/Google API keys,
+  PEM private-key blocks, JWTs, connection strings with embedded
+  credentials, `secret=`-style assignments and high-entropy tokens, and
+  a GB driving-licence rule. Credentials never receive realistic
+  stand-ins — even in surrogate mode they always fall back to typed
+  placeholders, since a same-shape fake key still reads as a live
+  credential.
+
+- **Tolerant restore-token matching (T098):** new side-effect-free
+  `@doccloak/core/restore-tokens` export that restores placeholders LLM
+  replies have mangled — case changes (`[person_1]`), separator swaps
+  (`[PERSON 1]`), markdown wrapping (`**[PERSON_1]**`), dropped brackets
+  and stray edge punctuation. Restoration only happens on an unambiguous
+  canonical hit; anything ambiguous is left exactly as the model wrote
+  it, because a wrong restore silently corrupts the document while a
+  missed one is visible and recoverable.
+
+- **Model integrity verification:** `fetchModelBlob` verifies downloads
+  against a pinned SHA-256 when the caller provides one and rejects
+  mismatches with a dedicated `ModelIntegrityError` (the corrupt copy is
+  discarded; verified cache entries carry a marker so they are not
+  re-hashed). The GLiNER and bardsai providers export their pinned
+  `*_MODEL_URL` / `*_MODEL_REVISION` / `*_MODEL_SHA256` constants.
+
+- **Multilingual surrogates (T073):** realistic stand-ins now follow the
+  original's language beyond EN/PL. New locale packs matching every
+  region the web app's language picker offers: German, French, Spanish,
+  Italian, Czech, Ukrainian, Dutch, Portuguese, Swedish, Norwegian,
+  Danish, Finnish, Japanese and Chinese: given-name/surname pools with
+  gender detection and surname feminization (-ova, -ska/-cka), month
+  names for date shifting (genitive forms where dates inflect), street
+  formats (Hauptstrasse 5 / 12 rue des Lilas / Calle del Sol 3 / Via dei
+  Tigli 10 / vul. Zelena 98) and company pools with locale-detecting
+  legal suffixes (GmbH, SARL, S.r.l., s.r.o., TOV) kept verbatim.
+  Locale detection scores name-pool and surname matches per token
+  (shared names like "Marie" resolve to the best-matching language);
+  Cyrillic script resolves decisively. Non-Latin surrogate names fall
+  back to an unrelated ASCII identity in derived email local parts.
+  CJK names compose surname-first without spaces via a per-pack
+  formatPerson hook (Chinese given-name length mirrored; kana decides
+  Japanese, surname-prefix scoring separates kanji-only Japanese from
+  Chinese, a Han script fallback catches unpooled surnames); CJK dates
+  (2024\u5e743\u670815\u65e5) shift in place; Finnish dates keep the partitive.
+  Bare legal suffixes (AB/AS) now require a preceding space, so 'SAAB'
+  never sheds an 'AB'. Adding further locales is data-only (one
+  LocalePack entry).
+
+- **Person-variant unification (T057):** repeated mentions of the same
+  person share one replacement. When a new PERSON value is a name-variant
+  of an already-mapped one (case-insensitive token subset with at least
+  one substantive shared token: "John" and "Smith" both match
+  "John Smith"; "Mr. Smith" and "Person 11" do not), the session reuses
+  its placeholder/surrogate instead of issuing a new one. The reverse map
+  keeps the LONGEST variant, so restore always yields the fullest known
+  form; `renameLabel` renames the whole variant group; `deserialize`
+  keeps the longest variant canonical regardless of entry order.
+
+- **Surrogate replacement mode (T043):** `AnonymizationSession` accepts a
+  new `'surrogate'` mode in which replacements are realistic,
+  shape-preserving stand-ins instead of typed placeholders: locale-aware
+  fake names (EN + PL, gendered Polish surname endings), emails whose
+  local part mirrors the in-session person surrogate on reserved example
+  domains, dates shifted by a per-session day offset while keeping their
+  format, phones/IBANs/IDs/cards that keep their shape (IBAN mod-97,
+  PESEL and Luhn checksums valid; generated PESELs encode a 19th-century
+  birth date and SSN shapes use the never-allocated 900-999 area, so a
+  generated identifier can never be a real living person's). Generation
+  is deterministic per session (seeded by a per-session salt, new
+  `src/surrogates.ts` module) and collision-safe against every original
+  value and every already-issued replacement in the session. The default
+  mode remains `'labeled'` (typed placeholders); restore is unchanged
+  exact-literal lookup. Surrogate-mode `serialize()` wraps the entry
+  array in `{ mode, salt, entries }` so `deserialize()` reproduces the
+  mode and salt; placeholder/blanked sessions keep the plain-array
+  Python-parity schema byte-identically.
+
+### Changed
+
+- **Breaking (user-visible output):** `AnonymizationSession` now generates
+  typed placeholders with per-type counters, e.g. `[PERSON_1]`, `[EMAIL_1]`,
+  `[DATE_2]`, instead of the global `<<REDACTED_N>>`. Typed placeholders
+  keep LLM answers coherent (pronouns, date reasoning, formatting), make
+  protected text human-readable, and avoid the `<<...>>` token that
+  Markdown-rendering chats can mangle. Placeholder type names are the
+  stable uppercase `EntityType` ids, so every generated token matches
+  `\[[A-Z_]+_\d+\]`.
+- Blanked-mode replacements no longer consume counter numbers, so labeled
+  placeholders number contiguously per type.
+- `AnonymizationSession.deserialize` rebuilds the per-type counters from
+  `[TYPE_N]` placeholders in the map, and `anonymize` skips any number
+  already present in the reverse map (renamed labels included), so freshly
+  issued placeholders never collide with restored or renamed ones.
+
+### Backward compatibility
+
+- Restoring is unchanged: `deanonymize` performs exact-literal replacement
+  of whatever placeholder strings the map contains. Maps serialized before
+  0.9.0 (or by the Python CLI's `save_map`) with `<<REDACTED_N>>` tokens
+  still deserialize and restore old-format text byte-identically.
+- The serialization schema (`original` / `replacement` / `entity_type`,
+  Python `save_map` parity) is unchanged.
+
 ## [0.8.0] - 2026-07-27
 
 First public release. The engine was extracted from the DocCloak web app

package/dist/index.d.ts

@@ -4,15 +4,17 @@
 export type { KVStore, BlobCache, HardwareHints, CoreEnv, MemoryBlobCacheOptions, } from './env.js';
 export { memoryKV, memoryBlobCache } from './env.js';
 export declare const CORE_PACKAGE_NAME = "@doccloak/core";
-export { fetchModelBlob, evictModelFromCache, retryAsync } from './model-loader.js';
-export type { ModelLoaderEnv, DownloadProgress, FetchModelOptions } from './model-loader.js';
+export { fetchModelBlob, evictModelFromCache, retryAsync, ModelIntegrityError, verificationMarkerKey } from './model-loader.js';
+export type { ModelLoaderEnv, DownloadProgress, FetchModelOptions, ModelVerification } from './model-loader.js';
 export { ALL_REGEX_RULES, REGEX_REGIONS } from './regex/index.js';
 export type { RegexRule, PiiDomain, RegionCode, RegexRegionId } from './regex/index.js';
 export * from './types.js';
 export * from './session.js';
 export * from './doc.js';
-export { GlinerProvider } from './providers/gliner.js';
-export { BardsaiProvider } from './providers/bardsai.js';
+export { generateSurrogate, generateUniqueSurrogate, generateSessionSalt, sessionDayOffset, FAKE_EMAIL_DOMAINS, } from './surrogates.js';
+export type { SurrogateContext } from './surrogates.js';
+export { GlinerProvider, GLINER_MODEL_URL, GLINER_MODEL_REVISION, GLINER_MODEL_SHA256 } from './providers/gliner.js';
+export { BardsaiProvider, BARDSAI_MODEL_URL, BARDSAI_MODEL_REVISION, BARDSAI_MODEL_SHA256 } from './providers/bardsai.js';
 export { detectWithRegex, resolveOverlaps, filterFalsePositives, propagateEntities, detectEntities, } from './pipeline.js';
 export { createEngine, PROVIDERS, pickDefaultProvider, defaultThresholdFor, clampThreshold, ENGINE_SETTINGS_KEYS, } from './engine.js';
 export type { ProviderId, ProviderEntry, ProviderFactory, EngineOptions, EngineSettings, DocCloakEngine, } from './engine.js';

package/dist/index.js

@@ -4,7 +4,7 @@
 export { memoryKV, memoryBlobCache } from "./env.js";
 export const CORE_PACKAGE_NAME = '@doccloak/core';
 // T006: model loader
-export { fetchModelBlob, evictModelFromCache, retryAsync } from "./model-loader.js";
+export { fetchModelBlob, evictModelFromCache, retryAsync, ModelIntegrityError, verificationMarkerKey } from "./model-loader.js";
 // end T006
 // T004: regex rules (REGEX_REGIONS moved here from the web engine in T009)
 export { ALL_REGEX_RULES, REGEX_REGIONS } from "./regex/index.js";
@@ -14,11 +14,14 @@ export * from "./types.js";
 export * from "./session.js";
 export * from "./doc.js";
 // end T003
+// T043: surrogate generator (realistic, shape-preserving replacements)
+export { generateSurrogate, generateUniqueSurrogate, generateSessionSalt, sessionDayOffset, FAKE_EMAIL_DOMAINS, } from "./surrogates.js";
+// end T043
 // T007: gliner provider
-export { GlinerProvider } from "./providers/gliner.js";
+export { GlinerProvider, GLINER_MODEL_URL, GLINER_MODEL_REVISION, GLINER_MODEL_SHA256 } from "./providers/gliner.js";
 // end T007
 // T008: bardsai provider
-export { BardsaiProvider } from "./providers/bardsai.js";
+export { BardsaiProvider, BARDSAI_MODEL_URL, BARDSAI_MODEL_REVISION, BARDSAI_MODEL_SHA256 } from "./providers/bardsai.js";
 // end T008
 // T005: pipeline
 export { detectWithRegex, resolveOverlaps, filterFalsePositives, propagateEntities, detectEntities, } from "./pipeline.js";

package/dist/model-loader.d.ts

@@ -14,6 +14,10 @@
  * - Serves the model from the injected BlobCache when available and prefers
  *   the cached (typically disk-backed) copy over the in-memory one to reduce
  *   peak RAM, which matters on iOS Safari where large tabs get killed.
+ * - Verifies downloads against a pinned SHA-256 when the caller provides one
+ *   (supply-chain hardening, T116): mismatches evict the cache entry and
+ *   reject with ModelIntegrityError; verified cache entries carry a marker
+ *   so they are not re-hashed on every startup.
  *
  * Environment-agnostic: all host capabilities (blob cache, fetch, persistent
  * storage request) are injected via ModelLoaderEnv. This module never touches
@@ -33,9 +37,47 @@ export interface ModelLoaderEnv {
     /** Best-effort persistent-storage request (navigator.storage.persist() on the web). */
     persistStorage?: () => Promise<boolean>;
 }
+/**
+ * A downloaded (or cached) model blob did not match the pinned SHA-256.
+ * Distinct error type so hosts can show a dedicated "integrity check
+ * failed" state instead of a generic download error. The offending cache
+ * entry is evicted before this is thrown; the regex/rules tier keeps
+ * working (existing degraded-mode behavior).
+ */
+export declare class ModelIntegrityError extends Error {
+    url: string;
+    expectedSha256: string;
+    actualSha256: string;
+    constructor(url: string, expectedSha256: string, actualSha256: string);
+}
+/** Successful SHA-256 verification of a model blob, surfaced to the model-status UI. */
+export interface ModelVerification {
+    url: string;
+    /** The verified SHA-256, lowercase hex - equals the pinned hash. */
+    sha256: string;
+}
+/**
+ * Cache key of the tiny "this URL was verified against this hash" marker.
+ * Uses a query parameter (not a URL fragment) because Cache Storage strips
+ * fragments, which would collide with the model entry itself. Keyed by
+ * url AND hash so bumping a pinned hash automatically invalidates markers
+ * written for the previous pin.
+ */
+export declare function verificationMarkerKey(url: string, sha256: string): string;
 export interface FetchModelOptions {
     maxAttempts?: number;
     retryBaseDelayMs?: number;
+    /**
+     * Pinned SHA-256 (lowercase hex) of the model blob. When set, every
+     * network download is hashed before use; a mismatch evicts the cache
+     * entry and rejects with ModelIntegrityError. Cached blobs that carry a
+     * verification marker for this hash skip re-hashing so startup cost is
+     * unchanged; cached blobs without a marker are hashed once and either
+     * marked verified or evicted and re-downloaded.
+     */
+    sha256?: string;
+    /** Fired once the served blob is known to match the pinned sha256. */
+    onVerified?: (verification: ModelVerification) => void;
 }
 /**
  * Download a model with progress reporting, resume and retry.
@@ -43,9 +85,10 @@ export interface FetchModelOptions {
  */
 export declare function fetchModelBlob(env: ModelLoaderEnv, url: string, onProgress?: DownloadProgress, options?: FetchModelOptions): Promise<Blob>;
 /**
- * Remove a single model from the cache (e.g. when its URL changes).
+ * Remove a single model from the cache (e.g. when its URL changes). When a
+ * pinned sha256 is given, the matching verification marker is removed too.
  */
-export declare function evictModelFromCache(env: ModelLoaderEnv, url: string): Promise<void>;
+export declare function evictModelFromCache(env: ModelLoaderEnv, url: string, sha256?: string): Promise<void>;
 /**
  * Retry an async operation with exponential backoff. Used for the smaller
  * companion downloads (tokenizer files) that go through libraries without

package/dist/model-loader.js

@@ -14,6 +14,10 @@
  * - Serves the model from the injected BlobCache when available and prefers
  *   the cached (typically disk-backed) copy over the in-memory one to reduce
  *   peak RAM, which matters on iOS Safari where large tabs get killed.
+ * - Verifies downloads against a pinned SHA-256 when the caller provides one
+ *   (supply-chain hardening, T116): mismatches evict the cache entry and
+ *   reject with ModelIntegrityError; verified cache entries carry a marker
+ *   so they are not re-hashed on every startup.
  *
  * Environment-agnostic: all host capabilities (blob cache, fetch, persistent
  * storage request) are injected via ModelLoaderEnv. This module never touches
@@ -30,6 +34,52 @@ class HttpError extends Error {
         this.status = status;
     }
 }
+/**
+ * A downloaded (or cached) model blob did not match the pinned SHA-256.
+ * Distinct error type so hosts can show a dedicated "integrity check
+ * failed" state instead of a generic download error. The offending cache
+ * entry is evicted before this is thrown; the regex/rules tier keeps
+ * working (existing degraded-mode behavior).
+ */
+export class ModelIntegrityError extends Error {
+    constructor(url, expectedSha256, actualSha256) {
+        super(`Model failed SHA-256 integrity check: expected ${expectedSha256.slice(0, 12)}..., ` +
+            `got ${actualSha256.slice(0, 12)}... (${url}). The downloaded copy was discarded.`);
+        this.name = 'ModelIntegrityError';
+        this.url = url;
+        this.expectedSha256 = expectedSha256;
+        this.actualSha256 = actualSha256;
+    }
+}
+/**
+ * Cache key of the tiny "this URL was verified against this hash" marker.
+ * Uses a query parameter (not a URL fragment) because Cache Storage strips
+ * fragments, which would collide with the model entry itself. Keyed by
+ * url AND hash so bumping a pinned hash automatically invalidates markers
+ * written for the previous pin.
+ */
+export function verificationMarkerKey(url, sha256) {
+    const sep = url.includes('?') ? '&' : '?';
+    return `${url}${sep}doccloak-sha256-verified=${sha256}`;
+}
+/**
+ * SHA-256 of a blob as lowercase hex. WebCrypto has no streaming digest,
+ * so the blob is hashed as one contiguous buffer: peak cost is one extra
+ * transient copy of the model, released before ONNX Runtime allocates its
+ * own copy.
+ */
+async function sha256Hex(blob) {
+    const buffer = await blob.arrayBuffer();
+    const digest = await crypto.subtle.digest('SHA-256', buffer);
+    return Array.from(new Uint8Array(digest), (b) => b.toString(16).padStart(2, '0')).join('');
+}
+/** Best-effort write of the verification marker (a 1-byte blob). */
+async function markVerified(cache, url, sha256) {
+    try {
+        await cache.put(verificationMarkerKey(url, sha256), new Blob(['1']));
+    }
+    catch { /* marker is an optimisation - next startup just re-hashes */ }
+}
 function isRetryable(err) {
     if (err instanceof HttpError) {
         return err.status === 408 || err.status === 429 || err.status >= 500;
@@ -80,9 +130,11 @@ async function tryCachePut(cache, url, blob) {
         if (!stored) {
             console.warn('[DocCloak] Model cache put refused (model still loaded in memory)');
         }
+        return stored;
     }
     catch (err) {
         console.warn('[DocCloak] Model cache put failed (model still loaded in memory):', err);
+        return false;
     }
 }
 /**
@@ -150,11 +202,33 @@ async function downloadAttempt(fetchFn, url, offset, onChunk, onHeaders) {
 export async function fetchModelBlob(env, url, onProgress, options) {
     const maxAttempts = options?.maxAttempts ?? MAX_ATTEMPTS;
     const retryBaseDelayMs = options?.retryBaseDelayMs ?? RETRY_BASE_DELAY_MS;
+    const expectedSha256 = options?.sha256?.toLowerCase();
     const cache = env.cache;
     const cachedBlob = await readFromCache(cache, url);
     if (cachedBlob) {
-        onProgress?.(cachedBlob.size, cachedBlob.size);
-        return cachedBlob;
+        if (!expectedSha256) {
+            onProgress?.(cachedBlob.size, cachedBlob.size);
+            return cachedBlob;
+        }
+        // Previously verified against this exact pin: skip the re-hash so
+        // startup cost is unchanged.
+        const marker = await readFromCache(cache, verificationMarkerKey(url, expectedSha256));
+        if (marker) {
+            onProgress?.(cachedBlob.size, cachedBlob.size);
+            options?.onVerified?.({ url, sha256: expectedSha256 });
+            return cachedBlob;
+        }
+        // No marker (cache predates pinning, or the pin changed): hash once.
+        const actualSha256 = await sha256Hex(cachedBlob);
+        if (actualSha256 === expectedSha256) {
+            await markVerified(cache, url, expectedSha256);
+            onProgress?.(cachedBlob.size, cachedBlob.size);
+            options?.onVerified?.({ url, sha256: expectedSha256 });
+            return cachedBlob;
+        }
+        // Stale or corrupt cached copy - evict and fall through to the network.
+        console.warn(`[DocCloak] Cached model failed SHA-256 check (expected ${expectedSha256.slice(0, 12)}..., got ${actualSha256.slice(0, 12)}...), re-downloading`);
+        await evictModelFromCache(env, url, expectedSha256);
     }
     await requestPersistentStorage(env);
     let lastProgressAt = 0;
@@ -213,22 +287,42 @@ export async function fetchModelBlob(env, url, onProgress, options) {
     reportProgress(downloaded, total || downloaded, true);
     let blob = new Blob(chunks);
     chunks = [];
-    await tryCachePut(cache, url, blob);
+    if (expectedSha256) {
+        // Verify the final assembled blob (covers both fresh and resumed
+        // downloads) BEFORE it is cached or handed to the runtime.
+        const actualSha256 = await sha256Hex(blob);
+        if (actualSha256 !== expectedSha256) {
+            await evictModelFromCache(env, url, expectedSha256);
+            throw new ModelIntegrityError(url, expectedSha256, actualSha256);
+        }
+    }
+    const stored = await tryCachePut(cache, url, blob);
+    if (expectedSha256 && stored)
+        await markVerified(cache, url, expectedSha256);
     // Prefer the cached (disk-backed) copy so the in-memory chunks can be
     // collected before ONNX Runtime allocates its own copy of the model.
     const diskBlob = await readFromCache(cache, url);
     if (diskBlob && diskBlob.size === blob.size)
         blob = diskBlob;
+    if (expectedSha256)
+        options?.onVerified?.({ url, sha256: expectedSha256 });
     return blob;
 }
 /**
- * Remove a single model from the cache (e.g. when its URL changes).
+ * Remove a single model from the cache (e.g. when its URL changes). When a
+ * pinned sha256 is given, the matching verification marker is removed too.
  */
-export async function evictModelFromCache(env, url) {
+export async function evictModelFromCache(env, url, sha256) {
     try {
         await env.cache.delete(url);
     }
     catch { /* ignore */ }
+    if (sha256) {
+        try {
+            await env.cache.delete(verificationMarkerKey(url, sha256.toLowerCase()));
+        }
+        catch { /* ignore */ }
+    }
 }
 /**
  * Retry an async operation with exponential backoff. Used for the smaller

package/dist/providers/bardsai.d.ts

@@ -12,6 +12,11 @@
  */
 import type { DetectedEntity, DetectionProvider, ProgressCallback } from '../types.js';
 import type { CoreEnv } from '../env.js';
+import type { ModelVerification } from '../model-loader.js';
+export declare const BARDSAI_MODEL_REVISION = "0e72e19f030ed4e661b1673e549af8e0dd176386";
+/** SHA-256 of onnx/model_quantized.onnx (278,736,360 bytes) at BARDSAI_MODEL_REVISION. */
+export declare const BARDSAI_MODEL_SHA256 = "8c9f555c743ed14eb7e505ff9d9c7785775a1671fd14031af33f424de8bd0e7b";
+export declare const BARDSAI_MODEL_URL = "https://huggingface.co/bardsai/eu-pii-anonimization-multilang/resolve/0e72e19f030ed4e661b1673e549af8e0dd176386/onnx/model_quantized.onnx";
 export declare class BardsaiProvider implements DetectionProvider {
     private _name;
     get name(): string;
@@ -23,7 +28,14 @@ export declare class BardsaiProvider implements DetectionProvider {
     private loadWaiters;
     private progressCallback;
     private threshold;
+    private verification;
     constructor(env: CoreEnv);
+    /**
+     * SHA-256 verification result of the served model blob (null until the
+     * model has been verified against the pinned hash). Surfaced so the
+     * model-status UI can show the positive "Model verified" state.
+     */
+    getVerification(): ModelVerification | null;
     isLoaded(): boolean;
     isLoading(): boolean;
     onProgress(callback: ProgressCallback): void;

package/dist/providers/bardsai.js

@@ -11,9 +11,23 @@
  * import.meta, caches, navigator or @huggingface/transformers directly.
  */
 import * as ort from 'onnxruntime-web';
-import { fetchModelBlob, retryAsync } from "../model-loader.js";
+import { evictModelFromCache, fetchModelBlob, retryAsync } from "../model-loader.js";
 // ── Model config ──────────────────────────────────────────
-const MODEL_URL = 'https://huggingface.co/bardsai/eu-pii-anonimization-multilang/resolve/main/onnx/model_quantized.onnx';
+// Supply-chain pinning (T116): the model is fetched from an immutable
+// commit revision, never from mutable resolve/main, and the downloaded
+// blob is verified against a pinned SHA-256. A model update is a
+// deliberate act: bump BARDSAI_MODEL_REVISION and BARDSAI_MODEL_SHA256
+// together in a reviewed commit and update
+// documentation/model-provenance.md.
+// Revision: main of bardsai/eu-pii-anonimization-multilang as of its last
+// modification 2026-05-13; pinned and hashed 2026-08-10.
+export const BARDSAI_MODEL_REVISION = '0e72e19f030ed4e661b1673e549af8e0dd176386';
+/** SHA-256 of onnx/model_quantized.onnx (278,736,360 bytes) at BARDSAI_MODEL_REVISION. */
+export const BARDSAI_MODEL_SHA256 = '8c9f555c743ed14eb7e505ff9d9c7785775a1671fd14031af33f424de8bd0e7b';
+export const BARDSAI_MODEL_URL = `https://huggingface.co/bardsai/eu-pii-anonimization-multilang/resolve/${BARDSAI_MODEL_REVISION}/onnx/model_quantized.onnx`;
+const MODEL_URL = BARDSAI_MODEL_URL;
+/** Pre-pinning download URL; its cache entry is evicted best-effort on load. */
+const LEGACY_MODEL_URL = 'https://huggingface.co/bardsai/eu-pii-anonimization-multilang/resolve/main/onnx/model_quantized.onnx';
 const TOKENIZER_HF = 'bardsai/eu-pii-anonimization-multilang';
 const MODEL_NAME = 'BardS.ai EU PII';
 const DEFAULT_THRESHOLD = 0.5;
@@ -102,8 +116,17 @@ export class BardsaiProvider {
         this.loadWaiters = [];
         this.progressCallback = null;
         this.threshold = DEFAULT_THRESHOLD;
+        this.verification = null;
         this.env = env;
     }
+    /**
+     * SHA-256 verification result of the served model blob (null until the
+     * model has been verified against the pinned hash). Surfaced so the
+     * model-status UI can show the positive "Model verified" state.
+     */
+    getVerification() {
+        return this.verification;
+    }
     isLoaded() {
         return this.session !== null && this.tokenizer !== null;
     }
@@ -141,9 +164,18 @@ export class BardsaiProvider {
                 fetch: this.env.fetch,
                 persistStorage: this.env.persistStorage,
             };
+            // Old cache entry from the pre-pinning resolve/main URL - drop it so
+            // a 279 MB stale copy does not linger against the origin quota.
+            void evictModelFromCache(loaderEnv, LEGACY_MODEL_URL);
             // Load tokenizer and model in parallel (skip tokenizer if already loaded from a prior session)
             const tasks = [
-                fetchModelBlob(loaderEnv, MODEL_URL, (downloaded, total) => this.progressCallback?.(downloaded, total)),
+                fetchModelBlob(loaderEnv, MODEL_URL, (downloaded, total) => this.progressCallback?.(downloaded, total), {
+                    sha256: BARDSAI_MODEL_SHA256,
+                    onVerified: (verification) => {
+                        this.verification = verification;
+                        console.info(`[DocCloak] Model verified: ${this._name} SHA-256 ${verification.sha256.slice(0, 12)}... matches the published hash (see documentation/model-provenance.md)`);
+                    },
+                }),
             ];
             if (!this.tokenizer) {
                 tasks.push(retryAsync(() => this.env.loadTokenizer(TOKENIZER_HF), 'Tokenizer download').then((t) => {

package/dist/providers/gliner.d.ts

@@ -8,6 +8,11 @@
  */
 import type { DetectedEntity, DetectionProvider, ProgressCallback } from '../types.js';
 import type { CoreEnv } from '../env.js';
+import type { ModelVerification } from '../model-loader.js';
+export declare const GLINER_MODEL_REVISION = "9b7f39b0a2da971a5beea78d35f1539d4009c891";
+/** SHA-256 of onnx/model_quint8.onnx (45,820,894 bytes) at GLINER_MODEL_REVISION. */
+export declare const GLINER_MODEL_SHA256 = "988acb03456b26e2d9f2521016d820310c2ed64deb4a846297d3289f0c2eb7e4";
+export declare const GLINER_MODEL_URL = "https://huggingface.co/knowledgator/gliner-pii-edge-v1.0/resolve/9b7f39b0a2da971a5beea78d35f1539d4009c891/onnx/model_quint8.onnx";
 export declare class GlinerProvider implements DetectionProvider {
     private _name;
     get name(): string;
@@ -20,7 +25,14 @@ export declare class GlinerProvider implements DetectionProvider {
     private progressCallback;
     private threshold;
     private customLabels;
+    private verification;
     constructor(env: CoreEnv);
+    /**
+     * SHA-256 verification result of the served model blob (null until the
+     * model has been verified against the pinned hash). Surfaced so the
+     * model-status UI can show the positive "Model verified" state.
+     */
+    getVerification(): ModelVerification | null;
     isLoaded(): boolean;
     isLoading(): boolean;
     onProgress(callback: ProgressCallback): void;

package/dist/providers/gliner.js

@@ -7,9 +7,23 @@
  * caches, navigator or @huggingface/transformers directly.
  */
 import * as ort from 'onnxruntime-web';
-import { fetchModelBlob, retryAsync } from "../model-loader.js";
+import { evictModelFromCache, fetchModelBlob, retryAsync } from "../model-loader.js";
 // ── Model config ──────────────────────────────────────────
-const DEFAULT_MODEL_URL = 'https://huggingface.co/knowledgator/gliner-pii-edge-v1.0/resolve/main/onnx/model_quint8.onnx';
+// Supply-chain pinning (T116): the model is fetched from an immutable
+// commit revision, never from mutable resolve/main, and the downloaded
+// blob is verified against a pinned SHA-256. A model update is a
+// deliberate act: bump GLINER_MODEL_REVISION and GLINER_MODEL_SHA256
+// together in a reviewed commit and update
+// documentation/model-provenance.md.
+// Revision: main of knowledgator/gliner-pii-edge-v1.0 as of its last
+// modification 2026-03-26; pinned and hashed 2026-08-10.
+export const GLINER_MODEL_REVISION = '9b7f39b0a2da971a5beea78d35f1539d4009c891';
+/** SHA-256 of onnx/model_quint8.onnx (45,820,894 bytes) at GLINER_MODEL_REVISION. */
+export const GLINER_MODEL_SHA256 = '988acb03456b26e2d9f2521016d820310c2ed64deb4a846297d3289f0c2eb7e4';
+export const GLINER_MODEL_URL = `https://huggingface.co/knowledgator/gliner-pii-edge-v1.0/resolve/${GLINER_MODEL_REVISION}/onnx/model_quint8.onnx`;
+const DEFAULT_MODEL_URL = GLINER_MODEL_URL;
+/** Pre-pinning download URL; its cache entry is evicted best-effort on load. */
+const LEGACY_MODEL_URL = 'https://huggingface.co/knowledgator/gliner-pii-edge-v1.0/resolve/main/onnx/model_quint8.onnx';
 const DEFAULT_TOKENIZER_HF = 'knowledgator/gliner-pii-edge-v1.0';
 const DEFAULT_MODEL_NAME = 'GLiNER PII Edge';
 const CUSTOM_LABELS_STORAGE_KEY = 'doccloak-custom-labels';
@@ -101,8 +115,17 @@ export class GlinerProvider {
         this.progressCallback = null;
         this.threshold = DEFAULT_THRESHOLD;
         this.customLabels = [];
+        this.verification = null;
         this.env = env;
     }
+    /**
+     * SHA-256 verification result of the served model blob (null until the
+     * model has been verified against the pinned hash). Surfaced so the
+     * model-status UI can show the positive "Model verified" state.
+     */
+    getVerification() {
+        return this.verification;
+    }
     isLoaded() {
         return this.session !== null && this.tokenizer !== null;
     }
@@ -176,9 +199,18 @@ export class GlinerProvider {
                 fetch: this.env.fetch,
                 persistStorage: this.env.persistStorage,
             };
+            // Old cache entry from the pre-pinning resolve/main URL - drop it so
+            // a 45 MB stale copy does not linger against the origin quota.
+            void evictModelFromCache(loaderEnv, LEGACY_MODEL_URL);
             // Load tokenizer and model in parallel (skip tokenizer if already loaded from a prior session)
             const tasks = [
-                fetchModelBlob(loaderEnv, DEFAULT_MODEL_URL, (downloaded, total) => this.progressCallback?.(downloaded, total)),
+                fetchModelBlob(loaderEnv, DEFAULT_MODEL_URL, (downloaded, total) => this.progressCallback?.(downloaded, total), {
+                    sha256: GLINER_MODEL_SHA256,
+                    onVerified: (verification) => {
+                        this.verification = verification;
+                        console.info(`[DocCloak] Model verified: ${this._name} SHA-256 ${verification.sha256.slice(0, 12)}... matches the published hash (see documentation/model-provenance.md)`);
+                    },
+                }),
             ];
             if (!this.tokenizer) {
                 tasks.push(retryAsync(() => this.env.loadTokenizer(DEFAULT_TOKENIZER_HF), 'Tokenizer download').then((t) => {
@@ -235,7 +267,7 @@ export class GlinerProvider {
         const allSpans = [];
         onProgress?.(0);
         if (words.length <= chunkSize) {
-            // Single chunk — no splitting needed
+            // Single chunk - no splitting needed
             const spans = await this.inferChunk(words, starts, ends, text, promptTokens, activeLabels);
             allSpans.push(...spans);
             onProgress?.(1);