def test_document_builder_is_deterministic_and_redacts_secrets():
    from app.core.knowledge.document_builder import build_document
    first = build_document("DataFlow", {"uid": "u", "name": "Flow", "version": 1, "password": "secret", "relations": [{"b": 2}, {"a": 1}]})
    second = build_document("DataFlow", {"relations": [{"a": 1}, {"b": 2}], "version": 1, "name": "Flow", "uid": "u", "password": "changed"})
    assert first["content_hash"] == second["content_hash"]
    assert "secret" not in first["content"]