@sanqianx/project-knowledge 5.0.24 → 5.0.25

package/_site/_test/server-security-test.js

@@ -1,96 +1,96 @@
-const assert = require('assert');
-const fs = require('fs');
-const os = require('os');
-const path = require('path');
-const { spawnServer } = require('./helpers/spawn-server');
-const { createRequestHandler } = require('../lib/server-app');
-
-const ROOT = path.resolve(__dirname, '..', '..');
-const PORT = 7832;
-const BASE = `http://127.0.0.1:${PORT}`;
-const dataDir = fs.mkdtempSync(path.join(os.tmpdir(), 'pkb-security-v2-'));
-const REMOTE_PORT = 7833;
-const REMOTE_BASE = `http://127.0.0.1:${REMOTE_PORT}`;
-const remoteDataDir = fs.mkdtempSync(path.join(os.tmpdir(), 'pkb-security-remote-v2-'));
-
-async function waitForServer() {
-  for (let attempt = 0; attempt < 100; attempt += 1) {
-    try { if ((await fetch(`${BASE}/api/health`)).ok) return; } catch {}
-    await new Promise(resolve => setTimeout(resolve, 100));
-  }
-  throw new Error('server did not start');
-}
-
-(async () => {
-  assert.throws(
-    () => createRequestHandler({}, { host: '0.0.0.0', port: 9999 }),
-    error => error && error.code === 'AUTH_REQUIRED',
-    'non-loopback bind must require authentication',
-  );
-
-  const spawned = spawnServer({ root: ROOT, port: PORT, dataDir, tag: 'security-v2', extraEnv: { KB_SKIP_MIGRATION: '1' } });
-  try {
-    await waitForServer();
-    let response = await fetch(`${BASE}/api/ai-profiles`, { headers: { Origin: 'https://evil.example' } });
-    assert.strictEqual(response.status, 403);
-    assert.strictEqual(response.headers.get('access-control-allow-origin'), null);
-
-    response = await fetch(`${BASE}/api/ai-profiles`, {
-      method: 'PUT', headers: { 'content-type': 'application/json' }, body: JSON.stringify({
-        schema: 'ai-profiles/v1', profiles: [{ id: 'secret', enabled: true, apiKeyUpdate: { mode: 'replace', value: 'top-secret-api-key' } }],
-      }),
-    });
-    assert.strictEqual(response.status, 200);
-    response = await fetch(`${BASE}/api/ai-profiles`);
-    const profileText = await response.text();
-    assert(!profileText.includes('top-secret-api-key'));
-    assert(!/"apiKey"\s*:/.test(profileText));
-
-    response = await fetch(`${BASE}/api/raw?path=../../settings.json`);
-    assert.strictEqual(response.status, 404);
-    const rawText = await response.text();
-    assert(!rawText.includes('top-secret-api-key'));
-
-    response = await fetch(`${BASE}/api/projects/not-valid%2Fid`);
-    const errorText = await response.text();
-    assert(!/\bstack\b/i.test(errorText));
-    assert(!errorText.includes('top-secret-api-key'));
-    const error = JSON.parse(errorText);
-    assert(error.error.operationId);
-
-    const remote = spawnServer({
-      root: ROOT,
-      port: REMOTE_PORT,
-      host: '0.0.0.0',
-      dataDir: remoteDataDir,
-      tag: 'security-remote-v2',
-      extraEnv: {
-        KB_SKIP_MIGRATION: '1',
-        KB_SITE_AUTH_TOKEN: 'remote-auth-secret',
-        KB_ALLOWED_ORIGINS: 'https://allowed.example',
-      },
-    });
-    try {
-      for (let attempt = 0; attempt < 100; attempt += 1) {
-        try {
-          const ready = await fetch(`${REMOTE_BASE}/api/health`, { headers: { Authorization: 'Bearer remote-auth-secret', Origin: 'https://allowed.example' } });
-          if (ready.ok) break;
-        } catch {}
-        await new Promise(resolve => setTimeout(resolve, 100));
-      }
-      let remoteResponse = await fetch(`${REMOTE_BASE}/api/health`, { headers: { Origin: 'https://allowed.example' } });
-      assert.strictEqual(remoteResponse.status, 401, 'non-loopback request without token must fail');
-      remoteResponse = await fetch(`${REMOTE_BASE}/api/health`, { headers: { Authorization: 'Bearer remote-auth-secret', Origin: 'https://evil.example' } });
-      assert.strictEqual(remoteResponse.status, 403, 'non-loopback request from an unlisted Origin must fail');
-      remoteResponse = await fetch(`${REMOTE_BASE}/api/health`, { headers: { Authorization: 'Bearer remote-auth-secret', Origin: 'https://allowed.example' } });
-      assert.strictEqual(remoteResponse.status, 200);
-      assert.strictEqual(remoteResponse.headers.get('access-control-allow-origin'), 'https://allowed.example');
-    } finally {
-      remote.cleanup();
-    }
-    console.log('server-security-test PASS');
-  } finally {
-    await spawned.cleanup();
-    fs.rmSync(remoteDataDir, { recursive: true, force: true });
-  }
-})().catch(error => { console.error(error); process.exitCode = 1; });
+const assert = require('assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawnServer } = require('./helpers/spawn-server');
+const { createRequestHandler } = require('../lib/server-app');
+
+const ROOT = path.resolve(__dirname, '..', '..');
+const PORT = 7832;
+const BASE = `http://127.0.0.1:${PORT}`;
+const dataDir = fs.mkdtempSync(path.join(os.tmpdir(), 'pkb-security-v2-'));
+const REMOTE_PORT = 7833;
+const REMOTE_BASE = `http://127.0.0.1:${REMOTE_PORT}`;
+const remoteDataDir = fs.mkdtempSync(path.join(os.tmpdir(), 'pkb-security-remote-v2-'));
+
+async function waitForServer() {
+  for (let attempt = 0; attempt < 100; attempt += 1) {
+    try { if ((await fetch(`${BASE}/api/health`)).ok) return; } catch {}
+    await new Promise(resolve => setTimeout(resolve, 100));
+  }
+  throw new Error('server did not start');
+}
+
+(async () => {
+  assert.throws(
+    () => createRequestHandler({}, { host: '0.0.0.0', port: 9999 }),
+    error => error && error.code === 'AUTH_REQUIRED',
+    'non-loopback bind must require authentication',
+  );
+
+  const spawned = spawnServer({ root: ROOT, port: PORT, dataDir, tag: 'security-v2', extraEnv: { KB_SKIP_MIGRATION: '1' } });
+  try {
+    await waitForServer();
+    let response = await fetch(`${BASE}/api/ai-profiles`, { headers: { Origin: 'https://evil.example' } });
+    assert.strictEqual(response.status, 403);
+    assert.strictEqual(response.headers.get('access-control-allow-origin'), null);
+
+    response = await fetch(`${BASE}/api/ai-profiles`, {
+      method: 'PUT', headers: { 'content-type': 'application/json' }, body: JSON.stringify({
+        schema: 'ai-profiles/v1', profiles: [{ id: 'secret', enabled: true, apiKeyUpdate: { mode: 'replace', value: 'top-secret-api-key' } }],
+      }),
+    });
+    assert.strictEqual(response.status, 200);
+    response = await fetch(`${BASE}/api/ai-profiles`);
+    const profileText = await response.text();
+    assert(!profileText.includes('top-secret-api-key'));
+    assert(!/"apiKey"\s*:/.test(profileText));
+
+    response = await fetch(`${BASE}/api/raw?path=../../settings.json`);
+    assert.strictEqual(response.status, 404);
+    const rawText = await response.text();
+    assert(!rawText.includes('top-secret-api-key'));
+
+    response = await fetch(`${BASE}/api/projects/not-valid%2Fid`);
+    const errorText = await response.text();
+    assert(!/\bstack\b/i.test(errorText));
+    assert(!errorText.includes('top-secret-api-key'));
+    const error = JSON.parse(errorText);
+    assert(error.error.operationId);
+
+    const remote = spawnServer({
+      root: ROOT,
+      port: REMOTE_PORT,
+      host: '0.0.0.0',
+      dataDir: remoteDataDir,
+      tag: 'security-remote-v2',
+      extraEnv: {
+        KB_SKIP_MIGRATION: '1',
+        KB_SITE_AUTH_TOKEN: 'remote-auth-secret',
+        KB_ALLOWED_ORIGINS: 'https://allowed.example',
+      },
+    });
+    try {
+      for (let attempt = 0; attempt < 100; attempt += 1) {
+        try {
+          const ready = await fetch(`${REMOTE_BASE}/api/health`, { headers: { Authorization: 'Bearer remote-auth-secret', Origin: 'https://allowed.example' } });
+          if (ready.ok) break;
+        } catch {}
+        await new Promise(resolve => setTimeout(resolve, 100));
+      }
+      let remoteResponse = await fetch(`${REMOTE_BASE}/api/health`, { headers: { Origin: 'https://allowed.example' } });
+      assert.strictEqual(remoteResponse.status, 401, 'non-loopback request without token must fail');
+      remoteResponse = await fetch(`${REMOTE_BASE}/api/health`, { headers: { Authorization: 'Bearer remote-auth-secret', Origin: 'https://evil.example' } });
+      assert.strictEqual(remoteResponse.status, 403, 'non-loopback request from an unlisted Origin must fail');
+      remoteResponse = await fetch(`${REMOTE_BASE}/api/health`, { headers: { Authorization: 'Bearer remote-auth-secret', Origin: 'https://allowed.example' } });
+      assert.strictEqual(remoteResponse.status, 200);
+      assert.strictEqual(remoteResponse.headers.get('access-control-allow-origin'), 'https://allowed.example');
+    } finally {
+      remote.cleanup();
+    }
+    console.log('server-security-test PASS');
+  } finally {
+    await spawned.cleanup();
+    fs.rmSync(remoteDataDir, { recursive: true, force: true });
+  }
+})().catch(error => { console.error(error); process.exitCode = 1; });

package/_site/_test/sessions-stream-test.js

@@ -1,93 +1,93 @@
-const assert = require('assert');
-const fs = require('fs');
-const http = require('http');
-const os = require('os');
-const path = require('path');
-const { spawnSync } = require('child_process');
-const { spawnServer } = require('./helpers/spawn-server');
-const freePort = require('./helpers/free-port');
-
-const ROOT = path.resolve(__dirname, '..', '..');
-let PORT, BASE;
-const dataDir = fs.mkdtempSync(path.join(os.tmpdir(), 'pkb-sse-v2-'));
-const repoPath = fs.mkdtempSync(path.join(os.tmpdir(), 'pkb-sse-repo-'));
-
-function git(args) {
-  const result = spawnSync('git', args, { cwd: repoPath, encoding: 'utf8' });
-  assert.strictEqual(result.status, 0, result.stderr);
-}
-
-async function json(method, pathname, body) {
-  const response = await fetch(`${BASE}${pathname}`, { method, headers: body === undefined ? undefined : { 'content-type': 'application/json' }, body: body === undefined ? undefined : JSON.stringify(body) });
-  return { status: response.status, data: await response.json() };
-}
-
-async function waitForServer() {
-  for (let attempt = 0; attempt < 100; attempt += 1) {
-    try { if ((await fetch(`${BASE}/api/health`)).ok) return; } catch {}
-    await new Promise(resolve => setTimeout(resolve, 100));
-  }
-  throw new Error('server did not start');
-}
-
-function openSse() {
-  const frames = [];
-  let buffer = '';
-  const request = http.get(`${BASE}/api/claude/sessions-stream`, response => {
-    assert.strictEqual(response.statusCode, 200);
-    response.on('data', chunk => {
-      buffer += chunk.toString('utf8');
-      let boundary;
-      while ((boundary = buffer.indexOf('\n\n')) >= 0) {
-        const block = buffer.slice(0, boundary);
-        buffer = buffer.slice(boundary + 2);
-        const event = /^event:\s*(.+)$/m.exec(block);
-        const data = /^data:\s*(.+)$/m.exec(block);
-        if (event && data) frames.push({ event: event[1], data: JSON.parse(data[1]) });
-      }
-    });
-  });
-  request.on('error', error => { frames.push({ event: 'transport-error', data: { message: error.message } }); });
-  return { frames, close: () => request.destroy() };
-}
-
-async function waitFor(predicate) {
-  for (let attempt = 0; attempt < 100; attempt += 1) {
-    if (predicate()) return;
-    await new Promise(resolve => setTimeout(resolve, 50));
-  }
-  throw new Error('timed out waiting for SSE frame');
-}
-
-(async () => {
-  PORT = await freePort(); BASE = `http://127.0.0.1:${PORT}`;
-  git(['init', '--initial-branch=main']);
-  git(['config', 'user.email', 'sse@example.test']);
-  git(['config', 'user.name', 'SSE Test']);
-  const spawned = spawnServer({ root: ROOT, port: PORT, dataDir, tag: 'sse-v2', extraEnv: { KB_SKIP_MIGRATION: '1' } });
-  try {
-    await waitForServer();
-    await json('PATCH', '/api/settings', { knowledge: { rootPath: path.join(dataDir, 'knowledge') } });
-    await json('PUT', '/api/ai-profiles', { schema: 'ai-profiles/v1', defaultProfileId: 'test', profiles: [{ id: 'test', name: 'Test', enabled: true, implementation: 'claude-code-agent', apiKeyUpdate: { mode: 'replace', value: 'sk-test' } }] });
-    const imported = await json('POST', '/api/projects/import', { localPath: repoPath, aiProfileId: 'test' });
-    assert.strictEqual(imported.status, 201, JSON.stringify(imported.data));
-
-    const stream = openSse();
-    await waitFor(() => stream.frames.some(frame => frame.event === 'claude/snapshot'));
-    const snapshot = stream.frames.find(frame => frame.event === 'claude/snapshot');
-    assert(Array.isArray(snapshot.data.sessions));
-
-    const started = await json('POST', '/api/claude/sessions', { projectId: imported.data.projectId });
-    assert.strictEqual(started.status, 201, JSON.stringify(started.data));
-    await waitFor(() => stream.frames.some(frame => frame.event === 'claude/sessions-changed' && frame.data.kind === 'create'));
-    const created = stream.frames.find(frame => frame.event === 'claude/sessions-changed' && frame.data.kind === 'create');
-    assert.strictEqual(created.data.projectSlug, imported.data.projectId);
-    const sessions = await json('GET', `/api/claude/sessions?projectId=${encodeURIComponent(imported.data.projectId)}`);
-    assert(sessions.data.sessions.some(session => session.sessionId === started.data.sessionId));
-    stream.close();
-    console.log('sessions-stream-test PASS');
-  } finally {
-    await spawned.cleanup();
-    fs.rmSync(repoPath, { recursive: true, force: true });
-  }
-})().catch(error => { console.error(error); process.exitCode = 1; });
+const assert = require('assert');
+const fs = require('fs');
+const http = require('http');
+const os = require('os');
+const path = require('path');
+const { spawnSync } = require('child_process');
+const { spawnServer } = require('./helpers/spawn-server');
+const freePort = require('./helpers/free-port');
+
+const ROOT = path.resolve(__dirname, '..', '..');
+let PORT, BASE;
+const dataDir = fs.mkdtempSync(path.join(os.tmpdir(), 'pkb-sse-v2-'));
+const repoPath = fs.mkdtempSync(path.join(os.tmpdir(), 'pkb-sse-repo-'));
+
+function git(args) {
+  const result = spawnSync('git', args, { cwd: repoPath, encoding: 'utf8' });
+  assert.strictEqual(result.status, 0, result.stderr);
+}
+
+async function json(method, pathname, body) {
+  const response = await fetch(`${BASE}${pathname}`, { method, headers: body === undefined ? undefined : { 'content-type': 'application/json' }, body: body === undefined ? undefined : JSON.stringify(body) });
+  return { status: response.status, data: await response.json() };
+}
+
+async function waitForServer() {
+  for (let attempt = 0; attempt < 100; attempt += 1) {
+    try { if ((await fetch(`${BASE}/api/health`)).ok) return; } catch {}
+    await new Promise(resolve => setTimeout(resolve, 100));
+  }
+  throw new Error('server did not start');
+}
+
+function openSse() {
+  const frames = [];
+  let buffer = '';
+  const request = http.get(`${BASE}/api/claude/sessions-stream`, response => {
+    assert.strictEqual(response.statusCode, 200);
+    response.on('data', chunk => {
+      buffer += chunk.toString('utf8');
+      let boundary;
+      while ((boundary = buffer.indexOf('\n\n')) >= 0) {
+        const block = buffer.slice(0, boundary);
+        buffer = buffer.slice(boundary + 2);
+        const event = /^event:\s*(.+)$/m.exec(block);
+        const data = /^data:\s*(.+)$/m.exec(block);
+        if (event && data) frames.push({ event: event[1], data: JSON.parse(data[1]) });
+      }
+    });
+  });
+  request.on('error', error => { frames.push({ event: 'transport-error', data: { message: error.message } }); });
+  return { frames, close: () => request.destroy() };
+}
+
+async function waitFor(predicate) {
+  for (let attempt = 0; attempt < 100; attempt += 1) {
+    if (predicate()) return;
+    await new Promise(resolve => setTimeout(resolve, 50));
+  }
+  throw new Error('timed out waiting for SSE frame');
+}
+
+(async () => {
+  PORT = await freePort(); BASE = `http://127.0.0.1:${PORT}`;
+  git(['init', '--initial-branch=main']);
+  git(['config', 'user.email', 'sse@example.test']);
+  git(['config', 'user.name', 'SSE Test']);
+  const spawned = spawnServer({ root: ROOT, port: PORT, dataDir, tag: 'sse-v2', extraEnv: { KB_SKIP_MIGRATION: '1' } });
+  try {
+    await waitForServer();
+    await json('PATCH', '/api/settings', { knowledge: { rootPath: path.join(dataDir, 'knowledge') } });
+    await json('PUT', '/api/ai-profiles', { schema: 'ai-profiles/v1', defaultProfileId: 'test', profiles: [{ id: 'test', name: 'Test', enabled: true, implementation: 'claude-code-agent', apiKeyUpdate: { mode: 'replace', value: 'sk-test' } }] });
+    const imported = await json('POST', '/api/projects/import', { localPath: repoPath, aiProfileId: 'test' });
+    assert.strictEqual(imported.status, 201, JSON.stringify(imported.data));
+
+    const stream = openSse();
+    await waitFor(() => stream.frames.some(frame => frame.event === 'claude/snapshot'));
+    const snapshot = stream.frames.find(frame => frame.event === 'claude/snapshot');
+    assert(Array.isArray(snapshot.data.sessions));
+
+    const started = await json('POST', '/api/claude/sessions', { projectId: imported.data.projectId });
+    assert.strictEqual(started.status, 201, JSON.stringify(started.data));
+    await waitFor(() => stream.frames.some(frame => frame.event === 'claude/sessions-changed' && frame.data.kind === 'create'));
+    const created = stream.frames.find(frame => frame.event === 'claude/sessions-changed' && frame.data.kind === 'create');
+    assert.strictEqual(created.data.projectSlug, imported.data.projectId);
+    const sessions = await json('GET', `/api/claude/sessions?projectId=${encodeURIComponent(imported.data.projectId)}`);
+    assert(sessions.data.sessions.some(session => session.sessionId === started.data.sessionId));
+    stream.close();
+    console.log('sessions-stream-test PASS');
+  } finally {
+    await spawned.cleanup();
+    fs.rmSync(repoPath, { recursive: true, force: true });
+  }
+})().catch(error => { console.error(error); process.exitCode = 1; });

package/_site/_test/shared-contracts-test.js

@@ -1,58 +1,58 @@
-const assert = require('assert');
-const contracts = require('../lib/contracts');
-
-assert.deepStrictEqual(contracts.TRIGGERS, ['git-hook']);
-assert.deepStrictEqual(contracts.LOG_LEVELS, ['trace', 'debug', 'info', 'warn', 'error', 'fatal']);
-assert.strictEqual(contracts.SCHEMAS.projectState, 'project-state/v2');
-assert.strictEqual(contracts.SCHEMA_VERSIONS.layoutMigration, 'layout-v2');
-
-for (const trigger of contracts.TRIGGERS) assert.strictEqual(contracts.validateTrigger(trigger), trigger);
-assert.throws(() => contracts.validateTrigger('simulate'), error => error.code === 'INVALID_TRIGGER');
-assert.throws(() => contracts.validateTrigger('project-init'), error => error.code === 'INVALID_TRIGGER');
-assert.throws(() => contracts.validateTrigger('startup'), error => error.code === 'INVALID_TRIGGER');
-
-const publicProfile = contracts.publicAiProfileView({
-  id: 'primary',
-  name: 'Primary',
-  apiKey: 'sk-super-secret-1234',
-  authToken: 'second-secret',
-  baseUrl: 'https://example.invalid',
-});
-assert.strictEqual(publicProfile.id, 'primary');
-assert.strictEqual(publicProfile.baseUrl, 'https://example.invalid');
-assert.strictEqual(publicProfile.hasApiKey, true);
-assert.strictEqual(publicProfile.apiKeyMasked, '****1234');
-assert.strictEqual(Object.prototype.hasOwnProperty.call(publicProfile, 'apiKey'), false);
-assert.strictEqual(Object.prototype.hasOwnProperty.call(publicProfile, 'authToken'), false);
-
-const domainError = new contracts.DomainError('HOOK_CONFLICT', 'A non-managed hook exists.', {
-  status: 409,
-  operationId: 'op-test',
-  details: {
-    apiKey: 'must-not-leak',
-    stack: 'must-not-leak',
-    nested: { authorization: 'Bearer must-not-leak', safe: 'kept' },
-  },
-});
-const envelope = contracts.serializeErrorEnvelope(domainError);
-const serialized = JSON.stringify(envelope);
-assert.strictEqual(envelope.ok, false);
-assert.strictEqual(envelope.error.code, 'HOOK_CONFLICT');
-assert.strictEqual(envelope.error.operationId, 'op-test');
-assert(!serialized.includes('must-not-leak'));
-assert(!serialized.includes('stack'));
-assert(serialized.includes('kept'));
-
-assert.strictEqual(contracts.validateStateTransition('idle', 'scanning'), true);
-assert.strictEqual(contracts.validateStateTransition('markdown.promoted', 'state.advanced'), true);
-assert.throws(() => contracts.validateStateTransition('idle', 'markdown.promoted'));
-
-assert.strictEqual(contracts.assertMutableProjectPatch({ displayName: 'New', enabled: false }), true);
-assert.throws(() => contracts.assertMutableProjectPatch({ projectId: 'new' }), error => error.code === 'IMMUTABLE_FIELD');
-assert.throws(() => contracts.assertMutableProjectPatch({ knowledgePath: 'D:/new' }), error => error.code === 'IMMUTABLE_FIELD');
-assert.strictEqual(contracts.assertMutableProjectPatch({ knowledgePath: 'D:/new' }, { allowKnowledgePath: true }), true);
-assert.throws(() => contracts.assertMutableProjectPatch({ repoPath: 'D:/moved' }), error => error.code === 'INVALID_ARGUMENT');
-assert.strictEqual(contracts.assertMutableProjectPatch({ repoPath: 'D:/moved' }, { allowRepoPath: true }), true);
-assert.throws(() => contracts.assertMutableProjectPatch({ teamBinding: {} }), error => error.code === 'INVALID_ARGUMENT');
-
-console.log('shared-contracts-test PASS');
+const assert = require('assert');
+const contracts = require('../lib/contracts');
+
+assert.deepStrictEqual(contracts.TRIGGERS, ['git-hook']);
+assert.deepStrictEqual(contracts.LOG_LEVELS, ['trace', 'debug', 'info', 'warn', 'error', 'fatal']);
+assert.strictEqual(contracts.SCHEMAS.projectState, 'project-state/v2');
+assert.strictEqual(contracts.SCHEMA_VERSIONS.layoutMigration, 'layout-v2');
+
+for (const trigger of contracts.TRIGGERS) assert.strictEqual(contracts.validateTrigger(trigger), trigger);
+assert.throws(() => contracts.validateTrigger('simulate'), error => error.code === 'INVALID_TRIGGER');
+assert.throws(() => contracts.validateTrigger('project-init'), error => error.code === 'INVALID_TRIGGER');
+assert.throws(() => contracts.validateTrigger('startup'), error => error.code === 'INVALID_TRIGGER');
+
+const publicProfile = contracts.publicAiProfileView({
+  id: 'primary',
+  name: 'Primary',
+  apiKey: 'sk-super-secret-1234',
+  authToken: 'second-secret',
+  baseUrl: 'https://example.invalid',
+});
+assert.strictEqual(publicProfile.id, 'primary');
+assert.strictEqual(publicProfile.baseUrl, 'https://example.invalid');
+assert.strictEqual(publicProfile.hasApiKey, true);
+assert.strictEqual(publicProfile.apiKeyMasked, '****1234');
+assert.strictEqual(Object.prototype.hasOwnProperty.call(publicProfile, 'apiKey'), false);
+assert.strictEqual(Object.prototype.hasOwnProperty.call(publicProfile, 'authToken'), false);
+
+const domainError = new contracts.DomainError('HOOK_CONFLICT', 'A non-managed hook exists.', {
+  status: 409,
+  operationId: 'op-test',
+  details: {
+    apiKey: 'must-not-leak',
+    stack: 'must-not-leak',
+    nested: { authorization: 'Bearer must-not-leak', safe: 'kept' },
+  },
+});
+const envelope = contracts.serializeErrorEnvelope(domainError);
+const serialized = JSON.stringify(envelope);
+assert.strictEqual(envelope.ok, false);
+assert.strictEqual(envelope.error.code, 'HOOK_CONFLICT');
+assert.strictEqual(envelope.error.operationId, 'op-test');
+assert(!serialized.includes('must-not-leak'));
+assert(!serialized.includes('stack'));
+assert(serialized.includes('kept'));
+
+assert.strictEqual(contracts.validateStateTransition('idle', 'scanning'), true);
+assert.strictEqual(contracts.validateStateTransition('markdown.promoted', 'state.advanced'), true);
+assert.throws(() => contracts.validateStateTransition('idle', 'markdown.promoted'));
+
+assert.strictEqual(contracts.assertMutableProjectPatch({ displayName: 'New', enabled: false }), true);
+assert.throws(() => contracts.assertMutableProjectPatch({ projectId: 'new' }), error => error.code === 'IMMUTABLE_FIELD');
+assert.throws(() => contracts.assertMutableProjectPatch({ knowledgePath: 'D:/new' }), error => error.code === 'IMMUTABLE_FIELD');
+assert.strictEqual(contracts.assertMutableProjectPatch({ knowledgePath: 'D:/new' }, { allowKnowledgePath: true }), true);
+assert.throws(() => contracts.assertMutableProjectPatch({ repoPath: 'D:/moved' }), error => error.code === 'INVALID_ARGUMENT');
+assert.strictEqual(contracts.assertMutableProjectPatch({ repoPath: 'D:/moved' }, { allowRepoPath: true }), true);
+assert.throws(() => contracts.assertMutableProjectPatch({ teamBinding: {} }), error => error.code === 'INVALID_ARGUMENT');
+
+console.log('shared-contracts-test PASS');