@open-mercato/shared 0.6.8-develop.7015.1.af90a2ddc7 → 0.6.8-develop.7019.1.f4c01c4b5c

package/src/lib/auth/__tests__/server.apiKeyCache.test.ts

@@ -94,6 +94,244 @@ describe('resolveApiKeyAuth caching + lastUsedAt debounce', () => {
     expect(emFlush).toHaveBeenCalledTimes(1)
   })
 
+  it('retains the creator identity for a regular tenant-scoped key', async () => {
+    const { getAuthFromRequest } = await import('@open-mercato/shared/lib/auth/server')
+    findApiKeyBySecret.mockResolvedValue({
+      id: 'key-tenant-scoped',
+      name: 'tenant scoped',
+      tenantId: 'tenant-1',
+      organizationId: null,
+      rolesJson: [],
+      sessionToken: null,
+      sessionUserId: null,
+      sessionSecretEncrypted: null,
+      opencodeSessionId: null,
+      createdBy: 'creator-1',
+      expiresAt: null,
+      lastUsedAt: null,
+    })
+    emFindOne.mockImplementation(async (_entity: unknown, where: Record<string, unknown>) => {
+      if (where.id === 'tenant-1' && where.isActive === true) return { id: 'tenant-1' }
+      if (where.id === 'creator-1') {
+        return { id: 'creator-1', tenantId: 'tenant-1', organizationId: 'creator-org' }
+      }
+      return null
+    })
+
+    const auth = await getAuthFromRequest(buildRequest('tenant-scoped-secret'))
+
+    expect(auth).toMatchObject({
+      sub: 'api_key:key-tenant-scoped',
+      tenantId: 'tenant-1',
+      orgId: null,
+      isApiKey: true,
+      keyId: 'key-tenant-scoped',
+      userId: 'creator-1',
+    })
+    // The creator remains the key's legacy identity, but its concrete
+    // organization does not narrow a tenant-scoped key.
+    expect(emFindOne).toHaveBeenCalledWith(
+      expect.anything(),
+      { id: 'creator-1', deletedAt: null },
+    )
+  })
+
+  it('rejects a tenant-scoped regular key once its creator is soft-deleted', async () => {
+    const { getAuthFromRequest } = await import('@open-mercato/shared/lib/auth/server')
+    findApiKeyBySecret.mockResolvedValue({
+      id: 'key-deleted-creator',
+      name: 'deleted creator',
+      tenantId: 'tenant-1',
+      organizationId: null,
+      rolesJson: [],
+      sessionToken: null,
+      sessionUserId: null,
+      sessionSecretEncrypted: null,
+      opencodeSessionId: null,
+      createdBy: 'creator-1',
+      expiresAt: null,
+      lastUsedAt: null,
+    })
+    emFindOne.mockImplementation(async (_entity: unknown, where: Record<string, unknown>) => {
+      if (where.id === 'tenant-1' && where.isActive === true) return { id: 'tenant-1' }
+      return null
+    })
+
+    await expect(
+      getAuthFromRequest(buildRequest('deleted-creator-secret')),
+    ).resolves.toBeNull()
+  })
+
+  it('rejects a tenant-scoped regular key whose creator moved to another tenant', async () => {
+    const { getAuthFromRequest } = await import('@open-mercato/shared/lib/auth/server')
+    findApiKeyBySecret.mockResolvedValue({
+      id: 'key-foreign-creator',
+      name: 'foreign creator',
+      tenantId: 'tenant-1',
+      organizationId: null,
+      rolesJson: [],
+      sessionToken: null,
+      sessionUserId: null,
+      sessionSecretEncrypted: null,
+      opencodeSessionId: null,
+      createdBy: 'creator-1',
+      expiresAt: null,
+      lastUsedAt: null,
+    })
+    emFindOne.mockImplementation(async (_entity: unknown, where: Record<string, unknown>) => {
+      if (where.id === 'tenant-1' && where.isActive === true) return { id: 'tenant-1' }
+      if (where.id === 'creator-1') {
+        return { id: 'creator-1', tenantId: 'tenant-2', organizationId: null }
+      }
+      return null
+    })
+
+    await expect(
+      getAuthFromRequest(buildRequest('foreign-creator-secret')),
+    ).resolves.toBeNull()
+  })
+
+  it('accepts a tenant-scoped regular key that records no creator', async () => {
+    const { getAuthFromRequest } = await import('@open-mercato/shared/lib/auth/server')
+    findApiKeyBySecret.mockResolvedValue({
+      id: 'key-no-creator',
+      name: 'no creator',
+      tenantId: 'tenant-1',
+      organizationId: null,
+      rolesJson: [],
+      sessionToken: null,
+      sessionUserId: null,
+      sessionSecretEncrypted: null,
+      opencodeSessionId: null,
+      createdBy: null,
+      expiresAt: null,
+      lastUsedAt: null,
+    })
+    emFindOne.mockImplementation(async (_entity: unknown, where: Record<string, unknown>) => {
+      if (where.id === 'tenant-1' && where.isActive === true) return { id: 'tenant-1' }
+      return null
+    })
+
+    await expect(
+      getAuthFromRequest(buildRequest('no-creator-secret')),
+    ).resolves.toMatchObject({ keyId: 'key-no-creator', tenantId: 'tenant-1' })
+  })
+
+  it('retains the creator identity for an organization-scoped regular key', async () => {
+    const { getAuthFromRequest } = await import('@open-mercato/shared/lib/auth/server')
+    findApiKeyBySecret.mockResolvedValue({
+      id: 'key-organization-scoped',
+      name: 'organization scoped',
+      tenantId: 'tenant-1',
+      organizationId: 'org-1',
+      rolesJson: [],
+      sessionToken: null,
+      sessionUserId: null,
+      sessionSecretEncrypted: null,
+      opencodeSessionId: null,
+      createdBy: 'creator-1',
+      expiresAt: null,
+      lastUsedAt: null,
+    })
+    emFindOne.mockImplementation(async (_entity: unknown, where: Record<string, unknown>) => {
+      if (where.id === 'creator-1') {
+        return { id: 'creator-1', tenantId: 'tenant-1', organizationId: 'org-1' }
+      }
+      return null
+    })
+
+    await expect(
+      getAuthFromRequest(buildRequest('organization-scoped-secret')),
+    ).resolves.toMatchObject({
+      sub: 'api_key:key-organization-scoped',
+      tenantId: 'tenant-1',
+      orgId: 'org-1',
+      userId: 'creator-1',
+    })
+  })
+
+  it('rejects an organization-scoped regular key when its creator scope no longer matches', async () => {
+    const { getAuthFromRequest } = await import('@open-mercato/shared/lib/auth/server')
+    findApiKeyBySecret.mockResolvedValue({
+      id: 'key-organization-mismatch',
+      name: 'organization mismatch',
+      tenantId: 'tenant-1',
+      organizationId: 'org-1',
+      rolesJson: [],
+      sessionToken: null,
+      sessionUserId: null,
+      sessionSecretEncrypted: null,
+      opencodeSessionId: null,
+      createdBy: 'creator-1',
+      expiresAt: null,
+      lastUsedAt: null,
+    })
+    emFindOne.mockImplementation(async (_entity: unknown, where: Record<string, unknown>) => {
+      if (where.id === 'creator-1') {
+        return { id: 'creator-1', tenantId: 'tenant-1', organizationId: 'org-2' }
+      }
+      return null
+    })
+
+    await expect(
+      getAuthFromRequest(buildRequest('organization-scope-mismatch-secret')),
+    ).resolves.toBeNull()
+  })
+
+  it('keeps session keys strictly bound to their persisted user and scope', async () => {
+    const { getAuthFromRequest } = await import('@open-mercato/shared/lib/auth/server')
+    findApiKeyBySecret.mockResolvedValue({
+      id: 'key-session-scoped',
+      name: 'session scoped',
+      tenantId: 'tenant-1',
+      organizationId: null,
+      rolesJson: [],
+      sessionToken: 'sess_123',
+      sessionUserId: 'session-user-1',
+      sessionSecretEncrypted: null,
+      opencodeSessionId: null,
+      createdBy: 'session-user-1',
+      expiresAt: null,
+      lastUsedAt: null,
+    })
+    emFindOne.mockImplementation(async (_entity: unknown, where: Record<string, unknown>) => {
+      if (where.id === 'session-user-1') {
+        return { id: 'session-user-1', tenantId: 'tenant-1', organizationId: 'user-org' }
+      }
+      return null
+    })
+
+    await expect(
+      getAuthFromRequest(buildRequest('session-scope-mismatch-secret')),
+    ).resolves.toBeNull()
+  })
+
+  it('fails closed when a row has session markers but no bound session user', async () => {
+    const { getAuthFromRequest } = await import('@open-mercato/shared/lib/auth/server')
+    findApiKeyBySecret.mockResolvedValue({
+      id: 'key-malformed-session',
+      name: 'malformed session',
+      tenantId: 'tenant-1',
+      organizationId: null,
+      rolesJson: [],
+      sessionToken: 'sess_missing_user',
+      sessionUserId: null,
+      sessionSecretEncrypted: null,
+      opencodeSessionId: null,
+      createdBy: 'creator-1',
+      expiresAt: null,
+      lastUsedAt: null,
+    })
+
+    await expect(
+      getAuthFromRequest(buildRequest('malformed-session-secret')),
+    ).resolves.toBeNull()
+    expect(emFindOne).not.toHaveBeenCalledWith(
+      expect.anything(),
+      expect.objectContaining({ id: 'creator-1' }),
+    )
+  })
+
   it('caches negative lookups so invalid keys skip the bcrypt+DB path', async () => {
     const { getAuthFromRequest } = await import('@open-mercato/shared/lib/auth/server')
     findApiKeyBySecret.mockResolvedValue(null)
@@ -128,4 +366,90 @@ describe('resolveApiKeyAuth caching + lastUsedAt debounce', () => {
     await getAuthFromRequest(buildRequest('secret-invalidate'))
     expect(findApiKeyBySecret).toHaveBeenCalledTimes(2)
   })
+
+  describe('super-admin bit stays bounded by the effective key scope', () => {
+    async function resolveWithSuperAdminRole(input: {
+      secret: string
+      keyId: string
+      keyOrganizationId: string | null
+      aclOrganizations: string[] | null
+    }) {
+      const { RoleAcl } = await import('@open-mercato/core/modules/auth/data/entities')
+      const { Organization, Tenant } = await import('@open-mercato/core/modules/directory/data/entities')
+      const { getAuthFromRequest } = await import('@open-mercato/shared/lib/auth/server')
+      // A creator-less key is validated against a live tenant (and organization when bound).
+      emFindOne.mockImplementation(async (entity: unknown) => {
+        if (entity === Tenant) return { id: 'tenant-1' }
+        if (entity === Organization) return { id: input.keyOrganizationId, tenant: { id: 'tenant-1' } }
+        return null
+      })
+      findApiKeyBySecret.mockResolvedValue({
+        id: input.keyId,
+        name: 'super admin key',
+        tenantId: 'tenant-1',
+        organizationId: input.keyOrganizationId,
+        rolesJson: ['role-super'],
+        sessionToken: null,
+        sessionUserId: null,
+        sessionSecretEncrypted: null,
+        opencodeSessionId: null,
+        createdBy: null,
+        expiresAt: null,
+        lastUsedAt: null,
+      })
+      emFind.mockImplementation(async (entity: unknown) => {
+        if (entity === RoleAcl) {
+          return [{ isSuperAdmin: true, organizationsJson: input.aclOrganizations }]
+        }
+        return []
+      })
+      return getAuthFromRequest(buildRequest(input.secret))
+    }
+
+    it('withholds it from an organization-bound key even when a role grants it', async () => {
+      // Generic guards trust this bit before live RBAC, so an organization-restricted key must
+      // never take super-admin shortcuts outside its own scope.
+      const auth = await resolveWithSuperAdminRole({
+        secret: 'super-bound',
+        keyId: 'key-super-bound',
+        keyOrganizationId: 'org-1',
+        aclOrganizations: null,
+      })
+
+      expect(auth).toMatchObject({ isApiKey: true, isSuperAdmin: false })
+    })
+
+    it('withholds it when the granting role ACL is itself organization-restricted', async () => {
+      const auth = await resolveWithSuperAdminRole({
+        secret: 'super-restricted',
+        keyId: 'key-super-restricted',
+        keyOrganizationId: null,
+        aclOrganizations: ['org-1'],
+      })
+
+      expect(auth).toMatchObject({ isApiKey: true, isSuperAdmin: false })
+    })
+
+    it('grants it for an unbound key with an unrestricted role grant', async () => {
+      const auth = await resolveWithSuperAdminRole({
+        secret: 'super-global',
+        keyId: 'key-super-global',
+        keyOrganizationId: null,
+        aclOrganizations: null,
+      })
+
+      expect(auth).toMatchObject({ isApiKey: true, isSuperAdmin: true })
+    })
+
+    it('grants it for an unbound key whose role ACL uses the __all__ sentinel', async () => {
+      const auth = await resolveWithSuperAdminRole({
+        secret: 'super-all-sentinel',
+        keyId: 'key-super-all-sentinel',
+        keyOrganizationId: null,
+        aclOrganizations: ['__all__'],
+      })
+
+      expect(auth).toMatchObject({ isApiKey: true, isSuperAdmin: true })
+    })
+  })
 })

package/src/lib/auth/principal-service.ts

@@ -0,0 +1,110 @@
+import type { AuthContext } from './server'
+
+export type PrincipalScope = {
+  tenantId: string
+  organizationId: string
+}
+
+export type AuthPrincipalType = 'user' | 'role'
+
+export type AuthPrincipalLabel = {
+  id: string
+  label: string
+  secondary: string | null
+}
+
+export type AuthPrincipalRolePage = {
+  items: AuthPrincipalLabel[]
+  page: number
+  pageSize: number
+  total: number
+}
+
+/** Public, request-scoped read boundary owned by the Auth module. */
+export interface AuthPrincipalService {
+  principalExists(input: {
+    type: AuthPrincipalType
+    id: string
+    scope: PrincipalScope
+  }): Promise<boolean>
+  resolveActiveUserRoleIds(userId: string, scope: PrincipalScope): Promise<string[]>
+  filterActiveRoleIds(roleIds: string[], scope: PrincipalScope): Promise<string[]>
+  resolveLabels(input: {
+    type: AuthPrincipalType
+    ids: string[]
+    scope: PrincipalScope
+  }): Promise<AuthPrincipalLabel[]>
+  /**
+   * Optional additive capability for organization-eligible role pickers.
+   * Implementations must apply eligibility before pagination and bound the
+   * advertised result window so sparse ACL matches cannot amplify requests.
+   */
+  queryActiveRolePage?(input: {
+    scope: PrincipalScope
+    search?: string
+    excludedIds?: string[]
+    page: number
+    pageSize: number
+  }): Promise<AuthPrincipalRolePage>
+  listSuperAdminUserIds(tenantId: string): Promise<string[]>
+}
+
+/** Public, request-scoped read boundary owned by the API Keys module. */
+export interface ApiKeyPrincipalService {
+  resolveAssignedRoleIds(apiKeyId: string, scope: PrincipalScope): Promise<string[]>
+}
+
+export type OrganizationScope = {
+  selectedId: string | null
+  filterIds: string[] | null
+  allowedIds: string[] | null
+  tenantId: string | null
+  // True when an explicit organization selection could not be honored. Reads
+  // fall back to the caller's accessible organizations; writes must fail.
+  selectionRejected?: boolean
+}
+
+export type OrganizationScopeAcl = {
+  isSuperAdmin: boolean
+  features: string[]
+  organizations: string[] | null
+}
+
+export type OrganizationScopeRequest = Request | {
+  cookies?: { get: (name: string) => { value: string } | undefined }
+  headers?: { get(name: string): string | null }
+}
+
+/**
+ * Narrow, request-scoped hierarchy boundary owned by Directory.
+ *
+ * `null` means the selected organization does not exist in the requested
+ * tenant. An empty array means it exists but has no ancestors.
+ */
+export interface OrganizationHierarchyService {
+  resolveAncestorIds(input: {
+    tenantId: string
+    organizationId: string
+  }): Promise<string[] | null>
+}
+
+/** Public, request-scoped organization expansion boundary owned by Directory. */
+export interface OrganizationScopeService {
+  resolve(input: {
+    auth: AuthContext | null | undefined
+    selectedId?: string | null
+    tenantId?: string | null
+    freshAcl?: boolean
+  }): Promise<OrganizationScope>
+  resolveFresh(input: {
+    auth: NonNullable<AuthContext>
+    selectedId?: string | null
+    tenantId?: string | null
+  }): Promise<{ scope: OrganizationScope; acl: OrganizationScopeAcl }>
+  resolveForRequest(input: {
+    auth: AuthContext | null | undefined
+    request?: OrganizationScopeRequest
+    selectedId?: string | null
+    tenantId?: string | null
+  }): Promise<OrganizationScope>
+}

package/src/lib/auth/server.ts

@@ -195,13 +195,33 @@ async function resolveApiKeyAuth(secret: string): Promise<AuthContext> {
       : []
     const roleNames = roles.map((role) => role.name).filter((name): name is string => typeof name === 'string' && name.length > 0)
 
+    // A role-level super-admin grant is authorization-grade only when it is genuinely
+    // unrestricted: the grant itself must not be organization-scoped, it must belong to the
+    // key's tenant, and the key must not be bound to a single organization. RbacService applies
+    // the same intersection when projecting the scoped ACL, but generic guards
+    // (tenantAccess.resolveIsSuperAdmin, the scoped-API helpers) trust this raw bit *before*
+    // live RBAC runs — so an organization-restricted key must never carry it.
     let keyIsSuperAdmin = false
-    if (roleIds.length) {
-      const superAcl = await em.findOne(
+    const keyOrganizationId = typeof record.organizationId === 'string' && record.organizationId.trim().length > 0
+      ? record.organizationId.trim()
+      : null
+    if (roleIds.length && !keyOrganizationId) {
+      const superAcls = await em.find(
         RoleAcl,
-        { role: { $in: roleIds } as any, isSuperAdmin: true, deletedAt: null } as any,
+        {
+          role: { $in: roleIds } as any,
+          tenantId: record.tenantId ?? null,
+          isSuperAdmin: true,
+          deletedAt: null,
+        } as any,
       )
-      keyIsSuperAdmin = !!(superAcl && (superAcl as { isSuperAdmin?: boolean }).isSuperAdmin)
+      keyIsSuperAdmin = superAcls.some((acl) => {
+        const organizations = Array.isArray((acl as { organizationsJson?: string[] | null }).organizationsJson)
+          ? (acl as { organizationsJson?: string[] | null }).organizationsJson as string[]
+          : null
+        // An empty list means "inherit the key's own binding"; with no binding that is tenant-wide.
+        return !organizations || organizations.length === 0 || organizations.includes('__all__')
+      })
     }
 
     if (cache.shouldWriteLastUsed(record.id)) {
@@ -213,8 +233,25 @@ async function resolveApiKeyAuth(secret: string): Promise<AuthContext> {
       }
     }
 
-    // For session keys, use sessionUserId; for regular keys, use createdBy
-    const actualUserId = record.sessionUserId ?? record.createdBy ?? null
+    // Ephemeral session keys are always user-bound. Regular keys retain their
+    // legacy creator identity, while tenant-scoped regular keys ignore only the
+    // creator's concrete organization when validating the wider key scope.
+    // Keep every session marker fail-closed so a malformed session key cannot
+    // fall back to the regular key path and escape its user/scope binding.
+    const isSessionBoundKey = Boolean(
+      record.sessionToken
+      || record.sessionUserId
+      || record.sessionSecretEncrypted
+      || record.opencodeSessionId
+    )
+    const actualUserId = isSessionBoundKey
+      ? record.sessionUserId ?? null
+      : record.createdBy ?? null
+
+    if (isSessionBoundKey && !actualUserId) {
+      cache.setMiss(secret)
+      return null
+    }
 
     if (actualUserId) {
       const user = await em.findOne(User, { id: actualUserId, deletedAt: null })
@@ -226,7 +263,8 @@ async function resolveApiKeyAuth(secret: string): Promise<AuthContext> {
         cache.setMiss(secret)
         return null
       }
-      if ((user.organizationId ?? null) !== (record.organizationId ?? null)) {
+      const requiresExactOrganization = isSessionBoundKey || Boolean(record.organizationId)
+      if (requiresExactOrganization && (user.organizationId ?? null) !== (record.organizationId ?? null)) {
         cache.setMiss(secret)
         return null
       }

package/src/lib/data/__tests__/engine.event-validation.test.ts

@@ -68,7 +68,15 @@ describe('DataEngine event contract validation (issue #1421)', () => {
       })
 
       expect(emitted).toEqual([
-        expect.objectContaining({ name: 'issue1421_test.widget.created' }),
+        expect.objectContaining({
+          name: 'issue1421_test.widget.created',
+          options: {
+            persistent: false,
+            tenantId: 'tenant-1',
+            organizationId: 'org-1',
+            emitterModuleId: 'issue1421_test',
+          },
+        }),
       ])
       expect(loggerWarn).not.toHaveBeenCalled()
     } finally {

package/src/lib/data/engine.ts

@@ -226,7 +226,12 @@ export class DefaultDataEngine implements DataEngine {
           const eventName = `${mod}.${ent}.updated`
           warnIfUndeclaredEvent(eventName, 'setCustomFields')
           try {
-            await bus.emitEvent(eventName, { id: recordId, organizationId, tenantId }, { persistent: true })
+            await bus.emitEvent(eventName, { id: recordId, organizationId, tenantId }, {
+              persistent: true,
+              tenantId,
+              organizationId,
+              emitterModuleId: mod,
+            })
           } catch {
             // non-blocking
           }
@@ -627,6 +632,7 @@ export class DefaultDataEngine implements DataEngine {
           persistent: !!events.persistent,
           tenantId: ctx.identifiers.tenantId ?? null,
           organizationId: ctx.identifiers.organizationId ?? null,
+          emitterModuleId: events.module,
         })
       } catch {
         // non-blocking

package/src/modules/events/__tests__/factory.test.ts

@@ -0,0 +1,88 @@
+const GLOBAL_EVENT_REGISTRY_KEY = '__openMercatoEventDefinitionRegistry__'
+
+type EventFactoryModule = typeof import('../factory')
+
+describe('event definition registry', () => {
+  const globalScope = globalThis as Record<string, unknown>
+  const originalRegistry = globalScope[GLOBAL_EVENT_REGISTRY_KEY]
+
+  beforeEach(() => {
+    delete globalScope[GLOBAL_EVENT_REGISTRY_KEY]
+  })
+
+  afterAll(() => {
+    if (originalRegistry === undefined) {
+      delete globalScope[GLOBAL_EVENT_REGISTRY_KEY]
+    } else {
+      globalScope[GLOBAL_EVENT_REGISTRY_KEY] = originalRegistry
+    }
+  })
+
+  it('shares declarations and registered configs across isolated module instances', () => {
+    let firstInstance: EventFactoryModule | undefined
+    let secondInstance: EventFactoryModule | undefined
+
+    jest.isolateModules(() => {
+      firstInstance = require('../factory') as EventFactoryModule
+      const config = firstInstance.createModuleEvents({
+        moduleId: 'isolated_events_test',
+        events: [{
+          id: 'isolated_events_test.invalidated',
+          label: 'Invalidated',
+          crossProcessBroadcast: true,
+        }] as const,
+      })
+      firstInstance.registerEventModuleConfigs([config])
+    })
+
+    jest.isolateModules(() => {
+      secondInstance = require('../factory') as EventFactoryModule
+    })
+
+    expect(secondInstance).not.toBe(firstInstance)
+    expect(secondInstance?.isEventDeclared('isolated_events_test.invalidated')).toBe(true)
+    expect(secondInstance?.isCrossProcessBroadcastEvent('isolated_events_test.invalidated')).toBe(true)
+    expect(secondInstance?.getDeclaredEvents()).toEqual(expect.arrayContaining([
+      expect.objectContaining({
+        id: 'isolated_events_test.invalidated',
+        module: 'isolated_events_test',
+      }),
+    ]))
+    expect(secondInstance?.getEventModuleConfigs()).toHaveLength(1)
+  })
+
+  it('refreshes a module definition during HMR without duplicating its event id', () => {
+    let firstInstance: EventFactoryModule | undefined
+    let secondInstance: EventFactoryModule | undefined
+
+    jest.isolateModules(() => {
+      firstInstance = require('../factory') as EventFactoryModule
+      firstInstance.createModuleEvents({
+        moduleId: 'hmr_events_test',
+        events: [{ id: 'hmr_events_test.changed', label: 'Before' }] as const,
+      })
+    })
+
+    jest.isolateModules(() => {
+      secondInstance = require('../factory') as EventFactoryModule
+      secondInstance.createModuleEvents({
+        moduleId: 'hmr_events_test',
+        events: [{
+          id: 'hmr_events_test.changed',
+          label: 'After',
+          clientBroadcast: true,
+        }] as const,
+      })
+    })
+
+    expect(firstInstance?.isBroadcastEvent('hmr_events_test.changed')).toBe(true)
+    expect(firstInstance?.getAllDeclaredEventIds()).toEqual(['hmr_events_test.changed'])
+    expect(firstInstance?.getDeclaredEvents()).toEqual([
+      expect.objectContaining({
+        id: 'hmr_events_test.changed',
+        label: 'After',
+        clientBroadcast: true,
+      }),
+    ])
+  })
+})