@bevel-software/platform-core-backend 0.13.6 → 0.15.1

package/src/modules/connection-probe/index.ts

@@ -0,0 +1,2 @@
+export * from './connection-probe.contract.js';
+export { ConnectionProbeService } from './connection-probe.service.js';

package/src/modules/database/core-schema.ts

@@ -183,6 +183,12 @@ export const externalApiKeys = pgTable('api_tokens', {
   userId: uuid('user_id').notNull().references(() => users.id),
   tokenHash: text('token_hash').notNull().unique(),
   label: text('label').notNull(),
+  /**
+   * What the key was minted as: `key` by hand, or a flow's own kind (a
+   * Claude link). The one fact that tells such keys apart — the label is
+   * free text the person may edit or imitate.
+   */
+  kind: text('kind').default('key').notNull(),
   createdAt: timestamp('created_at').defaultNow().notNull(),
   lastUsedAt: timestamp('last_used_at'),
   revokedAt: timestamp('revoked_at'),
@@ -490,3 +496,51 @@ export const deploymentSettings = pgTable('deployment_settings', {
   updatedBy: uuid('updated_by').references(() => users.id, { onDelete: 'set null' }),
   updatedAt: timestamp('updated_at').defaultNow().notNull(),
 });
+
+/**
+ * What this deployment presents to claude.ai as a "GitHub Enterprise Server"
+ * so that Cowork and claude.ai can add the per-user marketplace: the app id,
+ * client id and secrets an Owner pastes into Claude's admin settings. ONE row,
+ * generated on first use, replaced whole on rotate. Secrets are sealed with
+ * the secrets key, as stored settings are — see
+ * `marketplace/github-facade/github-facade-credentials.service.ts`.
+ */
+export const githubFacadeIdentity = pgTable('github_facade_identity', {
+  id: text('id').primaryKey(),
+  appId: text('app_id').notNull(),
+  clientId: text('client_id').notNull(),
+  /** Sealed. */
+  clientSecret: text('client_secret').notNull(),
+  /** Sealed. */
+  webhookSecret: text('webhook_secret').notNull(),
+  /** Sealed — PKCS#1 PEM. */
+  privateKeyPem: text('private_key_pem').notNull(),
+  publicKeyPem: text('public_key_pem').notNull(),
+  createdAt: timestamp('created_at').defaultNow().notNull(),
+  rotatedAt: timestamp('rotated_at'),
+});
+
+/**
+ * One-time codes the Claude connect flow issues on the consent page and
+ * Anthropic's backend exchanges seconds later — in the database so the
+ * replica that issued a code and the replica asked to exchange it agree.
+ *
+ * Keyed by the PERSON: "one live code per person" is the table's own rule,
+ * not a cleanup's. Issuing upserts their row — the newest code overwrites
+ * the last in one statement — so the table holds at most one row per user,
+ * for as long as the user exists (the row goes with them), and nothing ever
+ * has to sweep it. The client id is data the exchange checks, not part of
+ * the key: the bridge has one client, and a rotated client id must not leave
+ * a dead row behind under the old one. The code's hash is the unique lookup
+ * an exchange uses, spent by a conditional update. See
+ * `marketplace/github-facade/github-facade-codes.store.ts`.
+ */
+export const githubFacadeCodes = pgTable('github_facade_codes', {
+  userId: uuid('user_id').primaryKey().references(() => users.id, { onDelete: 'cascade' }),
+  clientId: text('client_id').notNull(),
+  codeHash: text('code_hash').notNull().unique(),
+  redirectUri: text('redirect_uri').notNull(),
+  expiresAt: timestamp('expires_at').notNull(),
+  consumedAt: timestamp('consumed_at'),
+  createdAt: timestamp('created_at').defaultNow().notNull(),
+});

package/src/modules/diff/diff.routes.ts

@@ -3,7 +3,7 @@ import type { AuthUser, IWorkflowService } from '@bevel-software/platform-shared
 import type { IDiffService } from './diff.interface.js';
 import type { AuthService } from '../auth/auth.service.js';
 import type { IAccessControl } from '../access/access-control.interface.js';
-import { toKbRelative, resolveReadableMap } from '../access-model/kb-read-filter.js';
+import { canReadWorkspacePath, toKbRelative, resolveReadableMap } from '../access-model/kb-read-filter.js';
 import { WorkflowDomainError, WorkflowValidationError } from '../../shared/domain-errors.js';
 import { LockingFilesystem } from '../kb-fs/locking-filesystem.js';
 import { branchForWorkspaceId } from '../../shared/workspace-id.js';
@@ -138,10 +138,14 @@ export function createDiffRoutes(
   }
 
   /** Read gate for a single change path (mirrors GET /review/file). Returns true to proceed. */
-  async function canReadPath(workspaceId: string, email: string, pathParam: string): Promise<boolean> {
-    const rel = toKbRelative(pathParam, kbDirName);
-    // Non-KB paths (toKbRelative → null) carry no read rules and pass.
-    return rel === null || (await accessControl.canRead(workspaceId, email, rel));
+  function canReadPath(workspaceId: string, email: string, pathParam: string): Promise<boolean> {
+    return canReadWorkspacePath(
+      (w, e, p) => accessControl.canRead(w, e, p),
+      workspaceId,
+      email,
+      kbDirName,
+      pathParam,
+    );
   }
 
   router.get('/workspace/:id/review', async (req, res) => {

package/src/modules/kb-fs/__tests__/mutex.test.ts

@@ -8,6 +8,113 @@ function deferred<T = void>() {
 }
 
 describe('WorkspaceMutex', () => {
+  describe('runAll', () => {
+    /**
+     * The property nesting cannot provide: `run(a, () => run(b, fn))` releases
+     * nothing, but between taking `a` and taking `b` the second key is free,
+     * so a single-key task can slip in, run to completion, and be gone before
+     * the pair operation's body starts. `runAll` reserves the set in one
+     * synchronous step, so it cannot be interleaved that way.
+     */
+    it('reserves every key before any of them can be taken by another task', async () => {
+      const mtx = new WorkspaceMutex();
+      const order: string[] = [];
+      const release = deferred();
+
+      // Something already holds 'a', so the pair operation cannot start yet —
+      // this is the window a nested acquisition would leave 'b' open in.
+      const holder = mtx.run('a', async () => {
+        order.push('holder-start');
+        await release.promise;
+        order.push('holder-end');
+      });
+      await new Promise((r) => setImmediate(r));
+
+      const pair = mtx.runAll(['a', 'b'], async () => {
+        order.push('pair');
+      });
+      // Submitted while the pair is still waiting on 'a'. If 'b' were taken
+      // only after 'a' were granted, this would run first.
+      const single = mtx.run('b', async () => {
+        order.push('single-b');
+      });
+
+      release.resolve();
+      await Promise.all([holder, pair, single]);
+      expect(order).toEqual(['holder-start', 'holder-end', 'pair', 'single-b']);
+    });
+
+    it('lets a task on an unrelated key run in parallel', async () => {
+      const mtx = new WorkspaceMutex();
+      const order: string[] = [];
+      const release = deferred();
+
+      const holder = mtx.run('a', async () => {
+        await release.promise;
+        order.push('holder');
+      });
+      await new Promise((r) => setImmediate(r));
+
+      const pair = mtx.runAll(['a', 'b'], async () => void order.push('pair'));
+      const other = mtx.run('c', async () => void order.push('other'));
+
+      await other;
+      expect(order).toEqual(['other']);
+      release.resolve();
+      await Promise.all([holder, pair]);
+      expect(order).toEqual(['other', 'holder', 'pair']);
+    });
+
+    /**
+     * A failing task on ONE key must not release the others. `Promise.all`
+     * settles on the first rejection rather than waiting for the rest, so
+     * combining the predecessors without catching each one first would start
+     * this task while another key was still held.
+     */
+    it('waits for every predecessor even when one of them fails first', async () => {
+      const mtx = new WorkspaceMutex();
+      const order: string[] = [];
+      const failA = deferred();
+      const finishB = deferred();
+
+      const failing = mtx.run('a', async () => {
+        await failA.promise;
+        throw new Error('a-failed');
+      });
+      failing.catch(() => undefined); // handled below; keep the rejection quiet
+      const running = mtx.run('b', async () => {
+        await finishB.promise;
+        order.push('b-end');
+      });
+
+      // Queued while BOTH predecessors are still pending.
+      const pair = mtx.runAll(['a', 'b'], async () => void order.push('pair'));
+
+      failA.resolve();
+      await expect(failing).rejects.toThrow('a-failed');
+      await new Promise((r) => setImmediate(r));
+      // 'a' has failed, but 'b' still holds its key — the pair must wait.
+      expect(order).toEqual([]);
+
+      finishB.resolve();
+      await Promise.all([running, pair]);
+      expect(order).toEqual(['b-end', 'pair']);
+    });
+
+    it('releases every key when the body throws', async () => {
+      const mtx = new WorkspaceMutex();
+      await expect(mtx.runAll(['a', 'b'], async () => { throw new Error('boom'); })).rejects.toThrow('boom');
+      // Both keys must be usable again, or one failure wedges them forever.
+      await expect(mtx.run('a', async () => 'a-ok')).resolves.toBe('a-ok');
+      await expect(mtx.run('b', async () => 'b-ok')).resolves.toBe('b-ok');
+    });
+
+    it('collapses a duplicate key instead of waiting on itself', async () => {
+      const mtx = new WorkspaceMutex();
+      await expect(mtx.runAll(['a', 'a'], async () => 'done')).resolves.toBe('done');
+    });
+  });
+
   it('serializes tasks for the same key in submission order', async () => {
     const mtx = new WorkspaceMutex();
     const order: string[] = [];

package/src/modules/kb-fs/mutex.ts

@@ -8,14 +8,59 @@ export class WorkspaceMutex {
   private readonly tails = new Map<string, Promise<unknown>>();
 
   async run<T>(key: string, fn: () => Promise<T>): Promise<T> {
-    const prev = this.tails.get(key) ?? Promise.resolve();
-    const next = prev.catch(() => undefined).then(fn);
-    this.tails.set(key, next);
+    return this.runAll([key], fn);
+  }
+
+  /**
+   * Reserve SEVERAL keys for one operation, atomically.
+   *
+   * Nesting `run(a, () => run(b, fn))` does NOT do this: between taking `a`
+   * and taking `b` there is a gap in which another operation can take `b`,
+   * finish, and release it — so an operation holding both keys can still be
+   * interleaved with one holding just the second. For branch lifecycle that
+   * gap is the whole bug: a change request being opened `Y -> X` would hold
+   * one branch's key while the other was deleted out from under it.
+   *
+   * This reserves the set in ONE synchronous step. The tails are read and
+   * rewritten without an await between, so no other call can observe a
+   * half-taken set: a concurrent `run` on any of these keys either already
+   * sits in `prev` (it goes first) or chains onto `next` (it goes after).
+   * Within one call nothing is ever held while waiting for something else,
+   * so callers that do not nest need no ordering discipline and cannot
+   * deadlock.
+   *
+   * NESTING is the one way to reintroduce hold-and-wait, so never nest
+   * `run`/`runAll` calls on the same instance. An inner call chains behind
+   * everything already queued on its keys, which can include a `runAll` that
+   * is itself waiting for the outer call to finish: `run(b, () => run(a, …))`
+   * was harmless when every operation took a single key, but against a
+   * concurrent `runAll([a, b])` it deadlocks — outer waits inner, inner
+   * waits the pair, the pair waits outer. No caller nests today; keep it
+   * that way, or hand the full key set to one `runAll` at the top.
+   *
+   * Duplicate keys collapse; the operation waits on each distinct key once.
+   *
+   * Each predecessor is caught INDIVIDUALLY, before the `Promise.all`. A bare
+   * `Promise.all` settles on the first rejection rather than waiting for the
+   * rest, so one key's task failing early would start this one while another
+   * key was still held — a failure on any key would punch a hole in the
+   * mutual exclusion of every key beside it. Catching first makes the
+   * combined promise wait for all of them to settle, however each ends.
+   */
+  async runAll<T>(keys: string[], fn: () => Promise<T>): Promise<T> {
+    const distinct = [...new Set(keys)];
+    const prev = Promise.all(
+      distinct.map((k) => (this.tails.get(k) ?? Promise.resolve()).catch(() => undefined)),
+    );
+    const next = prev.then(fn);
+    for (const k of distinct) this.tails.set(k, next);
     try {
       return await next;
     } finally {
-      if (this.tails.get(key) === next) {
-        this.tails.delete(key);
+      for (const k of distinct) {
+        if (this.tails.get(k) === next) {
+          this.tails.delete(k);
+        }
       }
     }
   }

package/src/modules/kb-sync/__tests__/kb-sync.routes.test.ts

@@ -0,0 +1,297 @@
+import { createHmac } from 'node:crypto';
+import type { Server } from 'node:http';
+import express from 'express';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { createKbSyncRoutes, isSyncRawBodyPath } from '../kb-sync.routes.js';
+import type { IKbSyncService, SyncResult } from '../kb-sync.interface.js';
+
+const SECRET = 'a-very-long-and-random-sync-secret';
+
+const SYNCED: SyncResult = {
+  status: 'synced',
+  results: [{ branch: 'main', outcome: 'updated', from: 'aaa', to: 'bbb' }],
+  changeRequests: { closedDeletedBranch: 0 },
+};
+
+let server: Server | undefined;
+afterEach(() => {
+  server?.close();
+  server = undefined;
+});
+
+async function mount(opts: {
+  secret?: string;
+  result?: SyncResult;
+  admin?: boolean;
+  /** Install the production-shaped global JSON parser in front of the router. */
+  globalJson?: boolean;
+}): Promise<{ base: string; sync: ReturnType<typeof vi.fn> }> {
+  // A suite may mount twice in one test; the earlier server must not outlive it.
+  server?.close();
+  const sync = vi.fn(async () => opts.result ?? SYNCED);
+  const kbSync: IKbSyncService = { sync };
+  const app = express();
+  // Mirrors production: the global JSON parser skips `/api/sync`, so the
+  // router's own raw parser sees the bytes. Installing `express.json()` here
+  // would hide exactly the wiring bug the signature path depends on.
+  if (opts.globalJson) {
+    const json = express.json();
+    app.use((req, res, next) => (isSyncRawBodyPath(req.path) ? next() : json(req, res, next)));
+  }
+  app.use(
+    '/api',
+    createKbSyncRoutes({
+      kbSync,
+      syncSecret: () => opts.secret ?? SECRET,
+      authService: {
+        verifyToken: (token: string) => {
+          if (token !== 'jwt-ok') throw new Error('bad token');
+          return { userId: 'u1', email: 'person@example.com' };
+        },
+      },
+      adminAccess: { isAdmin: async () => opts.admin === true },
+    }),
+  );
+  await new Promise<void>((resolve) => {
+    server = app.listen(0, resolve);
+  });
+  const address = server!.address();
+  if (typeof address === 'string' || !address) throw new Error('no port');
+  return { base: `http://127.0.0.1:${address.port}/api/sync`, sync };
+}
+
+function post(url: string, init: { headers?: Record<string, string>; body?: string } = {}) {
+  return fetch(url, { method: 'POST', headers: init.headers ?? {}, body: init.body });
+}
+
+describe('POST /api/sync — credentials', () => {
+  it('401 with no credential, and advertises the bearer challenge', async () => {
+    const { base, sync } = await mount({});
+    const res = await post(base);
+    expect(res.status).toBe(401);
+    expect(res.headers.get('www-authenticate')).toContain('Bearer');
+    expect(sync).not.toHaveBeenCalled();
+  });
+
+  it('401 with the wrong secret', async () => {
+    const { base, sync } = await mount({});
+    const res = await post(base, { headers: { authorization: 'Bearer wrong' } });
+    expect(res.status).toBe(401);
+    expect(sync).not.toHaveBeenCalled();
+  });
+
+  it('503 when no secret is configured and a hook presents one', async () => {
+    const { base } = await mount({ secret: '' });
+    const res = await post(base, { headers: { authorization: `Bearer ${SECRET}` } });
+    expect(res.status).toBe(503);
+    expect(((await res.json()) as { error: string }).error).toContain('KB_SYNC_SECRET');
+  });
+
+  it("an admin's session works; a non-admin's does not", async () => {
+    const admin = await mount({ admin: true });
+    expect((await post(admin.base, { headers: { authorization: 'Bearer jwt-ok' } })).status).toBe(200);
+    const person = await mount({ admin: false });
+    expect((await post(person.base, { headers: { authorization: 'Bearer jwt-ok' } })).status).toBe(401);
+  });
+
+  it('accepts the GitLab token header', async () => {
+    const { base } = await mount({});
+    const res = await post(base, { headers: { 'x-gitlab-token': SECRET } });
+    expect(res.status).toBe(200);
+  });
+
+  it('accepts a GitHub signature computed over the exact bytes received', async () => {
+    const { base, sync } = await mount({});
+    const body = '{"ref":"refs/heads/main","after":"b"}';
+    const sig = 'sha256=' + createHmac('sha256', SECRET).update(body).digest('hex');
+    const res = await post(base, {
+      headers: { 'x-hub-signature-256': sig, 'content-type': 'application/json' },
+      body,
+    });
+    expect(res.status).toBe(200);
+    expect(sync).toHaveBeenCalledWith(expect.objectContaining({ branches: ['main'] }));
+  });
+});
+
+describe('POST /api/sync — body and result', () => {
+  it('an empty body syncs everything', async () => {
+    const { base, sync } = await mount({});
+    const res = await post(base, { headers: { authorization: `Bearer ${SECRET}` } });
+    expect(res.status).toBe(200);
+    expect(sync).toHaveBeenCalledWith(expect.objectContaining({ branches: 'all' }));
+    expect(await res.json()).toEqual(SYNCED);
+  });
+
+  it('an explicit body names the branches', async () => {
+    const { base, sync } = await mount({});
+    await post(base, {
+      headers: { authorization: `Bearer ${SECRET}`, 'content-type': 'application/json' },
+      body: JSON.stringify({ branches: ['main', 'ali/x'] }),
+    });
+    expect(sync).toHaveBeenCalledWith(expect.objectContaining({ branches: ['main', 'ali/x'] }));
+  });
+
+  it('an Azure DevOps push payload names the pushed branch', async () => {
+    const { base, sync } = await mount({});
+    await post(base, {
+      headers: { authorization: `Bearer ${SECRET}`, 'content-type': 'application/json' },
+      body: JSON.stringify({
+        eventType: 'git.push',
+        resource: { refUpdates: [{ name: 'refs/heads/ali/x' }] },
+      }),
+    });
+    expect(sync).toHaveBeenCalledWith(expect.objectContaining({ branches: ['ali/x'] }));
+  });
+
+  it('400 for a branch name git would refuse, and for a body that is not JSON', async () => {
+    const { base, sync } = await mount({});
+    const bad = await post(base, {
+      headers: { authorization: `Bearer ${SECRET}`, 'content-type': 'application/json' },
+      body: JSON.stringify({ branches: ['--upload-pack=x'] }),
+    });
+    expect(bad.status).toBe(400);
+    const notJson = await post(base, {
+      headers: { authorization: `Bearer ${SECRET}`, 'content-type': 'application/json' },
+      body: '{not json',
+    });
+    expect(notJson.status).toBe(400);
+    expect(sync).not.toHaveBeenCalled();
+  });
+
+  it('409 when any branch is in conflict — the message rides in the body', async () => {
+    const { base } = await mount({
+      result: {
+        status: 'partial',
+        results: [
+          { branch: 'ali/x', outcome: 'updated', from: 'a', to: 'b' },
+          {
+            branch: 'main',
+            outcome: 'conflict',
+            conflictedPaths: ['Plugins/x/SKILL.md'],
+            error: 'main is not in sync yet: Plugins/x/SKILL.md changed both in Hexis and on the git host. Recovery is queued; if this stays, open the files on main in Hexis, keep what you want, and save.',
+          },
+        ],
+        changeRequests: { closedDeletedBranch: 0 },
+      },
+    });
+    const res = await post(base, { headers: { authorization: `Bearer ${SECRET}` } });
+    expect(res.status).toBe(409);
+    const body = (await res.json()) as SyncResult;
+    expect(body.results[1]).toMatchObject({ outcome: 'conflict' });
+    expect((body.results[1] as { error: string }).error).toContain('Recovery is queued');
+  });
+
+  it('503 when a branch could not be pulled and none is in conflict', async () => {
+    const { base } = await mount({
+      result: {
+        status: 'partial',
+        results: [{ branch: 'main', outcome: 'error', error: 'could not read from remote' }],
+        changeRequests: { closedDeletedBranch: 0 },
+      },
+    });
+    expect((await post(base, { headers: { authorization: `Bearer ${SECRET}` } })).status).toBe(503);
+  });
+});
+
+describe('POST /api/sync/<branch> — the branch in the URL', () => {
+  it('syncs exactly that branch, spelled as segments or percent-encoded', async () => {
+    for (const spelling of ['main', 'ali/new-skill', 'ali%2Fnew-skill']) {
+      const { base, sync } = await mount({});
+      const res = await post(`${base}/${spelling}`, { headers: { authorization: `Bearer ${SECRET}` } });
+      expect(res.status).toBe(200);
+      expect(sync).toHaveBeenCalledWith(expect.objectContaining({ branches: [decodeURIComponent(spelling)] }));
+      server?.close();
+    }
+  });
+
+  it('ignores the body for branch selection — a GitHub Action can post anything', async () => {
+    const { base, sync } = await mount({});
+    await post(`${base}/main`, {
+      headers: { authorization: `Bearer ${SECRET}`, 'content-type': 'application/json' },
+      body: JSON.stringify({ branches: ['other'] }),
+    });
+    expect(sync).toHaveBeenCalledWith(expect.objectContaining({ branches: ['main'] }));
+  });
+
+  it('still checks the credential first', async () => {
+    const { base, sync } = await mount({});
+    expect((await post(`${base}/main`)).status).toBe(401);
+    expect(sync).not.toHaveBeenCalled();
+  });
+
+  it('400 for a branch name git would refuse', async () => {
+    const { base, sync } = await mount({});
+    const res = await post(`${base}/--upload-pack=x`, { headers: { authorization: `Bearer ${SECRET}` } });
+    expect(res.status).toBe(400);
+    expect(sync).not.toHaveBeenCalled();
+  });
+});
+
+describe('POST /api/sync — behind the production JSON parser', () => {
+  it('the branch route still sees the raw bytes, so a GitHub signature verifies', async () => {
+    const { base, sync } = await mount({ globalJson: true });
+    const body = '{"ref":"refs/heads/main"}';
+    const sig = 'sha256=' + createHmac('sha256', SECRET).update(body).digest('hex');
+    const res = await post(`${base}/main`, {
+      headers: { 'x-hub-signature-256': sig, 'content-type': 'application/json' },
+      body,
+    });
+    expect(res.status).toBe(200);
+    expect(sync).toHaveBeenCalledWith(expect.objectContaining({ branches: ['main'] }));
+  });
+
+  it('and so does the bare route', async () => {
+    const { base } = await mount({ globalJson: true });
+    const body = '{"ref":"refs/heads/main"}';
+    const sig = 'sha256=' + createHmac('sha256', SECRET).update(body).digest('hex');
+    const res = await post(base, {
+      headers: { 'x-hub-signature-256': sig, 'content-type': 'application/json' },
+      body,
+    });
+    expect(res.status).toBe(200);
+  });
+
+  it('isSyncRawBodyPath covers both shapes and nothing else', () => {
+    expect(isSyncRawBodyPath('/api/sync')).toBe(true);
+    expect(isSyncRawBodyPath('/api/sync/main')).toBe(true);
+    expect(isSyncRawBodyPath('/api/sync/ali/new-skill')).toBe(true);
+    expect(isSyncRawBodyPath('/api/synchronise')).toBe(false);
+    expect(isSyncRawBodyPath('/api/setup/status')).toBe(false);
+  });
+});
+
+describe('POST /api/sync — the response marker', () => {
+  it('every answer carries the header a proxy never sets, including the 503 and the 401', async () => {
+    const ok = await mount({});
+    expect((await post(ok.base, { headers: { authorization: `Bearer ${SECRET}` } })).headers.get('x-hexis-sync')).toBe('result');
+    server?.close();
+    const down = await mount({
+      result: {
+        status: 'partial',
+        results: [{ branch: 'main', outcome: 'error', error: 'could not read from remote' }],
+        changeRequests: { closedDeletedBranch: 0 },
+      },
+    });
+    const res = await post(down.base, { headers: { authorization: `Bearer ${SECRET}` } });
+    expect(res.status).toBe(503);
+    expect(res.headers.get('x-hexis-sync')).toBe('result');
+    expect((await post(down.base)).headers.get('x-hexis-sync')).toBe('result');
+  });
+});
+
+describe('POST /api/Sync — an odd-cased URL', () => {
+  it('is matched by Express and by the raw-body carve-out alike, so it works exactly like the lower-case one', async () => {
+    const { base, sync } = await mount({ globalJson: true });
+    const oddCase = base.replace('/api/sync', '/api/Sync');
+    const body = '{"ref":"refs/heads/main"}';
+    const sig = 'sha256=' + createHmac('sha256', SECRET).update(body).digest('hex');
+    const res = await post(`${oddCase}/main`, {
+      headers: { 'x-hub-signature-256': sig, 'content-type': 'application/json' },
+      body,
+    });
+    expect(res.status).toBe(200);
+    expect(sync).toHaveBeenCalledWith(expect.objectContaining({ branches: ['main'] }));
+    expect(isSyncRawBodyPath('/api/Sync')).toBe(true);
+    expect(isSyncRawBodyPath('/API/SYNC/main')).toBe(true);
+  });
+});