Who a request to `tcm serve` is from: the maintainer (the server's own token, which can do anything), a contributor (a token `tcm user add` made, pushing only branches under `@<handle>/`), or, on a `--public` server, a reader with no token, who can pull and read contributions.
A definition's lint findings, as codebases send them to each other: under the key they were kept under (the linter's version and configuration). Findings are plain data, so they're shared as test results are.
A test's result, as codebases send them to each other: under the key it was kept under (the runtime, the test framework, and the platform for a test that reaches files, the environment or other processes).
Who a request's `authorization` header says it's from, or undefined if it's no one this server knows (a wrong token, or none on a server that isn't public).
`records` in batches a receiver can check one after another: whole components, each after the components among them that it uses (the receiver checks every reference resolves), and each batch under a request's size limit (a server takes 64 MB; the fewer batches, the less each checker compiles again what they all use) (`sizeOf` says a record's), however many there are. Further records of a definition (its other texts) come after all the code.
Fetch the components needed for `hashes` that we lack, following dependencies until the closure is complete. What's fetched is set aside in a file as it comes, only what orders it kept in memory: a long history's definitions, IR and all, wouldn't fit. `read` gets one back; `dispose` removes the file.
Fetch what this codebase lacks of the remote's namespace nodes from `roots` down, with the definitions they name (and what those use), the text versions they show, and the package versions their code runs on: everything to read those namespaces here. Returns definitions received. `maxNames` refuses namespaces naming more definitions than that before any are fetched (a hub mirroring a stranger's release, say); `keepLocks` keeps the package versions this codebase has locked (a library's code doesn't move them).
Fetch the results of a branch's tests this codebase has none of, from the remote: the ones it could use, run on this runtime (and, for a test whose result depends on it, this platform). How many were received. A codebase that hasn't run tests takes the remote's version of the test framework with them.
Pass a request on to the server `to` names, as it came (method, path, headers, body), streaming both ways, and its answer back: an app served beside the codebase, under a path of the site. Saying who asked (`x-forwarded-*`). With several servers (an app's version and its next, on two ports while one replaces the other), the one that answered last is asked first, and one that refuses the connection passes the request to the next: a request's body is read first then, so it can go to either.
A configured remote name (with the token it was added with), an http(s) URL, `tcm` (the libraries the running tcm ships: shippedLibraries), or a path to another codebase. A URL that isn't a configured remote is asked with no credentials: a library's sources, an announcement's, are others' to choose, and the environment's token (TCM_TOKEN, a server's own) mustn't go to them.
A codebase someone else names (an announcement's source, a hub visitor's codebase), as a hub asks it: an http(s) URL alone (no remote's name, no directory), at a public address (`publicUrl`; https or http, any address on a local network), asked with no credentials.
Send whatever the remote lacks of the components needed for `hashes`: what each uses before it (the receiver checks every reference resolves), in requests of a bounded size, however much there is.
Serve this codebase to other tcm instances. With the server's token, clients can store definitions, move branch names and — unless `allowRun` is false — run code here, so it listens on localhost by default. Contributors' tokens (`tcm user add`) push only their own branches and propose them; with `public`, anyone can pull and read contributions (refusal says who can do what).
Answer a GET from a static site's directory: `/` and directories by their index.html, `/a` by a.html (before a directory a), and a path with no file by the nearest 404.html above it (a static site's own, under its path, renders the app's other paths). Each file is sent at most once to a browser that keeps it: its ETag is its content (a browser asks again, and is told it hasn't changed), and a file named by its content (`style.<digest>.css`, the start of its SHA-256 in hex) is kept for good. Text is compressed (brotli or gzip, as the browser accepts). A directory asked without its slash goes to it with one, so its page's relative links are its own. With `moved` (a path of the site its pages moved under), a path with no file that the site has under `moved`, or that `proxied` says an app beside it serves there, goes there (a 301), so links from before the move work.
An app the running tcm's package ships (`apps` in its manifest): its directory beside the package's code (`<package>/apps/<name>`, holding its codebase), or undefined if it ships none of that name (a tcm run from a codebase rather than a package).
The tcm libraries the running tcm's package ships (`libraries` in its manifest), as a codebase directory `cb` can fetch them from: a copy, in its cache, of the codebase beside the package's code (`<package>/libraries`, or, for a tcm run from its codebase as suites run it, where they packed them: `TCM_SHIPPED_LIBRARIES`). Undefined if it ships none.
`data` (a file of a site, `digest` its SHA-256) as `encoding` ("br" or "gzip"): compressed once, then remembered. Undefined for what isn't worth it: not text, too small, or no smaller compressed.
The certificate and key for `tcm serve --tls`: given files, or a self-signed pair created once with openssl and kept in `.tcm/tls/`. Clients pin it by fingerprint.
The web UI `tcm serve` shows under `/forge/`: the app tcm ships (`share`), run by `tcm start` beside the server on the codebase it serves, started when it's first asked for (or ahead: `warm`). Its codebase is copied into the served one's `.tcm/share/` (again when tcm's changes), where its builds are kept; requests under `/forge/` go to it (a page asked for while it starts says so, and tries again by itself). It's told the server's token and whether it's public, and signs people in by the same tokens.
What a contributor can send besides: what's checked by its hash when it arrives (or is only kept once a branch names it), and contributions. Test results, lint findings and releases, taken on trust, are the maintainer's.
A definition as sent to a codebase that derives what it can itself (`x-tcm-records: lean`, which a tcm says it takes): its IR cut to its head (its tag, lineage salt and JSX runtime: what reading the code back takes; the rest is what the source gives, and a receiver keeps its own), and no type shape. Most of a record's bytes go. A file's IR is its content, so a file goes whole.
Why a server refuses a caller this route, or undefined if it doesn't. `sourceOf` says which branch a contribution proposes: a contributor closes and reopens only their own.
Send what the remote lacks of the history up to `head`: its causals, the namespace nodes they point at (a node the remote has, it has everything under), and every definition those name. Returns definitions sent.
Send the lint findings of a branch's definitions the remote doesn't have, under the keys they were kept under (the linter's version and configuration): a definition's findings depend only on those and its code, so they hold wherever it's linted the same. How many were sent (none to a remote that doesn't keep them).
Send the results of a branch's tests the remote doesn't have, under the keys they were kept under: a test's hash covers what it runs, so its result holds wherever that runs the same. How many were sent (none from a remote that doesn't keep results: an older tcm).
A site's files compressed for browsers, by content (`<digest> <encoding>`): each is compressed once while the server runs, and the oldest are forgotten past SITE_COMPRESSED_LIMIT bytes.
Which of the web UI's output `tcm serve` shows, a chunk at a time: what it says when it starts, stops or something fails (with the stack that says where), and pages that took a second or more to render, not every page it renders. A line split between chunks is judged whole.
Names from another codebase: paths must be valid (a file's as files are named: `docs.getting-started`) and every hash must already be stored here; kinds come from the local store.