tcmts.cli.sync.test

testFetchesAreCappedAndOnlyWhatsAsked () => Promise<void>

A fetch capped by what its namespaces name stops before fetching any code, and a server sending namespaces it wasn't asked for is refused.

testPublicRemotesAreOnlyPublicAddresses () => Promise<void>

What a hub opens on someone else's say-so is an http(s) address at a public server, alone: never a directory, a remote's name (with its token), an internal address, or one with credentials in it.

testUnconfiguredUrlsGetNoToken () => Promise<void>

A URL that isn't a configured remote is asked with no token, whatever `$TCM_TOKEN` holds (a server's own token went to any library source, an announcement's included); a configured remote is asked with the token it was added with.