Every URL a remote glob means.

HTTP has no readdir, so a directory has to volunteer its contents. Two shapes are read, because between them they cover every server anybody points this at:

• JSON — an array of names, an array of { name } (which is what the GitHub contents API answers), or { files: [...] }. A server that means to be listed says so this way.
• HTML — the <a href> links of an autoindex, which is what nginx, Caddy, python -m http.server and every static host produce for free.

** walks into subdirectories, bounded at MAX_DEPTH levels and MAX_MATCHES files so that a pattern aimed at the wrong host cannot quietly become the whole run.

The extension filter is the run's own: a directory listing is full of things that are not test files, and the local walk filters the same way.

import { expandRemoteGlob } from './remote-inputs.ts';

// Defined, not invoked: it lists a real server.
function example() {
  return expandRemoteGlob('https://example.com/tests/*-test.js', ['js', 'ts'], new Map());
}