test(cli): a test seam for os serve's unknown-hostname guard — refusal literal stays inline (#9442) (#9583)

* test(cli): give os serve's unknown-hostname guard a test seam (#9442)

The OS_ROOT_DOMAIN guard was a plugin object literal built inside
Serve.run(), closing over its locals and installing itself on a
`http.server` service resolved from the plugin context. Nothing about it
was exported or constructible, so reaching any of it meant booting a real
`os serve` — and every branch went untested, including the health/
readiness bypass whose own comment says a 404 there "would kill the
container".

Extract the SEAM, not the refusal: `createUnknownHostnameGuardPlugin()`
is exported from serve.ts the way its sibling helpers are, with run()
calling it. The middleware is byte-identical modulo indentation and five
declared rebinds (`__rootDomain` → `rootDomain`, the reserved set and the
health-path list to exported constants, and `process.env.OS_CLOUD_URL` to
an injectable reader that is still called PER REQUEST). The
`c.json({ ... }, 404)` refusal body stays an INLINE OBJECT LITERAL:
check-route-envelope.mjs judges the literal passed to `c.json(...)`, so
hoisting it would leave the file discovered while every counter read
zero — the #9364 conformance pin would go vacuous with the gate green.

The new suite mounts the real middleware on a real Hono app and pins both
directions: every bypass as an explicit pass-through (a sentinel 200,
never "not a 404" — Hono's own unmatched answer is a 404 too), and the
refusal by error.code AND HTTP status together.

The slot-lookup ratchet moves DOWN 10 → 9 for serve.ts: the
`const guardPlugin: any = { … }` declarator no longer contains a
service-lookup call, so one erasure site is gone. Hand-edited by one
number rather than regenerated.

Co-Authored-By: Claude <noreply@anthropic.com>

* test(cli): type the guard harness call() as async (#9442)

`rawApp.fetch()` is typed `Response | Promise<Response>`, so the harness
returned something the declared `Harness` interface did not accept.
`pnpm --filter @objectstack/cli typecheck` now exits 0.

Co-Authored-By: Claude <noreply@anthropic.com>

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-zhuang

.changeset/serve-unknown-hostname-guard-test-seam.md

@@ -0,0 +1,22 @@
+---
+"@objectstack/cli": patch
+---
+
+test(cli): `os serve`'s unknown-hostname guard gets a test seam — the middleware, refusal included, is now reachable without booting a server (#9442)
+
+The `OS_ROOT_DOMAIN` guard was a plugin object literal built inside
+`Serve.run()`, closing over its locals and installing itself on a `http.server`
+service resolved from the plugin context. Nothing about it was exported or
+constructible, so every branch — the health/readiness bypass whose own comment
+says a 404 there "would kill the container", the reserved-subdomain and
+`/_console` redirect branches, the `/_admin` and `/.well-known` pass-throughs,
+the lazy env-registry read whose every failure mode falls through — had zero
+regression coverage.
+
+It is now `createUnknownHostnameGuardPlugin()`, exported from `serve.ts` the way
+its sibling helpers are, with `run()` calling it. Behaviour is unchanged: same
+branches in the same order, same bodies, and `OS_CLOUD_URL` is still read per
+request rather than captured at install time. What is new is a suite that mounts
+the real middleware on a real Hono app and pins BOTH directions — every bypass
+as an explicit pass-through, and the refusal by `error.code` **and** HTTP status
+together.