test: replace artificial with built-in fetch for integration tests

[arb]

Why

Closes #266.

artificial is the source of 7 of the 11 npm warn deprecated notices on a fresh npm install. It pulls in the deprecated @hapi/joi@16 and @hapi/shot@4 lines, which transitively bring @hapi/hoek@8, @hapi/address@2, @hapi/formula@1, @hapi/pinpoint@1, and @hapi/topo@3. artificial itself has not been updated in years, and we use it in exactly one place: test/integration.test.js, where it attaches an in-process inject(...) method on the Express app via @hapi/shot's simulated Request/Response.

What's different now

test/integration.test.js drives the Express app over real HTTP via app.listen(0) and Node's built-in fetch. A small inject shim inside the Server() factory:

• binds the app to an ephemeral loopback port,
• issues one fetch per call with a default user-agent: 'shot' (kept so existing assertions stay byte-for-byte) and Connection: close so the server tears down promptly,
• awaits the listen, the fetch, the optional callback, and the full httpServer.close before resolving.

Because the shim is async and every server.inject(...) call site now awaits it, node:test sees a complete unit of work and exits cleanly. No reliance on --test-force-exit, no global undici dispatcher hook, and no new dependency.

Two side-effects of going from Shot's fake response to real HTTP:

• The two update req values > req.headers and multiple-runs > continues to set default values tests previously asserted on the entire req.headers bag. With real HTTP that bag includes whatever the transport happens to inject (e.g. accept-language, sec-fetch-mode). Those tests' actual intent is "the Joi default 'secret-header': '@@@@@@' got applied to req.headers," so the assertions are narrowed to that single contract. We're testing celebrate's behavior, not Express + the transport's.
• Four route handlers in the update req values block previously got away without sending a response because Shot faked the response cycle. Real fetch hangs forever waiting for one, so each of those handlers now calls res.send() after team.attend(req).

Tradeoffs

Real HTTP is slightly slower than in-process injection, but the full integration suite still finishes in ~330ms on Node 20. In exchange, the tests now exercise the actual production code path: Node's HTTP parser, Express.json() reading bytes off a real stream, cookie-parser reading a real Cookie: header, and Express 4 vs Express 5 routing/body parsing differences. That's exactly the regime where future regressions would otherwise ship undetected.

Teamwork is preserved. The optional inject(options, callback) shape is preserved. No public API changes; no production dependency changes; no CI matrix changes; no lib/ changes.

QA Spec

• npm install emits zero @hapi/* deprecation warnings.
• npm ls --all shows no @hapi/joi@16, @hapi/shot, @hapi/hoek@8, @hapi/address@2, @hapi/formula@1, @hapi/pinpoint@1, or @hapi/topo@3.
• npx eslint . is clean.
• npm run test:ci passes locally with c8 --100 green and the process exits cleanly (no hang).
• CI matrix passes on every Node x Express combination ([20.x, 22.x, 24.x, 25.x] x [latest-4, latest]).
• No regression in the 48 unit tests in test/celebrate.test.js.
• No package-lock.json accidentally committed.

Made with Cursor

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (670567e) to head (1bc1d72).
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@            Coverage Diff            @@
##            master      #269   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files            5         5           
  Lines          263       263           
=========================================
  Hits           263       263           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.