chore: inline 5 dependencies, removing external packages (#500)

* chore: remove 5 dependencies by inlining their functionality

- bech32: inline encode/decode in transform.ts (~75 lines)
- accepts: replace with request.headers.accept?.includes() check
- tor-control-ts: inline Tor control protocol via net.Socket (TorClient class)
- helmet: inline Content-Security-Policy header construction
- dotenv: use Node.js --env-file-if-exists flag in npm scripts

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* revert: restore accepts library, removing inline header check

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore: merge main into chore/inline-dependencies, resolve conflicts

* fix: address inline review comments — multi-line Tor parsing, bech32 validation, type deps, engines, await closeTorClient, TorClient tests

Agent-Logs-Url: https://github.com/cameri/nostream/sessions/f56791f2-7216-4d11-b88a-63b5d2c432e5

Co-authored-by: cameri <378886+cameri@users.noreply.github.com>

* chore: use node version from .nvmrc in engines field

Agent-Logs-Url: https://github.com/cameri/nostream/sessions/40ebf88c-b9ee-415d-85b0-248f84afbb78

Co-authored-by: cameri <378886+cameri@users.noreply.github.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: cameri <378886+cameri@users.noreply.github.com>

Author: 4 people

package-lock.json

@@ -24,12 +24,12 @@
   ],
   "main": "src/index.ts",
   "scripts": {
-    "dev": "node -r ts-node/register src/index.ts",
-    "clean-db": "node -r ts-node/register src/clean-db.ts",
+    "dev": "node --env-file-if-exists=.env -r ts-node/register src/index.ts",
+    "clean-db": "node --env-file-if-exists=.env -r ts-node/register src/clean-db.ts",
     "clean": "rimraf ./{dist,.nyc_output,.test-reports,.coverage}",
     "build": "tsc --project tsconfig.build.json",
     "prestart": "npm run build",
-    "start": "cd dist && node src/index.js",
+    "start": "cd dist && node --env-file-if-exists=../.env src/index.js",
     "build:check": "npm run build -- --noEmit",
     "knip": "knip --config .knip.json --production --include files,dependencies --no-progress --reporter compact",
     "lint": "biome lint ./src ./test",
@@ -38,7 +38,7 @@
     "lint:fix": "npm run lint -- --write",
     "format": "biome format --write ./src ./test",
     "format:check": "biome format ./src ./test",
-    "import": "node -r ts-node/register src/import-events.ts",
+    "import": "node --env-file-if-exists=.env -r ts-node/register src/import-events.ts",
     "db:migrate": "knex migrate:latest",
     "db:migrate:rollback": "knex migrate:rollback",
     "db:seed": "knex seed:run",
@@ -51,7 +51,7 @@
     "test:load": "node -r ts-node/register ./scripts/security-load-test.ts",
     "test:integration": "cucumber-js",
     "cover:integration": "nyc --report-dir .coverage/integration npm run test:integration -- -p cover",
-    "export": "node -r ts-node/register src/scripts/export-events.ts",
+    "export": "node --env-file-if-exists=.env -r ts-node/register src/scripts/export-events.ts",
     "docker:compose:start": "./scripts/start",
     "docker:compose:stop": "./scripts/stop",
     "docker:compose:clean": "./scripts/clean",
@@ -90,6 +90,7 @@
     "@semantic-release/github": "8.1.0",
     "@semantic-release/npm": "13.1.5",
     "@semantic-release/release-notes-generator": "10.0.3",
+    "@types/accepts": "^1.3.7",
     "@types/chai": "^4.3.1",
     "@types/chai-as-promised": "^7.1.5",
     "@types/debug": "4.1.7",
@@ -123,22 +124,21 @@
     "typescript": "~5.7.3",
     "uuid": "^8.3.2"
   },
+  "engines": {
+    "node": ">=24.14.1"
+  },
   "dependencies": {
     "@noble/secp256k1": "1.7.1",
     "accepts": "^1.3.8",
     "axios": "^1.15.0",
-    "bech32": "2.0.0",
     "debug": "4.3.4",
-    "dotenv": "16.0.3",
     "express": "4.22.1",
-    "helmet": "6.0.1",
     "js-yaml": "4.1.1",
     "knex": "2.4.2",
     "pg": "8.9.0",
     "pg-query-stream": "4.3.0",
     "ramda": "0.28.0",
     "redis": "4.5.1",
-    "tor-control-ts": "^1.0.0",
     "ws": "^8.18.0",
     "zod": "^3.22.4"
   },

package.json

@@ -1,11 +1,8 @@
 import { createInterface } from 'readline'
-import dotenv from 'dotenv'
 import { Knex } from 'knex'
 
 import { getMasterDbClient } from './database/client'
 
-dotenv.config()
-
 type CleanDbOptions = {
   all: boolean
   dryRun: boolean

src/clean-db.ts

@@ -1,5 +1,4 @@
 import express from 'express'
-import helmet from 'helmet'
 import { randomBytes } from 'crypto'
 
 import { createSettings } from './settings-factory'
@@ -34,7 +33,11 @@ export const createWebApp = () => {
         'font-src': ["'self'", 'https://cdn.jsdelivr.net/npm/'],
       }
 
-      return helmet.contentSecurityPolicy({ directives })(req, res, next)
+      const csp = Object.entries(directives)
+        .map(([key, values]) => `${key} ${values.join(' ')}`)
+        .join('; ')
+      res.setHeader('Content-Security-Policy', csp)
+      return next()
     })
     .use('/favicon.ico', express.static('./resources/favicon.ico'))
     .use('/css', express.static('./resources/css'))

src/factories/web-app-factory.ts

@@ -1,6 +1,6 @@
+import accepts from 'accepts'
 import { NextFunction, Request, Response } from 'express'
 import { path, pathEq } from 'ramda'
-import accepts from 'accepts'
 import { createSettings } from '../../factories/settings-factory'
 import { escapeHtml } from '../../utils/html'
 import { FeeSchedule } from '../../@types/settings'

src/handlers/request-handlers/root-request-handler.ts

@@ -2,10 +2,6 @@ import { extname, resolve } from 'path'
 
 import fs from 'fs'
 
-import dotenv from 'dotenv'
-
-dotenv.config()
-
 import {
   createEventBatchPersister,
   EventImportLineError,

src/import-events.ts

@@ -1,6 +1,4 @@
 import cluster from 'cluster'
-import dotenv from 'dotenv'
-dotenv.config()
 
 import { appFactory } from './factories/app-factory'
 import { maintenanceWorkerFactory } from './factories/maintenance-worker-factory'

src/index.ts

@@ -1,6 +1,4 @@
 import 'pg-query-stream'
-import dotenv from 'dotenv'
-dotenv.config()
 
 import fs from 'fs'
 import path from 'path'