fix: restore resilient Farside ETF flows (#28)

Author: gisk0

.trunk/trunk.yaml

@@ -25,6 +25,11 @@ lint:
     - markdownlint@0.47.0
     - git-diff-check
   ignore:
+    # bun.lock contains package integrity hashes, not prose; codespell can
+    # misidentify checksum fragments as words.
+    - linters: [codespell]
+      paths:
+        - bun.lock
     - linters: [ALL]
       paths:
         - node_modules/**

Dockerfile

@@ -3,6 +3,33 @@ FROM oven/bun:1.3.9-slim@sha256:8ca06c7812d9050ccc4b80799685f395d6a0d051d3b7207d
 
 WORKDIR /app
 
+# Puppeteer downloads Chrome during `bun install`. Keep it in the application
+# directory so the non-root runtime user can find and execute it.
+ENV PUPPETEER_CACHE_DIR=/app/.cache/puppeteer
+
+# Chrome's shared-library and font dependencies. The process still runs as the
+# unprivileged `bun` user below; Cloud Run provides the outer sandbox.
+RUN apt-get update \
+    && apt-get install --yes --no-install-recommends \
+        ca-certificates \
+        fonts-liberation \
+        libasound2 \
+        libatk-bridge2.0-0 \
+        libatk1.0-0 \
+        libcups2 \
+        libdbus-1-3 \
+        libgbm1 \
+        libgtk-3-0 \
+        libnspr4 \
+        libnss3 \
+        libx11-xcb1 \
+        libxcomposite1 \
+        libxdamage1 \
+        libxfixes3 \
+        libxrandr2 \
+        xdg-utils \
+    && rm -rf /var/lib/apt/lists/*
+
 # Install dependencies (with BuildKit cache mount for faster rebuilds)
 COPY package.json bun.lock ./
 COPY patches ./patches
@@ -13,6 +40,11 @@ RUN --mount=type=cache,target=/root/.bun/install/cache \
 COPY src ./src
 COPY tsconfig.json ./
 
+# `bun install` runs as root during the image build, while Cloud Run executes
+# the service as `bun`. Hand the downloaded browser and source tree over before
+# dropping privileges.
+RUN chown -R bun:bun /app
+
 # Production defaults
 ENV NODE_ENV=production
 ENV PORT=8080