Fix ETF flows, remove Voyages, and remediate dependencies

.env.example

@@ -12,8 +12,5 @@ LOG_LEVEL=info
 # Cloud Run (set automatically in production)
 PORT=8080
 
-# OpenSea Voyages (optional - get key at https://console.agentmail.to)
-AGENTMAIL_API_KEY=
-
 # Note: These values are also used by Terraform (via the Makefile).
 # This file is the single source of truth for secrets and app config.

.github/workflows/ci.yml

@@ -23,7 +23,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: latest
+          bun-version: 1.3.9
       - run: bun install --frozen-lockfile
       - uses: trunk-io/trunk-action@v1
       - run: bun run typecheck

AGENTS.md

@@ -44,20 +44,19 @@ channels/telegram.ts (formatBriefingForTelegram)
 
 ### Sources (`src/sources/`)
 
-| File                   | What it fetches                                      |
-| ---------------------- | ---------------------------------------------------- |
-| `etf-flows.ts`         | BTC/ETH/SOL ETF flows from farside.co.uk (Puppeteer) |
-| `overnight-futures.ts` | ES, NQ, GC, CL etc. from Yahoo Finance               |
-| `economic-calendar.ts` | Week-ahead macro events                              |
-| `appstore-rankings.ts` | iOS App Store Finance + Overall rankings             |
-| `polymarket.ts`        | Prediction market movements                          |
-| `congress-trades.ts`   | US Congress member stock trades from Capitol Trades  |
+| File                        | What it fetches                                     |
+| --------------------------- | --------------------------------------------------- |
+| `etf-flows.ts`              | BTC/ETH/SOL aggregate ETF flows from DefiLlama      |
+| `overnight-futures.ts`      | ES, NQ, GC, CL etc. from Yahoo Finance              |
+| `economic-calendar.ts`      | Week-ahead macro events                             |
+| `appstore-rankings.ts`      | iOS App Store Finance + Overall rankings            |
+| `polymarket.ts`             | Prediction market movements                         |
+| `congress-trades.ts`        | US Congress member stock trades from Capitol Trades |
+| `tracked-apps.ts`           | Config: which apps to track in App Store            |
+| `fetch-current-rankings.ts` | Shared helper for appstore-rankings                 |
 
 > **Congress Trades has its own maintenance guide:** `docs/congress-trades-maintenance.md`
 > Read it before updating politician data, committee mappings, or scoring thresholds.
-> | `opensea-voyages.ts` | NFT voyage data |
-> | `tracked-apps.ts` | Config: which apps to track in App Store |
-> | `fetch-current-rankings.ts` | Shared helper for appstore-rankings |
 
 ---
 
@@ -199,7 +198,6 @@ See `docs/deploy-from-scratch.md` for the full deploy guide.
 | -------------------- | ---------- | --------------- | -------------------------------------------------- |
 | `TELEGRAM_BOT_TOKEN` | Yes (prod) | —               | Bot API token from @BotFather                      |
 | `TELEGRAM_CHAT_ID`   | Yes (prod) | —               | Target chat for briefings                          |
-| `AGENTMAIL_API_KEY`  | No         | —               | For email-based OpenSea OTP login                  |
 | `TIMEZONE`           | No         | `Europe/Berlin` | Briefing timezone                                  |
 | `USE_MOCK_DATA`      | No         | `false`         | Use mock sources                                   |
 | `LOG_LEVEL`          | No         | `info`          | Logging verbosity                                  |
@@ -265,7 +263,7 @@ cd terraform && make plan  # Loads secrets from ../.env.local automatically
 
 ### Cloud Run logs show "Container failed to start"
 
-Check memory limits (Puppeteer needs 2Gi) and environment variables:
+Check memory limits and environment variables:
 
 ```bash
 bun run logs          # Tail Cloud Run logs

Dockerfile

@@ -1,24 +1,11 @@
 # syntax=docker/dockerfile:1
-# Use Puppeteer base image which includes Chrome
-# Match version to package.json puppeteer version for Chrome compatibility
-FROM ghcr.io/puppeteer/puppeteer:24.36.1 AS base
-
-# Switch to root to install bun
-USER root
-
-# Install bun
-RUN npm install -g bun
+FROM oven/bun:1.3.9-slim@sha256:8ca06c7812d9050ccc4b80799685f395d6a0d051d3b7207dfd120e2b437b1ec9 AS base
 
 WORKDIR /app
 
-# Configure Puppeteer BEFORE install to use the correct cache location
-# The base image has Chrome pre-installed in pptruser's cache, but bun install
-# runs as root. Setting PUPPETEER_CACHE_DIR ensures Chrome is downloaded to
-# a location accessible at runtime.
-ENV PUPPETEER_CACHE_DIR=/home/pptruser/.cache/puppeteer
-
 # Install dependencies (with BuildKit cache mount for faster rebuilds)
-COPY package.json bun.lockb* ./
+COPY package.json bun.lock ./
+COPY patches ./patches
 RUN --mount=type=cache,target=/root/.bun/install/cache \
     bun install --frozen-lockfile --production
 
@@ -33,9 +20,8 @@ EXPOSE 8080
 
 # Health check
 HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
-  CMD curl -f http://localhost:8080/health || exit 1
+  CMD bun -e 'const response = await fetch("http://localhost:8080/health"); process.exit(response.ok ? 0 : 1)'
 
-# Switch back to non-root user for security
-USER pptruser
+USER bun
 
 CMD ["bun", "run", "src/index.ts"]

README.md

@@ -8,7 +8,7 @@ tier).
 
 Every morning, receive a Telegram message with:
 
-- ETF fund flows (SPY, QQQ, etc.)
+- Aggregate BTC, ETH, and SOL ETF fund flows
 - Economic calendar highlights
 - Prediction market movements
 - And more...
@@ -32,6 +32,9 @@ cd terraform && make deploy
 See [docs/deploy-from-scratch.md](docs/deploy-from-scratch.md) for detailed
 instructions.
 
+Dependency security pins and package patches are maintained in
+[docs/dependency-security.md](docs/dependency-security.md).
+
 ## Local Development
 
 ```bash
@@ -63,7 +66,7 @@ bun dev
 src/
 ├── sources/          # Data sources (one file per integration)
 │   ├── index.ts      # Source registry — add new sources here
-│   ├── etf-flows.ts  # BTC/ETH/SOL ETF flows (Puppeteer)
+│   ├── etf-flows.ts  # BTC/ETH/SOL aggregate ETF flows
 │   ├── overnight-futures.ts
 │   ├── economic-calendar.ts
 │   ├── appstore-rankings.ts