Implement using PO token server to imrpove youtube downloads

.github/workflows/pr.yml

@@ -31,7 +31,7 @@ jobs:
         run: bun lint
 
       - name: Type checks
-        run: bun check
+        run: bun typecheck
 
       - name: Tests unit
         run: bun test:unit

.github/workflows/release.yml

@@ -18,7 +18,7 @@ on:
         type: string
 
 permissions:
-  contents: write
+  contents: read
 
 concurrency:
   group: release
@@ -27,6 +27,8 @@ concurrency:
 jobs:
   prepare:
     name: Prepare
+    permissions:
+      contents: write
     runs-on: ubuntu-latest
     outputs:
       tag: ${{ steps.version.outputs.tag }}
@@ -57,7 +59,7 @@ jobs:
         run: bun install --frozen-lockfile
 
       - name: Run release checks
-        run: bun check && bun lint && bun test:unit
+        run: bun typecheck && bun lint && bun test:unit
 
       - name: Bump package version
         id: version
@@ -151,6 +153,8 @@ jobs:
 
   build:
     name: Build
+    permissions:
+      contents: read
     needs: prepare
     strategy:
       fail-fast: false
@@ -184,6 +188,7 @@ jobs:
         uses: actions/checkout@v6
         with:
           ref: ${{ needs.prepare.outputs.tag }}
+          persist-credentials: false
 
       - name: Set up Bun
         uses: oven-sh/setup-bun@v2
@@ -224,6 +229,8 @@ jobs:
 
   release:
     name: Release
+    permissions:
+      contents: write
     needs:
       - prepare
       - build
@@ -308,6 +315,8 @@ jobs:
 
   release-homebrew:
     name: Release to Homebrew
+    permissions:
+      contents: read
     needs:
       - prepare
       - release
@@ -333,6 +342,8 @@ jobs:
 
   release-npm:
     name: Release to NPM
+    permissions:
+      contents: read
     needs:
       - prepare
       - release
@@ -342,6 +353,7 @@ jobs:
         uses: actions/checkout@v6
         with:
           ref: ${{ needs.prepare.outputs.tag }}
+          persist-credentials: false
 
       - name: Set up Node.js for npm publish
         uses: actions/setup-node@v6

.github/workflows/web.yml

@@ -8,13 +8,22 @@ on:
       - ".github/workflows/web.yml"
       - "packages/web/**"
 
+permissions:
+  contents: read
+
+concurrency:
+  group: web-deploy
+  cancel-in-progress: true
+
 jobs:
   deploy:
     runs-on: ubuntu-latest
 
     steps:
       - name: Check out
         uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
       - name: Set up Bun
         uses: oven-sh/setup-bun@v2

.github/workflows/youtube-token.yml

@@ -0,0 +1,47 @@
+name: YouTube Token Worker
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - ".github/workflows/youtube-token.yml"
+      - "packages/youtube-token/**"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: youtube-token-deploy
+  cancel-in-progress: true
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      - name: Set up Bun
+        uses: oven-sh/setup-bun@v2
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile --filter @mdl/youtube-token
+
+      - name: Type check
+        working-directory: packages/youtube-token
+        run: bun run typecheck
+
+      - name: Test
+        working-directory: packages/youtube-token
+        run: bun run test
+
+      - name: Deploy
+        working-directory: packages/youtube-token
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+        run: bunx wrangler deploy

.gitignore

@@ -5,3 +5,4 @@ music/
 .DS_Store
 *.tsbuildinfo
 *.tgz
+.wrangler

AGENTS.md

@@ -1,25 +1,20 @@
-You are an expert in TypeScript, Node.js, React, Tailwind CSS.
+Use `./docs/CAVEMAN.md` for thinking and responses.
+Env vars via Varlock (+ GCP Secret Manager).
+New dependencies use the latest compatible release; the repo pins exact versions.
+Use Conventional Commits for branches and commits. Subject under ~70 chars; body only when the why matters.
 
-## Code Style and Structure
+## Routing
 
-Write concise, technical TypeScript code with accurate examples.
-Use descriptive variable names with auxiliary verbs (e.g., isLoading, hasError).
-Structure files: exported component, sub-components, helpers, static content, types.
-Keep inline comments concise and limited for overlay complex code, favour using debug logging to explain what code is doing. Avoid adding huge chunks of commented code explaining the code.
+Load the smallest relevant doc set for the task:
 
-## Naming Conventions
+- Open `./docs/TYPESCRIPT.md` only when editing TypeScript or JavaScript files.
+- Open `./docs/TESTING.md` only when editing tests, mocks, or test infra.
+- Open `./docs/SHELL.md` only when editing shell scripts or `run` files.
+- Open `./docs/GH_WORKFLOWS.md` only when editing `.github/workflows/*`.
 
-Use lowercase for directories and Capitalization only for Class constructor or Components (e.g., components/AuthWizard), for helpers/lib/utils use lowercase.
-Favor named exports for components.
+## Naming
 
-## TypeScript Usage
-
-Use TypeScript for all code; prefer types over interfaces.
-Avoid enums; use maps instead.
-Use functional components with TypeScript types.
-
-## Syntax and Formatting
-
-Use the "function" keyword for pure functions.
-Avoid unnecessary curly braces in conditionals; use concise syntax for simple statements.
-Use declarative JSX.
+- `camelCase` for directories, files, and the default fallback.
+- `PascalCase` for React components and class constructor files.
+- `UPPER_SNAKE_CASE` for markdown files.
+- Preserve framework-required route filenames.

CONTRIBUTING.md

@@ -22,11 +22,11 @@ Run the same checks expected in pull requests before opening one:
 
 ```bash
 bun lint
-bun check
+bun typecheck
 bun test
 ```
 
-The end-to-end test downloads media and can take several minutes to finish.
+Run `bun test:youtube-smoke` separately to download and validate media.
 
 ## Pull requests
 

biome.json

@@ -5,11 +5,21 @@
   },
   "files": {
     "ignoreUnknown": true,
-    "includes": ["packages/**/*.ts", "packages/**/*.tsx", "*.json", "*.md"]
+    "includes": [
+      "packages/**/*.ts",
+      "packages/**/*.tsx",
+      "*.json",
+      "*.md",
+      "!**/.wrangler",
+      "!**/.output",
+      "!**/dist",
+      "!**/build"
+    ]
   },
   "formatter": {
     "enabled": true,
-    "indentStyle": "space"
+    "indentStyle": "space",
+    "lineWidth": 120
   },
   "linter": {
     "enabled": true,