# secrets/ — house-account cookies (TRACKED by operator authorization)

This directory is committed to the private, self-hosted Forgejo repository
(gitzcreations/openvisengine) by explicit operator authorization, so a
sandbox reprovision can never wipe the house accounts. Do **not** publish
this repository anywhere public while these files exist.

## What belongs here

Netscape `cookies.txt` exports of the operator's "house" music-service
accounts, one file per service. Stream-a-Link attaches them server-side as
the shared fallback login when a visitor has no saved login of their own:

- `house-youtube-cookies.txt` — YouTube / YouTube Music
- `house-soundcloud-cookies.txt` — SoundCloud
- `house-spotify-cookies.txt` — Spotify
- `house-apple-cookies.txt` — Apple Music

Loaded by `src/lib/server/house-cookies.ts`: read server-side only, the
status endpoint exposes booleans (never cookie contents), and a visitor's
own saved login always takes precedence over the house account.

## After a sandbox reset

Nothing to do — `git checkout` restores this directory and the app picks
the files up on boot. (The 2026-11-06 reprovision lost the original files
before this directory was tracked; the operator re-exports them once and
they are safe from then on.)