Hashed seat tokens, ledgered inputs, refusable moves, disk-checked codes, host-only bots, and a drift script

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0141G6xqLeNRYEtviLWSB5Up

template/server/src/store.ts

@@ -8,7 +8,10 @@ import type { SeatId } from '../../src/lib/game/spec';
 
 export type LedgerLine =
 	| { t: 'room'; id: string; seats: number; createdAt: number }
-	| { t: 'seat'; id: SeatId; name: string; token: string; bot: boolean }
+	/** A seat holds only the hash of its token; the token itself goes once to the browser that earned it. Ledgers written before hashing carry `token` and are read once more. */
+	| { t: 'seat'; id: SeatId; name: string; tokenHash?: string; token?: string; bot: boolean }
+	/** One seat's move for the round in progress, so a restart keeps it. The turn line that follows carries every input again. */
+	| { t: 'input'; at: number; id: SeatId; input: unknown }
 	/** A bot sent away by the host before the game began; its seat id is free again. */
 	| { t: 'unseat'; id: SeatId }
 	/** Ledgers from before revisions were recorded resolve under rules 1. */
@@ -41,6 +44,11 @@ export class Store {
 			.map((l) => JSON.parse(l) as LedgerLine);
 	}
 
+	/** Whether a ledger exists on disk, loaded or not; a code must not be reissued over one. */
+	exists(roomId: string): boolean {
+		return existsSync(this.path(roomId));
+	}
+
 	roomIds(): string[] {
 		return readdirSync(this.dir)
 			.filter((f) => f.endsWith('.jsonl'))