Seats are banked in a cookie the server sets, and a lost seat comes back by name to the address it was last used from

A seat lived in the browser's storage alone, and Safari clears that after a week away, or at a word from the person on another device. Now every seat taken is banked as well in an HttpOnly cookie the server writes, which such clearing leaves alone, and the wallet takes its seats back from the bank on arrival. For a browser that lost even the cookie, the ledger notes the address each seat was last used from, as a salted hash, at most once in ten minutes, and a name given in the lobby or from the gallery gets its seats back from the same address, with a new token; where the address differs, two people at the table share it, or the host gave the seat to the clockwork, the table is only counted, and the host's phrase or the keeper's link is the way back. A name refused as taken is looked for the same way before the refusal shows. The keeper's script finds a name across tables. The seat endpoints answer only this site's own pages, under a limit of their own.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CCLa2PaEeCj8njQZSWGqHx

packages/server/src/keeper.ts

@@ -2,6 +2,7 @@
 // port Caddy forwards to, so it answers only on the host itself, and only to
 // the key in its key file, so another service on a shared host cannot use
 // it. Its one caller is deploy/wizwar-reseat.sh, which sends the key:
+//   GET  /keeper/seats?name=         every table not finished where a person of that name sits, for one who lost the codes too
 //   GET  /keeper/rooms/:id           who sits at the table, and when each person last moved or spoke
 //   POST /keeper/rooms/:id/reseat    {seat}   a new token for a player locked out, as a link to send them
 
@@ -9,7 +10,7 @@ import { timingSafeEqual } from "node:crypto";
 import { readFileSync } from "node:fs";
 import { createServer, type IncomingMessage, type Server, type ServerResponse } from "node:http";
 import type { GameEvent, PlayerId } from "@wizwar/engine";
-import { getRoom, reseat, seatsForKeeper, type Room } from "./rooms";
+import { getRoom, reseat, seatsForKeeper, tablesForKeeper, type Room } from "./rooms";
 
 function send(res: ServerResponse, status: number, body: unknown): void {
   res.writeHead(status, { "content-type": "application/json" }).end(JSON.stringify(body));
@@ -54,6 +55,10 @@ async function handle(req: IncomingMessage, res: ServerResponse, { publicUrl, ke
   const parts = (req.url ?? "/").split("?")[0]!.split("/").filter(Boolean);
   // Nothing proxied belongs here: a forwarded request is turned away even if a proxy is someday pointed at this port.
   if (req.headers["x-forwarded-for"] || !keyGiven(req, keyFile)) return send(res, 404, { error: "not here" });
+  if (parts[0] === "keeper" && parts[1] === "seats" && parts.length === 2 && req.method === "GET") {
+    const name = new URL(req.url ?? "/", "http://localhost").searchParams.get("name") ?? "";
+    return send(res, 200, { tables: tablesForKeeper(name.trim().slice(0, 40)) });
+  }
   if (parts[0] !== "keeper" || parts[1] !== "rooms" || !parts[2]) return send(res, 404, { error: "not here" });
   const room = getRoom(parts[2]);
   if (!room) return send(res, 404, { error: "no such room" });