Quenga Designs · 2026
Titan Slayer
A browser idle/incremental RPG — prestige loops, clans, and weekly tournaments — built client-side with Supabase as a thin backend for saves and leaderboards.
- 18
- Game systems
- 153/153
- Tests passing
- 10
- Data files
- Problem
- Idle games live or die on two things: state you can trust, and a reason to come back — clans, leaderboards, weekly competition. Most of that doesn't need a heavyweight backend, but it does need one that can't be gamed.
- Solution
- The engine is pure client-side TypeScript (Vite, one dependency) with a clean split between core state, data definitions, game systems, and networking. Supabase sits underneath as thin infrastructure — anonymous accounts, cloud saves, and clan data — with every score and clan-contribution write locked behind a database RPC rather than a direct table write, so the client can propose a result but never insert one.
- Result
- Live in production with 153 of 153 tests passing across 18 game systems. A later hardening pass tightened the Supabase RPC permissions and closed a couple of loose grants, and cloud save protects against local-storage loss (not device switching — anonymous sessions are browser-scoped by design).
The brief
An idle/incremental RPG in the click-and-prestige tradition — heroes, monsters, equipment, pets, a skill tree, automation, quests, raids, and clan-based weekly tournaments. The interesting problem wasn't any one system; it was keeping eighteen of them coherent, and making the social layer (clans, leaderboards) trustworthy without standing up a real game server.
What was built
The engine is organized in four layers: core (state, save, math, formatting), data (ten definition files — heroes, monsters, equipment, pets, artifacts, achievements, skill tree, quests, raids, boss patterns), game (eighteen systems: combat, prestige, transcend, clan, tournament, raid, automation, evolution, fairy, offline progress, and more), and net (Supabase, clans, cloud save). It's all vanilla TypeScript with hand-rolled DOM — no UI framework, one runtime dependency.
Clans and their weekly tournament leaderboard are the one place the game needs a real backend, and that's exactly where it gets careful: score submissions and clan contributions go through database RPC functions, not direct table writes, and the weekly clan leaderboard is computed server-side rather than aggregated on the client. The scores table itself has no client-facing write policy at all — the RPC is the only door in.
Under the hood
Sixteen test files cover nearly every system, from combat math to save migration — 153 passing at last count. Five Supabase migrations since early August, including a dedicated hardening pass on the RPC permissions.
The project also had a real production moment worth being honest about: a deploy once went out with no environment variables configured, and because the Supabase client fails closed by design when its config is missing, the entire site rendered blank for every visitor — while Vercel's dashboard still showed "Ready," since a missing env var is a runtime failure, not a build failure. It was caught, the env vars were restored, and the incident became the reason for the RPC hardening pass that followed.
Where it stands
Live in production, clans and tournaments running, saves in the cloud. The fail-closed design meant a misconfiguration showed up as an obvious blank page instead of a silent, harder-to-notice problem — exactly the trade a security-conscious default is supposed to make.