Project overview
Two strangers, one ~90-second head-to-head duel, no install and no account — a web platform where matchmaking, scoring, and every answer reveal run server-side at the edge, so the game stays fast and stays cheat-proof.
The stack, explained
A UI framework built around a compiler that turns declarative components — written in HTML, CSS, and JavaScript — into lean, optimized JavaScript that surgically updates the DOM. There is no virtual DOM, so the browser ships and runs less code.
Here: powers the web app UI (via SvelteKit).
A fast, simple library for using SQLite databases from Node.js through a synchronous API, where queries return their results directly instead of via callbacks or promises. It offers full transaction support over an embedded, file-based database.
Here: the SQLite driver behind database access in local development and tests (production runs on Cloudflare D1).
A TypeScript ORM that lets you define your database schema and run queries in TypeScript, with both a typed SQL-like query builder and higher-level relational queries. It is lightweight and serverless-ready, supporting PostgreSQL, MySQL, and SQLite plus its own migration tooling.
Here: defines the schema and runs all database queries.
A framework-agnostic authentication and authorization library for TypeScript that handles email/password sign-in, social/OAuth providers, and sessions out of the box. A plugin ecosystem extends it with features like two-factor auth, multi-tenancy, and passkeys without much extra code.
Here: anonymous-first sessions, login, and passkey sign-in.
why this choice →A utility-first CSS framework where you style elements by applying small predefined classes (like flex or text-center) directly in your markup instead of writing custom CSS. It scans your templates and generates only the CSS you actually use, producing a small, optimized stylesheet.
Here: styles the whole UI.
A modern frontend build tool and development server that gives near-instant startup and hot-module replacement while developing, then bundles optimized assets for production. In development it serves source files over native ES modules instead of pre-bundling everything.
Here: the dev server and production bundler.
A fast testing framework powered by Vite that reuses your project's Vite config and transform pipeline, so tests run with the same setup as your app, with TypeScript, JSX, and ESM support out of the box. It offers a Jest-compatible API plus watch mode, mocking, snapshots, and coverage.
Here: runs the unit and integration test suite.
Why this stack
Realtime on Durable Objects, not a socket server
Each match is its own in-memory stateful object at the edge, so there is no global lock and the per-message ping never waits on a database — D1 is touched only at session boundaries.
Anonymous-first accounts with Better Auth
Players still just type a nick, but identity lives in a server session from the first touch — so it survives a cache clear or a device switch, and signing in is offered only once there is a win worth saving.
A pure-TypeScript engine with zero Cloudflare imports
The same game logic runs in a Worker, a browser, and a Node test unchanged — which is what makes the documented ~one-week migration off Cloudflare credible, and what lets the server replay runs to catch cheaters.
The server replays every run; the client score is never trusted
The deterministic engine re-runs the exact rounds from the same seed and scores from scratch, so a client's tally is only a claim to verify — topping the leaderboard still means actually playing a correct game.
One GameModule contract every game implements
The platform never imports a specific game, so when multi-choice arrived months later it slotted in as a single new case with the three existing categories untouched.
What it gives you
Glossary
The numbers
DataLOC, build time, sessions, language split, commit history, and the full file-by-file breakdown.
Why it's built this way
CourseA cinematic „why” course — the architectural decisions, the traps they avoid, and the roads not taken.
Audited & remediated
SecurityWhat was found, what's fixed — severity posture and before→after remediation, independently audited.