Fractured Crown

A social deduction game based on Secret Hitler, set in a dark medieval fantasy world where Loyalists, Traitors, and a hidden Usurper fight through elections, legislation, and executions. The client is completely untrusted — 13 Supabase Edge Functions handle role assignment, deck shuffling, vote tallying, and win conditions. State syncs to players through Supabase Realtime (Postgres CDC on 6 tables, Broadcast for cursors and emoji reactions, Presence for lobby tracking), backed by a polling fallback for reliability. Works as a standalone web app or embedded inside Discord as an Activity.

• –Server-authoritative game loop: 13 Edge Functions enforce the full ruleset including elections, legislation, executive powers, veto, chaos enactment, and all win conditions — the client never touches game state
• –Realtime sync: Postgres CDC on 6 tables for game state, Broadcast for ephemeral things like cursors and emoji reactions, Presence for lobby tracking, plus a 2-second polling fallback because Realtime isn't always reliable
• –Visual decay system: as shadow edicts pile up, the UI gradually deteriorates — ash particles, vignetting, crimson bleeds, screen-shake — six stages total, each layered independently through CSS and Framer Motion
• –Secret information via RLS: votes stay hidden until the server flips a revealed flag, roles are only visible to their owner until game over, and card hands are delivered through Edge Function responses rather than database columns
• –Discord Activity support: plays inside Discord with OAuth2 auth and Supabase traffic proxied through the iframe to get around cross-origin restrictions
• –Procedural audio: all game sounds are synthesized from Web Audio API oscillators and noise buffers — no audio files at all
• –Mobile-friendly multiplayer: three responsive breakpoints, a dedicated mobile action bar, keyboard shortcuts for voting (J/N), and cinematic card-flip animations for role reveals

• –The full Secret Hitler ruleset is surprisingly tricky to encode as a distributed state machine — edge cases like 5-player term limits, restoring the Herald pointer after special elections, and chaos enactment on three consecutive failed votes all needed careful handling across 13 separate edge functions
• –RLS and Supabase Realtime don't play nicely together by default — restrictive policies silently block event delivery, which took multiple migration iterations to figure out
• –The players table has a recursive RLS problem (a player's policy needs to check which room they're in, which queries the players table again), solved with a SECURITY DEFINER helper function
• –Keeping 7 CDC subscriptions on one Realtime channel in sync during fast phase transitions without race conditions or missed updates

Each edge function verifies the caller via an anon-key Supabase client, then mutates through a service-role client — basically a privilege escalation gate per request. The policy deck is rows in Postgres with pile/position columns, and RLS uses a SECURITY DEFINER helper to break the recursive lookup loop. Votes have a 'revealed' column gating SELECT visibility that the server flips atomically after tallying. Realtime is split into Presence for lobby identity and Broadcast for high-frequency stuff like cursors, with a 2-second polling interval as a safety net.

A fully playable social deduction game for 5–10 players in real time, with server-enforced rules, cinematic animations, a progressive decay effect that makes the board feel increasingly ominous, and dual deployment as a web app and Discord Activity. The database spans 10 tables with row-level security, and the game loop covers the full Secret Hitler ruleset — including the less common mechanics like veto power, chaos enactment, and special election pointer restoration.