Zombie Survivors
A 3D Vampire Survivors-like roguelite: auto-fire, gem pickups, three-choice level-ups, a 7-boss story mode plus an endless deathmatch — backed by a global leaderboard on Cloudflare D1.
The seven dimensions
memoryTechnical Depth 6.5/10
Genuine performance engineering at a modest scale: bullets and XP gems ride thin instances with a Float32Array SoA matrix buffer (weapon-system.ts, gem-system.ts CAPACITY=4000), a pre-instantiated pool of 63 skeletal-animated zombies (zombie-horde.ts), a spatial hash grid for neighbor queries (spatial-grid.ts), and Draco-compressed GLBs with a self-hosted decoder (−26 MB). But the horde caps at ~63 concurrent enemies — far from a true swarm — and there is no LOD, no worker, and every algorithm is a linear scan.
stadia_controllerGame Design 7/10
A complete VS loop with its own judgment: 8 characters with trade-offs, 25 capped upgrades, 7 bosses across 5 attack patterns, and a meta shop. The mature calls: jump-dodging contact damage (a movement axis VS lacks), a lifesteal-per-second cap, and a deathmatch level cap of 60 that guarantees every run ends so the leaderboard stays meaningful. Upgrades are mostly numeric stacking — no weapon evolution depth.
securityBackend & Security 5.5/10
A real backend with smart pieces — fully parameterized queries, plausibility validation (kills ≤ time×25+50, sub-200s clears rejected), and a cost-aware presence redesign that writes D1 only ~13% of the time. But there is zero rate limiting on any POST endpoint, deathmatch scores are forgeable with one curl (clamped at 100M vs a legit max ≈ 100k), and the message-board delete key '0501' is hardcoded in the public repo (messages.ts).
codeCode Quality 6.5/10
Strict TypeScript with noUnusedLocals, clean system decomposition (horde / weapons / gems / bosses / sound each in its own module), declarative data-driven content, and dense why-style comments. The flaw: game.ts is a 1,315-line closure factory holding 40+ state variables — a textbook god function — plus three near-identical all-enemy scan loops.
experimentTesting 1.5/10
Zero automated tests, zero CI. No *.test.* files, no vitest/jest, no workflows — the only quality gate is vue-tsc --noEmit inside the build. The backend clamp/sanitize helpers are the most testable pure functions in the repo and remain untested.
verifiedCompleteness 8/10
Astonishing polish for a first work: live deployment, a hand-written intro site, YouTube gameplay video, 11 screenshots, a fully procedural audio stack (all SFX + 4 BGM tracks with music-theory comments), monster codex, message board, an SVG online-count history chart, and three thorough docs (README / GAME.md / BACKEND.md runbook).
emoji_objectsOriginality 5/10
An openly admitted Vampire Survivors clone (the README's first line says so) built on CC0 asset packs — but the additions are real: full 3D with a rotatable camera, jump-dodge as a mechanical difference, a mutator-driven deathmatch, and a social layer this genre rarely has. A genre-follower with its own twist, not a reskin.
trending_upHighlights
- Skeletal-animation zombie pool — 7 types × 9 pre-instantiated animated clones with staggered Run/Walk cycles to break uniformity (
zombie-horde.ts:121-165) - Cost-aware presence — heartbeat polling refactored to check-in-once + ~13% probabilistic maintenance, explicitly to cut Cloudflare Functions/D1 usage (
online.ts:20-33) - Zero-asset audio — every SFX and 4 mood-shifting BGM tracks synthesized in Web Audio with a lookahead scheduler (
sound.ts) - Guaranteed-ending deathmatch — level cap 60 + steepening growth + contact lethality scaling solve the 'nobody ever dies' leaderboard problem (
deathmatch.ts) - Thin-instance weapon pipeline — knife model merged then swapped seamlessly onto the existing matrix buffer, with pierce/crit/freeze modifier chain (
weapon-system.ts:87-118)
trending_downWeaknesses
- Hardcoded delete key
'0501'in the public repo lets anyone wipe the message board (messages.ts:12) - Forgeable deathmatch scores — clamp allows 100,000,000 vs a legit max ≈ 100k; no cross-field consistency check (
run.ts:26) - Zero rate limiting on every POST endpoint — the board can be flooded by a script
- 1,315-line god function —
createGameholds all game state in one closure; story and deathmatch logic interleave (game.ts) - Zero tests, zero CI — even the trivially testable backend validators are untested
smart_toyAI-assisted development
Certain and heavy: the repo ships .claude/launch.json; the primary commit author is a corporate AI account with craig7351 as co-author. On day one, milestones 1 through 6 — from performance prototype to deployed meta-shop build — landed within 100 minutes (18 commits). GAME.md is literally a reskin playbook written for the AI workflow, and leftover penguin/fox models reveal this is itself a full reskin of an earlier animal-themed game.
summarizeFacts
| Stack | Vue 3 · TypeScript · Babylon.js 9 · Tailwind 4 · Vite · CF Pages Functions · D1 |
|---|---|
| Genre | Survivors-like roguelite |
| Period | 2026-06-12 → 2026-07-12 |
| Active dev days | 6 days |
| Commits | 62 |
| Lines of code | ~8,570 |
| Author | craig7351 (Book AI) |
Verdict
Far beyond hobby level for a 'first work': the performance engineering, cost awareness and design judgment are real. But it is a heavily AI-assisted product whose safety net is zero — no tests, soft-validation-only anti-cheat, and a hardcoded secret that should never have shipped.