The Press

Score. Bet. Settle up.

An offline-first PWA for keeping a golf bet honest. Enter scores hole by hole, pick a game, and the app tracks the money as you play — then shows exactly who owes whom, in the fewest transactions, when you walk off 18.

Games: Wolf (with Hammer and Breakout), Nassau with presses, Skins, Match Play, Stableford, Vegas, Snake, Bingo Bango Bongo, Sixes, Banker, and Trash/Dots.

Running it

The shipped app is one file, index.html — open it, or serve the repository root over HTTP so the service worker registers:

python3 -m http.server 8000

Editing it

index.html is generated. The source is under src/: the markup in src/index.html, the stylesheet in src/css/, and the script in src/js/, one file per area of the app (players, scoring, games, storage, screens, live rounds, …). Edit those, then rebuild and commit both:

npm run build      # reassemble index.html from src/ and data/courses.json
npm run format     # optional: format src/ with Prettier (CI checks it)

The build only concatenates: each <style>/<script> in src/index.html is filled with its folder's files in filename order, so the numeric prefixes are the load order. Nothing is transformed, and the shipped code is exactly the source. npm test fails if index.html is out of date.

Much of the script was recovered from minified code, so many functions still have single-letter parameter names (function (e, t)). Rename them as you touch them.

Tests

The money math is the product, so it has the most tests.

Command	What it covers
npm test	Money math, Wolf/Hammer settlement, the check that index.html is built from the current src/ and course data, and a static design-system audit. A few seconds, no dependencies.
npm run test:flows	Drives a real browser (Playwright) through complete rounds — the only check that sees bugs in the seam between two screens.
npm run test:rules	Runs firestore.rules through the real rules engine in the Firestore emulator. Requires Java.
npm run test:live	Two real browsers sharing one round against the Firestore and Auth emulators and the real security rules — publishing, joining by code, scores and Breakouts crossing the wire, the watch link, and account deletion. Requires Java.

All three run in CI on every push.

Course data

data/courses.json is the single source of truth for the built-in course list; it is inlined into index.html at build time because the app reads COURSE_DB synchronously and has to work with no signal. After editing it, run npm run build and commit both files — npm test fails if they drift.

See data/README.md for the schema and validation rules.

Architecture

Diagrams of the system, the money engine, live rounds, and CI live in docs/architecture.md.

• index.html — the entire application, built from src/: markup, styles, and logic in one file, so the service worker caches one shell and the app opens on a course with no signal. Nothing on the launch path goes to the network. The Firebase SDK in particular is not a blocking <script src>: it is listed in FIREBASE_SDK and fetched by ensureFirebase() on idle, after the first screen is up — as three blocking tags it put 528KB of uncacheable cross-origin JavaScript in front of the scorecard, and in a dead zone the app never opened at all. Anything that genuinely needs the SDK (sign-in, joining a live round, a ?watch= link) awaits ensureFirebase().
• sw.js — the service worker. Caches the shell and static assets individually (never addAll, which fails atomically) and announces updates through the cache so a reloaded page still sees them.
• src/ — the readable source index.html is built from.
• data/, scripts/ — the course database, build.js (which assembles index.html), and the preview builds the browser tests use.
• test/ — money math, Wolf/Hammer settlement, security rules, browser flows, and a static design-system audit.

Local storage is the source of truth. Everything in Firestore is a mirror of what is already on the device, which is why a signed-out player loses nothing.

scripts/build-preview.py produces the two builds the browser tests drive. Both work by rewriting the one FIREBASE_SDK array — emptied for flows.mjs, so ensureFirebase() resolves to "no Firebase" without a request; repointed at node_modules for live-round.test.mjs, which then drives the real SDK against the emulators. Rewriting the list rather than deleting the loader keeps the loader, its retry, and every await ensureFirebase() call site under test.

Backend and security model

Google Sign-In (Firebase Auth) is optional and unlocks cross-device sync, live rounds, and the shared course library. Three Firestore collections:

Collection	Contents	Who can read it
users/{uid}	A private mirror of one player's profiles, courses, and round history	That player only
liveRounds/{code}	A round in progress. The document ID is the six-character share code.	Anyone holding the code
sharedCourses/{slug}	The community course library — course data only, no personal information	Any signed-in player

The share code being the document ID is load-bearing. A round can be fetched by its code and the collection can never be listed by anyone but its own owner, so there is no query that returns rounds you were not invited to.

firestore.rules is the deployed policy, not a copy of it: it is tested in CI (test/rules.test.mjs, 34 cases against the real rules engine) and deployed from .github/workflows/deploy-rules.yml on every push to main that touches it. Editing rules in the Firebase console is how the repository and production drift apart — don't.

Deploying requires a FIREBASE_SERVICE_ACCOUNT repository secret (a service account JSON key with the Firebase Rules Admin role). Without it the workflow still tests the rules and warns instead of deploying.

Legal

• privacy.html and terms.html are served from the site root so they have stable public URLs — app stores require a reachable privacy policy link, and a policy that only exists inside a modal has no URL. The in-app Settings → Legal screens summarise the same text.
• LICENSE — proprietary, all rights reserved.

Before publishing: both policy pages carry a CONTACT EMAIL placeholder and name "The Press" rather than a legal entity. Replace both with the real contact address and the company's registered name once it exists.

The Press is a scorekeeper and a calculator. It never accepts, holds, or transfers money — the settle-up buttons hand off to Venmo, Cash App, or PayPal with an amount pre-filled, and the payment happens between the players in those apps. Keeping it that way is what keeps this a utility rather than a regulated money transmitter or gambling operator.