six-degrees 0.2.0

package/.next/standalone/CONTRIBUTING.md

@@ -0,0 +1,99 @@
+# Contributing
+
+Thanks for taking a look. This is a small research project, so the bar is
+"does it work and is it honest," not ceremony.
+
+## Ground rule that matters most
+
+**Never commit real network data.** No exported CSVs, no `public/avatars/`, no
+`demo-data.json` built from a real account, no screenshots of real people, no
+credentials. These describe identifiable individuals who did not opt in. CI
+enforces this, but please don't rely on CI to catch it.
+
+When filing an issue, redact names before attaching anything.
+
+## Setup
+
+The README's install line is for people who want to *use* the app. To change it,
+run from source:
+
+```bash
+git clone https://github.com/blakeb056/six-degrees && cd six-degrees && npm install && npm run dev
+```
+
+The `&&`s matter: if the clone fails — most often because a `six-degrees` folder
+from an earlier try is already there — nothing after it runs, instead of quietly
+starting that older copy. Already have a clone? Update it with `npm run update`,
+which also gets past the regenerated `package-lock.json` that makes a plain
+`git pull` refuse.
+
+Needs **Node 22.13+** (`nvm use` reads `.nvmrc`). Opens on <http://localhost:3000>.
+Nothing to configure: no `.env`, no account, no keys. It uses the same data
+folder as the installed app, `~/.six-degrees`; point `SIX_DEGREES_HOME` somewhere
+else to develop against an empty one.
+
+Scraper work also needs Python 3.9+ and Google Chrome — the Scan page sets up
+the Python side. Read `docs/SCRAPING.md` and `docs/brain/TRAPS.md` first.
+
+## Releasing
+
+Bump the version, tag it, push the tag. `.github/workflows/release.yml` builds the
+Mac app for Apple Silicon and Intel, publishes both `.dmg` files and a `SHA256SUMS`
+file on a GitHub Release (which is what `install.sh` downloads), and publishes to
+npm when an `NPM_TOKEN` secret is set.
+
+```bash
+npm version 0.2.0 --no-git-tag-version
+git commit -am "Release 0.2.0" && git tag v0.2.0 && git push --follow-tags
+```
+
+To try a packaged build locally: `npm run build:app`, then
+`SIX_DEGREES_DMG=dist/Six-Degrees-<version>-arm64.dmg bash install.sh`.
+
+The picture behind the `.dmg` window is `scripts/dmg/background.html`. After changing
+it, run `node scripts/make-dmg-background.mjs` (needs Google Chrome) and commit the
+`.tiff` it writes; the build only copies that file. Its layout and the icon positions in
+`scripts/build-app.mjs` are one design — change them together.
+
+## Before opening a PR
+
+```bash
+npm run lint
+npm test
+npm run build
+```
+
+Keep changes focused. Match the surrounding style rather than reformatting:
+this codebase is plain JavaScript with inline style objects, and consistency
+beats personal preference.
+
+## Screenshots
+
+The images in the README are generated, never hand-captured, so they can never
+accidentally contain a real person:
+
+```bash
+npm run dev
+python3 scripts/screenshots.py        # writes docs/img/*.png
+```
+
+It runs against the sample network only. If you change the UI in a way the
+README shows, regenerate rather than cropping a screenshot of your own data.
+
+## Commit messages
+
+Explain **why**, not just what. A one-line subject, then a body if the change
+isn't self-evident.
+
+## Scope
+
+Bug fixes, accessibility, performance, and documentation are always welcome.
+Before building a large feature, open an issue first — the project has a
+deliberate shape and not every idea fits it.
+
+## A note on scraping
+
+Anything that automates LinkedIn carries Terms-of-Service risk for the person
+running it. Contributions that make scraping more aggressive, add credential
+handling, or work around LinkedIn's protections will be declined. The official
+CSV export is the supported path.

package/.next/standalone/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Blake Burford
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/.next/standalone/README.md

@@ -0,0 +1,265 @@
+<h1 align="center">Six Degrees</h1>
+
+<p align="center">
+  <em>Map your LinkedIn network as a galaxy — see who bridges you to everyone else,<br />
+  and find the shortest path to someone you haven't met.</em>
+</p>
+
+<p align="center">
+  <a href="https://github.com/blakeb056/six-degrees/releases/latest/download/Six-Degrees-Mac-Apple-Silicon.dmg"><img src="https://img.shields.io/badge/Download-Apple%20Silicon%20(M1%20or%20newer)-2ea44f?style=for-the-badge&logo=apple&logoColor=white" alt="Download for a Mac with Apple Silicon (M1 or newer)"></a>
+  &nbsp;
+  <a href="https://github.com/blakeb056/six-degrees/releases/latest/download/Six-Degrees-Mac-Intel.dmg"><img src="https://img.shields.io/badge/Download-Intel%20Mac-555555?style=for-the-badge&logo=apple&logoColor=white" alt="Download for a Mac with an Intel processor"></a>
+</p>
+
+<p align="center"><sub>Free Mac app · macOS 13.5 or later · <a href="#install-it">how to install</a> · <a href="https://github.com/blakeb056/six-degrees/releases/latest">what's new</a></sub></p>
+
+<p align="center">
+  <img src="docs/img/app-window.png" alt="Six Degrees on a Mac: your network drawn as circles around you, the most powerful people closest" width="100%">
+</p>
+
+<p align="center"><sub>Every person shown in this README is invented — see <a href="scripts/gen-synthetic.mjs"><code>gen-synthetic.mjs</code></a>.</sub></p>
+
+---
+
+Your network has a shape, and you can't see it. Six Degrees draws it: everyone you
+know placed on rings by how much they can open up for you, the handful of people
+whose own circles reach the furthest, and the shortest chain from you to a stranger
+worth meeting.
+
+It's a Mac app. It runs on your computer, against your own data, with no account and
+no server. (Inside the app the logo reads *6 Degrees*; in Applications it's **Six
+Degrees**.)
+
+## Install it
+
+**Which download?** Apple menu → **About This Mac**. If it says "Chip: Apple M…", take
+**Apple Silicon**. If it says "Processor: …Intel…", take **Intel**. It needs **macOS 13.5
+(Ventura) or later**, and it's about 185 MB.
+
+**The first time you open it**, macOS stops it, because the app isn't signed with a
+paid Apple certificate yet:
+
+1. Open the file you downloaded (**Six-Degrees-Mac-….dmg**, in your Downloads folder).
+   In the window that opens, drag **Six Degrees** onto the **Applications** folder.
+2. Open **Six Degrees** from Applications. macOS says it can't check the app for
+   malware. Close that message with **Done** (on macOS 13 or 14 it may say **OK** or
+   **Cancel**). Anything except *Move to Trash*.
+3. Open **System Settings → Privacy & Security**, scroll down to *"Six Degrees" was
+   blocked*, and click **Open Anyway**. Confirm with **Open** (and your password if
+   asked).
+
+That's once per download; after that it opens like any app.
+
+**Or install it from Terminal** (no approval step). Press ⌘ Space, type *Terminal* and
+press Return. Paste this line into the window that opens and press Return:
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/blakeb056/six-degrees/main/install.sh | bash
+```
+
+It downloads the right version for your Mac, checks the file is exactly the one
+published here, puts **Six Degrees** in Applications and opens it.
+[Read the script](install.sh) first if you like.
+
+**Updating.** Choose *Six Degrees → Check for Updates…*, scroll to **Updates** at the
+bottom of the page that opens, and click **Check for updates**. Nothing checks by
+itself. If there's a newer version, it gives you the Terminal line to paste, which
+replaces the app even while it's running. Downloading the new `.dmg` works too; you'll
+repeat step 3 once for it.
+
+Your network isn't stored in the app. It's in a hidden folder in your home folder,
+`.six-degrees` (open it any time with *Help → Show the Data Folder*), so updates never
+touch it. Each new version also copies your data into its `backups` folder before it
+first opens it.
+
+**Linux:** run it from source (below); it's tested on Ubuntu.
+**Windows:** not yet. A Windows app is planned; nothing is released.
+
+<details>
+<summary>Run it from source (Linux, or a Mac without the app)</summary>
+
+Needs **Node 22.13 or later** and git.
+
+```bash
+git clone https://github.com/blakeb056/six-degrees.git
+cd six-degrees
+npm ci
+npm run build
+npm run start:packaged      # opens http://127.0.0.1:6363 in your browser
+```
+
+To update later: stop it (Ctrl-C), then
+`git pull && npm ci && npm run build && npm run start:packaged`.
+Scanning LinkedIn also needs Python 3.9+ and Google Chrome (see below).
+</details>
+
+## Before you scan LinkedIn
+
+> [!WARNING]
+> **Scanning drives your own LinkedIn account, and LinkedIn may restrict accounts that
+> do this.** Automating LinkedIn may break its User Agreement. It has happened twice
+> while building this:
+> - The account was temporarily restricted after about 20 profile views in one sitting
+>   (2026-09-09); it was lifted the same evening.
+> - Search was blocked after results were read too fast (2026-09-24).
+>
+> The scanner now reads slowly and keeps to a search budget (by default 50 a day and 250
+> a month; you can change it on the Scan page). It locks itself during a cooldown, and
+> stops at the first sign of push-back. The risk is still yours.
+>
+> **The CSV import and the sample network carry no LinkedIn risk at all.** Details:
+> [`docs/SCRAPING.md`](docs/SCRAPING.md).
+
+## First run
+
+The app opens on a welcome screen with three ways in, and asks nothing about you:
+
+- **Scan my LinkedIn**: a guided page that ticks each step off as it goes. It sets up
+  the scanner in one click, you sign into LinkedIn yourself in a Chrome window, and then
+  it scans. Needs Google Chrome (in Applications) and Python 3.9+; the page checks that
+  both are installed and says what's missing. The app marks this *Recommended* because
+  it's the only way to Degrees and Outlink. Read the warning above first.
+- **Import my LinkedIn CSV**: LinkedIn's official export, read on your machine. On
+  LinkedIn: **Settings & Privacy → Data privacy → Get a copy of your data →
+  Connections**. LinkedIn emails a link in about ten minutes; unzip it and drop
+  `Connections.csv` into the app.
+- **Explore a sample network**: 150 invented connections and the 598 invented people
+  they know. Click through before deciding anything.
+
+|  | Your scan | Your `Connections.csv` | Sample network |
+|---|---|---|---|
+| Setup | Python + Chrome, once | ~10 min (LinkedIn emails the file) | none |
+| Network Circle, Paths | ✅ | ✅ | ✅ |
+| **Degrees** (people you *haven't* met) | ✅ | — | ✅ |
+| **Outlink** (getting introduced) | ✅ | — | — |
+| Profile photos | ✅ | initials | initials |
+| LinkedIn account risk | **yes**, see above | none | none |
+
+**The CSV is the safe path, and deliberately the shallower one.** LinkedIn's export only
+contains people you're already connected to, so Degrees and Outlink, the views about
+people you *haven't* met, have nothing to draw. That data exists in no official export;
+the scanner is the only way to it, and it's opt-in for that reason.
+
+While the sample or a CSV is loaded, the top bar shows *Sample network ×* or *Your CSV
+×* (click × to go back), and Outlink and Scan are hidden. Neither is ever added to your
+network: they last as long as the app's window is open.
+
+## What it does
+
+**Network Circle.** Everyone you know, on rings by tier, the most powerful closest to
+you. Switch the drawing between **Galaxy**, **Orbit**, **Pyramid** and **List** in the
+panel on the left.
+
+**Degrees** *(needs a scan or the sample)*. The people two steps away. **Separation**
+ranks every one of them with every way in: which of your connections knows them, and
+how many do. **Orbit**, **Bridge Chains**, **Revolver**, **Pyramid** and **List** draw
+the same people differently.
+
+<img src="docs/img/degrees.png" alt="Degrees → Separation: people two steps away, ranked, each with the connection who can introduce you" width="100%">
+
+**Paths.** Your network by company and industry, in the spirit of LinkedIn's old
+InMaps:
+- **Map**: your companies as bubbles (the 140 largest), grouped by industry and linked
+  where your connections at one know people at another.
+- **Industries**: a card per industry.
+- **Companies**: pick one to see its people level by level, up to the top.
+- **Scores**: every scanned company's score, which you can change.
+
+Click a company for its analyzer: who you know there, who you can reach, the warmest way
+in, and its most powerful people.
+
+<img src="docs/img/paths.png" alt="Paths → Map with the company analyzer open: companies grouped by industry, and one company's people by level and ways in" width="100%">
+
+**Outlink** *(needs a scan)*. Getting introduced, as a game. Each mapped connection's
+circle offers its best five people at a time; mark invites as sent to fill the ring and
+unlock the next five. It also shows the next best moves, levels and points (from
+invites sent and people who accepted, never from browsing).
+
+**Scan.** The guided scanner. It shows progress, the budget that's left, the cooldown
+lock, and a **Paused** list you can carry on from.
+
+## How scoring works
+
+```
+power = title × (0.45 + 0.055 × company score) + reach bonus + bridge boost
+tiers:  S ≥ 7.5   A ≥ 5.5   B ≥ 4.0   C ≥ 2.5   D < 2.5
+```
+
+- **Title (1–10)** comes from someone's current role in their headline, with former
+  roles at 70%; current students are capped.
+- **Company score (1–10)** is the one you set (Paths → Scores) if there is one. Otherwise
+  it comes from a list of well-known companies, or from how many of your people work
+  there.
+- Multiplying means seniority counts for more at a bigger company. A VP at a company
+  scored 10 gets 9.0; a founder at an unknown company, 6.7.
+- **Reach bonus (up to 1.5)**: investor, YC, an audience in the millions. It counts half
+  at an unknown company, because headlines are self-written.
+- **Bridge boost (up to 1)**: someone whose mapped circle is unusually strong.
+
+Scanned and sample people show the working ("VP / Partner / GM (9) · Snap (9/10) · +0.7
+strong circle"). A CSV import shows the score only, and uses the built-in company list
+rather than your own scores. The model is [`lib/scoring.js`](lib/scoring.js), explained
+in [`docs/brain/SCORING.md`](docs/brain/SCORING.md).
+
+It estimates **network position**, not what anyone is worth as a person.
+
+## Privacy
+
+- Your network is stored on your computer and nowhere else. No account, no server, no
+  telemetry, no analytics, no crash reporting.
+- A CSV import is read on your machine and never added to your network. It's held only
+  in the app window's own storage, and you import it again next time.
+- The app contacts only these, and only when you act:
+  - **LinkedIn**, while you scan. Also, until a profile photo has been saved to your
+    computer, the app shows it straight from LinkedIn's image server.
+  - **PyPI** (the Python package library), once, to download the scanner's add-ons.
+  - **GitHub**, only when you click *Check for updates*, to read the newest version
+    number.
+  
+  Nothing about you is sent, and nothing checks on its own.
+- The web framework's own anonymous usage stats are turned off.
+
+See [SECURITY.md](SECURITY.md) for the threat model.
+
+## How your data is stored
+
+```
+.six-degrees/               in your home folder (hidden)
+├── six-degrees.sqlite      your network: connections, scores, tiers, queue
+├── backups/                a copy of the database before each new version touches it
+├── avatars/                profile photos, if you scan
+├── chrome-profile/         the scanner's Chrome sign-in, if you scan (see below)
+├── venv/                   the scanner's Python add-ons, if you set it up
+├── pushback/               what LinkedIn's page said if it ever pushed back
+└── *.json                  the scanner's budget, cooldown, progress and skip lists
+```
+
+**To remove everything:** quit the app and drag **Six Degrees** from Applications to the
+Trash. Then in Finder choose **Go → Go to Folder…** (⇧⌘G), paste `~/.six-degrees` and
+move that folder to the Trash. Do the same for
+`~/Library/Application Support/Six Degrees`, the app window's own storage and cache
+(it can include a CSV you imported).
+
+> [!WARNING]
+> `chrome-profile/` holds a **real, signed-in LinkedIn session**. It's the one thing here
+> that grants access to your account. Never copy it, sync it or share it. Deleting it
+> just means signing in again.
+
+## Configuration (for developers)
+
+Nothing to configure. Two optional environment variables exist:
+
+| Variable | Purpose |
+|---|---|
+| `SIX_DEGREES_HOME` | Where your data lives. Defaults to `~/.six-degrees`. It's read at launch, so it applies when you run from source, not when the Mac app is opened from the Dock or Finder. |
+| `ADMIN_TOKEN` | Not needed on your own computer. The app listens only on 127.0.0.1 and isn't built to be exposed: don't put it behind a tunnel or bind it to another address ([SECURITY.md](SECURITY.md)). If it's ever bound elsewhere, the six routes that delete data, run the scanner or update a copy run from source refuse every caller without this token, including the app's own buttons. Everything else, including reading your whole network, stays open. |
+
+## Contributing
+
+See [CONTRIBUTING.md](CONTRIBUTING.md). The rule that matters most: **never commit real
+network data**. That means no exported CSVs, no avatars, and no screenshots of real
+people.
+
+## License
+
+MIT © Blake Burford — see [LICENSE](LICENSE).

package/.next/standalone/SECURITY.md

@@ -0,0 +1,46 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+Please report security issues privately through
+[GitHub Security Advisories](https://github.com/blakeb056/six-degrees/security/advisories/new)
+rather than opening a public issue. Expect an initial response within a week.
+
+## Threat model
+
+This app is designed to run **on your own machine, against your own network**.
+
+- The web UI binds to localhost. It is not hardened for exposure to the
+  internet, and it has no multi-user authentication or per-user authorization.
+- Four API routes (`admin-delete`, `admin-update`, `delete-cluster`,
+  `setup-profile`) can irreversibly destroy or rewrite data. On localhost they
+  are allowed without a token — anyone who can reach 127.0.0.1 can already open
+  the database file directly, so a token there adds friction rather than
+  safety. Reached from any other host they require `ADMIN_TOKEN` as a bearer,
+  and refuse to run when it is unset.
+- A localhost-bound service is still reachable by any web page you visit — the
+  binding keeps other machines out, not your own browser. Every mutating API
+  request is therefore refused when the browser reports it came from another
+  site (`Sec-Fetch-Site`, with `Origin` as a fallback). Command-line callers
+  such as the scraper send neither header and are unaffected.
+- Values stored in the database are treated as untrusted text and escaped
+  before rendering. Do not reintroduce `innerHTML` (including d3's `.html()`)
+  for anything data-bearing.
+- Do not bind this app to `0.0.0.0` or expose it through a tunnel.
+
+## Your data
+
+Everything stays local:
+
+- A CSV import is parsed in the browser and held for that tab only. It is never
+  uploaded and never written to a database.
+- Scraped data and cached avatars are written to your machine and are gitignored.
+- There is no telemetry, no analytics, and no crash reporting.
+
+If you run the scraper, `chrome-profile/` in the data directory holds a live
+logged-in LinkedIn session. Never copy, sync, or commit it.
+
+Never commit `public/avatars/` or any exported CSV — they contain real people.
+`public/demo-data.json` is committed, but only ever as the generated synthetic
+sample; CI fails the build if it appears without its `"synthetic":true` marker,
+or if avatars or a raw export show up.

package/.next/standalone/app/api/admin-delete/route.js

@@ -0,0 +1,18 @@
+import { db as supabase } from '../../../lib/db';
+
+export async function POST(request) {
+  try {
+    const { profileUrl } = await request.json();
+    if (!profileUrl) return Response.json({ error: 'Missing profileUrl' }, { status: 400 });
+
+    const { error } = await supabase
+      .from('linkedin_connections')
+      .delete()
+      .eq('profile_url', profileUrl);
+
+    if (error) return Response.json({ error: error.message }, { status: 500 });
+    return Response.json({ success: true });
+  } catch (err) {
+    return Response.json({ error: err.message }, { status: 500 });
+  }
+}

package/.next/standalone/app/api/admin-update/route.js

@@ -0,0 +1,23 @@
+import { db as supabase } from '../../../lib/db';
+
+export async function POST(request) {
+  try {
+    const { profileUrl, updates } = await request.json();
+    if (!profileUrl || !updates) {
+      return Response.json({ error: 'Missing profileUrl or updates' }, { status: 400 });
+    }
+
+    const { error } = await supabase
+      .from('linkedin_connections')
+      .update(updates)
+      .eq('profile_url', profileUrl);
+
+    if (error) {
+      return Response.json({ error: error.message }, { status: 500 });
+    }
+
+    return Response.json({ success: true });
+  } catch (err) {
+    return Response.json({ error: err.message }, { status: 500 });
+  }
+}

package/.next/standalone/app/api/bridges/route.js

@@ -0,0 +1,43 @@
+import { db as supabase } from '../../../lib/db';
+
+// Which connections already have a mapped circle.
+//
+// This used to be answered by pulling every 2nd-degree row and collecting the
+// distinct source ids — with a limit of 2000. Past that many, the answer was
+// silently wrong: bridges that had been mapped looked unmapped, so a resumed
+// auto-bridge run scraped them all over again. On a real database with 2,738
+// 2nd-degree rows, 738 of them were invisible.
+//
+// One row per bridge instead of one per person: a few dozen, not a few thousand,
+// and no limit to outgrow.
+
+export async function GET(request) {
+  try {
+    const { searchParams } = new URL(request.url);
+    const userId = searchParams.get('userId');
+
+    let q = supabase
+      .from('linkedin_connections')
+      .select('source_connection_id')
+      .eq('degree', 2);
+    if (userId) q = q.eq('user_id', userId);
+
+    const { data, error } = await q;
+    if (error) return Response.json({ error: error.message }, { status: 500 });
+
+    const counts = {};
+    for (const row of data || []) {
+      const id = row.source_connection_id;
+      if (!id) continue;
+      counts[id] = (counts[id] || 0) + 1;
+    }
+
+    return Response.json({
+      bridgeIds: Object.keys(counts),
+      counts,
+      total: Object.keys(counts).length,
+    });
+  } catch (err) {
+    return Response.json({ error: err.message }, { status: 500 });
+  }
+}

package/.next/standalone/app/api/bulk-import/route.js

@@ -0,0 +1,90 @@
+import { db as supabase } from '../../../lib/db';
+
+const CORS_HEADERS = {
+  'Access-Control-Allow-Origin': '*',
+  'Access-Control-Allow-Methods': 'POST, OPTIONS',
+  'Access-Control-Allow-Headers': 'Content-Type',
+};
+
+// CORS preflight
+export async function OPTIONS() {
+  return new Response(null, { status: 204, headers: CORS_HEADERS });
+}
+
+// Bulk import connections for a specific user
+// Used when importing scraped data from another session
+export async function POST(request) {
+  try {
+    const { connections, userId } = await request.json();
+    if (!connections || !Array.isArray(connections) || !userId) {
+      return Response.json({ error: 'Missing connections array or userId' }, { status: 400, headers: CORS_HEADERS });
+    }
+
+    // Parse each connection
+    const records = connections.map(c => {
+      const headline = (c.headline || '').trim();
+      const nameParts = headline.split(' at ');
+      const role = nameParts[0] || '';
+      const company = nameParts[1]?.split('|')[0]?.trim() || '';
+
+      return {
+        degree: 1,
+        name: (c.name || '').trim(),
+        headline: headline.substring(0, 200),
+        company: company.substring(0, 100),
+        role: role.substring(0, 100),
+        profile_url: (c.profileUrl || c.profile_url || '').trim(),
+        profile_image_url: c.imageUrl || c.profile_image_url || null,
+        user_id: userId,
+      };
+    }).filter(r => r.name && r.profile_url);
+
+    if (records.length === 0) {
+      return Response.json({ error: 'No valid records' }, { status: 400, headers: CORS_HEADERS });
+    }
+
+    // Check which already exist for this user
+    const urls = records.map(r => r.profile_url);
+    const existingUrls = new Set();
+    for (let i = 0; i < urls.length; i += 100) {
+      const batch = urls.slice(i, i + 100);
+      const { data: existing } = await supabase
+        .from('linkedin_connections')
+        .select('profile_url')
+        .eq('user_id', userId)
+        .in('profile_url', batch);
+      (existing || []).forEach(e => existingUrls.add(e.profile_url));
+    }
+
+    const newRecords = records.filter(r => !existingUrls.has(r.profile_url));
+
+    if (newRecords.length === 0) {
+      return Response.json({ success: true, imported: 0, skipped: records.length, message: 'All connections already exist' }, { headers: CORS_HEADERS });
+    }
+
+    // Insert in batches of 200
+    let imported = 0;
+    for (let i = 0; i < newRecords.length; i += 200) {
+      const batch = newRecords.slice(i, i + 200);
+      const { error } = await supabase.from('linkedin_connections').insert(batch);
+      if (error) {
+        console.error('Bulk import batch error:', error);
+      } else {
+        imported += batch.length;
+      }
+    }
+
+    // Trigger scoring
+    try { await supabase.rpc('score_new_connections'); } catch (e) { /* optional */ }
+
+    return Response.json({
+      success: true,
+      imported,
+      skipped: records.length - newRecords.length,
+      total: records.length,
+    }, { headers: CORS_HEADERS });
+  } catch (err) {
+    console.error('Bulk import error:', err);
+    return Response.json({ error: err.message }, { status: 500, headers: CORS_HEADERS });
+  }
+}

package/.next/standalone/app/api/company-scores/route.js

@@ -0,0 +1,62 @@
+import { getDb, newId, nowIso } from '../../../lib/db-client';
+import { rescoreAll, companyOverrides } from '../../../lib/rpc';
+import { rolesWithCompanies, companyScore, KNOWN_COMPANIES } from '../../../lib/scoring';
+import { industryOf } from '../../../lib/companies';
+
+// Every company in your network with the score it gets and where that score
+// comes from — and the one place to set your own. Setting or clearing a score
+// rescores everyone, since a person's power depends on their company's.
+
+export async function GET() {
+  try {
+    const db = getDb();
+    const rows = db.prepare('SELECT id, degree, headline, role, company, scanned_company, profile_url, tier FROM linkedin_connections').all();
+    const overrides = companyOverrides(db);
+    const byName = new Map();
+    const seen = new Set();
+    for (const r of rows) {
+      for (const role of rolesWithCompanies(r)) {
+        if (!role.company || role.former) continue;
+        const key = `${role.company}|${r.profile_url || r.id}`;
+        if (seen.has(key)) continue;
+        seen.add(key);
+        const c = byName.get(role.company) || { name: role.company, people: 0, d1: 0, senior: 0, S: 0, A: 0, headline: r.headline };
+        c.people++;
+        if (r.degree === 1) c.d1++;
+        if (role.title.level >= 4) c.senior++;
+        if (r.tier === 'S') c.S++;
+        if (r.tier === 'A') c.A++;
+        byName.set(role.company, c);
+      }
+    }
+    const companies = [...byName.values()].map((c) => {
+      const industry = industryOf(c.name, c.headline);
+      const { score, source } = companyScore(c.name, { overrides, headcount: c.people, industry: industry.key });
+      const known = KNOWN_COMPANIES.find(([n]) => n === c.name);
+      return { ...c, headline: undefined, score, source, suggested: known ? known[1] : null, industry: { key: industry.key, label: industry.label, color: industry.color } };
+    }).sort((a, b) => b.people - a.people || b.score - a.score);
+    return Response.json({ companies });
+  } catch (err) {
+    return Response.json({ error: err.message }, { status: 500 });
+  }
+}
+
+export async function POST(request) {
+  try {
+    const { name, score } = await request.json();
+    if (!name || typeof name !== 'string') return Response.json({ error: 'name is required' }, { status: 400 });
+    const db = getDb();
+    if (score === null || score === undefined || score === '') {
+      db.prepare('DELETE FROM company_scores WHERE name = ?').run(name);
+    } else {
+      const n = Number(score);
+      if (!Number.isFinite(n) || n < 1 || n > 10) return Response.json({ error: 'score must be 1–10' }, { status: 400 });
+      db.prepare(`INSERT INTO company_scores (id, name, score, updated_at) VALUES (?, ?, ?, ?)
+        ON CONFLICT(name) DO UPDATE SET score = excluded.score, updated_at = excluded.updated_at`).run(newId(), name, n, nowIso());
+    }
+    const result = rescoreAll();
+    return Response.json({ success: true, ...result });
+  } catch (err) {
+    return Response.json({ error: err.message }, { status: 500 });
+  }
+}