six-degrees 0.2.0

package/.next/standalone/bin/six-degrees.mjs

@@ -0,0 +1,149 @@
+#!/usr/bin/env node
+/**
+ * Launcher for the published package: `npx six-degrees`.
+ *
+ * Starts the prebuilt server on this machine, opens a browser at it, and stays
+ * in the foreground so Ctrl-C stops it. Nothing is installed globally and
+ * nothing is written outside the data directory.
+ */
+import { createServer } from 'node:net';
+import { spawn } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { existsSync, mkdirSync } from 'node:fs';
+import { homedir, platform } from 'node:os';
+import path from 'node:path';
+
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+const ROOT = path.join(HERE, '..');
+
+// node:sqlite is the database driver and is only available unflagged from
+// 22.13. engines is advisory, so check before anything can fail obscurely.
+const MIN_NODE = [22, 13, 0];
+function checkNode() {
+  const parts = process.versions.node.split('.').map(Number);
+  for (let i = 0; i < MIN_NODE.length; i++) {
+    if ((parts[i] || 0) > MIN_NODE[i]) return;
+    if ((parts[i] || 0) < MIN_NODE[i]) {
+      console.error(
+        `\n  six-degrees needs Node ${MIN_NODE.join('.')} or newer (this is ${process.versions.node}).` +
+        `\n  It uses node:sqlite, which older versions do not provide.\n`
+      );
+      process.exit(1);
+    }
+  }
+}
+
+function parseArgs(argv) {
+  const out = { port: Number(process.env.PORT) || 6363, open: true };
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === '--port' || a === '-p') out.port = Number(argv[++i]);
+    else if (a === '--no-open') out.open = false;
+    else if (a === '--data-dir') process.env.SIX_DEGREES_HOME = argv[++i];
+    else if (a === '--help' || a === '-h') out.help = true;
+    else if (a === '--version' || a === '-v') out.version = true;
+  }
+  return out;
+}
+
+const HELP = `
+  six-degrees — map your professional network as a galaxy, on your own machine
+
+  Usage
+    npx six-degrees [options]
+
+  Options
+    -p, --port <n>      port to listen on (default 6363)
+        --data-dir <p>  where to keep the database (default ~/.six-degrees)
+        --no-open       do not open a browser
+    -h, --help          show this
+    -v, --version       print the version
+
+  Your data stays on this machine. Nothing is uploaded.
+`;
+
+// Walk upward from the requested port rather than failing when it is taken —
+// a port collision is the most common way a local tool wastes someone's time.
+function freePort(start, attempts = 20) {
+  return new Promise((resolve, reject) => {
+    let port = start;
+    const tryPort = () => {
+      const srv = createServer();
+      srv.once('error', () => {
+        srv.close();
+        if (++port - start >= attempts) reject(new Error('no free port found'));
+        else tryPort();
+      });
+      srv.once('listening', () => srv.close(() => resolve(port)));
+      srv.listen(port, '127.0.0.1');
+    };
+    tryPort();
+  });
+}
+
+function openBrowser(url) {
+  const cmd = platform() === 'darwin' ? 'open' : platform() === 'win32' ? 'start' : 'xdg-open';
+  const args = platform() === 'win32' ? ['', url] : [url];
+  try {
+    spawn(cmd, args, { stdio: 'ignore', detached: true, shell: platform() === 'win32' }).unref();
+  } catch {
+    /* a browser that will not open is not worth failing over */
+  }
+}
+
+async function main() {
+  const args = parseArgs(process.argv.slice(2));
+
+  if (args.help) { console.log(HELP); return; }
+  if (args.version) {
+    const { default: pkg } = await import(path.join(ROOT, 'package.json'), { with: { type: 'json' } });
+    console.log(pkg.version);
+    return;
+  }
+
+  checkNode();
+
+  const dataDir = process.env.SIX_DEGREES_HOME || path.join(homedir(), '.six-degrees');
+  if (!existsSync(dataDir)) mkdirSync(dataDir, { recursive: true });
+
+  const server = path.join(ROOT, '.next', 'standalone', 'server.js');
+  if (!existsSync(server)) {
+    console.error(
+      '\n  This package is missing its build output.' +
+      '\n  If you are running from a clone, build it first:  npm run build\n'
+    );
+    process.exit(1);
+  }
+
+  const port = await freePort(args.port);
+  const url = `http://127.0.0.1:${port}`;
+
+  process.env.PORT = String(port);
+  process.env.HOSTNAME = '127.0.0.1';
+  process.env.SIX_DEGREES_BIND = '127.0.0.1';   // read by the destructive-route gate
+  // Tells the Updates panel how to update: a git checkout run from source
+  // updates with git; the npm package (once published) with npx.
+  process.env.SIX_DEGREES_INSTALL = existsSync(path.join(ROOT, '.git')) ? 'source' : 'npm';
+  process.env.SIX_DEGREES_HOME = dataDir;
+  process.env.NEXT_TELEMETRY_DISABLED = '1';
+
+  console.log(`
+  six-degrees
+
+  ▸ Running at   ${url}
+  ▸ Data         ${dataDir}
+
+  Nothing leaves this machine. Press Ctrl-C to stop.
+`);
+
+  // The standalone server resolves its assets relative to its own directory.
+  process.chdir(path.join(ROOT, '.next', 'standalone'));
+  await import(server);
+
+  if (args.open) setTimeout(() => openBrowser(url), 600);
+}
+
+main().catch((err) => {
+  console.error('\n  Failed to start:', err?.message || err, '\n');
+  process.exit(1);
+});

package/.next/standalone/db/schema.js

@@ -0,0 +1,160 @@
+// The database schema, kept as a module rather than a .sql file on disk.
+//
+// It used to be read with fs from process.cwd() + 'db/schema.sql', which
+// works when the app is started from its own directory and fails everywhere
+// else — including from an installed package, which is the whole point of
+// shipping this. Bundlers follow an import; they do not follow a runtime
+// file read.
+//
+// Every statement is CREATE ... IF NOT EXISTS, so applying it is both
+// first-run setup and a no-op on every later boot.
+
+export const SCHEMA_SQL = `-- 6 Degrees — local SQLite schema.
+--
+-- Ported from the Postgres schema this project ran on before it went
+-- local-first. Type mapping: uuid -> TEXT (generated in JS), jsonb and
+-- text[] -> TEXT holding JSON, boolean -> INTEGER 0/1, timestamptz and date
+-- -> TEXT holding ISO-8601. lib/db.js encodes and decodes these so route
+-- code sees the same shapes it always did.
+
+PRAGMA journal_mode = WAL;
+PRAGMA foreign_keys = ON;
+
+CREATE TABLE IF NOT EXISTS users (
+  id                      TEXT PRIMARY KEY,
+  name                    TEXT NOT NULL,
+  headline                TEXT,
+  role                    TEXT,
+  company                 TEXT,
+  industry                TEXT,
+  sectors                 TEXT,            -- JSON array
+  goals                   TEXT,            -- JSON array
+  linkedin_url            TEXT,
+  company_prestige_config TEXT,            -- JSON object
+  created_at              TEXT DEFAULT (datetime('now'))
+);
+
+CREATE TABLE IF NOT EXISTS linkedin_connections (
+  id                      TEXT PRIMARY KEY,
+  degree                  INTEGER NOT NULL DEFAULT 1,
+  source_connection_id    TEXT,
+  name                    TEXT NOT NULL,
+  headline                TEXT,
+  company                 TEXT,
+  role                    TEXT,
+  profile_url             TEXT NOT NULL,
+  profile_image_url       TEXT,
+  connected_date          TEXT,
+  power_score             REAL DEFAULT 0,
+  seniority_score         REAL DEFAULT 0,
+  company_prestige_score  REAL DEFAULT 0,
+  influence_signals       TEXT DEFAULT '{}',   -- JSON
+  tier                    TEXT,
+  is_catalyst             INTEGER DEFAULT 0,   -- boolean
+  catalyst_score          REAL DEFAULT 0,
+  circle_power            REAL DEFAULT 0,
+  circle_s_count          INTEGER DEFAULT 0,
+  circle_a_count          INTEGER DEFAULT 0,
+  circle_elite_pct        REAL DEFAULT 0,
+  unlock_status           TEXT DEFAULT 'locked',
+  unlocked_from_bridge_id TEXT,
+  unlocked_from_name      TEXT,
+  outreach_status         TEXT,
+  scanned_company         TEXT,
+  score_why               TEXT,
+  user_id                 TEXT,
+  image_refreshed_at      TEXT,
+  created_at              TEXT DEFAULT (datetime('now')),
+  updated_at              TEXT DEFAULT (datetime('now'))
+);
+
+-- Mirrors the Postgres uniqueness rule: one row per person, per bridge, per
+-- user. COALESCE keeps NULLs from defeating the constraint the way they would
+-- in a plain UNIQUE index.
+CREATE UNIQUE INDEX IF NOT EXISTS idx_connections_unique_per_user_bridge
+  ON linkedin_connections (
+    profile_url,
+    COALESCE(source_connection_id, ''),
+    COALESCE(user_id, '')
+  );
+
+CREATE INDEX IF NOT EXISTS idx_connections_degree      ON linkedin_connections(degree);
+CREATE INDEX IF NOT EXISTS idx_connections_user        ON linkedin_connections(user_id);
+CREATE INDEX IF NOT EXISTS idx_connections_power       ON linkedin_connections(power_score DESC);
+CREATE INDEX IF NOT EXISTS idx_connections_source      ON linkedin_connections(source_connection_id);
+CREATE INDEX IF NOT EXISTS idx_connections_tier        ON linkedin_connections(tier);
+
+CREATE TABLE IF NOT EXISTS user_stats (
+  id             TEXT PRIMARY KEY,
+  xp             INTEGER DEFAULT 0,
+  level          INTEGER DEFAULT 1,
+  streak_weeks   INTEGER DEFAULT 0,
+  last_scrape_at TEXT,
+  last_active_at TEXT DEFAULT (datetime('now')),
+  created_at     TEXT DEFAULT (datetime('now'))
+);
+
+CREATE TABLE IF NOT EXISTS notifications (
+  id         TEXT PRIMARY KEY,
+  user_id    TEXT,
+  type       TEXT NOT NULL,
+  title      TEXT NOT NULL,
+  message    TEXT,
+  icon       TEXT,
+  seen       INTEGER DEFAULT 0,   -- boolean
+  data       TEXT DEFAULT '{}',   -- JSON
+  created_at TEXT DEFAULT (datetime('now'))
+);
+
+CREATE INDEX IF NOT EXISTS idx_notifications_user ON notifications(user_id, created_at DESC);
+
+CREATE TABLE IF NOT EXISTS queue_items (
+  id            TEXT PRIMARY KEY,
+  connection_id TEXT,
+  profile_url   TEXT NOT NULL UNIQUE,
+  name          TEXT NOT NULL,
+  status        TEXT DEFAULT 'suggested',
+  xp_reward     INTEGER DEFAULT 10,
+  bridge_name   TEXT,
+  created_at    TEXT DEFAULT (datetime('now')),
+  sent_at       TEXT,
+  accepted_at   TEXT,
+  scanned_at    TEXT
+);
+
+-- Company scores you set yourself (lib/scoring.js): they win over the curated
+-- list and over the network estimate. One row per canonical company name.
+CREATE TABLE IF NOT EXISTS company_scores (
+  id          TEXT PRIMARY KEY,
+  name        TEXT NOT NULL UNIQUE,
+  score       REAL NOT NULL,
+  updated_at  TEXT DEFAULT (datetime('now'))
+);
+
+-- Small key/value facts about this install, e.g. which scoring model the
+-- stored scores were computed with.
+CREATE TABLE IF NOT EXISTS app_meta (
+  key    TEXT PRIMARY KEY,
+  value  TEXT
+);
+
+-- Referenced by app/api/setup-profile but absent from the old cloud schema,
+-- so it is created here rather than inherited.
+CREATE TABLE IF NOT EXISTS user_profile (
+  id                      TEXT PRIMARY KEY,
+  user_id                 TEXT,
+  name                    TEXT,
+  headline                TEXT,
+  role                    TEXT,
+  company                 TEXT,
+  industry                TEXT,
+  sectors                 TEXT,   -- JSON array
+  goals                   TEXT,   -- JSON array
+  linkedin_url            TEXT,
+  company_prestige_config TEXT,   -- JSON object
+  created_at              TEXT DEFAULT (datetime('now')),
+  updated_at              TEXT DEFAULT (datetime('now'))
+);
+`;
+
+export default SCHEMA_SQL;

package/.next/standalone/eslint.config.mjs

@@ -0,0 +1,34 @@
+import { defineConfig, globalIgnores } from "eslint/config";
+import nextVitals from "eslint-config-next/core-web-vitals";
+
+const eslintConfig = defineConfig([
+  ...nextVitals,
+  // Override default ignores of eslint-config-next.
+  globalIgnores([
+    // Default ignores of eslint-config-next:
+    ".next/**",
+    "out/**",
+    "build/**",
+    "next-env.d.ts",
+    // The packaged .app is a copy of the build output, not source.
+    "dist/**",
+  ]),
+  {
+    rules: {
+      // Identity and scraper-status are read from localStorage and from a
+      // process on the user's own machine. Neither exists during server
+      // rendering, so the read MUST happen in an effect and its result MUST
+      // land in state — which is exactly what this rule flags. Kept visible as
+      // a warning rather than silenced, so genuine cascading-render bugs still
+      // surface in review.
+      "react-hooks/set-state-in-effect": "warn",
+
+      // Avatars are user-supplied remote URLs (or local files captured by the
+      // scraper) with graceful initial-letter fallbacks. next/image would add a
+      // loader and per-request cost for no benefit here.
+      "@next/next/no-img-element": "off",
+    },
+  },
+]);
+
+export default eslintConfig;

package/.next/standalone/install.sh

@@ -0,0 +1,192 @@
+#!/bin/bash
+# Install 6 Degrees on a Mac with one line:
+#
+#   curl -fsSL https://raw.githubusercontent.com/blakeb056/six-degrees/main/install.sh | bash
+#
+# What it does, in order — nothing else:
+#   1. finds the newest release on GitHub for your Mac's chip (Apple Silicon or Intel)
+#   2. downloads it and checks it against the published SHA-256 checksum
+#   3. copies "Six Degrees.app" into /Applications (or ~/Applications)
+#   4. opens it
+#
+# Why a script and not just the .dmg: the app is not signed with a paid Apple
+# developer certificate, so a .dmg downloaded in a browser makes macOS refuse the
+# first launch until you approve it in System Settings. A file fetched with curl
+# is not marked as "downloaded from the internet", so installed this way it
+# simply opens. The .dmg on the Releases page still works; it just needs that
+# one approval.
+#
+# Your data is never touched: it lives in ~/.six-degrees, not in the app, so
+# running this again later is also how you update.
+#
+# Options (environment variables — put them after the pipe, where the installer
+# runs: `curl -fsSL …/install.sh | SIX_DEGREES_VERSION=0.2.0 bash`):
+#   SIX_DEGREES_VERSION=0.2.0   install a specific release instead of the newest
+#   SIX_DEGREES_DEST=~/Apps     install somewhere else
+#   SIX_DEGREES_NO_OPEN=1       do not open the app afterwards
+#   SIX_DEGREES_DMG=./x.dmg     install a .dmg you already have (skips the download)
+
+# Everything runs inside main(), called on the last line. If the download of
+# this script is cut short, bash never reaches that line and nothing runs —
+# a half-received installer must not half-install.
+
+set -euo pipefail
+
+REPO="blakeb056/six-degrees"
+APP_NAME="Six Degrees"
+
+say()  { printf '  %s\n' "$*"; }
+fail() { printf '\n  ✗ %s\n\n' "$*" >&2; exit 1; }
+
+# Pull one download URL out of the GitHub release JSON. No jq on a stock Mac.
+asset_url() {
+  printf '%s' "$1" | grep -o "\"browser_download_url\": *\"[^\"]*$2\"" | head -1 \
+    | sed 's/.*"\(https[^"]*\)"$/\1/'
+}
+
+# Download the release for this chip into $2, verify it, and print its file name.
+fetch_release() {
+  local arch="$1" tmp="$2" api release dmg_url sums_url file want got
+
+  if [ -n "${SIX_DEGREES_VERSION:-}" ]; then
+    api="https://api.github.com/repos/$REPO/releases/tags/v${SIX_DEGREES_VERSION#v}"
+  else
+    api="https://api.github.com/repos/$REPO/releases/latest"
+  fi
+
+  release="$(curl -fsSL -H 'Accept: application/vnd.github+json' "$api")" \
+    || fail "Could not find a release on GitHub. Check your connection, or see https://github.com/$REPO/releases"
+
+  # Asset names are fixed by scripts/build-app.mjs: Six-Degrees-<version>-<arch>.dmg
+  dmg_url="$(asset_url "$release" "-$arch\\.dmg")"
+  sums_url="$(asset_url "$release" "SHA256SUMS")"
+  [ -n "$dmg_url" ] || fail "That release has no download for this Mac ($arch). See https://github.com/$REPO/releases"
+
+  file="$(basename "$dmg_url")"
+  say "Release:  $file" >&2
+  say "Downloading…" >&2
+  curl -fL --progress-bar -o "$tmp/$file" "$dmg_url" || fail "The download failed. Try again."
+
+  if [ -n "$sums_url" ]; then
+    curl -fsSL -o "$tmp/SHA256SUMS" "$sums_url" || fail "Could not fetch the checksum file."
+    want="$(grep " $file\$" "$tmp/SHA256SUMS" | awk '{print $1}')"
+    got="$(shasum -a 256 "$tmp/$file" | awk '{print $1}')"
+    [ -n "$want" ] || fail "The checksum file does not list $file."
+    [ "$want" = "$got" ] || fail "Checksum mismatch — the download is not what was published. Nothing was installed."
+    say "Verified: SHA-256 matches the release" >&2
+  else
+    say "Note:     this release has no checksum file, so the download was not verified" >&2
+  fi
+
+  printf '%s' "$file"
+}
+
+# A copy that is still running would keep serving the old version, so stop it
+# first. Two processes: the launcher, found by its path, and the server, which
+# cannot be — Next renames its process to "next-server", so no path appears in
+# the process list. The server does sit in the app's folder, though, so find the
+# node processes whose working directory is inside this app. Only those.
+stop_running_copy() {
+  local target="$1" pids p i
+  pids="$(pgrep -f "$target/Contents/MacOS/" 2>/dev/null || true)"
+  pids="$pids $(lsof -a -d cwd -c node -Fpn 2>/dev/null | awk -v t="$target/Contents/" '
+    /^p/ { pid = substr($0, 2) }
+    /^n/ { if (index(substr($0, 2), t) == 1) print pid }' || true)"
+  pids="$(printf '%s\n' $pids | sort -u | grep -v '^$' || true)"
+  [ -n "$pids" ] || return 0
+
+  say "Stopping the running copy so it can be replaced…"
+  # shellcheck disable=SC2086  # a list of pids, split on purpose
+  kill $pids 2>/dev/null || true
+  for i in 1 2 3 4 5 6 7 8 9 10; do
+    for p in $pids; do kill -0 "$p" 2>/dev/null && break; p=""; done
+    [ -z "$p" ] && return 0
+    sleep 0.5
+  done
+  # shellcheck disable=SC2086
+  kill -9 $pids 2>/dev/null || true
+}
+
+main() {
+  printf '\n  6 Degrees — installer\n\n'
+
+  [ "$(uname -s)" = "Darwin" ] || fail "This installer is for macOS. On Linux, run it from source (see the README). Windows isn't supported yet."
+
+  local arch
+  # A Terminal running under Rosetta reports x86_64 even on Apple Silicon, and
+  # would fetch the Intel build. Ask the hardware instead.
+  case "$(uname -m)" in
+    arm64)  arch="arm64" ;;
+    x86_64) if [ "$(sysctl -n hw.optional.arm64 2>/dev/null)" = "1" ]; then arch="arm64"; else arch="x64"; fi ;;
+    *)      fail "Unrecognised Mac chip: $(uname -m)" ;;
+  esac
+  say "Mac:      $arch"
+
+  # Every release bundles Node 24, which needs macOS 13.5, and the Electron app
+  # needs 13. Refuse plainly rather than install an app that cannot start: on an
+  # older Mac it used to install fine and then fail with a generic alert.
+  local macos major minor
+  macos="$(sw_vers -productVersion 2>/dev/null || echo 0)"
+  major="${macos%%.*}"
+  minor="$(printf '%s' "$macos" | cut -d. -f2)"; minor="${minor:-0}"
+  if [ "$major" -lt 13 ] 2>/dev/null || { [ "$major" -eq 13 ] && [ "$minor" -lt 5 ]; }; then
+    fail "Six Degrees needs macOS 13.5 (Ventura) or later. This Mac runs $macos."
+  fi
+  say "macOS:    $macos"
+
+  local tmp
+  tmp="$(mktemp -d)"
+  # shellcheck disable=SC2064  # expand now: tmp is local and gone by exit time
+  trap "hdiutil detach '$tmp/mnt' -quiet >/dev/null 2>&1 || true; rm -rf '$tmp'" EXIT
+
+  # ---- get the disk image --------------------------------------------------
+  local file
+  if [ -n "${SIX_DEGREES_DMG:-}" ]; then
+    [ -f "$SIX_DEGREES_DMG" ] || fail "No file at $SIX_DEGREES_DMG"
+    file="$(basename "$SIX_DEGREES_DMG")"
+    cp "$SIX_DEGREES_DMG" "$tmp/$file"
+    say "Local:    $file (your own file, so no checksum to check)"
+  else
+    file="$(fetch_release "$arch" "$tmp")"
+  fi
+
+  # ---- where it goes -------------------------------------------------------
+  local dest="${SIX_DEGREES_DEST:-/Applications}"
+  dest="${dest/#\~/$HOME}"
+  mkdir -p "$dest" 2>/dev/null || true
+  if [ ! -w "$dest" ]; then
+    dest="$HOME/Applications"
+    mkdir -p "$dest"
+    say "Note:     /Applications is not writable for you, using ~/Applications"
+  fi
+  local target="$dest/$APP_NAME.app"
+
+  # ---- install -------------------------------------------------------------
+  mkdir -p "$tmp/mnt"
+  hdiutil attach "$tmp/$file" -nobrowse -readonly -mountpoint "$tmp/mnt" -quiet \
+    || fail "Could not open the disk image."
+  [ -d "$tmp/mnt/$APP_NAME.app" ] || fail "The disk image does not contain $APP_NAME.app."
+
+  stop_running_copy "$target"
+
+  rm -rf "$target"
+  ditto "$tmp/mnt/$APP_NAME.app" "$target" || fail "Could not copy the app into $dest."
+  hdiutil detach "$tmp/mnt" -quiet >/dev/null 2>&1 || true
+
+  # curl does not mark files as downloaded, so normally there is nothing to
+  # clear. This matters only if the same image reached the Mac another way first.
+  xattr -dr com.apple.quarantine "$target" >/dev/null 2>&1 || true
+
+  say "Installed: $target"
+  say "Your data: ~/.six-degrees (unchanged)"
+
+  if [ -z "${SIX_DEGREES_NO_OPEN:-}" ]; then
+    open "$target"
+    printf '\n  ✓ Opening 6 Degrees. Next time, open it from Applications or Spotlight.\n'
+  else
+    printf '\n  ✓ Done.\n'
+  fi
+  printf '    To update later, run the same command again.\n\n'
+}
+
+main "$@"

package/.next/standalone/jsconfig.json

@@ -0,0 +1,7 @@
+{
+  "compilerOptions": {
+    "paths": {
+      "@/*": ["./*"]
+    }
+  }
+}

package/.next/standalone/lib/app-version.js

@@ -0,0 +1,7 @@
+// This build's version, from package.json, for code that runs on the server.
+// An import attribute rather than a file read: a read resolves against the
+// caller's folder and breaks once the app is installed (TRAPS §4), while an
+// import is resolved at build time and works in the tests too.
+import pkg from '../package.json' with { type: 'json' };
+
+export const APP_VERSION = pkg.version;