six-degrees 0.2.0

package/.next/standalone/lib/db.js

@@ -0,0 +1,288 @@
+import {
+  getDb, newId, nowIso, decodeRow, encodeValue,
+} from './db-client.js';
+
+// A supabase-js-shaped query builder over local SQLite.
+//
+// The point is that the twelve API routes keep their existing call chains —
+// .from().select().eq().order().single() and friends — while the data lives in
+// a file on the user's machine instead of a hosted database. Five behaviours
+// are load-bearing and are pinned by tests in tests/db.test.mjs:
+//
+//   1. It RESOLVES to { data, error }. It never rejects, because no call site
+//      wraps these in try/catch expecting a throw.
+//   2. It is thenable AND catchable — several routes await the builder itself
+//      rather than calling a terminal method.
+//   3. It MUTATES and returns `this`. app/api/notifications/route.js calls
+//      q.eq(...) without reassigning the result; an immutable builder would
+//      silently drop that filter with no error and no failing test.
+//   4. .single() yields { data: null, error } when nothing matches.
+//   5. Column names stay snake_case throughout.
+
+const IDENTIFIER = /^[a-z_][a-z0-9_]*$/i;
+
+function assertIdentifier(name, kind) {
+  if (!IDENTIFIER.test(name)) throw new Error(`Unsafe ${kind}: ${name}`);
+  return name;
+}
+
+class QueryBuilder {
+  constructor(table) {
+    this.table = assertIdentifier(table, 'table');
+    this._columns = '*';
+    this._filters = [];      // { sql, params }
+    this._order = null;
+    this._limit = null;
+    this._single = false;
+    this._op = 'select';
+    this._payload = null;
+    this._onConflict = null;
+    this._ignoreDuplicates = false;
+  }
+
+  select(columns = '*') {
+    // On insert/update/delete, .select() only asks for the rows back.
+    if (this._op === 'select') this._columns = columns === '*' ? '*' : columns;
+    this._returning = true;
+    return this;
+  }
+
+  eq(column, value) {
+    assertIdentifier(column, 'column');
+    if (value === null) this._filters.push({ sql: `"${column}" IS NULL`, params: [] });
+    else this._filters.push({ sql: `"${column}" = ?`, params: [encodeValue(this.table, column, value)] });
+    return this;
+  }
+
+  neq(column, value) {
+    assertIdentifier(column, 'column');
+    this._filters.push({ sql: `"${column}" IS NOT ?`, params: [encodeValue(this.table, column, value)] });
+    return this;
+  }
+
+  in(column, values) {
+    assertIdentifier(column, 'column');
+    const list = Array.isArray(values) ? values : [];
+    if (!list.length) {
+      this._filters.push({ sql: '0 = 1', params: [] });   // matches nothing, like PostgREST
+      return this;
+    }
+    this._filters.push({
+      sql: `"${column}" IN (${list.map(() => '?').join(', ')})`,
+      params: list.map((v) => encodeValue(this.table, column, v)),
+    });
+    return this;
+  }
+
+  ilike(column, pattern) {
+    assertIdentifier(column, 'column');
+    // SQLite's LIKE is case-insensitive for ASCII by default, which is the
+    // behaviour ilike callers rely on here.
+    this._filters.push({ sql: `"${column}" LIKE ?`, params: [pattern] });
+    return this;
+  }
+
+  not(column, operator, value) {
+    assertIdentifier(column, 'column');
+    if (operator === 'is' && value === null) {
+      this._filters.push({ sql: `"${column}" IS NOT NULL`, params: [] });
+    } else {
+      this._filters.push({ sql: `NOT ("${column}" = ?)`, params: [encodeValue(this.table, column, value)] });
+    }
+    return this;
+  }
+
+  is(column, value) {
+    assertIdentifier(column, 'column');
+    if (value === null) this._filters.push({ sql: `"${column}" IS NULL`, params: [] });
+    else this._filters.push({ sql: `"${column}" = ?`, params: [encodeValue(this.table, column, value)] });
+    return this;
+  }
+
+  order(column, { ascending = true } = {}) {
+    assertIdentifier(column, 'column');
+    // NULLS LAST on descending sorts matches Postgres' default ordering, which
+    // keeps unscored rows from floating to the top of the galaxy.
+    this._order = `"${column}" ${ascending ? 'ASC' : 'DESC NULLS LAST'}`;
+    return this;
+  }
+
+  limit(n) {
+    this._limit = Number(n) || 0;
+    return this;
+  }
+
+  single() {
+    this._single = true;
+    this._limit = this._limit ?? 1;
+    return this;
+  }
+
+  maybeSingle() {
+    return this.single();
+  }
+
+  insert(rows) {
+    this._op = 'insert';
+    this._payload = Array.isArray(rows) ? rows : [rows];
+    return this;
+  }
+
+  upsert(rows, options = {}) {
+    this._op = 'upsert';
+    this._payload = Array.isArray(rows) ? rows : [rows];
+    this._onConflict = options.onConflict || null;
+    this._ignoreDuplicates = !!options.ignoreDuplicates;
+    return this;
+  }
+
+  update(values) {
+    this._op = 'update';
+    this._payload = values;
+    return this;
+  }
+
+  delete() {
+    this._op = 'delete';
+    return this;
+  }
+
+  _where() {
+    if (!this._filters.length) return { sql: '', params: [] };
+    return {
+      sql: ' WHERE ' + this._filters.map((f) => f.sql).join(' AND '),
+      params: this._filters.flatMap((f) => f.params),
+    };
+  }
+
+  _run() {
+    const db = getDb();
+    const where = this._where();
+
+    if (this._op === 'select') {
+      let sql = `SELECT ${this._columns === '*' ? '*' : this._columns} FROM "${this.table}"${where.sql}`;
+      if (this._order) sql += ` ORDER BY ${this._order}`;
+      if (this._limit != null) sql += ` LIMIT ${Number(this._limit)}`;
+      const rows = db.prepare(sql).all(...where.params).map((r) => decodeRow(this.table, r));
+      if (this._single) {
+        if (!rows.length) return { data: null, error: { message: 'No rows found', code: 'PGRST116' } };
+        return { data: rows[0], error: null };
+      }
+      return { data: rows, error: null };
+    }
+
+    if (this._op === 'insert' || this._op === 'upsert') {
+      const inserted = [];
+      for (const raw of this._payload) {
+        const row = { id: raw.id || newId(), ...raw };
+        if (!row.id) row.id = newId();
+        const cols = Object.keys(row).filter((c) => IDENTIFIER.test(c));
+        const values = cols.map((c) => encodeValue(this.table, c, row[c]));
+        const placeholders = cols.map(() => '?').join(', ');
+        const quoted = cols.map((c) => `"${c}"`).join(', ');
+
+        let sql = `INSERT INTO "${this.table}" (${quoted}) VALUES (${placeholders})`;
+        if (this._op === 'upsert') {
+          if (this._ignoreDuplicates) {
+            sql += ' ON CONFLICT DO NOTHING';
+          } else {
+            const target = this._onConflict
+              ? this._onConflict.split(',').map((c) => `"${c.trim()}"`).join(', ')
+              : '"id"';
+            const assignments = cols
+              .filter((c) => c !== 'id')
+              .map((c) => `"${c}" = excluded."${c}"`)
+              .join(', ');
+            sql += ` ON CONFLICT (${target}) DO UPDATE SET ${assignments || '"id" = "id"'}`;
+          }
+        }
+        try {
+          db.prepare(sql).run(...values);
+          const back = db.prepare(`SELECT * FROM "${this.table}" WHERE id = ?`).get(row.id);
+          if (back) inserted.push(decodeRow(this.table, back));
+        } catch (err) {
+          if (this._op === 'upsert' && /UNIQUE constraint/i.test(err.message)) continue;
+          return { data: null, error: { message: err.message } };
+        }
+      }
+      if (this._single) return { data: inserted[0] ?? null, error: inserted.length ? null : { message: 'Insert returned no row' } };
+      return { data: inserted, error: null };
+    }
+
+    if (this._op === 'update') {
+      const values = { ...this._payload };
+      if ('updated_at' in values === false && this.table === 'linkedin_connections') {
+        values.updated_at = nowIso();
+      }
+      const cols = Object.keys(values).filter((c) => IDENTIFIER.test(c));
+      if (!cols.length) return { data: [], error: null };
+      const assignments = cols.map((c) => `"${c}" = ?`).join(', ');
+      const params = cols.map((c) => encodeValue(this.table, c, values[c]));
+      const sql = `UPDATE "${this.table}" SET ${assignments}${where.sql}`;
+      try {
+        const affected = db.prepare(`SELECT id FROM "${this.table}"${where.sql}`).all(...where.params);
+        db.prepare(sql).run(...params, ...where.params);
+        const rows = affected
+          .map((r) => db.prepare(`SELECT * FROM "${this.table}" WHERE id = ?`).get(r.id))
+          .filter(Boolean)
+          .map((r) => decodeRow(this.table, r));
+        if (this._single) return { data: rows[0] ?? null, error: rows.length ? null : { message: 'No rows updated' } };
+        return { data: rows, error: null };
+      } catch (err) {
+        return { data: null, error: { message: err.message } };
+      }
+    }
+
+    if (this._op === 'delete') {
+      try {
+        const doomed = db.prepare(`SELECT * FROM "${this.table}"${where.sql}`).all(...where.params)
+          .map((r) => decodeRow(this.table, r));
+        db.prepare(`DELETE FROM "${this.table}"${where.sql}`).run(...where.params);
+        return { data: doomed, error: null };
+      } catch (err) {
+        return { data: null, error: { message: err.message } };
+      }
+    }
+
+    return { data: null, error: { message: `Unsupported operation: ${this._op}` } };
+  }
+
+  // Thenable: `await supabase.from(...).select()` works, and so does awaiting
+  // the builder after only calling filters.
+  then(onFulfilled, onRejected) {
+    let result;
+    try {
+      result = this._run();
+    } catch (err) {
+      result = { data: null, error: { message: err.message } };
+    }
+    return Promise.resolve(result).then(onFulfilled, onRejected);
+  }
+
+  catch(onRejected) {
+    return this.then(undefined, onRejected);
+  }
+
+  finally(onFinally) {
+    return this.then(
+      (v) => { onFinally?.(); return v; },
+      (e) => { onFinally?.(); throw e; },
+    );
+  }
+}
+
+export const db = {
+  from(table) {
+    return new QueryBuilder(table);
+  },
+
+  // The cloud build kept three stored procedures. Two are reimplemented in
+  // lib/rpc.js; exec_sql (arbitrary DDL over HTTP) is deliberately not carried
+  // over — a local app has no business executing caller-supplied schema changes.
+  async rpc(name, args = {}) {
+    const { runRpc } = await import('./rpc.js');
+    return runRpc(name, args);
+  },
+};
+
+export default db;

package/.next/standalone/lib/demo.js

@@ -0,0 +1,34 @@
+// The sample network that ships with the app.
+//
+// Every person in public/demo-data.json is invented — see scripts/gen-synthetic.mjs.
+// It exists so a first run has something to show, so screenshots contain no real
+// people, and so the Bridges view can be explored before you have data of your own.
+
+import { saveSessionNetwork } from './csv';
+
+export const IS_DEMO = process.env.NEXT_PUBLIC_DEMO_MODE === 'true';
+
+export const DEMO_USER = {
+  id: 'synthetic-demo-user',
+  name: 'You',
+  headline: 'Sample network',
+};
+
+let _cache = null;
+
+export async function loadDemoNetwork() {
+  if (_cache) return _cache;
+  const res = await fetch('/demo-data.json', { cache: 'no-cache' });
+  if (!res.ok) throw new Error('demo-data.json not found — run: node scripts/gen-synthetic.mjs');
+  const data = await res.json();
+  _cache = { degree1: data.degree1 || [], degree2: data.degree2 || [] };
+  return _cache;
+}
+
+// Loads the sample into this browser tab and reports how big it is. Nothing is
+// written to the database, so it disappears when the tab closes.
+export async function loadSampleIntoSession() {
+  const net = await loadDemoNetwork();
+  saveSessionNetwork({ degree1: net.degree1, degree2: net.degree2, source: 'sample' });
+  return { degree1: net.degree1.length, degree2: net.degree2.length };
+}

package/.next/standalone/lib/gate.js

@@ -0,0 +1,87 @@
+// Decides whether a request to one of the destructive routes is allowed.
+//
+// Split out from middleware.js so the rule can be tested directly: it is pure,
+// takes everything it needs as arguments, and touches no framework types.
+
+// Routes that must never be reachable from another machine. Four of them
+// irreversibly destroy or rewrite data; /api/scraper spawns processes and
+// /api/update changes the code that will run next, both of which are more power
+// than any of the others, so they sit behind the same gate.
+export const DESTRUCTIVE_ROUTES = [
+  '/api/admin-delete',
+  '/api/admin-update',
+  '/api/delete-cluster',
+  '/api/setup-profile',
+  '/api/scraper',
+  '/api/update',
+];
+
+const LOOPBACK = new Set(['127.0.0.1', '::1', 'localhost']);
+
+/**
+ * Is this a write driven by some other website?
+ *
+ * Binding to loopback keeps other machines out, but not the browser on this
+ * one: a page on any site can POST to 127.0.0.1, and with a simple content
+ * type it does so with no preflight. The response stays hidden from them, but
+ * the write still lands — enough to plant data this app later renders.
+ *
+ * Sec-Fetch-Site is set by the browser and cannot be forged by script, so it is
+ * the reliable signal. Origin is the fallback for browsers that omit it.
+ * Non-browser callers (curl, scripts/scrape.py) send neither and are unaffected.
+ */
+export function isCrossSiteWrite({ method, secFetchSite, origin, host }) {
+  if (!method || !['POST', 'PUT', 'PATCH', 'DELETE'].includes(method.toUpperCase())) return false;
+
+  if (secFetchSite) return !['same-origin', 'same-site', 'none'].includes(secFetchSite);
+
+  if (origin) {
+    try {
+      const from = new URL(origin).host;
+      return !!host && from !== host;
+    } catch {
+      return true;   // unparseable Origin — treat as hostile
+    }
+  }
+  return false;      // no browser headers at all: not a browser
+}
+
+export function isDestructive(pathname) {
+  return DESTRUCTIVE_ROUTES.some((p) => pathname === p || pathname.startsWith(`${p}/`));
+}
+
+export function boundToLoopback(bind) {
+  return LOOPBACK.has(String(bind || '').toLowerCase());
+}
+
+function sameSecret(a, b) {
+  if (typeof a !== 'string' || typeof b !== 'string' || a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  return diff === 0;
+}
+
+/**
+ * @param {{ bind?: string, token?: string, bearer?: string }} ctx
+ * @returns {{ allow: boolean, status?: number, reason: string }}
+ *
+ * Note what is absent: the Host and X-Forwarded-For headers. Both are supplied
+ * by the caller and pass through untouched, so neither can prove a request is
+ * local. Only the server's own bind address can.
+ */
+export function gateDecision({ bind, token, bearer }) {
+  if (token && sameSecret(bearer, token)) {
+    return { allow: true, reason: 'valid admin token' };
+  }
+  if (boundToLoopback(bind)) {
+    return { allow: true, reason: 'server is bound to loopback; only this machine can connect' };
+  }
+  if (!token) {
+    return {
+      allow: false,
+      status: 503,
+      reason: 'server is not bound to loopback and no ADMIN_TOKEN is configured',
+    };
+  }
+  return { allow: false, status: 401, reason: 'missing or incorrect admin token' };
+}

package/.next/standalone/lib/ingest.js

@@ -0,0 +1,62 @@
+// Cleaning a batch before it is written. Used by app/api/ingest/route.js.
+
+/**
+ * One record per profile, keeping the first.
+ *
+ * A scraped batch can name the same person more than once — the same profile on
+ * two result pages, or the same mutual connection shown under many results — and
+ * the database's one-row-per-person-per-bridge index then rejects the WHOLE
+ * insert. That is how a bridge's 134 people were read and none saved (TRAPS §32).
+ */
+export function uniqueByProfile(records) {
+  const seen = new Set();
+  return records.filter((r) => {
+    if (!r || !r.profile_url || seen.has(r.profile_url)) return false;
+    seen.add(r.profile_url);
+    return true;
+  });
+}
+
+/**
+ * For someone else's circle (2nd degree) or a company scan, set aside the people
+ * who are already your own connections.
+ *
+ * They arrive as the "mutual connections" links under each search result. They
+ * are not people you have not met, so counting them inflates every circle; and
+ * stored as 2nd-degree they duplicate your own network — the 190 rows a full
+ * rescan once had to merge back.
+ *
+ * @param {object[]} records
+ * @param {Set<string>} firstDegreeUrls  profile URLs that are 1st-degree for this user
+ */
+export function splitAlreadyConnected(records, firstDegreeUrls) {
+  const keep = [];
+  let alreadyConnected = 0;
+  for (const r of records) {
+    if (firstDegreeUrls.has(r.profile_url)) alreadyConnected += 1;
+    else keep.push(r);
+  }
+  return { keep, alreadyConnected };
+}
+
+const MONTHS = ['january', 'february', 'march', 'april', 'may', 'june', 'july',
+  'august', 'september', 'october', 'november', 'december'];
+
+/**
+ * "September 22, 2026" (as LinkedIn prints "Connected on …") → "2026-09-22".
+ *
+ * Parsed by hand rather than with new Date(text).toISOString(): that reads the
+ * text as local midnight and converts to UTC, which moves the date back a day
+ * anywhere east of Greenwich — and throws outright on text it cannot read.
+ * Returns null for anything it does not recognise.
+ */
+export function toIsoDate(text) {
+  const t = String(text || '').trim();
+  if (/^\d{4}-\d{2}-\d{2}$/.test(t)) return t;
+  const m = t.match(/^([A-Za-z]+)\.?\s+(\d{1,2}),?\s+(\d{4})$/);
+  if (!m) return null;
+  const month = MONTHS.findIndex((name) => name.startsWith(m[1].toLowerCase()) && m[1].length >= 3);
+  const day = Number(m[2]);
+  if (month < 0 || day < 1 || day > 31) return null;
+  return `${m[3]}-${String(month + 1).padStart(2, '0')}-${String(day).padStart(2, '0')}`;
+}

package/.next/standalone/lib/linkedin-limits.js

@@ -0,0 +1,118 @@
+// What the Scan page shows about LinkedIn: how much has been searched, the
+// budget, and whether a cooldown is on. The scanner writes these files
+// (scripts/scrape.py, "How much this machine has asked of LinkedIn"); this
+// reads them with the same rules, and writes only the two things a person
+// changes here — the budget, and lifting a cooldown.
+//
+// They belong to the LinkedIn account, not to a profile in the app. TRAPS §35.
+
+import { readFileSync, writeFileSync, renameSync, unlinkSync, existsSync } from 'node:fs';
+import path from 'node:path';
+
+export const DEFAULT_LIMITS = { daily: 50, monthly: 250 };
+export const DAILY_CHOICES = [25, 50, 100, 200, 500];
+export const MONTHLY_CHOICES = [100, 250, 500, 1000, 0];   // 0 = no monthly cap (Premium)
+const DAY = 24 * 3600;
+const PACIFIC = 'America/Los_Angeles';
+
+function readJson(file) {
+  try { return JSON.parse(readFileSync(file, 'utf8')); } catch { return null; }
+}
+
+function writeJsonAtomic(file, data) {
+  const tmp = `${file}.${process.pid}.${Date.now()}.tmp`;
+  writeFileSync(tmp, JSON.stringify(data, null, 2));
+  renameSync(tmp, file);
+}
+
+/** Pacific offset from UTC in hours on a given instant, e.g. -7 or -8. */
+function pacificOffsetHours(ms) {
+  const part = new Intl.DateTimeFormat('en-US', { timeZone: PACIFIC, timeZoneName: 'shortOffset' })
+    .formatToParts(new Date(ms)).find((p) => p.type === 'timeZoneName')?.value || 'GMT-8';
+  const m = part.match(/GMT([+-]\d+)(?::(\d+))?/);
+  return m ? Number(m[1]) : -8;
+}
+
+/** Midnight Pacific on the 1st of the month containing `ms` (LinkedIn's reset), in ms. */
+export function monthStartPacific(ms = Date.now()) {
+  const parts = Object.fromEntries(new Intl.DateTimeFormat('en-US', {
+    timeZone: PACIFIC, year: 'numeric', month: 'numeric',
+  }).formatToParts(new Date(ms)).map((p) => [p.type, p.value]));
+  const y = Number(parts.year), mo = Number(parts.month);
+  // The offset that applies AT midnight, not later that day: daylight saving
+  // can end on the 1st (Nov 1, 2026), and noon's offset put midnight an hour late.
+  let at = Date.UTC(y, mo - 1, 1, 8);
+  for (let i = 0; i < 2; i++) at = Date.UTC(y, mo - 1, 1, -pacificOffsetHours(at));
+  return at;
+}
+
+/** Midnight Pacific on the 1st of next month, in ms. */
+export function nextMonthStartPacific(ms = Date.now()) {
+  const start = monthStartPacific(ms);
+  return monthStartPacific(start + 40 * DAY * 1000);
+}
+
+export function readLimits(dir) {
+  const raw = readJson(path.join(dir, 'scan-limits.json')) || {};
+  const num = (v, d) => (Number.isInteger(v) && v >= 0 ? v : d);
+  return { daily: num(raw.daily, DEFAULT_LIMITS.daily), monthly: num(raw.monthly, DEFAULT_LIMITS.monthly) };
+}
+
+/** Only the offered choices are accepted, like everything else that reaches the scanner. */
+export function writeLimits(dir, { daily, monthly }) {
+  const cur = readLimits(dir);
+  const next = {
+    daily: DAILY_CHOICES.includes(daily) ? daily : cur.daily,
+    monthly: MONTHLY_CHOICES.includes(monthly) ? monthly : cur.monthly,
+  };
+  writeJsonAtomic(path.join(dir, 'scan-limits.json'), next);
+  return next;
+}
+
+/**
+ * Searches in the last 24 hours and since LinkedIn's month began, and profile
+ * views today. An unreadable record reads as the day used up, as the scanner
+ * treats it — failing open would say nothing had been searched.
+ */
+export function usage(dir, now = Date.now()) {
+  const file = path.join(dir, 'linkedin-activity.json');
+  const data = existsSync(file) ? readJson(file) : { searches: [], profiles: [] };
+  if (!data || typeof data !== 'object') return { searchesToday: Infinity, searchesMonth: 0, profilesToday: 0, unreadable: true };
+  const s = (Array.isArray(data.searches) ? data.searches : []).map(Number);
+  const p = (Array.isArray(data.profiles) ? data.profiles : []).map(Number);
+  const dayAgo = now / 1000 - DAY;
+  const month0 = monthStartPacific(now) / 1000;
+  return {
+    searchesToday: s.filter((t) => t > dayAgo).length,
+    searchesMonth: s.filter((t) => t >= month0).length,
+    profilesToday: p.filter((t) => t > dayAgo).length,
+  };
+}
+
+/** The active cooldown { until (ms), reason, setAt }, or null. */
+export function readCooldown(dir, now = Date.now()) {
+  const raw = readJson(path.join(dir, 'linkedin-cooldown.json'));
+  const until = Number(raw?.until) * 1000;
+  if (!raw || !Number.isFinite(until) || until <= now) return null;
+  return { until, reason: String(raw.reason || 'LinkedIn pushed back'), setAt: Number(raw.set_at) * 1000 || null };
+}
+
+/** Lift it: the person says LinkedIn works for them again. */
+export function liftCooldown(dir) {
+  try { unlinkSync(path.join(dir, 'linkedin-cooldown.json')); } catch { /* none to lift */ }
+}
+
+/** Everything the Scan page shows, in one object. */
+export function linkedinState(dir, now = Date.now()) {
+  const limits = readLimits(dir);
+  const use = usage(dir, now);
+  const left = (limit, used) => (limit ? Math.max(0, limit - used) : null);
+  return {
+    ...use,
+    limits,
+    leftToday: left(limits.daily, use.searchesToday),
+    leftMonth: left(limits.monthly, use.searchesMonth),
+    monthResets: nextMonthStartPacific(now),
+    cooldown: readCooldown(dir, now),
+  };
+}

package/.next/standalone/lib/network.js

@@ -0,0 +1,13 @@
+// Client-side loader for the network. Replaces the direct database queries the
+// pages used to run in the browser.
+export async function loadNetwork(userId) {
+  const url = userId ? `/api/network?userId=${encodeURIComponent(userId)}` : '/api/network';
+  const res = await fetch(url);
+  if (!res.ok) throw new Error(`Failed to load network (${res.status})`);
+  const data = await res.json();
+  return {
+    degree1: data.degree1 || [],
+    degree2: data.degree2 || [],
+    degree3: data.degree3 || [],
+  };
+}

package/.next/standalone/lib/paths.js

@@ -0,0 +1,31 @@
+// Where things are on disk. Both API routes that shell out need these, and
+// having two copies is how they drift.
+
+import { existsSync } from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+
+/** The checkout or install root — the folder holding scripts/scrape.py. */
+export function projectRoot() {
+  const candidates = [
+    process.env.SIX_DEGREES_ROOT,
+    process.cwd(),
+    path.join(process.cwd(), '..'),
+    path.join(process.cwd(), '..', '..'),
+  ].filter(Boolean);
+  for (const c of candidates) {
+    if (existsSync(path.join(c, 'scripts', 'scrape.py'))) return c;
+  }
+  return null;
+}
+
+/** Everything personal: database, avatars, browser profile, python env. */
+export function dataDir() {
+  return process.env.SIX_DEGREES_HOME || path.join(os.homedir(), '.six-degrees');
+}
+
+/** True when the app is running from a git checkout rather than an install. */
+export function isGitCheckout() {
+  const root = projectRoot();
+  return Boolean(root && existsSync(path.join(root, '.git')));
+}