six-degrees 0.2.1 → 0.3.0

package/lib/companies.js

@@ -1,4 +1,4 @@
-import { readTitle, currentCompany } from './scoring.js';
+import { readTitle, currentCompany, rolesWithCompanies, networkCompanies } from './scoring.js';
 // Companies and industries across your network — what the Paths analyzer is
 // built on. Plain functions, no React, so tests/companies.test.mjs runs them.
 //
@@ -6,99 +6,6 @@ import { readTitle, currentCompany } from './scoring.js';
 // industry is inferred from the company name and headline, and labelled
 // "inferred" wherever it is shown. Unclear stays unclear rather than guessed.
 
-// Merge company name variants
-export function normalizeCompany(name) {
-  const n = (name || '').trim().toLowerCase();
-  // Social / Media
-  if (n.includes('snap') && (n.includes('inc') || n === 'snap' || n === 'snapchat')) return 'Snap';
-  if (n.includes('meta') && (n.includes('platform') || n === 'meta' || n.includes('facebook'))) return 'Meta';
-  if (n.includes('tiktok') || n.includes('bytedance')) return 'TikTok';
-  if (n.includes('pinterest')) return 'Pinterest';
-  // Big Tech
-  if (n === 'google' || n.includes('alphabet') || (n.includes('google') && n.includes('llc'))) return 'Google';
-  if (n === 'apple' || n === 'apple inc' || n === 'apple inc.') return 'Apple';
-  if (n.includes('amazon') && !n.includes('amazon ')) return 'Amazon';
-  if (n.includes('microsoft')) return 'Microsoft';
-  // AI
-  if (n.includes('anthropic')) return 'Anthropic';
-  if (n.includes('openai') || n === 'open ai') return 'OpenAI';
-  if (n.includes('deepmind')) return 'DeepMind';
-  if (n.includes('cohere')) return 'Cohere';
-  if (n.includes('mistral')) return 'Mistral';
-  if (n.includes('hugging') && n.includes('face')) return 'Hugging Face';
-  // Fintech / Crypto
-  if (n.includes('stripe')) return 'Stripe';
-  if (n.includes('coinbase')) return 'Coinbase';
-  if (n.includes('polymarket')) return 'Polymarket';
-  if (n.includes('blackrock')) return 'BlackRock';
-  if (n.includes('robinhood')) return 'Robinhood';
-  // Growth / Commerce
-  if (n.includes('whatnot')) return 'Whatnot';
-  if (n.includes('shopify')) return 'Shopify';
-  if (n.includes('palantir')) return 'Palantir';
-  if (n.includes('anduril')) return 'Anduril';
-  if (n.includes('netflix')) return 'Netflix';
-  if (n.includes('spotify')) return 'Spotify';
-  if (n.includes('tesla')) return 'Tesla';
-  if (n.includes('spacex')) return 'SpaceX';
-  if (n.includes('nvidia')) return 'NVIDIA';
-  // Defense / Aerospace
-  if (n.includes('lockheed')) return 'Lockheed Martin';
-  if (n.includes('northrop')) return 'Northrop Grumman';
-  if (n.includes('boeing')) return 'Boeing';
-  if (n.includes('l3harris') || n.includes('l3 harris')) return 'L3Harris';
-  if (n.includes('leidos')) return 'Leidos';
-  if (n.includes('nasa')) return 'NASA';
-  if (n.includes('sandia')) return 'Sandia National Labs';
-  if (n.includes('blue origin')) return 'Blue Origin';
-  if (n.includes('raytheon')) return 'Raytheon';
-  if (n.includes('general dynamics')) return 'General Dynamics';
-  if (n.includes('bae systems')) return 'BAE Systems';
-  // Finance
-  if (n.includes('goldman')) return 'Goldman Sachs';
-  if (n.includes('jpmorgan') || n.includes('jp morgan')) return 'JPMorgan Chase';
-  if (n.includes('wells fargo')) return 'Wells Fargo';
-  if (n.includes('citi') && !n.includes('citizen')) return 'Citi';
-  if (n.includes('mastercard')) return 'Mastercard';
-  if (n.includes('visa') && n.length < 15) return 'Visa';
-  if (n.includes('paypal')) return 'PayPal';
-  if (n.includes('bny') || n.includes('bank of new york') || n.includes('mellon')) return 'BNY Mellon';
-  if (n.includes('deloitte')) return 'Deloitte';
-  if (n.includes('bain')) return 'Bain & Company';
-  if (n.includes('bloomberg')) return 'Bloomberg';
-  if (n.includes('usaa')) return 'USAA';
-  if (n.includes('navy federal')) return 'Navy Federal';
-  if (n.includes('raymond james')) return 'Raymond James';
-  if (n.includes('geico')) return 'GEICO';
-  // Enterprise / Industrial
-  if (n.includes('oracle')) return 'Oracle';
-  if (n.includes('ibm')) return 'IBM';
-  if (n.includes('servicenow')) return 'ServiceNow';
-  if (n.includes('siemens')) return 'Siemens';
-  if (n.includes('texas instruments')) return 'Texas Instruments';
-  if (n.includes('qualcomm')) return 'Qualcomm';
-  if (n.includes('databricks')) return 'Databricks';
-  if (n.includes('together.ai') || n.includes('together ai')) return 'Together AI';
-  if (n.includes('zoox')) return 'Zoox';
-  // Entertainment
-  if (n.includes('nbcuniversal') || n.includes('nbc universal')) return 'NBCUniversal';
-  if (n.includes('universal destinations')) return 'Universal Destinations';
-  // Other
-  if (n.includes('humana')) return 'Humana';
-  if (n.includes('booz allen')) return 'Booz Allen Hamilton';
-  if (n.includes('abbott')) return 'Abbott';
-  if (n.includes('walmart')) return 'Walmart';
-  if (n.includes('publix')) return 'Publix';
-  if (n.includes('mitsubishi')) return 'Mitsubishi Power';
-  if (n.includes('oscar health')) return 'Oscar Health';
-  if (n.includes('ford') && n.length < 15) return 'Ford';
-  if (n.includes('coca') && n.includes('cola')) return 'Coca-Cola';
-  if (n.includes('nike')) return 'Nike';
-  if (n.includes('disney')) return 'Disney';
-  if (n.includes('ucf') || n.includes('university of central florida')) return 'UCF';
-  return (name || '').trim();
-}
-
 // Seniority for grouping and filters, read by lib/scoring.js so Paths and the
 // power score never disagree about someone's level (0 intern/student … 6 C-suite).
 export function getSeniority(headline) {
@@ -106,25 +13,36 @@ export function getSeniority(headline) {
   return { key: t.key, label: t.label, level: t.level };
 }
 
-/** The company someone works at now: a company scan's, else their current role's (lib/scoring.js). */
+/**
+ * The company someone works at now: a company scan's, else their current
+ * role's, named as scoring names it (lib/scoring.js cleanCompany), so Paths
+ * groups people under the companies the score is built on. It used to merge
+ * names by a second, hand-picked list of its own, which also merged by
+ * mistake: Oxford, Hartford and Bradford were Ford, and Bainbridge was Bain.
+ */
 export function companyOf(c) {
-  const co = currentCompany(c);
-  return co ? normalizeCompany(co) || co : null;
+  return currentCompany(c);
 }
 
 // Order matters: the first industry whose words match wins, checked against the
-// company name first (it is the stronger signal), then the headline.
+// company name first (it is the stronger signal), then the headline. The words
+// are the same for everyone: no one school, region or company of one person's,
+// no job every kind of company has (a "Head of Growth" can work anywhere, so
+// it is "growth marketing" here), and no word that is also plain English ("AR
+// Specialist" is accounts receivable). docs/brain/SCORING.md lists the words
+// taken out. Editing them changes the stored scores' list stamp (lib/rpc.js),
+// since a company's one industry can decide its estimate and your sector.
 export const INDUSTRIES = [
   { key: 'defense', label: 'Government, Defense & Aerospace', color: '#7f8c8d',
-    words: /\b(government|federal|state of|county|city of|defen[cs]e|army|navy|air force|marine corps|military|dod|nasa|aerospace|lockheed|northrop|boeing|raytheon|l3harris|leidos|anduril|sandia|blue origin|spacex|public sector)\b/i },
-  { key: 'finance', label: 'Finance, VC & Crypto', color: '#2ecc71',
-    words: /\b(bank|banking|capital|ventures?|vc|investments?|investor|fund|private equity|asset management|wealth|trading|trader|hedge|crypto|blockchain|web3|defi|fintech|stripe|coinbase|blackrock|robinhood|polymarket|goldman|morgan stanley|jpmorgan|chase|bny|mellon|wells fargo|citi|citigroup|capital one|fidelity|vanguard|schwab|visa|mastercard|amex|american express|paypal|insurance|accounting|cpa|financial)\b/i },
+    words: /\b(government|federal|state of|county|city of|defen[cs]e|army|navy|air force|marine corps|military|dod|nasa|aerospace|lockheed|northrop|boeing|raytheon|l3harris|leidos|blue origin|spacex|public sector)\b/i },
+  { key: 'finance', label: 'Finance & Investing', color: '#2ecc71',
+    words: /\b(bank|banking|capital|ventures?|vc|investments?|investor|fund|private equity|growth equity|asset management|wealth|trading|trader|hedge|crypto|blockchain|web3|defi|fintech|stripe|coinbase|blackrock|robinhood|goldman|morgan stanley|jpmorgan|chase|bny|mellon|wells fargo|citi|citigroup|capital one|fidelity|vanguard|schwab|visa|mastercard|amex|american express|paypal|insurance|accounting|cpa|financial)\b/i },
   { key: 'health', label: 'Healthcare & Biotech', color: '#e74c3c',
     words: /\b(health|healthcare|medical|medicine|hospital|clinic|pharma|pharmaceutical|biotech|nurse|nursing|physician|doctor|dental|therapy|therapist|wellness)\b/i },
   { key: 'education', label: 'Education', color: '#f1c40f',
-    words: /\b(university|college|school|education|student|professor|teacher|academy|ucf|phd|faculty|alumni)\b/i },
-  { key: 'media', label: 'Marketing, Media & Creator', color: '#e67e22',
-    words: /\b(marketing|brand|branding|advertising|agency|media|content|social media|creative|creator|influencer|pr|public relations|communications|snap|snapchat|tiktok|pinterest|youtube|lens|ar|growth)\b/i },
+    words: /\b(university|college|school|education|student|professor|teacher|academy|phd|faculty|alumni)\b/i },
+  { key: 'media', label: 'Marketing & Media', color: '#e67e22',
+    words: /\b(marketing|brand|branding|advertising|agency|media|content|social media|creative|creator|influencer|pr|public relations|communications|tiktok|pinterest|youtube|growth marketing)\b/i },
   { key: 'entertainment', label: 'Entertainment & Gaming', color: '#9b59b6',
     words: /\b(entertainment|film|movie|music|records|gaming|games?|esports|studio|studios|netflix|disney|spotify|hollywood|theater|theatre|sports)\b/i },
   { key: 'tech', label: 'Tech, Software & AI', color: '#3498db',
@@ -134,7 +52,7 @@ export const INDUSTRIES = [
   { key: 'realestate', label: 'Real Estate & Construction', color: '#d35400',
     words: /\b(real estate|realtor|realty|property|properties|construction|architecture|architect|mortgage|homes|housing|builders?)\b/i },
   { key: 'consumer', label: 'Retail, Consumer & Hospitality', color: '#ff79c6',
-    words: /\b(retail|e-?commerce|shopify|consumer|cpg|fashion|apparel|beauty|cosmetics|food|beverage|restaurant|hospitality|hotel|travel|tourism|coca-cola|nike|whatnot|store|shop)\b/i },
+    words: /\b(retail|e-?commerce|shopify|consumer|cpg|fashion|apparel|beauty|cosmetics|food|beverage|restaurant|hospitality|hotel|travel|tourism|coca-cola|nike|store|shop)\b/i },
   { key: 'industry', label: 'Manufacturing, Energy & Logistics', color: '#95a5a6',
     words: /\b(manufacturing|energy|oil|gas|solar|utilities|automotive|tesla|siemens|ge|general electric|honeywell|3m|logistics|supply chain|shipping|freight|fedex|ups|industrial|mining|chemicals?)\b/i },
   { key: 'nonprofit', label: 'Nonprofit & Community', color: '#bdc3c7',
@@ -154,14 +72,30 @@ export function industryOf(company, headline) {
   return UNKNOWN_INDUSTRY;
 }
 
+/** industryOf as a key: what lib/scoring.js is handed, since it imports nothing. */
+export const industryKeyOf = (company, headline) => industryOf(company, headline).key;
+
 export const isSenior = (headline) => getSeniority(headline).level >= 4;
 
 /**
  * Every company in the network with the people there.
  * @returns Map name -> { name, industry, people, d1, d2, d3, S, A, senior }
  * People are kept once (by profile URL), at their closest degree.
+ *
+ * A company's industry is the one scoring uses (lib/scoring.js
+ * networkCompanies over the same rows): the curated list's, else the name's,
+ * else what most of its people say. So a company's colour here is the sector
+ * Settings → Your sector leans on, and each company is the one scoring
+ * scores: both name it with cleanCompany().
  */
 export function buildCompanyIndex(rows = []) {
+  // Each headline is read once, for the industries and for companyOf below.
+  const parsed = new Map();
+  const rolesOf = (r) => {
+    if (!parsed.has(r)) parsed.set(r, rolesWithCompanies(r));
+    return parsed.get(r);
+  };
+  const { industries } = networkCompanies(rows, { industryOf: industryKeyOf, rolesOf });
   const best = new Map();
   for (const r of rows) {
     const key = r.profile_url || `id:${r.id}`;
@@ -170,11 +104,12 @@ export function buildCompanyIndex(rows = []) {
   }
   const index = new Map();
   for (const r of best.values()) {
-    const name = companyOf(r);
+    // companyOf(r), from the roles already read.
+    const name = rolesOf(r).find((x) => !x.former)?.company;
     if (!name) continue;
     let co = index.get(name);
     if (!co) {
-      co = { name, people: [], d1: 0, d2: 0, d3: 0, S: 0, A: 0, senior: 0, votes: {} };
+      co = { name, people: [], d1: 0, d2: 0, d3: 0, S: 0, A: 0, senior: 0 };
       index.set(name, co);
     }
     co.people.push(r);
@@ -182,19 +117,9 @@ export function buildCompanyIndex(rows = []) {
     if (r.tier === 'S') co.S++;
     if (r.tier === 'A') co.A++;
     if (isSenior(r.headline)) co.senior++;
-    const ind = industryOf(name, r.headline).key;
-    co.votes[ind] = (co.votes[ind] || 0) + 1;
-  }
-  for (const co of index.values()) {
-    // The company name decides when it can; otherwise the most common headline industry.
-    const byName = industryOf(co.name, null);
-    if (byName !== UNKNOWN_INDUSTRY) co.industry = byName;
-    else {
-      const [top] = Object.entries(co.votes).filter(([k]) => k !== 'unknown').sort((a, b) => b[1] - a[1]);
-      co.industry = top ? industryByKey(top[0]) : UNKNOWN_INDUSTRY;
-    }
-    delete co.votes;
   }
+  // Every company here is someone's current one, so networkCompanies read it too.
+  for (const co of index.values()) co.industry = industryByKey(industries.get(co.name));
   return index;
 }
 

package/lib/csv.js

@@ -181,6 +181,14 @@ export function hasCsvNetwork() {
   try { return !!sessionStorage.getItem(STORAGE_KEY); } catch { return false; }
 }
 
+/** 'csv' or 'sample' when this tab holds one, else null — without rescoring it as loadCsvNetwork() does. */
+export function csvNetworkSource() {
+  try {
+    const raw = sessionStorage.getItem(STORAGE_KEY);
+    return raw ? JSON.parse(raw).source || 'csv' : null;
+  } catch { return null; }
+}
+
 export function loadCsvNetwork() {
   try {
     const raw = sessionStorage.getItem(STORAGE_KEY);

package/lib/data-export.js

@@ -0,0 +1,170 @@
+// One file that carries your network to another computer.
+//
+// The file is itself a SQLite database: a consistent copy of yours, made with
+// VACUUM INTO the way the automatic backups are (safe even mid-WAL), plus two
+// tables of its own. sd_export_manifest says what it is: the format, which
+// version made it, when, and how many of each thing. sd_export_files holds the
+// photos and the scanner's files that travel, each with its SHA-256. One file,
+// no archive format, no new dependency. lib/data-import.js reads it back.
+//
+// What travels is an allow-list (lib/data-folder.js). Your LinkedIn sign-in
+// (chrome-profile/) never does: the new computer signs in again.
+
+import { DatabaseSync } from 'node:sqlite';
+import { readFileSync, lstatSync, statSync } from 'node:fs';
+import { createHash } from 'node:crypto';
+import path from 'node:path';
+import { AVATAR_FILE, TRAVELLING_FILES, namesInFolder } from './data-folder.js';
+
+/** Bump when the file's layout changes in a way an older import can't read. */
+export const EXPORT_FORMAT = 1;
+export const EXPORT_EXTENSION = '.sixdegrees';
+
+/** The two tables an export adds. An import accepts exactly these columns. */
+export const EXPORT_TABLES = {
+  sd_export_manifest: 'CREATE TABLE sd_export_manifest (key TEXT PRIMARY KEY, value TEXT NOT NULL)',
+  sd_export_files: 'CREATE TABLE sd_export_files (path TEXT PRIMARY KEY, bytes BLOB NOT NULL, sha256 TEXT NOT NULL)',
+};
+
+export function sha256(bytes) {
+  return createHash('sha256').update(bytes).digest('hex');
+}
+
+/** A path as an SQL string literal, for the statements that can't take a parameter (VACUUM INTO, ATTACH). */
+export function sqlString(value) {
+  return `'${String(value).replace(/'/g, "''")}'`;
+}
+
+/** The app's tables, read from the schema, so a table added later is counted and carried without anyone remembering to. */
+export function appTables(schemaSql) {
+  return [...schemaSql.matchAll(/CREATE TABLE IF NOT EXISTS (\w+)/g)].map((m) => m[1]);
+}
+
+/** The app's named indexes, read from the schema the same way. */
+export function appIndexes(schemaSql) {
+  return [...schemaSql.matchAll(/CREATE (?:UNIQUE )?INDEX IF NOT EXISTS (\w+)/g)].map((m) => m[1]);
+}
+
+/** People, not rows: someone reachable through two bridges has a row for each. */
+export function countPeople(db, schema = 'main') {
+  try {
+    return db.prepare(`SELECT count(DISTINCT profile_url) AS n FROM ${schema}.linkedin_connections`).get().n;
+  } catch {
+    return 0;
+  }
+}
+
+/** "Six Degrees backup 2026-09-25.sixdegrees", in this computer's own date. */
+export function exportFileName(now = new Date()) {
+  const pad = (n) => String(n).padStart(2, '0');
+  return `Six Degrees backup ${now.getFullYear()}-${pad(now.getMonth() + 1)}-${pad(now.getDate())}${EXPORT_EXTENSION}`;
+}
+
+/** The photo files the network's rows point at (`/avatars/<name>`), by name. */
+export function referencedPhotos(db) {
+  return new Set(db.prepare(`SELECT DISTINCT substr(profile_image_url, 10) AS name FROM linkedin_connections
+    WHERE substr(profile_image_url, 1, 9) = '/avatars/'`).all().map((r) => r.name));
+}
+
+/**
+ * The files in the data folder that travel: the scanner's own JSON files and,
+ * if asked, the photos (only those named in `photos`, when it is given). Only
+ * plain files are taken, never a link, and avatars/ is read only if it is a
+ * real folder, so nothing outside the data folder can be pulled in through one.
+ */
+export function travellingFiles(dir, { includePhotos = true, photos = null } = {}) {
+  const plain = (p) => {
+    try { return lstatSync(p).isFile(); } catch { return false; }
+  };
+  const out = [];
+  for (const name of TRAVELLING_FILES) {
+    const abs = path.join(dir, name);
+    if (plain(abs)) out.push({ rel: name, abs });
+  }
+  if (includePhotos) {
+    for (const name of namesInFolder(path.join(dir, 'avatars')).sort()) {
+      if (!AVATAR_FILE.test(name) || (photos && !photos.has(name))) continue;
+      const abs = path.join(dir, 'avatars', name);
+      if (plain(abs)) out.push({ rel: `avatars/${name}`, abs });
+    }
+  }
+  return out;
+}
+
+/**
+ * Write an export of the open database `db` and the data folder `dir` to
+ * `outFile`, which must not exist yet.
+ * @returns {{ bytes, people, photos, files, counts }}
+ */
+export function buildExport(db, { dir, outFile, includePhotos = true, appVersion, schemaSql, now = new Date() }) {
+  db.exec(`VACUUM INTO ${sqlString(outFile)}`);
+
+  const out = new DatabaseSync(outFile);
+  let summary;
+  try {
+    // One self-contained file: no -wal beside it to be forgotten in a copy.
+    out.exec('PRAGMA journal_mode = DELETE');
+    out.exec(`${Object.values(EXPORT_TABLES).join(';\n')};`);
+    out.exec('BEGIN');
+
+    // Without the photos, a row pointing at /avatars/<file> would point at a
+    // file the other computer doesn't have: some views draw an empty circle
+    // for it. With no photo, they show initials, and the next scan of that
+    // person saves a new one. A photo not saved yet (LinkedIn's own link,
+    // which expires in a few weeks) is left as it is, as it is here.
+    if (!includePhotos) {
+      out.exec("UPDATE linkedin_connections SET profile_image_url = NULL WHERE profile_image_url LIKE '/avatars/%'");
+    }
+    // This computer's own history, not the network's: the other computer
+    // records its own import when it finishes it.
+    out.exec("DELETE FROM app_meta WHERE key = 'last_import'");
+
+    const put = out.prepare('INSERT INTO sd_export_files (path, bytes, sha256) VALUES (?, ?, ?)');
+    let photos = 0;
+    let files = 0;
+    // Only the photos of people still in the network. avatars/ keeps the
+    // photo of someone whose circle was deleted since; the copy has no row
+    // for them, so their face has no reason to travel.
+    const inNetwork = includePhotos ? referencedPhotos(out) : null;
+    for (const f of travellingFiles(dir, { includePhotos, photos: inNetwork })) {
+      let bytes;
+      try { bytes = readFileSync(f.abs); } catch { continue; } // replaced since the listing
+      put.run(f.rel, bytes, sha256(bytes));
+      files++;
+      if (f.rel.startsWith('avatars/')) photos++;
+    }
+
+    const counts = {};
+    for (const t of appTables(schemaSql)) {
+      try { counts[t] = out.prepare(`SELECT count(*) AS n FROM "${t}"`).get().n; } catch { counts[t] = 0; }
+    }
+    let scoringVersion = '';
+    try {
+      scoringVersion = out.prepare("SELECT value FROM app_meta WHERE key = 'scoring_version'").get()?.value ?? '';
+    } catch { /* never scored */ }
+    const people = countPeople(out);
+
+    const manifest = {
+      format: EXPORT_FORMAT,
+      app_version: appVersion,
+      scoring_version: scoringVersion,
+      exported_at: now.toISOString(),
+      include_photos: includePhotos ? 1 : 0,
+      people,
+      photos,
+      files,
+      counts: JSON.stringify(counts),
+    };
+    const meta = out.prepare('INSERT INTO sd_export_manifest (key, value) VALUES (?, ?)');
+    for (const [key, value] of Object.entries(manifest)) meta.run(key, String(value));
+
+    out.exec('COMMIT');
+    summary = { people, photos, files, counts };
+  } catch (err) {
+    try { out.exec('ROLLBACK'); } catch { /* nothing open */ }
+    throw err;
+  } finally {
+    out.close();
+  }
+  return { ...summary, bytes: statSync(outFile).size };
+}

package/lib/data-folder.js

@@ -0,0 +1,238 @@
+// The data folder: what is in it, and which parts of it may leave this computer.
+//
+// Everything Six Degrees keeps lives in one folder (SIX_DEGREES_HOME, default
+// ~/.six-degrees). Parts of it belong to this computer only: chrome-profile/ is
+// a live, signed-in LinkedIn session (SECURITY.md), and venv/ and python/ (the
+// scanner's own Python, when Set up the scanner downloaded one) are built for this
+// machine's chip. So what an export carries is an allow-list, never "the folder
+// minus a few things": a file that appears in the folder later stays behind
+// until someone decides it should travel.
+
+import { readdirSync, lstatSync, existsSync, rmSync } from 'node:fs';
+import { spawn } from 'node:child_process';
+import path from 'node:path';
+
+/** A photo the /avatars route serves: a plain file name, no folders. The route uses this same pattern. */
+export const AVATAR_FILE = /^[A-Za-z0-9_-]+\.(webp|jpg|jpeg|png)$/;
+
+/**
+ * The scanner's notes about the network itself: without them, people whose
+ * circles are hidden or half-read would be retried from scratch on the new
+ * computer (TRAPS §15, §34). They describe one network's people, so an import
+ * replaces them along with the network: this computer's notes would say which
+ * pages of the old network's people were read, and the scanner would skip
+ * those pages for the new one.
+ */
+export const NETWORK_FILES = [
+  'bridge-progress.json',
+  'bridge-skips.json',
+  'bridge-unclear.json',
+];
+
+/**
+ * The LinkedIn account's budget and cooldown. They belong to the account, not
+ * to a network or a computer, and leaving them behind would reset the month's
+ * count (TRAPS §35). So they travel, and an import merges them with the ones
+ * already here instead of replacing them (lib/linkedin-limits.js
+ * mergeBudgetFiles): searches made on either computer still count.
+ */
+export const BUDGET_FILES = [
+  'scan-limits.json',
+  'linkedin-activity.json',
+  'linkedin-cooldown.json',
+];
+
+/** Everything of the scanner's that an export carries. */
+export const TRAVELLING_FILES = [...NETWORK_FILES, ...BUDGET_FILES];
+
+/** Where a checked import waits for the next start (lib/data-import.js). */
+export const PENDING_DIR = 'import-pending';
+
+/** backups/ names: the copy kept before an import replaced the network. */
+export const IMPORT_BACKUP_PREFIX = 'before-import-';
+
+// Private working folders, made with mkdtemp inside the data folder so nothing
+// is written anywhere else. A run that dies part-way leaves one behind; they
+// are swept once they are an hour old (so a job still running is never hit),
+// at each server's start (lib/data-import.js applyPendingImport, from getDb)
+// and before the next run of the same kind.
+export const EXPORT_WORK_PREFIX = '.export-';
+export const UPLOAD_WORK_PREFIX = '.import-upload-';
+// Set up the scanner's download and what it unpacked (lib/scanner-python.js):
+// 25 to 150 MB, so a server stopped part-way shouldn't leave it for good.
+export const SETUP_WORK_PREFIX = '.python-setup-';
+const WORK_PREFIXES = [EXPORT_WORK_PREFIX, UPLOAD_WORK_PREFIX, SETUP_WORK_PREFIX];
+const SPENT_PENDING = /^import-pending\.(done|cancelled)-/;
+
+function plainFileSize(file) {
+  try {
+    const s = lstatSync(file);
+    return s.isFile() ? s.size : 0;
+  } catch {
+    return 0;
+  }
+}
+
+/**
+ * The names in a folder that really is one here. A link, even to a folder, is
+ * never followed: nothing outside the data folder may be counted, or carried
+ * off in an export, through one.
+ */
+export function namesInFolder(folder) {
+  try {
+    return lstatSync(folder).isDirectory() ? readdirSync(folder) : [];
+  } catch {
+    return [];
+  }
+}
+
+/** Count and total size of the plain files directly in a folder whose names pass `keep`. */
+function filesIn(folder, keep = () => true) {
+  let count = 0;
+  let bytes = 0;
+  const names = namesInFolder(folder);
+  for (const name of names) {
+    if (!keep(name)) continue;
+    try {
+      const s = lstatSync(path.join(folder, name));
+      if (s.isFile()) { count++; bytes += s.size; }
+    } catch { /* gone since the listing */ }
+  }
+  return { count, bytes };
+}
+
+/** Everything under a folder, without following links. Capped, so a huge folder can't stall the page. */
+function treeBytes(folder, budget = { left: 50000 }) {
+  let bytes = 0;
+  let names = [];
+  try { names = readdirSync(folder); } catch { return 0; }
+  for (const name of names) {
+    if (budget.left-- <= 0) break;
+    const p = path.join(folder, name);
+    try {
+      const s = lstatSync(p);
+      if (s.isDirectory()) bytes += treeBytes(p, budget);
+      else if (s.isFile()) bytes += s.size;
+    } catch { /* gone since the listing */ }
+  }
+  return bytes;
+}
+
+/** 'auto' (before a new version), 'import' (before an import) or 'manual' (anything else, made by hand). */
+export function backupKind(name, autoPrefix) {
+  if (autoPrefix && name.startsWith(autoPrefix)) return 'auto';
+  if (name.startsWith(IMPORT_BACKUP_PREFIX)) return 'import';
+  return 'manual';
+}
+
+/** Every copy in backups/, newest first. A folder is the photos and files kept beside an import's copy. */
+export function listBackups(folder, { autoPrefix } = {}) {
+  let names = [];
+  try { names = readdirSync(folder); } catch { return []; }
+  const out = [];
+  for (const name of names) {
+    if (name.startsWith('.') || name.endsWith('.partial')) continue;
+    const p = path.join(folder, name);
+    let s;
+    try { s = lstatSync(p); } catch { continue; }
+    if (!s.isFile() && !s.isDirectory()) continue;
+    out.push({
+      name,
+      bytes: s.isFile() ? s.size : treeBytes(p),
+      modifiedAt: s.mtimeMs,
+      kind: backupKind(name, autoPrefix),
+      folder: s.isDirectory(),
+    });
+  }
+  return out.sort((a, b) => b.modifiedAt - a.modifiedAt || b.name.localeCompare(a.name));
+}
+
+/**
+ * What the Settings page shows about the folder. Sizes come from the file
+ * system only; nothing is read. chrome-profile/ is reported as there or not,
+ * and never looked inside. `inNetwork` (the photo names the network's rows
+ * point at) gives photosInCopy: the ones a copy would carry, since photos of
+ * people no longer in the network stay behind (lib/data-export.js).
+ */
+export function folderReport({ dir, dbFile, autoPrefix, inNetwork = null }) {
+  const avatars = path.join(dir, 'avatars');
+  return {
+    dataDir: dir,
+    dbFile,
+    databaseBytes: ['', '-wal', '-shm'].reduce((n, s) => n + plainFileSize(dbFile + s), 0),
+    photos: filesIn(avatars, (name) => AVATAR_FILE.test(name)),
+    photosInCopy: inNetwork ? filesIn(avatars, (name) => AVATAR_FILE.test(name) && inNetwork.has(name)) : null,
+    backups: listBackups(path.join(path.dirname(dbFile), 'backups'), { autoPrefix }),
+    linkedinSignIn: existsSync(path.join(dir, 'chrome-profile')),
+  };
+}
+
+/** Remove working folders a run that died left behind, once they are old enough to be nobody's. */
+export function sweepLeftovers(dir, { now = Date.now(), maxAgeMs = 3600 * 1000 } = {}) {
+  let names = [];
+  try { names = readdirSync(dir); } catch { return 0; }
+  let removed = 0;
+  for (const name of names) {
+    const work = WORK_PREFIXES.some((prefix) => name.startsWith(prefix));
+    if (!work && !SPENT_PENDING.test(name)) continue;
+    const p = path.join(dir, name);
+    try {
+      const s = lstatSync(p);
+      if (!s.isDirectory()) continue;
+      // A spent import folder is only ever renamed away to be deleted: always safe.
+      if (work && now - s.mtimeMs < maxAgeMs) continue;
+      rmSync(p, { recursive: true, force: true });
+      removed++;
+    } catch { /* someone else got there first */ }
+  }
+  return removed;
+}
+
+/** The program that opens a folder in the file browser here, or null where there is none. */
+export function folderOpener(platform = process.platform) {
+  if (platform === 'darwin') return 'open';
+  if (platform === 'linux') return 'xdg-open';
+  return null;
+}
+
+/**
+ * Open the data folder in Finder (or the Linux file browser). The path is the
+ * data folder itself, never anything from a request. Resolves { ok, message }.
+ */
+export function revealFolder(dir, { platform = process.platform, spawnImpl = spawn, waitMs = 3000 } = {}) {
+  const cmd = folderOpener(platform);
+  if (!cmd) return Promise.resolve({ ok: false, message: 'There is no file browser to open it with on this computer.' });
+  return new Promise((resolve) => {
+    let timer = null;
+    let settled = false;
+    const done = (result) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve(result);
+    };
+    let child;
+    try {
+      child = spawnImpl(cmd, [dir], { stdio: 'ignore', detached: true });
+    } catch (err) {
+      done({ ok: false, message: `It couldn't be opened (${err.message}).` });
+      return;
+    }
+    child.on('error', (err) => done({
+      ok: false,
+      message: err.code === 'ENOENT'
+        ? `This computer has no ${cmd}, so there is no file browser to open it with.`
+        : `It couldn't be opened (${err.message}).`,
+    }));
+    // `open` hands the folder to Finder and exits at once, and so does xdg-open
+    // (or it fails at once, on a machine with no desktop). Still running after a
+    // few seconds means a file browser is up and holding it.
+    child.on('exit', (code) => done(code === 0
+      ? { ok: true }
+      : { ok: false, message: `The file browser didn't open (${cmd} stopped with code ${code}).` }));
+    timer = setTimeout(() => {
+      try { child.unref(); } catch { /* already gone */ }
+      done({ ok: true });
+    }, waitMs);
+  });
+}