six-degrees 0.2.1 → 0.3.0

package/lib/db-client.js

@@ -4,6 +4,7 @@ import { homedir } from 'node:os';
 import path from 'node:path';
 import { SCHEMA_SQL } from '../db/schema.js';
 import { APP_VERSION } from './app-version.js';
+import { applyPendingImport, recordImport } from './data-import.js';
 
 // The database lives OUTSIDE the app directory so an installed copy never
 // writes into its own package. Override with SIX_DEGREES_HOME.
@@ -36,10 +37,42 @@ export const BOOLEAN_COLUMNS = {
 
 let _db = null;
 
+// Set once this server process has opened the database, by any copy of this
+// module. The bundler can give a route its own copy, with its own _db, and a
+// copy that opens late must not finish an import staged while another copy's
+// handle was already open: the swap would happen under that handle. There is
+// one globalThis per process, like lib/scan-state.js.
+const OPENED = Symbol.for('six-degrees.db-opened');
+
+/** The database file: SIX_DEGREES_DB, or six-degrees.sqlite in the data folder. */
+export function dbFile() {
+  return process.env.SIX_DEGREES_DB || path.join(dataDir(), 'six-degrees.sqlite');
+}
+
 export function getDb() {
   if (_db) return _db;
 
-  const file = process.env.SIX_DEGREES_DB || path.join(dataDir(), 'six-degrees.sqlite');
+  const file = dbFile();
+
+  // A network imported from another computer (Settings → Your data) is swapped
+  // in here, at the start, before anything opens the database: it can't be
+  // swapped under a handle that is already open, this process's or another's
+  // (it waits while another copy of Six Degrees has the database open). What
+  // was here is kept in backups/ first. If a step fails, what is in place opens
+  // as usual and the next start carries on (lib/data-import.js).
+  let imported = null;
+  if (!globalThis[OPENED]) {
+    try {
+      imported = applyPendingImport({ dir: dataDir(), dbFile: file });
+      if (imported) {
+        console.log(`Six Degrees: finished the import (${imported.people} people). What was here before: ${imported.keptDatabase || 'nothing to keep'}.`);
+      }
+    } catch (err) {
+      console.error(`Six Degrees: could not finish the import (will try again next start): ${err.message}`);
+    }
+  }
+  globalThis[OPENED] = true;
+
   _db = new DatabaseSync(file);
 
   // Before this version changes anything: if a different version opened this
@@ -53,12 +86,24 @@ export function getDb() {
 
   // Idempotent: every statement is CREATE ... IF NOT EXISTS, so this doubles
   // as first-run setup and as a no-op on every later boot.
-  _db.exec(SCHEMA_SQL);
-  addMissingColumns(_db);
+  applySchema(_db);
+
+  if (imported) {
+    try { recordImport(_db, imported); } catch { /* only the Settings page's note is lost */ }
+  }
 
   return _db;
 }
 
+/**
+ * Every table, index and column this version uses, made if missing. An import
+ * is rebuilt into exactly this (lib/data-import.js), so only rows travel.
+ */
+export function applySchema(db) {
+  db.exec(SCHEMA_SQL);
+  addMissingColumns(db);
+}
+
 // CREATE TABLE IF NOT EXISTS never adds a column to a table that already
 // exists, so columns added after first release are added here, once.
 const ADDED_COLUMNS = [

package/lib/durable.js

@@ -0,0 +1,73 @@
+// Writes that have to be on the disk before the next step may count on them.
+//
+// A rename is atomic, but it isn't durable. After a power cut the new name can
+// be on the disk while the bytes it names aren't, so a copy that "exists" can
+// be empty. SQLite doesn't sync what VACUUM INTO writes either (its docs say
+// so). So a file is synced before it is renamed into place, and its folder
+// after, so the rename itself is on the disk before anything relies on it.
+//
+// On a Mac, Node's fsync is F_FULLFSYNC (libuv), which also empties the drive's
+// own write cache; a plain fsync there doesn't.
+
+import fs from 'node:fs';
+import path from 'node:path';
+
+// A folder that isn't there has no rename to make durable, and some file
+// systems can't open or sync one: nothing more can be done then.
+const FOLDER_CANT_SYNC = new Set(['ENOENT', 'EINVAL', 'ENOTSUP', 'ENOSYS', 'EISDIR', 'EPERM', 'EBADF']);
+
+function syncFile(file) {
+  const fd = fs.openSync(file, 'r');
+  try {
+    fs.fsyncSync(fd);
+  } finally {
+    fs.closeSync(fd);
+  }
+}
+
+function syncFolder(folder) {
+  let fd;
+  try {
+    fd = fs.openSync(folder, 'r');
+  } catch (err) {
+    if (FOLDER_CANT_SYNC.has(err.code)) return;
+    throw err;
+  }
+  try {
+    fs.fsyncSync(fd);
+  } catch (err) {
+    if (!FOLDER_CANT_SYNC.has(err.code)) throw err;
+  } finally {
+    fs.closeSync(fd);
+  }
+}
+
+/** Replace `file` with `data` so that after a power cut it holds either the old contents or the new, never part of either. */
+function writeFileDurably(file, data) {
+  const tmp = `${file}.${process.pid}.tmp`;
+  try {
+    const fd = fs.openSync(tmp, 'w');
+    try {
+      fs.writeFileSync(fd, data);
+      fs.fsyncSync(fd);
+    } finally {
+      fs.closeSync(fd);
+    }
+    fs.renameSync(tmp, file);
+  } catch (err) {
+    fs.rmSync(tmp, { force: true });
+    throw err;
+  }
+  syncFolder(path.dirname(file));
+}
+
+/** The same, for a JSON document, laid out the way the scanner writes its own files. */
+function writeJsonDurably(file, value) {
+  writeFileDurably(file, `${JSON.stringify(value, null, 2)}\n`);
+}
+
+/**
+ * Called through this object rather than directly, so a test can see what was
+ * synced and in which order (tests/data-transfer.test.mjs).
+ */
+export const durable = { syncFile, syncFolder, writeFileDurably, writeJsonDurably };

package/lib/gate.js

@@ -7,6 +7,11 @@
 // irreversibly destroy or rewrite data; /api/scraper spawns processes and
 // /api/update changes the code that will run next, both of which are more power
 // than any of the others, so they sit behind the same gate.
+//
+// The four under /api/data are Settings → Your data: export hands over the
+// whole network in one file, import replaces it, restart stops the server, and
+// reveal starts a process. Reading /api/data itself (sizes, the folder's path)
+// changes nothing and stays open, like every other read.
 export const DESTRUCTIVE_ROUTES = [
   '/api/admin-delete',
   '/api/admin-update',
@@ -14,6 +19,10 @@ export const DESTRUCTIVE_ROUTES = [
   '/api/setup-profile',
   '/api/scraper',
   '/api/update',
+  '/api/data/export',
+  '/api/data/import',
+  '/api/data/restart',
+  '/api/data/reveal',
 ];
 
 const LOOPBACK = new Set(['127.0.0.1', '::1', 'localhost']);
@@ -29,11 +38,21 @@ const LOOPBACK = new Set(['127.0.0.1', '::1', 'localhost']);
  * Sec-Fetch-Site is set by the browser and cannot be forged by script, so it is
  * the reliable signal. Origin is the fallback for browsers that omit it.
  * Non-browser callers (curl, scripts/scrape.py) send neither and are unaffected.
+ *
+ * 'same-site' is not enough on its own: a site ignores the port, so a page
+ * served from any other port on 127.0.0.1 (another local app, a dev server, a
+ * tool's web UI) is "same-site" with this one. Such a write has to show an
+ * Origin that is exactly this host and port. The app's own pages are always
+ * 'same-origin', so nothing legitimate is refused.
  */
 export function isCrossSiteWrite({ method, secFetchSite, origin, host }) {
   if (!method || !['POST', 'PUT', 'PATCH', 'DELETE'].includes(method.toUpperCase())) return false;
 
-  if (secFetchSite) return !['same-origin', 'same-site', 'none'].includes(secFetchSite);
+  if (secFetchSite) {
+    if (secFetchSite === 'same-origin' || secFetchSite === 'none') return false;
+    if (secFetchSite !== 'same-site') return true;
+    if (!origin) return true;          // same-site but no Origin to pin the port: refuse
+  }
 
   if (origin) {
     try {
@@ -46,6 +65,38 @@ export function isCrossSiteWrite({ method, secFetchSite, origin, host }) {
   return false;      // no browser headers at all: not a browser
 }
 
+/**
+ * Was this request sent to this app under someone else's name?
+ *
+ * DNS rebinding: a page on any website can make its own domain resolve to
+ * 127.0.0.1. The browser then treats the app as that page's own origin, so
+ * Sec-Fetch-Site says 'same-origin', the write check above lets it through,
+ * and CORS lets the page read every answer, the whole network included. What
+ * gives it away is the Host header: it carries the attacker's name, because
+ * that is the address the page used.
+ *
+ * When the server is bound to loopback, every real caller (this app's pages,
+ * the Mac app's window, the scanner, curl) addresses it as 127.0.0.1,
+ * localhost or [::1], so any other Host is refused. Bound anywhere else, the
+ * operator chose that on purpose and ADMIN_TOKEN guards what matters.
+ */
+export function isRebound({ bind, host }) {
+  if (!boundToLoopback(bind)) return false;
+  if (!host) return false;          // a client that sends no Host names nothing to judge
+  let hostname;
+  try {
+    hostname = new URL(`http://${host}`).hostname.toLowerCase();
+  } catch {
+    return true;                    // an unparseable Host is not a real caller
+  }
+  return !LOOPBACK_HOSTNAMES.has(hostname);
+}
+
+// How URL() writes the loopback names (it keeps IPv6 in brackets). 0.0.0.0 is
+// here because the scanner's own allow-list accepts it for APP_URL; a rebinding
+// page can only ever send its own domain, never this.
+const LOOPBACK_HOSTNAMES = new Set(['127.0.0.1', 'localhost', '[::1]', '0.0.0.0']);
+
 export function isDestructive(pathname) {
   return DESTRUCTIVE_ROUTES.some((p) => pathname === p || pathname.startsWith(`${p}/`));
 }
@@ -61,6 +112,44 @@ function sameSecret(a, b) {
   return diff === 0;
 }
 
+/**
+ * Everything middleware.js decides about a request, as one answer: null to let
+ * it through, or { status, error } to refuse it. In order: a request addressed
+ * to another name (421), a write from another site (403), then, for the routes
+ * in DESTRUCTIVE_ROUTES, the gate (gateDecision).
+ *
+ * One function, so the one route middleware.js leaves alone (the import, whose
+ * body must not be buffered first: see middleware.js) makes exactly the same
+ * checks itself, before it reads anything.
+ *
+ * @param {{ method: string, pathname: string, headers: { get(name: string): string | null },
+ *           env: { SIX_DEGREES_BIND?: string, HOSTNAME?: string, ADMIN_TOKEN?: string } }} request
+ */
+export function requestRefusal({ method, pathname, headers, env = {} }) {
+  const header = (name) => headers?.get?.(name) ?? null;
+  const bind = env.SIX_DEGREES_BIND || env.HOSTNAME;
+
+  if (isRebound({ bind, host: header('host') })) {
+    return { status: 421, error: 'This app only answers to 127.0.0.1 and localhost.' };
+  }
+  if (isCrossSiteWrite({
+    method,
+    secFetchSite: header('sec-fetch-site'),
+    origin: header('origin'),
+    host: header('host'),
+  })) {
+    return { status: 403, error: 'Cross-site requests are not accepted. This app only answers to pages it serves.' };
+  }
+  if (!isDestructive(pathname)) return null;
+
+  const decision = gateDecision({
+    bind,
+    token: env.ADMIN_TOKEN,
+    bearer: (header('authorization') || '').replace(/^Bearer\s+/i, ''),
+  });
+  return decision.allow ? null : { status: decision.status, error: decision.reason };
+}
+
 /**
  * @param {{ bind?: string, token?: string, bearer?: string }} ctx
  * @returns {{ allow: boolean, status?: number, reason: string }}

package/lib/ingest.js

@@ -60,3 +60,43 @@ export function toIsoDate(text) {
   if (month < 0 || day < 1 || day > 31) return null;
   return `${m[3]}-${String(month + 1).padStart(2, '0')}-${String(day).padStart(2, '0')}`;
 }
+
+// Tiers that make a new connection worth a notification of its own.
+const HIGH_VALUE = new Set(['S', 'A']);
+
+/**
+ * The notifications a refresh of your own connections (1st degree) leaves:
+ * how many are new, and one for each new person the model scored S or A.
+ *
+ * `added` are the records this request inserted: new means new to the
+ * database, not missing from a lookup (a re-scan of people already saved
+ * used to count everyone past the first hundred as new). `tierOf(url)` is
+ * the tier each was stored with by the rescore that follows the insert, so
+ * "high-value" is the model's judgement (lib/scoring.js), not a list of
+ * words or famous names matched anywhere in the headline, which read
+ * "Metadata Engineer" as Meta and "Engineer at Applewood Bakery" as Apple.
+ * `checked` is how many records the refresh sent.
+ */
+export function refreshNotifications({ added = [], checked = 0, tierOf = () => null, userId = null } = {}) {
+  const user_id = userId || null;
+  if (!added.length) {
+    return [{
+      user_id, type: 'refresh_summary', title: 'Network up to date',
+      message: `Checked ${checked} connections — no new additions`, icon: '✓',
+    }];
+  }
+  const out = [{
+    user_id,
+    type: 'refresh_summary',
+    title: `${added.length} new connection${added.length > 1 ? 's' : ''} found!`,
+    message: added.slice(0, 3).map((r) => r.name).join(', ') + (added.length > 3 ? ` +${added.length - 3} more` : ''),
+    icon: '🔄',
+  }];
+  for (const r of added.filter((a) => HIGH_VALUE.has(tierOf(a.profile_url))).slice(0, 5)) {
+    out.push({
+      user_id, type: 'new_elite_connection', title: `High-value connection: ${r.name}`,
+      message: r.headline?.substring(0, 60), icon: '👑',
+    });
+  }
+  return out;
+}

package/lib/legacy-offer.js

@@ -0,0 +1,185 @@
+// Paths → Scores: the one-time offer to keep the curated list's old scores as
+// your own, after the list was made neutral (lib/legacy-scores.js has the old
+// scores and why each changed).
+//
+// Who is offered what. The offer opens when rescoreAll() first replaces scores
+// that were computed with the old list (lib/rpc.js), so a database that never
+// had them, a fresh one, never sees it. It then lists each old entry that
+// someone in this network works at now, whose built-in score is different now,
+// and that you haven't scored yourself. A CSV import and the sample aren't
+// scored on the server, so the page doesn't ask while one is open.
+//
+// Keeping writes the old score under every name scoring uses for the entry's
+// companies, as Paths → Scores sets a score (setCompanyScores), then rescores
+// everyone once for the whole batch. Keep or No thanks, it is never offered
+// again, and an offer whose first look finds nothing to offer closes itself.
+
+import { getDb } from './db-client.js';
+import { readNetwork, companyScore, KNOWN_COMPANIES } from './scoring.js';
+import { industryKeyOf } from './companies.js';
+import { scoringRows, companyOverrides, setCompanyScores, rescoreAll } from './rpc.js';
+import { LEGACY_SCORES, LEGACY_OFFER_KEY } from './legacy-scores.js';
+
+const LISTED = new Set(KNOWN_COMPANIES.map(([name]) => name));
+const OLD = LEGACY_SCORES.map(([name, score, names, industry]) => ({ name, score, names, industry }));
+const OLD_BY_NAME = new Map(OLD.map((e) => [e.name, e]));
+// As lib/scoring.js cleanCompany reads it: a name that says it is a school
+// only matched a school on the list. Copied rather than imported, because this
+// is how the old list matched and must stay so whatever the live rule becomes.
+const SCHOOL_NAME = /\b(school|college|university)\b/;
+
+// Most names an answer may carry: the old list had 34 changed entries.
+const MAX_ANSWER = 100;
+
+/**
+ * The old list's entry that scored a company, found by the name scoring gives
+ * the company now (cleanCompany's), or null. A company still on the list keeps
+ * its name, so its old entry counts only if it was rescored. A removed entry's
+ * names are found by its own names (lib/legacy-scores.js), the way
+ * cleanCompany found them: "University of Central Florida" is its own name
+ * now, and was UCF's. Another company the old alias also caught ("Hard Rock
+ * Hotel" for Hard Rock Digital) isn't that entry's.
+ */
+export function legacyEntryFor(name) {
+  if (!name) return null;
+  if (LISTED.has(name)) return OLD_BY_NAME.get(name) || null;
+  const lower = name.toLowerCase();
+  const bare = lower.replace(/^the /, '');
+  const school = SCHOOL_NAME.test(lower);
+  for (const entry of OLD) {
+    if (LISTED.has(entry.name) || (school && entry.industry !== 'education')) continue;
+    if (entry.names.test(lower) || entry.names.test(bare) || lower === entry.name.toLowerCase()) return entry;
+  }
+  return null;
+}
+
+/**
+ * 'open', 'kept', 'declined', 'none' (it opened, and there was nothing in
+ * this network to offer), or null when this database was never offered.
+ */
+export function legacyOfferState(db = getDb()) {
+  return db.prepare('SELECT value FROM app_meta WHERE key = ?').get(LEGACY_OFFER_KEY)?.value ?? null;
+}
+
+/**
+ * What Paths → Scores offers, or null: nothing when the offer isn't open
+ * (never was, or was answered) or no company in the network lost an old score
+ * that you haven't replaced with one of your own. That last closes it for
+ * good ('none'): the network the old list scored is the one read here, so
+ * nothing could turn up later, and every visit to Paths → Scores would
+ * otherwise read the whole network again to find nothing.
+ *
+ * The companies are the ones Paths → Scores lists, those someone works at now,
+ * so a kept score shows there as yours and Auto can hand it back. (A name only
+ * in former roles would be a score nothing lists; its people's former role
+ * counts at 70% and moves them little.) Each is compared by its built-in score
+ * now (the list or the estimate, before any sector lean) with the old entry's.
+ *
+ * @returns null | { companies: [{ name, was, now, estimated, people, names }] },
+ *   one per old entry, most people first: the score it had (`was`), the
+ *   built-in score its main name has now (`now`, `estimated` when that comes
+ *   from the network rather than the list), how many people work there now,
+ *   and every name it covers, as scoring writes them.
+ */
+export function legacyOffer(db = getDb()) {
+  if (legacyOfferState(db) !== 'open') return null;
+  const rows = scoringRows(db);
+  if (!rows.length) return closeEmpty(db);
+  const overrides = companyOverrides(db);
+  const read = readNetwork(rows, { industryOf: industryKeyOf });
+
+  const offered = new Map();                       // old entry name → what it offers
+  const entryOf = new Map();                       // company name → that offer
+  for (const [name, { headcount, industry }] of read.companies) {
+    if (!headcount || overrides.has(name)) continue;   // nobody there now, or yours already
+    const entry = legacyEntryFor(name);
+    if (!entry) continue;
+    const now = companyScore(name, { headcount, industry });
+    if (now.score === entry.score) continue;       // the estimate landed where the list was
+    const o = offered.get(entry.name) || { name: entry.name, was: entry.score, names: [], people: new Set() };
+    o.names.push({ name, now, headcount });
+    offered.set(entry.name, o);
+    entryOf.set(name, o);
+  }
+  if (!offered.size) return closeEmpty(db);
+
+  // People, each once, across all of an entry's names.
+  for (const r of rows) {
+    for (const role of read.people.get(r).roles) {
+      if (!role.former && entryOf.has(role.company)) entryOf.get(role.company).people.add(r.profile_url || r.id);
+    }
+  }
+  const companies = [...offered.values()].map((o) => {
+    // Its main name: where most of its people are (then the first by name).
+    const main = o.names.reduce((a, b) => (b.headcount > a.headcount || (b.headcount === a.headcount && b.name < a.name) ? b : a));
+    return {
+      name: o.name,
+      was: o.was,
+      now: main.now.score,
+      estimated: main.now.source !== 'known',
+      people: o.people.size,
+      names: o.names.map((n) => n.name).sort(),
+    };
+  });
+  companies.sort((a, b) => b.people - a.people || a.name.localeCompare(b.name));
+  return { companies };
+}
+
+/** Close an open offer that has nothing to offer; null, as legacyOffer() says it. */
+function closeEmpty(db) {
+  db.prepare("UPDATE app_meta SET value = 'none' WHERE key = ? AND value = 'open'").run(LEGACY_OFFER_KEY);
+  return null;
+}
+
+/**
+ * The names an answer keeps, from the body the page sends: {keep: [names]},
+ * where an empty list is No thanks. Throws an Error fit to show on anything
+ * else.
+ */
+export function parseLegacyAnswer(body) {
+  const keep = body?.keep;
+  if (!Array.isArray(keep) || keep.length > MAX_ANSWER || !keep.every((n) => typeof n === 'string' && n.length <= 200)) {
+    throw new Error('Send the companies to keep as a list of names (an empty list for No thanks).');
+  }
+  return keep;
+}
+
+/**
+ * Answer the offer: keep, as your own, the old scores of the entries named in
+ * `keep` (names from the offer; any other name is ignored), or keep none (No
+ * thanks). Either way it is never offered again. The scores and the answer
+ * are written together, all or nothing; then everyone is rescored once for
+ * the whole batch, and only if something was kept. Answering an offer that
+ * isn't open (another window already did) changes nothing.
+ *
+ * `rescore` is lib/rpc.js rescoreAll; tests pass a counting stand-in.
+ * @returns { kept: [{ name, score, names }], scored }
+ * @throws when the rescore fails, after the answer is saved: the message says
+ *   so, `.kept` says what was kept, and the next load of the map rescores.
+ */
+export function answerLegacyOffer(keep = [], { db = getDb(), rescore = rescoreAll } = {}) {
+  if (legacyOfferState(db) !== 'open') return { kept: [], scored: 0 };
+  const wanted = new Set(keep);
+  const kept = (legacyOffer(db)?.companies || [])
+    .filter((c) => wanted.has(c.name))
+    .map((c) => ({ name: c.name, score: c.was, names: c.names }));
+  db.exec('BEGIN');
+  try {
+    setCompanyScores(db, kept.flatMap((c) => c.names.map((n) => [n, c.score])));
+    db.prepare('UPDATE app_meta SET value = ? WHERE key = ?').run(kept.length ? 'kept' : 'declined', LEGACY_OFFER_KEY);
+    db.exec('COMMIT');
+  } catch (err) {
+    db.exec('ROLLBACK');
+    throw err;
+  }
+  if (!kept.length) return { kept, scored: 0 };
+  try {
+    return { kept, scored: rescore().scored };
+  } catch (err) {
+    // The kept scores are saved and the stored ones are not yet computed with
+    // them. Without a model stamp they count as stale, so the next load of the
+    // map redoes it (rpc.js rescoreIfStale), as a Settings save's retry does.
+    try { db.prepare("DELETE FROM app_meta WHERE key = 'scoring_version'").run(); } catch { /* then the next change to any score rescores */ }
+    throw Object.assign(new Error(`Kept, but rescoring your network failed (${err.message}). It will try again the next time the map loads.`), { kept });
+  }
+}

package/lib/legacy-scores.js

@@ -0,0 +1,77 @@
+// The curated company list's scores from before it was made neutral, kept for
+// one thing only: the one-time offer on Paths → Scores to keep them as your
+// own (lib/legacy-offer.js). Nothing scores with these. lib/scoring.js never
+// imports this file, and the model must never read it.
+//
+// The list used to mix well-known companies with picks from one person's
+// career and region (Snap at 9, UCF at 5, a group of 6s from one network),
+// and those picks were everyone's defaults. It now follows a written rule
+// (lib/scoring.js, docs/brain/SCORING.md). Each row here is an entry that the
+// rule removed or rescored, with the score exactly as it was:
+//
+//   [name, the score it had, the names it is offered for, its industry]
+//
+// The names and industry are kept because a removed entry no longer
+// canonicalises: "University of Central Florida" used to be read as "UCF" and
+// is now a name of its own. The names are the entry's own company's, as they
+// read once cleaned, and end there ($) unless every company starting so is
+// that company's (UCF's colleges, AdventHealth's hospitals, Havas's
+// agencies). The old aliases were wider and caught other companies too
+// ("Snap-on" and "Specs Optical" read as Snap, "Hard Rock Hotel" as Hard Rock
+// Digital): the old list scored those by mistake, and keeping must not give
+// them its score. Rows are in the old list's order, since the first to match
+// won.
+
+export const LEGACY_SCORES = [
+  // Rescored: scored like its peers Pinterest, Reddit and X.
+  ['Snap', 9, /^(snap|snapchat)( inc)?$/, 'media'],
+  // Removed: private companies that are neither household names nor Fortune
+  // 500-sized, and small startups.
+  ['Anduril', 9, /^anduril( industries)?$/, 'defense'],
+  ['Polymarket', 9, /^polymarket$/, 'finance'],
+  ['Kalshi', 9, /^kalshi$/, 'finance'],
+  ['Databricks', 8, /^databricks$/, 'tech'],
+  ['Figma', 8, /^figma$/, 'tech'],
+  ['Scale AI', 8, /^(scale ai|scale\.ai|scale\.com)$/, 'tech'],
+  ['Whatnot', 8, /^whatnot$/, 'consumer'],
+  // Removed: executive search firms, known to executives rather than to most
+  // professionals, and two of the field's five big firms (not its largest).
+  ['Egon Zehnder', 8, /^egon zehnder( international)?$/, 'consulting'],
+  ['Heidrick & Struggles', 8, /^heidrick( (&|and) struggles)?$/, 'consulting'],
+  // Rescored: a household name, but a company of a few hundred people, so the
+  // list's floor (7) rather than "major" (8).
+  ['MrBeast', 8, /^(mrbeast|beast industries)$/, 'media'],
+  // Removed: startups and mid-size companies known inside one field.
+  ['Whop', 7, /^whop$/, 'tech'],
+  ['Hims & Hers', 7, /^hims( (&|and) hers( health)?)?$/, 'health'],
+  ['Riot Games', 7, /^riot games$/, 'entertainment'],
+  ['Notion', 7, /^notion( labs)?$/, 'tech'],
+  ['Vercel', 7, /^vercel$/, 'tech'],
+  ['Plaid', 7, /^plaid$/, 'finance'],
+  ['Brex', 7, /^brex$/, 'finance'],
+  ['Ramp', 7, /^ramp$/, 'finance'],
+  ['Mercury', 7, /^mercury$/, 'finance'],
+  ['Chime', 7, /^chime$/, 'finance'],
+  // Removed: the only military branch on the list (no Army, Navy, Air Force or
+  // Marines), so a regional pick rather than a rule.
+  ['U.S. Space Force', 7, /^((u\.?s\.?|united states) )?space force$/, 'defense'],
+  // Removed: the "notable" 6s, drawn from one network and one region, and the
+  // one "local institution".
+  ['Grindr', 6, /^grindr$/, 'tech'],
+  ['Genius Sports', 6, /^genius sports( group)?$/, 'entertainment'],
+  ['Later', 6, /^later$/, 'media'],
+  ['Hard Rock Digital', 6, /^hard rock digital$/, 'entertainment'],
+  ['Vanta', 6, /^vanta$/, 'tech'],
+  ['Kaseya', 6, /^kaseya$/, 'tech'],
+  ['Havas', 6, /^havas\b/, 'media'],
+  ['VaynerMedia', 6, /^vayner ?media$/, 'media'],
+  ['AdventHealth', 6, /^adventhealth\b/, 'health'],
+  ['University of Florida', 6, /^(uf|university of florida)$/, 'education'],
+  ['The Athletic', 6, /^the athletic( media( company)?)?$/, 'media'],
+  ['UCF', 5, /^(ucf|university of central florida)\b/, 'education'],
+];
+
+// Where the offer's state lives in app_meta. lib/rpc.js rescoreAll() sets it
+// to 'open' the first time it replaces scores that came from the old list;
+// answering sets it to 'kept' or 'declined', and nothing sets it back.
+export const LEGACY_OFFER_KEY = 'legacy_scores_offer';