six-degrees 0.4.0-beta.1 → 0.4.1

package/lib/chain-layout.js

@@ -0,0 +1,228 @@
+// Where Bridge Chains puts a circle's dots.
+//
+// Blake, 2026-09-28: "when i scan someone and have a lot of 2nd degree its
+// almost a solid line and needs to expand more". Every dot sat on one ring, so
+// 200 people round one circle were a band and 800 were a solid line. Here a
+// circle fills rings from the inside out instead, as many as its count needs:
+// a small circle is one ring, a big one spreads into more, and neighbours keep
+// their distance. Plain maths, no React; tests/chain-layout.test.mjs.
+
+const TAU = Math.PI * 2;
+
+/** How many dots fit on a ring of `radius` across `sweep` radians, `spacing` apart. */
+function capacity(radius, spacing, sweep) {
+  if (radius <= 0) return 1;
+  const arc = sweep * radius;
+  // A whole circle closes on itself; an arc has a dot at each end.
+  return Math.max(1, sweep >= TAU - 1e-9 ? Math.floor(arc / spacing) : Math.floor(arc / spacing) + 1);
+}
+
+/** The rings from `inner` outwards, `spacing` apart, until `n` dots fit. */
+function ringsFor(n, inner, spacing, sweep) {
+  const radii = [];
+  let room = 0;
+  for (let r = inner; room < n; r += spacing) {
+    radii.push(r);
+    room += capacity(r, spacing, sweep);
+  }
+  return radii;
+}
+
+const outerOf = (n, inner, spacing, sweep) => {
+  const radii = ringsFor(n, inner, spacing, sweep);
+  return radii[radii.length - 1];
+};
+
+/**
+ * Places `n` dots in rings round a centre at (0, 0).
+ *
+ * The first ring sits at `inner`, and each next one `spacing` further out.
+ * When that would run past `outer`, the rings first start further in (down to
+ * `innerMin`), then close up (down to `minSpacing`); past that they carry on
+ * beyond `outer` rather than overlap, and zooming out shows them. The dots on
+ * each ring share it evenly, in proportion to its length, so every ring is
+ * about as full as the rest; the first `n` of a list sorted best-first land
+ * nearest the centre. Every other ring is turned by half a step, so dots on
+ * neighbouring rings don't line up in spokes.
+ *
+ * `start` and `sweep` fill an arc instead of the whole circle, each ring from
+ * its middle outwards.
+ *
+ * @returns {{ spacing: number, inner: number, rings: { radius: number, count: number }[],
+ *   points: { x: number, y: number, angle: number, ring: number }[] }}
+ */
+export function ringLayout(n, {
+  inner, outer, spacing, minSpacing = spacing / 3, innerMin = inner,
+  start = -Math.PI / 2, sweep = TAU,
+} = {}) {
+  const count = Math.max(0, Math.floor(n) || 0);
+  if (!count) return { spacing, inner, rings: [], points: [] };
+
+  let s = spacing;
+  let r0 = inner;
+  if (outerOf(count, r0, s, sweep) > outer) {
+    // Start further in, as far as innerMin, before closing anything up.
+    if (outerOf(count, innerMin, s, sweep) <= outer) {
+      let lo = innerMin, hi = inner;
+      for (let i = 0; i < 24; i++) {
+        const mid = (lo + hi) / 2;
+        if (outerOf(count, mid, s, sweep) <= outer) lo = mid; else hi = mid;
+      }
+      r0 = lo;
+    } else {
+      r0 = innerMin;
+      let lo = minSpacing, hi = spacing;
+      if (outerOf(count, r0, lo, sweep) <= outer) {
+        for (let i = 0; i < 24; i++) {
+          const mid = (lo + hi) / 2;
+          if (outerOf(count, r0, mid, sweep) <= outer) lo = mid; else hi = mid;
+        }
+      }
+      s = lo;
+    }
+  }
+
+  const radii = ringsFor(count, r0, s, sweep);
+  const caps = radii.map((r) => capacity(r, s, sweep));
+  const room = caps.reduce((a, b) => a + b, 0);
+
+  // Share the dots in proportion to each ring's room, never over it; what the
+  // rounding leaves goes to the rings with the most room left.
+  const counts = caps.map((c) => Math.min(c, Math.floor((count * c) / room)));
+  let left = count - counts.reduce((a, b) => a + b, 0);
+  while (left > 0) {
+    let best = -1;
+    for (let k = 0; k < caps.length; k++) {
+      if (counts[k] < caps[k] && (best < 0 || caps[k] - counts[k] > caps[best] - counts[best])) best = k;
+    }
+    counts[best]++;
+    left--;
+  }
+
+  const whole = sweep >= TAU - 1e-9;
+  const points = [];
+  const rings = [];
+  radii.forEach((radius, k) => {
+    const m = counts[k];
+    if (!m) return;
+    rings.push({ radius, count: m });
+    // Round a whole circle evenly; across an arc from one edge to the other, a
+    // lone dot in the middle of it. An arc fills from its middle outwards, so
+    // the first in the list sit nearest whatever the arc fans out from.
+    const step = whole ? TAU / m : m > 1 ? sweep / (m - 1) : 0;
+    const from = whole ? start + (k % 2 ? step / 2 : 0) : m > 1 ? start : start + sweep / 2;
+    const slots = whole ? null : middleOut(m);
+    for (let j = 0; j < m; j++) {
+      const angle = from + (slots ? slots[j] : j) * step;
+      points.push({ x: radius * Math.cos(angle), y: radius * Math.sin(angle), angle, ring: rings.length - 1 });
+    }
+  });
+  return { spacing: s, inner: r0, rings, points };
+}
+
+/** 0 … m-1 from the middle outwards: for 5, 2 3 1 4 0. */
+function middleOut(m) {
+  let lo = Math.floor((m - 1) / 2);
+  let hi = lo + 1;
+  const out = [lo--];
+  while (out.length < m) {
+    if (hi < m) out.push(hi++);
+    if (out.length < m && lo >= 0) out.push(lo--);
+  }
+  return out;
+}
+
+/** A dot's radius for a layout's spacing: bigger for higher tiers, never touching a neighbour. */
+export function dotRadius(spacing, tier) {
+  const scale = tier === 'S' ? 1 : tier === 'A' ? 0.86 : tier === 'B' ? 0.72 : 0.6;
+  return Math.max(1.4, Math.min(7, spacing * 0.42 * scale));
+}
+
+/**
+ * Where a bridge's circle is previewed on hover: a band beyond every ring of
+ * bridges. With many bridges the overview grows extra rings, past where the
+ * preview used to start, and it drew over them. `clear` leaves room for a
+ * hovered bridge's dot (20) and its name under it.
+ */
+export function previewBand(maxR, bridgeRings = [], clear = 34) {
+  const edge = Math.max(0, ...bridgeRings.map((r) => r.radius));
+  const inner = Math.max(maxR * 0.66, edge ? edge + clear : 0);
+  return { inner, outer: Math.max(maxR * 0.8, inner + maxR * 0.14) };
+}
+
+const TIER_BANDS = ['S', 'A', 'B', 'C', 'D'];
+
+/**
+ * An opened circle's people in tier bands round the person: S nearest, then A,
+ * B, C and D, with a gap between bands like Network Circle's tier orbits, so a
+ * big circle reads as layers instead of one clump. Points come back in the
+ * order of `rows`, each with `slot`: the angle its ring gives each dot. The
+ * spacing closes up, down to `minSpacing`, until every band fits inside
+ * `outer`; past that the bands carry on outwards and zooming out shows them.
+ *
+ * @returns {{ spacing: number, edge: number, bands: { tier: string, inner: number, outer: number }[],
+ *   points: { x: number, y: number, angle: number, slot: number }[] }}
+ */
+export function tierBandLayout(rows, { inner, outer, spacing, minSpacing = spacing / 3, gap = spacing }) {
+  const groups = TIER_BANDS.map((tier) => ({ tier, idx: [] }));
+  rows.forEach((row, i) => {
+    const t = TIER_BANDS.indexOf(row?.tier);
+    groups[t < 0 ? 4 : t].idx.push(i);              // no tier: with D
+  });
+  const used = groups.filter((g) => g.idx.length);
+  const place = (s) => {
+    const points = new Array(rows.length);
+    const bands = [];
+    let r = inner;
+    for (const g of used) {
+      const l = ringLayout(g.idx.length, { inner: r, outer: Infinity, spacing: s, minSpacing: s });
+      g.idx.forEach((rowIndex, j) => {
+        const p = l.points[j];
+        points[rowIndex] = { x: p.x, y: p.y, angle: p.angle, slot: TAU / l.rings[p.ring].count };
+      });
+      const edge = Math.max(r, ...l.rings.map((x) => x.radius));
+      bands.push({ tier: g.tier, inner: r, outer: edge });
+      r = edge + gap * (s / spacing);
+    }
+    return { spacing: s, points, bands, edge: bands.length ? bands[bands.length - 1].outer : inner };
+  };
+  let best = place(spacing);
+  if (best.edge <= outer) return best;
+  let lo = minSpacing;
+  let hi = spacing;
+  best = place(lo);
+  if (best.edge > outer) return best;
+  for (let i = 0; i < 20; i++) {
+    const mid = (lo + hi) / 2;
+    const tryMid = place(mid);
+    if (tryMid.edge <= outer) { lo = mid; best = tryMid; } else hi = mid;
+  }
+  return best;
+}
+
+/**
+ * The people behind each person in an opened circle: their own circle, drawn
+ * as a fan of small dots beyond `from`, centred on that person's angle and no
+ * wider than their slot (at most a sixth of the circle), so each fan sits
+ * behind its own person. At most `cap` dots a fan and about `total` in all, so
+ * a big network stays quick; `more` is how many weren't drawn.
+ *
+ * @param {{ angle: number, slot: number, count: number }[]} anchors
+ * @returns {({ points: { x: number, y: number }[], more: number } | null)[]}
+ */
+export function outerFans(anchors, { from, spacing = 7, cap = 40, total = 1200 } = {}) {
+  const fans = anchors.filter((a) => a?.count > 0).length;
+  const each = Math.max(6, Math.min(cap, Math.floor(total / Math.max(1, fans))));
+  return anchors.map((a) => {
+    if (!(a?.count > 0)) return null;
+    const n = Math.min(a.count, each);
+    // Only as wide as the dots need at `spacing`, never wider than their slot:
+    // more rows once it's full, so a small fan stays a tight cluster.
+    const room = Math.min(a.slot || TAU, TAU / 6);
+    const width = Math.min(room, Math.max((spacing * 3) / from, (n * spacing) / from));
+    const l = ringLayout(n, {
+      inner: from, outer: Infinity, spacing, minSpacing: spacing, start: a.angle - width / 2, sweep: width,
+    });
+    return { points: l.points.map(({ x, y }) => ({ x, y })), more: a.count - n };
+  });
+}

package/lib/circle.js

@@ -137,17 +137,34 @@ export function circleLayout(rings = [], size = 240) {
   for (let k = 0; k < R; k++) {
     const radius = radiusOf(k);
     const people = rings[k].people;
-    const dotR = clamp((2 * Math.PI * radius) / Math.max(1, people.length) * 0.32, 0.8, size / 60);
+    // More than their slice holds without the dots touching: rows, neighbours
+    // alternating between them, so a big circle never draws as a solid line.
+    // Each keeps its angle behind who they hang off. Rows go out towards the
+    // next ring, or for the outermost, in towards the one before (less than
+    // half way either side, so two rings' rows never meet).
+    const gap = Math.max(2.4, size / 100);
+    const inward = k === R - 1 && R > 1;
+    const band = (inward ? radius - radiusOf(k - 1) : (k + 1 < R ? radiusOf(k + 1) : half * 0.97) - radius) * 0.45;
+    const maxRows = Math.max(1, Math.floor(band / gap) + 1);
+    const rowGap = maxRows > 1 ? (inward ? -1 : 1) * Math.min(gap * 1.2, band / (maxRows - 1)) : 0;
+    const rowsFor = (count, arc) => clamp(Math.ceil((count * gap) / Math.max(1e-9, radius * arc)), 1, maxRows);
+    let rows = 1;
+    let room = Infinity;      // the least room any one dot gets along its row
     const items = [];
     for (const [parentId, group] of byParent[k]) {
       const [a0, a1] = k === 0 ? [START, START + 2 * Math.PI] : span.get(parentId) || [START, START + 2 * Math.PI];
       const total = group.reduce((s, p) => s + weight.get(p), 0);
+      const groupRows = rowsFor(group.length, a1 - a0);
+      rows = Math.max(rows, groupRows);
+      room = Math.min(room, (radius * (a1 - a0) * groupRows) / Math.max(1, group.length));
+      let n = 0;
       let a = a0;
       for (const p of group) {
         const w = ((a1 - a0) * weight.get(p)) / total;
         const angle = a + w / 2;
-        const x = half + radius * Math.cos(angle);
-        const y = half + radius * Math.sin(angle);
+        const r = radius + (n++ % groupRows) * rowGap;
+        const x = half + r * Math.cos(angle);
+        const y = half + r * Math.sin(angle);
         items.push({ ...p, angle, x, y });
         if (p.state === 'connected') span.set(p.row.id, [a, a + w]);
         a += w;
@@ -163,7 +180,9 @@ export function circleLayout(rings = [], size = 240) {
         spokes.push({ x1: it.x, y1: it.y, x2: half + nextR * Math.cos(mid), y2: half + nextR * Math.sin(mid) });
       }
     }
-    out.push({ degree: rings[k].degree, radius, dotR, items });
+    // Sized by the most crowded slice, and never wider than the gap between rows.
+    const dotR = clamp(Math.min(room * 0.32, rows > 1 ? Math.abs(rowGap) * 0.42 : Infinity), 0.8, size / 60);
+    out.push({ degree: rings[k].degree, radius, dotR, rows, items });
   }
   return { size, center: { x: half, y: half }, rings: out, spokes };
 }

package/lib/csv.js

@@ -1,4 +1,5 @@
 import { scorePerson, curveCutoffs, curvedTier } from './scoring.js';
+import { toIsoDate } from './ingest.js';
 // LinkedIn Connections.csv import — parsed ENTIRELY in the browser.
 //
 // Nothing is uploaded and nothing is written to the database: an imported
@@ -136,12 +137,9 @@ export function parseConnectionsCsv(text) {
     if (seen.has(id)) { skipped++; continue; }
     seen.add(id);
 
-    let connected_date = null;
-    const raw = cell(iConnected);
-    if (raw) {
-      const d = new Date(raw);
-      if (!isNaN(d.getTime())) connected_date = d.toISOString().split('T')[0];
-    }
+    // "28 Sep 2026", read as the calendar date it is. new Date(raw).toISOString()
+    // made it local midnight in UTC, a day early anywhere east of London.
+    const connected_date = toIsoDate(cell(iConnected));
 
     connections.push(connectionFrom({ id, name, role, company, profileUrl, connected_date }));
   }

package/lib/data-export.js

@@ -111,7 +111,8 @@ export function buildExport(db, { dir, outFile, includePhotos = true, appVersion
     // file the other computer doesn't have: some views draw an empty circle
     // for it. With no photo, they show initials, and the next scan of that
     // person saves a new one. A photo not saved yet (LinkedIn's own link,
-    // which expires in a few weeks) is left as it is, as it is here.
+    // which expires in a few weeks) is left as it is, as it is here: neither
+    // computer shows it, and either saves it once (lib/photos.js).
     if (!includePhotos) {
       out.exec("UPDATE linkedin_connections SET profile_image_url = NULL WHERE profile_image_url LIKE '/avatars/%'");
     }

package/lib/data-folder.js

@@ -11,9 +11,11 @@
 import { readdirSync, lstatSync, existsSync, rmSync } from 'node:fs';
 import { spawn } from 'node:child_process';
 import path from 'node:path';
+import { AVATAR_FILE } from './photos.js';
 
-/** A photo the /avatars route serves: a plain file name, no folders. The route uses this same pattern. */
-export const AVATAR_FILE = /^[A-Za-z0-9_-]+\.(webp|jpg|jpeg|png)$/;
+// A photo the /avatars route serves (lib/photos.js). An export carries and an
+// import accepts exactly those names.
+export { AVATAR_FILE };
 
 /**
  * The scanner's notes about the network itself: without them, people whose

package/lib/degrees.js

@@ -0,0 +1,30 @@
+// Everyone the app knows, by degree, for Network Circle's degree filter.
+//
+// 1st: your connections. 2nd: anyone in a scanned circle, including the people
+// behind someone you added, since you're connected to them now. 3rd: anyone a
+// company scan found who is neither. Each person counts once, at the nearest
+// degree they're found (by profile, lib/separation.js keyFor), whichever
+// circle or scan found them first.
+
+import { keyFor } from './separation.js';
+
+export function peopleByDegree(degree1 = [], degree2 = [], degree3 = []) {
+  const seen = new Set();
+  const take = (rows, degree) => {
+    const out = [];
+    for (const row of rows || []) {
+      const key = keyFor(row);
+      if (seen.has(key)) continue;
+      seen.add(key);
+      out.push(row.degree === degree ? row : { ...row, degree });
+    }
+    return out;
+  };
+  return { 1: take(degree1, 1), 2: take(degree2, 2), 3: take(degree3, 3) };
+}
+
+export function tierCountsOf(rows = []) {
+  const counts = {};
+  for (const row of rows) counts[row.tier] = (counts[row.tier] || 0) + 1;
+  return counts;
+}

package/lib/galaxy.js

@@ -0,0 +1,12 @@
+// The Galaxy's view, as numbers, kept apart from the drawing so it can be tested
+// (app/components/ForceGraph.js).
+
+/**
+ * The same view in a box of a new size. It moves by half the change, at the
+ * same zoom, so whatever was in the middle of the box is in the middle still.
+ * Opening a 320-pixel panel slides the view 160 pixels left, and closing it
+ * slides the view back to exactly where it was.
+ */
+export function recentre({ x, y, k }, from, to) {
+  return { x: x + (to.width - from.width) / 2, y: y + (to.height - from.height) / 2, k };
+}

package/lib/ingest.js

@@ -31,34 +31,41 @@ export function uniqueByProfile(records) {
  */
 export function splitAlreadyConnected(records, firstDegreeUrls) {
   const keep = [];
-  let alreadyConnected = 0;
+  const connected = [];      // their profile URLs: ties between your connections (lib/ties.js)
   for (const r of records) {
-    if (firstDegreeUrls.has(r.profile_url)) alreadyConnected += 1;
+    if (firstDegreeUrls.has(r.profile_url)) connected.push(r.profile_url);
     else keep.push(r);
   }
-  return { keep, alreadyConnected };
+  return { keep, alreadyConnected: connected.length, connected };
 }
 
 const MONTHS = ['january', 'february', 'march', 'april', 'may', 'june', 'july',
   'august', 'september', 'october', 'november', 'december'];
 
 /**
- * "September 22, 2026" (as LinkedIn prints "Connected on …") → "2026-09-22".
+ * A date as LinkedIn writes it → "2026-09-22": "September 22, 2026" (a profile's
+ * "Connected on …", read by the scanner) or "22 Sep 2026" (the "Connected On"
+ * column of the Connections.csv export, read by lib/csv.js).
  *
  * Parsed by hand rather than with new Date(text).toISOString(): that reads the
  * text as local midnight and converts to UTC, which moves the date back a day
  * anywhere east of Greenwich — and throws outright on text it cannot read.
- * Returns null for anything it does not recognise.
+ * A calendar date has no time zone, so nothing here uses one.
+ * Returns null for anything it does not recognise, or a day the month doesn't have.
  */
 export function toIsoDate(text) {
   const t = String(text || '').trim();
   if (/^\d{4}-\d{2}-\d{2}$/.test(t)) return t;
-  const m = t.match(/^([A-Za-z]+)\.?\s+(\d{1,2}),?\s+(\d{4})$/);
-  if (!m) return null;
-  const month = MONTHS.findIndex((name) => name.startsWith(m[1].toLowerCase()) && m[1].length >= 3);
-  const day = Number(m[2]);
-  if (month < 0 || day < 1 || day > 31) return null;
-  return `${m[3]}-${String(month + 1).padStart(2, '0')}-${String(day).padStart(2, '0')}`;
+  let name, day, year;
+  let m = t.match(/^([A-Za-z]+)\.?\s+(\d{1,2}),?\s+(\d{4})$/);   // September 22, 2026
+  if (m) [, name, day, year] = m;
+  else if ((m = t.match(/^(\d{1,2})\s+([A-Za-z]+)\.?\s+(\d{4})$/))) [, day, name, year] = m;   // 22 Sep 2026
+  else return null;
+  const month = MONTHS.findIndex((full) => full.startsWith(name.toLowerCase()) && name.length >= 3);
+  day = Number(day);
+  // Day 0 of the next month is this month's last, counted in UTC so no zone moves it.
+  if (month < 0 || day < 1 || day > new Date(Date.UTC(Number(year), month + 1, 0)).getUTCDate()) return null;
+  return `${year}-${String(month + 1).padStart(2, '0')}-${String(day).padStart(2, '0')}`;
 }
 
 // Tiers that make a new connection worth a notification of its own.

package/lib/linkedin-limits.js

@@ -4,15 +4,21 @@
 // reads them with the same rules, and writes only the two things a person
 // changes here — the budget, and lifting a cooldown.
 //
+// The budget is searches (a day and a month) and profile views (a day). Profile
+// views got an account restricted (TRAPS §16), so their cap has no "no limit",
+// and the scanner also keeps any two a minute apart. Searches did too, at 373 in
+// 24 hours: the page asks before a risky search budget (lib/search-risk.js).
+//
 // They belong to the LinkedIn account, not to a profile in the app. TRAPS §35.
 
 import { readFileSync, writeFileSync, renameSync, unlinkSync, existsSync, lstatSync } from 'node:fs';
 import path from 'node:path';
 import { durable } from './durable.js';
 
-export const DEFAULT_LIMITS = { daily: 50, monthly: 250 };
+export const DEFAULT_LIMITS = { daily: 50, monthly: 250, profiles: 50 };
 export const DAILY_CHOICES = [25, 50, 100, 200, 500];
 export const MONTHLY_CHOICES = [100, 250, 500, 1000, 0];   // 0 = no monthly cap (Premium)
+export const PROFILE_CHOICES = [10, 25, 50, 100];           // profile views a day; never unlimited
 const DAY = 24 * 3600;
 const PACIFIC = 'America/Los_Angeles';
 
@@ -53,18 +59,32 @@ export function nextMonthStartPacific(ms = Date.now()) {
   return monthStartPacific(start + 40 * DAY * 1000);
 }
 
+const profileChoice = (n) => PROFILE_CHOICES.filter((c) => c <= n).pop() ?? PROFILE_CHOICES[0];
+
 export function readLimits(dir) {
   const raw = readJson(path.join(dir, 'scan-limits.json')) || {};
   const num = (v, d) => (Number.isInteger(v) && v >= 0 ? v : d);
-  return { daily: num(raw.daily, DEFAULT_LIMITS.daily), monthly: num(raw.monthly, DEFAULT_LIMITS.monthly) };
+  return {
+    daily: num(raw.daily, DEFAULT_LIMITS.daily),
+    monthly: num(raw.monthly, DEFAULT_LIMITS.monthly),
+    // 0 is "no limit" for searches; for profile views the scanner reads it as the
+    // default. A number typed in by hand counts as the largest choice under it,
+    // as the scanner reads it (scrape.py search_limits).
+    profiles: profileChoice(num(raw.profiles, 0) || DEFAULT_LIMITS.profiles),
+  };
 }
 
-/** Only the offered choices are accepted, like everything else that reaches the scanner. */
-export function writeLimits(dir, { daily, monthly }) {
+/**
+ * Only the offered choices are accepted, like everything else that reaches the
+ * scanner. A value not given keeps what is saved: every key is written back,
+ * or saving one would drop the others to their defaults.
+ */
+export function writeLimits(dir, { daily, monthly, profiles } = {}) {
   const cur = readLimits(dir);
   const next = {
     daily: DAILY_CHOICES.includes(daily) ? daily : cur.daily,
     monthly: MONTHLY_CHOICES.includes(monthly) ? monthly : cur.monthly,
+    profiles: PROFILE_CHOICES.includes(profiles) ? profiles : cur.profiles,
   };
   writeJsonAtomic(path.join(dir, 'scan-limits.json'), next);
   return next;
@@ -72,13 +92,14 @@ export function writeLimits(dir, { daily, monthly }) {
 
 /**
  * Searches in the last 24 hours and since LinkedIn's month began, and profile
- * views today. An unreadable record reads as the day used up, as the scanner
- * treats it — failing open would say nothing had been searched.
+ * views in the last 24 hours. An unreadable record reads as the day used up,
+ * searches and profile views both, as the scanner treats it — failing open
+ * would say nothing had been searched.
  */
 export function usage(dir, now = Date.now()) {
   const file = path.join(dir, 'linkedin-activity.json');
   const data = existsSync(file) ? readJson(file) : { searches: [], profiles: [] };
-  if (!data || typeof data !== 'object') return { searchesToday: Infinity, searchesMonth: 0, profilesToday: 0, unreadable: true };
+  if (!data || typeof data !== 'object') return { searchesToday: Infinity, searchesMonth: 0, profilesToday: Infinity, unreadable: true };
   const s = (Array.isArray(data.searches) ? data.searches : []).map(Number);
   const p = (Array.isArray(data.profiles) ? data.profiles : []).map(Number);
   const dayAgo = now / 1000 - DAY;
@@ -113,6 +134,7 @@ export function linkedinState(dir, now = Date.now()) {
     limits,
     leftToday: left(limits.daily, use.searchesToday),
     leftMonth: left(limits.monthly, use.searchesMonth),
+    profilesLeftToday: left(limits.profiles, use.profilesToday),
     monthResets: nextMonthStartPacific(now),
     cooldown: readCooldown(dir, now),
   };
@@ -138,7 +160,8 @@ const isTime = (v) => typeof v === 'number' && Number.isFinite(v) && v >= 0;
  * Why one of these files from another computer can't be used here, in words
  * for the page, or null when it can. The limits follow writeLimits: only the
  * menu's own choices. A value the app never offers is refused rather than
- * passed to the scanner, which reads a daily limit of 0 as "no limit at all".
+ * passed to the scanner, which reads a daily limit of 0 as "no limit at all"
+ * (and 1000 profile views a day would be as good as none).
  */
 export function budgetFileProblem(name, data) {
   if (!isObject(data)) return 'it is not a JSON object';
@@ -155,6 +178,9 @@ export function budgetFileProblem(name, data) {
     if (data.monthly !== undefined && !MONTHLY_CHOICES.includes(data.monthly)) {
       return `its monthly limit (${String(data.monthly).slice(0, 20)}) is not one Six Degrees offers`;
     }
+    if (data.profiles !== undefined && !PROFILE_CHOICES.includes(data.profiles)) {
+      return `its limit on profile views (${String(data.profiles).slice(0, 20)}) is not one Six Degrees offers`;
+    }
   }
   return null;
 }
@@ -236,6 +262,7 @@ export function mergeBudgetFiles({ dir, from }) {
     durable.writeJsonDurably(here(LIMITS), {
       daily: limits.daily ?? DEFAULT_LIMITS.daily,
       monthly: limits.monthly ?? DEFAULT_LIMITS.monthly,
+      profiles: limits.profiles ?? DEFAULT_LIMITS.profiles,
     });
   }
 }

package/lib/photos.js

@@ -0,0 +1,47 @@
+// Profile photos are shown from this computer only.
+//
+// The scanner saves each photo into the data folder as it reads it
+// (scripts/image_store.py), and the row points at the saved file,
+// `/avatars/<name>`, which app/avatars/[file] serves. A row can also hold a
+// link: LinkedIn's own, which older versions stored until the scanner replaced
+// it, and which a copy of a network made by one carries too. A page never loads
+// a link: it would contact LinkedIn while someone is only looking at their map,
+// and the app goes online only when you act. That person shows initials until
+// the photo is saved, at the next scan or with Save photos on the Scan page.
+// The Content-Security-Policy in next.config.mjs holds the same line in the
+// browser.
+//
+// No imports, so the views and the server share it: every view and the routes
+// that store photos check with localPhoto, and the /avatars route serves the
+// names AVATAR_FILE allows.
+
+/** A photo the /avatars route serves: a plain file name, no folders. The route uses this same pattern. */
+export const AVATAR_FILE = /^[A-Za-z0-9_-]+\.(webp|jpg|jpeg|png)$/;
+
+const PREFIX = '/avatars/';
+
+/** The photo to show for a row's `profile_image_url`: its saved file's path, or null. */
+export function localPhoto(url) {
+  if (typeof url !== 'string' || !url.startsWith(PREFIX)) return null;
+  return AVATAR_FILE.test(url.slice(PREFIX.length)) ? url : null;
+}
+
+/**
+ * The photos still kept as links, one per person and link:
+ * [{ profileUrl, imageUrl }]. `db` is an open node:sqlite database. The
+ * scanner saves each (`GET /api/update-images`), or forgets the link on a
+ * definite no, so a link is tried until there's an answer.
+ */
+export function waitingPhotos(db) {
+  return db.prepare(`SELECT DISTINCT profile_url AS profileUrl, profile_image_url AS imageUrl
+      FROM linkedin_connections
+     WHERE profile_image_url IS NOT NULL AND profile_image_url <> ''
+       AND substr(profile_image_url, 1, 9) <> '/avatars/'
+     ORDER BY profile_url`).all()
+    .filter((r) => r.profileUrl && !localPhoto(r.imageUrl));
+}
+
+/** How many people have a photo waiting to be saved. */
+export function waitingPhotoCount(db) {
+  return new Set(waitingPhotos(db).map((r) => r.profileUrl)).size;
+}

package/lib/quest.js

@@ -9,6 +9,8 @@
 // sent, people who actually joined your network), never from browsing.
 // Plain functions; tests/quest.test.mjs.
 
+import { circleState } from './reach.js';
+
 export const STAGE_SIZE = 5;
 export const XP_SEND = { S: 25, A: 15, B: 10, C: 5, D: 2 };
 export const XP_ADDED = { S: 100, A: 60, B: 35, C: 15, D: 5 };
@@ -26,8 +28,9 @@ export function levelFor(points) {
  * @param sentIds ids marked "invite sent"
  * @param added   1st-degree people who came through a cluster (unlocked_from_bridge_id set)
  * @param mappedIds ids of 1st-degree people whose own circle is mapped
+ * @param reach   lib/reach.js reachIndex(), which also knows hidden lists; mappedIds stands in without it
  */
-export function buildQuest({ recs = [], sentIds = new Set(), added = [], mappedIds = new Set() }) {
+export function buildQuest({ recs = [], sentIds = new Set(), added = [], mappedIds = new Set(), reach = null }) {
   const byBridge = new Map();
   const seen = new Set();
   for (const r of [...recs].sort((a, b) => (b.priority || 0) - (a.priority || 0))) {
@@ -112,8 +115,10 @@ export function buildQuest({ recs = [], sentIds = new Set(), added = [], mappedI
     level: levelFor(points),
     sentTotal,
     addedTotal,
-    // People you've added whose own circle isn't mapped yet: the next degree.
-    newDoors: added.filter((a) => a.unlocked_from_bridge_id && !mappedIds.has(a.id)),
+    // People you've added whose own circle can be scanned: the next degree.
+    // Hidden lists aren't doors (lib/reach.js, the rule Bridge Chains uses).
+    newDoors: added.filter((a) => a.unlocked_from_bridge_id
+      && circleState(a, reach || { scanned: mappedIds, hidden: new Set() }) === 'todo'),
     clearedStages: clusters.reduce((s, c) => s + (c.stage - 1) + (c.complete ? 1 : 0), 0),
   };
 }