six-degrees 0.6.0 → 0.8.0

package/.next/standalone/README.md

@@ -68,7 +68,7 @@ The links above always fetch the newest release.</sub>
 
 **Which download?** Apple menu → **About This Mac**. If it says "Chip: Apple M…", take
 **Apple Silicon**. If it says "Processor: …Intel…", take **Intel**. It needs **macOS 13.5
-(Ventura) or later**, and it's about 220 MB. Everything the scanner needs except Google
+(Ventura) or later**, and it's about 210 MB. Everything the scanner needs except Google
 Chrome is inside, Python included, so there's nothing else to install.
 
 **The first time you open it**, macOS stops it, because the app isn't signed with a
@@ -112,8 +112,9 @@ Downloading the new `.dmg` works too; you'll repeat step 3 once for it.
 
 Your network isn't stored in the app. It's in a hidden folder in your home folder,
 `.six-degrees` (open it any time with *Help → Show the Data Folder*), so updates never
-touch it. Each new version also copies your data into its `backups` folder before it
-first opens it. To take it to another computer, see
+touch it. Each new version also backs up your data, photos and all, into its `backups`
+folder before it first opens it, and Six Degrees makes a backup each day it's open
+(see [Backups](#backups)). To take it to another computer, see
 [Moving to a new computer](#moving-to-a-new-computer).
 
 **Windows (beta):** download [Six-Degrees-Windows-Setup.exe](https://github.com/blakeb056/six-degrees/releases/download/v0.5.1-beta.1/Six-Degrees-Windows-Setup.exe)
@@ -192,6 +193,16 @@ in, and its most powerful people.
 
 <img src="docs/img/paths.png" alt="Paths → Map with the company analyzer open: companies grouped by industry, and one company's people by level and ways in" width="100%">
 
+**Insights.** Everyone within two steps of you in one table, ranked by power, each person
+once: the **Power Index**, with filters for degree, tier and rarity, and Open circle, Scan
+circle or Ask on every row. Beside it, and each a board of its own in the notch:
+**Kingmakers** (your connections with the most S and A people behind them), **Gatekeepers**
+(who your S and A reach hangs on), **Hidden giants** (S-tier with one way in), **Untapped**
+(S and A with no request out), **Company power** and **Industries**. **Report** is the same
+numbers as a page you scroll. Every number says where it came from, and nothing is about
+money: *Richest?* says plainly that the app never sees it. Power ranks reachability, not
+people.
+
 **Scores.** How a power score is worked out, and the three things you can change about
 it, in one place: your field (the sectors you work in), how tiers are graded (on your
 network's curve or the fixed scale), and every scanned company's score.
@@ -201,6 +212,15 @@ circle offers its best five people at a time; mark invites as sent to fill the r
 unlock the next five. It also shows the next best moves, levels and points (from
 invites sent and people who accepted, never from browsing).
 
+**Auto** *(needs a scan)*. Next to every Connect (a person's card, Outlink), Auto sends
+that one person a connection request for you, from the scanner's Chrome, without a note.
+One press, one person: never a batch, never on a timer. It asks once before the first one.
+If LinkedIn wants their email address first, Auto closes that and sends nothing (use
+Connect to add them yourself); if it offers a personal note (Premium), Auto sends without
+one. It calls a request sent only once their profile shows it pending. It stops at 15 in
+any 24 hours and 80 in any 7 days, opens their profile once (a profile view), and counts in
+Settings → LinkedIn usage.
+
 **Scan.** The guided scanner. It shows progress, the budget that's left, the cooldown
 lock, and a **Paused** list you can carry on from.
 
@@ -283,6 +303,14 @@ Something out of date, or unfair to another tool? [Open an issue](https://github
 >
 > **The CSV import and the sample network carry no LinkedIn risk at all.** Details:
 > [how scanning works and what it risks](docs/SCRAPING.md).
+>
+> The app asks for an explicit "I understand" once, before the first scan.
+>
+> **The scanner reads; the one thing it ever sends is a connection request, and only when
+> you press Auto** on a person (one each press, without a note, at most 15 a day and 80 a
+> week). Auto asks once before its first request.
+>
+> Six Degrees is not affiliated with or endorsed by LinkedIn.
 
 ## First run
 
@@ -298,7 +326,7 @@ The app opens on a welcome screen with three ways in, and asks nothing about you
 - **Import my LinkedIn CSV**: LinkedIn's official export, read on your machine. On
   LinkedIn: **Settings & Privacy → Data privacy → Get a copy of your data →
   Connections**. LinkedIn emails a link in about ten minutes; unzip it and drop
-  `Connections.csv` into the app.
+  `Connections.csv` into the app. It's kept on your computer until you remove it.
 - **Explore a sample network**: 150 invented connections and the 598 invented people
   they know. Click through before deciding anything.
 
@@ -317,8 +345,12 @@ people you *haven't* met, have nothing to draw. That data exists in no official
 the scanner is the only way to it, and it's opt-in for that reason.
 
 While the sample or a CSV is loaded, the top bar shows *Sample network ×* or *Your CSV
-×* (click × to go back), and Outlink and Scan are hidden. Neither is ever added to your
-network: they last as long as the app's window is open.
+×*, and Outlink and Scan are hidden. Neither is ever added to your network. The sample
+lasts as long as the app's window is open. A CSV import is kept on your computer, in the
+data folder (`csv-network.json`), so it's still there after you close the window or
+restart; click × to remove it (your `Connections.csv` itself isn't touched). Once you've
+scanned your own connections, the map shows your scan instead; the CSV stays kept until
+you remove it from the import page.
 
 ## How scoring works
 
@@ -382,10 +414,12 @@ It estimates **network position**, not what anyone is worth as a person.
 
 - Your network is stored on your computer and nowhere else. No account, no server, no
   telemetry, no analytics, no crash reporting.
-- A CSV import is read on your machine and never added to your network. It's held only
-  in the app window's own storage, and you import it again next time.
+- A CSV import is read on your machine and never added to your network. It's kept in the
+  data folder as `csv-network.json` (names, positions, companies, profile links and when
+  you connected; never email addresses) until you click × beside *Your CSV*.
 - The app contacts only these, and only when you act:
-  - **LinkedIn**, while you scan. Each profile photo is saved on your computer as the
+  - **LinkedIn**, while you scan, and when you press **Auto** (one connection request,
+    sent from the scanner's Chrome). Each profile photo is saved on your computer as the
     scan reads it, and the app shows photos only from there, so looking at your network
     never contacts LinkedIn. (Photos an older version kept as links to LinkedIn show
     initials until the next scan, or *Save photos* on the Scan page, saves them.)
@@ -413,30 +447,58 @@ See [SECURITY.md](SECURITY.md) for the threat model.
 ```
 .six-degrees/               in your home folder (hidden)
 ├── six-degrees.sqlite      your network: connections, scores, tiers, queue, settings
-├── backups/                copies of the database from before each new version, and
-│                           before an import, touched it
+├── backups/                backups of your network: daily, before each new version, before
+│                           an import or a restore, and any you make (see Backups below)
 ├── avatars/                profile photos, if you scan
 ├── chrome-profile/         the scanner's Chrome sign-in, if you scan (see below)
 ├── venv/                   the scanner's Python add-ons, if you set it up without the Mac app
 ├── python/                 a private Python for them, if Set up the scanner downloaded one
 ├── pushback/               what LinkedIn's page said if it ever pushed back
+├── csv-network.json        a LinkedIn CSV import, kept until you remove it
 └── *.json                  the scanner's budget, cooldown, progress and skip lists
 ```
 
 **Settings → Your data** shows where this folder is (with *Copy the path* and *Show in
 Finder*), what each part takes up, and the backups in it.
 
+### Backups
+
+A backup is your whole network in one `.sixdegrees` file: your connections, their profile
+photos, your settings (the look and your saved Galaxy layouts too), and the scanner's
+progress, skip lists and LinkedIn budget. Each one is checked as it's made, the same way a
+restore would check it, so a backup that's listed would restore. The Social tab's messages
+and notes are never in a backup, so deleting them there (*Forget it*) deletes them
+everywhere, and a restore leaves them as they are. Six Degrees makes one:
+
+- **each day** it's open with a network in it (when it starts, and after a scan, if the
+  newest daily one is a day old; nothing runs on a timer), keeping the last 7;
+- **before a new version** first opens your data, keeping the last 3;
+- **when you click Back up now** in Settings → Your data. These are never deleted for you.
+
+An import or a restore keeps what it replaced as well (`before-import-…`), keeping the
+last 3, and never one that's under 30 days old. Anything else you put in `backups/`
+yourself is never touched.
+
+Settings → Your data says when the last backup was made and whether it passed its check
+("Last backup: <time>, verified"), or what's wrong with it if it didn't. Each backup has
+**Restore** and **Show in Finder**. Backups stay on this computer: to keep one safe if the
+computer is lost, copy it somewhere else (Show in Finder, then drag it to a USB stick).
+
+They take space. For a network of about 650 connections and 5,000 people beyond them,
+with their photos, each backup is about 25 to 35 MB, so the kept ones add up to about
+300 to 400 MB.
+
 ### Moving to a new computer
 
-1. On the old computer, open **Settings → Your data** and click **Save a copy of my
-   network**. You get one file, `Six Degrees backup <date>.sixdegrees`, with your network,
+1. On the old computer, open **Settings → Your data** and click **Export backup
+   file…**. You get one file, `Six Degrees backup <date>.sixdegrees`, with your network,
    your settings, the scanner's progress, skip lists and LinkedIn budget, and the profile
    photos of the people in it (untick them to leave them out; they come back as you scan
    again).
 2. Move that file to the new computer yourself (a USB stick, AirDrop). It holds other
    people's names and photos, so don't post it or share it.
-3. On the new computer, install Six Degrees, open **Settings → Your data**, choose the
-   file and click **Import**. It's checked first, and nothing changes if it isn't a whole
+3. On the new computer, install Six Degrees, open **Settings → Your data**, click
+   **Restore from a file…**, choose the file and click **Restore**. It's checked first, and nothing changes if it isn't a whole
    and undamaged Six Degrees copy. If that computer already has a network, you're asked to
    confirm that the import replaces it. The two networks are never merged. Your LinkedIn
    search budget is the one thing that is: it belongs to your LinkedIn account, not to a
@@ -446,42 +508,27 @@ Finder*), what each part takes up, and the backups in it.
    **Restart now**; with `npx six-degrees`, press Ctrl-C and start it again. If another
    copy of Six Degrees has the same folder open (one started from the Terminal, say), the
    import waits, and Settings says so. What was there before is kept in `backups/`
-   (`before-import-…`), and those copies are never deleted automatically: see
-   [Undo an import](#undo-an-import).
+   (`before-import-…`), for at least 30 days: see [Undo an import](#undo-an-import).
 5. Sign in to LinkedIn again on the new computer before you scan. Your sign-in never goes
-   into a copy. A network opened from a LinkedIn CSV isn't in the copy either: it lives in
-   its browser tab, so import the CSV again there.
+   into a copy. A LinkedIn CSV import kept on the old computer does go into it, and opens
+   on the new one.
 
 ### Undo an import
 
-An import keeps what it replaced in the data folder's `backups/`, named with the time it
-finished (Settings → Your data shows the exact name):
-
-- `before-import-<time>.sqlite`: your network as it was.
-- `before-import-<time>-files/`: its profile photos (`avatars/`), the scanner's notes about
-  it (`bridge-progress.json`, `bridge-skips.json`, `bridge-unclear.json`), and a copy of
-  your LinkedIn budget files as they were.
-
-To put it back (there's no button for this yet):
-
-1. Quit Six Degrees (⌘Q in the Mac app, Ctrl-C for `npx six-degrees`). Do the rest while
-   it's closed.
-2. Open the data folder (Settings → Your data → *Show in Finder*, or `~/.six-degrees`).
-   Move these out of it, to the Trash or somewhere safe if you might want the imported
-   network again: `six-degrees.sqlite`, and `six-degrees.sqlite-wal` and
-   `six-degrees.sqlite-shm` if they're there (a `-wal` left beside a different database
-   is replayed into it and damages it), then `avatars/` and the three `bridge-*.json`
-   files.
-3. Copy `backups/before-import-<time>.sqlite` into the data folder and rename the copy
-   `six-degrees.sqlite`. If `before-import-<time>.sqlite-wal` and `-shm` files are beside
-   it, copy them too, renamed to match (`six-degrees.sqlite-wal`,
-   `six-degrees.sqlite-shm`).
-4. Copy `avatars/` and the three `bridge-*.json` files from
-   `backups/before-import-<time>-files/` back into the data folder.
-5. Leave `linkedin-activity.json`, `linkedin-cooldown.json` and `scan-limits.json` as they
-   are. They're your LinkedIn account's budget, which the import kept (it only added the
-   other computer's searches), so they're right whichever network you use.
-6. Open Six Degrees again.
+An import, or a restore, keeps what it replaced in the data folder's `backups/`, named with
+the time it finished: `before-import-<time>.sqlite`, your network as it was, and
+`before-import-<time>-files/` beside it, with its profile photos, the scanner's notes
+about it, and a CSV import kept with it if there was one.
+
+To put it back, open **Settings → Your data**, open **The backups**, find **Before an import
+or a restore** with that time, and click **Restore**. It's checked first, then finishes when
+Six Degrees restarts (**Restart now** in the Mac app; with `npx six-degrees`, press Ctrl-C
+and start it again), and what's there now is kept in the same way, so you can go back
+again. Your LinkedIn search budget stays as it is: it belongs to your LinkedIn account,
+not to a network.
+
+The same **Restore** puts back any other backup: yesterday's, or the one from before the
+last update.
 
 Don't put the live folder in iCloud Drive or Dropbox to share it between computers
 instead. A sync service that copies the database while it's open can damage it, and it
@@ -490,8 +537,7 @@ would also sync your LinkedIn sign-in.
 **To remove everything:** quit the app and drag **Six Degrees** from Applications to the
 Trash. Then in Finder choose **Go → Go to Folder…** (⇧⌘G), paste `~/.six-degrees` and
 move that folder to the Trash. Do the same for
-`~/Library/Application Support/Six Degrees`, the app window's own storage and cache
-(it can include a CSV you imported).
+`~/Library/Application Support/Six Degrees`, the app window's own storage and cache.
 
 > [!WARNING]
 > `chrome-profile/` holds a **real, signed-in LinkedIn session**. It's the one thing here
@@ -505,7 +551,7 @@ Nothing to configure. Two optional environment variables exist:
 | Variable | Purpose |
 |---|---|
 | `SIX_DEGREES_HOME` | Where your data lives. Defaults to `~/.six-degrees`. It's read at launch, so it applies to `npx six-degrees` and source runs (npx also takes `--data-dir`; see `npx six-degrees --help`), not when the Mac app is opened from the Dock or Finder. A relative folder is taken from the folder you run the command in. |
-| `ADMIN_TOKEN` | Not needed on your own computer. The app listens only on 127.0.0.1 and isn't built to be exposed: don't put it behind a tunnel or bind it to another address ([SECURITY.md](SECURITY.md)). If it's ever bound elsewhere, the ten routes that delete, replace or hand over your data, run the scanner, open the data folder or update a copy run from source refuse every caller without this token, including the app's own buttons. Everything else, including reading your whole network, stays open. |
+| `ADMIN_TOKEN` | Not needed on your own computer. The app listens only on 127.0.0.1 and isn't built to be exposed: don't put it behind a tunnel or bind it to another address ([SECURITY.md](SECURITY.md)). If it's ever bound elsewhere, the eleven routes that delete, replace or hand over your data, run the scanner, open the data folder or update a copy run from source refuse every caller without this token, including the app's own buttons. Everything else, including reading your whole network, stays open. |
 
 ## Docs
 

package/.next/standalone/SECURITY.md

@@ -12,21 +12,25 @@ This app is designed to run **on your own machine, against your own network**.
 
 - The web UI binds to localhost. It is not hardened for exposure to the
   internet, and it has no multi-user authentication or per-user authorization.
-- Ten API routes are gated (`admin-delete`, `admin-update`, `delete-cluster`,
-  `setup-profile`, `scraper`, `update`, and Settings → Your data's
-  `data/export`, `data/import`, `data/restart`, `data/reveal`). The first four
-  can irreversibly destroy or rewrite data, `scraper` starts processes, and
-  `update` changes the code that runs next. `data/export` hands over the whole
+- Thirteen API routes are gated (`admin-delete`, `admin-update`, `delete-cluster`,
+  `setup-profile`, `scraper`, `update`, Settings → Your data's
+  `data/export`, `data/import`, `data/restart`, `data/reveal`, `data/backup`,
+  `data/restore`, and `data/csv`). The first four can irreversibly destroy or rewrite data,
+  `scraper` starts processes, and `update` changes the code that runs next. `data/export` hands over the whole
   network in one file, `data/import` replaces it, `data/restart` stops the
-  server, and `data/reveal` starts a process (Finder, or the Linux file
-  browser, on the data folder's own path). While the server is bound to
+  server, `data/reveal` starts a process (Finder, or the Linux file
+  browser, on the data folder's own path or a backup in it), `data/backup`
+  writes the whole network to a file in `backups/`, `data/restore`
+  replaces the network with one of those backups, named as `backups/` lists
+  it, never by a path from the request, and `data/csv` keeps, hands over and
+  removes a LinkedIn CSV import kept in the data folder. While the server is bound to
   127.0.0.1 they need no token — anyone who can reach it can already open the
   database file directly, so a token there adds friction rather than safety. If
   it is bound to any other address, every caller must send `ADMIN_TOKEN` as a
   bearer, including this machine and the app's own buttons, and the routes
   refuse to run when it is unset. Reading the data folder's facts
-  (`GET /api/data`: its path and sizes) changes nothing and stays open, like
-  every other read.
+  (`GET /api/data`: its path, sizes and backups) changes nothing and stays
+  open, like every other read.
 - A localhost-bound service is still reachable by any web page you visit — the
   binding keeps other machines out, not your own browser. Every mutating API
   request is therefore refused when the browser reports it came from another
@@ -113,8 +117,10 @@ This app is designed to run **on your own machine, against your own network**.
 
 Everything stays local:
 
-- A CSV import is parsed in the browser and held for that tab only. It is never
-  uploaded and never written to a database.
+- A CSV import is parsed in the browser. Only what the map needs about each
+  person (no email addresses) goes to the app on this computer, which keeps it
+  in the data folder as `csv-network.json` until you remove it, apart from the
+  database. It is never uploaded anywhere.
 - Scanned data and cached avatars are written to your machine and are gitignored.
   The app shows photos only from those files, so looking at your network never
   contacts LinkedIn.
@@ -123,6 +129,14 @@ Everything stays local:
 If you run the scanner, `chrome-profile/` in the data directory holds a live
 logged-in LinkedIn session. Never copy, sync, or commit it.
 
+The scanner reads LinkedIn. The one thing it ever sends there is a connection request,
+and only when you press **Auto** on a person: one request per press, without a note, at
+most 15 in any 24 hours and 80 in any 7 days. The app looks the person up by the id the
+page sends and passes the scanner their profile URL from the database, never a URL or name
+from the request, and refuses before anything starts during a cooldown, past those caps,
+or before Auto's one-time question has been answered (`app/api/scraper/route.js`,
+`lib/auto-connect.js`).
+
 ### Moving your data (Settings → Your data)
 
 - **An export** is one `.sixdegrees` file the user saves and carries. It is

package/.next/standalone/app/api/data/backup/route.js

@@ -0,0 +1,25 @@
+import { getDb, backupOptions } from '../../../../lib/db-client';
+import { makeBackup, noteBackupFailure } from '../../../../lib/backups';
+import { countPeople } from '../../../../lib/data-export';
+
+// Settings → Your data → Back up now: a backup in backups/ like the daily ones
+// (lib/backups.js), kept until the person deletes it. Nothing is taken from
+// the request. Gated (lib/gate.js) with the routes that hand over or replace
+// the whole network: it writes all of it to a file.
+
+export async function POST() {
+  const db = getDb();
+  if (countPeople(db) === 0) {
+    return Response.json({ error: 'There’s no network here to back up yet.' }, { status: 409 });
+  }
+  try {
+    const made = makeBackup('manual', backupOptions(db));
+    return Response.json({
+      ok: true,
+      backup: { name: made.name, bytes: made.bytes, people: made.people, photos: made.photos, verified: made.verified },
+    });
+  } catch (err) {
+    noteBackupFailure('manual', err);
+    return Response.json({ error: `The backup couldn’t be made: ${err.message}` }, { status: 500 });
+  }
+}

package/.next/standalone/app/api/data/csv/route.js

@@ -0,0 +1,74 @@
+import { dataDir } from '../../../../lib/db-client';
+import { pendingImport } from '../../../../lib/data-import';
+import { resolveProfile, networkCounts } from '../../../../lib/profile';
+import {
+  readCsvNetwork, writeCsvNetwork, removeCsvNetwork, CsvStoreError, CSV_NETWORK_FILE,
+} from '../../../../lib/csv-store';
+
+// A LinkedIn Connections.csv import, kept in the data folder so it is still
+// there after the window closes (lib/csv-store.js). The page reads the CSV and
+// sends only what the map needs (lib/csv.js packConnections); nothing here
+// sees the file itself.
+//
+// Gated with the other routes under /api/data (lib/gate.js): POST replaces the
+// kept import, DELETE removes it, and GET hands it over, so all three answer
+// only on this computer, as the server's bind address proves, never a header
+// (TRAPS §2). POST and DELETE are writes, so middleware.js also refuses them
+// from another site.
+
+export async function GET() {
+  const { csv, problem } = readCsvNetwork(dataDir());
+  // Your scanned 1st-degree connections, under the profile the map shows
+  // (lib/profile.js): once there are any, pages show them instead of a kept
+  // CSV (lib/csv.js openNetworkSource).
+  let scanned;
+  try {
+    const me = resolveProfile({ create: false });
+    scanned = me ? networkCounts(me.id).first : 0;
+  } catch (err) {
+    return Response.json({ error: `Your network couldn't be read (${err.message}).` }, { status: 500 });
+  }
+  return Response.json({
+    csv,
+    scanned,
+    // Said, never shown as no import at all (TRAPS §7): the welcome screen
+    // puts this on the CSV card.
+    problem: problem ? `Your kept CSV import couldn't be read: ${problem}. Import Connections.csv again to replace it.` : null,
+  });
+}
+
+export async function POST(request) {
+  const dir = dataDir();
+  // An import from another computer waiting for the next start replaces the
+  // network's files, this one included: a CSV kept now would be set aside
+  // with what it replaces.
+  if (pendingImport(dir)) {
+    return Response.json({
+      error: 'A copy of a network is waiting to finish importing. Restart Six Degrees to finish it first (Settings → Your data says how), then import the CSV.',
+    }, { status: 409 });
+  }
+  let body;
+  try {
+    body = await request.json();
+  } catch {
+    return Response.json({ error: "The import didn't arrive whole, so nothing was kept. Try again." }, { status: 400 });
+  }
+  try {
+    return Response.json({ ok: true, ...writeCsvNetwork(dir, body?.connections) });
+  } catch (err) {
+    if (err instanceof CsvStoreError) {
+      return Response.json({ error: `This import can't be kept (${err.message}), so nothing was saved.` }, { status: 400 });
+    }
+    return Response.json({ error: `The import couldn't be saved on this computer (${err.message}).` }, { status: 500 });
+  }
+}
+
+export async function DELETE() {
+  try {
+    return Response.json({ ok: true, removed: removeCsvNetwork(dataDir()) });
+  } catch (err) {
+    return Response.json({
+      error: `The import couldn't be removed (${err.message}). It is ${CSV_NETWORK_FILE} in your data folder.`,
+    }, { status: 500 });
+  }
+}

package/.next/standalone/app/api/data/export/route.js

@@ -7,7 +7,7 @@ import { EXPORT_WORK_PREFIX, sweepLeftovers } from '../../../../lib/data-folder'
 import { SCHEMA_SQL } from '../../../../db/schema';
 import { APP_VERSION } from '../../../../lib/app-version';
 
-// Save a copy of the network to carry to another computer: one .sixdegrees
+// Export backup file…: a copy of the network to carry to another computer, one .sixdegrees
 // file (lib/data-export.js), sent back as a download. A POST, so it takes a
 // click on the app's own page (the cross-site guard applies), and gated with
 // the other routes that hand over or replace everything (lib/gate.js).

package/.next/standalone/app/api/data/restore/route.js

@@ -0,0 +1,48 @@
+import path from 'node:path';
+import { getDb, dataDir, applySchema, backupsFolder } from '../../../../lib/db-client';
+import { SCHEMA_SQL } from '../../../../db/schema';
+import { APP_VERSION } from '../../../../lib/app-version';
+import { countPeople } from '../../../../lib/data-export';
+import { ImportError, pendingImport } from '../../../../lib/data-import';
+import { findBackup, restoreBackup, restorePreflight } from '../../../../lib/backups';
+import { scannerJob } from '../../../../lib/scan-state';
+
+// Settings → Your data → Restore, on one backup: put that backup's network
+// back. The same as importing it (lib/backups.js restoreBackup, through
+// stageImport): checked first, applied at the next start (Restart now), and
+// what is here kept in backups/ before anything is replaced.
+//
+// The body names a backup, {name, replace}: a name from backups/' own listing
+// (lib/data-folder.js listBackups), never a path. Anything else is refused.
+// `replace` is the number of people the person agreed to replace. Gated
+// (lib/gate.js): it replaces the network.
+
+export async function POST(request) {
+  let body = {};
+  try { body = await request.json(); } catch { /* refused below */ }
+  const name = typeof body?.name === 'string' ? body.name : '';
+
+  // The name first: one the folder doesn't hold is refused before anything else is asked.
+  if (!findBackup(backupsFolder(), name)) {
+    return Response.json({ error: 'There is no backup by that name in the backups folder.' }, { status: 404 });
+  }
+  const dir = path.resolve(dataDir());
+  const currentPeople = countPeople(getDb());
+  const refusal = restorePreflight({
+    scanRunning: scannerJob(),
+    pending: pendingImport(dir),
+    currentPeople,
+    confirmedPeople: Number(body?.replace),
+  });
+  if (refusal) return Response.json({ error: refusal.message, ...refusal.extra }, { status: refusal.status });
+
+  try {
+    const pending = restoreBackup(name, {
+      dir, backupsDir: backupsFolder(), applySchema, schemaSql: SCHEMA_SQL, appVersion: APP_VERSION, replacedPeople: currentPeople,
+    });
+    return Response.json({ ok: true, pending });
+  } catch (err) {
+    if (err instanceof ImportError) return Response.json({ error: err.message, ...err.extra }, { status: err.status });
+    return Response.json({ error: `The backup couldn’t be restored: ${err.message}` }, { status: 500 });
+  }
+}

package/.next/standalone/app/api/data/reveal/route.js

@@ -1,14 +1,27 @@
 import path from 'node:path';
-import { dataDir } from '../../../../lib/db-client';
+import { dataDir, backupsFolder } from '../../../../lib/db-client';
 import { revealFolder } from '../../../../lib/data-folder';
+import { findBackup } from '../../../../lib/backups';
 
-// Show the data folder in Finder (or the Linux file browser). It opens the data
-// folder itself and takes nothing from the request. Gated (lib/gate.js) like
-// every route that starts a process.
+// Show the data folder in Finder (or the Linux file browser), or one backup in
+// it, selected: {backup: name}, a name from backups/' own listing, never a
+// path (lib/backups.js findBackup). Nothing else is taken from the request.
+// Gated (lib/gate.js) like every route that starts a process.
 
-export async function POST() {
+export async function POST(request) {
+  let body = {};
+  try { body = await request.json(); } catch { /* no body: the data folder */ }
+  if (body?.backup !== undefined) {
+    const folder = path.resolve(backupsFolder());
+    const found = findBackup(folder, body.backup, { restorable: false });
+    if (!found) return Response.json({ error: 'There is no backup by that name in the backups folder.' }, { status: 404 });
+    const file = path.join(folder, found.name);
+    const result = await revealFolder(folder, { select: file });
+    if (result.ok) return Response.json({ ok: true });
+    return Response.json({ error: `${result.message} The backup is ${file}`, path: file }, { status: 500 });
+  }
   const dir = path.resolve(dataDir());
   const result = await revealFolder(dir);
   if (result.ok) return Response.json({ ok: true });
-  return Response.json({ error: `${result.message} The folder is ${dir}` }, { status: 500 });
+  return Response.json({ error: `${result.message} The folder is ${dir}`, path: dir }, { status: 500 });
 }

package/.next/standalone/app/api/data/route.js

@@ -1,7 +1,10 @@
 import path from 'node:path';
 import { homedir } from 'node:os';
-import { getDb, dataDir, dbFile, AUTO_BACKUP_PREFIX } from '../../../lib/db-client';
+import { getDb, dataDir, dbFile, backupsFolder, applySchema, AUTO_BACKUP_PREFIX } from '../../../lib/db-client';
 import { folderReport } from '../../../lib/data-folder';
+import { backupReport } from '../../../lib/backups';
+import { SCHEMA_SQL } from '../../../db/schema';
+import { APP_VERSION } from '../../../lib/app-version';
 import { countPeople, referencedPhotos } from '../../../lib/data-export';
 import {
   pendingImport, lastImport, restartCodeFrom, restartAdvice, MAX_IMPORT_BYTES,
@@ -9,9 +12,11 @@ import {
 import { projectRoot, isGitCheckout } from '../../../lib/paths';
 import { installKind } from '../../../lib/release';
 
-// Settings → Your data: where the network is kept, what it takes up, and any
-// import waiting to finish. Sizes come from the file system; nothing in the
-// folder is read, and chrome-profile/ is only reported as there or not. A read
+// Settings → Your data: where the network is kept, what it takes up, the
+// backups, and any import waiting to finish. Sizes come from the file system,
+// and chrome-profile/ is only reported as there or not. The one file read is
+// the newest backup, checked as the importer would check it (once per file per
+// server, lib/backups.js backupReport), so "verified" is never a guess. A read
 // that changes nothing, so it stays open like every other read. The actions
 // live under /api/data/… and are gated (lib/gate.js).
 
@@ -22,8 +27,14 @@ export async function GET() {
     // A git checkout is its own kind here, as on the rest of the Settings page.
     const kind = isGitCheckout() ? 'git' : installKind(process.env, projectRoot());
     const custom = dir !== path.join(homedir(), '.six-degrees');
+    // One entry per backup (a database copy and its folder of photos are one), newest first.
+    const { backups, ...backupStatus } = backupReport(path.resolve(backupsFolder()), {
+      applySchema, schemaSql: SCHEMA_SQL, appVersion: APP_VERSION,
+    });
     return Response.json({
       ...folderReport({ dir, dbFile: path.resolve(dbFile()), autoPrefix: AUTO_BACKUP_PREFIX, inNetwork: referencedPhotos(db) }),
+      backups,
+      backupStatus,
       people: countPeople(db),
       platform: process.platform,
       kind,

package/.next/standalone/app/api/ingest/route.js

@@ -322,7 +322,7 @@ export async function POST(request) {
               user_id: userId || null,
               type: 'request_accepted',
               title: `${p.name} accepted! +${XP_ACCEPT[p.tier] || 5} XP`,
-              message: `${p.tier}-Tier connection — bridge their cluster to reach D3`,
+              message: `${p.tier}-Tier connection: bridge their cluster to reach D3`,
               icon: '🤝',
               data: { personId: p.id, viaId: p.source_connection_id ?? null, tier: p.tier ?? null },
             }))