six-degrees 0.6.0 → 0.8.0

package/.next/standalone/lib/linkedin-limits.js

@@ -4,23 +4,35 @@
 // reads them with the same rules, and writes only the two things a person
 // changes here — the budget, and lifting a cooldown.
 //
+// Settings → LinkedIn usage reads the same record more closely (linkedinUsage):
+// the last hour and the last 7 days, when the next search frees up, and the
+// last time LinkedIn pushed back. lib/usage.js says what the numbers mean.
+//
 // The budget is searches (a day and a month) and profile views (a day). Profile
 // views got an account restricted (TRAPS §16), so their cap has no "no limit",
 // and the scanner also keeps any two a minute apart. Searches did too, at 373 in
 // 24 hours: the page asks before a risky search budget (lib/search-risk.js).
 //
+// Auto's connection requests (lib/auto-connect.js) are a third list in the same
+// record, "invites", with caps of their own: 15 in any 24 hours, 80 in any 7 days.
+//
 // They belong to the LinkedIn account, not to a profile in the app. TRAPS §35.
 
-import { readFileSync, writeFileSync, renameSync, unlinkSync, existsSync, lstatSync } from 'node:fs';
+import {
+  readFileSync, writeFileSync, renameSync, unlinkSync, existsSync, lstatSync, readdirSync, openSync, readSync, closeSync,
+} from 'node:fs';
 import path from 'node:path';
 import { durable } from './durable.js';
 import { PACES, DEFAULT_PACE } from './scan-pace.js';
+import { countAfter } from './usage.js';
+import { INVITE_CAPS } from './auto-connect.js';
 
 export const DEFAULT_LIMITS = { daily: 50, monthly: 250, profiles: 50, pace: DEFAULT_PACE };
 export const DAILY_CHOICES = [25, 50, 100, 200, 500];
 export const MONTHLY_CHOICES = [100, 250, 500, 1000, 0];   // 0 = no monthly cap (Premium)
 export const PROFILE_CHOICES = [10, 25, 50, 100];           // profile views a day; never unlimited
 const DAY = 24 * 3600;
+const WEEK = 7 * DAY;
 const PACIFIC = 'America/Los_Angeles';
 
 function readJson(file) {
@@ -94,6 +106,19 @@ export function writeLimits(dir, { daily, monthly, profiles, pace } = {}) {
   return next;
 }
 
+/**
+ * The scanner's record as three lists of times (epoch seconds): searches,
+ * profile views and Auto's connection requests. null when it can't be read. No
+ * record at all is nothing done yet.
+ */
+function readActivity(dir) {
+  const file = path.join(dir, 'linkedin-activity.json');
+  const data = existsSync(file) ? readJson(file) : { searches: [], profiles: [] };
+  if (!data || typeof data !== 'object') return null;
+  const times = (v) => (Array.isArray(v) ? v : []).map(Number);
+  return { searches: times(data.searches), profiles: times(data.profiles), invites: times(data.invites) };
+}
+
 /**
  * Searches in the last 24 hours and since LinkedIn's month began, and profile
  * views in the last 24 hours. An unreadable record reads as the day used up,
@@ -101,31 +126,59 @@ export function writeLimits(dir, { daily, monthly, profiles, pace } = {}) {
  * would say nothing had been searched.
  */
 export function usage(dir, now = Date.now()) {
-  const file = path.join(dir, 'linkedin-activity.json');
-  const data = existsSync(file) ? readJson(file) : { searches: [], profiles: [] };
-  if (!data || typeof data !== 'object') return { searchesToday: Infinity, searchesMonth: 0, profilesToday: Infinity, unreadable: true };
-  const s = (Array.isArray(data.searches) ? data.searches : []).map(Number);
-  const p = (Array.isArray(data.profiles) ? data.profiles : []).map(Number);
+  const rec = readActivity(dir);
+  if (!rec) {
+    return { searchesToday: Infinity, searchesMonth: 0, profilesToday: Infinity, invitesToday: Infinity, invitesWeek: Infinity, unreadable: true };
+  }
+  const { searches: s, profiles: p, invites: i } = rec;
   const dayAgo = now / 1000 - DAY;
   const month0 = monthStartPacific(now) / 1000;
   return {
     searchesToday: s.filter((t) => t > dayAgo).length,
     searchesMonth: s.filter((t) => t >= month0).length,
     profilesToday: p.filter((t) => t > dayAgo).length,
+    // Auto's connection requests (lib/auto-connect.js), against their own caps.
+    invitesToday: i.filter((t) => t > dayAgo).length,
+    invitesWeek: i.filter((t) => t > now / 1000 - WEEK).length,
   };
 }
 
-/** The active cooldown { until (ms), reason, setAt }, or null. */
+/** The active cooldown { until (ms), reason, setAt }, or null. A lifted one (liftCooldown) is none. */
 export function readCooldown(dir, now = Date.now()) {
   const raw = readJson(path.join(dir, 'linkedin-cooldown.json'));
   const until = Number(raw?.until) * 1000;
-  if (!raw || !Number.isFinite(until) || until <= now) return null;
+  if (!raw || raw.lifted_at !== undefined || !Number.isFinite(until) || until <= now) return null;
   return { until, reason: String(raw.reason || 'LinkedIn pushed back'), setAt: Number(raw.set_at) * 1000 || null };
 }
 
-/** Lift it: the person says LinkedIn works for them again. */
-export function liftCooldown(dir) {
-  try { unlinkSync(path.join(dir, 'linkedin-cooldown.json')); } catch { /* none to lift */ }
+/**
+ * Lift it: the person says LinkedIn works for them again. The record is kept,
+ * marked lifted, so Settings → LinkedIn usage can still say when LinkedIn last
+ * pushed back; deleting it forgot that. Its `until` becomes the moment it was
+ * lifted and the old end moves to `was_until`, so everything that reads the
+ * file sees a pause that has simply ended, with no change of its own: here
+ * (readCooldown, the import's merge) and in the scanner (read_cooldown and
+ * set_cooldown in scripts/scrape.py ask only whether `until` is still ahead),
+ * so the scanner's pacing is exactly what it was. A pause already over is
+ * left alone; a record that can't be read is removed, as before.
+ */
+export function liftCooldown(dir, now = Date.now()) {
+  const file = path.join(dir, COOLDOWN);
+  const raw = readJson(file);
+  const until = Number(raw?.until);
+  if (!isObject(raw) || !Number.isFinite(until)) {
+    try { unlinkSync(file); } catch { /* none to lift */ }
+    return;
+  }
+  const at = now / 1000;
+  if (until <= at) return;
+  writeJsonAtomic(file, {
+    until: at,
+    reason: typeof raw.reason === 'string' ? raw.reason : 'LinkedIn pushed back',
+    set_at: isTime(raw.set_at) ? raw.set_at : null,
+    lifted_at: at,
+    was_until: until,
+  });
 }
 
 /** Everything the Scan page shows, in one object. */
@@ -133,17 +186,175 @@ export function linkedinState(dir, now = Date.now()) {
   const limits = readLimits(dir);
   const use = usage(dir, now);
   const left = (limit, used) => (limit ? Math.max(0, limit - used) : null);
+  // When Auto may send again once a cap is reached: the request that stops
+  // counting soonest frees the next (freesAt below).
+  const invites = use.unreadable ? null : readActivity(dir)?.invites || [];
   return {
     ...use,
     limits,
     leftToday: left(limits.daily, use.searchesToday),
     leftMonth: left(limits.monthly, use.searchesMonth),
     profilesLeftToday: left(limits.profiles, use.profilesToday),
+    inviteCaps: INVITE_CAPS,
+    invitesFreeAt: invites ? freesAt(invites, now, INVITE_CAPS.day) : null,
+    invitesWeekFreeAt: invites ? freesAt(invites, now, INVITE_CAPS.week, WEEK) : null,
     monthResets: nextMonthStartPacific(now),
     cooldown: readCooldown(dir, now),
   };
 }
 
+// ── Settings → LinkedIn usage ────────────────────────────────────────────────
+// The same record, read more closely. Windows count a time strictly inside
+// them (t > now - window), as usage() and the scanner's linkedin_usage do, so a
+// search exactly 24 hours old has stopped counting.
+
+/** How many of `times` (epoch s) fall in the last `seconds` before `now` (ms). */
+export function countWithin(times, now, seconds) {
+  const from = now / 1000 - seconds;
+  return times.filter((t) => t > from).length;
+}
+
+/**
+ * When the count in the window next drops under `cap`, in ms: the moment a
+ * search (or profile view) is free again. null when one is free now, or with
+ * no cap. The scanner says the same for profile views (scrape.py
+ * budget_message: the one that stops counting soonest frees the next).
+ */
+export function freesAt(times, now, cap, seconds = DAY) {
+  if (!cap) return null;
+  const live = times.filter((t) => t > now / 1000 - seconds).sort((a, b) => a - b);
+  if (live.length < cap) return null;
+  return (live[live.length - cap] + seconds) * 1000;
+}
+
+/** When the window holds nothing at all again (the newest time turns `seconds` old), in ms; null if it's empty. */
+export function clearAt(times, now, seconds = DAY) {
+  const live = times.filter((t) => t > now / 1000 - seconds);
+  return live.length ? (Math.max(...live) + seconds) * 1000 : null;
+}
+
+// The scanner keeps what the page showed when LinkedIn pushed back as
+// pushback/<local date>_<time>.txt: "reason: …", then "url: …", then the page's
+// text (scrape.py _keep_pushback_evidence). Only the name's time and the first
+// line are read here: the page's address and its text are LinkedIn's page about
+// this account and stay in the file.
+const PUSHBACK_FILE = /^(\d{4})-(\d{2})-(\d{2})_(\d{2})(\d{2})(\d{2})\.txt$/;
+const FIRST_LINE_BYTES = 256;
+
+/** The reason on a pushback file's first line, or null. Never more of the file. */
+function pushbackReason(file) {
+  let fd;
+  try {
+    fd = openSync(file, 'r');
+    const buf = Buffer.alloc(FIRST_LINE_BYTES);
+    const n = readSync(fd, buf, 0, FIRST_LINE_BYTES, 0);
+    const line = buf.subarray(0, n).toString('utf8').split(/\r?\n/)[0];
+    const m = line.match(/^reason: (.+)$/);
+    const reason = m && m[1].replace(/[\u0000-\u001f\u007f]/g, '').trim().slice(0, 120);
+    // The scanner's reasons are its own short phrases; anything shaped like an address isn't one.
+    return reason && !/:\/\/|www\.|linkedin\.com|\/in\//i.test(reason) ? reason : null;
+  } catch {
+    return null;
+  } finally {
+    if (fd !== undefined) closeSync(fd);
+  }
+}
+
+/** The newest pushback file: { at (ms, from its name), reason }, or null. */
+export function newestPushback(dir) {
+  let names;
+  try {
+    // Plain files only: a link or a folder by that name is not the scanner's.
+    names = readdirSync(path.join(dir, 'pushback'), { withFileTypes: true })
+      .filter((e) => e.isFile() && PUSHBACK_FILE.test(e.name)).map((e) => e.name);
+  } catch {
+    return null;
+  }
+  // Newest first by name, which is by time; a name that isn't a real time is passed over.
+  for (const name of names.sort().reverse()) {
+    const [, y, mo, d, h, mi, s] = name.match(PUSHBACK_FILE).map(Number);
+    // The scanner names it by this computer's clock (datetime.now()), as this reads it.
+    const when = new Date(y, mo - 1, d, h, mi, s);
+    if (when.getMonth() !== mo - 1 || when.getDate() !== d || h > 23 || mi > 59 || s > 59) continue;
+    return { at: when.getTime(), reason: pushbackReason(path.join(dir, 'pushback', name)) };
+  }
+  return null;
+}
+
+// One pushback usually leaves both: the page kept, then the pause set, moments
+// (at most the rest of that person's read) apart.
+const SAME_EVENT_MS = 10 * 60 * 1000;
+
+/**
+ * The last time LinkedIn pushed back, from the cooldown file (active, ended or
+ * lifted) and the newest pushback file: { at (ms or null), reason, pausedUntil,
+ * liftedAt, active }, or null when there's no sign of one. Times and the
+ * reason only.
+ */
+export function lastPushback(dir, now = Date.now()) {
+  const file = newestPushback(dir);
+  const raw = readJson(path.join(dir, COOLDOWN));
+  const until = Number(raw?.until);
+  const pause = isObject(raw) && Number.isFinite(until) ? {
+    at: isTime(raw.set_at) ? raw.set_at * 1000 : null,
+    reason: typeof raw.reason === 'string' && raw.reason.trim() ? raw.reason.trim().slice(0, 160) : 'LinkedIn pushed back',
+    pausedUntil: (isTime(raw.was_until) ? raw.was_until : until) * 1000,
+    liftedAt: isTime(raw.lifted_at) ? raw.lifted_at * 1000 : null,
+  } : null;
+  const fromFile = file && {
+    at: file.at,
+    reason: file.reason ? `LinkedIn pushed back: ${file.reason}` : 'LinkedIn pushed back',
+    pausedUntil: null,
+    liftedAt: null,
+  };
+  let last;
+  if (pause && fromFile && pause.at != null && Math.abs(pause.at - fromFile.at) <= SAME_EVENT_MS) {
+    last = { ...pause, at: Math.min(pause.at, fromFile.at) };
+  } else if (pause && fromFile) {
+    last = (pause.at ?? -Infinity) >= fromFile.at ? pause : fromFile;
+  } else {
+    last = pause || fromFile;
+  }
+  if (!last) return null;
+  return { ...last, active: !last.liftedAt && last.pausedUntil != null && last.pausedUntil > now };
+}
+
+/**
+ * Everything Settings → LinkedIn usage shows (GET /api/scraper?usage): the
+ * Scan page's state, plus
+ *   searchesLastHour, searchesWeek   counted like searchesToday
+ *   dayFreesAt                       when the daily budget has a search free again (null: one is free now)
+ *   dayClearAt                       when the last 24 hours hold no searches at all
+ *   profilesFreeAt                   when a profile view is free again
+ *   lastPushback                     lastPushback() above
+ *   searchesSincePushback            searches made after it (lib/usage.js countAfter)
+ * An unreadable record gives nulls, never zeros: it isn't "nothing searched".
+ */
+export function linkedinUsage(dir, now = Date.now()) {
+  const state = linkedinState(dir, now);
+  const rec = readActivity(dir);
+  const pushback = lastPushback(dir, now);
+  const known = (fn) => (rec ? fn(rec) : null);
+  return {
+    ...state,
+    now,
+    searchesToday: rec ? state.searchesToday : null,
+    profilesToday: rec ? state.profilesToday : null,
+    // Auto's connection requests: the last 24 hours and the last 7 days, against INVITE_CAPS.
+    invitesToday: rec ? state.invitesToday : null,
+    invitesWeek: rec ? state.invitesWeek : null,
+    searchesMonth: rec ? state.searchesMonth : null,
+    leftMonth: rec ? state.leftMonth : null,
+    searchesLastHour: known((r) => countWithin(r.searches, now, 3600)),
+    searchesWeek: known((r) => countWithin(r.searches, now, 7 * DAY)),
+    dayFreesAt: known((r) => freesAt(r.searches, now, state.limits.daily)),
+    dayClearAt: known((r) => clearAt(r.searches, now)),
+    profilesFreeAt: known((r) => freesAt(r.profiles, now, state.limits.profiles)),
+    lastPushback: pushback,
+    searchesSincePushback: known((r) => countAfter(r.searches, pushback?.at)),
+  };
+}
+
 // ── another computer's budget (Settings → Your data → Import) ───────────────
 // An import carries these three files from the other computer. They describe
 // the same LinkedIn account, so they are merged with the ones here, never put
@@ -170,11 +381,15 @@ const isTime = (v) => typeof v === 'number' && Number.isFinite(v) && v >= 0;
 export function budgetFileProblem(name, data) {
   if (!isObject(data)) return 'it is not a JSON object';
   if (name === ACTIVITY) {
-    if (!isTimeList(data.searches) || !isTimeList(data.profiles)) return 'its record of searches is not a list of times';
+    if (!isTimeList(data.searches) || !isTimeList(data.profiles) || !isTimeList(data.invites)) return 'its record of searches is not a list of times';
   } else if (name === COOLDOWN) {
     if (!isTime(data.until)) return 'its pause has no end time';
     if (data.reason !== undefined && typeof data.reason !== 'string') return 'its pause has a reason that is not text';
     if (data.set_at !== undefined && !isTime(data.set_at)) return 'its pause has a start time that is not a time';
+    // A pause lifted by hand (liftCooldown) says when, and when it would have ended.
+    for (const key of ['lifted_at', 'was_until']) {
+      if (data[key] !== undefined && !isTime(data[key])) return 'its lifted pause has a time that is not a time';
+    }
   } else if (name === LIMITS) {
     if (data.daily !== undefined && !DAILY_CHOICES.includes(data.daily)) {
       return `its daily limit (${String(data.daily).slice(0, 20)}) is not one Six Degrees offers`;
@@ -218,7 +433,8 @@ const hasFile = (p) => {
 /**
  * Merge the budget files in `from` (an import's, already checked with
  * budgetFileProblem) into the data folder `dir`:
- *   linkedin-activity.json  both computers' searches and profile views (mergeTimes)
+ *   linkedin-activity.json  both computers' searches, profile views and Auto's
+ *                           connection requests (mergeTimes)
  *   linkedin-cooldown.json  whichever pause ends later
  *   scan-limits.json        this computer's, if it has one; the copy's otherwise.
  *                           The limits are a choice someone made here, and an
@@ -240,10 +456,16 @@ export function mergeBudgetFiles({ dir, from }) {
     const mine = hasFile(here(ACTIVITY)) ? readJson(here(ACTIVITY)) : {};
     const searches = isObject(mine) ? readableTimes(mine.searches) : null;
     const profiles = isObject(mine) ? readableTimes(mine.profiles) : null;
-    if (searches && profiles) {
+    const invites = isObject(mine) ? readableTimes(mine.invites) : null;
+    if (searches && profiles && invites) {
+      // Auto's requests too, or a copy brought in would forget the ones sent here
+      // (and Auto's caps would start again from nothing). Written only when
+      // either side has any, so a record from before Auto keeps its old layout.
+      const sent = mergeTimes(invites, activity.invites);
       durable.writeJsonDurably(here(ACTIVITY), {
         searches: mergeTimes(searches, activity.searches),
         profiles: mergeTimes(profiles, activity.profiles),
+        ...(sent.length ? { invites: sent } : {}),
       });
     }
   }
@@ -252,11 +474,15 @@ export function mergeBudgetFiles({ dir, from }) {
   if (cooldown) {
     const mine = readJson(here(COOLDOWN));
     const mineEnds = Number.isFinite(Number(mine?.until)) ? Number(mine.until) : -Infinity;
+    // A pause lifted here ends when it was lifted (liftCooldown), so one still
+    // on in the copy comes back, as it did when lifting deleted the file.
     if (cooldown.until > mineEnds) {
       durable.writeJsonDurably(here(COOLDOWN), {
         until: cooldown.until,
         reason: cooldown.reason ?? 'LinkedIn pushed back',
         set_at: cooldown.set_at ?? null,
+        // Lifted in the copy: still lifted here, and still the last pushback on record.
+        ...(cooldown.lifted_at !== undefined && { lifted_at: cooldown.lifted_at, was_until: cooldown.was_until ?? cooldown.until }),
       });
     }
   }

package/.next/standalone/lib/liquid-glass.js

@@ -0,0 +1,59 @@
+// Liquid Glass's lensing (Apple, WWDC25 "Meet Liquid Glass"; HIG → Materials):
+// the edge of a pane of glass bends what's behind it, where frosted glass only
+// blurs it. Done the way the good web versions do it in Chromium: a
+// displacement map, drawn here for a panel's exact size, used by an SVG
+// feDisplacementMap that the panel's backdrop-filter runs
+// (app/components/LiquidGlass.js).
+//
+// The map's red channel shifts a pixel across, green up and down; 128 is no
+// shift. Only a band along the edge (the bezel) moves, and it always pulls
+// inward, since a backdrop is clipped to the panel and anything pulled from
+// outside it would come back empty.
+
+/**
+ * How far, and which way, each pixel of a rounded rectangle w×h (corner r)
+ * bends: [dx, dy] in -1…1 for (x, y), strongest at the edge and fading to
+ * nothing `bezel` pixels in.
+ */
+export function lensAt(x, y, w, h, r, bezel) {
+  const px = x + 0.5 - w / 2;
+  const py = y + 0.5 - h / 2;
+  const qx = Math.abs(px) - (w / 2 - r);
+  const qy = Math.abs(py) - (h / 2 - r);
+  const ox = Math.max(qx, 0);
+  const oy = Math.max(qy, 0);
+  const o = Math.hypot(ox, oy);
+  const dist = r - (o + Math.min(Math.max(qx, qy), 0));   // pixels in from the edge
+  let nx = 0;
+  let ny = 0;
+  if (o > 0) { nx = ox / o; ny = oy / o; } else if (qx > qy) nx = 1; else ny = 1;
+  nx *= -Math.sign(px) || 0;
+  ny *= -Math.sign(py) || 0;
+  const t = Math.max(0, 1 - dist / bezel);
+  const m = t * t;
+  return [nx * m, ny * m];
+}
+
+/** The displacement map for a w×h panel, as a PNG data URL (needs a canvas: the browser only). */
+export function lensMap(w, h, r, bezel) {
+  const c = document.createElement('canvas');
+  c.width = w;
+  c.height = h;
+  const ctx = c.getContext('2d');
+  const img = ctx.createImageData(w, h);
+  const d = img.data;
+  for (let y = 0; y < h; y++) {
+    for (let x = 0; x < w; x++) {
+      const i = (y * w + x) * 4;
+      // Most of a big panel is its middle, which never moves.
+      const nearEdge = x < bezel + r || y < bezel + r || x >= w - bezel - r || y >= h - bezel - r;
+      const [dx, dy] = nearEdge ? lensAt(x, y, w, h, r, bezel) : [0, 0];
+      d[i] = 128 + 127 * dx;
+      d[i + 1] = 128 + 127 * dy;
+      d[i + 2] = 128;
+      d[i + 3] = 255;
+    }
+  }
+  ctx.putImageData(img, 0, 0);
+  return c.toDataURL();
+}

package/.next/standalone/lib/notifications.js

@@ -94,6 +94,19 @@ const NAME_IN_TITLE = [
  * `via` is who you met them through: the notification's own, else the person's
  * recorded introducer. `people` are everyone it names (a top-company list).
  */
+/**
+ * Which circle a notification is about, as a connection's id (a string), or
+ * null: whoever someone came through for "added you back" and "top companies",
+ * and whose circle it was for "Scan done". Read from what the note saved, so it
+ * needs nothing loaded.
+ */
+export function noteCircle(note) {
+  const data = typeof note?.data === 'string' ? safeJson(note.data) : note?.data || {};
+  if (data.viaId != null) return String(data.viaId);
+  if (data.action && data.personId != null) return String(data.personId);
+  return null;
+}
+
 export function noteSubject(note, connections = [], degree2 = []) {
   const all = [...(connections || []), ...(degree2 || [])];
   const byId = new Map(all.map((r) => [r.id, r]));

package/.next/standalone/lib/requests-client.js

@@ -96,6 +96,16 @@ export async function markRequested(row, { bridgeId } = {}) {
   }
 }
 
+/**
+ * A request the app has already saved, shown everywhere at once with nothing
+ * posted: Auto's, which the server marks itself once LinkedIn shows it pending
+ * (app/api/scraper/route.js, lib/requests.js).
+ */
+export function sawRequested(row) {
+  mine.set(keyFor(row), true);
+  publish();
+}
+
 /** Take a request back, everywhere. */
 export async function undoRequest(row) {
   const key = keyFor(row);

package/.next/standalone/lib/requests.js

@@ -0,0 +1,124 @@
+// Requests you've sent, kept per PERSON: the server side of
+// lib/requests-client.js.
+//
+// A person has one row per bridge whose circle holds them (the table's key is
+// profile + bridge + user), and a request used to mark only the copy that was
+// clicked. The other copies still offered "Add", the Pending count counted
+// copies, and every click awarded XP again. Now a request marks every copy of
+// the person, in both columns, the bridge you asked through is kept (so once
+// they accept, their card and circle say who introduced you: lib/promote.js
+// keeps it), XP comes once per person, and Undo takes back all of it.
+//
+// Two callers: POST /api/outreach (a Connect pressed on a page), and the
+// scanner's route once Auto has sent a request and LinkedIn showed it pending
+// (app/api/scraper/route.js; Blake, 2026-10-03). Both go through markSent here,
+// so a request sent by Auto is the same request everywhere as one sent by hand.
+
+import { db as supabase } from './db.js';
+import { resolveProfile } from './profile.js';
+
+// XP rewards by tier
+export const XP_SEND = { S: 25, A: 15, B: 10, C: 5, D: 2 };
+export const XP_ACCEPT = { S: 100, A: 60, B: 35, C: 15, D: 5 };
+const TIER_ORDER = ['S', 'A', 'B', 'C', 'D'];
+
+export async function awardXP(userId, amount) {
+  if (!userId || !amount) return;
+  // Upsert: create if not exists, change if exists. Never below zero: an Undo
+  // takes back what a send gave, including sends from before sends gave any.
+  const { data: existing } = await supabase.from('user_stats').select('xp').eq('id', userId).single();
+  if (existing) {
+    await supabase.from('user_stats').update({ xp: Math.max(0, (existing.xp || 0) + amount) }).eq('id', userId);
+  } else if (amount > 0) {
+    await supabase.from('user_stats').insert([{ id: userId, xp: amount, level: 1 }]).catch(() => {});
+  }
+}
+
+/** The profile a request belongs to: the one sent, else this machine's. */
+export function whose(userId) {
+  if (userId) return String(userId);
+  try { return resolveProfile({ create: false })?.id || null; } catch { return null; }
+}
+
+/** Every copy of one person: by the clicked row's profile URL, or the URL given. */
+export function copiesOf(db, { connectionId, profileUrl, userId }) {
+  let url = profileUrl ? String(profileUrl) : null;
+  let user = userId ? String(userId) : null;
+  let clicked = null;
+  if (connectionId != null) {
+    clicked = db.prepare('SELECT id, profile_url, user_id FROM linkedin_connections WHERE id = ?').get(String(connectionId)) || null;
+    if (clicked) {
+      url = clicked.profile_url || url;
+      user = user || clicked.user_id || null;
+    }
+  }
+  const cols = 'id, degree, tier, outreach_status, unlock_status, unlocked_from_bridge_id';
+  let rows = [];
+  if (url) {
+    rows = user
+      ? db.prepare(`SELECT ${cols} FROM linkedin_connections WHERE profile_url = ? AND user_id = ?`).all(url, user)
+      : db.prepare(`SELECT ${cols} FROM linkedin_connections WHERE profile_url = ?`).all(url);
+  } else if (clicked) {
+    rows = db.prepare(`SELECT ${cols} FROM linkedin_connections WHERE id = ?`).all(clicked.id);
+  }
+  return { url, user, rows };
+}
+
+export const inList = (ids) => ids.map(() => '?').join(', ');
+export const bestTier = (rows) => TIER_ORDER.find((t) => rows.some((r) => r.tier === t)) || 'D';
+
+/**
+ * Mark a request to this person as sent, on every copy of them, through
+ * `bridgeId` (one of your own connections) when given: the rows only, at once.
+ * Returns { saved, xp, already, user }: `saved` is how many rows (0 when nobody
+ * is on file, as for the sample network, which lives in the browser), `xp` what
+ * the send is worth (once per person), for markSent or the caller to award.
+ */
+export function markSentRows(db, { connectionId, profileUrl, userId, bridgeId } = {}) {
+  const { user, rows } = copiesOf(db, { connectionId, profileUrl, userId });
+  if (!rows.length) return { saved: 0, xp: 0, already: false, user };
+  const ids = rows.map((r) => r.id);
+  const now = new Date().toISOString();
+  const already = rows.some((r) => r.outreach_status === 'sent' || r.outreach_status === 'accepted');
+  db.prepare(`UPDATE linkedin_connections SET outreach_status = 'sent', updated_at = ?
+    WHERE id IN (${inList(ids)}) AND (outreach_status IS NULL OR outreach_status NOT IN ('sent', 'accepted'))`).run(now, ...ids);
+  db.prepare(`UPDATE linkedin_connections SET unlock_status = 'pending', updated_at = ?
+    WHERE id IN (${inList(ids)}) AND (unlock_status IS NULL OR unlock_status = 'locked')`).run(now, ...ids);
+  // Who you asked through: one of your own connections, or nothing.
+  if (bridgeId != null) {
+    const bridge = db.prepare(
+      `SELECT id, name FROM linkedin_connections WHERE id = ? AND degree = 1${user ? ' AND user_id = ?' : ''}`,
+    ).get(...[String(bridgeId), ...(user ? [user] : [])]);
+    if (bridge) {
+      db.prepare(`UPDATE linkedin_connections SET unlocked_from_bridge_id = ?, unlocked_from_name = ?, updated_at = ?
+        WHERE id IN (${inList(ids)}) AND degree = 2 AND unlocked_from_bridge_id IS NULL`).run(bridge.id, bridge.name, now, ...ids);
+    }
+  }
+  const xp = already ? 0 : XP_SEND[bestTier(rows)] || 2;
+  return { saved: ids.length, xp, already, user };
+}
+
+/** markSentRows, and its XP awarded: { saved, xp, already }. */
+export async function markSent(db, request = {}) {
+  const { saved, xp, already, user } = markSentRows(db, request);
+  if (saved) await awardXP(whose(user), xp);
+  return { saved, xp, already };
+}
+
+/**
+ * Where this person stands for a new request, over every copy of them:
+ * { connected, requested, accepted }. `connected`: a copy of them is one of
+ * your own connections; `requested`: a request is out (sent or pending);
+ * `accepted`: one was accepted (or their path is unlocked).
+ */
+export function requestStanding(db, { profileUrl, userId }) {
+  if (!profileUrl) return { connected: false, requested: false, accepted: false };
+  const rows = userId
+    ? db.prepare('SELECT degree, outreach_status, unlock_status FROM linkedin_connections WHERE profile_url = ? AND user_id = ?').all(String(profileUrl), String(userId))
+    : db.prepare('SELECT degree, outreach_status, unlock_status FROM linkedin_connections WHERE profile_url = ?').all(String(profileUrl));
+  return {
+    connected: rows.some((r) => r.degree === 1),
+    requested: rows.some((r) => r.outreach_status === 'sent' || r.unlock_status === 'pending'),
+    accepted: rows.some((r) => r.outreach_status === 'accepted' || r.unlock_status === 'unlocked'),
+  };
+}

package/.next/standalone/lib/scan-pace.js

@@ -29,6 +29,17 @@ export function paceSeconds(name, searches) {
   return n * (WORK_SECONDS + p.pagePause) + Math.floor(n / EVERY) * p.chunkCooldown;
 }
 
+/**
+ * About how long a circle scan takes to show its first people on the map. The
+ * scanner saves after its first ten pages (scrape.py SAVE_EVERY_PAGES), so it's
+ * those ten at this speed; the longer rest counted after them stands in for
+ * opening Chrome and the person's profile first. About 5 minutes at Fast: the
+ * Scan page's honest "first circle" (the rest of a network takes days).
+ */
+export function firstCircleSeconds(name) {
+  return paceSeconds(name, EVERY);
+}
+
 /** About how many searches an hour a speed makes. */
 export function searchesPerHour(name) {
   const p = paceOf(name);

package/.next/standalone/lib/scan-progress.js

@@ -70,6 +70,26 @@ export function scanProgress(log, action) {
   return null;
 }
 
+// "[3/10] Ada Park (A-tier, score 6.2)", with ", carrying on from page 11"
+// after it when a read goes on: the name is everything before the last
+// "(…-tier, score …)".
+const BRIDGE_PERSON = /^\[\d+\/\d+\] (.+) \([^()]*-tier, score [^()]*\)/;
+
+/**
+ * Whose circle a batch (Map 2nd degree, every paused list) is reading now,
+ * by name, from the line it printed as that person started; null for any
+ * other job, or before the first. The Scan page's "Watch it fill in" link
+ * (app/api/scraper/route.js turns the name into one of your connections).
+ */
+export function mappingNow(log, action) {
+  if (!Array.isArray(log) || !action || !(action.startsWith('auto-bridge') || action === 'resume-all')) return null;
+  for (let i = log.length - 1; i >= 0; i--) {
+    const m = String(log[i]).match(BRIDGE_PERSON);
+    if (m) return m[1];
+  }
+  return null;
+}
+
 function walk(done, total) {
   if (!total) return null;
   return { done: Math.min(done, total), total, kind: 'walk' };