v0.1.6

Spend limits, version 2. Money safety: a pull is now held to a daily and a monthly budget, and repeating a request is not charged twice.

Changed for money safety

• Period budget: daily and monthly (UTC), $10 and $50 by default, saved in budget.json in LOOOT_ADS_DATA_DIR. Only the signed-in owner changes it, on the new Costs page (PUT /api/budget, session plus CSRF). A run request that carries a budget field is refused with 400. A spend cap in a request is ignored; the cap per pull comes only from ADS_SPEND_CAP_USD.
• Reserve then settle under a lock file. Each call reserves its list price before it is made and is refused if used plus reserved plus the price would pass either budget. Parallel requests cannot pass the budget together (tested with 25 at once).
• A call still running keeps its reservation and is never counted as $0. The next pull settles it through GET /v1/runs/{id}. A reservation that cannot be looked up is released after 24 hours. A call looot refused with an HTTP answer releases it.
• Stored results for 40 days: the same request is answered with no call and no charge.
• Stable keys: the X ads call ended its date window on today, so its key changed daily and a repeat on a new day was charged again. The window now ends on the first day of a 7-day period. --fresh still starts a new pull on purpose.
• Sidebar and Costs page show used, reserved and remaining. The CLI refuses a pull above what is left unless --partial.

Upgrading

• No migration. budget.json is created on first use. Run one instance on a persistent disk.
• New admin routes: /costs and /api/budget.
• The looot token balance is still the final limit. Fund a dedicated token with only what you are willing to spend.
• The first X ads pull after upgrading may be charged once more, because its key form changed.

162 tests pass.

v0.1.5

Keyword discovery on Meta, LinkedIn, TikTok, Reddit and TikTok top ads. One keyword on five platforms is $0.01064.

Added

• search.reddit-ad-library, searchapi-io-reddit-ad-library, $0.004 per call
• api.tiktok.ads.search-ads, tikhub-api-tiktok-ads-search-ads, $0.001 per call
• api.twitter.ads.search, anysite-api-twitter-ads-search, $0.00036 per result, 20 results asked, $0.0072 per call (needs an @handle)
• ads.meta.search keyword variant, scrapecreators-facebook-adlibrary-search-ads-get, $0.00188
• ads.linkedin.search and tiktok.ad-library.search keyword variants, $0.00188

Fixed

• The Adyntel endpoints are no longer in the public catalog, so live-priced pulls refused Meta, Google and LinkedIn calls for a domain. Meta and LinkedIn now search by company name, Google by domain through searchapi-io-google-ads-transparency-center ($0.004).
• A competitor with a domain on four platforms now costs $0.00964 (was listed as $0.0211). Five cost $0.0482 (was $0.1057).

Parsers for the new sources are unverified guesses, marked so in the README. No new routes. 123 tests.

v0.1.4: admin sign-in

Security fix. Versions 0.1.3 and older had no admin authentication. Anyone who could reach a running web UI could read the saved pull and start paid looot runs on your token, with a spend cap they chose. If you run one of those versions on a host others can reach, upgrade to v0.1.4 and set ADS_ADMIN_PASSWORD (12 characters or more).

What changed

• Every page and route is public on purpose or admin. Admin routes are closed until a password is set, and /login explains what to set.
• Signed httpOnly session cookie, lockout after repeated wrong passwords, CSRF token plus same-origin check on every state-changing request.
• The spend cap is set by the server (ADS_SPEND_CAP_USD, default 1.00), not by the request. A paid run needs a quote token the server signed for your session and that pull. 6 paid runs per session per hour.
• Security headers, and no-store on admin responses.

For upgraders

• The web UI now needs ADS_ADMIN_PASSWORD, or it shows a setup page. The CLI is unchanged.
• The Spend cap field is gone from the page. Set ADS_SPEND_CAP_USD instead.
• npm run demo refuses to start next to a LOOOT_TOKEN or a saved pull (.looot-data/latest.json) unless a password is set.

See Securing a deployment in the README.

v0.1.3

Sidebar: nested-item support in the shared shell, placeholder label no longer under the platform pill

v0.1.2

Sidebar layout.

v0.1.1

Dependency security bump. next and eslint-config-next 16.3.7 to 16.3.8, which fixes six Next.js advisories (GHSA-3w37-wq28-93x7, GHSA-4jqv-mc3x-m676, GHSA-39w2-rjm5-chcv, GHSA-f87g-xv8r-7p7x, GHSA-mcj8-r9mp-w47p, GHSA-cjq9-62q9-8jv4). No code changes. v0.1.0 is unchanged.

v0.1.0

First release. Competitor ad board over the Meta, Google, LinkedIn and TikTok ad libraries through looot. Demo mode with invented brands, a headless CLI with --dry-run and a spend cap, and a web UI on the same engine. No paid looot run was made; response parsing is built from catalog descriptions and fixtures.