v0.3.3 — ban detection, session health monitor, request throttling

New modules in @b1dz/source-dealdash:
  - api/session.ts    Session health monitor. Tracks consecutive auth
                      failures and scans response bodies for ban language.
                      5 consecutive 401/403s or any "account suspended"
                      text → state transitions to 'banned' and ALL
                      requests are blocked immediately. withSessionMonitor()
                      wraps any DealDashFetcher with auto-detection.
                      (10 contract tests)
  - api/throttle.ts   Request rate limiter. Default 500ms between requests
                      (2/sec). Configurable via DEALDASH_THROTTLE_MS env.
                      Wraps any DealDashFetcher transparently.

Ban detection checks:
  - "account suspended/banned/disabled/blocked"
  - "violation of terms"
  - "access denied permanently"
  - "your account has been"
  - 5 consecutive 401/403 responses (hysteresis: resets on any 200)
  - 5xx errors do NOT count toward ban detection (they're transient)

121 tests in @b1dz/source-dealdash, 18/18 turbo tasks green.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

v0.3.2 — add Arb + Trade tabs for crypto sources

Scaffold views for cross-exchange arbitrage (Gemini/Kraken/Binance.US)
and single-exchange day trading. Table headers + config summary in place;
data flows once the exchange feed clients are implemented.

Tab bar: My | 1v1 | Profit | Loss | Waiting | Joinable | Won | Lost | Arb | Trade | Lookup | Logs

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

v0.3.1 — TUI cut over to shared strategy modules

Phase 3g: the TUI now uses the same typed pollOnce() + decide() path
the daemon does, via a thin tui-bridge.ts orchestrator. ~320 lines of
inline strategy code deleted from the vendored dealdash.tsx.

New files
  - apps/cli/src/tui/tui-storage.ts   Storage adapter for pollOnce
  - apps/cli/src/tui/tui-bridge.ts    pollTick + decideTick + mode setters

Changes to apps/cli/src/tui/dealdash.tsx (1854 → 1535 lines)
  - Data-gathering block → single pollTick() call
  - AUTO_BID strategy block → single decideTick() call
  - Vendored caches hydrated one-way from PollResult.caches each tick
  - All React UI components preserved unchanged
  - Mode state shared via tui-bridge → same ModeState type as daemon

All 18 turbo tasks pass, 111+ tests in source-dealdash, no regressions.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

v0.3.0 — daemon runs real strategy end-to-end

Phase 3 of the refactor: the lifted TUI logic now has a typed, tested,
daemon-callable counterpart. Vendored TUI still runs unchanged in parallel.

@b1dz/source-dealdash — lifted and tested from the TUI
  - strategy/profit.ts      pure profit math (24 tests)
  - strategy/score.ts       rejoin scoring (6 tests)
  - strategy/balance.ts     low-balance hysteresis state machine (5 tests)
  - strategy/decide.ts      pure decision engine — force-exit, dedup,
                            focus, entry gates, rebook, cancel (20 tests)
  - api/fetcher.ts          DealDashFetcher seam with real + stub impls
  - api/page.ts             dd.auctionFeed brace-balanced parser (12)
  - api/bid-buddy.ts        book/cancel/exchange actions (6 tests)
  - api/auctions.ts         live feed + gonzales + getBidders helpers (12)
  - api/wins.ts             orders-feed normalizer (3 tests)
  - poll.ts                 pollOnce(ctx) orchestrator (11 tests)
  - project.ts              toDisplayAuctions — history → bidders (8)

@b1dz/daemon — the worker actually does work now
  - dealdashWorker.tick() calls pollOnce → decide → execute
  - Per-user fetcher from source_state.payload.credentials
  - Mode state (hysteresis, focus id, toggles, lockedProductIds) persists
    in source_state.payload.daemon.mode across restarts
  - Uses shared toDisplayAuctions so bidder counts match what the TUI sees
  - Each decision executes independently — one failure doesn't block the
    others

Tests
  - 111 tests in @b1dz/source-dealdash alone, ~140 repo-wide
  - Every gate the TUI enforces is now locked in by a contract test
  - Stub fetcher + in-memory storage for fully deterministic runs

The TUI keeps working unchanged; the daemon is now a parallel
implementation that can run the same decisions server-side. Phase 3g
cuts over the TUI to read from storage instead of recomputing inline.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

v0.2.0 — daemon, API surface, life-saving mode

Architecture
- New @b1dz/daemon package: long-running multi-source, multi-user
  scheduler. Per-(user, source) setInterval, error isolation, graceful
  shutdown. Runs identically under terminal, systemd, Docker, Railway.
- Multi-stage Dockerfile + Railway config (Docker builder, two services
  from one image: web + daemon)
- pnpm scripts: dev:web, dev:daemon, start, daemon, b1dz
- systemd unit file with hardening flags

API as the only outside-world surface
- New @b1dz/sdk package: typed wrappers every client imports.
  storage.{get,put,delete,list}, dealdash.{bookBid,cancelBid,exchange,
  pageInfo,marketPrice}, signup/login, auto token refresh.
- API routes for all DealDash actions (book, cancel, exchange, page-info,
  market-price). Server-side cookie loader. Clients never touch DealDash.
- @b1dz/storage-b1dz-api adapter — third Storage implementation, drop-in
  swap for the Supabase one. CLI now defaults to it (no secret key on
  user machines).

State migration
- All DealDash internal caches (titles, categories, BIN, exchangeable,
  productIds, noReEntry, bidsSpent, marketPrices, seenAuctions, dailyPL,
  plSamples, hourStats, exchangeRates) moved from local JSON files into
  source_state.payload via state-sync registry. Per-user, per-source.
- Per-user DealDash session cookies stored in source_state.payload.credentials

Strategy
- Life-saving mode: hotkey `l`, defaults ON via LIFE_SAVING_MODE=1.
  Forces survival/acquire-only behavior regardless of bid balance.
- Auto low-balance trip with hysteresis (enter ≤1000, exit ≥1500)
- Survival mode: only enter 2-bidder bid packs
- Focus mode: cancel all but the highest-sunk-cost auction per productId
- Same-product duplicate detection [DUP] badge in Waiting tab
- Per-pack scoring uses sqrt(bidders) penalty + total upside × pack size
- Auto-tightness multiplier from rolling P/L windows (1m..1y)
- Concurrency cap (MAX_CONCURRENT) + bid balance floor + stop-loss

Misc
- pnpm version:patch|minor|major scripts to bump every workspace
  package + extension manifest in lockstep
- ValueSERP key now used server-side only via /api/sources/dealdash/
  market-price route
- 18/18 tests + builds pass

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

v0.1.0 — initial b1dz monorepo

Multi-source profit monitor with pluggable Source<T> abstraction.

Apps
- @b1dz/web        Next 16 + Tailwind 4 + PWA dashboard
- @b1dz/cli        Global b1dz binary, ink TUI, runner, auth
- @b1dz/extension  Browser extension stub for cookie sync

Packages
- @b1dz/core              Source, Opportunity, Alert, Storage, Runner, profit math, env loader
- @b1dz/storage-json      File-backed Storage adapter (dev)
- @b1dz/storage-supabase  Postgres adapter (multi-tenant, RLS-aware)
- @b1dz/source-dealdash   DealDash source (lift in progress)
- @b1dz/source-crypto-arb Cross-exchange arbitrage scanner
- @b1dz/source-crypto-trade Single-exchange day trading

Infra
- pnpm 10 workspaces + Turborepo
- Vitest with shared Storage contract test
- ESLint flat config + typescript-eslint
- Supabase migrations (opportunities, alerts, source_state, logs, multi-tenant RLS)
- Auth via Supabase: cli signup/login, web /login + /signup, middleware
- Per-user DealDash credentials in source_state.payload

Lifted DealDash TUI from ~/src/dealdash with full feature set:
- ink-based real-time dashboard
- per-product cooldown, concurrency cap, low-balance focus
- profit-floor gates with auto-tune based on rolling P/L windows
- 1m/5m/15m/30m/1h/1d/1w/1mo/1y P/L tracking
- bid pack cost-per-bid display
- exchange-only + snipe modes
- automated DealDash login via puppeteer + capsolver

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>