autoreg-skills-max: initial public release (restored, redacted, hardened)

skills/ai-provider-autoreg/references/beatapi-email-signup-and-quota-probe.md

@@ -0,0 +1,64 @@
+# BeatAPI (beatapi.io) — email-signup path, walls, and the proxy×domain quota probe
+
+Email signup is fully reversed and scripted (`tmp/beat_autoreg/beat_email_reg.py`)
+but currently **blocked server-side**; GH OAuth (`beat_gh_reg.py`) remains the
+working pipeline. This file saves a future session from re-reversing the SPA
+and re-discovering the walls.
+
+## API topology (SPA chunk reverse)
+
+- Marketing site `beatapi.io` is a Vite/React SPA; `/api/*` there returns a
+  404 HTML shell — do NOT conclude "no API".
+- Real base: **`https://api.beatapi.io/api`**. Discovery path: main bundle
+  `assets/index-*.js` lists lazy chunks (`sign-up-*.js`); the sign-up chunk
+  shows the payload shape and imports its client from a `gateway-client-*.js`
+  chunk, which holds the base URL (`VITE_GATEWAY_URL`) and the
+  `fetch(base + '/api' + path)` helper.
+- All dashboard calls need a browser-like User-Agent (Cloudflare 1010 on
+  urllib defaults).
+
+## Email signup protocol (no browser; empty turnstile accepted)
+
+1. `GET /api/verification?email=<e>&turnstile=` → `{success:true}` = 6-digit
+   code emailed.
+2. `POST /api/user/register?turnstile=` JSON
+   `{username, password, display_name, email, verification_code, aff_code}`.
+   Username is auto-derived from the email local part; on collision (error
+   matches `/用户名|username/i`) retry with a `-xxxx` random suffix.
+3. uid via `GET /api/user/self` (cookies) → `POST /api/token/` with header
+   `New-Api-User: <uid>` (trailing slash mandatory) → `POST /api/token/{id}/key`
+   for the full key.
+
+## Verified walls
+
+- **Email alias restriction**: gmail with dots/plus →
+  `管理员已启用邮箱地址别名限制` reject. Only fully unique mailboxes count —
+  dot-alias mass-reg is dead here.
+- **Domain whitelist**: gmail/163/qq/icloud/yahoo/foxmail pass the domain
+  check; t-online.de, high.edu.pl (temp.tf), outlook/hotmail rejected.
+- **Global SMTP daily quota**: whitelisted domains reach the send step and hit
+  `550 You have reached your daily email sending quota` — SERVER-GLOBAL, not
+  per-IP (identical from 10+ distinct exit IPs). Resets daily (~midnight UTC).
+- **Per-IP rate limit**: 429 `发送过于频繁 ... 24 秒` between verification
+  requests from one IP.
+- temp.tf issues only high.edu.pl (gmail provider returns `{"email":null}`)
+  → not whitelisted anywhere useful.
+- Yahoo combo pool (1.1M entries, `tmp/apiclaw_reg/yahoo_pool.json`): 6625
+  sampled across head + far slices → **0 alive** via IMAP. Always IMAP-sample
+  a combo pool (~25-50 creds, multiple offsets) before building a flow on it.
+
+## Proxy × domain matrix probe (reusable methodology)
+
+When a signup/verification endpoint answers with a quota or limit error,
+determine **per-IP vs global** before burning time on proxy rotation:
+
+1. Load alive proxies (`Desktop/proxy_bot/proxies.db` `pool` WHERE alive=1
+   ORDER BY score; `tmp/live_http_proxies.txt`), ~30 of them.
+2. Rotate the test email DOMAIN per request (round-robin) so the 24s per-IP
+   rate limit never fires and each domain gets many distinct exits.
+3. Classify each response: QUOTA / WHITELIST_REJECT / RATELIMIT / SUCCESS /
+   PROXY_DEAD (expect ~50% dead on free pools — filter, don't conclude).
+4. Same block message across many distinct exit IPs = global server-side
+   limit → proxies cannot help; switch pipelines instead.
+
+Script: `tmp/beat_autoreg/beat_quota_probe.py`, results `quota_probe.jsonl`.