autoreg-skills-max: initial public release (restored, redacted, hardened)

skills/ai-provider-autoreg/references/hero-sms-protocol-autoreg.md

@@ -0,0 +1,35 @@
+# hero-sms.com (partners.hero-sms.com) — protocol autoreg + SPA cookie-auth pattern
+
+Status 2026-10-12: full reg flow WORKS (register 200 → email → password set → login 200).
+BUSINESS VERDICT: signup gives $0 balance (`GET /internal/user/balances` → `{"data":{"usd":0}}`) — keys are useless without top-up (~$3.6/number). Do NOT farm hero-sms for free SMS; only reuse if the account already has credit.
+
+## Generalizable pattern: SPA protocol autoreg with httpOnly-cookie auth
+
+Applies to any Vite/React SPA panel behind Cloudflare Turnstile where external HTTP fails:
+
+1. **Reverse the API from INSIDE the page** — external fetches get 403 (CF), in-page `fetch()` of the JS bundle chunks does not. List chunks via `[...document.querySelectorAll('script[src]')]`, fetch the index chunk, regex lazy-chunk names, fetch each and grep for `/api/`, `/internal/`, endpoint literals. Guessing chunk hashes fails — always extract real names from the index bundle at runtime.
+2. **Drive the API with in-page `fetch(..., {credentials:'include'})`** via `frame.evaluate(async...)` — inherits CF clearance and cookies. Never replay from Python `requests` against the same endpoints (CF 403/1010).
+3. **Auth token may live ONLY in an httpOnly cookie.** If the login 200 body is just `{status, needTwoFA, message}` — do NOT hunt for JWTs in body/localStorage; the next in-page fetch with `credentials:'include'` is already authenticated. Verify by calling a cheap authed endpoint (balances) instead of declaring login-fail.
+4. **Turnstile: camoufox solves it natively** — just poll `input[name=cf-turnstile-response]` value (up to ~180s, it is flaky run-to-run). Fallback: captcha sidecar on :8877 (`POST /solve {type:'turnstile', sitekey, url, real_page:true}`), inject returned token into the hidden input, then read it back. Sitekey comes from `.cf-turnstile[data-sitekey]` in DOM.
+5. **Password-policy gotcha:** create-password pages silently keep the Submit button `disabled` when the password violates policy (min 8 chars, upper+lower+digit+special from `!@#$%^&+.?*`). Always generate policy-compliant passwords and poll button `.disabled` before/while clicking — a `None` click result means validation, not a missing selector.
+6. **Fill password inputs with real keyboard** (`page.click(sel)` + `keyboard.type`), not JS value injection — React controlled components ignore dispatchEvent-only fills.
+7. **Confirmation email can be delayed >5 min** on some runs (t-online). If reg succeeded but no mail: keep the pending account in the bank — the create-token from the email link stays valid across runs, so a recovery pass can finish password+login for old tokens later (resend endpoint `POST /internal/auth/mail-confirmation` exists but payload shape unresolved — 422 on `{email:...}`).
+
+## hero-sms protocol map (partners-api.hero-sms.com)
+
+- Base: `https://partners-api.hero-sms.com`, headers `Content-Type: application/json`, `lang: ru`
+- `POST /internal/registration` `{type: 2, email, cf-turnstile-response}` → 200 `{status:success}` (type 2 = Protocol; enum from types chunk)
+- Email from Hero SMS → link `https://partners.hero-sms.com/auth/create/<token>?lang=ru` = create-password page (NOT a separate confirm step). Regex the link from IMAP HTML body.
+- Create-password page: 2 visible `input[type=password]` (password + repeat), Submit button text `Создать`.
+- `POST /internal/auth/confirm-password` with `{token, password}` variants → 422 (payload shape unresolved) — UI submit is the working path.
+- `POST /internal/partner/auth/login` `{email, password, cf-turnstile-response}` → 200 `{status:success, needTwoFA:false}` + httpOnly cookie. Fresh turnstile token required per login.
+- `GET /internal/user/balances` (cookie) → `{data:{usd:N}}`
+- `GET /internal/user/api-key` → 405 Method Not Allowed on GET; key retrieval via dashboard UI (profile → key eye-toggle), not resolved headlessly.
+- `GET /internal/user` → 404.
+
+## Scripts + bank
+
+- Working scripts: `C:/Users/User/tmp/hero_reg9.py` (full flow), `hero_recover2.py` (cookie login → balances). Bank: `tmp/hero_reg_accounts.jsonl` (email/password/mail_pass per record; latest record per email wins).
+- Mail pool: `Desktop/avtoreg/working_mails.txt` t-online canonical addresses (dash-aliases dead for delivery), used-list `tmp/hero_reg_used.txt`.
+- Run: `PYTHONPATH="" Python311/python.exe hero_reg9.py` (~5-8 min/account: turnstile waits dominate).
+- 2 live accounts banked: [REDACTED-EMAIL], [REDACTED-EMAIL] (balance $0).