autoreg-skills-max: initial public release (restored, redacted, hardened)

skills/ai-provider-autoreg/references/nace-ai-autoreg.md

@@ -0,0 +1,69 @@
+# NACE.AI (console.nace.ai) — Passwordless OTP Autoreg + Credit Gate
+
+**Service:** nace.ai (Drex inference — POST /v1/systemone, NDI documents)
+**Auth:** Next.js server actions, passwordless email OTP ("Drex sign-in code"), Cloudflare Turnstile managed
+**Key format:** `nace_sk_{51 chars}` — retrieved via Replace dialog (full key shown once)
+**Credit:** $25 advertised, but structurally gated to Google/GitHub OAuth for free email providers
+
+## Recon
+
+- Login page: `https://console.nace.ai/login`
+- No `/signup` route (returns 404) — login IS registration
+- Turnstile sitekey: `0x4AAAAAAFCRPOs3yZbksWF1` (managed, no action required)
+- Auth options: Google OAuth + GitHub OAuth + email code (passwordless OTP)
+- Sitekey discovery: `grep -oE '0x4[A-Za-z0-9]+' login_dump.html`
+
+## Registration Flow (email OTP)
+
+1. Navigate to `/login`, fill email, Camoufox solves Turnstile natively (0 captcha spend)
+2. Server sends 6-digit "Drex sign-in code" to email (sender: Drex/NACE, subject contains "sign-in code")
+3. Parse code from text/plain MIME body with service-specific regex: `sign-in code is (\d{6})`
+   - PITFALL: Generic IMAP regex (`\d{6}`) catches SPF header numbers. Filter by suffix + sender keywords.
+4. Fill code, verify → redirect to `/dashboard`
+5. API keys at `/dashboard/api-keys`, billing at `/dashboard/billing`
+
+## Key Extraction
+
+- Full key is NOT visible on the API keys page — only partial mask shown
+- Click "Replace" on an existing key → modal shows full `nace_sk_{51}` once
+- Scrape from input.value, innerHTML, or clipboard — NOT page text
+- Key format: `nace_sk_{51 chars}`, Bearer auth on `https://console.nace.ai/v1`
+- Up to 3 active keys per account
+- Test: `POST /v1/systemone` → 402 insufficient_credit if no balance, 401 if key invalid
+
+## Credit Gate (CRITICAL)
+
+**Email OTP registrations on Gmail/free providers do NOT receive the $25 credit.**
+
+Billing page quote: "Free credit is given once per person and not to temporary email addresses. On Gmail, Outlook and other free email providers, only accounts that sign in with Google or GitHub get it."
+
+- Email OTP signup → credit_balance: $0.00 → `PARTIAL` (key valid, no credit)
+- Google/GitHub OAuth signup → presumably receives the $25 (untested)
+- Temp email domains (voidash.bond) explicitly excluded
+- Promo code field exists on billing page (untested)
+
+## Browser
+
+- Camoufox headless solves Turnstile natively (no 2captcha spend)
+- Fallback: Playwright Chromium with `--disable-blink-features=AutomationControlled` + custom UA
+- Browser retry pattern: try Camoufox 3×, then Playwright fallback
+
+## Key Verification
+
+```bash
+curl -s https://console.nace.ai/v1/models \
+  -H "Authorization: Bearer nace_sk_..."
+# 200 = key valid (may return 0 models — Drex, not chat API)
+# 401 = key invalid
+# 402 = auth OK but no spendable credit (for /v1/systemone)
+```
+
+## Bank Entry
+
+```json
+{"service": "nace.ai", "email": "[REDACTED-NAME]+{sfx}@gmail.com", "password": null,
+ "auth": "email OTP (passwordless), Turnstile managed",
+ "api_key": "nace_sk_{51}", "credits": "$0.00",
+ "endpoint": "https://console.nace.ai/v1",
+ "proof_status": "PARTIAL: registered+key valid, $25 credit requires Google/GitHub OAuth"}
+```