autoreg-skills-max: initial public release (restored, redacted, hardened)

2026-10-20 02:16:32 +03:00
commit f58eafeb48
565 changed files with 60064 additions and 0 deletions
--- a/skills/cloud-trial-registration/references/aws-signin-captcha-payment.md
+++ b/skills/cloud-trial-registration/references/aws-signin-captcha-payment.md
@@ -0,0 +1,52 @@
+# AWS signup/login: TM captcha auto-solve, OTP, payment resume, IdC gating
+
+Verified end-to-end on signin.aws.amazon.com + signup.aws.amazon.com (root login → console → payment form). CDP endpoint on a locally-launched Chrome (`http://127.0.0.1:<port>/json/list`), raw websocket CDP (no Playwright needed).
+
+## 1. Threat-mitigation text captcha (WORKING auto-solve)
+
+The "Making sure it's you" challenge lives in an iframe; input is `captchaGuess`.
+
+Loop recipe:
+1. Track the iframe's live execution context (contexts get reused IDs after reload — keep an ordered list of live contexts, pick the newest containing `captchaGuess`).
+2. If no captcha visible: click the main-page `Verify` button (match by `innerText`), then poll for `captchaGuess` visible (~2.5s).
+3. If captcha already open for a while: click `Reset` INSIDE the iframe to force a fresh image.
+4. Get the image WITHOUT screenshot cropping: read `img.src` from the iframe DOM (`Array.from(document.querySelectorAll('img')).filter(im => im.src.startsWith('http') && im.width > 50)`, take last), then download the S3 URL with plain `urllib` outside the browser. Screenshot-crop and `Network.getResponseBody` both race the challenge TTL; DOM img-src + direct download is the fast reliable path. EXCEPTION — Builder ID `platform/d-` login pages: the S3 `img.src` is single-use (403 on outside refetch) and Reset emits NO Network events on the iframe target; there capture via main-target `Page.captureScreenshot` with `clip` = iframe rect (main doc) + inner img rect (iframe doc) instead — the iframe is a separate CDP target.
+5. OCR with a local VL model — `qwen3-vl-plus` via the dashscope proxy reads these in ~4s (`qwen-vl-ocr` was 18s and less accurate).
+6. Fill answer via native value setter + `input`/`change` events, then JS `form.submit()`/button click. Real keystrokes (`Input.dispatchKeyEvent`) fail on this form (`typed: None`) and lose the TTL race — do not use them.
+7. Wrong answer rotates the challenge silently — no error message. Treat submit as loop step: after submit wait, if a new captcha appears go to 3.
+
+One round (reset → img dl → OCR → submit) ≈ 7s; a few rounds per login is normal.
+
+## 2. Root login flow + Builder ID trap
+
+- Sign-in page: pick "root user" email path by clicking the actual element (`a, button, [role=link]` containing the root-email text), not by body-text heuristic.
+- After captcha+password, error **"An AWS account with that sign-in information does not exist"** means the email is an **AWS Builder ID**, not an account root user. Builder ID ≠ AWS account — signin with it will never reach a console. Use the email the account was actually registered with.
+
+## 3. Email OTP + MFA skip
+
+- "Confirm you're you" page: 6-digit code to account email. For t-online pool: `imaplib.IMAP4_SSL('secureimap.t-online.de', 993)`, scan last ~15 mails (full-inbox `SEARCH ALL` chokes on 18k+ mailboxes — fetch last N ids instead), regex `(?:Verification code|code)[^\d]{0,20}(\d{6})` on AWS/Amazon mails.
+- Fill code with JS native setter, click `Verify and continue`.
+- Next page is MFA registration ("required in N days") — click **Skip for now** → lands in console.
+- Save state (stage=`console_logged_in`) immediately; the session cookies persist in the browser profile.
+
+## 4. CDP quirks on AWS pages
+
+- `Runtime.evaluate` on `console.aws.amazon.com` can hang >90s (heavy SPA renderer). Don't fight it: open a NEW tab via `PUT /json/new?<url>`, or navigate a light tab (`signup.aws`) and let redirects settle, then read state from a fresh `/json/list`.
+- After login, navigating the same tab to a console URL is safer than forcing `Page.navigate` mid-session (session bounce resets to signin).
+
+## 5. Payment resume for stuck (incomplete) accounts
+
+- Stuck account → `https://signup.aws.amazon.com/billing/signup/incomplete` → link **"Complete your AWS registration"** → `signup?type=resubscribe#/paymentinformation` (contact/plan steps are skipped, already stored).
+- Card form is React/awsui: fill with native value setter + `input`/`change` (card number field masks to `4147 2046 ...` — that's normal). Expiry as `MM/YY`.
+- Click Continue, then watch network: `aws-payment-encryption-prod.../createpaymentinstrument` 200 = card encrypted OK; `aws-payments-gateway-service.../PaymentInstrument` is the actual verdict. Page shows `Error 880104` alert on rejection.
+
+## 6. Error 880104 semantics (hard-won)
+
+- **880104 = the payment instrument is rejected at the real $1 pre-auth.** Two distinct failing classes: (a) generated/fake VCCs — always, any BIN; (b) genuinely-issued cards from blacklisted issuer families — Monobank/UA BINs (444111 etc.) are blanket-blocked regardless of account age, proxy, or billing address (multiple real cards on fresh accounts + DE-resi + DE billing: encrypt/createpaymentinstrument 200, gateway verdict 880104).
+- Not engineerable via proxy/address/account rotation — do not burn resources retrying. What passes: EU-issued card (Revolut/Wise-class BIN) or a live no-KYC crypto VCC with real 3DS/authorization capability (kliencard-class; Luhn-generated cards are useless — AWS does a live authorization hold).
+- Distinguish from UpCloud/Braintree: there a $0 auth geo-blocks all UA BINs; AWS rejects both non-existent cards AND banned issuer families.
+
+## 7. IAM Identity Center gating
+
+- `console.aws.amazon.com/singlesignon` on an account with incomplete signup **redirects to signup/incomplete** — IdC instance cannot be enabled until payment completes. Anything downstream (Kiro via IdC, region us-east-1/eu-central-1) is blocked. Sequence is always: payment → IdC → app SSO.
+- When enabling IdC: use "Enable an account instance", never "Enable with AWS Organizations" (org creation has different requirements/limits).
--- a/skills/cloud-trial-registration/references/ionos-trial.md
+++ b/skills/cloud-trial-registration/references/ionos-trial.md
@@ -0,0 +1,33 @@
+# IONOS Free Trial (verified 2026-09, login flow verified 2026-09-24)
+
+## Trial offers
+| Offer | Terms | URL |
+|---|---|---|
+| Free VPS (VPS XXL+) | 30-day money-back guarantee, CC required at signup, auto-renews unless cancelled | https://www.ionos.com/servers/free-vps |
+| Free Cloud Server | starting credit covers ~1 month, no minimum contract, cancel anytime | https://www.ionos.com/cloud/free-cloud-server |
+| IONOS Cloud Cubes | **$200 starting credit** — biggest offer; separate signup on Compute Engine | https://cloud.ionos.com/compute/sign-up |
+| AI Marketing Suite | **3 months free** promo — visible inside logged-in control panel | my.ionos.com/home/add-product (top stripe) |
+| Free server hosting overview | links both paths | https://www.ionos.com/servers/free-server-hosting |
+
+- Card required on all offers; IONOS does a pre-auth at registration (useful $0/$1 auth-validation target).
+- Datacenter choice includes non-US (Frankfurt, Berlin, Logroño).
+- VPS = KVM + root; free Plesk Web Host Edition option.
+- Billing address and hosting IP geo do NOT need to match (their US IPs are Kansas City / Lenexa, AS8560 IONOS SE, 74.208.x.x range).
+
+## Login flow (my.ionos.com) — VERIFIED 2026-09-24
+1. `https://my.ionos.com/login` is a **404** — use `https://my.ionos.com/` which redirects to `https://login.ionos.com/?redirect_url=...`.
+2. Step 1: single-field "Customer ID, email address or domain" → Next.
+3. Step 2: **mandatory email OTP** — 6-digit code to account email (`login.ionos.com/emailconfirmation`).
+4. Step 3: **password step DOES appear after OTP** (`login.ionos.com/password#`) for at least some accounts — an earlier note claiming "no password step" was wrong. Full chain: email → OTP code → password → my.ionos.com/home/products.
+5. **Error 500 on OTP submit does NOT burn the code**: submitting the OTP can land on `Error 500` ("this page cannot be accessed") while the status page says all systems normal; session is NOT established (my.ionos.com still redirects to login). Recovery that worked: restart the login from `my.ionos.com/` and **re-enter the SAME code** — it was still valid on the second attempt. Only request a fresh code if the same one is rejected.
+6. Browser automation: chrome-devtools MCP works (fill + click by uid). Note: after password submit, panel may briefly redirect through `ai-builder.ionos.com` if an AI Builder project exists; `my.ionos.com/websites/` navigation can timeout (10s default) — raise timeout to 30s for panel pages.
+
+## Control panel recon (logged in)
+- `my.ionos.com/home/products` — product overview; account name shown in "Welcome <name>" heading.
+- `my.ionos.com/home/add-product` — full catalog of offers incl. free-trial buttons. Scrape with evaluate_script over `a,h2,h3` filtering `/server|vps|cloud|hosting|free|trial/i` — returns tiles + promo stripes (this is how the IONOS Cloud "Start your free Trial" and AI Marketing Suite 3-months-free promos were found).
+- IONOS Cloud trial signup from inside the panel goes through an `ias.ionos.com/ias/follow/CLICK?...` tracking redirect to `cloud.ionos.com/compute/signup` — session may carry over from the main account.
+- Empty account (only AI Builder project) shows NO VPS in products list — VPS must be added via add-product catalog.
+
+## Account intel pattern
+- ip-api.com geo of their front IPs: [REDACTED-IP]/77 → Kansas City, MO, AS8560 IONOS SE.
+- AbuseIPDB/GreyNoise need API keys in env; skip gracefully if absent.
--- a/skills/cloud-trial-registration/references/kamatera-api.md
+++ b/skills/cloud-trial-registration/references/kamatera-api.md
@@ -0,0 +1,71 @@
+# Kamatera API Reference
+
+## Registration flow
+```
+POST https://www.kamatera.com/wp-admin/admin-ajax.php
+Content-Type: application/x-www-form-urlencoded
+
+action=cwm_api_action
+data_options[cases]=cwml
+data_options[email]=<email>
+data_options[password]=<password>
+data_options[orgUrl]=https://www.kamatera.com/free-trial/
+data_options[formButtonText]=Create free account
+data_options[submitText]=Create free account
+data_options[headerText]=
+```
+
+Success response: `{"status":0,"token":"...","url":"https://console.kamatera.com/al.php?t=...","validationToken":"..."}`
+
+## Login flow
+```
+POST /svc/login → {"email":"...","mediateToken":"..."}
+GET /csrf → extract CSRF_TOKEN from HTML
+POST /svc/sendtfa → triggers email
+  (check mail.tm for 6-digit code)
+POST /svc/logintfa → {"code":"...","email":"...","mediateToken":"...","rememberBrowser":true}
+```
+
+## Billing API
+```
+PUT /svc/billing/profile
+Headers: token=<csrf>, api-version=latest, Content-Type=application/json
+
+{
+  "firstName": "Alex",
+  "lastName": "Morgan",
+  "country": "UA",
+  "city": "Kyiv",
+  "address": "1 Khreshchatyk St",
+  "state": "Kyiv",
+  "postalCode": "01001",
+  "phone": "380501234567",
+  "invoiceName": "Alex Morgan",
+  "paymentType": 0,
+  "cardNumber": "4874100085748500",
+  "cardExpiry": "05/30",
+  "cardCvv": "851"
+}
+```
+
+## Error codes
+| Code | Meaning |
+|------|---------|
+| 21 | Generic / card declined |
+| 51 | Invalid TFA code |
+| 57 | Invalid/missing CSRF token |
+| 105 | Invalid first name |
+| 107 | Invalid country |
+| 109 | Invalid phone |
+| 110 | Invalid city |
+| 112 | Invalid zip code |
+| 122 | Invalid invoice name |
+
+## Email validation
+- Email regex: `/^\w+([\.-]?\w+)*@\w+([\.-]?\w+)*(\.\w{2,})+$/` — `+` NOT allowed
+- Password: [REDACTED] + uppercase + number + >=8 chars + <28 chars
+
+## Card: 4874100085748500
+- BIN: 487410 (Visa Rewards, JSC Universal Bank, Ukraine)
+- Luhn: valid
+- Status: DECLINED by payment processor (error 21) — likely blocked for international/online payments
--- a/skills/cloud-trial-registration/references/mulesoft-trial.md
+++ b/skills/cloud-trial-registration/references/mulesoft-trial.md
@@ -0,0 +1,69 @@
+# MuleSoft Developer Trial Reference
+
+## Account
+- Email: [REDACTED-NAME]+mulesoft@gmail.com
+- Username: alexmorgan26
+- Password: [REDACTED]
+- Org: TechNova Solutions (id: 50597a0b-36b0-4a8b-9130-169fd33bf633)
+- Trial: Developer, expires 2026-08-24
+- Email: NOT verified (emailVerifiedAt: null)
+- User ID: c12e2a6a-a533-467a-a177-0a3796d73979
+
+## What's available (entitlements)
+- vCores Sandbox: 1, Design: 1, Production: 0
+- runtimeFabricCloud: true (but fabrics: [] — nothing provisioned)
+- flexGateway: true
+- managedGatewaySmall: 1 (but gateways 404)
+- muleDxGenAI: true (Einstein GPT, only via Code Builder)
+- muleDxWebIde: true (Code Builder, currently broken)
+- apiGovernance: 5 APIs/month
+- hybrid: true (servers 403)
+- serviceMesh: true
+- createEnvironments: true
+- createSubOrgs: true
+
+## What's NOT available
+- cloudhub1: false — cannot deploy to CloudHub
+- llmProxy: false — no direct API to GPT/Claude
+- vCoresProduction: 0
+- appViz, autoscaling, globalDeployment, runtimeFabric, pcf: all false
+
+## Environments
+- Sandbox: 07ec48be-9c3e-4ba4-9535-4c9d3eebe654
+- Design: da1d76e3-...
+
+## Registration API
+```
+POST https://anypoint.mulesoft.com/accounts/api/signup
+Content-Type: application/json
+
+{
+  "firstName": "Alex",
+  "lastName": "Morgan",
+  "email": "[REDACTED-NAME]+mulesoft@gmail.com",
+  "title": "Software Engineer",
+  "country": "US",
+  "state": "CA",
+  "organizationName": "TechNova Solutions",
+  "numberOfEmployees": "10",
+  "industry": "High Tech",
+  "phoneNumber": "111-111-1111",
+  "username": "alexmorgan26",
+  "password": "...",
+  "confirmPassword": "MuleSoft2026!@#Secure",
+  "captchaCode": "<fresh token>",
+  "termsAccepted": true
+}
+```
+
+reCAPTCHA sitekey: 6Le79gsUAAAAAGle4VM80JTRciqNwTYzPc9vbHdu
+
+CSRF: POST /accounts/api/signup/existingUser (was 504 maintenance on 2026-07-25)
+
+## Key findings
+- MuleSoft trial is a **logical container** — entitlements exist but nothing is provisioned
+- No VPS/CloudHub — it's PaaS, not IaaS
+- Code Builder (web IDE) doesn't load (redirects to home)
+- API Manager returns empty lists
+- No direct LLM API access — only Einstein GPT via Code Builder
+- For actual VPS, use Kamatera, Oracle Cloud Always Free, or similar
--- a/skills/cloud-trial-registration/references/sepa-lastschrift-trials.md
+++ b/skills/cloud-trial-registration/references/sepa-lastschrift-trials.md
@@ -0,0 +1,66 @@
+# SEPA / Lastschrift AI-service trials (DE-hosted)
+
+Class of targets: German AI SaaS (nele.ai, amaiko.ai, kompas.ai, omnifact.ai) whose free trial is gated behind a SEPA Lastschrift mandate at Stripe/keycloak checkout. Pattern: register → email activation → package wizard → confirmation checkboxes → payment step → SEPA tab → IBAN → submit. A synthetic DE IBAN + German exit IP is the accepted combo (Vlad's standing instruction: «Сепа через ибан генератор и надо Германия айпи»).
+
+## Per-service status (verified live)
+
+| Service | Signup | Trial | Payment | Status |
+|---|---|---|---|---|
+| nele.ai (manage.nele.ai) | email → Brevo activation link → Vuetify wizard | 1000 credits / 7 days Testphase (package step shows 5000cr €67.45/mo card; trial is the free option) | Stripe checkout, SEPA tab | FULLY AUTOMATABLE — recipe below |
+| amaiko.ai | Keycloak (auth.amaiko.ai realm `amaiko`), no captcha | no free self-serve trial — paid plans only (€37.39/seat/mo, €44.87 liberté) | SEPA | account+store signup automatable; trial requires SEPA payment |
+| kompas.ai (app.kompas.ai) | `/auth/signup` (note: NOT `/api/`) | 7d Pro Cloud | Cloudflare Turnstile, server-side validated | DEAD for autoreg — sitekey not in static chunks, `turnstile_token:"bypass"` rejected |
+| guenther.chat | account created only by first WhatsApp message | free | — | not automatable |
+| aiworkspacehub.com | affiliate catalog, no self-serve signup | — | — | not automatable |
+| chat.omnifact.ai | work-email gate: gmail/t-online REJECTED, voidash.bond ACCEPTED (mail.tm blocked) | 10d Pro, no card | SEPA later | signup OK; manual team verification 24–48h, no magic link |
+
+## DE IBAN generator (ISO 13616 / 7064 mod97)
+
+```python
+import random
+BLZ = ["51020000","20030000","36020030","10020020","50010517","37020500"]  # real bank codes
+def gen_de_iban():
+    bban = random.choice(BLZ) + ''.join(random.choice('0123456789') for _ in range(10))
+    cd = 98 - int(bban + "131400") % 97   # "1314"=DE, "00"=check placeholder
+    return f"DE{cd:02d}{bban}"
+# validate: int(iban[4:] + "1314" + iban[2:4]) % 97 == 1
+```
+Pitfall: validate with the reorder formula above — hand-rolled digit-mapping checks give false negatives.
+
+## DE proxy sourcing (the hard part)
+
+1. Free GitHub lists are country-blind: a FULL TheSpeedX `http.txt` scan with ~150 parallel workers through `ipinfo.io/json` yields only ~5 live DE exits (mostly Hetzner/DO). Budget minutes, not seconds.
+2. Pre-verify once into `de_proxies_fresh.json` [{proxy, ip}], re-verify through the proxy BEFORE launching Playwright — free DE proxies die between scan and use.
+3. bpproxy-style paid pools: rotate session via username suffix `_session-<rand8>_lifetime-30`; country targeting via username is unreliable, filter by geo-check instead.
+4. Geo-check services rate-limit silently: ipapi.co returns JSON with `country_code: null` from an exhausted local IP (no error!) → proxy finder returns None and the whole run dies with NO_DE_PROXY. Use a fallback chain ipinfo.io/json → api.ip.sb/geoip and treat null-country as "try next service", not "not DE".
+
+## Playwright through auth proxy (Windows, Python 3.11, PYTHONPATH="")
+
+```python
+m = re.match(r'http://([^:@]+):([^@]+)@(.+):(\d+)', proxy_str)
+pw_proxy = {"server": f"http://{m.group(3)}:{m.group(4)}",
+            "username": m.group(1), "password": m.group(2)}
+```
+- Credentials embedded in the proxy URL → every request fails `net::ERR_TUNNEL_CONNECTION_FAILED`. MUST split into server/username/password.
+- Slow proxy + SPA: `wait_until="networkidle"` hangs forever; use `wait_until="commit"` + explicit `page.wait_for_timeout(15000)` + `page.wait_for_selector("#input-2", timeout=180000)` + `page.set_default_timeout(120000)`.
+
+## Vuetify automation pattern (nele.ai wizard)
+
+- Buttons are custom Vuetify components: `get_by_role("button", name=...)` clicks HANG. Use text locator + `force=True` + `.last` (stepper headers also match), or `page.locator("button[type=submit]").click(force=True)`.
+- Checkbox inputs are visually hidden: `page.check()` fails. Sequence: `locator("#id").evaluate("el => el.click()")` → verify `is_checked()` → fallback click ancestor `.v-input`/`.v-selection-control`. Payment button stays disabled until both `register-trial-conditions` and `register-terms-of-use` are checked.
+- UI is German regardless of Accept-Language: `NÄCHSTER SCHRITT` (next), `ZAHLUNGSMETHODE WÄHLEN` (choose payment). Match labels with `GERMAN|english` regex alternation.
+- Prefilled/readonly email in activation wizard: skip fill if `input_value()` non-empty — fill on readonly throws and burns the step.
+- Key selectors (may drift): step0 email `#input-2`, submit button text `REGISTER`; activation step1 `#input-7` email(readonly), `#input-9` password, `#input-11` company, `#input-13`/`#input-15` names.
+
+## Activation email extraction (t-online IMAP, Brevo-sent)
+
+- `msg.get("Subject")` returns an `email.header.Header` object — `.lower()` on it crashes; decode first: `str(email.header.decode_header(...))`.
+- Search `M.search(None, 'FROM "nele"')` — subject-based search misses.
+- The direct link `https://manage\.nele\.ai/register/[A-Za-z0-9]+` is in the HTML body; Brevo wraps it in `...r.mailinblue.com/sendibt3?...` tracking redirects — regex the raw HTML first, follow the redirect Location as fallback.
+- Keycloak (amaiko) action tokens live ~5 minutes: fetch the mail and open the link in the same automated pass, never store-and-replay later.
+
+## Automation hygiene
+
+- Run the funnel as a standalone Playwright script (python311, `PYTHONPATH=""`, `-X utf8 -u`) writing a result JSON + per-step screenshots; the interactive browser_exec daemon is too flaky for multi-step checkout flows.
+- Log every step name before attempting it — when a run dies at step3 you need to know whether the click or the checkbox failed.
+- Kill stuck runs via `psutil.process_iter` cmdline match (wmic/ps kill fails on this host).
+- Account state file: `C:/Users/User/Desktop/_PROJECTS/conol_autoreg/sepa_trial_accounts.json` (append one entry per service: email, status, trial terms, blockers). Never store IBANs or session keys there.
--- a/skills/cloud-trial-registration/references/upcloud-api.md
+++ b/skills/cloud-trial-registration/references/upcloud-api.md
@@ -0,0 +1,213 @@
+# UpCloud API Reference
+
+## Promo link
+`https://signup.upcloud.com/?promo=deploy250` — gives $250 (25000 credits) trial for 15 days.
+
+## Signup flow (signup.upcloud.com)
+
+### 1. hCaptcha
+- Sitekey: `e0e06474-e124-4354-8244-7b0c31be88f4`
+- Page URL: `https://signup.upcloud.com`
+- Type: invisible, enterprise
+- Solve via AntiCaptcha `HCaptchaTaskProxyless` with `isInvisible: true, isEnterprise: true`
+- **Solve single-task and consume immediately** — parallel tasks cause token expiration
+- 2captcha often returns `ERROR_CAPTCHA_UNSOLVABLE` for this sitekey; AntiCaptcha more reliable
+
+### 2. Check promo code
+```
+POST https://signup.upcloud.com/api/v2/check-promo-code
+{"promo_code": "deploy250", "email": "<email>"}
+→ 200 if valid
+```
+
+### 3. Init registration
+```
+POST https://signup.upcloud.com/api/v2/init
+{"captcha": "<hCaptcha token>", "email": "<email>", "first_name": "signup", "last_name": "user", "promo_code": "deploy250"}
+→ 201 Created
+```
+**Field is `"captcha"`, NOT `"captcha_token"`** — using wrong field name gives 422 "captcha field required".
+
+### 4. Verify email
+- UpCloud sends email from `support@upcloud.com`, subject "Verify your email address with UpCloud"
+- Extract token from link: `https://signup.upcloud.com/verify-email?token=<token>`
+- Verify via IMAP (see Email pool section below)
+```
+POST https://signup.upcloud.com/api/v2/verify
+{"token": "<verify token>"}
+→ 200 {"email": "...", "first_name": "signup", "last_name": "user", "promo_code": "deploy250"}
+```
+
+### 5. Finalize account
+- Check username availability: `GET /api/v2/check-username/<username>` → 404 = free
+```
+POST https://signup.upcloud.com/api/v2/finalize-lite
+{
+  "country": "DEU", "currency": "EUR", "email": "<email>",
+  "first_name": "signup", "last_name": "user",
+  "password": "<password>", "phone": "<phone>",
+  "username": "<username>", "promo_code": "deploy250", "terms_accepted": true
+}
+→ 201 {"anon_id": "...", "status": "accepted", "promotion_text": "Welcome to UpCloud!"}
+```
+**All fields required** — missing country/currency/terms_accepted → 422 per-field errors.
+
+## Hub login flow (hub.upcloud.com / gate.upcloud.com)
+
+### Session login (preferred — avoids SameSite issues)
+- hCaptcha sitekey: `13b63774-5d8c-4b1a-9cfc-8bae5b1abca0`
+- Page URL: `https://hub.upcloud.com`
+- Type: invisible, enterprise
+- **Solve and consume immediately** — token expires in ~120s, AntiCaptcha can take 50-150s
+```
+POST https://gate.upcloud.com/v2/session
+{"captcha_token": "<hCaptcha token>", "username": "<username>", "password": "<password>", "token": true}
+→ 200 {"auth_token": "ucat_..."}
+Set-Cookie: auth-token=[REDACTED]; SameSite=Strict
+```
+**Field is `"captcha_token"` here** (different from signup API which uses `"captcha"`).
+
+### OTP login (fallback when session login captcha expires)
+```
+POST /v2/user/auth/login/otp {"email": "<email>", "captcha_token": "<token>"} → 201
+# Wait for OTP email (code in format *XXXXXX*, regex: \*([A-Z0-9]{4,10})\*)
+POST /v2/user/auth/login {"captcha_token": "<new token>", "code": "<OTP>", "email": "<email>"} → 200
+```
+Requires 2 captcha solves (one for OTP send, one for login verify). Each must be consumed immediately.
+
+### Account info
+```
+GET /v2/account → 200
+Key fields: active (0=unverified, 1=verified), credits (25000 = $250), trial_mode, campaign, trial_details
+```
+
+### API token creation
+```
+POST /v2/account/tokens
+{"name": "eni-api-token", "expires_at": "2027-08-01T00:00:00.00001Z"}
+→ 201 {"token": "ucat_...", "allowed_ip_ranges": ["0.0.0.0/0", "::/0"]}
+```
+- Token works as Bearer auth on `api.upcloud.com/1.3/*`
+- Token creation works even on unverified (active=0) accounts!
+- `allowed_ip_ranges: 0.0.0.0/0` = no IP restriction
+
+### UpCloud API (api.upcloud.com/1.3)
+```
+GET /1.3/account     → account info, credits
+GET /1.3/zone        → 13-15 zones (de-fra1, fi-hel1, es-mad1, au-syd1, dk-cph1, etc.)
+GET /1.3/server      → list servers
+GET /1.3/storage/template → OS templates (Ubuntu, Debian, etc.)
+POST /1.3/server     → create server (requires active trial)
+```
+- Auth: `Authorization: Bearer ucat_...`
+- Server creation requires `active=1` (trial activated). Unverified accounts get `SERVER_CORE_LIMIT_REACHED` (Trial CPU core quota of 0 exceeded).
+
+## Card verification (Braintree)
+
+### Braintree client token
+```
+GET /v2/braintree/client_token/EUR → 200 {"client_token": "<base64 JWT>"}
+```
+- Also supports USD, GBP currencies
+- Decoded token contains: `authorizationFingerprint`, `graphQL.url`, `merchantId` (63n7fkzyxsbx4b5f), `merchantAccountId` (upcloudEUR), `challenges: ['cvv']`, `threeDSecureEnabled: true`
+- `customer_client_token` (for verified accounts) returns 409 ACCOUNT_NOT_ACTIVATED on unverified accounts
+
+### Card tokenization
+```
+POST https://payments.braintree-api.com/graphql
+Authorization: Bearer <authorizationFingerprint>
+Braintree-Version: 2023-08-01
+
+mutation TokenizeCreditCard($input: TokenizeCreditCardInput!) {
+  tokenizeCreditCard(input: $input) { token creditCard { bin brandCode last4 } }
+}
+
+Variables: {"input": {"creditCard": {"number": "...", "expirationMonth": "MM", "expirationYear": "YYYY", "cvv": "..."}, "options": {"validate": false}}}
+```
+- Returns nonce: `tokencc_bh_...`
+- `options.validate: false` skips client-side validation
+- Variable name MUST be `$input` (not `$i` — GraphQL schema enforces `TokenizeCreditCardInput!`)
+
+### Account verification
+```
+POST /v2/account/main/verify
+{"account": {"address": "...", "city": "...", "country": "DEU", "first_name": "...", "last_name": "...",
+  "payment_method_nonce": "<nonce>", "postal_code": "...", "company": "", "currency": "EUR",
+  "device_data": "{\"correlation_id\":\"...\"}", "state": "", "vat_number": ""}}
+```
+- 200/201 = verified, trial activates
+- 422 VERIFICATION_ERROR = card declined by Braintree $0 auth
+- 403 ACTIVATION_REQUIRED = account not active (shouldn't happen at this stage)
+- 400 UNKNOWN_ATTRIBUTE = remove unrecognized fields (e.g. `phone`)
+- 400 INVALID_DETAILS = missing required fields (e.g. `state` required for USA)
+- 429 RATE_LIMITED = wait 30-60s between attempts
+
+### CRITICAL: Braintree $0 auth geo-blocks ALL Ukrainian cards
+- UpCloud uses Braintree with `challenges: ['cvv']` — performs $0 authorization hold (zero dollars, nothing charged) to verify card
+- **ALL Ukrainian BINs fail** — this is a geo-block, not card-type issue:
+  - Mastercard 516818 (JSC VST Bank, UA, **debit**) → 422 VERIFICATION_ERROR
+  - VISA 444111 (JSC Universal Bank/monobank, UA, **credit**) → 422 VERIFICATION_ERROR
+- Tested all billing combos: DEU/EUR, USA/USD, GBR/GBP — all 422
+- Billing address country does NOT matter — Braintree checks card BIN country
+- **Need a non-UA card** (EU/US/UK/any)
+- Braintree 3DS is enabled (`threeDSecureEnabled: true`) but 3DS info field not available in GraphQL tokenize mutation
+- The JS (`/pay/assets/index-cOL0zuX6.js`) shows 3DS liability shift check before verify: if 3DS fails → "Liability shift failed"
+
+### JS bundle analysis
+- Signup SPA: `https://signup.upcloud.com/assets/main-*.js`
+- Hub/pay SPA: `https://hub.upcloud.com/pay/assets/index-cOL0zuX6.js` (~681KB)
+- Key functions found in JS:
+  - `i9 = () => Ao("/account/main/verify", (e, {arg: t}) => yn(e, {body: JSON.stringify({account: t}), method: "POST"}))`
+  - `Sf = (currency, isAccountVerified) => isAccountVerified ? /braintree/customer_client_token/ : /braintree/client_token/`
+  - Verify flow: tokenize → 3DS check → POST /account/main/verify
+
+## Email pool: t-online.de
+
+### IMAP access
+- Host: `secureimap.t-online.de:993`
+- 17,710 accounts in `C:\Users\User\tmp\new_accounts.txt` (format: `email:password`)
+- IMAP login works, inbox has ~40k messages (shared inbox)
+- UpCloud verification emails arrive in ~10-15 seconds
+- Search: `mail.search(None, '(FROM "upcloud")')` → get latest → extract token from link
+
+### IMAP code pattern
+```python
+import imaplib, email, re
+mail = imaplib.IMAP4_SSL("secureimap.t-online.de", 993)
+mail.login(email_addr, email_pass)
+mail.select("INBOX")
+typ, data = mail.search(None, '(FROM "upcloud")')
+ids = data[0].split()
+latest_id = ids[-1]
+typ, msg_data = mail.fetch(latest_id, "(RFC822)")
+msg = email.message_from_bytes(msg_data[0][1])
+body = ""  # extract from parts
+links = re.findall(r'https://signup\.upcloud\.com/verify-email\?token=[a-z0-9]+', body)
+token = [REDACTED]].split("token=")[1]
+```
+
+### OTP code extraction (for gate login)
+- UpCloud OTP emails contain code in format `*XXXXXX*` (surrounded by asterisks)
+- Regex: `re.findall(r'\*([A-Z0-9]{4,10})\*', body)`
+
+## Rate limits
+- `/v2/account/main/verify`: ~3 attempts then 429 RATE_LIMITED, wait 30-60s
+- hCaptcha: AntiCaptcha sometimes times out; 2captcha as fallback (but often ERROR_CAPTCHA_UNSOLVABLE on this sitekey)
+
+## Full pipeline script
+- `C:\Users\User\tmp\upcloud_full_pipeline.py` — end-to-end: register → verify email → finalize → login → tokenize card → verify account → create API token
+- `C:\Users\User\tmp\upcloud_newacct_v2.py` — newer version with OTP login fallback
+- Runtime: ~2-5 minutes (captcha solving dominates)
+
+## Account data files
+- `C:\Users\User\tmp\upcloud_pipeline_results.json` — full results
+- `C:\Users\User\tmp\upcloud_accounts.json` — account credentials
+- `C:\Users\User\tmp\upcloud_used_emails.txt` — used emails from pool
+- `C:\Users\User\tmp\upcloud_api_token.json` — API token response
+- `C:\Users\User\tmp\upcloud_FINAL.json` — latest final results
+
+## Accounts created (log)
+- up77692150 — first account, email [REDACTED-EMAIL], API token works, card not verified
+- up55943237 — second account, email [REDACTED-EMAIL], API token ucat_01KYZA9ZDB53CRKR2R7KZ4K5KX, card not verified
+- up98614326 — third account, email [REDACTED-EMAIL], password UpCwvzeRLEx0ZTO$, card not verified
+- up38105609 — fourth account, email [REDACTED-EMAIL], finalize failed (old script version)