# NIKKE Lab Account Service Version 0.2.0-beta.6 — NIKKE Lab's official import method, currently in beta. Independent account capture: shared official profile → complete build preview → sanitized NIKKE Lab import. This implementation uses official public JSON resources and our own arithmetic port; it does not call DrMkdaddy's API. ## Hosted browser calculation Online import retrieves bounded shared-account inputs on the server, then downloads public game tables and calculates stats in your browser. Review the sanitized result before applying it; capture and calculation do not automatically save or cloud sync the result. Current availability is shown by the website's importer. The local helper described below remains a separate capture option. The hosted architecture keeps account capture and the existing Enikk scheduled refresh in the same SQLite AccountCaptureDurableObject instance, account-capture-v1, while the ordinary Worker forwards work and browser stat calculation stays on the client. Scheduled refresh uses private binding RPC independently of import pause; overlapping refresh deliveries share one in-flight operation. This preserves the existing refresh algorithm without an extra object, public maintenance route, binding, migration or custom CPU allowance. Application and shared platform quotas still apply. On October 17, 2026, the initial production deployment ecbb67ac-04d1-4bb1-a0da-e2799d9fdefe from source 290ec4752c5ca2335a0d2a514e9fd279a32c8df3 passed provider checks and all 17 production smoke checks. A real LIVE public-UI import observed 145 roster units and reached a validated preview with four squad slots reviewed and both apply controls enabled; nothing was applied, saved or cloud synced. Capture traces measured 1 ms forwarding Worker CPU and 62 ms Durable Object CPU. That deployment's separate scheduled refresh completed with an unchanged catalog but used 16 ms CPU, exceeding the ordinary Worker's 10 ms Free limit; the [original failed budget receipt](../../../../../../outputs/account-import-activation-20261017/production-schedule.json) is preserved. These are dated initial-deployment observations. Release-specific follow-up status and measurements belong to the [internal validation record](../../docs/account-hybrid-free-tier-validation.md). The no-download flow moves public game-data reads and stat calculation into a browser worker, with a bounded server context endpoint and free-tier request/database guards. Before deployment, the isolated release passed the normal hosted build, package verification, TypeScript, 362 importer tests and synthetic browser checks; its activation guard passed seven configuration tests. Renewed-session guest-stage capture passed for 145 real units at LIVE, level 400 and level 40, plus four units in OL-only mode. That stage used real production D1 and official hosted authentication, not a Discord-authenticated site session. Separate captured-context browser checks prepared complete v3 results without saving or applying; complete network-body measurement used the disclosed harness-only worker lifecycle hold. Those historical measurements are distinct from the later production UI and CPU checks. Production evidence in the active workspace: [provider settings](../../../../../../outputs/account-import-activation-20261017/provider-deployed.json), [smoke checks](../../../../../../outputs/account-import-activation-20261017/production-smoke-receipt.json), [public UI](../../../../../../outputs/account-import-activation-20261017/production-ui-receipt.json) and [CPU traces](../../../../../../outputs/account-import-activation-20261017/production-capture-cpu.json). See [implementation and validation boundaries](../../docs/account-import-free-tier.md). The earlier beta notes below describe the existing local service and historical hosting state. ## Current validation status Account capture on Mac has been confirmed. Automated calculation, transport, session, and real-importer tests pass. All 200 current official character identities resolve. A full live comparison of calculated stats with the rendered official calculator remains pending. Account Service is now NIKKE Lab's default importer; no browser extension is required. ## Mac setup Online import is available through NIKKE Lab when its hosted connection is ready. Ordinary users sign into NIKKE Lab, paste a publicly shared profile, and review its builds directly; no local software or JSON download is needed. Both My Nikkes and Outpost/Recycling Room must be visible to everyone. The instructions below remain available for local capture and administrator connection setup. When updating from an earlier beta, stop its launcher with Control+C before opening the new download. The separate sign-in profile is retained in the same local application-data folder. 1. Install Google Chrome in Applications if it is not already installed. 2. Unzip the download, then open start-mac.command. The launcher uses an existing Node.js 22+ installation, or downloads the pinned official runtime into your user cache and verifies its SHA256 before running it. It does not use sudo or modify system installations. 3. If macOS does not open the launcher directly, open Terminal, type `bash ` (including the space), drag start-mac.command into Terminal, and press Return. 4. The local capture page opens automatically. Select Open dedicated sign-in and authenticate your alternate account directly on BlablaLink. Return after ShiftyPad opens. 5. Paste the desired official profile link or long ShiftyPad account ID. Choose Live, Solo Raid level 400, or Custom level 1–1000, then Capture roster. 6. Only complete captures offer a download. In NIKKE Lab, choose Import, then Import captured JSON, and review the proposed changes before applying them. Save the snapshot to the Library for later team changes. For Co-op local capture, choose Custom level 40 and enter the character codes shown in the Co-op workspace. Leave codes blank only when you need the complete owned roster. Import each player's JSON in the Co-op workspace. Unowned composition units stay unavailable; you do not need every player to own every unit. Keep the launcher's Terminal window open while capturing; press Control+C to stop. The service uses its own available loopback port. The page is local to the Mac running it and is not a publicly hosted account API. ## Access troubleshooting Beta 6 recognizes Diffusion Cube (official item 1000317). Previously, an equipped Diffusion Cube could block an otherwise complete roster capture. Co-op online import requests only the currently selected units; reload an older Co-op tab if it still offers a full-roster import. Beta 5 adds administrator-only provisioning for hosted imports. It also bounds public resource concurrency and calculation caches for large rosters. Beta 4's request pacing and corrected profile lookup remain in place. Beta 4 handles BlablaLink's "Operation too fast" replies (official codes 212000 and 212001). Equipment requests use sequential batches of 30, matching the official bulk roster view. The service spaces game requests and automatically retries temporary throttling at most twice, honoring any longer Retry-After instruction. A long or persistent cooldown stops capture with a clear message instead of retrying indefinitely. Closing the connection cancels waiting requests. Beta 3 corrects the profile-lookup route to the one used by the current official site. This fixes an outdated request that could fail with official code 220000 before the roster was requested, even when the roster opened in Chrome. The fix is verified against the official request definition and automated regression tests; an authenticated capture on your Mac still needs a retry. The service matches the official site's common platform/language headers and distinguishes confirmed permission refusal (official code 1301002) from other access refusals such as 220000. The message identifies whether profile lookup, My Nikkes, character details, or Outpost/Recycling Room access failed. A profile lookup alone does not label the connection verified. In the separate Chrome window opened by the service, open the same target profile and confirm its roster is visible. Finish any sign-in or official privacy-consent prompts yourself. Account sharing settings and sign-in consent are different checks. If the request still fails, expand Support details under the error and share that short diagnostic line. It contains only the service version, failed step, error code, HTTP status, and official response code; no account IDs, cookies, tokens, or upstream response text. ## Windows / source setup Requires Node.js 22+ and Google Chrome. From services/account-service run `pnpm install --frozen-lockfile`, then `node server.mjs`. Packaged downloads already include the pinned browser dependency. The default local address is http://127.0.0.1:5199. NIKKE_ACCOUNT_SERVICE_PORT changes the port. ## What is implemented - Official profile resolution, scoped roster/details and outpost retrieval. Details use sequential batches of 30. One shared request queue spaces calls by at least one second; temporary throttling has bounded backoff. Hidden/unavailable data fails closed. - Current public character, weapon, equipment, bond, recycling, cube and Favorite Item resources. Downloaded JavaScript is inspected as text only to validate the reviewed resource convention; only JSON is parsed as data. - LIVE and requested-level primary stats with the official order of rounding, grade/core normalization, manufacturer gear bonuses, bond and recycling effects. Calculations retain separate provenance and a baseline; they do not claim to be browser-rendered captures. - Exact official OL fractions from state_effects, including 5.71% CR. These override the rounded lookup table during import. Raw Favorite Item phase 1 remains displayed Phase 2. - Complete sanitized v3 exports accepted by NIKKE Lab's checksum/storage/import pipeline. Missing investments, metadata, exact OL values, account context, or requested units prevent an import-ready result. - Session-isolated browser authentication, strict loopback Host/Origin checks, bounded requests, sanitized errors, stable local pseudonymous fingerprints, and 15-minute in-memory result caching. Refresh bypasses cache; changing the connection invalidates pending and cached captures. ## Data and sign-in Sign-in uses a separate persistent Chrome profile owned by this service. It does not attach to your normal Chrome profile. Passwords and session tokens never appear in the capture page, downloaded build file, or normal logs. Local settings and the service browser profile live under: - macOS: ~/Library/Application Support/NIKKELabAccountService - Windows: %LOCALAPPDATA%/NIKKELabAccountService The fingerprint key is stable across launches on one installation. Different installations produce different pseudonymous fingerprints. Raw account routing stays transient inside the service; build results remain in memory until expiration/close unless you download them. Closing the connection closes its browser; it does not erase the persistent login profile. Sign out on BlablaLink in that dedicated browser to revoke its login. Advanced operators may set NIKKE_SHIFTYPAD_SESSION_COOKIE as a runtime secret instead of interactive sign-in. That selects server-managed authentication and disables the browser sign-in controls. Never paste this value into chat or save it in source control. NIKKE_ACCOUNT_SERVICE_DATA_DIR overrides local storage for isolated operator setups. ## API and development GET /health returns service version and current connection state. POST /session/open and /session/close accept an empty JSON object. POST /v1/account-builds accepts only profile, optional nameCodes, statProfile, and refresh. No caller-supplied stats, credentials, executable callbacks, or arbitrary upstream URL are accepted. Complete results contain simulationReady:true and export.schema=nikke.shiftypad.sanitized.v3. Incomplete results contain simulationReady:false, explicit issues, and no export. Account captures are atomic: missing requested units cannot silently become a complete subset. From the repository root: `node --test services/account-service/*.test.mjs tests/shiftypad-import.test.mjs`. ## Before production hosting The website uses a separate authenticated Worker API with encrypted session storage, single-use provisioning codes, a global D1 capture lease, request quotas, and anonymous public-sharing checks before and after capture. Local server endpoints are not exposed on the internet. The hosted capture engine uses the same calculations and JSON validation as local capture. Live hosted access and resource behavior must be validated using an authorized profile before opening the pilot to all users. Formula comparison against live ShiftyPad remains pending. ## Administrator: connect hosted importing Only the administrator needs this step. Open https://nikkelab.com/account-service/admin and sign in with the approved Discord account. Generate a connection code. In this local helper, open the dedicated alt sign-in and complete official prompts, then expand "NIKKE Lab administrator: connect hosted importing". Paste the code, confirm using this alt, and choose Connect hosted service. The helper sends cookies applicable to the official API from its own dedicated profile directly to the fixed NIKKE Lab HTTPS endpoint. They never enter the local page, clipboard, chat, normal logs or exports. NIKKE Lab stores them encrypted with a seven-day expiry and accepts official cookie refreshes within that period. Expiry prevents further use; the encrypted session is removed on the next connection check. The code lasts five minutes and works once. Renew through the same flow when the connection expires. Disconnect hosted service in administrator setup removes the encrypted connection and invalidates ongoing imports; closing the local helper alone does not revoke hosted access. After connecting, refresh administrator status and import an authorized public profile through the simulator. Ordinary users never need the helper. Local account captures remain local unless you export/import them, or explicitly choose this administrator session transfer.