# Sources

★ = directly verified during this audit (Oct 12, 2026). Unmarked items are community context, not re-verified.

## Comuline (the audited project)

- ★ `https://comuline.com` — web app ("Cari & Simpan Jadwal KRL 2024"). Vite SPA on Cloudflare; analytics via `analytics.zulio.me`.
- ★ `https://api.comuline.com` — public API (no auth). Docs at `/docs` (Scalar), OpenAPI spec at `/openapi`. Endpoints: `/v1/station`, `/v1/station/{id}`, `/v1/schedule/{station_id}`, `/v1/route/{train_id}`, `/status`.
- ★ Source repos: `github.com/comuline/web` (Vite/React; openapi-fetch + swr-openapi; i18n default `id`), `github.com/comuline/api` (Hono + Bun; Drizzle + Neon Postgres + Upstash Redis; sync scripts under `src/sync/`), plus `android` (Kotlin) and `ios` (Swift).
- ★ Author: Abiel Zulio M — `github.com/abielzulio`; prior project `abielzulio/jadwal-krl`.
- ★ Repo activity: `api` last push 2025-03-30 (116★), `web` 2025-04-03 (95★), `android` 2025-08-22, `ios` 2024-09-02. None archived; all dormant on the data side.

## Upstream (official KAI Commuter)

- ★ `https://api-partner.krl.co.id/krl-webs/v1` — official partner API of KRL (krl.co.id = KAI Commuter domain). Endpoints used by comuline's sync: `GET /krl-station`, `GET /schedule?stationid={id}&timefrom=00:00&timeto=23:00`.
  - Auth: Bearer JWT. A long-lived token is hardcoded in the public repo (`comuline/api/src/sync/headers.ts`); its value is [REDACTED] here and was not used in this audit. Unauthenticated probe returned HTTP 404.
  - Sync also sends browser-like headers and does a CORS `OPTIONS` preflight before each GET.
- Context: KRL (Commuter Line) is operated by PT Kereta Commuter Indonesia (KAI Commuter), subsidiary of PT KAI. "Daop" = KAI operational region (daop 1 = Jakarta, daop 2 = Bandung, daop 6 = Yogyakarta).

## Related ecosystem (community, for context)

- `github.com/vyonizr/tarif-krl` — KRL fare calculator "based on the official APIs: `api-partner.krl.co.id` and `jakartamrt.co.id`" — independent confirmation that the partner API is the de-facto official source.
- `github.com/Fannandya/api-krl` — KRL network-data SaaS (registration, API keys, daily quotas; curated reference data).
- Live-ish KRL trackers (different approach, NOT audited): `trackmycommuter.com`, `krljakarta.com` ("updates every 30 seconds"), `botkita.com/krl-tracker`.