station-kit 1.0.8 → 1.1.0

package/dist/server/auth/keys.js

@@ -1,12 +1,152 @@
 import crypto from "node:crypto";
-import Database from "better-sqlite3";
-export class KeyStore {
+import { closeSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, renameSync, writeSync, } from "node:fs";
+import { createRequire } from "node:module";
+import { dirname } from "node:path";
+/**
+ * Default ApiKeyStorageAdapter backed by a JSON file. Used by the Station
+ * server when no `keyStorage` is configured. Has no native dependencies —
+ * works on any Node 18+ install without compiling bindings.
+ *
+ * Crash-safety: writes go through a fsync'd tmp-file + rename, with a
+ * second fsync on the parent directory so the rename itself survives
+ * power loss. The keys file is created with `0o600` and the parent dir
+ * with `0o700` so a default umask doesn't expose key metadata.
+ *
+ * Single-process only: do not point two `createStation` instances at
+ * the same file or last-rename-wins will silently clobber writes. For
+ * multi-process or high-volume deployments, implement
+ * `ApiKeyStorageAdapter` against Postgres / MySQL / Redis.
+ */
+export class FileKeyStorage {
+    filePath;
+    records = new Map();
+    constructor(options) {
+        this.filePath = options.filePath;
+        mkdirSync(dirname(this.filePath), { recursive: true, mode: 0o700 });
+        this.load();
+    }
+    load() {
+        if (!existsSync(this.filePath))
+            return;
+        try {
+            const raw = readFileSync(this.filePath, "utf8");
+            const data = JSON.parse(raw);
+            if (Array.isArray(data)) {
+                for (const r of data)
+                    this.records.set(r.id, r);
+            }
+        }
+        catch {
+            // Corrupt or unreadable file — start fresh rather than throwing.
+        }
+    }
+    flush() {
+        const tmp = `${this.filePath}.tmp`;
+        const body = JSON.stringify(Array.from(this.records.values()), null, 2);
+        // Write tmp file with fsync so its bytes are durable before rename.
+        const fd = openSync(tmp, "w", 0o600);
+        try {
+            writeSync(fd, body);
+            fsyncSync(fd);
+        }
+        finally {
+            closeSync(fd);
+        }
+        renameSync(tmp, this.filePath);
+        // fsync the parent directory so the rename's directory entry survives
+        // a crash. Best-effort: opening a directory for fsync isn't supported
+        // on every platform (notably Windows), so swallow errors.
+        try {
+            const dirFd = openSync(dirname(this.filePath), "r");
+            try {
+                fsyncSync(dirFd);
+            }
+            finally {
+                closeSync(dirFd);
+            }
+        }
+        catch {
+            // Platform doesn't support directory fsync; rename + tmp fsync
+            // already give us most of the durability we can offer.
+        }
+    }
+    insert(record) {
+        this.records.set(record.id, { ...record });
+        this.flush();
+    }
+    findByHash(keyHash) {
+        for (const r of this.records.values()) {
+            if (r.keyHash === keyHash)
+                return { ...r };
+        }
+        return null;
+    }
+    list() {
+        return Array.from(this.records.values())
+            .sort((a, b) => b.createdAt.localeCompare(a.createdAt))
+            .map((r) => {
+            const { keyHash: _h, ...rest } = r;
+            return rest;
+        });
+    }
+    touch(id, lastUsedIso) {
+        const r = this.records.get(id);
+        if (!r)
+            return;
+        r.lastUsed = lastUsedIso;
+        this.flush();
+    }
+    revoke(id) {
+        const r = this.records.get(id);
+        if (!r)
+            return false;
+        r.revoked = true;
+        this.flush();
+        return true;
+    }
+}
+let cachedBetterSqlite3 = null;
+function loadBetterSqlite3() {
+    if (cachedBetterSqlite3)
+        return cachedBetterSqlite3;
+    try {
+        const requireFn = createRequire(import.meta.url);
+        cachedBetterSqlite3 = requireFn("better-sqlite3");
+        return cachedBetterSqlite3;
+    }
+    catch (err) {
+        const reason = err instanceof Error ? err.message : String(err);
+        throw new Error(`SqliteKeyStorage requires the optional 'better-sqlite3' package, ` +
+            `which isn't installed. Install it with:\n` +
+            `  npm install better-sqlite3\n` +
+            `Or use FileKeyStorage (default) / MemoryKeyStorage instead.\n` +
+            `Underlying error: ${reason}`);
+    }
+}
+/**
+ * Optional ApiKeyStorageAdapter backed by better-sqlite3. Requires the
+ * `better-sqlite3` package to be installed separately — Station Kit no
+ * longer ships it as a hard dependency.
+ *
+ * Prefer `FileKeyStorage` (the default) unless you specifically need
+ * sqlite features (concurrent reads from multiple processes, large
+ * key catalogs, etc.).
+ */
+export class SqliteKeyStorage {
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
     db;
-    constructor(dbPath) {
-        this.db = new Database(dbPath);
+    table;
+    constructor(options) {
+        const tableName = options.tableName ?? "api_keys";
+        if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(tableName)) {
+            throw new Error(`Invalid table name "${tableName}"`);
+        }
+        this.table = tableName;
+        const Database = loadBetterSqlite3();
+        this.db = new Database(options.dbPath);
         this.db.pragma("journal_mode = WAL");
         this.db.exec(`
-      CREATE TABLE IF NOT EXISTS api_keys (
+      CREATE TABLE IF NOT EXISTS ${this.table} (
         id          TEXT PRIMARY KEY,
         name        TEXT NOT NULL,
         key_hash    TEXT NOT NULL UNIQUE,
@@ -19,73 +159,168 @@ export class KeyStore {
       )
     `);
     }
-    /** Generate a new API key. Returns the full key (only shown once) and the stored record. */
-    create(name, scopes = ["trigger", "read"]) {
-        const id = crypto.randomUUID();
-        const rawKey = `sk_live_${crypto.randomBytes(16).toString("hex")}`;
-        const keyHash = crypto.createHash("sha256").update(rawKey).digest("hex");
-        const keyPrefix = rawKey.slice(0, 12);
-        const createdAt = new Date().toISOString();
+    insert(record) {
         this.db.prepare(`
-      INSERT INTO api_keys (id, name, key_hash, key_prefix, scopes, created_at)
-      VALUES (?, ?, ?, ?, ?, ?)
-    `).run(id, name, keyHash, keyPrefix, JSON.stringify(scopes), createdAt);
-        return {
-            key: rawKey,
-            record: { id, name, keyHash, keyPrefix, scopes, createdAt, lastUsed: null, expiresAt: null, revoked: false },
-        };
+      INSERT INTO ${this.table}
+        (id, name, key_hash, key_prefix, scopes, created_at, last_used, expires_at, revoked)
+      VALUES
+        (@id, @name, @key_hash, @key_prefix, @scopes, @created_at, @last_used, @expires_at, @revoked)
+    `).run({
+            id: record.id,
+            name: record.name,
+            key_hash: record.keyHash,
+            key_prefix: record.keyPrefix,
+            scopes: JSON.stringify(record.scopes),
+            created_at: record.createdAt,
+            last_used: record.lastUsed,
+            expires_at: record.expiresAt,
+            revoked: record.revoked ? 1 : 0,
+        });
     }
-    /** Verify an API key. Returns the key record if valid, null otherwise. */
-    verify(rawKey) {
-        const keyHash = crypto.createHash("sha256").update(rawKey).digest("hex");
-        const row = this.db.prepare(`
-      SELECT id, name, key_hash, key_prefix, scopes, created_at, last_used, expires_at, revoked
-      FROM api_keys WHERE key_hash = ?
-    `).get(keyHash);
-        if (!row)
-            return null;
-        if (row.revoked)
-            return null;
-        if (row.expires_at && new Date(row.expires_at) < new Date())
-            return null;
-        // Update last_used
-        this.db.prepare("UPDATE api_keys SET last_used = ? WHERE id = ?").run(new Date().toISOString(), row.id);
-        return {
-            id: row.id,
-            name: row.name,
-            keyHash: row.key_hash,
-            keyPrefix: row.key_prefix,
-            scopes: JSON.parse(row.scopes),
-            createdAt: row.created_at,
-            lastUsed: row.last_used,
-            expiresAt: row.expires_at,
-            revoked: Boolean(row.revoked),
-        };
+    findByHash(keyHash) {
+        const row = this.db
+            .prepare(`SELECT id, name, key_hash, key_prefix, scopes, created_at, last_used, expires_at, revoked
+                FROM ${this.table} WHERE key_hash = ?`)
+            .get(keyHash);
+        return row ? rowToApiKey(row) : null;
     }
-    /** List all keys (without hashes). */
     list() {
-        const rows = this.db.prepare(`
-      SELECT id, name, key_prefix, scopes, created_at, last_used, expires_at, revoked
-      FROM api_keys ORDER BY created_at DESC
-    `).all();
+        const rows = this.db
+            .prepare(`SELECT id, name, key_prefix, scopes, created_at, last_used, expires_at, revoked
+                FROM ${this.table} ORDER BY created_at DESC`)
+            .all();
         return rows.map((row) => ({
             id: row.id,
             name: row.name,
             keyPrefix: row.key_prefix,
             scopes: JSON.parse(row.scopes),
             createdAt: row.created_at,
-            lastUsed: row.last_used,
-            expiresAt: row.expires_at,
+            lastUsed: row.last_used ?? null,
+            expiresAt: row.expires_at ?? null,
             revoked: Boolean(row.revoked),
         }));
     }
-    /** Revoke a key by ID. */
+    touch(id, lastUsedIso) {
+        this.db.prepare(`UPDATE ${this.table} SET last_used = ? WHERE id = ?`).run(lastUsedIso, id);
+    }
     revoke(id) {
-        const result = this.db.prepare("UPDATE api_keys SET revoked = 1 WHERE id = ?").run(id);
+        const result = this.db.prepare(`UPDATE ${this.table} SET revoked = 1 WHERE id = ?`).run(id);
         return result.changes > 0;
     }
     close() {
         this.db.close();
     }
 }
+function rowToApiKey(row) {
+    return {
+        id: row.id,
+        name: row.name,
+        keyHash: row.key_hash,
+        keyPrefix: row.key_prefix,
+        scopes: JSON.parse(row.scopes),
+        createdAt: row.created_at,
+        lastUsed: row.last_used ?? null,
+        expiresAt: row.expires_at ?? null,
+        revoked: Boolean(row.revoked),
+    };
+}
+// ─── In-memory storage for tests / ephemeral deployments ────────────
+export class MemoryKeyStorage {
+    records = new Map();
+    insert(record) {
+        this.records.set(record.id, { ...record });
+    }
+    findByHash(keyHash) {
+        for (const r of this.records.values()) {
+            if (r.keyHash === keyHash)
+                return { ...r };
+        }
+        return null;
+    }
+    list() {
+        return Array.from(this.records.values())
+            .sort((a, b) => b.createdAt.localeCompare(a.createdAt))
+            .map((r) => {
+            const { keyHash: _h, ...rest } = r;
+            return rest;
+        });
+    }
+    touch(id, lastUsedIso) {
+        const r = this.records.get(id);
+        if (r)
+            r.lastUsed = lastUsedIso;
+    }
+    revoke(id) {
+        const r = this.records.get(id);
+        if (!r)
+            return false;
+        r.revoked = true;
+        return true;
+    }
+}
+// ─── KeyStore — owns crypto, delegates persistence ──────────────────
+export class KeyStore {
+    storage;
+    /**
+     * Pass an `ApiKeyStorageAdapter` for any backend. The string overload is
+     * retained for backwards compatibility — it constructs a FileKeyStorage
+     * at the given path. (Previously this returned a SqliteKeyStorage; SQLite
+     * is now opt-in to avoid native build dependencies.)
+     */
+    constructor(storageOrPath) {
+        if (typeof storageOrPath === "string") {
+            const filePath = storageOrPath.endsWith(".db")
+                ? storageOrPath.replace(/\.db$/, ".json")
+                : storageOrPath;
+            this.storage = new FileKeyStorage({ filePath });
+        }
+        else {
+            this.storage = storageOrPath;
+        }
+    }
+    /** Generate a new API key. Returns the full key (only shown once) and the stored record. */
+    async create(name, scopes = ["trigger", "read"]) {
+        const id = crypto.randomUUID();
+        const rawKey = `sk_live_${crypto.randomBytes(16).toString("hex")}`;
+        const keyHash = crypto.createHash("sha256").update(rawKey).digest("hex");
+        const keyPrefix = rawKey.slice(0, 12);
+        const createdAt = new Date().toISOString();
+        const record = {
+            id, name, keyHash, keyPrefix, scopes, createdAt,
+            lastUsed: null, expiresAt: null, revoked: false,
+        };
+        await this.storage.insert(record);
+        return { key: rawKey, record };
+    }
+    /** Verify an API key. Returns the key record if valid, null otherwise. */
+    async verify(rawKey) {
+        const keyHash = crypto.createHash("sha256").update(rawKey).digest("hex");
+        const record = await this.storage.findByHash(keyHash);
+        if (!record)
+            return null;
+        if (record.revoked)
+            return null;
+        if (record.expiresAt && new Date(record.expiresAt) < new Date())
+            return null;
+        // Touch is best-effort — don't block verification on the write. Wrap in
+        // an explicit deferred so a synchronous throw from a sync `touch()` is
+        // also swallowed, matching the async case.
+        Promise.resolve()
+            .then(() => this.storage.touch(record.id, new Date().toISOString()))
+            .catch(() => { });
+        return record;
+    }
+    /** List all keys (without hashes). */
+    async list() {
+        return this.storage.list();
+    }
+    /** Revoke a key by ID. */
+    async revoke(id) {
+        return this.storage.revoke(id);
+    }
+    async close() {
+        if (this.storage.close)
+            await this.storage.close();
+    }
+}
 //# sourceMappingURL=keys.js.map

package/dist/server/auth/keys.js.map

@@ -1 +1 @@
-{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../../src/server/auth/keys.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AActC,MAAM,OAAO,QAAQ;IACX,EAAE,CAAoB;IAE9B,YAAY,MAAc;QACxB,IAAI,CAAC,EAAE,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;QACrC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;KAYZ,CAAC,CAAC;IACL,CAAC;IAED,4FAA4F;IAC5F,MAAM,CAAC,IAAY,EAAE,SAAmB,CAAC,SAAS,EAAE,MAAM,CAAC;QACzD,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,WAAW,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACnE,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACzE,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtC,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAE3C,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;;KAGf,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,CAAC;QAExE,OAAO;YACL,GAAG,EAAE,MAAM;YACX,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE;SAC7G,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,MAAM,CAAC,MAAc;QACnB,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACzE,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;;KAG3B,CAAC,CAAC,GAAG,CAAC,OAAO,CAAwC,CAAC;QAEvD,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,IAAI,GAAG,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC7B,IAAI,GAAG,CAAC,UAAU,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,UAAoB,CAAC,GAAG,IAAI,IAAI,EAAE;YAAE,OAAO,IAAI,CAAC;QAEnF,mBAAmB;QACnB,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,gDAAgD,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QAExG,OAAO;YACL,EAAE,EAAE,GAAG,CAAC,EAAY;YACpB,IAAI,EAAE,GAAG,CAAC,IAAc;YACxB,OAAO,EAAE,GAAG,CAAC,QAAkB;YAC/B,SAAS,EAAE,GAAG,CAAC,UAAoB;YACnC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAgB,CAAC;YACxC,SAAS,EAAE,GAAG,CAAC,UAAoB;YACnC,QAAQ,EAAE,GAAG,CAAC,SAA0B;YACxC,SAAS,EAAE,GAAG,CAAC,UAA2B;YAC1C,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;SAC9B,CAAC;IACJ,CAAC;IAED,sCAAsC;IACtC,IAAI;QACF,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;;KAG5B,CAAC,CAAC,GAAG,EAA+B,CAAC;QAEtC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACxB,EAAE,EAAE,GAAG,CAAC,EAAY;YACpB,IAAI,EAAE,GAAG,CAAC,IAAc;YACxB,SAAS,EAAE,GAAG,CAAC,UAAoB;YACnC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAgB,CAAC;YACxC,SAAS,EAAE,GAAG,CAAC,UAAoB;YACnC,QAAQ,EAAE,GAAG,CAAC,SAA0B;YACxC,SAAS,EAAE,GAAG,CAAC,UAA2B;YAC1C,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;SAC9B,CAAC,CAAC,CAAC;IACN,CAAC;IAED,0BAA0B;IAC1B,MAAM,CAAC,EAAU;QACf,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,8CAA8C,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvF,OAAO,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC;IAC5B,CAAC;IAED,KAAK;QACH,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;IAClB,CAAC;CACF"}
+{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../../src/server/auth/keys.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EACL,SAAS,EACT,UAAU,EACV,SAAS,EACT,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,UAAU,EAEV,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAoCpC;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,cAAc;IACjB,QAAQ,CAAS;IACjB,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE5C,YAAY,OAA8B;QACxC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IAEO,IAAI;QACV,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO;QACvC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAChD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAa,CAAC;YACzC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxB,KAAK,MAAM,CAAC,IAAI,IAAI;oBAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;QACnE,CAAC;IACH,CAAC;IAEO,KAAK;QACX,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,MAAM,CAAC;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACxE,oEAAoE;QACpE,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QACrC,IAAI,CAAC;YACH,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACpB,SAAS,CAAC,EAAE,CAAC,CAAC;QAChB,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,EAAE,CAAC,CAAC;QAChB,CAAC;QACD,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/B,sEAAsE;QACtE,sEAAsE;QACtE,0DAA0D;QAC1D,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;YACpD,IAAI,CAAC;gBACH,SAAS,CAAC,KAAK,CAAC,CAAC;YACnB,CAAC;oBAAS,CAAC;gBACT,SAAS,CAAC,KAAK,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,+DAA+D;YAC/D,uDAAuD;QACzD,CAAC;IACH,CAAC;IAED,MAAM,CAAC,MAAc;QACnB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAED,UAAU,CAAC,OAAe;QACxB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YACtC,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO;gBAAE,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;QAC7C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI;QACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;aACrC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;aACtD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACT,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC;YACnC,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACP,CAAC;IAED,KAAK,CAAC,EAAU,EAAE,WAAmB;QACnC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC,CAAC;YAAE,OAAO;QACf,CAAC,CAAC,QAAQ,GAAG,WAAW,CAAC;QACzB,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAED,MAAM,CAAC,EAAU;QACf,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACrB,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAcD,IAAI,mBAAmB,GAA+B,IAAI,CAAC;AAE3D,SAAS,iBAAiB;IACxB,IAAI,mBAAmB;QAAE,OAAO,mBAAmB,CAAC;IACpD,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjD,mBAAmB,GAAG,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAClD,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,IAAI,KAAK,CACb,mEAAmE;YACjE,2CAA2C;YAC3C,gCAAgC;YAChC,+DAA+D;YAC/D,qBAAqB,MAAM,EAAE,CAChC,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,gBAAgB;IAC3B,8DAA8D;IACtD,EAAE,CAAM;IACR,KAAK,CAAS;IAEtB,YAAY,OAAgC;QAC1C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,UAAU,CAAC;QAClD,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,uBAAuB,SAAS,GAAG,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;QACvB,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;QACrC,IAAI,CAAC,EAAE,GAAG,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;QACrC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC;mCACkB,IAAI,CAAC,KAAK;;;;;;;;;;;KAWxC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,MAAc;QACnB,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;oBACA,IAAI,CAAC,KAAK;;;;KAIzB,CAAC,CAAC,GAAG,CAAC;YACL,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,QAAQ,EAAE,MAAM,CAAC,OAAO;YACxB,UAAU,EAAE,MAAM,CAAC,SAAS;YAC5B,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC;YACrC,UAAU,EAAE,MAAM,CAAC,SAAS;YAC5B,SAAS,EAAE,MAAM,CAAC,QAAQ;YAC1B,UAAU,EAAE,MAAM,CAAC,SAAS;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SAChC,CAAC,CAAC;IACL,CAAC;IAED,UAAU,CAAC,OAAe;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aAChB,OAAO,CAAC;uBACQ,IAAI,CAAC,KAAK,qBAAqB,CAAC;aAChD,GAAG,CAAC,OAAO,CAAwC,CAAC;QACvD,OAAO,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACvC,CAAC;IAED,IAAI;QACF,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE;aACjB,OAAO,CAAC;uBACQ,IAAI,CAAC,KAAK,2BAA2B,CAAC;aACtD,GAAG,EAA+B,CAAC;QACtC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACxB,EAAE,EAAE,GAAG,CAAC,EAAY;YACpB,IAAI,EAAE,GAAG,CAAC,IAAc;YACxB,SAAS,EAAE,GAAG,CAAC,UAAoB;YACnC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAgB,CAAC;YACxC,SAAS,EAAE,GAAG,CAAC,UAAoB;YACnC,QAAQ,EAAG,GAAG,CAAC,SAA2B,IAAI,IAAI;YAClD,SAAS,EAAG,GAAG,CAAC,UAA4B,IAAI,IAAI;YACpD,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;SAC9B,CAAC,CAAC,CAAC;IACN,CAAC;IAED,KAAK,CAAC,EAAU,EAAE,WAAmB;QACnC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,KAAK,iCAAiC,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,CAAC,EAAU;QACf,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,KAAK,+BAA+B,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5F,OAAO,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC;IAC5B,CAAC;IAED,KAAK;QACH,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;IAClB,CAAC;CACF;AAED,SAAS,WAAW,CAAC,GAA4B;IAC/C,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAY;QACpB,IAAI,EAAE,GAAG,CAAC,IAAc;QACxB,OAAO,EAAE,GAAG,CAAC,QAAkB;QAC/B,SAAS,EAAE,GAAG,CAAC,UAAoB;QACnC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAgB,CAAC;QACxC,SAAS,EAAE,GAAG,CAAC,UAAoB;QACnC,QAAQ,EAAG,GAAG,CAAC,SAA2B,IAAI,IAAI;QAClD,SAAS,EAAG,GAAG,CAAC,UAA4B,IAAI,IAAI;QACpD,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;KAC9B,CAAC;AACJ,CAAC;AAED,uEAAuE;AAEvE,MAAM,OAAO,gBAAgB;IACnB,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE5C,MAAM,CAAC,MAAc;QACnB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,UAAU,CAAC,OAAe;QACxB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YACtC,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO;gBAAE,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;QAC7C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI;QACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;aACrC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;aACtD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACT,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC;YACnC,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACP,CAAC;IAED,KAAK,CAAC,EAAU,EAAE,WAAmB;QACnC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC;YAAE,CAAC,CAAC,QAAQ,GAAG,WAAW,CAAC;IAClC,CAAC;IAED,MAAM,CAAC,EAAU;QACf,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACrB,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,uEAAuE;AAEvE,MAAM,OAAO,QAAQ;IACX,OAAO,CAAuB;IAEtC;;;;;OAKG;IACH,YAAY,aAA4C;QACtD,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;YACtC,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAC5C,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC;gBACzC,CAAC,CAAC,aAAa,CAAC;YAClB,IAAI,CAAC,OAAO,GAAG,IAAI,cAAc,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QAClD,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,OAAO,GAAG,aAAa,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,4FAA4F;IAC5F,KAAK,CAAC,MAAM,CAAC,IAAY,EAAE,SAAmB,CAAC,SAAS,EAAE,MAAM,CAAC;QAC/D,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,WAAW,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACnE,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACzE,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtC,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAE3C,MAAM,MAAM,GAAW;YACrB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS;YAC/C,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK;SAChD,CAAC;QACF,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAClC,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjC,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,MAAM,CAAC,MAAc;QACzB,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACzE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,IAAI,MAAM,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAChC,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,EAAE;YAAE,OAAO,IAAI,CAAC;QAE7E,wEAAwE;QACxE,uEAAuE;QACvE,2CAA2C;QAC3C,OAAO,CAAC,OAAO,EAAE;aACd,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;aACnE,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAEnB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,sCAAsC;IACtC,KAAK,CAAC,IAAI;QACR,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IAC7B,CAAC;IAED,0BAA0B;IAC1B,KAAK,CAAC,MAAM,CAAC,EAAU;QACrB,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK;YAAE,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACrD,CAAC;CACF"}

package/dist/server/index.d.ts

@@ -1,7 +1,10 @@
 import type { StationConfig } from "../config/schema.js";
 import { KeyStore } from "./auth/keys.js";
-export { KeyStore } from "./auth/keys.js";
-export type { ApiKey } from "./auth/keys.js";
+export { KeyStore, FileKeyStorage, SqliteKeyStorage, MemoryKeyStorage, } from "./auth/keys.js";
+export type { ApiKey, ApiKeyPublic, ApiKeyStorageAdapter, FileKeyStorageOptions, SqliteKeyStorageOptions, } from "./auth/keys.js";
+export { LogStore, FileLogStorage, MemoryLogStorage, } from "./log-store.js";
+export type { LogStorageAdapter, FileLogStorageOptions, } from "./log-store.js";
+export type { LogEntry } from "./log-buffer.js";
 export interface StationInstance {
     start(): Promise<void>;
     stop(): Promise<void>;

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAWzD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAc1C,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,YAAY,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAE7C,MAAM,WAAW,eAAe;IAC9B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,iEAAiE;IACjE,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,wCAAwC;IACxC,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,aAAa,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CA2SnH"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAWzD,OAAO,EAAE,QAAQ,EAAkB,MAAM,gBAAgB,CAAC;AAiB1D,OAAO,EACL,QAAQ,EACR,cAAc,EACd,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,MAAM,EACN,YAAY,EACZ,oBAAoB,EACpB,qBAAqB,EACrB,uBAAuB,GACxB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,QAAQ,EACR,cAAc,EACd,gBAAgB,GACjB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAEhD,MAAM,WAAW,eAAe;IAC9B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,iEAAiE;IACjE,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,wCAAwC;IACxC,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,aAAa,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAiWnH"}

package/dist/server/index.js

@@ -3,19 +3,20 @@ import { createMiddleware } from "hono/factory";
 import { serve } from "@hono/node-server";
 import { resolve } from "node:path";
 import { existsSync } from "node:fs";
-import { SignalRunner, MemoryAdapter } from "station-signal";
+import { SignalRunner, MemoryAdapter, parseInterval } from "station-signal";
 import { BroadcastRunner, BroadcastMemoryAdapter } from "station-broadcast";
+import { ScheduleReconciler, } from "station-schedules";
 import { ensureStationDir } from "../station-dir.js";
 import { WebSocketHub } from "./ws.js";
 import { SSEHub } from "./sse.js";
 import { LogBuffer } from "./log-buffer.js";
-import { LogStore } from "./log-store.js";
+import { LogStore, FileLogStorage } from "./log-store.js";
 import { StationSignalSubscriber, StationBroadcastSubscriber } from "./subscriber.js";
 import { healthRoutes } from "./routes/health.js";
 import { signalRoutes } from "./routes/signals.js";
 import { runRoutes } from "./routes/runs.js";
 import { broadcastRoutes } from "./routes/broadcasts.js";
-import { KeyStore } from "./auth/keys.js";
+import { KeyStore, FileKeyStorage } from "./auth/keys.js";
 import { verifySessionToken, verifyCredentials, createSessionToken } from "./auth/session.js";
 import { authResolver } from "./middleware/auth.js";
 import { requireScope } from "./middleware/scope-guard.js";
@@ -28,20 +29,30 @@ import { v1TriggerRoutes } from "./routes/v1/trigger.js";
 import { v1KeyRoutes } from "./routes/v1/keys.js";
 import { v1AuthRoutes } from "./routes/v1/auth.js";
 import { v1EventRoutes } from "./routes/v1/events.js";
-export { KeyStore } from "./auth/keys.js";
+import { v1DefinitionRoutes, v1DefinitionReadRoutes } from "./routes/v1/definitions.js";
+import { v1ScheduleRoutes, v1ScheduleReadRoutes } from "./routes/v1/schedules.js";
+import { v1ExpressionRoutes } from "./routes/v1/expressions.js";
+export { KeyStore, FileKeyStorage, SqliteKeyStorage, MemoryKeyStorage, } from "./auth/keys.js";
+export { LogStore, FileLogStorage, MemoryLogStorage, } from "./log-store.js";
 export async function createStation(config, cwd, nextPort) {
     const signalAdapter = config.adapter ?? new MemoryAdapter();
     const broadcastAdapter = config.broadcastAdapter ?? (config.broadcastsDir ? new BroadcastMemoryAdapter() : undefined);
     const { dataDir } = ensureStationDir(cwd, config.stationDir);
+    warnIfLegacySqliteFiles(dataDir);
     const wsHub = new WebSocketHub();
     const sseHub = new SSEHub();
     const logBuffer = new LogBuffer();
-    const logStore = new LogStore(resolve(dataDir, "station-logs.db"));
+    const logStore = new LogStore(config.logStorage ?? new FileLogStorage({
+        filePath: resolve(dataDir, "station-logs.jsonl"),
+        onError: (err) => console.error("[station] log write failed:", err),
+    }));
     // Auth: create KeyStore and SessionConfig if auth is configured
     let keyStore;
     let sessionConfig;
     if (config.auth) {
-        keyStore = new KeyStore(resolve(dataDir, "station-keys.db"));
+        const storage = config.auth.keyStorage
+            ?? new FileKeyStorage({ filePath: resolve(dataDir, "station-keys.json") });
+        keyStore = new KeyStore(storage);
         sessionConfig = {
             username: config.auth.username,
             password: config.auth.password,
@@ -68,7 +79,20 @@ export async function createStation(config, cwd, nextPort) {
     // Create runners if enabled
     let signalRunner;
     let broadcastRunner;
+    const scheduleAdapter = config.scheduleAdapter;
     if (config.runRunners) {
+        // Build schedule reconcilers up front. Each reconciler handles only the
+        // kinds it's responsible for; the runner ticks it once per loop.
+        const signalScheduleReconciler = scheduleAdapter
+            ? new ScheduleReconciler({
+                adapter: scheduleAdapter,
+                kinds: ["signal"],
+                parseInterval,
+                triggerFn: (s) => signalRunner.triggerSignal(s.target, s.input ?? {}),
+                hasPendingOrRunning: (s) => signalRunner.hasPendingOrRunningForSignal(s.target),
+                onError: (err) => console.error("[station] Signal schedule reconciler:", err),
+            })
+            : undefined;
         signalRunner = new SignalRunner({
             signalsDir,
             adapter: signalAdapter,
@@ -77,14 +101,26 @@ export async function createStation(config, cwd, nextPort) {
             maxAttempts: config.runner.maxAttempts,
             retryBackoffMs: config.runner.retryBackoffMs,
             subscribers: [stationSignalSub],
+            scheduleReconciler: signalScheduleReconciler,
         });
         if (broadcastsDir || broadcastAdapter) {
+            const broadcastScheduleReconciler = scheduleAdapter
+                ? new ScheduleReconciler({
+                    adapter: scheduleAdapter,
+                    kinds: ["broadcast-static", "broadcast-dynamic"],
+                    parseInterval,
+                    triggerFn: (s) => broadcastRunner.trigger(s.target, s.input ?? {}),
+                    hasPendingOrRunning: (s) => broadcastRunner.hasPendingOrRunningForBroadcast(s.target),
+                    onError: (err) => console.error("[station] Broadcast schedule reconciler:", err),
+                })
+                : undefined;
             broadcastRunner = new BroadcastRunner({
                 signalRunner,
                 broadcastsDir,
                 adapter: broadcastAdapter ?? new BroadcastMemoryAdapter(),
                 pollIntervalMs: config.broadcastRunner.pollIntervalMs,
                 subscribers: [stationBroadcastSub],
+                scheduleReconciler: broadcastScheduleReconciler,
             });
         }
     }
@@ -166,6 +202,15 @@ export async function createStation(config, cwd, nextPort) {
     readRoutes.route("/", v1RunRoutes({ signalRunner, signalAdapter, logBuffer, logStore }));
     readRoutes.route("/", v1BroadcastRoutes({ broadcastRunner, broadcastAdapter, broadcastSubscriber: stationBroadcastSub }));
     readRoutes.route("/", v1EventRoutes({ sseHub }));
+    readRoutes.route("/", v1ExpressionRoutes());
+    // Schedule GET + preview are read-scoped; mutating routes are mounted under admin below.
+    readRoutes.route("/", v1ScheduleReadRoutes({ scheduleAdapter }));
+    readRoutes.route("/", v1DefinitionReadRoutes({
+        broadcastRunner,
+        broadcastAdapter,
+        signalRunner,
+        signalSubscriber: stationSignalSub,
+    }));
     v1.route("/", readRoutes);
     // Trigger-scope routes
     const triggerRoutes = new Hono();
@@ -198,10 +243,17 @@ export async function createStation(config, cwd, nextPort) {
         return c.json({ data: { cancelled: true } });
     });
     v1.route("/", cancelRoutes);
-    // Admin-scope routes
+    // Admin-scope routes — destructive / mutating endpoints
     const adminRoutes = new Hono();
     adminRoutes.use("/*", requireScope("admin"));
     adminRoutes.route("/", v1KeyRoutes({ keyStore }));
+    adminRoutes.route("/", v1DefinitionRoutes({
+        broadcastRunner,
+        broadcastAdapter,
+        signalRunner,
+        signalSubscriber: stationSignalSub,
+    }));
+    adminRoutes.route("/", v1ScheduleRoutes({ scheduleAdapter }));
     v1.route("/", adminRoutes);
     app.route("/api/v1", v1);
     // ── Proxy to Next.js standalone server ──────────────────────────
@@ -283,12 +335,35 @@ export async function createStation(config, cwd, nextPort) {
             }
             wsHub.close();
             sseHub.close();
-            logStore.close();
-            keyStore?.close();
+            await logStore.close();
+            await keyStore?.close();
             if (httpServer) {
                 httpServer.close();
             }
         },
     };
 }
+// Existing deployments that ran older Station versions persisted keys
+// to `station-keys.db` (SQLite) and run logs to `station-logs.db`. The
+// new defaults are `station-keys.json` and `station-logs.jsonl`; the
+// legacy files are NOT auto-migrated. Emit a one-time warning so an
+// upgrade doesn't silently appear to wipe a user's API keys.
+function warnIfLegacySqliteFiles(dataDir) {
+    const legacy = [
+        { file: "station-keys.db", replacement: "station-keys.json" },
+        { file: "station-logs.db", replacement: "station-logs.jsonl" },
+    ];
+    for (const { file, replacement } of legacy) {
+        const legacyPath = resolve(dataDir, file);
+        if (!existsSync(legacyPath))
+            continue;
+        const replacementPath = resolve(dataDir, replacement);
+        if (existsSync(replacementPath))
+            continue;
+        console.warn(`[station] Legacy ${file} detected at ${legacyPath} but no ${replacement} found. ` +
+            `Station no longer reads SQLite-backed defaults; data in ${file} will not be loaded. ` +
+            `If you need the contents, export them with the better-sqlite3 CLI before upgrading. ` +
+            `To suppress this warning, delete or rename ${file}.`);
+    }
+}
 //# sourceMappingURL=index.js.map