Updated doc

Author: crystalin

.gitignore

@@ -193,8 +193,10 @@ proxy.log
 dashboard.log
 
 # Credentials (keep the directory but not the files)
-credentials/*.json
-credentials/*.credentials.json
+credentials/
+!credentials/.gitkeep
+!credentials/*/.gitkeep
+!credentials/README.md
 
 # Temporary files
 *.tmp

AGENTS.md

@@ -222,7 +222,7 @@ Follow [Repository Grooming](docs/01-Getting-Started/repository-grooming.md) for
 ```bash
 # Installation (2 commands)
 bun install                           # Install dependencies
-bun run scripts/init-database.ts      # Initialize database (requires DATABASE_URL in .env)
+bun run scripts/db/migrations/000-init-database.ts  # Initialize database (requires DATABASE_URL in .env)
 
 # Development (3 commands)
 bun run dev                          # Run both services

CLAUDE.md

@@ -222,7 +222,7 @@ Follow [Repository Grooming](docs/01-Getting-Started/repository-grooming.md) for
 ```bash
 # Installation (2 commands)
 bun install                           # Install dependencies
-bun run scripts/init-database.ts      # Initialize database (requires DATABASE_URL in .env)
+bun run scripts/db/migrations/000-init-database.ts  # Initialize database (requires DATABASE_URL in .env)
 
 # Development (3 commands)
 bun run dev                          # Run both services

credentials/accounts/.gitkeep

@@ -35,7 +35,7 @@ curl -X POST http://proxy:3000/v1/messages \
 Generate a secure client API key:
 
 ```bash
-bun run scripts/generate-api-key.ts
+bun run scripts/auth/generate-api-key.ts
 ```
 
 ### Disabling Client Authentication
@@ -177,7 +177,7 @@ JSON
 For OAuth authentication:
 
 ```bash
-bun run scripts/oauth-login.ts credentials/accounts/account-primary.credentials.json
+bun run scripts/auth/oauth-login.ts credentials/accounts/account-primary.credentials.json
 ```
 
 ### Step 3: Configure Request Headers
@@ -251,7 +251,7 @@ bun run scripts/oauth-refresh-all.ts credentials
 **Solution:**
 
 ```bash
-bun run scripts/oauth-login.ts credentials/accounts/account-primary.credentials.json
+bun run scripts/auth/oauth-login.ts credentials/accounts/account-primary.credentials.json
 ```
 
 #### "No refresh token available"

credentials/train-client-keys/.gitkeep

@@ -67,7 +67,7 @@ async function checkOAuthStatus() {
         console.error(
           '\nERROR: Token is expired and no refresh token available. Re-authentication required!'
         )
-        console.log(`Run: bun run scripts/oauth-login.ts ${credentialPath}`)
+        console.log(`Run: bun run scripts/auth/oauth-login.ts ${credentialPath}`)
       }
     } else if (credentials.type === 'api_key') {
       console.log(

docs/02-User-Guide/authentication.md

@@ -7,9 +7,9 @@ async function main() {
   const credentialPath = process.argv[2]
 
   if (!credentialPath) {
-    console.error('Usage: bun run scripts/oauth-login.ts <credential-path>')
+    console.error('Usage: bun run scripts/auth/oauth-login.ts <credential-path>')
     console.error(
-      'Example: bun run scripts/oauth-login.ts credentials/example.com.credentials.json'
+      'Example: bun run scripts/auth/oauth-login.ts credentials/example.com.credentials.json'
     )
     process.exit(1)
   }

scripts/auth/check-oauth-status.ts

@@ -62,7 +62,7 @@ async function refreshOAuthToken() {
 
     if (!oauth.refreshToken) {
       console.error('\nERROR: No refresh token available. Re-authentication required.')
-      console.error(`Run: bun run scripts/oauth-login.ts ${credentialPath}`)
+      console.error(`Run: bun run scripts/auth/oauth-login.ts ${credentialPath}`)
       process.exit(1)
     }
 

scripts/auth/oauth-login.ts

@@ -435,7 +435,7 @@ export async function getApiKey(
             // Check for specific error codes
             if (refreshError.errorCode === 'invalid_grant' || refreshError.status === 400) {
               console.error('Refresh token is invalid or expired. Re-authentication required.')
-              console.error(`Please run: bun run scripts/oauth-login.ts ${credentialPath}`)
+              console.error(`Please run: bun run scripts/auth/oauth-login.ts ${credentialPath}`)
             }
 
             return null