Release v3.1.0

### Added - Support for GITHUB_EXCLUDED_ORGS environment variable - New textarea UI component for configuration forms ### Fixed - Mirror strategy configuration test failures - Organization repository routing logic - Starred repositories organization routing - SSO and OIDC authentication issues ### Improved - Organization configuration for repository routing - Mirror strategy handling in tests - Authentication error handling 🤖 Generated with Claude Code Co-Authored-By: Claude <noreply@anthropic.com>
fixed tests
2025-12-06 11:36:44 +03:00 · 2025-07-21 16:46:36 +05:30 · 2025-07-21 15:17:53 +05:30 · 2025-07-21 12:30:04 +05:30 · 2025-07-21 12:26:31 +05:30 · 2025-07-21 12:09:38 +05:30
50 changed files with 1477 additions and 1572 deletions
--- a/.claude/settings.local.json
+++ b/.claude/settings.local.json
@@ -0,0 +1,8 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(docker build:*)"
+    ],
+    "deny": []
+  }
+}
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,23 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

 ## [Unreleased]

+## [3.1.0] - 2025-07-21
+
+### Added
+- Support for GITHUB_EXCLUDED_ORGS environment variable to filter out specific organizations during discovery
+- New textarea UI component for improved form inputs in configuration
+
+### Fixed
+- Fixed test failures related to mirror strategy configuration location
+- Corrected organization repository routing logic for different mirror strategies
+- Fixed starred repositories organization routing bug
+- Resolved SSO and OIDC authentication issues
+
+### Improved
+- Enhanced organization configuration for better repository routing control
+- Better handling of mirror strategies in test suite
+- Improved error handling in authentication flows
+
 ## [3.0.0] - 2025-07-17

 ### 🔴 Breaking Changes
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -2,6 +2,8 @@

 This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.

+DONT HALLUCIATE THINGS. IF YOU DONT KNOW LOOK AT THE CODE OR ASK FOR DOCS
+
 ## Project Overview

 Gitea Mirror is a web application that automatically mirrors repositories from GitHub to self-hosted Gitea instances. It uses Astro for SSR, React for UI, SQLite for data storage, and Bun as the JavaScript runtime.
@@ -40,7 +42,7 @@ bun run start        # Start production server
 - **Frontend**: Astro (SSR) + React + Tailwind CSS v4 + Shadcn UI
 - **Backend**: Bun runtime + SQLite + Drizzle ORM
 - **APIs**: GitHub (Octokit) and Gitea APIs
- **Auth**: JWT tokens with bcryptjs password hashing
+- **Auth**: Better Auth with email/password, SSO, and OIDC provider support

 ### Project Structure
 - `/src/pages/api/` - API endpoints (Astro API routes)
@@ -68,10 +70,15 @@ export async function POST({ request }: APIContext) {

 3. **Real-time Updates**: Server-Sent Events (SSE) endpoint at `/api/events` for live dashboard updates

-4. **Authentication Flow**: 
+4. **Authentication System**: 
+   - Built on Better Auth library
+   - Three authentication methods:
+     - Email & Password (traditional auth)
+     - SSO (authenticate via external OIDC providers)
+     - OIDC Provider (act as OIDC provider for other apps)
+   - Session-based authentication with secure cookies
   - First user signup creates admin account
-   - JWT tokens stored in cookies
-   - Protected routes check auth via `getUserFromCookie()`
+   - Protected routes use Better Auth session validation

 5. **Mirror Process**:
   - Discovers repos from GitHub (user/org)
@@ -79,11 +86,18 @@ export async function POST({ request }: APIContext) {
   - Tracks status in database
   - Supports scheduled automatic mirroring

-6. **Mirror Strategies**: Three ways to organize repositories in Gitea:
+6. **Mirror Strategies**: Four ways to organize repositories in Gitea:
   - **preserve**: Maintains GitHub structure (default)
+     - Organization repos → Same organization name in Gitea
+     - Personal repos → Under your Gitea username
   - **single-org**: All repos go to one organization
+     - All repos → Single configured organization
   - **flat-user**: All repos go under user account
-   - Starred repos always go to separate organization (starredReposOrg)
+     - All repos → Under your Gitea username
+   - **mixed**: Hybrid approach
+     - Organization repos → Preserve structure
+     - Personal repos → Single configured organization
+   - Starred repos always go to separate organization (starredReposOrg, default: "starred")
   - Routing logic in `getGiteaRepoOwner()` function

 ### Database Schema (SQLite)
@@ -102,11 +116,18 @@ export async function POST({ request }: APIContext) {

 ### Development Tips
 - Environment variables in `.env` (copy from `.env.example`)
- JWT_SECRET auto-generated if not provided
+- BETTER_AUTH_SECRET required for session signing
 - Database auto-initializes on first run
 - Use `bun run dev:clean` for fresh database start
 - Tailwind CSS v4 configured with Vite plugin

+### Authentication Setup
+- **Better Auth** handles all authentication
+- Configuration in `/src/lib/auth.ts` (server) and `/src/lib/auth-client.ts` (client)
+- Auth endpoints available at `/api/auth/*`
+- SSO providers configured through the web UI
+- OIDC provider functionality for external applications
+
 ### Common Tasks

 **Adding a new API endpoint:**
@@ -125,6 +146,73 @@ export async function POST({ request }: APIContext) {
 2. Run `bun run init-db` to recreate database
 3. Update related queries in `/src/lib/db/queries/`

+## Configuration Options
+
+### GitHub Configuration (UI Fields)
+
+#### Basic Settings (`githubConfig`)
+- **username**: GitHub username
+- **token**: GitHub personal access token (requires repo and admin:org scopes)
+- **privateRepositories**: Include private repositories
+- **mirrorStarred**: Mirror starred repositories
+
+### Gitea Configuration (UI Fields)
+- **url**: Gitea instance URL
+- **username**: Gitea username
+- **token**: Gitea access token
+- **organization**: Destination organization (for single-org/mixed strategies)
+- **starredReposOrg**: Organization for starred repositories (default: "starred")
+- **visibility**: Organization visibility - "public", "private", "limited"
+- **mirrorStrategy**: Repository organization strategy (set via UI)
+- **preserveOrgStructure**: Automatically set based on mirrorStrategy
+
+### Schedule Configuration (`scheduleConfig`)
+- **enabled**: Enable automatic mirroring (default: false)
+- **interval**: Cron expression or seconds (default: "0 2 * * *" - 2 AM daily)
+- **concurrent**: Allow concurrent mirror operations (default: false)
+- **batchSize**: Number of repos to process in parallel (default: 10)
+
+### Database Cleanup Configuration (`cleanupConfig`)
+- **enabled**: Enable automatic cleanup (default: false)
+- **retentionDays**: Days to keep events (stored as seconds internally)
+
+### Mirror Options (UI Fields)
+- **mirrorReleases**: Mirror GitHub releases to Gitea
+- **mirrorMetadata**: Enable metadata mirroring (master toggle)
+- **metadataComponents** (only available when mirrorMetadata is enabled):
+  - **issues**: Mirror issues
+  - **pullRequests**: Mirror pull requests  
+  - **labels**: Mirror labels
+  - **milestones**: Mirror milestones
+  - **wiki**: Mirror wiki content
+
+### Advanced Options (UI Fields)
+- **skipForks**: Skip forked repositories (default: false)
+- **skipStarredIssues**: Skip issues for starred repositories (default: false) - enables "Lightweight mode" for starred repos
+
+### Authentication Configuration
+
+#### SSO Provider Configuration
+- **issuerUrl**: OIDC issuer URL (e.g., https://accounts.google.com)
+- **domain**: Email domain for this provider
+- **providerId**: Unique identifier for the provider
+- **clientId**: OAuth client ID from provider
+- **clientSecret**: OAuth client secret from provider
+- **authorizationEndpoint**: OAuth authorization URL (auto-discovered if supported)
+- **tokenEndpoint**: OAuth token exchange URL (auto-discovered if supported)
+- **jwksEndpoint**: JSON Web Key Set URL (optional, auto-discovered)
+- **userInfoEndpoint**: User information endpoint (optional, auto-discovered)
+
+#### OIDC Provider Settings (for external apps)
+- **allowedRedirectUris**: Comma-separated list of allowed redirect URIs
+- **clientId**: Generated client ID for the application
+- **clientSecret**: Generated client secret for the application
+- **scopes**: Available scopes (openid, profile, email)
+
+#### Environment Variables
+- **BETTER_AUTH_SECRET**: Secret key for signing sessions (required)
+- **BETTER_AUTH_URL**: Base URL for authentication (default: http://localhost:4321)
+
 ## Security Guidelines

 - **Confidentiality Guidelines**:
--- a/MIGRATION_GUIDE.md
+++ b/MIGRATION_GUIDE.md
@@ -1,248 +0,0 @@
-# Migration Guide
-
-This guide covers database migrations and version upgrades for Gitea Mirror.
-
-## Version 3.0 Migration Guide
-
-### Overview of v3 Changes
-
-Version 3.0 introduces significant security improvements and authentication changes:
- **Token Encryption**: All GitHub and Gitea tokens are now encrypted in the database
- **Better Auth**: Complete authentication system overhaul with session-based auth
- **SSO/OIDC Support**: Enterprise authentication options
- **Enhanced Security**: Improved error handling and security practices
-
-### Breaking Changes in v3
-
-#### 1. Authentication System Overhaul
- Users now log in with **email** instead of username
- Session-based authentication replaces JWT tokens
- New auth endpoints: `/api/auth/[...all]` instead of `/api/auth/login`
- Password reset may be required for existing users
-
-#### 2. Token Encryption
- All stored GitHub and Gitea tokens are encrypted using AES-256-GCM
- Requires encryption secret configuration
- Existing unencrypted tokens must be migrated
-
-#### 3. Environment Variables
-**Required changes:**
- `JWT_SECRET` → `BETTER_AUTH_SECRET` (backward compatible)
- New: `BETTER_AUTH_URL` (required)
- New: `ENCRYPTION_SECRET` (recommended)
-
-#### 4. Database Schema Updates
-New tables added:
- `sessions` - User session management
- `accounts` - Authentication accounts
- `verification_tokens` - Email verification
- `oauth_applications` - OAuth app registrations
- `sso_providers` - SSO configuration
-
-### Migration Steps from v2 to v3
-
-**⚠️ IMPORTANT: Backup your database before upgrading!**
-
-```bash
-cp data/gitea-mirror.db data/gitea-mirror.db.backup
-```
-
-#### Automated Migration (Docker Compose)
-
-For Docker Compose users, v3 migration is **fully automated**:
-
-1. **Update your docker-compose.yml** to use v3:
-```yaml
-services:
-  gitea-mirror:
-    image: ghcr.io/raylabshq/gitea-mirror:v3
-```
-
-2. **Pull and restart the container**:
-```bash
-docker compose pull
-docker compose down
-docker compose up -d
-```
-
-**That's it!** The container will automatically:
- ✅ Generate BETTER_AUTH_SECRET (from existing JWT_SECRET if available)
- ✅ Generate ENCRYPTION_SECRET for token encryption
- ✅ Create Better Auth database tables
- ✅ Migrate existing users to Better Auth system
- ✅ Encrypt all stored GitHub/Gitea tokens
- ✅ Apply all necessary database migrations
-
-#### Manual Migration (Non-Docker)
-
-#### Step 1: Update Environment Variables
-Add to your `.env` file:
-```bash
-# Set your application URL (required)
-BETTER_AUTH_URL=http://localhost:4321  # or your production URL
-
-# Optional: These will be auto-generated if not provided
-# BETTER_AUTH_SECRET=your-existing-jwt-secret  # Will use existing JWT_SECRET
-# ENCRYPTION_SECRET=your-48-character-secret   # Will be auto-generated
-```
-
-#### Step 2: Stop the Application
-```bash
-# Stop your running instance
-pkill -f "bun run start" # or your process manager command
-```
-
-#### Step 3: Update to v3
-```bash
-# Pull latest changes
-git pull origin v3
-
-# Install dependencies
-bun install
-```
-
-#### Step 4: Run Migrations
-```bash
-# Option 1: Automatic migration on startup
-bun run build
-bun run start  # Migrations run automatically
-
-# Option 2: Manual migration
-bun run migrate:better-auth      # Migrate users to Better Auth
-bun run migrate:encrypt-tokens   # Encrypt stored tokens
-```
-
-### Post-Migration Tasks
-
-1. **All users must log in again** - Sessions are invalidated
-2. **Users log in with email** - Not username anymore
-3. **Check token encryption** - Verify GitHub/Gitea connections still work
-4. **Update API integrations** - Switch to new auth endpoints
-
-### Troubleshooting v3 Migration
-
-#### Users Can't Log In
- Ensure they're using email, not username
- They may need to reset password if migration failed
- Check Better Auth migration logs
-
-#### Token Decryption Errors
- Verify ENCRYPTION_SECRET is set correctly
- Re-run token encryption migration
- Users may need to re-enter tokens
-
-#### Database Errors
- Ensure all migrations completed
- Check disk space for new tables
- Review migration logs in console
-
-### Rollback Procedure
-If migration fails:
-```bash
-# Stop application
-pkill -f "bun run start"
-
-# Restore database backup
-cp data/gitea-mirror.db.backup data/gitea-mirror.db
-
-# Checkout previous version
-git checkout v2.22.0
-
-# Restart with old version
-bun run start
-```
-
---
-
-## Drizzle Kit Migration Guide
-
-This project uses Drizzle Kit for database migrations, providing better schema management and migration tracking.
-
-## Overview
-
- **Database**: SQLite (with preparation for future PostgreSQL migration)
- **ORM**: Drizzle ORM with Drizzle Kit for migrations
- **Schema Location**: `/src/lib/db/schema.ts`
- **Migrations Folder**: `/drizzle`
- **Configuration**: `/drizzle.config.ts`
-
-## Available Commands
-
-### Database Management
- `bun run init-db` - Initialize database with all migrations
- `bun run check-db` - Check database status and recent migrations
- `bun run reset-users` - Remove all users and related data
- `bun run cleanup-db` - Remove database files
-
-### Drizzle Kit Commands
- `bun run db:generate` - Generate new migration files from schema changes
- `bun run db:migrate` - Apply pending migrations to database
- `bun run db:push` - Push schema changes directly (development)
- `bun run db:pull` - Pull schema from database
- `bun run db:check` - Check for migration issues
- `bun run db:studio` - Open Drizzle Studio for database browsing
-
-## Making Schema Changes
-
-1. **Update Schema**: Edit `/src/lib/db/schema.ts`
-2. **Generate Migration**: Run `bun run db:generate`
-3. **Review Migration**: Check the generated SQL in `/drizzle` folder
-4. **Apply Migration**: Run `bun run db:migrate` or restart the application
-
-## Migration Process
-
-The application automatically runs migrations on startup:
- Checks for pending migrations
- Creates migrations table if needed
- Applies all pending migrations in order
- Tracks migration history
-
-## Schema Organization
-
-### Tables
- `users` - User authentication and accounts
- `configs` - GitHub/Gitea configurations
- `repositories` - Repository mirror tracking
- `organizations` - GitHub organizations
- `mirror_jobs` - Job tracking with resilience
- `events` - Real-time event notifications
-
-### Indexes
-All performance-critical indexes are automatically created:
- User lookups
- Repository status queries
- Organization filtering
- Job tracking
- Event channels
-
-## Future PostgreSQL Migration
-
-The setup is designed for easy PostgreSQL migration:
-
-1. Update `drizzle.config.ts`:
-```typescript
-export default defineConfig({
-  dialect: "postgresql",
-  schema: "./src/lib/db/schema.ts",
-  out: "./drizzle",
-  dbCredentials: {
-    connectionString: process.env.DATABASE_URL,
-  },
-});
-```
-
-2. Update connection in `/src/lib/db/index.ts`
-3. Generate new migrations: `bun run db:generate`
-4. Apply to PostgreSQL: `bun run db:migrate`
-
-## Troubleshooting
-
-### Migration Errors
- Check `/drizzle` folder for migration files
- Verify database permissions
- Review migration SQL for conflicts
-
-### Schema Conflicts
- Use `bun run db:check` to identify issues
- Review generated migrations before applying
- Keep schema.ts as single source of truth
--- a/README.md
+++ b/README.md
@@ -11,7 +11,7 @@
 </p>

 > [!IMPORTANT]
-> **Upgrading to v3?** Please read the [Migration Guide](MIGRATION_GUIDE.md) for breaking changes and upgrade instructions.
+> **Upgrading to v3?** v3 requires a fresh start with a new data volume. Please read the [Upgrade Guide](UPGRADE.md) for instructions.


 ## 🚀 Quick Start
@@ -35,7 +35,7 @@ First user signup becomes admin. Configure GitHub and Gitea through the web inte
 - 🔁 Mirror public, private, and starred GitHub repos to Gitea
 - 🏢 Mirror entire organizations with flexible strategies
 - 🎯 Custom destination control for repos and organizations
- 🔐 Secure authentication with JWT tokens
+- 🔐 Secure authentication with Better Auth (email/password, SSO, OIDC)
 - 📊 Real-time dashboard with activity logs
 - ⏱️ Scheduled automatic mirroring
 - 🐳 Dockerized with multi-arch support (AMD64/ARM64)
--- a/UPGRADE.md
+++ b/UPGRADE.md
@@ -0,0 +1,74 @@
+# Upgrade Guide
+
+## Upgrading to v3.0
+
+> **⚠️ IMPORTANT**: v3.0 requires a fresh start. There is no automated migration from v2.x to v3.0.
+
+### Why No Migration?
+
+v3.0 introduces fundamental changes to the application architecture:
+- **Authentication**: Switched from JWT to Better Auth
+- **Database**: Now uses Drizzle ORM with proper migrations
+- **Security**: All tokens are now encrypted
+- **Features**: Added SSO support and OIDC provider functionality
+
+Due to these extensive changes, we recommend starting fresh with v3.0 for the best experience.
+
+### Upgrade Steps
+
+1. **Stop your v2.x container**
+   ```bash
+   docker stop gitea-mirror
+   docker rm gitea-mirror
+   ```
+
+2. **Backup your v2.x data (optional)**
+   ```bash
+   # If you want to keep your v2 data for reference
+   docker run --rm -v gitea-mirror-data:/data -v $(pwd):/backup alpine tar czf /backup/gitea-mirror-v2-backup.tar.gz -C /data .
+   ```
+
+3. **Create a new volume for v3**
+   ```bash
+   docker volume create gitea-mirror-v3-data
+   ```
+
+4. **Run v3 with the new volume**
+   ```bash
+   docker run -d \
+     --name gitea-mirror \
+     -p 4321:4321 \
+     -v gitea-mirror-v3-data:/app/data \
+     -e BETTER_AUTH_SECRET=your-secret-key \
+     -e ENCRYPTION_SECRET=your-encryption-key \
+     arunavo4/gitea-mirror:latest
+   ```
+
+5. **Set up your configuration again**
+   - Navigate to http://localhost:4321
+   - Create a new admin account
+   - Re-enter your GitHub and Gitea credentials
+   - Configure your mirror settings
+
+### What Happens to My Existing Mirrors?
+
+Your existing mirrors in Gitea are **not affected**. The application will:
+- Recognize existing repositories when you re-import
+- Skip creating duplicates
+- Resume normal mirror operations
+
+### Environment Variable Changes
+
+v3.0 uses different environment variables:
+
+| v2.x | v3.0 | Notes |
+|------|------|-------|
+| `JWT_SECRET` | `BETTER_AUTH_SECRET` | Required for session management |
+| - | `ENCRYPTION_SECRET` | New - required for token encryption |
+
+### Need Help?
+
+If you have questions about upgrading:
+1. Check the [README](README.md) for v3 setup instructions
+2. Review your v2 configuration before upgrading
+3. Open an issue if you encounter problems
--- a/bun.lock
+++ b/bun.lock
@@ -8,6 +8,7 @@
        "@astrojs/mdx": "^4.3.0",
        "@astrojs/node": "9.3.0",
        "@astrojs/react": "^4.3.0",
+        "@better-auth/sso": "^1.3.2",
        "@octokit/rest": "^22.0.0",
        "@radix-ui/react-accordion": "^1.2.11",
        "@radix-ui/react-avatar": "^1.1.10",
@@ -99,6 +100,8 @@

    "@astrojs/yaml2ts": ["@astrojs/yaml2ts@0.2.2", "", { "dependencies": { "yaml": "^2.5.0" } }, "sha512-GOfvSr5Nqy2z5XiwqTouBBpy5FyI6DEe+/g/Mk5am9SjILN1S5fOEvYK0GuWHg98yS/dobP4m8qyqw/URW35fQ=="],

+    "@authenio/xml-encryption": ["@authenio/xml-encryption@2.0.2", "", { "dependencies": { "@xmldom/xmldom": "^0.8.6", "escape-html": "^1.0.3", "xpath": "0.0.32" } }, "sha512-cTlrKttbrRHEw3W+0/I609A2Matj5JQaRvfLtEIGZvlN0RaPi+3ANsMeqAyCAVlH/lUIW2tmtBlSMni74lcXeg=="],
+
    "@babel/code-frame": ["@babel/code-frame@7.27.1", "", { "dependencies": { "@babel/helper-validator-identifier": "^7.27.1", "js-tokens": "^4.0.0", "picocolors": "^1.1.1" } }, "sha512-cjQ7ZlQ0Mv3b47hABuTevyTuYN4i+loJKGeV9flcCgIK37cCXRh+L1bd3iBHlynerhQ7BhCkn2BPbQUL+rGqFg=="],

    "@babel/compat-data": ["@babel/compat-data@7.27.3", "", {}, "sha512-V42wFfx1ymFte+ecf6iXghnnP8kWTO+ZLXIyZq+1LAXHHvTZdVxicn4yiVYdYMGaCO3tmqub11AorKkv+iodqw=="],
@@ -137,6 +140,8 @@

    "@babel/types": ["@babel/types@7.27.3", "", { "dependencies": { "@babel/helper-string-parser": "^7.27.1", "@babel/helper-validator-identifier": "^7.27.1" } }, "sha512-Y1GkI4ktrtvmawoSq+4FCVHNryea6uR+qUQy0AGxLSsjCX0nVmkYQMBLHDkXZuo5hGx7eYdnIaslsdBFm7zbUw=="],

+    "@better-auth/sso": ["@better-auth/sso@1.3.2", "", { "dependencies": { "@better-fetch/fetch": "^1.1.18", "better-auth": "^1.3.2", "fast-xml-parser": "^5.2.5", "jose": "^5.9.6", "oauth2-mock-server": "^7.2.0", "samlify": "^2.10.0", "zod": "^3.24.1" } }, "sha512-Rl7SiPIjJR8qg1XshEV7sPwzU6jk27A3mfXUWSt8PVwO4IgN1iW10DfOEdvmGX47CNSwgVuTBczKpJkQmZzKbw=="],
+
    "@better-auth/utils": ["@better-auth/utils@0.2.5", "", { "dependencies": { "typescript": "^5.8.2", "uncrypto": "^0.1.3" } }, "sha512-uI2+/8h/zVsH8RrYdG8eUErbuGBk16rZKQfz8CjxQOyCE6v7BqFYEbFwvOkvl1KbUdxhqOnXp78+uE5h8qVEgQ=="],

    "@better-fetch/fetch": ["@better-fetch/fetch@1.1.18", "", {}, "sha512-rEFOE1MYIsBmoMJtQbl32PGHHXuG2hDxvEd7rUHE0vCBoFQVSDqaVs9hkZEtHCxRoY+CljXKFCOuJ8uxqw1LcA=="],
@@ -613,6 +618,12 @@

    "@vscode/l10n": ["@vscode/l10n@0.0.18", "", {}, "sha512-KYSIHVmslkaCDyw013pphY+d7x1qV8IZupYfeIfzNA+nsaWHbn5uPuQRvdRFsa9zFzGeudPuoGoZ1Op4jrJXIQ=="],

+    "@xmldom/is-dom-node": ["@xmldom/is-dom-node@1.0.1", "", {}, "sha512-CJDxIgE5I0FH+ttq/Fxy6nRpxP70+e2O048EPe85J2use3XKdatVM7dDVvFNjQudd9B49NPoZ+8PG49zj4Er8Q=="],
+
+    "@xmldom/xmldom": ["@xmldom/xmldom@0.8.10", "", {}, "sha512-2WALfTl4xo2SkGCYRt6rDTFfk9R1czmBvUQy12gK2KuRKIpWEhcbbzy8EZXtz/jkRqHX8bFEc6FC1HjX4TUWYw=="],
+
+    "accepts": ["accepts@1.3.8", "", { "dependencies": { "mime-types": "~2.1.34", "negotiator": "0.6.3" } }, "sha512-PYAthTa2m2VKxuvSD3DPC/Gy+U+sOA1LAuT8mkmRuvw+NACSaeXEQ+NHcVF7rONl6qcaxV3Uuemwawk+7+SJLw=="],
+
    "acorn": ["acorn@8.14.1", "", { "bin": { "acorn": "bin/acorn" } }, "sha512-OvQ/2pUDKmgfCg++xsTX1wGxfTaszcHVcTctW4UJB4hibJx2HXxxO5UmVgyjMa+ZDsiaf5wWLXYpRWMmBI0QHg=="],

    "acorn-jsx": ["acorn-jsx@5.3.2", "", { "peerDependencies": { "acorn": "^6.0.0 || ^7.0.0 || ^8.0.0" } }, "sha512-rq9s+JNhf0IChjtDXxllJ7g41oZk5SlXtp0LHwyA5cejwn7vKmKp4pPri6YEePv2PU65sAsegbXtIinmDFDXgQ=="],
@@ -635,8 +646,12 @@

    "aria-query": ["aria-query@5.3.2", "", {}, "sha512-COROpnaoap1E2F000S62r6A60uHZnmlvomhfyT2DlTcrY1OrBKn2UhH7qn5wTC9zMvD0AY7csdPSNwKP+7WiQw=="],

+    "array-flatten": ["array-flatten@1.1.1", "", {}, "sha512-PCVAQswWemu6UdxsDFFX/+gVeYqKAod3D3UVm91jHwynguOwAvYPhx8nNlM++NqRcK6CxxpUafjmhIdKiHibqg=="],
+
    "array-iterate": ["array-iterate@2.0.1", "", {}, "sha512-I1jXZMjAgCMmxT4qxXfPXa6SthSoE8h6gkSI9BGGNv8mP8G/v0blc+qFnZu6K42vTOiuME596QaLO0TP3Lk0xg=="],

+    "asn1": ["asn1@0.2.6", "", { "dependencies": { "safer-buffer": "~2.1.0" } }, "sha512-ix/FxPn0MDjeyJ7i/yoHGFt/EX6LyNbxSEhPPXODPL+KB0VPk86UYfL0lMdy+KCnv+fmvIzySwaK5COwqVbWTQ=="],
+
    "asn1js": ["asn1js@3.0.6", "", { "dependencies": { "pvtsutils": "^1.3.6", "pvutils": "^1.1.3", "tslib": "^2.8.1" } }, "sha512-UOCGPYbl0tv8+006qks/dTgV9ajs97X2p0FAbyS2iyCRrmLSRolDaHdp+v/CLgnzHc3fVB+CwYiUmei7ndFcgA=="],

    "assertion-error": ["assertion-error@2.0.1", "", {}, "sha512-Izi8RQcffqCeNVgFigKli1ssklIbpHnCYc6AknXGYoB6grJqyeby7jv12JUQgmTAnIDnbck1uxksT4dzN3PWBA=="],
@@ -653,6 +668,8 @@

    "base64-js": ["base64-js@1.5.1", "", {}, "sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA=="],

+    "basic-auth": ["basic-auth@2.0.1", "", { "dependencies": { "safe-buffer": "5.1.2" } }, "sha512-NF+epuEdnUYVlGuhaxbbq+dvJttwLnGY+YixlXlME5KpQ5W3CnXA5cVTneY3SPbPDRkcjMbifrwmFYcClgOZeg=="],
+
    "bcryptjs": ["bcryptjs@3.0.2", "", { "bin": { "bcrypt": "bin/bcrypt" } }, "sha512-k38b3XOZKv60C4E2hVsXTolJWfkGRMbILBIe2IBITXciy5bOsTKot5kDrf3ZfufQtQOUN5mXceUEpU1rTl9Uog=="],

    "before-after-hook": ["before-after-hook@4.0.0", "", {}, "sha512-q6tR3RPqIB1pMiTRMFcZwuG5T8vwp+vUvEG0vuI6B+Rikh5BfPp2fQ82c925FOs+b0lcFQ8CFrL+KbilfZFhOQ=="],
@@ -663,6 +680,8 @@

    "blob-to-buffer": ["blob-to-buffer@1.2.9", "", {}, "sha512-BF033y5fN6OCofD3vgHmNtwZWRcq9NLyyxyILx9hfMy1sXYy4ojFl765hJ2lP0YaN2fuxPaLO2Vzzoxy0FLFFA=="],

+    "body-parser": ["body-parser@1.20.3", "", { "dependencies": { "bytes": "3.1.2", "content-type": "~1.0.5", "debug": "2.6.9", "depd": "2.0.0", "destroy": "1.2.0", "http-errors": "2.0.0", "iconv-lite": "0.4.24", "on-finished": "2.4.1", "qs": "6.13.0", "raw-body": "2.5.2", "type-is": "~1.6.18", "unpipe": "1.0.0" } }, "sha512-7rAxByjUMqQ3/bHJy7D6OGXvx/MMc4IqBn/X0fcM1QUcAItpZrBEYhWGem+tzXH90c+G01ypMcYJBO9Y30203g=="],
+
    "boxen": ["boxen@8.0.1", "", { "dependencies": { "ansi-align": "^3.0.1", "camelcase": "^8.0.0", "chalk": "^5.3.0", "cli-boxes": "^3.0.0", "string-width": "^7.2.0", "type-fest": "^4.21.0", "widest-line": "^5.0.0", "wrap-ansi": "^9.0.0" } }, "sha512-F3PH5k5juxom4xktynS7MoFY+NUWH5LC4CnH11YB8NPew+HLpmBLCybSAEyb2F+4pRXhuhWqFesoQd6DAyc2hw=="],

    "braces": ["braces@3.0.3", "", { "dependencies": { "fill-range": "^7.1.1" } }, "sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA=="],
@@ -677,9 +696,15 @@

    "bun-types": ["bun-types@1.2.18", "", { "dependencies": { "@types/node": "*" }, "peerDependencies": { "@types/react": "^19" } }, "sha512-04+Eha5NP7Z0A9YgDAzMk5PHR16ZuLVa83b26kH5+cp1qZW4F6FmAURngE7INf4tKOvCE69vYvDEwoNl1tGiWw=="],

+    "bytes": ["bytes@3.1.2", "", {}, "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg=="],
+
    "cac": ["cac@6.7.14", "", {}, "sha512-b6Ilus+c3RrdDk+JhLKUAQfzzgLEPy6wcXqS7f/xe1EETvsDP6GORG7SFuOs6cID5YkqchW/LXZbX5bc8j7ZcQ=="],

-    "camelcase": ["camelcase@8.0.0", "", {}, "sha512-8WB3Jcas3swSvjIeA2yvCJ+Miyz5l1ZmB6HFb9R1317dt9LCQoswg/BGrmAmkWVEszSrrg4RwmO46qIm2OEnSA=="],
+    "call-bind-apply-helpers": ["call-bind-apply-helpers@1.0.2", "", { "dependencies": { "es-errors": "^1.3.0", "function-bind": "^1.1.2" } }, "sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ=="],
+
+    "call-bound": ["call-bound@1.0.4", "", { "dependencies": { "call-bind-apply-helpers": "^1.0.2", "get-intrinsic": "^1.3.0" } }, "sha512-+ys997U96po4Kx/ABpBCqhA9EuxJaQWDQg7295H4hBphv3IZg0boBKuwYpt4YXp6MZ5AmZQnU/tyMTlRpaSejg=="],
+
+    "camelcase": ["camelcase@6.3.0", "", {}, "sha512-Gmy6FhYlCY7uOElZUSbxo2UCDH8owEk996gkbrpsgGtrJLM3J7jGxl9Ic7Qwwj4ivOE5AWZWRMecDdF7hqGjFA=="],

    "caniuse-lite": ["caniuse-lite@1.0.30001718", "", {}, "sha512-AflseV1ahcSunK53NfEs9gFWgOEmzr0f+kaMFA4xiLZlr9Hzt7HxcSpIFcnNCUkz6R6dWKa54rUz3HUmI3nVcw=="],

@@ -733,12 +758,20 @@

    "common-ancestor-path": ["common-ancestor-path@1.0.1", "", {}, "sha512-L3sHRo1pXXEqX8VU28kfgUY+YGsk09hPqZiZmLacNib6XNTCM8ubYeT7ryXQw8asB1sKgcU5lkB7ONug08aB8w=="],

+    "content-disposition": ["content-disposition@0.5.4", "", { "dependencies": { "safe-buffer": "5.2.1" } }, "sha512-FveZTNuGw04cxlAiWbzi6zTAL/lhehaWbTtgluJh4/E95DqMwTmha3KZN1aAWA8cFIhHzMZUvLevkw5Rqk+tSQ=="],
+
+    "content-type": ["content-type@1.0.5", "", {}, "sha512-nTjqfcBFEipKdXCv4YDQWCfmcLZKm81ldF0pAopTvyrFGVbcR6P/VAAd5G7N+0tTr8QqiU0tFadD6FK4NtJwOA=="],
+
    "convert-source-map": ["convert-source-map@2.0.0", "", {}, "sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg=="],

    "cookie": ["cookie@1.0.2", "", {}, "sha512-9Kr/j4O16ISv8zBBhJoi4bXOYNTkFLOqSL3UDB0njXxCXNezjeyVrJyGOWtgfs/q2km1gwBcfH8q1yEGoMYunA=="],

    "cookie-es": ["cookie-es@1.2.2", "", {}, "sha512-+W7VmiVINB+ywl1HGXJXmrqkOhpKrIiVZV6tQuV54ZyQC7MMuBt81Vc336GMLoHBq5hV/F9eXgt5Mnx0Rha5Fg=="],

+    "cookie-signature": ["cookie-signature@1.0.6", "", {}, "sha512-QADzlaHc8icV8I7vbaJXJwod9HWYp8uCqf1xa4OfNu1T7JVxQIrUgOWtHdNDtPiywmFbiS12VjotIXLrKM3orQ=="],
+
+    "cors": ["cors@2.8.5", "", { "dependencies": { "object-assign": "^4", "vary": "^1" } }, "sha512-KIHbLJqu73RGr/hnbrO9uBeixNGuvSQjul/jdFvS/KFSIH1hWVd1ng7zOHx+YrEfInLG7q4n6GHQ9cDtxv/P6g=="],
+
    "cross-fetch": ["cross-fetch@3.2.0", "", { "dependencies": { "node-fetch": "^2.7.0" } }, "sha512-Q+xVJLoGOeIMXZmbUK4HYk+69cQH6LudR0Vu/pRm2YlU/hDV9CiS0gKUMaWY5f2NeUH9C1nV3bsTlCo0FsTV1Q=="],

    "crossws": ["crossws@0.3.5", "", { "dependencies": { "uncrypto": "^0.1.3" } }, "sha512-ojKiDvcmByhwa8YYqbQI/hg7MEU0NC03+pSdEq4ZUnZR9xXpwk7E43SMNGkn+JxJGPFtNvQ48+vV2p+P1ml5PA=="],
@@ -771,6 +804,8 @@

    "destr": ["destr@2.0.5", "", {}, "sha512-ugFTXCtDZunbzasqBxrK93Ik/DRYsO6S/fedkWEMKqt04xZ4csmnmwGDBAb07QWNaGMAmnTIemsYZCksjATwsA=="],

+    "destroy": ["destroy@1.2.0", "", {}, "sha512-2sJGJTaXIIaR1w4iJSNoN0hnMY7Gpc/n8D4qSCJw8QqFWXf7cuAgnEHxBpweaVcPevC2l3KpjYCx3NypQQgaJg=="],
+
    "detect-libc": ["detect-libc@2.0.4", "", {}, "sha512-3UDv+G9CsCKO1WKMGw9fwq/SWJYbI0c5Y7LU1AXYoDdbhE2AHQ6N6Nb34sG8Fj7T5APy8qXDCKuuIHd1BR0tVA=="],

    "detect-node-es": ["detect-node-es@1.1.0", "", {}, "sha512-ypdmJU/TbBby2Dxibuv7ZLW3Bs1QEmM7nHjEANfohJLvE0XVujisn1qPJcZxg+qDucsr+bP6fLD1rPS3AhJ7EQ=="],
@@ -795,6 +830,8 @@

    "dset": ["dset@3.1.4", "", {}, "sha512-2QF/g9/zTaPDc3BjNcVTGoBbXBgYfMTTceLaYcFJ/W9kggFUkhxD/hMEeuLKbugyef9SqAx8cpgwlIP/jinUTA=="],

+    "dunder-proto": ["dunder-proto@1.0.1", "", { "dependencies": { "call-bind-apply-helpers": "^1.0.1", "es-errors": "^1.3.0", "gopd": "^1.2.0" } }, "sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A=="],
+
    "ecdsa-sig-formatter": ["ecdsa-sig-formatter@1.0.11", "", { "dependencies": { "safe-buffer": "^5.0.1" } }, "sha512-nagl3RYrbNv6kQkeJIpt6NJZy8twLB/2vtz6yN9Z4vRKHN4/QZJIEbqohALSgwKdnksuY3k5Addp5lg8sVoVcQ=="],

    "ee-first": ["ee-first@1.1.1", "", {}, "sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow=="],
@@ -811,8 +848,14 @@

    "entities": ["entities@6.0.0", "", {}, "sha512-aKstq2TDOndCn4diEyp9Uq/Flu2i1GlLkc6XIDQSDMuaFE3OPW5OphLCyQ5SpSJZTb4reN+kTcYru5yIfXoRPw=="],

+    "es-define-property": ["es-define-property@1.0.1", "", {}, "sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g=="],
+
+    "es-errors": ["es-errors@1.3.0", "", {}, "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw=="],
+
    "es-module-lexer": ["es-module-lexer@1.7.0", "", {}, "sha512-jEQoCwk8hyb2AZziIOLhDqpm5+2ww5uIE6lkO/6jcOCusfk6LhMHpXXfBLXTZ7Ydyt0j4VoUQv6uGNYbdW+kBA=="],

+    "es-object-atoms": ["es-object-atoms@1.1.1", "", { "dependencies": { "es-errors": "^1.3.0" } }, "sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA=="],
+
    "esast-util-from-estree": ["esast-util-from-estree@2.0.0", "", { "dependencies": { "@types/estree-jsx": "^1.0.0", "devlop": "^1.0.0", "estree-util-visit": "^2.0.0", "unist-util-position-from-estree": "^2.0.0" } }, "sha512-4CyanoAudUSBAn5K13H4JhsMH6L9ZP7XbLVe/dKybkxMO7eDyLsT8UHl9TRNrU2Gr9nz+FovfSIjuXWJ81uVwQ=="],

    "esast-util-from-js": ["esast-util-from-js@2.0.1", "", { "dependencies": { "@types/estree-jsx": "^1.0.0", "acorn": "^8.0.0", "esast-util-from-estree": "^2.0.0", "vfile-message": "^4.0.0" } }, "sha512-8Ja+rNJ0Lt56Pcf3TAmpBZjmx8ZcK5Ts4cAzIOjsjevg9oSXJnl6SUQ2EevU8tv3h6ZLWmoKL5H4fgWvdvfETw=="],
@@ -847,6 +890,8 @@

    "expect-type": ["expect-type@1.2.1", "", {}, "sha512-/kP8CAwxzLVEeFrMm4kMmy4CCDlpipyA7MYLVrdJIkV0fYF0UaigQHRsxHiuY/GEea+bh4KSv3TIlgr+2UL6bw=="],

+    "express": ["express@4.21.2", "", { "dependencies": { "accepts": "~1.3.8", "array-flatten": "1.1.1", "body-parser": "1.20.3", "content-disposition": "0.5.4", "content-type": "~1.0.4", "cookie": "0.7.1", "cookie-signature": "1.0.6", "debug": "2.6.9", "depd": "2.0.0", "encodeurl": "~2.0.0", "escape-html": "~1.0.3", "etag": "~1.8.1", "finalhandler": "1.3.1", "fresh": "0.5.2", "http-errors": "2.0.0", "merge-descriptors": "1.0.3", "methods": "~1.1.2", "on-finished": "2.4.1", "parseurl": "~1.3.3", "path-to-regexp": "0.1.12", "proxy-addr": "~2.0.7", "qs": "6.13.0", "range-parser": "~1.2.1", "safe-buffer": "5.2.1", "send": "0.19.0", "serve-static": "1.16.2", "setprototypeof": "1.2.0", "statuses": "2.0.1", "type-is": "~1.6.18", "utils-merge": "1.0.1", "vary": "~1.1.2" } }, "sha512-28HqgMZAmih1Czt9ny7qr6ek2qddF4FclbMzwhCREB6OFfH+rXAnuNCwo1/wFvrtbgsQDb4kSbX9de9lFbrXnA=="],
+
    "extend": ["extend@3.0.2", "", {}, "sha512-fjquC59cD7CyW6urNXK0FBufkZcoiGG80wTuPujX590cB5Ttln20E2UB4S/WARVqhXffZl2LNgS+gQdPIIim/g=="],

    "fast-content-type-parse": ["fast-content-type-parse@3.0.0", "", {}, "sha512-ZvLdcY8P+N8mGQJahJV5G4U88CSvT1rP8ApL6uETe88MBXrBHAkZlSEySdUlyztF7ccb+Znos3TFqaepHxdhBg=="],
@@ -857,22 +902,30 @@

    "fast-uri": ["fast-uri@3.0.6", "", {}, "sha512-Atfo14OibSv5wAp4VWNsFYE1AchQRTv9cBGWET4pZWHzYshFSS9NQI6I57rdKn9croWVMbYFbLhJ+yJvmZIIHw=="],

+    "fast-xml-parser": ["fast-xml-parser@5.2.5", "", { "dependencies": { "strnum": "^2.1.0" }, "bin": { "fxparser": "src/cli/cli.js" } }, "sha512-pfX9uG9Ki0yekDHx2SiuRIyFdyAr1kMIMitPvb0YBo8SUfKvia7w7FIyd/l6av85pFYRhZscS75MwMnbvY+hcQ=="],
+
    "fastq": ["fastq@1.19.1", "", { "dependencies": { "reusify": "^1.0.4" } }, "sha512-GwLTyxkCXjXbxqIhTsMI2Nui8huMPtnxg7krajPJAjnEG/iiOS7i+zCtWGZR9G0NBKbXKh6X9m9UIsYX/N6vvQ=="],

    "fdir": ["fdir@6.4.4", "", { "peerDependencies": { "picomatch": "^3 || ^4" }, "optionalPeers": ["picomatch"] }, "sha512-1NZP+GK4GfuAv3PqKvxQRDMjdSRZjnkq7KfhlNrCNNlZ0ygQFpebfrnfnq/W7fpUnAv9aGWmY1zKx7FYL3gwhg=="],

    "fill-range": ["fill-range@7.1.1", "", { "dependencies": { "to-regex-range": "^5.0.1" } }, "sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg=="],

+    "finalhandler": ["finalhandler@1.3.1", "", { "dependencies": { "debug": "2.6.9", "encodeurl": "~2.0.0", "escape-html": "~1.0.3", "on-finished": "2.4.1", "parseurl": "~1.3.3", "statuses": "2.0.1", "unpipe": "~1.0.0" } }, "sha512-6BN9trH7bp3qvnrRyzsBz+g3lZxTNZTbVO2EV1CS0WIcDbawYVdYvGflME/9QP0h0pYlCDBCTjYa9nZzMDpyxQ=="],
+
    "flattie": ["flattie@1.1.1", "", {}, "sha512-9UbaD6XdAL97+k/n+N7JwX46K/M6Zc6KcFYskrYL8wbBV/Uyk0CTAMY0VT+qiK5PM7AIc9aTWYtq65U7T+aCNQ=="],

    "fontace": ["fontace@0.3.0", "", { "dependencies": { "@types/fontkit": "^2.0.8", "fontkit": "^2.0.4" } }, "sha512-czoqATrcnxgWb/nAkfyIrRp6Q8biYj7nGnL6zfhTcX+JKKpWHFBnb8uNMw/kZr7u++3Y3wYSYoZgHkCcsuBpBg=="],

    "fontkit": ["fontkit@2.0.4", "", { "dependencies": { "@swc/helpers": "^0.5.12", "brotli": "^1.3.2", "clone": "^2.1.2", "dfa": "^1.2.0", "fast-deep-equal": "^3.1.3", "restructure": "^3.0.0", "tiny-inflate": "^1.0.3", "unicode-properties": "^1.4.0", "unicode-trie": "^2.0.0" } }, "sha512-syetQadaUEDNdxdugga9CpEYVaQIxOwk7GlwZWWZ19//qW4zE5bknOKeMBDYAASwnpaSHKJITRLMF9m1fp3s6g=="],

+    "forwarded": ["forwarded@0.2.0", "", {}, "sha512-buRG0fpBtRHSTCOASe6hD258tEubFoRLb4ZNA6NxMVHNw2gOcwHo9wyablzMzOA5z9xA9L1KNjk/Nt6MT9aYow=="],
+
    "fresh": ["fresh@2.0.0", "", {}, "sha512-Rx/WycZ60HOaqLKAi6cHRKKI7zxWbJ31MhntmtwMoaTeF7XFH9hhBp8vITaMidfljRQ6eYWCKkaTK+ykVJHP2A=="],

    "fsevents": ["fsevents@2.3.3", "", { "os": "darwin" }, "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw=="],

+    "function-bind": ["function-bind@1.1.2", "", {}, "sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA=="],
+
    "fuse.js": ["fuse.js@7.1.0", "", {}, "sha512-trLf4SzuuUxfusZADLINj+dE8clK1frKdmqiJNb1Es75fmI5oY6X2mxLVUciLLjxqw/xr72Dhy+lER6dGd02FQ=="],

    "gensync": ["gensync@1.0.0-beta.2", "", {}, "sha512-3hN7NaskYvMDLQY55gnW3NQ+mesEAepTqlg+VEbj7zzqEMBVNhzcGYYeqFo/TlYz6eQiFcp1HcsCZO+nGgS8zg=="],
@@ -881,8 +934,12 @@

    "get-east-asian-width": ["get-east-asian-width@1.3.0", "", {}, "sha512-vpeMIQKxczTD/0s2CdEWHcb0eeJe6TFjxb+J5xgX7hScxqrGuyjmv4c1D4A/gelKfyox0gJJwIHF+fLjeaM8kQ=="],

+    "get-intrinsic": ["get-intrinsic@1.3.0", "", { "dependencies": { "call-bind-apply-helpers": "^1.0.2", "es-define-property": "^1.0.1", "es-errors": "^1.3.0", "es-object-atoms": "^1.1.1", "function-bind": "^1.1.2", "get-proto": "^1.0.1", "gopd": "^1.2.0", "has-symbols": "^1.1.0", "hasown": "^2.0.2", "math-intrinsics": "^1.1.0" } }, "sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ=="],
+
    "get-nonce": ["get-nonce@1.0.1", "", {}, "sha512-FJhYRoDaiatfEkUK8HKlicmu/3SGFD51q3itKDGoSTysQJBnfOcxU5GxnhE1E6soB76MbT0MBtnKJuXyAx+96Q=="],

+    "get-proto": ["get-proto@1.0.1", "", { "dependencies": { "dunder-proto": "^1.0.1", "es-object-atoms": "^1.0.0" } }, "sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g=="],
+
    "get-tsconfig": ["get-tsconfig@4.10.1", "", { "dependencies": { "resolve-pkg-maps": "^1.0.0" } }, "sha512-auHyJ4AgMz7vgS8Hp3N6HXSmlMdUyhSUrfBF16w153rxtLIEOE+HGqaBppczZvnHLqQJfiHotCYpNhl0lUROFQ=="],

    "github-slugger": ["github-slugger@2.0.0", "", {}, "sha512-IaOQ9puYtjrkq7Y0Ygl9KDZnrf/aiUJYUpVf89y8kyaxbRG7Y1SrX/jaumrv81vc61+kiMempujsM3Yw7w5qcw=="],
@@ -891,12 +948,18 @@

    "globals": ["globals@11.12.0", "", {}, "sha512-WOBp/EEGUiIsJSp7wcv/y6MO+lV9UoncWqxuFfm8eBwzWNgyfBd6Gz+IeKQ9jCmyhoH99g15M3T+QaVHFjizVA=="],

+    "gopd": ["gopd@1.2.0", "", {}, "sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg=="],
+
    "graceful-fs": ["graceful-fs@4.2.11", "", {}, "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ=="],

    "h3": ["h3@1.15.3", "", { "dependencies": { "cookie-es": "^1.2.2", "crossws": "^0.3.4", "defu": "^6.1.4", "destr": "^2.0.5", "iron-webcrypto": "^1.2.1", "node-mock-http": "^1.0.0", "radix3": "^1.1.2", "ufo": "^1.6.1", "uncrypto": "^0.1.3" } }, "sha512-z6GknHqyX0h9aQaTx22VZDf6QyZn+0Nh+Ym8O/u0SGSkyF5cuTJYKlc8MkzW3Nzf9LE1ivcpmYC3FUGpywhuUQ=="],

    "has-flag": ["has-flag@4.0.0", "", {}, "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ=="],

+    "has-symbols": ["has-symbols@1.1.0", "", {}, "sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ=="],
+
+    "hasown": ["hasown@2.0.2", "", { "dependencies": { "function-bind": "^1.1.2" } }, "sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ=="],
+
    "hast-util-from-html": ["hast-util-from-html@2.0.3", "", { "dependencies": { "@types/hast": "^3.0.0", "devlop": "^1.1.0", "hast-util-from-parse5": "^8.0.0", "parse5": "^7.0.0", "vfile": "^6.0.0", "vfile-message": "^4.0.0" } }, "sha512-CUSRHXyKjzHov8yKsQjGOElXy/3EKpyX56ELnkHH34vDVw1N1XSQ1ZcAvTyAPtGqLTuKP/uxM+aLkSPqF/EtMw=="],

    "hast-util-from-parse5": ["hast-util-from-parse5@8.0.3", "", { "dependencies": { "@types/hast": "^3.0.0", "@types/unist": "^3.0.0", "devlop": "^1.0.0", "hastscript": "^9.0.0", "property-information": "^7.0.0", "vfile": "^6.0.0", "vfile-location": "^5.0.0", "web-namespaces": "^2.0.0" } }, "sha512-3kxEVkEKt0zvcZ3hCRYI8rqrgwtlIOFMWkbclACvjlDw8Li9S2hk/d51OI0nr/gIpdMHNepwgOKqZ/sy0Clpyg=="],
@@ -945,6 +1008,8 @@

    "inline-style-parser": ["inline-style-parser@0.2.4", "", {}, "sha512-0aO8FkhNZlj/ZIbNi7Lxxr12obT7cL1moPfE4tg1LkX7LlLfC6DeX4l2ZEud1ukP9jNQyNnfzQVqwbwmAATY4Q=="],

+    "ipaddr.js": ["ipaddr.js@1.9.1", "", {}, "sha512-0KI/607xoxSToH7GjN1FfSbLoU0+btTicjsQSWQlh/hZykN8KpmMf7uYwPW3R+akZ6R/w18ZlXSHBYXiYUPO3g=="],
+
    "iron-webcrypto": ["iron-webcrypto@1.2.1", "", {}, "sha512-feOM6FaSr6rEABp/eDfVseKyTMDt+KGpeB35SkVn9Tyn0CqvVsY3EwI0v5i8nMHyJnzCIQf7nsy3p41TPkJZhg=="],

    "is-alphabetical": ["is-alphabetical@2.0.1", "", {}, "sha512-FWyyY60MeTNyeSRpkM2Iry0G9hpr7/9kD40mD/cGQEuilcZYS4okz8SN2Q6rLCJ8gbCt6fN+rC+6tMGS99LaxQ=="],
@@ -971,13 +1036,15 @@

    "is-plain-obj": ["is-plain-obj@4.1.0", "", {}, "sha512-+Pgi+vMuUNkJyExiMBt5IlFoMyKnr5zhJ4Uspz58WOhBF5QoIZkFyNHIbBAtHwzVAgk5RtndVNsDRN61/mmDqg=="],

+    "is-plain-object": ["is-plain-object@5.0.0", "", {}, "sha512-VRSzKkbMm5jMDoKLbltAkFQ5Qr7VDiTFGXxYFXXowVj387GeGNOCsOH6Msy00SGZ3Fp84b1Naa1psqgcCIEP5Q=="],
+
    "is-potential-custom-element-name": ["is-potential-custom-element-name@1.0.1", "", {}, "sha512-bCYeRA2rVibKZd+s2625gGnGF/t7DSqDs4dP7CrLA1m7jKWz6pps0LpYLJN8Q64HtmPKJ1hrN3nzPNKFEKOUiQ=="],

    "is-wsl": ["is-wsl@3.1.0", "", { "dependencies": { "is-inside-container": "^1.0.0" } }, "sha512-UcVfVfaK4Sc4m7X3dUSoHoozQGBEFeDC+zVo06t98xe8CzHSZZBekNXH+tu0NalHolcJ/QAGqS46Hef7QXBIMw=="],

    "jiti": ["jiti@2.4.2", "", { "bin": { "jiti": "lib/jiti-cli.mjs" } }, "sha512-rg9zJN+G4n2nfJl5MW3BMygZX56zKPNVEYYqq7adpmMh4Jn2QNEwhvQlFy6jPVdcod7txZtKHWnyZiA3a0zP7A=="],

-    "jose": ["jose@6.0.11", "", {}, "sha512-QxG7EaliDARm1O1S8BGakqncGT9s25bKL1WSf6/oa17Tkqwi8D2ZNglqCF+DsYF88/rV66Q/Q2mFAy697E1DUg=="],
+    "jose": ["jose@5.10.0", "", {}, "sha512-s+3Al/p9g32Iq+oqXxkW//7jk2Vig6FF1CFqzVXoTUXt2qz89YWbL+OwS17NFYEvxC35n0FKeGO2LGYSxeM2Gg=="],

    "js-tokens": ["js-tokens@4.0.0", "", {}, "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ=="],

@@ -1059,6 +1126,8 @@

    "markdown-table": ["markdown-table@3.0.4", "", {}, "sha512-wiYz4+JrLyb/DqW2hkFJxP7Vd7JuTDm77fvbM8VfEQdmSMqcImWeeRbHwZjBjIFki/VaMK2BhFi7oUUZeM5bqw=="],

+    "math-intrinsics": ["math-intrinsics@1.1.0", "", {}, "sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g=="],
+
    "mdast-util-definitions": ["mdast-util-definitions@6.0.0", "", { "dependencies": { "@types/mdast": "^4.0.0", "@types/unist": "^3.0.0", "unist-util-visit": "^5.0.0" } }, "sha512-scTllyX6pnYNZH/AIp/0ePz6s4cZtARxImwoPJ7kS42n+MnVsI4XbnG6d4ibehRIldYMWM2LD7ImQblVhUejVQ=="],

    "mdast-util-find-and-replace": ["mdast-util-find-and-replace@3.0.2", "", { "dependencies": { "@types/mdast": "^4.0.0", "escape-string-regexp": "^5.0.0", "unist-util-is": "^6.0.0", "unist-util-visit-parents": "^6.0.0" } }, "sha512-Tmd1Vg/m3Xz43afeNxDIhWRtFZgM2VLyaf4vSTYwudTyeuTneoL3qtWMA5jeLyz/O1vDJmmV4QuScFCA2tBPwg=="],
@@ -1095,8 +1164,14 @@

    "mdn-data": ["mdn-data@2.12.2", "", {}, "sha512-IEn+pegP1aManZuckezWCO+XZQDplx1366JoVhTpMpBB1sPey/SbveZQUosKiKiGYjg1wH4pMlNgXbCiYgihQA=="],

+    "media-typer": ["media-typer@0.3.0", "", {}, "sha512-dq+qelQ9akHpcOl/gUVRTxVIOkAJ1wR3QAvb4RsVjS8oVoFjDGTc679wJYmUmknUF5HwMLOgb5O+a3KxfWapPQ=="],
+
+    "merge-descriptors": ["merge-descriptors@1.0.3", "", {}, "sha512-gaNvAS7TZ897/rVaZ0nMtAyxNyi/pdbjbAwUpFQpN70GqnVfOiXpeUUMKRBmzXaSQ8DdTX4/0ms62r2K+hE6mQ=="],
+
    "merge2": ["merge2@1.4.1", "", {}, "sha512-8q7VEgMJW4J8tcfVPy8g09NcQwZdbwFEqhe/WZkoIzjn/3TGDwtOCYtXGxA3O8tPzpczCCDgv+P2P5y00ZJOOg=="],

+    "methods": ["methods@1.1.2", "", {}, "sha512-iclAHeNqNm68zFtnZ0e+1L2yUIdvzNoauKU4WBA3VvH/vPFieF7qfRlwUZU+DA9P9bPXIS90ulxoUoCH23sV2w=="],
+
    "micromark": ["micromark@4.0.2", "", { "dependencies": { "@types/debug": "^4.0.0", "debug": "^4.0.0", "decode-named-character-reference": "^1.0.0", "devlop": "^1.0.0", "micromark-core-commonmark": "^2.0.0", "micromark-factory-space": "^2.0.0", "micromark-util-character": "^2.0.0", "micromark-util-chunked": "^2.0.0", "micromark-util-combine-extensions": "^2.0.0", "micromark-util-decode-numeric-character-reference": "^2.0.0", "micromark-util-encode": "^2.0.0", "micromark-util-normalize-identifier": "^2.0.0", "micromark-util-resolve-all": "^2.0.0", "micromark-util-sanitize-uri": "^2.0.0", "micromark-util-subtokenize": "^2.0.0", "micromark-util-symbol": "^2.0.0", "micromark-util-types": "^2.0.0" } }, "sha512-zpe98Q6kvavpCr1NPVSCMebCKfD7CA2NqZ+rykeNhONIJBpc1tFKt9hucLGwha3jNTNI8lHpctWJWoimVF4PfA=="],

    "micromark-core-commonmark": ["micromark-core-commonmark@2.0.3", "", { "dependencies": { "decode-named-character-reference": "^1.0.0", "devlop": "^1.0.0", "micromark-factory-destination": "^2.0.0", "micromark-factory-label": "^2.0.0", "micromark-factory-space": "^2.0.0", "micromark-factory-title": "^2.0.0", "micromark-factory-whitespace": "^2.0.0", "micromark-util-character": "^2.0.0", "micromark-util-chunked": "^2.0.0", "micromark-util-classify-character": "^2.0.0", "micromark-util-html-tag-name": "^2.0.0", "micromark-util-normalize-identifier": "^2.0.0", "micromark-util-resolve-all": "^2.0.0", "micromark-util-subtokenize": "^2.0.0", "micromark-util-symbol": "^2.0.0", "micromark-util-types": "^2.0.0" } }, "sha512-RDBrHEMSxVFLg6xvnXmb1Ayr2WzLAWjeSATAoxwKYJV94TeNavgoIdA0a9ytzDSVzBy2YKFK+emCPOEibLeCrg=="],
@@ -1169,6 +1244,8 @@

    "micromatch": ["micromatch@4.0.8", "", { "dependencies": { "braces": "^3.0.3", "picomatch": "^2.3.1" } }, "sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA=="],

+    "mime": ["mime@1.6.0", "", { "bin": { "mime": "cli.js" } }, "sha512-x0Vn8spI+wuJ1O6S7gnbaQg8Pxh4NNHb7KSINmEWKiPE4RKOplvijn+NkmYmmRgP68mc70j2EbeTFRsrswaQeg=="],
+
    "mime-db": ["mime-db@1.54.0", "", {}, "sha512-aU5EJuIN2WDemCcAp2vFBfp/m4EAhWJnUNSSw0ixs7/kXbd6Pg64EmwJkNdFhB8aWt1sH2CTXrLxo/iAGV3oPQ=="],

    "mime-types": ["mime-types@3.0.1", "", { "dependencies": { "mime-db": "^1.54.0" } }, "sha512-xRc4oEhT6eaBpU1XF7AjpOFD+xQmXNB5OVKwp4tqCuBpHLS/ZbBDrc07mYTDqVMg6PfxUjjNp85O6Cd2Z/5HWA=="],
@@ -1191,6 +1268,8 @@

    "nanostores": ["nanostores@0.11.4", "", {}, "sha512-k1oiVNN4hDK8NcNERSZLQiMfRzEGtfnvZvdBvey3SQbgn8Dcrk0h1I6vpxApjb10PFUflZrgJ2WEZyJQ+5v7YQ=="],

+    "negotiator": ["negotiator@0.6.3", "", {}, "sha512-+EUsqGPLsM+j/zdChZjsnX51g4XrHFOIXwfnCVPGlQk/k5giakcKsuxCObBRu6DSm9opw/O6slWbJdghQM4bBg=="],
+
    "neotraverse": ["neotraverse@0.6.18", "", {}, "sha512-Z4SmBUweYa09+o6pG+eASabEpP6QkQ70yHj351pQoEXIs8uHbaU2DWVmzBANKgflPa47A50PtB2+NgRpQvr7vA=="],

    "next-themes": ["next-themes@0.4.6", "", { "peerDependencies": { "react": "^16.8 || ^17 || ^18 || ^19 || ^19.0.0-rc", "react-dom": "^16.8 || ^17 || ^18 || ^19 || ^19.0.0-rc" } }, "sha512-pZvgD5L0IEvX5/9GWyHMf3m8BKiVQwsCMHfoFosXtXBMnaS0ZnIJ9ST4b4NqLVKDEm8QBxoNNGNaBv2JNF6XNA=="],
@@ -1201,14 +1280,24 @@

    "node-fetch-native": ["node-fetch-native@1.6.6", "", {}, "sha512-8Mc2HhqPdlIfedsuZoc3yioPuzp6b+L5jRCRY1QzuWZh2EGJVQrGppC6V6cF0bLdbW0+O2YpqCA25aF/1lvipQ=="],

+    "node-forge": ["node-forge@1.3.1", "", {}, "sha512-dPEtOeMvF9VMcYV/1Wb8CPoVAXtp6MKMlcbAt4ddqmGqUJ6fQZFXkNZNkNlfevtNkGtaSoXf/vNNNSvgrdXwtA=="],
+
    "node-mock-http": ["node-mock-http@1.0.0", "", {}, "sha512-0uGYQ1WQL1M5kKvGRXWQ3uZCHtLTO8hln3oBjIusM75WoesZ909uQJs/Hb946i2SS+Gsrhkaa6iAO17jRIv6DQ=="],

    "node-releases": ["node-releases@2.0.19", "", {}, "sha512-xxOWJsBKtzAq7DY0J+DTzuz58K8e7sJbdgwkbMWQe8UYB6ekmsQ45q0M/tJDsGaZmbC+l7n57UV8Hl5tHxO9uw=="],

+    "node-rsa": ["node-rsa@1.1.1", "", { "dependencies": { "asn1": "^0.2.4" } }, "sha512-Jd4cvbJMryN21r5HgxQOpMEqv+ooke/korixNNK3mGqfGJmy0M77WDDzo/05969+OkMy3XW1UuZsSmW9KQm7Fw=="],
+
    "normalize-path": ["normalize-path@3.0.0", "", {}, "sha512-6eZs5Ls3WtCisHWp9S2GUy8dqkpGi4BVSz3GaqiE6ezub0512ESztXUwUB6C6IKbQkY2Pnb/mD4WYojCRwcwLA=="],

    "nwsapi": ["nwsapi@2.2.20", "", {}, "sha512-/ieB+mDe4MrrKMT8z+mQL8klXydZWGR5Dowt4RAGKbJ3kIGEx3X4ljUo+6V73IXtUPWgfOlU5B9MlGxFO5T+cA=="],

+    "oauth2-mock-server": ["oauth2-mock-server@7.2.1", "", { "dependencies": { "basic-auth": "^2.0.1", "cors": "^2.8.5", "express": "^4.21.2", "is-plain-object": "^5.0.0", "jose": "^5.10.0" }, "bin": { "oauth2-mock-server": "dist\\oauth2-mock-server.js" } }, "sha512-ZXL+VuJU2pvzehseq+7b47ZSN7p2Z7J5GoI793X0oECgdLYdol7tnBbTY/aUxuMkk+xpnE186ZzhnigwCAEBOQ=="],
+
+    "object-assign": ["object-assign@4.1.1", "", {}, "sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg=="],
+
+    "object-inspect": ["object-inspect@1.13.4", "", {}, "sha512-W67iLl4J2EXEGTbfeHCffrjDfitvLANg0UlX3wFUUSTx92KXRFegMHUVgSqE+wvhAbi4WqjGg9czysTV2Epbew=="],
+
    "ofetch": ["ofetch@1.4.1", "", { "dependencies": { "destr": "^2.0.3", "node-fetch-native": "^1.6.4", "ufo": "^1.5.4" } }, "sha512-QZj2DfGplQAr2oj9KzceK9Hwz6Whxazmn85yYeVuS3u9XTMOGMRx0kO95MQ+vLsj/S/NwBDMMLU5hpxvI6Tklw=="],

    "ohash": ["ohash@2.0.11", "", {}, "sha512-RdR9FQrFwNBNXAr4GixM8YaRZRJ5PUWbKYbE5eOsrwAjJW0q2REGcf79oYPsLyskQCZG1PLN+S/K1V00joZAoQ=="],
@@ -1227,7 +1316,7 @@

    "package-manager-detector": ["package-manager-detector@1.3.0", "", {}, "sha512-ZsEbbZORsyHuO00lY1kV3/t72yp6Ysay6Pd17ZAlNGuGwmWDLCJxFpRs0IzfXfj1o4icJOkUEioexFHzyPurSQ=="],

-    "pako": ["pako@0.2.9", "", {}, "sha512-NUcwaKxUxWrZLpDG+z/xZaCgQITkA/Dv4V/T6bw7VON6l1Xz/VnrBqrYjZQ12TamKHzITTfOEIYUj48y2KXImA=="],
+    "pako": ["pako@1.0.11", "", {}, "sha512-4hLB8Py4zZce5s4yd9XzopqwVv/yGNhV1Bl8NTmCq1763HeK2+EwVTv+leGeL13Dnh2wfbqowVPXCIO0z4taYw=="],

    "parse-entities": ["parse-entities@4.0.2", "", { "dependencies": { "@types/unist": "^2.0.0", "character-entities-legacy": "^3.0.0", "character-reference-invalid": "^2.0.0", "decode-named-character-reference": "^1.0.0", "is-alphanumerical": "^2.0.0", "is-decimal": "^2.0.0", "is-hexadecimal": "^2.0.0" } }, "sha512-GG2AQYWoLgL877gQIKeRPGO1xF9+eG1ujIb5soS5gPvLQ1y2o8FL90w2QWNdf9I361Mpp7726c+lj3U0qK1uGw=="],

@@ -1235,8 +1324,12 @@

    "parse5": ["parse5@7.3.0", "", { "dependencies": { "entities": "^6.0.0" } }, "sha512-IInvU7fabl34qmi9gY8XOVxhYyMyuH2xUNpb2q8/Y+7552KlejkRvqvD19nMoUW/uQGGbqNpA6Tufu5FL5BZgw=="],

+    "parseurl": ["parseurl@1.3.3", "", {}, "sha512-CiyeOxFT/JZyN5m0z9PfXw4SCBJ6Sygz1Dpl0wqjlhDEGGBP1GnsUVEL0p63hoG1fcj3fHynXi9NYO4nWOL+qQ=="],
+
    "path-browserify": ["path-browserify@1.0.1", "", {}, "sha512-b7uo2UCUOYZcnF/3ID0lulOJi/bafxa1xPe7ZPsammBSpjSWQkjNxlt635YGS2MiR9GjvuXCtz2emr3jbsz98g=="],

+    "path-to-regexp": ["path-to-regexp@0.1.12", "", {}, "sha512-RA1GjUVMnvYFxuqovrEqZoxxW5NUZqbwKtYz/Tt7nXerk0LbLblQmrsgdeOxV5SFHf0UDggjS/bSeOZwt1pmEQ=="],
+
    "pathe": ["pathe@2.0.3", "", {}, "sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w=="],

    "pathval": ["pathval@2.0.0", "", {}, "sha512-vE7JKRyES09KiunauX7nd2Q9/L7lhok4smP9RZTDeD4MVs72Dp2qNFVz39Nz5a0FVEW0BJR6C0DYrq6unoziZA=="],
@@ -1257,18 +1350,24 @@

    "property-information": ["property-information@7.1.0", "", {}, "sha512-TwEZ+X+yCJmYfL7TPUOcvBZ4QfoT5YenQiJuX//0th53DE6w0xxLEtfK3iyryQFddXuvkIk51EEgrJQ0WJkOmQ=="],

+    "proxy-addr": ["proxy-addr@2.0.7", "", { "dependencies": { "forwarded": "0.2.0", "ipaddr.js": "1.9.1" } }, "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg=="],
+
    "punycode": ["punycode@2.3.1", "", {}, "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg=="],

    "pvtsutils": ["pvtsutils@1.3.6", "", { "dependencies": { "tslib": "^2.8.1" } }, "sha512-PLgQXQ6H2FWCaeRak8vvk1GW462lMxB5s3Jm673N82zI4vqtVUPuZdffdZbPDFRoU8kAhItWFtPCWiPpp4/EDg=="],

    "pvutils": ["pvutils@1.1.3", "", {}, "sha512-pMpnA0qRdFp32b1sJl1wOJNxZLQ2cbQx+k6tjNtZ8CpvVhNqEPRgivZ2WOUev2YMajecdH7ctUPDvEe87nariQ=="],

+    "qs": ["qs@6.13.0", "", { "dependencies": { "side-channel": "^1.0.6" } }, "sha512-+38qI9SOr8tfZ4QmJNplMUxqjbe7LKvvZgWdExBOmd+egZTtjLB67Gu0HRX3u/XOq7UU2Nx6nsjvS16Z9uwfpg=="],
+
    "queue-microtask": ["queue-microtask@1.2.3", "", {}, "sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A=="],

    "radix3": ["radix3@1.1.2", "", {}, "sha512-b484I/7b8rDEdSDKckSSBA8knMpcdsXudlE/LNL639wFoHKwLbEkQFZHWEYwDC0wa0FKUcCY+GAF73Z7wxNVFA=="],

    "range-parser": ["range-parser@1.2.1", "", {}, "sha512-Hrgsx+orqoygnmhFbKaHE6c296J+HTAQXoxEF6gNupROmmGJRoyzfG3ccAveqCBrwr/2yxQ5BVd/GTl5agOwSg=="],

+    "raw-body": ["raw-body@2.5.2", "", { "dependencies": { "bytes": "3.1.2", "http-errors": "2.0.0", "iconv-lite": "0.4.24", "unpipe": "1.0.0" } }, "sha512-8zGqypfENjCIqGhgXToC8aB2r7YrBX+AQAfIPs/Mlk+BtPTztOvTS01NRW/3Eh60J+a48lt8qsCzirQ6loCVfA=="],
+
    "react": ["react@19.1.0", "", {}, "sha512-FS+XFBNvn3GTAWq26joslQgWNoFu08F4kl0J4CgdNKADkdSGXQyTCnKteIAJy96Br6YbpEU1LSzV5dYtjMkMDg=="],

    "react-dom": ["react-dom@19.1.0", "", { "dependencies": { "scheduler": "^0.26.0" }, "peerDependencies": { "react": "^19.1.0" } }, "sha512-Xs1hdnE+DyKgeHJeJznQmYMIBG3TKIHJJT95Q58nHLSrElKlGQqDTR2HQ9fx5CN/Gk6Vh/kupBTDLU11/nDk/g=="],
@@ -1357,6 +1456,8 @@

    "safer-buffer": ["safer-buffer@2.1.2", "", {}, "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg=="],

+    "samlify": ["samlify@2.10.1", "", { "dependencies": { "@authenio/xml-encryption": "^2.0.2", "@xmldom/xmldom": "^0.8.6", "camelcase": "^6.2.0", "node-forge": "^1.3.0", "node-rsa": "^1.1.1", "pako": "^1.0.10", "uuid": "^8.3.2", "xml": "^1.0.1", "xml-crypto": "^6.1.2", "xml-escape": "^1.1.0", "xpath": "^0.0.32" } }, "sha512-4zHbKKTvPnnqfGu4tks26K4fJjsY99ylsP7TPMobW5rggwcsxNlyhLE9ucxW3JFCsUcoKXb77QjQjwQo1TtRgw=="],
+
    "saxes": ["saxes@6.0.0", "", { "dependencies": { "xmlchars": "^2.2.0" } }, "sha512-xAg7SOnEhrm5zI3puOOKyy1OMcMlIJZYNJY7xLBwSze0UjhPLnWfj2GF2EpT0jmzaJKIWKHLsaSSajf35bcYnA=="],

    "scheduler": ["scheduler@0.26.0", "", {}, "sha512-NlHwttCI/l5gCPR3D1nNXtWABUmBwvZpEQiD4IXSbIDq8BzLIK/7Ir5gTFSGZDUu37K5cMNp0hFtzO38sC7gWA=="],
@@ -1365,6 +1466,8 @@

    "send": ["send@1.2.0", "", { "dependencies": { "debug": "^4.3.5", "encodeurl": "^2.0.0", "escape-html": "^1.0.3", "etag": "^1.8.1", "fresh": "^2.0.0", "http-errors": "^2.0.0", "mime-types": "^3.0.1", "ms": "^2.1.3", "on-finished": "^2.4.1", "range-parser": "^1.2.1", "statuses": "^2.0.1" } }, "sha512-uaW0WwXKpL9blXE2o0bRhoL2EGXIrZxQ2ZQ4mgcfoBxdFmQold+qWsD2jLrfZ0trjKL6vOw0j//eAwcALFjKSw=="],

+    "serve-static": ["serve-static@1.16.2", "", { "dependencies": { "encodeurl": "~2.0.0", "escape-html": "~1.0.3", "parseurl": "~1.3.3", "send": "0.19.0" } }, "sha512-VqpjJZKadQB/PEbEwvFdO43Ax5dFBZ2UECszz8bQ7pi7wt//PWe1P6MN7eCnjsatYtBT6EuiClbjSWP2WrIoTw=="],
+
    "server-destroy": ["server-destroy@1.0.1", "", {}, "sha512-rb+9B5YBIEzYcD6x2VKidaa+cqYBJQKnU4oe4E3ANwRRN56yk/ua1YCJT1n21NTS8w6CcOclAKNP3PhdCXKYtQ=="],

    "set-cookie-parser": ["set-cookie-parser@2.7.1", "", {}, "sha512-IOc8uWeOZgnb3ptbCURJWNjWUPcO3ZnTTdzsurqERrP6nPyv+paC55vJM0LpOlT2ne+Ix+9+CRG1MNLlyZ4GjQ=="],
@@ -1375,6 +1478,14 @@

    "shiki": ["shiki@3.4.2", "", { "dependencies": { "@shikijs/core": "3.4.2", "@shikijs/engine-javascript": "3.4.2", "@shikijs/engine-oniguruma": "3.4.2", "@shikijs/langs": "3.4.2", "@shikijs/themes": "3.4.2", "@shikijs/types": "3.4.2", "@shikijs/vscode-textmate": "^10.0.2", "@types/hast": "^3.0.4" } }, "sha512-wuxzZzQG8kvZndD7nustrNFIKYJ1jJoWIPaBpVe2+KHSvtzMi4SBjOxrigs8qeqce/l3U0cwiC+VAkLKSunHQQ=="],

+    "side-channel": ["side-channel@1.1.0", "", { "dependencies": { "es-errors": "^1.3.0", "object-inspect": "^1.13.3", "side-channel-list": "^1.0.0", "side-channel-map": "^1.0.1", "side-channel-weakmap": "^1.0.2" } }, "sha512-ZX99e6tRweoUXqR+VBrslhda51Nh5MTQwou5tnUDgbtyM0dBgmhEDtWGP/xbKn6hqfPRHujUNwz5fy/wbbhnpw=="],
+
+    "side-channel-list": ["side-channel-list@1.0.0", "", { "dependencies": { "es-errors": "^1.3.0", "object-inspect": "^1.13.3" } }, "sha512-FCLHtRD/gnpCiCHEiJLOwdmFP+wzCmDEkc9y7NsYxeF4u7Btsn1ZuwgwJGxImImHicJArLP4R0yX4c2KCrMrTA=="],
+
+    "side-channel-map": ["side-channel-map@1.0.1", "", { "dependencies": { "call-bound": "^1.0.2", "es-errors": "^1.3.0", "get-intrinsic": "^1.2.5", "object-inspect": "^1.13.3" } }, "sha512-VCjCNfgMsby3tTdo02nbjtM/ewra6jPHmpThenkTYh8pG9ucZ/1P8So4u4FGBek/BjpOVsDCMoLA/iuBKIFXRA=="],
+
+    "side-channel-weakmap": ["side-channel-weakmap@1.0.2", "", { "dependencies": { "call-bound": "^1.0.2", "es-errors": "^1.3.0", "get-intrinsic": "^1.2.5", "object-inspect": "^1.13.3", "side-channel-map": "^1.0.1" } }, "sha512-WPS/HvHQTYnHisLo9McqBHOJk2FkHO/tlpvldyrnem4aeQp4hai3gythswg6p01oSoTl58rcpiFAjF2br2Ak2A=="],
+
    "siginfo": ["siginfo@2.0.0", "", {}, "sha512-ybx0WO1/8bSBLEWXZvEd7gMW3Sn3JFlW3TvX1nREbDLRNQNaeNN8WK0meBwPdAaOI7TtRRRJn/Es1zhrrCHu7g=="],

    "simple-swizzle": ["simple-swizzle@0.2.2", "", { "dependencies": { "is-arrayish": "^0.3.1" } }, "sha512-JA//kQgZtbuY83m+xT+tXJkmJncGMTFT+C+g2h2R9uxkYIrE2yy9sgmcLhCnw57/WSD+Eh3J97FPEDFnbXnDUg=="],
@@ -1409,6 +1520,8 @@

    "strip-literal": ["strip-literal@3.0.0", "", { "dependencies": { "js-tokens": "^9.0.1" } }, "sha512-TcccoMhJOM3OebGhSBEmp3UZ2SfDMZUEBdRA/9ynfLi8yYajyWX3JiXArcJt4Umh4vISpspkQIY8ZZoCqjbviA=="],

+    "strnum": ["strnum@2.1.1", "", {}, "sha512-7ZvoFTiCnGxBtDqJ//Cu6fWtZtc7Y3x+QOirG15wztbdngGSkht27o2pyGWrVy0b4WAy3jbKmnoK6g5VlVNUUw=="],
+
    "style-to-js": ["style-to-js@1.1.16", "", { "dependencies": { "style-to-object": "1.0.8" } }, "sha512-/Q6ld50hKYPH3d/r6nr117TZkHR0w0kGGIVfpG9N6D8NymRPM9RqCUv4pRpJ62E5DqOYx2AFpbZMyCPnjQCnOw=="],

    "style-to-object": ["style-to-object@1.0.8", "", { "dependencies": { "inline-style-parser": "0.2.4" } }, "sha512-xT47I/Eo0rwJmaXC4oilDGDWLohVhR6o/xAQcPQN8q6QBuZVL8qMYL85kLmST5cPjAorwvqIA4qXTRQoYHaL6g=="],
@@ -1465,6 +1578,8 @@

    "type-fest": ["type-fest@4.41.0", "", {}, "sha512-TeTSQ6H5YHvpqVwBRcnLDCBnDOHWYu7IvGbHT6N8AOymcr9PJGjc1GTtiWZTYg0NCgYwvnYWEkVChQAr9bjfwA=="],

+    "type-is": ["type-is@1.6.18", "", { "dependencies": { "media-typer": "0.3.0", "mime-types": "~2.1.24" } }, "sha512-TkRKr9sUTxEH8MdfuCSP7VizJyzRNMjj2J2do2Jr3Kym598JVdEksuzPQCnlFPW4ky9Q+iA+ma9BGm06XQBy8g=="],
+
    "typesafe-path": ["typesafe-path@0.2.2", "", {}, "sha512-OJabfkAg1WLZSqJAJ0Z6Sdt3utnbzr/jh+NAHoyWHJe8CMSy79Gm085094M9nvTPy22KzTVn5Zq5mbapCI/hPA=="],

    "typescript": ["typescript@5.8.3", "", { "bin": { "tsc": "bin/tsc", "tsserver": "bin/tsserver" } }, "sha512-p1diW6TqL9L07nNxvRMM7hMMw4c5XOo/1ibL4aAIGmSAt9slTE1Xgw5KWuof2uTOvCg9BY7ZRi+GaF+7sfgPeQ=="],
@@ -1509,6 +1624,8 @@

    "universal-user-agent": ["universal-user-agent@7.0.3", "", {}, "sha512-TmnEAEAsBJVZM/AADELsK76llnwcf9vMKuPz8JflO1frO8Lchitr0fNaN9d+Ap0BjKtqWqd/J17qeDnXh8CL2A=="],

+    "unpipe": ["unpipe@1.0.0", "", {}, "sha512-pjy2bYhSsufwWlKwPc+l3cN7+wuJlK6uz0YdJEOlQDbl6jo/YlPi4mb8agUkVC8BF7V8NuzeyPNqRksA3hztKQ=="],
+
    "unstorage": ["unstorage@1.16.0", "", { "dependencies": { "anymatch": "^3.1.3", "chokidar": "^4.0.3", "destr": "^2.0.5", "h3": "^1.15.2", "lru-cache": "^10.4.3", "node-fetch-native": "^1.6.6", "ofetch": "^1.4.1", "ufo": "^1.6.1" }, "peerDependencies": { "@azure/app-configuration": "^1.8.0", "@azure/cosmos": "^4.2.0", "@azure/data-tables": "^13.3.0", "@azure/identity": "^4.6.0", "@azure/keyvault-secrets": "^4.9.0", "@azure/storage-blob": "^12.26.0", "@capacitor/preferences": "^6.0.3 || ^7.0.0", "@deno/kv": ">=0.9.0", "@netlify/blobs": "^6.5.0 || ^7.0.0 || ^8.1.0", "@planetscale/database": "^1.19.0", "@upstash/redis": "^1.34.3", "@vercel/blob": ">=0.27.1", "@vercel/kv": "^1.0.1", "aws4fetch": "^1.0.20", "db0": ">=0.2.1", "idb-keyval": "^6.2.1", "ioredis": "^5.4.2", "uploadthing": "^7.4.4" }, "optionalPeers": ["@azure/app-configuration", "@azure/cosmos", "@azure/data-tables", "@azure/identity", "@azure/keyvault-secrets", "@azure/storage-blob", "@capacitor/preferences", "@deno/kv", "@netlify/blobs", "@planetscale/database", "@upstash/redis", "@vercel/blob", "@vercel/kv", "aws4fetch", "db0", "idb-keyval", "ioredis", "uploadthing"] }, "sha512-WQ37/H5A7LcRPWfYOrDa1Ys02xAbpPJq6q5GkO88FBXVSQzHd7+BjEwfRqyaSWCv9MbsJy058GWjjPjcJ16GGA=="],

    "update-browserslist-db": ["update-browserslist-db@1.1.3", "", { "dependencies": { "escalade": "^3.2.0", "picocolors": "^1.1.1" }, "peerDependencies": { "browserslist": ">= 4.21.0" }, "bin": { "update-browserslist-db": "cli.js" } }, "sha512-UxhIZQ+QInVdunkDAaiazvvT/+fXL5Osr0JZlJulepYu6Jd7qJtDZjlur0emRlT71EN3ScPoE7gvsuIKKNavKw=="],
@@ -1519,8 +1636,12 @@

    "use-sync-external-store": ["use-sync-external-store@1.5.0", "", { "peerDependencies": { "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0" } }, "sha512-Rb46I4cGGVBmjamjphe8L/UnvJD+uPPtTkNvX5mZgqdbavhI4EbgIWJiIHXJ8bc/i9EQGPRh4DwEURJ552Do0A=="],

+    "utils-merge": ["utils-merge@1.0.1", "", {}, "sha512-pMZTvIkT1d+TFGvDOqodOclx0QWkkgi6Tdoa8gC8ffGAAqz9pzPTZWAybbsHHoED/ztMtkv/VoYTYyShUn81hA=="],
+
    "uuid": ["uuid@11.1.0", "", { "bin": { "uuid": "dist/esm/bin/uuid" } }, "sha512-0/A9rDy9P7cJ+8w1c9WD9V//9Wj15Ce2MPz8Ri6032usz+NfePxx5AcN3bN+r6ZL6jEo066/yNYB3tn4pQEx+A=="],

+    "vary": ["vary@1.1.2", "", {}, "sha512-BNGbWLfd0eUPabhkXUVm0j8uuvREyTh5ovRa/dyow/BqAbZJyC+5fU+IzQOzmAKzYqYRAISoRhdQr3eIZ/PXqg=="],
+
    "vaul": ["vaul@1.1.2", "", { "dependencies": { "@radix-ui/react-dialog": "^1.1.1" }, "peerDependencies": { "react": "^16.8 || ^17.0 || ^18.0 || ^19.0.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0.0 || ^19.0.0-rc" } }, "sha512-ZFkClGpWyI2WUQjdLJ/BaGuV6AVQiJ3uELGk3OYtP+B6yCO7Cmn9vPFXVJkRaGkOJu3m8bQMgtyzNHixULceQA=="],

    "vfile": ["vfile@6.0.3", "", { "dependencies": { "@types/unist": "^3.0.0", "vfile-message": "^4.0.0" } }, "sha512-KzIbH/9tXat2u30jf+smMwFCsno4wHVdNmzFyL+T/L3UGqqk6JKfVqOFOZEpZSHADH1k40ab6NUIXZq422ov3Q=="],
@@ -1593,10 +1714,18 @@

    "ws": ["ws@8.18.2", "", { "peerDependencies": { "bufferutil": "^4.0.1", "utf-8-validate": ">=5.0.2" }, "optionalPeers": ["bufferutil", "utf-8-validate"] }, "sha512-DMricUmwGZUVr++AEAe2uiVM7UoO9MAVZMDu05UQOaUII0lp+zOzLLU4Xqh/JvTqklB1T4uELaaPBKyjE1r4fQ=="],

+    "xml": ["xml@1.0.1", "", {}, "sha512-huCv9IH9Tcf95zuYCsQraZtWnJvBtLVE0QHMOs8bWyZAFZNDcYjsPq1nEx8jKA9y+Beo9v+7OBPRisQTjinQMw=="],
+
+    "xml-crypto": ["xml-crypto@6.1.2", "", { "dependencies": { "@xmldom/is-dom-node": "^1.0.1", "@xmldom/xmldom": "^0.8.10", "xpath": "^0.0.33" } }, "sha512-leBOVQdVi8FvPJrMYoum7Ici9qyxfE4kVi+AkpUoYCSXaQF4IlBm1cneTK9oAxR61LpYxTx7lNcsnBIeRpGW2w=="],
+
+    "xml-escape": ["xml-escape@1.1.0", "", {}, "sha512-B/T4sDK8Z6aUh/qNr7mjKAwwncIljFuUP+DO/D5hloYFj+90O88z8Wf7oSucZTHxBAsC1/CTP4rtx/x1Uf72Mg=="],
+
    "xml-name-validator": ["xml-name-validator@5.0.0", "", {}, "sha512-EvGK8EJ3DhaHfbRlETOWAS5pO9MZITeauHKJyb8wyajUfQUenkIg2MvLDTZ4T/TgIcm3HU0TFBgWWboAZ30UHg=="],

    "xmlchars": ["xmlchars@2.2.0", "", {}, "sha512-JZnDKK8B0RCDw84FNdDAIpZK+JuJw+s7Lz8nksI7SIuU3UXJJslUthsi+uWBUYOwPFwW7W7PRLRfUKpxjtjFCw=="],

+    "xpath": ["xpath@0.0.32", "", {}, "sha512-rxMJhSIoiO8vXcWvSifKqhvV96GjiD5wYb8/QHdoRyQvraTpp4IEv944nhGausZZ3u7dhQXteZuZbaqfpB7uYw=="],
+
    "xxhash-wasm": ["xxhash-wasm@1.1.0", "", {}, "sha512-147y/6YNh+tlp6nd/2pWq38i9h6mz/EuQ6njIrmW8D1BS5nCqs0P6DG+m6zTGnNz5I+uhZ0SHxBs9BsPrwcKDA=="],

    "y18n": ["y18n@5.0.8", "", {}, "sha512-0pfFzegeDWJHJIAmTLRP2DwHjdF5s7jo9tuztdQxAhINCdvS+3nGINqPd00AphqJR/0LhANUS6/+7SCb98YOfA=="],
@@ -1643,6 +1772,10 @@

    "@babel/template/@babel/parser": ["@babel/parser@7.27.3", "", { "dependencies": { "@babel/types": "^7.27.3" }, "bin": "./bin/babel-parser.js" }, "sha512-xyYxRj6+tLNDTWi0KCBcZ9V7yg3/lwL9DWh9Uwh/RIVlIfFidggcgxKX3GCXwCiswwcGRawBKbEg2LG/Y8eJhw=="],

+    "@better-auth/sso/better-auth": ["better-auth@1.3.2", "", { "dependencies": { "@better-auth/utils": "0.2.5", "@better-fetch/fetch": "^1.1.18", "@noble/ciphers": "^0.6.0", "@noble/hashes": "^1.8.0", "@simplewebauthn/browser": "^13.0.0", "@simplewebauthn/server": "^13.0.0", "better-call": "^1.0.12", "defu": "^6.1.4", "jose": "^5.9.6", "kysely": "^0.28.1", "nanostores": "^0.11.3", "zod": "^4.0.5" }, "peerDependencies": { "react": "^18.0.0 || ^19.0.0", "react-dom": "^18.0.0 || ^19.0.0" }, "optionalPeers": ["react", "react-dom"] }, "sha512-510kOtFBTdp4z51hWtTEqk9yqSinXzyg7PkDFnXYMq1K0KvdXRY1A9t9J998i0CSf/tJA0wNoN3S8exkOgBvTw=="],
+
+    "@better-auth/sso/zod": ["zod@3.25.75", "", {}, "sha512-OhpzAmVzabPOL6C3A3gpAifqr9MqihV/Msx3gor2b2kviCgcb+HM9SEOpMWwwNp9MRunWnhtAKUoo0AHhjyPPg=="],
+
    "@esbuild-kit/core-utils/esbuild": ["esbuild@0.18.20", "", { "optionalDependencies": { "@esbuild/android-arm": "0.18.20", "@esbuild/android-arm64": "0.18.20", "@esbuild/android-x64": "0.18.20", "@esbuild/darwin-arm64": "0.18.20", "@esbuild/darwin-x64": "0.18.20", "@esbuild/freebsd-arm64": "0.18.20", "@esbuild/freebsd-x64": "0.18.20", "@esbuild/linux-arm": "0.18.20", "@esbuild/linux-arm64": "0.18.20", "@esbuild/linux-ia32": "0.18.20", "@esbuild/linux-loong64": "0.18.20", "@esbuild/linux-mips64el": "0.18.20", "@esbuild/linux-ppc64": "0.18.20", "@esbuild/linux-riscv64": "0.18.20", "@esbuild/linux-s390x": "0.18.20", "@esbuild/linux-x64": "0.18.20", "@esbuild/netbsd-x64": "0.18.20", "@esbuild/openbsd-x64": "0.18.20", "@esbuild/sunos-x64": "0.18.20", "@esbuild/win32-arm64": "0.18.20", "@esbuild/win32-ia32": "0.18.20", "@esbuild/win32-x64": "0.18.20" }, "bin": { "esbuild": "bin/esbuild" } }, "sha512-ceqxoedUrcayh7Y7ZX6NdbbDzGROiyVBgC4PriJThBKSVPWnnFHZAkfI1lJT8QFkOwH4qOS2SJkS4wvpGl8BpA=="],

    "@rollup/pluginutils/estree-walker": ["estree-walker@2.0.2", "", {}, "sha512-Rfkk/Mp/DL7JVje3u18FxFujQlTNR2q6QfMSMB7AvCBx91NGj/ba3kCfza0f6dVDbw7YlRf/nDrn7pQrCCyQ/w=="],
@@ -1669,12 +1802,24 @@

    "@types/babel__template/@babel/parser": ["@babel/parser@7.27.3", "", { "dependencies": { "@babel/types": "^7.27.3" }, "bin": "./bin/babel-parser.js" }, "sha512-xyYxRj6+tLNDTWi0KCBcZ9V7yg3/lwL9DWh9Uwh/RIVlIfFidggcgxKX3GCXwCiswwcGRawBKbEg2LG/Y8eJhw=="],

+    "accepts/mime-types": ["mime-types@2.1.35", "", { "dependencies": { "mime-db": "1.52.0" } }, "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw=="],
+
    "anymatch/picomatch": ["picomatch@2.3.1", "", {}, "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA=="],

    "astro/zod": ["zod@3.25.75", "", {}, "sha512-OhpzAmVzabPOL6C3A3gpAifqr9MqihV/Msx3gor2b2kviCgcb+HM9SEOpMWwwNp9MRunWnhtAKUoo0AHhjyPPg=="],

+    "basic-auth/safe-buffer": ["safe-buffer@5.1.2", "", {}, "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g=="],
+
+    "better-auth/jose": ["jose@6.0.11", "", {}, "sha512-QxG7EaliDARm1O1S8BGakqncGT9s25bKL1WSf6/oa17Tkqwi8D2ZNglqCF+DsYF88/rV66Q/Q2mFAy697E1DUg=="],
+
    "better-auth/zod": ["zod@3.25.75", "", {}, "sha512-OhpzAmVzabPOL6C3A3gpAifqr9MqihV/Msx3gor2b2kviCgcb+HM9SEOpMWwwNp9MRunWnhtAKUoo0AHhjyPPg=="],

+    "body-parser/debug": ["debug@2.6.9", "", { "dependencies": { "ms": "2.0.0" } }, "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA=="],
+
+    "body-parser/iconv-lite": ["iconv-lite@0.4.24", "", { "dependencies": { "safer-buffer": ">= 2.1.2 < 3" } }, "sha512-v3MXnZAcvnywkTUEZomIActle7RXXeedOR31wwl7VlyoXO4Qi9arvSenNQWne1TcRwhCL1HwLI21bEqdpj8/rA=="],
+
+    "boxen/camelcase": ["camelcase@8.0.0", "", {}, "sha512-8WB3Jcas3swSvjIeA2yvCJ+Miyz5l1ZmB6HFb9R1317dt9LCQoswg/BGrmAmkWVEszSrrg4RwmO46qIm2OEnSA=="],
+
    "boxen/chalk": ["chalk@5.4.1", "", {}, "sha512-zgVZuo2WcZgfUEmsn6eO3kINexW8RAE4maiQ8QNs8CtpPCSyMiYsULR3HQYkm3w8FIA3SberyMJMSldGsW+U3w=="],

    "boxen/string-width": ["string-width@7.2.0", "", { "dependencies": { "emoji-regex": "^10.3.0", "get-east-asian-width": "^1.0.0", "strip-ansi": "^7.1.0" } }, "sha512-tsaTIkKW9b4N+AEj+SVA+WhJzV7/zMhcSu78mLKWSk7cXMOSHsBKFWUs0fWwq8QyK3MgJBQRX6Gbi4kYbdvGkQ=="],
@@ -1683,6 +1828,16 @@

    "cliui/wrap-ansi": ["wrap-ansi@7.0.0", "", { "dependencies": { "ansi-styles": "^4.0.0", "string-width": "^4.1.0", "strip-ansi": "^6.0.0" } }, "sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q=="],

+    "express/cookie": ["cookie@0.7.1", "", {}, "sha512-6DnInpx7SJ2AK3+CTUE/ZM0vWTUboZCegxhC2xiIydHR9jNuTAASBrfEpHhiGOZw/nX51bHt6YQl8jsGo4y/0w=="],
+
+    "express/debug": ["debug@2.6.9", "", { "dependencies": { "ms": "2.0.0" } }, "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA=="],
+
+    "express/fresh": ["fresh@0.5.2", "", {}, "sha512-zJ2mQYM18rEFOudeV4GShTGIQ7RbzA7ozbU9I/XBpm7kqgMywgmylMwXHxZJmkVoYkna9d2pVXVXPdYTP9ej8Q=="],
+
+    "express/send": ["send@0.19.0", "", { "dependencies": { "debug": "2.6.9", "depd": "2.0.0", "destroy": "1.2.0", "encodeurl": "~1.0.2", "escape-html": "~1.0.3", "etag": "~1.8.1", "fresh": "0.5.2", "http-errors": "2.0.0", "mime": "1.6.0", "ms": "2.1.3", "on-finished": "2.4.1", "range-parser": "~1.2.1", "statuses": "2.0.1" } }, "sha512-dW41u5VfLXu8SJh5bwRmyYUbAoSB3c9uQh6L8h/KtsFREPWpbX1lrljJo186Jc4nmci/sGUZ9a0a0J2zgfq2hw=="],
+
+    "finalhandler/debug": ["debug@2.6.9", "", { "dependencies": { "ms": "2.0.0" } }, "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA=="],
+
    "hast-util-to-parse5/property-information": ["property-information@6.5.0", "", {}, "sha512-PgTgs/BlvHxOu8QuEN7wi5A0OmXaBcHpmCSTehcs6Uuu9IkDIEo13Hy7n898RHfrQ49vKCoGeWZSaAK01nwVig=="],

    "magicast/@babel/parser": ["@babel/parser@7.27.3", "", { "dependencies": { "@babel/types": "^7.27.3" }, "bin": "./bin/babel-parser.js" }, "sha512-xyYxRj6+tLNDTWi0KCBcZ9V7yg3/lwL9DWh9Uwh/RIVlIfFidggcgxKX3GCXwCiswwcGRawBKbEg2LG/Y8eJhw=="],
@@ -1697,10 +1852,20 @@

    "prompts/kleur": ["kleur@3.0.3", "", {}, "sha512-eTIzlVOSUR+JxdDFepEYcBMtZ9Qqdef+rnzWdRZuMbOywu5tO2w2N7rqjoANZ5k9vywhL6Br1VRjUIgTQx4E8w=="],

+    "raw-body/iconv-lite": ["iconv-lite@0.4.24", "", { "dependencies": { "safer-buffer": ">= 2.1.2 < 3" } }, "sha512-v3MXnZAcvnywkTUEZomIActle7RXXeedOR31wwl7VlyoXO4Qi9arvSenNQWne1TcRwhCL1HwLI21bEqdpj8/rA=="],
+
+    "samlify/uuid": ["uuid@8.3.2", "", { "bin": { "uuid": "dist/bin/uuid" } }, "sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg=="],
+
+    "serve-static/send": ["send@0.19.0", "", { "dependencies": { "debug": "2.6.9", "depd": "2.0.0", "destroy": "1.2.0", "encodeurl": "~1.0.2", "escape-html": "~1.0.3", "etag": "~1.8.1", "fresh": "0.5.2", "http-errors": "2.0.0", "mime": "1.6.0", "ms": "2.1.3", "on-finished": "2.4.1", "range-parser": "~1.2.1", "statuses": "2.0.1" } }, "sha512-dW41u5VfLXu8SJh5bwRmyYUbAoSB3c9uQh6L8h/KtsFREPWpbX1lrljJo186Jc4nmci/sGUZ9a0a0J2zgfq2hw=="],
+
    "source-map-support/source-map": ["source-map@0.6.1", "", {}, "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g=="],

    "strip-literal/js-tokens": ["js-tokens@9.0.1", "", {}, "sha512-mxa9E9ITFOt0ban3j6L5MpjwegGz6lBQmM1IJkWeBZGcMxto50+eWdjC/52xDbS2vy0k7vIMK0Fe2wfL9OQSpQ=="],

+    "type-is/mime-types": ["mime-types@2.1.35", "", { "dependencies": { "mime-db": "1.52.0" } }, "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw=="],
+
+    "unicode-trie/pako": ["pako@0.2.9", "", {}, "sha512-NUcwaKxUxWrZLpDG+z/xZaCgQITkA/Dv4V/T6bw7VON6l1Xz/VnrBqrYjZQ12TamKHzITTfOEIYUj48y2KXImA=="],
+
    "vscode-json-languageservice/jsonc-parser": ["jsonc-parser@3.3.1", "", {}, "sha512-HUgH65KyejrUFPvHFPbqOY0rsFip3Bo5wb4ngvdi1EpCYWUQDC5V+Y7mZws+DLkr4M//zQJoanu1SP+87Dv1oQ=="],

    "widest-line/string-width": ["string-width@7.2.0", "", { "dependencies": { "emoji-regex": "^10.3.0", "get-east-asian-width": "^1.0.0", "strip-ansi": "^7.1.0" } }, "sha512-tsaTIkKW9b4N+AEj+SVA+WhJzV7/zMhcSu78mLKWSk7cXMOSHsBKFWUs0fWwq8QyK3MgJBQRX6Gbi4kYbdvGkQ=="],
@@ -1711,6 +1876,8 @@

    "wrap-ansi/strip-ansi": ["strip-ansi@7.1.0", "", { "dependencies": { "ansi-regex": "^6.0.1" } }, "sha512-iq6eVVI64nQQTRYq2KtEg2d2uU7LElhTJwsH4YzIHZshxlgZms/wIc4VoDQTlG/IvVIrBKG06CrZnp0qv7hkcQ=="],

+    "xml-crypto/xpath": ["xpath@0.0.33", "", {}, "sha512-NNXnzrkDrAzalLhIUc01jO2mOzXGXh1JwPgkihcLLzw98c0WgYDmmjSh1Kl3wzaxSVWMuA+fe0WTWOBDWCBmNA=="],
+
    "yaml-language-server/request-light": ["request-light@0.5.8", "", {}, "sha512-3Zjgh+8b5fhRJBQZoy+zbVKpAQGLyka0MPgW3zruTF4dFFJ8Fqcfu9YsAvi/rvdcaTeWG3MkbZv4WKxAn/84Lg=="],

    "yaml-language-server/vscode-languageserver": ["vscode-languageserver@7.0.0", "", { "dependencies": { "vscode-languageserver-protocol": "3.16.0" }, "bin": { "installServerIntoExtension": "bin/installServerIntoExtension" } }, "sha512-60HTx5ID+fLRcgdHfmz0LDZAXYEV68fzwG0JWwEPBode9NuMYTIxuYXPg4ngO8i8+Ou0lM7y6GzaYWbiDL0drw=="],
@@ -1727,6 +1894,8 @@

    "@babel/helper-module-transforms/@babel/traverse/@babel/parser": ["@babel/parser@7.27.3", "", { "dependencies": { "@babel/types": "^7.27.3" }, "bin": "./bin/babel-parser.js" }, "sha512-xyYxRj6+tLNDTWi0KCBcZ9V7yg3/lwL9DWh9Uwh/RIVlIfFidggcgxKX3GCXwCiswwcGRawBKbEg2LG/Y8eJhw=="],

+    "@better-auth/sso/better-auth/zod": ["zod@4.0.5", "", {}, "sha512-/5UuuRPStvHXu7RS+gmvRf4NXrNxpSllGwDnCBcJZtQsKrviYXm54yDGV2KYNLT5kq0lHGcl7lqWJLgSaG+tgA=="],
+
    "@esbuild-kit/core-utils/esbuild/@esbuild/android-arm": ["@esbuild/android-arm@0.18.20", "", { "os": "android", "cpu": "arm" }, "sha512-fyi7TDI/ijKKNZTUJAQqiG5T7YjJXgnzkURqmGj13C6dCqckZBLdl4h7bkhHt/t0WP+zO9/zwroDvANaOqO5Sw=="],

    "@esbuild-kit/core-utils/esbuild/@esbuild/android-arm64": ["@esbuild/android-arm64@0.18.20", "", { "os": "android", "cpu": "arm64" }, "sha512-Nz4rJcchGDtENV0eMKUNa6L12zz2zBDXuhj/Vjh18zGqB44Bi7MBMSXjgunJgjRhCmKOjnPuZp4Mb6OKqtMHLQ=="],
@@ -1771,14 +1940,32 @@

    "@esbuild-kit/core-utils/esbuild/@esbuild/win32-x64": ["@esbuild/win32-x64@0.18.20", "", { "os": "win32", "cpu": "x64" }, "sha512-kTdfRcSiDfQca/y9QIkng02avJ+NCaQvrMejlsB3RRv5sE9rRoeBPISaZpKxHELzRxZyLvNts1P27W3wV+8geQ=="],

+    "accepts/mime-types/mime-db": ["mime-db@1.52.0", "", {}, "sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg=="],
+
+    "body-parser/debug/ms": ["ms@2.0.0", "", {}, "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A=="],
+
    "boxen/string-width/emoji-regex": ["emoji-regex@10.4.0", "", {}, "sha512-EC+0oUMY1Rqm4O6LLrgjtYDvcVYTy7chDnM4Q7030tP4Kwj3u/pR6gP9ygnp2CJMK5Gq+9Q2oqmrFJAz01DXjw=="],

    "boxen/string-width/strip-ansi": ["strip-ansi@7.1.0", "", { "dependencies": { "ansi-regex": "^6.0.1" } }, "sha512-iq6eVVI64nQQTRYq2KtEg2d2uU7LElhTJwsH4YzIHZshxlgZms/wIc4VoDQTlG/IvVIrBKG06CrZnp0qv7hkcQ=="],

+    "express/debug/ms": ["ms@2.0.0", "", {}, "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A=="],
+
+    "express/send/encodeurl": ["encodeurl@1.0.2", "", {}, "sha512-TPJXq8JqFaVYm2CWmPvnP2Iyo4ZSM7/QKcSmuMLDObfpH5fi7RUGmd/rTDf+rut/saiDiQEeVTNgAmJEdAOx0w=="],
+
+    "finalhandler/debug/ms": ["ms@2.0.0", "", {}, "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A=="],
+
    "node-fetch/whatwg-url/tr46": ["tr46@0.0.3", "", {}, "sha512-N3WMsuqV66lT30CrXNbEjx4GEwlow3v6rr4mCcv6prnfwhS01rkgyFdjPNBYd9br7LpXV1+Emh01fHnq2Gdgrw=="],

    "node-fetch/whatwg-url/webidl-conversions": ["webidl-conversions@3.0.1", "", {}, "sha512-2JAn3z8AR6rjK8Sm8orRC0h/bcl/DqL7tRPdGZ4I1CjdF+EaMLmYxBHyXuKL849eucPFhvBoxMsflfOb8kxaeQ=="],

+    "serve-static/send/debug": ["debug@2.6.9", "", { "dependencies": { "ms": "2.0.0" } }, "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA=="],
+
+    "serve-static/send/encodeurl": ["encodeurl@1.0.2", "", {}, "sha512-TPJXq8JqFaVYm2CWmPvnP2Iyo4ZSM7/QKcSmuMLDObfpH5fi7RUGmd/rTDf+rut/saiDiQEeVTNgAmJEdAOx0w=="],
+
+    "serve-static/send/fresh": ["fresh@0.5.2", "", {}, "sha512-zJ2mQYM18rEFOudeV4GShTGIQ7RbzA7ozbU9I/XBpm7kqgMywgmylMwXHxZJmkVoYkna9d2pVXVXPdYTP9ej8Q=="],
+
+    "type-is/mime-types/mime-db": ["mime-db@1.52.0", "", {}, "sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg=="],
+
    "widest-line/string-width/emoji-regex": ["emoji-regex@10.4.0", "", {}, "sha512-EC+0oUMY1Rqm4O6LLrgjtYDvcVYTy7chDnM4Q7030tP4Kwj3u/pR6gP9ygnp2CJMK5Gq+9Q2oqmrFJAz01DXjw=="],

    "widest-line/string-width/strip-ansi": ["strip-ansi@7.1.0", "", { "dependencies": { "ansi-regex": "^6.0.1" } }, "sha512-iq6eVVI64nQQTRYq2KtEg2d2uU7LElhTJwsH4YzIHZshxlgZms/wIc4VoDQTlG/IvVIrBKG06CrZnp0qv7hkcQ=="],
@@ -1799,6 +1986,8 @@

    "boxen/string-width/strip-ansi/ansi-regex": ["ansi-regex@6.1.0", "", {}, "sha512-7HSX4QQb4CspciLpVFwyRe79O3xsIZDDLER21kERQ71oaPodF8jL725AgJMFAYbooIqolJoRLuM81SpeUkpkvA=="],

+    "serve-static/send/debug/ms": ["ms@2.0.0", "", {}, "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A=="],
+
    "widest-line/string-width/strip-ansi/ansi-regex": ["ansi-regex@6.1.0", "", {}, "sha512-7HSX4QQb4CspciLpVFwyRe79O3xsIZDDLER21kERQ71oaPodF8jL725AgJMFAYbooIqolJoRLuM81SpeUkpkvA=="],

    "yaml-language-server/vscode-languageserver/vscode-languageserver-protocol/vscode-jsonrpc": ["vscode-jsonrpc@6.0.0", "", {}, "sha512-wnJA4BnEjOSyFMvjZdpiOwhSq9uDoK8e/kpRJDTaMYzwlkrhG1fwDIZI94CLsLzlCK5cIbMMtFlJlfR57Lavmg=="],
--- a/docker-compose.dev.yml
+++ b/docker-compose.dev.yml
@@ -70,6 +70,7 @@ services:
      # GitHub/Gitea Mirror Config
      - GITHUB_USERNAME=${GITHUB_USERNAME:-your-github-username}
      - GITHUB_TOKEN=${GITHUB_TOKEN:-your-github-token}
+      - GITHUB_EXCLUDED_ORGS=${GITHUB_EXCLUDED_ORGS:-}
      - SKIP_FORKS=${SKIP_FORKS:-false}
      - PRIVATE_REPOSITORIES=${PRIVATE_REPOSITORIES:-false}
      - MIRROR_ISSUES=${MIRROR_ISSUES:-false}
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -35,6 +35,7 @@ services:
      # GitHub/Gitea Mirror Config
      - GITHUB_USERNAME=${GITHUB_USERNAME:-}
      - GITHUB_TOKEN=${GITHUB_TOKEN:-}
+      - GITHUB_EXCLUDED_ORGS=${GITHUB_EXCLUDED_ORGS:-}
      - SKIP_FORKS=${SKIP_FORKS:-false}
      - PRIVATE_REPOSITORIES=${PRIVATE_REPOSITORIES:-false}
      - MIRROR_ISSUES=${MIRROR_ISSUES:-false}
--- a/docker-entrypoint.sh
+++ b/docker-entrypoint.sh
@@ -269,82 +269,7 @@ else
    bun scripts/manage-db.ts fix
  fi

-  # Run database migrations
-  echo "Running database migrations..."
-
-  # Update mirror_jobs table with new columns for resilience
-  if [ -f "dist/scripts/update-mirror-jobs-table.js" ]; then
-    echo "Updating mirror_jobs table..."
-    bun dist/scripts/update-mirror-jobs-table.js
-  elif [ -f "scripts/update-mirror-jobs-table.ts" ]; then
-    echo "Updating mirror_jobs table using TypeScript script..."
-    bun scripts/update-mirror-jobs-table.ts
-  else
-    echo "Warning: Could not find mirror_jobs table update script."
-  fi
-
-  # Run v3 migrations if needed
-  echo "Checking for v3 migrations..."
-  
-  # Check if we need to run Better Auth migration (check if accounts table exists)
-  if ! sqlite3 /app/data/gitea-mirror.db "SELECT name FROM sqlite_master WHERE type='table' AND name='accounts';" | grep -q accounts; then
-    echo "🔄 v3 Migration: Creating Better Auth tables..."
-    # Create Better Auth tables
-    sqlite3 /app/data/gitea-mirror.db <<EOF
-    CREATE TABLE IF NOT EXISTS accounts (
-      id TEXT PRIMARY KEY,
-      userId TEXT NOT NULL,
-      accountId TEXT NOT NULL,
-      providerId TEXT NOT NULL,
-      accessToken TEXT,
-      refreshToken TEXT,
-      expiresAt INTEGER,
-      password TEXT,
-      createdAt INTEGER NOT NULL,
-      updatedAt INTEGER NOT NULL,
-      FOREIGN KEY (userId) REFERENCES users(id)
-    );
-    
-    CREATE TABLE IF NOT EXISTS sessions (
-      id TEXT PRIMARY KEY,
-      userId TEXT NOT NULL,
-      token TEXT NOT NULL,
-      expiresAt INTEGER NOT NULL,
-      createdAt INTEGER NOT NULL,
-      updatedAt INTEGER NOT NULL,
-      FOREIGN KEY (userId) REFERENCES users(id)
-    );
-    
-    CREATE TABLE IF NOT EXISTS verification_tokens (
-      id TEXT PRIMARY KEY,
-      identifier TEXT NOT NULL,
-      token TEXT NOT NULL,
-      expires INTEGER NOT NULL
-    );
-    
-    CREATE INDEX IF NOT EXISTS idx_accounts_userId ON accounts(userId);
-    CREATE INDEX IF NOT EXISTS idx_sessions_token ON sessions(token);
-    CREATE INDEX IF NOT EXISTS idx_verification_identifier_token ON verification_tokens(identifier, token);
-EOF
-  fi
-  
-  # Run Better Auth user migration
-  if [ -f "dist/scripts/migrate-better-auth.js" ]; then
-    echo "🔄 v3 Migration: Migrating users to Better Auth..."
-    bun dist/scripts/migrate-better-auth.js
-  elif [ -f "scripts/migrate-better-auth.ts" ]; then
-    echo "🔄 v3 Migration: Migrating users to Better Auth..."
-    bun scripts/migrate-better-auth.ts
-  fi
-  
-  # Run token encryption migration
-  if [ -f "dist/scripts/migrate-tokens-encryption.js" ]; then
-    echo "🔄 v3 Migration: Encrypting stored tokens..."
-    bun dist/scripts/migrate-tokens-encryption.js
-  elif [ -f "scripts/migrate-tokens-encryption.ts" ]; then
-    echo "🔄 v3 Migration: Encrypting stored tokens..."
-    bun scripts/migrate-tokens-encryption.ts
-  fi
+  echo "Database exists, checking integrity..."
 fi

 # Extract version from package.json and set as environment variable
--- a/docs/BUILD_GUIDE.md
+++ b/docs/BUILD_GUIDE.md
@@ -92,6 +92,7 @@ JWT_SECRET=your-secret-here
 # GitHub Configuration
 GITHUB_TOKEN=ghp_...
 GITHUB_WEBHOOK_SECRET=...
+GITHUB_EXCLUDED_ORGS=org1,org2,org3  # Optional: Comma-separated list of organizations to exclude from sync

 # Gitea Configuration
 GITEA_URL=https://your-gitea.com
@@ -202,4 +203,4 @@ Expected build times:

 - Configure with [Configuration Guide](./CONFIGURATION.md)
 - Deploy with [Deployment Guide](./DEPLOYMENT.md)
- Set up authentication with [SSO Guide](./SSO-OIDC-SETUP.md)
+- Set up authentication with [SSO Guide](./SSO-OIDC-SETUP.md)
--- a/package.json
+++ b/package.json
@@ -1,13 +1,13 @@
 {
  "name": "gitea-mirror",
  "type": "module",
-  "version": "3.0.0",
+  "version": "3.1.0",
  "engines": {
    "bun": ">=1.2.9"
  },
  "scripts": {
    "setup": "bun install && bun run manage-db init",
-    "dev": "bunx --bun astro dev --port 4567",
+    "dev": "bunx --bun astro dev --port 9876",
    "dev:clean": "bun run cleanup-db && bun run manage-db init && bunx --bun astro dev",
    "build": "bunx --bun astro build",
    "cleanup-db": "rm -f gitea-mirror.db data/gitea-mirror.db",
@@ -22,8 +22,6 @@
    "db:pull": "bun drizzle-kit pull",
    "db:check": "bun drizzle-kit check",
    "db:studio": "bun drizzle-kit studio",
-    "migrate:better-auth": "bun scripts/migrate-to-better-auth.ts",
-    "migrate:encrypt-tokens": "bun scripts/migrate-tokens-encryption.ts",
    "startup-recovery": "bun scripts/startup-recovery.ts",
    "startup-recovery-force": "bun scripts/startup-recovery.ts --force",
    "test-recovery": "bun scripts/test-recovery.ts",
@@ -43,6 +41,7 @@
    "@astrojs/mdx": "^4.3.0",
    "@astrojs/node": "9.3.0",
    "@astrojs/react": "^4.3.0",
+    "@better-auth/sso": "^1.3.2",
    "@octokit/rest": "^22.0.0",
    "@radix-ui/react-accordion": "^1.2.11",
    "@radix-ui/react-avatar": "^1.1.10",
--- a/scripts/migrate-better-auth.ts
+++ b/scripts/migrate-better-auth.ts
@@ -1,100 +0,0 @@
-#!/usr/bin/env bun
-import { db } from "../src/lib/db";
-import { accounts } from "../src/lib/db/schema";
-import { sql } from "drizzle-orm";
-
-console.log("🔄 Starting Better Auth migration...");
-
-async function migrateToBetterAuth() {
-  try {
-    // Check if migration is needed
-    const existingAccounts = await db.select().from(accounts).limit(1);
-    if (existingAccounts.length > 0) {
-      console.log("✓ Better Auth migration already completed");
-      return;
-    }
-
-    // Check if we have old users table with passwords
-    // This query checks if password column exists in users table
-    const hasPasswordColumn = await db.get<{ count: number }>(
-      sql`SELECT COUNT(*) as count FROM pragma_table_info('users') WHERE name = 'password'`
-    );
-    
-    if (!hasPasswordColumn || hasPasswordColumn.count === 0) {
-      console.log("ℹ️  Users table doesn't have password column - migration may have already been done");
-      
-      // Check if we have any users without accounts
-      const usersWithoutAccounts = await db.all<{ id: string; email: string }>(
-        sql`SELECT u.id, u.email FROM users u LEFT JOIN accounts a ON u.id = a.user_id WHERE a.id IS NULL`
-      );
-      
-      if (usersWithoutAccounts.length === 0) {
-        console.log("✓ All users have accounts - migration complete");
-        return;
-      }
-      
-      console.log(`⚠️  Found ${usersWithoutAccounts.length} users without accounts - they may need to reset passwords`);
-      return;
-    }
-
-    // Get all users with password hashes using raw SQL since the schema doesn't have password
-    const allUsersWithPasswords = await db.all<{ id: string; email: string; username: string; password: string }>(
-      sql`SELECT id, email, username, password FROM users WHERE password IS NOT NULL`
-    );
-    
-    if (allUsersWithPasswords.length === 0) {
-      console.log("ℹ️  No users with passwords to migrate");
-      return;
-    }
-
-    console.log(`📊 Found ${allUsersWithPasswords.length} users to migrate`);
-
-    // Migrate each user
-    for (const user of allUsersWithPasswords) {
-      try {
-        // Create Better Auth account entry
-        await db.insert(accounts).values({
-          id: crypto.randomUUID(),
-          userId: user.id,
-          accountId: user.email, // Use email as account ID
-          providerId: "credential", // Better Auth credential provider
-          providerUserId: null,
-          accessToken: null,
-          refreshToken: null,
-          expiresAt: null,
-          password: user.password, // Move password hash to accounts table
-          createdAt: new Date(),
-          updatedAt: new Date()
-        });
-
-        console.log(`✓ Migrated user: ${user.email}`);
-      } catch (error) {
-        console.error(`❌ Failed to migrate user ${user.email}:`, error);
-        // Continue with other users even if one fails
-      }
-    }
-
-    // Remove password column from users table if it exists
-    console.log("🔄 Cleaning up old password column...");
-    try {
-      // SQLite doesn't support DROP COLUMN directly, so we need to recreate the table
-      // For now, we'll just leave it as is since it's not harmful
-      console.log("ℹ️  Password column left in users table for compatibility");
-    } catch (error) {
-      console.error("⚠️  Could not remove password column:", error);
-    }
-
-    console.log("✅ Better Auth migration completed successfully");
-    
-    // Verify migration
-    const migratedAccounts = await db.select().from(accounts);
-    console.log(`📊 Total accounts after migration: ${migratedAccounts.length}`);
-    
-  } catch (error) {
-    console.error("❌ Better Auth migration failed:", error);
-    process.exit(1);
-  }
-}
-
-// Run migration
-migrateToBetterAuth();
--- a/scripts/migrate-to-better-auth.ts
+++ b/scripts/migrate-to-better-auth.ts
@@ -1,87 +0,0 @@
-#!/usr/bin/env bun
-
-import { db, users, accounts } from "../src/lib/db";
-import { eq } from "drizzle-orm";
-import { v4 as uuidv4 } from "uuid";
-
-/**
- * Migrate existing users to Better Auth schema
- * 
- * This script:
- * 1. Moves existing password hashes from users table to accounts table
- * 2. Updates user data to match Better Auth requirements
- * 3. Creates credential accounts for existing users
- */
-
-async function migrateUsers() {
-  console.log("🔄 Starting user migration to Better Auth...");
-
-  try {
-    // Get all existing users
-    const existingUsers = await db.select().from(users);
-    
-    if (existingUsers.length === 0) {
-      console.log("✅ No users to migrate");
-      return;
-    }
-
-    console.log(`Found ${existingUsers.length} users to migrate`);
-
-    for (const user of existingUsers) {
-      console.log(`\nMigrating user: ${user.username} (${user.email})`);
-
-      // Check if user already has a credential account
-      const existingAccount = await db
-        .select()
-        .from(accounts)
-        .where(
-          eq(accounts.userId, user.id) && 
-          eq(accounts.providerId, "credential")
-        )
-        .limit(1);
-
-      if (existingAccount.length > 0) {
-        console.log("✓ User already migrated");
-        continue;
-      }
-
-      // Create credential account with existing password hash
-      const accountId = uuidv4();
-      await db.insert(accounts).values({
-        id: accountId,
-        accountId: accountId,
-        userId: user.id,
-        providerId: "credential",
-        providerUserId: user.email, // Use email as provider user ID
-        // password: user.password, // Password is not in users table anymore
-        createdAt: user.createdAt,
-        updatedAt: user.updatedAt,
-      });
-
-      console.log("✓ Created credential account");
-
-      // Update user name field if it's null (Better Auth uses 'name' field)
-      // Note: Better Auth expects a 'name' field, but we're using username
-      // This is handled by our additional fields configuration
-    }
-
-    console.log("\n✅ User migration completed successfully!");
-    
-    // Summary
-    const migratedAccounts = await db
-      .select()
-      .from(accounts)
-      .where(eq(accounts.providerId, "credential"));
-    
-    console.log(`\nMigration Summary:`);
-    console.log(`- Total users: ${existingUsers.length}`);
-    console.log(`- Migrated accounts: ${migratedAccounts.length}`);
-
-  } catch (error) {
-    console.error("❌ Migration failed:", error);
-    process.exit(1);
-  }
-}
-
-// Run migration
-migrateUsers();
--- a/scripts/migrate-tokens-encryption.ts
+++ b/scripts/migrate-tokens-encryption.ts
@@ -1,135 +0,0 @@
-#!/usr/bin/env bun
-/**
- * Migration script to encrypt existing GitHub and Gitea tokens in the database
- * Run with: bun run scripts/migrate-tokens-encryption.ts
- */
-
-import { db, configs } from "../src/lib/db";
-import { eq } from "drizzle-orm";
-import { encrypt, isEncrypted, migrateToken } from "../src/lib/utils/encryption";
-
-async function migrateTokens() {
-  console.log("Starting token encryption migration...");
-  
-  try {
-    // Fetch all configs
-    const allConfigs = await db.select().from(configs);
-    
-    console.log(`Found ${allConfigs.length} configurations to check`);
-    
-    let migratedCount = 0;
-    let skippedCount = 0;
-    let errorCount = 0;
-    
-    for (const config of allConfigs) {
-      try {
-        let githubUpdated = false;
-        let giteaUpdated = false;
-        
-        // Parse configs
-        const githubConfig = typeof config.githubConfig === "string"
-          ? JSON.parse(config.githubConfig)
-          : config.githubConfig;
-          
-        const giteaConfig = typeof config.giteaConfig === "string"
-          ? JSON.parse(config.giteaConfig)
-          : config.giteaConfig;
-        
-        // Check and migrate GitHub token
-        if (githubConfig.token) {
-          if (!isEncrypted(githubConfig.token)) {
-            console.log(`Encrypting GitHub token for config ${config.id} (user: ${config.userId})`);
-            githubConfig.token = encrypt(githubConfig.token);
-            githubUpdated = true;
-          } else {
-            console.log(`GitHub token already encrypted for config ${config.id}`);
-          }
-        }
-        
-        // Check and migrate Gitea token
-        if (giteaConfig.token) {
-          if (!isEncrypted(giteaConfig.token)) {
-            console.log(`Encrypting Gitea token for config ${config.id} (user: ${config.userId})`);
-            giteaConfig.token = encrypt(giteaConfig.token);
-            giteaUpdated = true;
-          } else {
-            console.log(`Gitea token already encrypted for config ${config.id}`);
-          }
-        }
-        
-        // Update config if any tokens were migrated
-        if (githubUpdated || giteaUpdated) {
-          await db
-            .update(configs)
-            .set({
-              githubConfig,
-              giteaConfig,
-              updatedAt: new Date(),
-            })
-            .where(eq(configs.id, config.id));
-            
-          migratedCount++;
-          console.log(`✓ Config ${config.id} updated successfully`);
-        } else {
-          skippedCount++;
-        }
-        
-      } catch (error) {
-        errorCount++;
-        console.error(`✗ Error processing config ${config.id}:`, error);
-      }
-    }
-    
-    console.log("\n=== Migration Summary ===");
-    console.log(`Total configs: ${allConfigs.length}`);
-    console.log(`Migrated: ${migratedCount}`);
-    console.log(`Skipped (already encrypted): ${skippedCount}`);
-    console.log(`Errors: ${errorCount}`);
-    
-    if (errorCount > 0) {
-      console.error("\n⚠️  Some configs failed to migrate. Please check the errors above.");
-      process.exit(1);
-    } else {
-      console.log("\n✅ Token encryption migration completed successfully!");
-    }
-    
-  } catch (error) {
-    console.error("Fatal error during migration:", error);
-    process.exit(1);
-  }
-}
-
-// Verify environment setup
-function verifyEnvironment() {
-  const requiredEnvVars = ["ENCRYPTION_SECRET", "JWT_SECRET", "BETTER_AUTH_SECRET"];
-  const availableSecrets = requiredEnvVars.filter(varName => process.env[varName]);
-  
-  if (availableSecrets.length === 0) {
-    console.error("❌ No encryption secret found!");
-    console.error("Please set one of the following environment variables:");
-    console.error("  - ENCRYPTION_SECRET (recommended)");
-    console.error("  - JWT_SECRET");
-    console.error("  - BETTER_AUTH_SECRET");
-    process.exit(1);
-  }
-  
-  console.log(`Using encryption secret from: ${availableSecrets[0]}`);
-}
-
-// Main execution
-async function main() {
-  console.log("=== Gitea Mirror Token Encryption Migration ===\n");
-  
-  // Verify environment
-  verifyEnvironment();
-  
-  // Run migration
-  await migrateTokens();
-  
-  process.exit(0);
-}
-
-main().catch((error) => {
-  console.error("Unexpected error:", error);
-  process.exit(1);
-});
--- a/src/components/NotFound.tsx
+++ b/src/components/NotFound.tsx
@@ -1,4 +1,3 @@
-import React from "react";
 import { Button } from "@/components/ui/button";
 import { Card, CardContent, CardHeader } from "@/components/ui/card";
 import { Home, ArrowLeft, GitBranch, BookOpen, Settings, FileQuestion } from "lucide-react";
--- a/src/components/config/ConfigTabs.tsx
+++ b/src/components/config/ConfigTabs.tsx
@@ -46,7 +46,7 @@ export function ConfigTabs() {
      token: '',
      organization: 'github-mirrors',
      visibility: 'public',
-      starredReposOrg: 'github',
+      starredReposOrg: 'starred',
      preserveOrgStructure: false,
    },
    scheduleConfig: {
--- a/src/components/config/GiteaConfigForm.tsx
+++ b/src/components/config/GiteaConfigForm.tsx
@@ -44,11 +44,13 @@ export function GiteaConfigForm({ config, setConfig, onAutoSave, isAutoSaving, g
      case "preserve":
        newConfig.preserveOrgStructure = true;
        newConfig.mirrorStrategy = "preserve";
+        newConfig.personalReposOrg = undefined; // Clear personal repos org in preserve mode
        break;
      case "single-org":
        newConfig.preserveOrgStructure = false;
        newConfig.mirrorStrategy = "single-org";
-        if (!newConfig.organization) {
+        // Reset to default if coming from mixed mode where it was personal repos org
+        if (config.mirrorStrategy === "mixed" || !newConfig.organization || newConfig.organization === "github-personal") {
          newConfig.organization = "github-mirrors";
        }
        break;
@@ -60,8 +62,10 @@ export function GiteaConfigForm({ config, setConfig, onAutoSave, isAutoSaving, g
      case "mixed":
        newConfig.preserveOrgStructure = false;
        newConfig.mirrorStrategy = "mixed";
-        if (!newConfig.organization) {
-          newConfig.organization = "github-mirrors";
+        // In mixed mode, organization field represents personal repos org
+        // Reset it to default if coming from single-org mode
+        if (config.mirrorStrategy === "single-org" || !newConfig.organization || newConfig.organization === "github-mirrors") {
+          newConfig.organization = "github-personal";
        }
        if (!newConfig.personalReposOrg) {
          newConfig.personalReposOrg = "github-personal";
--- a/src/components/config/OrganizationConfiguration.tsx
+++ b/src/components/config/OrganizationConfiguration.tsx
@@ -104,7 +104,7 @@ export const OrganizationConfiguration: React.FC<OrganizationConfigurationProps>
              id="destinationOrg"
              value={destinationOrg || ""}
              onChange={(e) => onDestinationOrgChange(e.target.value)}
-              placeholder="github-mirrors"
+              placeholder={strategy === "mixed" ? "github-personal" : "github-mirrors"}
              className=""
            />
            <p className="text-xs text-muted-foreground mt-1">
@@ -114,32 +114,6 @@ export const OrganizationConfiguration: React.FC<OrganizationConfigurationProps>
              }
            </p>
          </div>
-        ) : strategy === "preserve" ? (
-          <div className="space-y-1">
-            <Label htmlFor="personalReposOrg" className="text-sm font-normal flex items-center gap-2">
-              Personal Repos Organization
-              <TooltipProvider>
-                <Tooltip>
-                  <TooltipTrigger>
-                    <Info className="h-3.5 w-3.5 text-muted-foreground" />
-                  </TooltipTrigger>
-                  <TooltipContent>
-                    <p>Override where your personal repositories are mirrored (leave empty to use your username)</p>
-                  </TooltipContent>
-                </Tooltip>
-              </TooltipProvider>
-            </Label>
-            <Input
-              id="personalReposOrg"
-              value={personalReposOrg || ""}
-              onChange={(e) => onPersonalReposOrgChange(e.target.value)}
-              placeholder="my-personal-mirrors"
-              className=""
-            />
-            <p className="text-xs text-muted-foreground mt-1">
-              Override destination for your personal repos
-            </p>
-          </div>
        ) : (
          <div className="hidden md:block" />
        )}
--- a/src/components/config/SSOSettings.tsx
+++ b/src/components/config/SSOSettings.tsx
@@ -9,10 +9,12 @@ import { Dialog, DialogContent, DialogDescription, DialogFooter, DialogHeader, D
 import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '@/components/ui/select';
 import { apiRequest, showErrorToast } from '@/lib/utils';
 import { toast } from 'sonner';
-import { Plus, Trash2, ExternalLink, Loader2, AlertCircle, Copy, Shield, Info } from 'lucide-react';
+import { Plus, Trash2, ExternalLink, Loader2, AlertCircle, Shield, Info } from 'lucide-react';
 import { Separator } from '@/components/ui/separator';
 import { Skeleton } from '../ui/skeleton';
 import { Badge } from '../ui/badge';
+import { Tabs, TabsContent, TabsList, TabsTrigger } from '@/components/ui/tabs';
+import { Textarea } from '@/components/ui/textarea';

 interface SSOProvider {
  id: string;
@@ -20,20 +22,35 @@ interface SSOProvider {
  domain: string;
  providerId: string;
  organizationId?: string;
-  oidcConfig: {
+  oidcConfig?: {
    clientId: string;
    clientSecret: string;
    authorizationEndpoint: string;
    tokenEndpoint: string;
-    jwksEndpoint: string;
-    userInfoEndpoint: string;
-    mapping: {
-      id: string;
-      email: string;
-      emailVerified: string;
-      name: string;
-      image: string;
-    };
+    jwksEndpoint?: string;
+    userInfoEndpoint?: string;
+    discoveryEndpoint?: string;
+    scopes?: string[];
+    pkce?: boolean;
+  };
+  samlConfig?: {
+    entryPoint: string;
+    cert: string;
+    callbackUrl?: string;
+    audience?: string;
+    wantAssertionsSigned?: boolean;
+    signatureAlgorithm?: string;
+    digestAlgorithm?: string;
+    identifierFormat?: string;
+  };
+  mapping?: {
+    id: string;
+    email: string;
+    emailVerified?: string;
+    name?: string;
+    image?: string;
+    firstName?: string;
+    lastName?: string;
  };
  createdAt: string;
  updatedAt: string;
@@ -47,16 +64,32 @@ export function SSOSettings() {
  const [headerAuthEnabled, setHeaderAuthEnabled] = useState(false);

  // Form states for new provider
+  const [providerType, setProviderType] = useState<'oidc' | 'saml'>('oidc');
  const [providerForm, setProviderForm] = useState({
+    // Common fields
    issuer: '',
    domain: '',
    providerId: '',
+    organizationId: '',
+    // OIDC fields
    clientId: '',
    clientSecret: '',
    authorizationEndpoint: '',
    tokenEndpoint: '',
    jwksEndpoint: '',
    userInfoEndpoint: '',
+    discoveryEndpoint: '',
+    scopes: ['openid', 'email', 'profile'],
+    pkce: true,
+    // SAML fields
+    entryPoint: '',
+    cert: '',
+    callbackUrl: '',
+    audience: '',
+    wantAssertionsSigned: true,
+    signatureAlgorithm: 'sha256',
+    digestAlgorithm: 'sha256',
+    identifierFormat: 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress',
  });


@@ -69,7 +102,7 @@ export function SSOSettings() {
    setIsLoading(true);
    try {
      const [providersRes, headerAuthStatus] = await Promise.all([
-        apiRequest<SSOProvider[]>('/sso/providers'),
+        apiRequest<SSOProvider[]>('/auth/sso/register'),
        apiRequest<{ enabled: boolean }>('/auth/header-status').catch(() => ({ enabled: false }))
      ]);
      
@@ -101,6 +134,7 @@ export function SSOSettings() {
        tokenEndpoint: discovered.tokenEndpoint || '',
        jwksEndpoint: discovered.jwksEndpoint || '',
        userInfoEndpoint: discovered.userInfoEndpoint || '',
+        discoveryEndpoint: discovered.discoveryEndpoint || `${providerForm.issuer}/.well-known/openid-configuration`,
        domain: discovered.suggestedDomain || prev.domain,
      }));

@@ -114,18 +148,38 @@ export function SSOSettings() {

  const createProvider = async () => {
    try {
-      const newProvider = await apiRequest<SSOProvider>('/sso/providers', {
+      const requestData: any = {
+        providerId: providerForm.providerId,
+        issuer: providerForm.issuer,
+        domain: providerForm.domain,
+        organizationId: providerForm.organizationId || undefined,
+        providerType,
+      };
+
+      if (providerType === 'oidc') {
+        requestData.clientId = providerForm.clientId;
+        requestData.clientSecret = providerForm.clientSecret;
+        requestData.authorizationEndpoint = providerForm.authorizationEndpoint;
+        requestData.tokenEndpoint = providerForm.tokenEndpoint;
+        requestData.jwksEndpoint = providerForm.jwksEndpoint;
+        requestData.userInfoEndpoint = providerForm.userInfoEndpoint;
+        requestData.discoveryEndpoint = providerForm.discoveryEndpoint;
+        requestData.scopes = providerForm.scopes;
+        requestData.pkce = providerForm.pkce;
+      } else {
+        requestData.entryPoint = providerForm.entryPoint;
+        requestData.cert = providerForm.cert;
+        requestData.callbackUrl = providerForm.callbackUrl || `${window.location.origin}/api/auth/sso/saml2/callback/${providerForm.providerId}`;
+        requestData.audience = providerForm.audience || window.location.origin;
+        requestData.wantAssertionsSigned = providerForm.wantAssertionsSigned;
+        requestData.signatureAlgorithm = providerForm.signatureAlgorithm;
+        requestData.digestAlgorithm = providerForm.digestAlgorithm;
+        requestData.identifierFormat = providerForm.identifierFormat;
+      }
+
+      const newProvider = await apiRequest<SSOProvider>('/auth/sso/register', {
        method: 'POST',
-        data: {
-          ...providerForm,
-          mapping: {
-            id: 'sub',
-            email: 'email',
-            emailVerified: 'email_verified',
-            name: 'name',
-            image: 'picture',
-          },
-        },
+        data: requestData,
      });

      setProviders([...providers, newProvider]);
@@ -134,12 +188,24 @@ export function SSOSettings() {
        issuer: '',
        domain: '',
        providerId: '',
+        organizationId: '',
        clientId: '',
        clientSecret: '',
        authorizationEndpoint: '',
        tokenEndpoint: '',
        jwksEndpoint: '',
        userInfoEndpoint: '',
+        discoveryEndpoint: '',
+        scopes: ['openid', 'email', 'profile'],
+        pkce: true,
+        entryPoint: '',
+        cert: '',
+        callbackUrl: '',
+        audience: '',
+        wantAssertionsSigned: true,
+        signatureAlgorithm: 'sha256',
+        digestAlgorithm: 'sha256',
+        identifierFormat: 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress',
      });
      toast.success('SSO provider created successfully');
    } catch (error) {
@@ -264,97 +330,171 @@ export function SSOSettings() {
                    <DialogHeader>
                      <DialogTitle>Add SSO Provider</DialogTitle>
                      <DialogDescription>
-                        Configure an external OIDC provider for user authentication
+                        Configure an external identity provider for user authentication
                      </DialogDescription>
                    </DialogHeader>
-                    <div className="space-y-4">
-                      <div className="space-y-2">
-                        <Label htmlFor="issuer">Issuer URL</Label>
-                        <div className="flex gap-2">
-                          <Input
-                            id="issuer"
-                            value={providerForm.issuer}
-                            onChange={e => setProviderForm(prev => ({ ...prev, issuer: e.target.value }))}
-                            placeholder="https://accounts.google.com"
-                          />
-                          <Button
-                            variant="outline"
-                            onClick={discoverOIDC}
-                            disabled={isDiscovering}
-                          >
-                            {isDiscovering ? <Loader2 className="h-4 w-4 animate-spin" /> : 'Discover'}
-                          </Button>
+                    <Tabs value={providerType} onValueChange={(value) => setProviderType(value as 'oidc' | 'saml')}>
+                      <TabsList className="grid w-full grid-cols-2">
+                        <TabsTrigger value="oidc">OIDC / OAuth2</TabsTrigger>
+                        <TabsTrigger value="saml">SAML 2.0</TabsTrigger>
+                      </TabsList>
+                      
+                      {/* Common Fields */}
+                      <div className="space-y-4 mt-4">
+                        <div className="grid grid-cols-2 gap-4">
+                          <div className="space-y-2">
+                            <Label htmlFor="providerId">Provider ID</Label>
+                            <Input
+                              id="providerId"
+                              value={providerForm.providerId}
+                              onChange={e => setProviderForm(prev => ({ ...prev, providerId: e.target.value }))}
+                              placeholder="google-sso"
+                            />
+                          </div>
+                          <div className="space-y-2">
+                            <Label htmlFor="domain">Email Domain</Label>
+                            <Input
+                              id="domain"
+                              value={providerForm.domain}
+                              onChange={e => setProviderForm(prev => ({ ...prev, domain: e.target.value }))}
+                              placeholder="example.com"
+                            />
+                          </div>
                        </div>
-                      </div>

-                      <div className="grid grid-cols-2 gap-4">
                        <div className="space-y-2">
-                          <Label htmlFor="domain">Domain</Label>
-                          <Input
-                            id="domain"
-                            value={providerForm.domain}
-                            onChange={e => setProviderForm(prev => ({ ...prev, domain: e.target.value }))}
-                            placeholder="example.com"
-                          />
+                          <Label htmlFor="issuer">Issuer URL</Label>
+                          <div className="flex gap-2">
+                            <Input
+                              id="issuer"
+                              value={providerForm.issuer}
+                              onChange={e => setProviderForm(prev => ({ ...prev, issuer: e.target.value }))}
+                              placeholder={providerType === 'oidc' ? "https://accounts.google.com" : "https://idp.example.com"}
+                            />
+                            {providerType === 'oidc' && (
+                              <Button
+                                variant="outline"
+                                onClick={discoverOIDC}
+                                disabled={isDiscovering}
+                              >
+                                {isDiscovering ? <Loader2 className="h-4 w-4 animate-spin" /> : 'Discover'}
+                              </Button>
+                            )}
+                          </div>
                        </div>
+
                        <div className="space-y-2">
-                          <Label htmlFor="providerId">Provider ID</Label>
+                          <Label htmlFor="organizationId">Organization ID (Optional)</Label>
                          <Input
-                            id="providerId"
-                            value={providerForm.providerId}
-                            onChange={e => setProviderForm(prev => ({ ...prev, providerId: e.target.value }))}
-                            placeholder="google-sso"
+                            id="organizationId"
+                            value={providerForm.organizationId}
+                            onChange={e => setProviderForm(prev => ({ ...prev, organizationId: e.target.value }))}
+                            placeholder="org_123"
                          />
+                          <p className="text-xs text-muted-foreground">Link this provider to an organization for automatic user provisioning</p>
                        </div>
                      </div>

-                      <div className="grid grid-cols-2 gap-4">
+                      <TabsContent value="oidc" className="space-y-4">
+                        <div className="grid grid-cols-2 gap-4">
+                          <div className="space-y-2">
+                            <Label htmlFor="clientId">Client ID</Label>
+                            <Input
+                              id="clientId"
+                              value={providerForm.clientId}
+                              onChange={e => setProviderForm(prev => ({ ...prev, clientId: e.target.value }))}
+                            />
+                          </div>
+                          <div className="space-y-2">
+                            <Label htmlFor="clientSecret">Client Secret</Label>
+                            <Input
+                              id="clientSecret"
+                              type="password"
+                              value={providerForm.clientSecret}
+                              onChange={e => setProviderForm(prev => ({ ...prev, clientSecret: e.target.value }))}
+                            />
+                          </div>
+                        </div>
+
                        <div className="space-y-2">
-                          <Label htmlFor="clientId">Client ID</Label>
+                          <Label htmlFor="authEndpoint">Authorization Endpoint</Label>
                          <Input
-                            id="clientId"
-                            value={providerForm.clientId}
-                            onChange={e => setProviderForm(prev => ({ ...prev, clientId: e.target.value }))}
+                            id="authEndpoint"
+                            value={providerForm.authorizationEndpoint}
+                            onChange={e => setProviderForm(prev => ({ ...prev, authorizationEndpoint: e.target.value }))}
+                            placeholder="https://accounts.google.com/o/oauth2/auth"
                          />
                        </div>
+
                        <div className="space-y-2">
-                          <Label htmlFor="clientSecret">Client Secret</Label>
+                          <Label htmlFor="tokenEndpoint">Token Endpoint</Label>
                          <Input
-                            id="clientSecret"
-                            type="password"
-                            value={providerForm.clientSecret}
-                            onChange={e => setProviderForm(prev => ({ ...prev, clientSecret: e.target.value }))}
+                            id="tokenEndpoint"
+                            value={providerForm.tokenEndpoint}
+                            onChange={e => setProviderForm(prev => ({ ...prev, tokenEndpoint: e.target.value }))}
+                            placeholder="https://oauth2.googleapis.com/token"
                          />
                        </div>
-                      </div>

-                      <div className="space-y-2">
-                        <Label htmlFor="authEndpoint">Authorization Endpoint</Label>
-                        <Input
-                          id="authEndpoint"
-                          value={providerForm.authorizationEndpoint}
-                          onChange={e => setProviderForm(prev => ({ ...prev, authorizationEndpoint: e.target.value }))}
-                          placeholder="https://accounts.google.com/o/oauth2/auth"
-                        />
-                      </div>
+                        <div className="flex items-center space-x-2">
+                          <Switch
+                            id="pkce"
+                            checked={providerForm.pkce}
+                            onCheckedChange={(checked) => setProviderForm(prev => ({ ...prev, pkce: checked }))}
+                          />
+                          <Label htmlFor="pkce">Enable PKCE</Label>
+                        </div>

-                      <div className="space-y-2">
-                        <Label htmlFor="tokenEndpoint">Token Endpoint</Label>
-                        <Input
-                          id="tokenEndpoint"
-                          value={providerForm.tokenEndpoint}
-                          onChange={e => setProviderForm(prev => ({ ...prev, tokenEndpoint: e.target.value }))}
-                          placeholder="https://oauth2.googleapis.com/token"
-                        />
-                      </div>
+                        <Alert>
+                          <AlertCircle className="h-4 w-4" />
+                          <AlertDescription>
+                            Redirect URL: {window.location.origin}/api/auth/sso/callback/{providerForm.providerId || '{provider-id}'}
+                          </AlertDescription>
+                        </Alert>
+                      </TabsContent>

-                      <Alert>
-                        <AlertCircle className="h-4 w-4" />
-                        <AlertDescription>
-                          Redirect URL: {window.location.origin}/api/auth/sso/callback/{providerForm.providerId || '{provider-id}'}
-                        </AlertDescription>
-                      </Alert>
-                    </div>
+                      <TabsContent value="saml" className="space-y-4">
+                        <div className="space-y-2">
+                          <Label htmlFor="entryPoint">SAML Entry Point</Label>
+                          <Input
+                            id="entryPoint"
+                            value={providerForm.entryPoint}
+                            onChange={e => setProviderForm(prev => ({ ...prev, entryPoint: e.target.value }))}
+                            placeholder="https://idp.example.com/sso"
+                          />
+                        </div>
+
+                        <div className="space-y-2">
+                          <Label htmlFor="cert">X.509 Certificate</Label>
+                          <Textarea
+                            id="cert"
+                            value={providerForm.cert}
+                            onChange={e => setProviderForm(prev => ({ ...prev, cert: e.target.value }))}
+                            placeholder="-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----"
+                            rows={6}
+                          />
+                        </div>
+
+                        <div className="flex items-center space-x-2">
+                          <Switch
+                            id="wantAssertionsSigned"
+                            checked={providerForm.wantAssertionsSigned}
+                            onCheckedChange={(checked) => setProviderForm(prev => ({ ...prev, wantAssertionsSigned: checked }))}
+                          />
+                          <Label htmlFor="wantAssertionsSigned">Require Signed Assertions</Label>
+                        </div>
+
+                        <Alert>
+                          <AlertCircle className="h-4 w-4" />
+                          <AlertDescription>
+                            <div className="space-y-1">
+                              <p>Callback URL: {window.location.origin}/api/auth/sso/saml2/callback/{providerForm.providerId || '{provider-id}'}</p>
+                              <p>SP Metadata: {window.location.origin}/api/auth/sso/saml2/sp/metadata?providerId={providerForm.providerId || '{provider-id}'}</p>
+                            </div>
+                          </AlertDescription>
+                        </Alert>
+                      </TabsContent>
+                    </Tabs>
                    <DialogFooter>
                      <Button variant="outline" onClick={() => setShowProviderDialog(false)}>
                        Cancel
@@ -391,7 +531,12 @@ export function SSOSettings() {
                      <CardHeader>
                        <div className="flex items-center justify-between">
                          <div>
-                            <h4 className="font-semibold">{provider.providerId}</h4>
+                            <div className="flex items-center gap-2">
+                              <h4 className="font-semibold">{provider.providerId}</h4>
+                              <Badge variant="outline" className="text-xs">
+                                {provider.samlConfig ? 'SAML' : 'OIDC'}
+                              </Badge>
+                            </div>
                            <p className="text-sm text-muted-foreground">{provider.domain}</p>
                          </div>
                          <Button
@@ -407,12 +552,26 @@ export function SSOSettings() {
                        <div className="grid grid-cols-2 gap-4 text-sm">
                          <div>
                            <p className="font-medium">Issuer</p>
-                            <p className="text-muted-foreground">{provider.issuer}</p>
-                          </div>
-                          <div>
-                            <p className="font-medium">Client ID</p>
-                            <p className="text-muted-foreground font-mono">{provider.oidcConfig.clientId}</p>
+                            <p className="text-muted-foreground break-all">{provider.issuer}</p>
                          </div>
+                          {provider.oidcConfig && (
+                            <div>
+                              <p className="font-medium">Client ID</p>
+                              <p className="text-muted-foreground font-mono break-all">{provider.oidcConfig.clientId}</p>
+                            </div>
+                          )}
+                          {provider.samlConfig && (
+                            <div>
+                              <p className="font-medium">Entry Point</p>
+                              <p className="text-muted-foreground break-all">{provider.samlConfig.entryPoint}</p>
+                            </div>
+                          )}
+                          {provider.organizationId && (
+                            <div className="col-span-2">
+                              <p className="font-medium">Organization</p>
+                              <p className="text-muted-foreground">{provider.organizationId}</p>
+                            </div>
+                          )}
                        </div>
                      </CardContent>
                    </Card>
--- a/src/components/organizations/OrganizationsList.tsx
+++ b/src/components/organizations/OrganizationsList.tsx
@@ -281,6 +281,7 @@ export function OrganizationList({
                    <div className="flex items-center gap-3">
                      <Skeleton className="h-4 w-20" />
                      <Skeleton className="h-4 w-20" />
+                      <Skeleton className="h-4 w-20" />
                    </div>
                  ) : (
                    <div className="flex items-center gap-3">
@@ -300,6 +301,14 @@ export function OrganizationList({
                          </span>
                        </div>
                      )}
+                      {org.forkRepositoryCount !== undefined && org.forkRepositoryCount > 0 && (
+                        <div className="flex items-center gap-1.5">
+                          <div className="h-2.5 w-2.5 rounded-full bg-blue-500" />
+                          <span className="text-muted-foreground">
+                            {org.forkRepositoryCount} {org.forkRepositoryCount === 1 ? "fork" : "forks"}
+                          </span>
+                        </div>
+                      )}
                    </div>
                  )}
                </div>
--- a/src/components/repositories/InlineDestinationEditor.tsx
+++ b/src/components/repositories/InlineDestinationEditor.tsx
@@ -48,8 +48,8 @@ export function InlineDestinationEditor({
      if (repository.organization) {
        return repository.organization;
      }
-      // For personal repos, check if personalReposOrg is configured
-      if (!repository.organization && giteaConfig?.personalReposOrg) {
+      // For personal repos, check if personalReposOrg is configured (but not in preserve mode)
+      if (!repository.organization && giteaConfig?.personalReposOrg && strategy !== 'preserve') {
        return giteaConfig.personalReposOrg;
      }
      // Default to the gitea username or owner
--- a/src/components/repositories/Repository.tsx
+++ b/src/components/repositories/Repository.tsx
@@ -9,7 +9,7 @@ import {
  type RepositoryApiResponse,
  type RepoStatus,
 } from "@/types/Repository";
-import { apiRequest, showErrorToast } from "@/lib/utils";
+import { apiRequest, showErrorToast, getStatusColor } from "@/lib/utils";
 import {
  Select,
  SelectContent,
@@ -707,12 +707,7 @@ export default function Repository() {
                        <SelectItem key={status} value={status}>
                          <span className="flex items-center gap-2">
                            {status !== "all" && (
-                              <span className={`h-2 w-2 rounded-full ${
-                                status === "synced" ? "bg-green-500" :
-                                status === "failed" ? "bg-red-500" :
-                                status === "syncing" ? "bg-blue-500" :
-                                "bg-yellow-500"
-                              }`} />
+                              <span className={`h-2 w-2 rounded-full ${getStatusColor(status)}`} />
                            )}
                            {status === "all"
                              ? "All statuses"
@@ -814,12 +809,7 @@ export default function Repository() {
                  <SelectItem key={status} value={status}>
                    <span className="flex items-center gap-2">
                      {status !== "all" && (
-                        <span className={`h-2 w-2 rounded-full ${
-                          status === "synced" ? "bg-green-500" :
-                          status === "failed" ? "bg-red-500" :
-                          status === "syncing" ? "bg-blue-500" :
-                          "bg-yellow-500"
-                        }`} />
+                        <span className={`h-2 w-2 rounded-full ${getStatusColor(status)}`} />
                      )}
                      {status === "all"
                        ? "All statuses"
--- a/src/components/ui/textarea.tsx
+++ b/src/components/ui/textarea.tsx
@@ -0,0 +1,18 @@
+import * as React from "react"
+
+import { cn } from "@/lib/utils"
+
+function Textarea({ className, ...props }: React.ComponentProps<"textarea">) {
+  return (
+    <textarea
+      data-slot="textarea"
+      className={cn(
+        "border-input placeholder:text-muted-foreground focus-visible:border-ring focus-visible:ring-ring/50 aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive dark:bg-input/30 flex field-sizing-content min-h-16 w-full rounded-md border bg-transparent px-3 py-2 text-base shadow-xs transition-[color,box-shadow] outline-none focus-visible:ring-[3px] disabled:cursor-not-allowed disabled:opacity-50 md:text-sm",
+        className
+      )}
+      {...props}
+    />
+  )
+}
+
+export { Textarea }
--- a/src/hooks/useAuth.ts
+++ b/src/hooks/useAuth.ts
@@ -114,7 +114,7 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
  // Create the context value
  const contextValue = {
    user: user as AuthUser | null,
-    session,
+    session: session as Session | null,
    isLoading: isLoading || betterAuthSession.isPending,
    error,
    login,
--- a/src/hooks/useAuthMethods.ts
+++ b/src/hooks/useAuthMethods.ts
@@ -36,7 +36,7 @@ export function useAuthMethods() {
  const loadAuthMethods = async () => {
    try {
      // Check SSO providers
-      const providers = await apiRequest<any[]>('/sso/providers').catch(() => []);
+      const providers = await apiRequest<any[]>('/auth/sso/register').catch(() => []);
      const applications = await apiRequest<any[]>('/sso/applications').catch(() => []);

      setAuthMethods({
--- a/src/lib/auth-client.ts
+++ b/src/lib/auth-client.ts
@@ -1,6 +1,7 @@
 import { createAuthClient } from "better-auth/react";
 import { oidcClient } from "better-auth/client/plugins";
-import { ssoClient } from "better-auth/client/plugins";
+import { ssoClient } from "@better-auth/sso/client";
+import type { Session as BetterAuthSession, User as BetterAuthUser } from "better-auth";

 export const authClient = createAuthClient({
  // The base URL is optional when running on the same domain
@@ -23,6 +24,12 @@ export const {
  getSession
 } = authClient;

-// Export types
-export type Session = Awaited<ReturnType<typeof authClient.getSession>>["data"];
-export type AuthUser = Session extends { user: infer U } ? U : never;
+// Export types - directly use the types from better-auth
+export type Session = BetterAuthSession & {
+  user: BetterAuthUser & {
+    username?: string | null;
+  };
+};
+export type AuthUser = BetterAuthUser & {
+  username?: string | null;
+};
--- a/src/lib/auth-config.ts
+++ b/src/lib/auth-config.ts
@@ -1,70 +0,0 @@
-import { betterAuth } from "better-auth";
-import { drizzleAdapter } from "better-auth/adapters/drizzle";
-import { oidcProvider } from "better-auth/plugins";
-import { sso } from "better-auth/plugins/sso";
-import type { BunSQLiteDatabase } from "drizzle-orm/bun-sqlite";
-
-// This function will be called with the actual database instance
-export function createAuth(db: BunSQLiteDatabase) {
-  return betterAuth({
-    // Database configuration
-    database: drizzleAdapter(db, {
-      provider: "sqlite",
-      usePlural: true, // Our tables use plural names (users, not user)
-    }),
-
-    // Base URL configuration
-    baseURL: process.env.BETTER_AUTH_URL || "http://localhost:3000",
-
-    // Authentication methods
-    emailAndPassword: {
-      enabled: true,
-      requireEmailVerification: false, // We'll enable this later
-      sendResetPassword: async ({ user, url, token }, request) => {
-        // TODO: Implement email sending for password reset
-        console.log("Password reset requested for:", user.email);
-        console.log("Reset URL:", url);
-      },
-    },
-
-    // Session configuration
-    session: {
-      cookieName: "better-auth-session",
-      updateSessionCookieAge: true,
-      expiresIn: 60 * 60 * 24 * 30, // 30 days
-    },
-
-    // User configuration
-    user: {
-      additionalFields: {
-        // We can add custom fields here if needed
-      },
-    },
-
-    // Plugins for OIDC/SSO support
-    plugins: [
-      // SSO plugin for OIDC client support
-      sso({
-        provisionUser: async (data) => {
-          // Custom user provisioning logic for SSO users
-          console.log("Provisioning SSO user:", data);
-          return data;
-        },
-      }),
-      
-      // OIDC Provider plugin (for future use when we want to be an OIDC provider)
-      oidcProvider({
-        loginPage: "/signin",
-        consentPage: "/oauth/consent",
-        metadata: {
-          issuer: process.env.BETTER_AUTH_URL || "http://localhost:3000",
-        },
-      }),
-    ],
-
-    // Trusted origins for CORS
-    trustedOrigins: [
-      process.env.BETTER_AUTH_URL || "http://localhost:3000",
-    ],
-  });
-}
--- a/src/lib/auth-oidc-config.example.ts
+++ b/src/lib/auth-oidc-config.example.ts
@@ -1,179 +0,0 @@
-/**
- * Example OIDC/SSO Configuration for Better Auth
- * 
- * This file demonstrates how to enable OIDC and SSO features in Gitea Mirror.
- * To use: Copy this file to auth-oidc-config.ts and update the auth.ts import.
- */
-
-import { betterAuth } from "better-auth";
-import { drizzleAdapter } from "better-auth/adapters/drizzle";
-import { sso } from "better-auth/plugins/sso";
-import { oidcProvider } from "better-auth/plugins/oidc";
-import type { BunSQLiteDatabase } from "drizzle-orm/bun-sqlite";
-
-export function createAuthWithOIDC(db: BunSQLiteDatabase) {
-  return betterAuth({
-    // Database configuration
-    database: drizzleAdapter(db, {
-      provider: "sqlite",
-      usePlural: true,
-    }),
-
-    // Base configuration
-    baseURL: process.env.BETTER_AUTH_URL || "http://localhost:3000",
-    basePath: "/api/auth",
-
-    // Email/Password authentication
-    emailAndPassword: {
-      enabled: true,
-      requireEmailVerification: false,
-    },
-
-    // Session configuration
-    session: {
-      cookieName: "better-auth-session",
-      updateSessionCookieAge: true,
-      expiresIn: 60 * 60 * 24 * 30, // 30 days
-    },
-
-    // User configuration with additional fields
-    user: {
-      additionalFields: {
-        username: {
-          type: "string",
-          required: true,
-          defaultValue: "user",
-          input: true,
-        }
-      },
-    },
-
-    // OAuth2 providers (examples)
-    socialProviders: {
-      github: {
-        enabled: !!process.env.GITHUB_OAUTH_CLIENT_ID,
-        clientId: process.env.GITHUB_OAUTH_CLIENT_ID!,
-        clientSecret: process.env.GITHUB_OAUTH_CLIENT_SECRET!,
-      },
-      google: {
-        enabled: !!process.env.GOOGLE_OAUTH_CLIENT_ID,
-        clientId: process.env.GOOGLE_OAUTH_CLIENT_ID!,
-        clientSecret: process.env.GOOGLE_OAUTH_CLIENT_SECRET!,
-      },
-    },
-
-    // Plugins
-    plugins: [
-      // SSO Plugin - For OIDC/SAML client functionality
-      sso({
-        // Auto-provision users from SSO providers
-        provisionUser: async (data) => {
-          console.log("Provisioning SSO user:", data.email);
-          
-          // Custom logic to set username from email
-          const username = data.email.split('@')[0];
-          
-          return {
-            ...data,
-            username,
-          };
-        },
-
-        // Organization provisioning for enterprise SSO
-        organizationProvisioning: {
-          disabled: false,
-          defaultRole: "member",
-          getRole: async (user) => {
-            // Custom logic to determine user role
-            // For admin emails, grant admin role
-            if (user.email?.endsWith('@admin.example.com')) {
-              return 'admin';
-            }
-            return 'member';
-          },
-        },
-      }),
-
-      // OIDC Provider Plugin - Makes Gitea Mirror an OIDC provider
-      oidcProvider({
-        // Login page for OIDC authentication flow
-        loginPage: "/login",
-        
-        // Consent page for OAuth2 authorization
-        consentPage: "/oauth/consent",
-        
-        // Allow dynamic client registration
-        allowDynamicClientRegistration: false,
-        
-        // OIDC metadata configuration
-        metadata: {
-          issuer: process.env.BETTER_AUTH_URL || "http://localhost:3000",
-          authorization_endpoint: "/api/auth/oauth2/authorize",
-          token_endpoint: "/api/auth/oauth2/token",
-          userinfo_endpoint: "/api/auth/oauth2/userinfo",
-          jwks_uri: "/api/auth/jwks",
-        },
-
-        // Additional user info claims
-        getAdditionalUserInfoClaim: (user, scopes) => {
-          const claims: Record<string, any> = {};
-          
-          // Add custom claims based on scopes
-          if (scopes.includes('profile')) {
-            claims.username = user.username;
-            claims.preferred_username = user.username;
-          }
-          
-          if (scopes.includes('gitea')) {
-            // Add Gitea-specific claims
-            claims.gitea_admin = false; // Customize based on your logic
-            claims.gitea_repos = []; // Could fetch user's repositories
-          }
-          
-          return claims;
-        },
-      }),
-    ],
-
-    // Trusted origins for CORS
-    trustedOrigins: [
-      process.env.BETTER_AUTH_URL || "http://localhost:3000",
-      // Add your OIDC client domains here
-    ],
-  });
-}
-
-// Environment variables needed:
-/*
-# OAuth2 Providers (optional)
-GITHUB_OAUTH_CLIENT_ID=your-github-client-id
-GITHUB_OAUTH_CLIENT_SECRET=your-github-client-secret
-GOOGLE_OAUTH_CLIENT_ID=your-google-client-id
-GOOGLE_OAUTH_CLIENT_SECRET=your-google-client-secret
-
-# SSO Configuration (when registering providers)
-SSO_PROVIDER_ISSUER=https://idp.example.com
-SSO_PROVIDER_CLIENT_ID=your-client-id
-SSO_PROVIDER_CLIENT_SECRET=your-client-secret
-*/
-
-// Example: Registering an SSO provider programmatically
-/*
-import { authClient } from "./auth-client";
-
-// Register corporate SSO
-await authClient.sso.register({
-  issuer: "https://login.microsoftonline.com/tenant-id/v2.0",
-  domain: "company.com",
-  clientId: process.env.AZURE_CLIENT_ID!,
-  clientSecret: process.env.AZURE_CLIENT_SECRET!,
-  providerId: "azure-ad",
-  mapping: {
-    id: "sub",
-    email: "email",
-    emailVerified: "email_verified",
-    name: "name",
-    image: "picture",
-  },
-});
-*/
--- a/src/lib/auth.ts
+++ b/src/lib/auth.ts
@@ -1,7 +1,7 @@
 import { betterAuth } from "better-auth";
 import { drizzleAdapter } from "better-auth/adapters/drizzle";
 import { oidcProvider } from "better-auth/plugins";
-import { sso } from "better-auth/plugins/sso";
+import { sso } from "@better-auth/sso";
 import { db, users } from "./db";
 import * as schema from "./db/schema";
 import { eq } from "drizzle-orm";
@@ -25,7 +25,7 @@ export const auth = betterAuth({
  emailAndPassword: {
    enabled: true,
    requireEmailVerification: false, // We'll enable this later
-    sendResetPassword: async ({ user, url, token }, request) => {
+    sendResetPassword: async ({ user, url }) => {
      // TODO: Implement email sending for password reset
      console.log("Password reset requested for:", user.email);
      console.log("Reset URL:", url);
@@ -60,6 +60,8 @@ export const auth = betterAuth({
      consentPage: "/oauth/consent",
      // Allow dynamic client registration for flexibility
      allowDynamicClientRegistration: true,
+      // Note: trustedClients would be configured here if Better Auth supports it
+      // For now, we'll use dynamic registration
      // Customize user info claims based on scopes
      getAdditionalUserInfoClaim: (user, scopes) => {
        const claims: Record<string, any> = {};
@@ -73,19 +75,32 @@ export const auth = betterAuth({
    // SSO plugin - allows users to authenticate with external OIDC providers
    sso({
      // Provision new users when they sign in with SSO
-      provisionUser: async (user) => {
+      provisionUser: async ({ user }: { user: any, userInfo: any }) => {
        // Derive username from email if not provided
        const username = user.name || user.email?.split('@')[0] || 'user';
-        return {
-          ...user,
-          username,
-        };
+        
+        // Update user in database if needed
+        await db.update(users)
+          .set({ username })
+          .where(eq(users.id, user.id))
+          .catch(() => {}); // Ignore errors if user doesn't exist yet
      },
      // Organization provisioning settings
      organizationProvisioning: {
        disabled: false,
        defaultRole: "member",
+        getRole: async ({ user, userInfo }: { user: any, userInfo: any }) => {
+          // Check if user has admin attribute from SSO provider
+          const isAdmin = userInfo.attributes?.role === 'admin' ||
+                         userInfo.attributes?.groups?.includes('admins');
+          
+          return isAdmin ? "admin" : "member";
+        },
      },
+      // Override user info with provider data by default
+      defaultOverrideUserInfo: true,
+      // Allow implicit sign up for new users
+      disableImplicitSignUp: false,
    }),
  ],

--- a/src/lib/db/schema.ts
+++ b/src/lib/db/schema.ts
@@ -7,7 +7,7 @@ export const userSchema = z.object({
  id: z.string(),
  username: z.string(),
  password: z.string(),
-  email: z.string().email(),
+  email: z.email(),
  emailVerified: z.boolean().default(false),
  createdAt: z.coerce.date(),
  updatedAt: z.coerce.date(),
@@ -24,12 +24,12 @@ export const githubConfigSchema = z.object({
  includePublic: z.boolean().default(true),
  includeOrganizations: z.array(z.string()).default([]),
  starredReposOrg: z.string().optional(),
-  mirrorStrategy: z.enum(["preserve", "single-org", "flat-user"]).default("preserve"),
+  mirrorStrategy: z.enum(["preserve", "single-org", "flat-user", "mixed"]).default("preserve"),
  defaultOrg: z.string().optional(),
 });

 export const giteaConfigSchema = z.object({
-  url: z.string().url(),
+  url: z.url(),
  token: z.string(),
  defaultOwner: z.string(),
  mirrorInterval: z.string().default("8h"),
@@ -47,6 +47,13 @@ export const giteaConfigSchema = z.object({
  forkStrategy: z
    .enum(["skip", "reference", "full-copy"])
    .default("reference"),
+  // Mirror options
+  mirrorReleases: z.boolean().default(false),
+  mirrorMetadata: z.boolean().default(false),
+  mirrorIssues: z.boolean().default(false),
+  mirrorPullRequests: z.boolean().default(false),
+  mirrorLabels: z.boolean().default(false),
+  mirrorMilestones: z.boolean().default(false),
 });

 export const scheduleConfigSchema = z.object({
@@ -72,6 +79,7 @@ export const scheduleConfigSchema = z.object({

 export const cleanupConfigSchema = z.object({
  enabled: z.boolean().default(false),
+  retentionDays: z.number().default(604800), // 7 days in seconds
  deleteFromGitea: z.boolean().default(false),
  deleteIfNotInGitHub: z.boolean().default(true),
  protectedRepos: z.array(z.string()).default([]),
@@ -104,8 +112,8 @@ export const repositorySchema = z.object({
  configId: z.string(),
  name: z.string(),
  fullName: z.string(),
-  url: z.string().url(),
-  cloneUrl: z.string().url(),
+  url: z.url(),
+  cloneUrl: z.url(),
  owner: z.string(),
  organization: z.string().optional().nullable(),
  mirroredLocation: z.string().default(""),
--- a/src/lib/gitea.test.ts
+++ b/src/lib/gitea.test.ts
@@ -309,17 +309,17 @@ describe("getGiteaRepoOwner - Organization Override Tests", () => {
      excludeOrgs: [],
      mirrorPublicOrgs: false,
      publicOrgs: [],
-      skipStarredIssues: false
+      skipStarredIssues: false,
+      mirrorStrategy: "preserve"
    },
    giteaConfig: {
-      username: "giteauser",
+      defaultOwner: "giteauser",
      url: "https://gitea.example.com",
      token: "gitea-token",
      organization: "github-mirrors",
      visibility: "public",
      starredReposOrg: "starred",
-      preserveOrgStructure: false,
-      mirrorStrategy: "preserve"
+      preserveVisibility: false
    }
  };

@@ -354,19 +354,21 @@ describe("getGiteaRepoOwner - Organization Override Tests", () => {
    expect(result).toBe("starred");
  });

-  test("preserve strategy: personal repos use personalReposOrg override", () => {
-    const configWithOverride = {
+  test("starred repos default to 'starred' org when starredReposOrg is not configured", () => {
+    const repo = { ...baseRepo, isStarred: true };
+    const configWithoutStarredOrg = {
      ...baseConfig,
      giteaConfig: {
-        ...baseConfig.giteaConfig!,
-        personalReposOrg: "my-personal-mirrors"
+        ...baseConfig.giteaConfig,
+        starredReposOrg: undefined
      }
    };
-    const repo = { ...baseRepo, organization: undefined };
-    const result = getGiteaRepoOwner({ config: configWithOverride, repository: repo });
-    expect(result).toBe("my-personal-mirrors");
+    const result = getGiteaRepoOwner({ config: configWithoutStarredOrg, repository: repo });
+    expect(result).toBe("starred");
  });

+  // Removed test for personalReposOrg as this field no longer exists
+
  test("preserve strategy: personal repos fallback to username when no override", () => {
    const repo = { ...baseRepo, organization: undefined };
    const result = getGiteaRepoOwner({ config: baseConfig, repository: repo });
@@ -382,9 +384,12 @@ describe("getGiteaRepoOwner - Organization Override Tests", () => {
  test("mixed strategy: personal repos go to organization", () => {
    const configWithMixed = {
      ...baseConfig,
+      githubConfig: {
+        ...baseConfig.githubConfig!,
+        mirrorStrategy: "mixed" as const
+      },
      giteaConfig: {
        ...baseConfig.giteaConfig!,
-        mirrorStrategy: "mixed" as const,
        organization: "github-mirrors"
      }
    };
@@ -396,9 +401,12 @@ describe("getGiteaRepoOwner - Organization Override Tests", () => {
  test("mixed strategy: org repos preserve their structure", () => {
    const configWithMixed = {
      ...baseConfig,
+      githubConfig: {
+        ...baseConfig.githubConfig!,
+        mirrorStrategy: "mixed" as const
+      },
      giteaConfig: {
        ...baseConfig.giteaConfig!,
-        mirrorStrategy: "mixed" as const,
        organization: "github-mirrors"
      }
    };
@@ -407,18 +415,16 @@ describe("getGiteaRepoOwner - Organization Override Tests", () => {
    expect(result).toBe("myorg");
  });

-  test("mixed strategy: fallback to username if no org configs", () => {
-    const configWithMixed = {
+  test("flat-user strategy: all repos go to defaultOwner", () => {
+    const configWithFlatUser = {
      ...baseConfig,
-      giteaConfig: {
-        ...baseConfig.giteaConfig!,
-        mirrorStrategy: "mixed" as const,
-        organization: undefined,
-        personalReposOrg: undefined
+      githubConfig: {
+        ...baseConfig.githubConfig!,
+        mirrorStrategy: "flat-user" as const
      }
    };
-    const repo = { ...baseRepo, organization: undefined };
-    const result = getGiteaRepoOwner({ config: configWithMixed, repository: repo });
+    const repo = { ...baseRepo, organization: "myorg" };
+    const result = getGiteaRepoOwner({ config: configWithFlatUser, repository: repo });
    expect(result).toBe("giteauser");
  });
 });
--- a/src/lib/gitea.ts
+++ b/src/lib/gitea.ts
@@ -64,7 +64,7 @@ export const getGiteaRepoOwnerAsync = async ({
    throw new Error("GitHub or Gitea config is required.");
  }

-  if (!config.giteaConfig.username) {
+  if (!config.giteaConfig.defaultOwner) {
    throw new Error("Gitea username is required.");
  }

@@ -73,8 +73,8 @@ export const getGiteaRepoOwnerAsync = async ({
  }

  // Check if repository is starred - starred repos always go to starredReposOrg (highest priority)
-  if (repository.isStarred && config.giteaConfig.starredReposOrg) {
-    return config.giteaConfig.starredReposOrg;
+  if (repository.isStarred) {
+    return config.githubConfig.starredReposOrg || "starred";
  }

  // Check for repository-specific override (second highest priority)
@@ -96,11 +96,7 @@ export const getGiteaRepoOwnerAsync = async ({
    }
  }

-  // Check for personal repos override (when it's user's repo, not an organization)
-  if (!repository.organization && config.giteaConfig.personalReposOrg) {
-    console.log(`Using personal repos override: ${config.giteaConfig.personalReposOrg}`);
-    return config.giteaConfig.personalReposOrg;
-  }
+  // For personal repos (not organization repos), fall back to the default strategy

  // Fall back to existing strategy logic
  return getGiteaRepoOwner({ config, repository });
@@ -117,17 +113,17 @@ export const getGiteaRepoOwner = ({
    throw new Error("GitHub or Gitea config is required.");
  }

-  if (!config.giteaConfig.username) {
+  if (!config.giteaConfig.defaultOwner) {
    throw new Error("Gitea username is required.");
  }

  // Check if repository is starred - starred repos always go to starredReposOrg
-  if (repository.isStarred && config.giteaConfig.starredReposOrg) {
-    return config.giteaConfig.starredReposOrg;
+  if (repository.isStarred) {
+    return config.githubConfig.starredReposOrg || "starred";
  }

  // Get the mirror strategy - use preserveOrgStructure for backward compatibility
-  const mirrorStrategy = config.giteaConfig.mirrorStrategy || 
+  const mirrorStrategy = config.githubConfig.mirrorStrategy || 
    (config.giteaConfig.preserveOrgStructure ? "preserve" : "flat-user");

  switch (mirrorStrategy) {
@@ -137,7 +133,7 @@ export const getGiteaRepoOwner = ({
        return repository.organization;
      }
      // Use personal repos override if configured, otherwise use username
-      return config.giteaConfig.personalReposOrg || config.giteaConfig.username;
+      return config.giteaConfig.defaultOwner;

    case "single-org":
      // All non-starred repos go to the destination organization
@@ -145,11 +141,11 @@ export const getGiteaRepoOwner = ({
        return config.giteaConfig.organization;
      }
      // Fallback to username if no organization specified
-      return config.giteaConfig.username;
+      return config.giteaConfig.defaultOwner;

    case "flat-user":
      // All non-starred repos go under the user account
-      return config.giteaConfig.username;
+      return config.giteaConfig.defaultOwner;

    case "mixed":
      // Mixed mode: personal repos to single org, organization repos preserve structure
@@ -162,11 +158,11 @@ export const getGiteaRepoOwner = ({
        return config.giteaConfig.organization;
      }
      // Fallback to username if no organization specified
-      return config.giteaConfig.username;
+      return config.giteaConfig.defaultOwner;

    default:
      // Default fallback
-      return config.giteaConfig.username;
+      return config.giteaConfig.defaultOwner;
  }
 };

@@ -268,10 +264,13 @@ export const mirrorGithubRepoToGitea = async ({
      throw new Error("github config and gitea config are required.");
    }

-    if (!config.giteaConfig.username) {
+    if (!config.giteaConfig.defaultOwner) {
      throw new Error("Gitea username is required.");
    }

+    // Decrypt config tokens for API usage
+    const decryptedConfig = decryptConfigTokens(config as Config);
+
    // Get the correct owner based on the strategy (with organization overrides)
    const repoOwner = await getGiteaRepoOwnerAsync({ config, repository });

@@ -347,14 +346,14 @@ export const mirrorGithubRepoToGitea = async ({

      cloneAddress = repository.cloneUrl.replace(
        "https://",
-        `https://${config.githubConfig.token}@`
+        `https://${decryptedConfig.githubConfig.token}@`
      );
    }

    const apiUrl = `${config.giteaConfig.url}/api/v1/repos/migrate`;

-    // Handle organization creation if needed for single-org or preserve strategies
-    if (repoOwner !== config.giteaConfig.username && !repository.isStarred) {
+    // Handle organization creation if needed for single-org, preserve strategies, or starred repos
+    if (repoOwner !== config.giteaConfig.defaultOwner) {
      // Need to create the organization if it doesn't exist
      await getOrCreateGiteaOrg({
        orgName: repoOwner,
@@ -380,11 +379,13 @@ export const mirrorGithubRepoToGitea = async ({
    );

    //mirror releases
-    await mirrorGitHubReleasesToGitea({
-      config,
-      octokit,
-      repository,
-    });
+    if (config.githubConfig?.mirrorReleases) {
+      await mirrorGitHubReleasesToGitea({
+        config,
+        octokit,
+        repository,
+      });
+    }

    // clone issues
    // Skip issues for starred repos if skipStarredIssues is enabled
@@ -644,6 +645,9 @@ export async function mirrorGitHubRepoToGiteaOrg({
      throw new Error("Gitea config is required.");
    }

+    // Decrypt config tokens for API usage
+    const decryptedConfig = decryptConfigTokens(config as Config);
+
    const isExisting = await isRepoPresentInGitea({
      config,
      owner: orgName,
@@ -698,7 +702,7 @@ export async function mirrorGitHubRepoToGiteaOrg({

      cloneAddress = repository.cloneUrl.replace(
        "https://",
-        `https://${config.githubConfig.token}@`
+        `https://${decryptedConfig.githubConfig.token}@`
      );
    }

@@ -732,11 +736,13 @@ export async function mirrorGitHubRepoToGiteaOrg({
    );

    //mirror releases
-    await mirrorGitHubReleasesToGitea({
-      config,
-      octokit,
-      repository,
-    });
+    if (config.githubConfig?.mirrorReleases) {
+      await mirrorGitHubReleasesToGitea({
+        config,
+        octokit,
+        repository,
+      });
+    }

    // Clone issues
    // Skip issues for starred repos if skipStarredIssues is enabled
@@ -891,7 +897,7 @@ export async function mirrorGitHubOrgToGitea({
    });

    // Get the mirror strategy - use preserveOrgStructure for backward compatibility
-    const mirrorStrategy = config.giteaConfig?.mirrorStrategy ||
+    const mirrorStrategy = config.githubConfig?.mirrorStrategy ||
      (config.giteaConfig?.preserveOrgStructure ? "preserve" : "flat-user");

    let giteaOrgId: number;
@@ -900,7 +906,7 @@ export async function mirrorGitHubOrgToGitea({
    // Determine the target organization based on strategy
    if (mirrorStrategy === "single-org" && config.giteaConfig?.organization) {
      // For single-org strategy, use the configured destination organization
-      targetOrgName = config.giteaConfig.organization;
+      targetOrgName = config.giteaConfig.organization || config.giteaConfig.defaultOwner;
      giteaOrgId = await getOrCreateGiteaOrg({
        orgId: organization.id,
        orgName: targetOrgName,
@@ -919,7 +925,7 @@ export async function mirrorGitHubOrgToGitea({
      // For flat-user strategy, we shouldn't create organizations at all
      // Skip organization creation and let individual repos be handled by getGiteaRepoOwner
      console.log(`Using flat-user strategy: repos will be placed under user account`);
-      targetOrgName = config.giteaConfig?.username || "";
+      targetOrgName = config.giteaConfig?.defaultOwner || "";
    }

    //query the db with the org name and get the repos
@@ -1076,7 +1082,7 @@ export const syncGiteaRepo = async ({
      !config.userId ||
      !config.giteaConfig?.url ||
      !config.giteaConfig?.token ||
-      !config.giteaConfig?.username
+      !config.giteaConfig?.defaultOwner
    ) {
      throw new Error("Gitea config is required.");
    }
@@ -1125,7 +1131,7 @@ export const syncGiteaRepo = async ({
    const apiUrl = `${config.giteaConfig.url}/api/v1/repos/${actualOwner}/${repository.name}/mirror-sync`;

    const response = await httpPost(apiUrl, undefined, {
-      Authorization: `token ${config.giteaConfig.token}`,
+      Authorization: `token ${decryptedConfig.giteaConfig.token}`,
    });

    // Mark repo as "synced" in DB
@@ -1243,7 +1249,7 @@ export const mirrorGitRepoIssuesToGitea = async ({
  const giteaLabelsRes = await httpGet(
    `${config.giteaConfig.url}/api/v1/repos/${giteaOwner}/${repository.name}/labels`,
    {
-      Authorization: `token ${config.giteaConfig.token}`,
+      Authorization: `token ${decryptedConfig.giteaConfig.token}`,
    }
  );

@@ -1399,7 +1405,7 @@ export async function mirrorGitHubReleasesToGitea({
  config: Partial<Config>;
 }) {
  if (
-    !config.giteaConfig?.username ||
+    !config.giteaConfig?.defaultOwner ||
    !config.giteaConfig?.token ||
    !config.giteaConfig?.url
  ) {
--- a/src/lib/github.ts
+++ b/src/lib/github.ts
@@ -52,13 +52,11 @@ export async function getGithubRepositories({
      { per_page: 100 }
    );

-    const includePrivate = config.githubConfig?.privateRepositories ?? false;
    const skipForks = config.githubConfig?.skipForks ?? false;

    const filteredRepos = repos.filter((repo) => {
-      const isPrivateAllowed = includePrivate || !repo.private;
      const isForkAllowed = !skipForks || !repo.fork;
-      return isPrivateAllowed && isForkAllowed;
+      return isForkAllowed;
    });

    return filteredRepos.map((repo) => ({
@@ -174,8 +172,23 @@ export async function getGithubOrganizations({
      per_page: 100,
    });

+    // Get excluded organizations from environment variable
+    const excludedOrgsEnv = process.env.GITHUB_EXCLUDED_ORGS;
+    const excludedOrgs = excludedOrgsEnv
+      ? excludedOrgsEnv.split(',').map(org => org.trim().toLowerCase())
+      : [];
+
+    // Filter out excluded organizations
+    const filteredOrgs = orgs.filter(org => {
+      if (excludedOrgs.includes(org.login.toLowerCase())) {
+        console.log(`Skipping organization ${org.login} - excluded via GITHUB_EXCLUDED_ORGS environment variable`);
+        return false;
+      }
+      return true;
+    });
+
    const organizations = await Promise.all(
-      orgs.map(async (org) => {
+      filteredOrgs.map(async (org) => {
        const [{ data: orgDetails }, { data: membership }] = await Promise.all([
          octokit.orgs.get({ org: org.login }),
          octokit.orgs.getMembershipForAuthenticatedUser({ org: org.login }),
--- a/src/lib/utils.ts
+++ b/src/lib/utils.ts
@@ -197,17 +197,17 @@ export async function apiRequest<T>(
 export const getStatusColor = (status: string): string => {
  switch (status) {
    case "imported":
-      return "bg-blue-500"; // Info/primary-like
+      return "bg-yellow-500"; // Ready to mirror
    case "mirroring":
-      return "bg-yellow-400"; // In progress
+      return "bg-amber-500"; // In progress
    case "mirrored":
-      return "bg-emerald-500"; // Success
+      return "bg-green-500"; // Successfully mirrored
    case "failed":
-      return "bg-rose-500"; // Error
+      return "bg-red-500"; // Error
    case "syncing":
-      return "bg-indigo-500"; // Sync in progress
+      return "bg-blue-500"; // Sync in progress
    case "synced":
-      return "bg-teal-500"; // Sync complete
+      return "bg-emerald-500"; // Successfully synced
    case "skipped":
      return "bg-gray-500"; // Skipped
    case "deleting":
--- a/src/lib/utils/config-mapper.ts
+++ b/src/lib/utils/config-mapper.ts
@@ -9,35 +9,14 @@ import type {
  AdvancedOptions,
  SaveConfigApiRequest 
 } from "@/types/config";
+import { z } from "zod";
+import { githubConfigSchema, giteaConfigSchema, scheduleConfigSchema, cleanupConfigSchema } from "@/lib/db/schema";

-interface DbGitHubConfig {
-  username: string;
-  token?: string;
-  skipForks: boolean;
-  privateRepositories: boolean;
-  mirrorIssues: boolean;
-  mirrorWiki: boolean;
-  mirrorStarred: boolean;
-  useSpecificUser: boolean;
-  singleRepo?: string;
-  includeOrgs: string[];
-  excludeOrgs: string[];
-  mirrorPublicOrgs: boolean;
-  publicOrgs: string[];
-  skipStarredIssues: boolean;
-}
-
-interface DbGiteaConfig {
-  username: string;
-  url: string;
-  token: string;
-  organization?: string;
-  visibility: "public" | "private" | "limited";
-  starredReposOrg: string;
-  preserveOrgStructure: boolean;
-  mirrorStrategy?: "preserve" | "single-org" | "flat-user" | "mixed";
-  personalReposOrg?: string;
-}
+// Use the actual database schema types
+type DbGitHubConfig = z.infer<typeof githubConfigSchema>;
+type DbGiteaConfig = z.infer<typeof giteaConfigSchema>;
+type DbScheduleConfig = z.infer<typeof scheduleConfigSchema>;
+type DbCleanupConfig = z.infer<typeof cleanupConfigSchema>;

 /**
 * Maps UI config structure to database schema structure
@@ -48,32 +27,67 @@ export function mapUiToDbConfig(
  mirrorOptions: MirrorOptions,
  advancedOptions: AdvancedOptions
 ): { githubConfig: DbGitHubConfig; giteaConfig: DbGiteaConfig } {
-  // Map GitHub config with fields from mirrorOptions and advancedOptions
+  // Map GitHub config to match database schema fields
  const dbGithubConfig: DbGitHubConfig = {
-    username: githubConfig.username,
-    token: githubConfig.token,
-    privateRepositories: githubConfig.privateRepositories,
-    mirrorStarred: githubConfig.mirrorStarred,
+    // Map username to owner field
+    owner: githubConfig.username,
+    type: "personal", // Default to personal, could be made configurable
+    token: githubConfig.token || "",
    
-    // From mirrorOptions
-    mirrorIssues: mirrorOptions.mirrorMetadata && mirrorOptions.metadataComponents.issues,
-    mirrorWiki: mirrorOptions.mirrorMetadata && mirrorOptions.metadataComponents.wiki,
+    // Map checkbox fields with proper names
+    includeStarred: githubConfig.mirrorStarred,
+    includePrivate: githubConfig.privateRepositories,
+    includeForks: !advancedOptions.skipForks, // Note: UI has skipForks, DB has includeForks
+    includeArchived: false, // Not in UI yet, default to false
+    includePublic: true, // Not in UI yet, default to true
    
-    // From advancedOptions
-    skipForks: advancedOptions.skipForks,
-    skipStarredIssues: advancedOptions.skipStarredIssues,
+    // Organization related fields
+    includeOrganizations: [], // Not in UI yet
    
-    // Default values for fields not in UI
-    useSpecificUser: false,
-    includeOrgs: [],
-    excludeOrgs: [],
-    mirrorPublicOrgs: false,
-    publicOrgs: [],
+    // Starred repos organization
+    starredReposOrg: giteaConfig.starredReposOrg,
+    
+    // Mirror strategy
+    mirrorStrategy: giteaConfig.mirrorStrategy || "preserve",
+    defaultOrg: giteaConfig.organization,
  };

-  // Gitea config remains mostly the same
+  // Map Gitea config to match database schema
  const dbGiteaConfig: DbGiteaConfig = {
-    ...giteaConfig,
+    url: giteaConfig.url,
+    token: giteaConfig.token,
+    defaultOwner: giteaConfig.username, // Map username to defaultOwner
+    
+    // Mirror interval and options
+    mirrorInterval: "8h", // Default value, could be made configurable
+    lfs: false, // Not in UI yet
+    wiki: mirrorOptions.mirrorMetadata && mirrorOptions.metadataComponents.wiki,
+    
+    // Visibility settings
+    visibility: giteaConfig.visibility || "default",
+    preserveVisibility: giteaConfig.preserveOrgStructure,
+    
+    // Organization creation
+    createOrg: true, // Default to true
+    
+    // Template settings (not in UI yet)
+    templateOwner: undefined,
+    templateRepo: undefined,
+    
+    // Topics
+    addTopics: true, // Default to true
+    topicPrefix: undefined,
+    
+    // Fork strategy
+    forkStrategy: advancedOptions.skipForks ? "skip" : "reference",
+    
+    // Mirror options from UI
+    mirrorReleases: mirrorOptions.mirrorReleases,
+    mirrorMetadata: mirrorOptions.mirrorMetadata,
+    mirrorIssues: mirrorOptions.mirrorMetadata && mirrorOptions.metadataComponents.issues,
+    mirrorPullRequests: mirrorOptions.mirrorMetadata && mirrorOptions.metadataComponents.pullRequests,
+    mirrorLabels: mirrorOptions.mirrorMetadata && mirrorOptions.metadataComponents.labels,
+    mirrorMilestones: mirrorOptions.mirrorMetadata && mirrorOptions.metadataComponents.milestones,
  };

  return {
@@ -91,40 +105,44 @@ export function mapDbToUiConfig(dbConfig: any): {
  mirrorOptions: MirrorOptions;
  advancedOptions: AdvancedOptions;
 } {
+  // Map from database GitHub config to UI fields
  const githubConfig: GitHubConfig = {
-    username: dbConfig.githubConfig?.username || "",
+    username: dbConfig.githubConfig?.owner || "", // Map owner to username
    token: dbConfig.githubConfig?.token || "",
-    privateRepositories: dbConfig.githubConfig?.privateRepositories || false,
-    mirrorStarred: dbConfig.githubConfig?.mirrorStarred || false,
+    privateRepositories: dbConfig.githubConfig?.includePrivate || false, // Map includePrivate to privateRepositories
+    mirrorStarred: dbConfig.githubConfig?.includeStarred || false, // Map includeStarred to mirrorStarred
  };

+  // Map from database Gitea config to UI fields
  const giteaConfig: GiteaConfig = {
    url: dbConfig.giteaConfig?.url || "",
-    username: dbConfig.giteaConfig?.username || "",
+    username: dbConfig.giteaConfig?.defaultOwner || "", // Map defaultOwner to username
    token: dbConfig.giteaConfig?.token || "",
-    organization: dbConfig.giteaConfig?.organization || "github-mirrors",
-    visibility: dbConfig.giteaConfig?.visibility || "public",
-    starredReposOrg: dbConfig.giteaConfig?.starredReposOrg || "github",
-    preserveOrgStructure: dbConfig.giteaConfig?.preserveOrgStructure || false,
-    mirrorStrategy: dbConfig.giteaConfig?.mirrorStrategy,
-    personalReposOrg: dbConfig.giteaConfig?.personalReposOrg,
+    organization: dbConfig.githubConfig?.defaultOrg || "github-mirrors", // Get from GitHub config
+    visibility: dbConfig.giteaConfig?.visibility === "default" ? "public" : dbConfig.giteaConfig?.visibility || "public",
+    starredReposOrg: dbConfig.githubConfig?.starredReposOrg || "starred", // Get from GitHub config
+    preserveOrgStructure: dbConfig.giteaConfig?.preserveVisibility || false, // Map preserveVisibility
+    mirrorStrategy: dbConfig.githubConfig?.mirrorStrategy || "preserve", // Get from GitHub config
+    personalReposOrg: undefined, // Not stored in current schema
  };

+  // Map mirror options from various database fields
  const mirrorOptions: MirrorOptions = {
-    mirrorReleases: false, // Not stored in DB yet
-    mirrorMetadata: dbConfig.githubConfig?.mirrorIssues || dbConfig.githubConfig?.mirrorWiki || false,
+    mirrorReleases: dbConfig.giteaConfig?.mirrorReleases || false,
+    mirrorMetadata: dbConfig.giteaConfig?.mirrorMetadata || false,
    metadataComponents: {
-      issues: dbConfig.githubConfig?.mirrorIssues || false,
-      pullRequests: false, // Not stored in DB yet
-      labels: false, // Not stored in DB yet
-      milestones: false, // Not stored in DB yet
-      wiki: dbConfig.githubConfig?.mirrorWiki || false,
+      issues: dbConfig.giteaConfig?.mirrorIssues || false,
+      pullRequests: dbConfig.giteaConfig?.mirrorPullRequests || false,
+      labels: dbConfig.giteaConfig?.mirrorLabels || false,
+      milestones: dbConfig.giteaConfig?.mirrorMilestones || false,
+      wiki: dbConfig.giteaConfig?.wiki || false,
    },
  };

+  // Map advanced options
  const advancedOptions: AdvancedOptions = {
-    skipForks: dbConfig.githubConfig?.skipForks || false,
-    skipStarredIssues: dbConfig.githubConfig?.skipStarredIssues || false,
+    skipForks: !(dbConfig.githubConfig?.includeForks ?? true), // Invert includeForks to get skipForks
+    skipStarredIssues: false, // Not stored in current schema
  };

  return {
@@ -133,4 +151,74 @@ export function mapDbToUiConfig(dbConfig: any): {
    mirrorOptions,
    advancedOptions,
  };
+}
+
+/**
+ * Maps UI schedule config to database schema
+ */
+export function mapUiScheduleToDb(uiSchedule: any): DbScheduleConfig {
+  return {
+    enabled: uiSchedule.enabled || false,
+    interval: uiSchedule.interval ? `0 */${Math.floor(uiSchedule.interval / 3600)} * * *` : "0 2 * * *", // Convert seconds to cron expression
+    concurrent: false,
+    batchSize: 10,
+    pauseBetweenBatches: 5000,
+    retryAttempts: 3,
+    retryDelay: 60000,
+    timeout: 3600000,
+    autoRetry: true,
+    cleanupBeforeMirror: false,
+    notifyOnFailure: true,
+    notifyOnSuccess: false,
+    logLevel: "info",
+    timezone: "UTC",
+    onlyMirrorUpdated: false,
+    updateInterval: 86400000,
+    skipRecentlyMirrored: true,
+    recentThreshold: 3600000,
+  };
+}
+
+/**
+ * Maps database schedule config to UI format
+ */
+export function mapDbScheduleToUi(dbSchedule: DbScheduleConfig): any {
+  // Extract hours from cron expression if possible
+  let intervalSeconds = 3600; // Default 1 hour
+  const cronMatch = dbSchedule.interval.match(/0 \*\/(\d+) \* \* \*/);
+  if (cronMatch) {
+    intervalSeconds = parseInt(cronMatch[1]) * 3600;
+  }
+
+  return {
+    enabled: dbSchedule.enabled,
+    interval: intervalSeconds,
+  };
+}
+
+/**
+ * Maps UI cleanup config to database schema
+ */
+export function mapUiCleanupToDb(uiCleanup: any): DbCleanupConfig {
+  return {
+    enabled: uiCleanup.enabled || false,
+    retentionDays: uiCleanup.retentionDays || 604800, // Default to 7 days
+    deleteFromGitea: false,
+    deleteIfNotInGitHub: true,
+    protectedRepos: [],
+    dryRun: true,
+    orphanedRepoAction: "archive",
+    batchSize: 10,
+    pauseBetweenDeletes: 2000,
+  };
+}
+
+/**
+ * Maps database cleanup config to UI format
+ */
+export function mapDbCleanupToUi(dbCleanup: DbCleanupConfig): any {
+  return {
+    enabled: dbCleanup.enabled,
+    retentionDays: dbCleanup.retentionDays || 604800, // Use actual value from DB or default to 7 days
+  };
 }
--- a/src/pages/api/auth/legacy-backup/README.md
+++ b/src/pages/api/auth/legacy-backup/README.md
@@ -1,13 +0,0 @@
-# Legacy Auth Routes Backup
-
-These files are the original authentication routes before migrating to Better Auth.
-They are kept here as a reference during the migration process.
-
-## Migration Notes
-
- `index.ts` - Handled user session validation and getting current user
- `login.ts` - Handled user login with email/password
- `logout.ts` - Handled user logout and session cleanup
- `register.ts` - Handled new user registration
-
-All these endpoints are now handled by Better Auth through the catch-all route `[...all].ts`.
--- a/src/pages/api/auth/legacy-backup/index.ts
+++ b/src/pages/api/auth/legacy-backup/index.ts
@@ -1,83 +0,0 @@
-import type { APIRoute } from "astro";
-import { db, users, configs } from "@/lib/db";
-import { eq, and, sql } from "drizzle-orm";
-import jwt from "jsonwebtoken";
-
-const JWT_SECRET = process.env.JWT_SECRET || "your-secret-key";
-
-export const GET: APIRoute = async ({ request, cookies }) => {
-  const authHeader = request.headers.get("Authorization");
-  const token = authHeader?.split(" ")[1] || cookies.get("token")?.value;
-
-  if (!token) {
-    const userCountResult = await db
-      .select({ count: sql<number>`count(*)` })
-      .from(users);
-    const userCount = userCountResult[0].count;
-
-    if (userCount === 0) {
-      return new Response(JSON.stringify({ error: "No users found" }), {
-        status: 404,
-        headers: { "Content-Type": "application/json" },
-      });
-    }
-
-    return new Response(JSON.stringify({ error: "Unauthorized" }), {
-      status: 401,
-      headers: { "Content-Type": "application/json" },
-    });
-  }
-
-  try {
-    const decoded = jwt.verify(token, JWT_SECRET) as { id: string };
-
-    const userResult = await db
-      .select()
-      .from(users)
-      .where(eq(users.id, decoded.id))
-      .limit(1);
-
-    if (!userResult.length) {
-      return new Response(JSON.stringify({ error: "User not found" }), {
-        status: 404,
-        headers: { "Content-Type": "application/json" },
-      });
-    }
-
-    const { password, ...userWithoutPassword } = userResult[0];
-
-    const configResult = await db
-      .select({
-        scheduleConfig: configs.scheduleConfig,
-      })
-      .from(configs)
-      .where(and(eq(configs.userId, decoded.id), eq(configs.isActive, true)))
-      .limit(1);
-
-    const scheduleConfig = configResult[0]?.scheduleConfig;
-
-    const syncEnabled = scheduleConfig?.enabled ?? false;
-    const syncInterval = scheduleConfig?.interval ?? 3600;
-    const lastSync = scheduleConfig?.lastRun ?? null;
-    const nextSync = scheduleConfig?.nextRun ?? null;
-
-    return new Response(
-      JSON.stringify({
-        ...userWithoutPassword,
-        syncEnabled,
-        syncInterval,
-        lastSync,
-        nextSync,
-      }),
-      {
-        status: 200,
-        headers: { "Content-Type": "application/json" },
-      }
-    );
-  } catch (error) {
-    return new Response(JSON.stringify({ error: "Invalid token" }), {
-      status: 401,
-      headers: { "Content-Type": "application/json" },
-    });
-  }
-};
--- a/src/pages/api/auth/legacy-backup/login.ts
+++ b/src/pages/api/auth/legacy-backup/login.ts
@@ -1,62 +0,0 @@
-import type { APIRoute } from "astro";
-import bcrypt from "bcryptjs";
-import jwt from "jsonwebtoken";
-import { db, users } from "@/lib/db";
-import { eq } from "drizzle-orm";
-
-const JWT_SECRET = process.env.JWT_SECRET || "your-secret-key";
-
-export const POST: APIRoute = async ({ request }) => {
-  const { username, password } = await request.json();
-
-  if (!username || !password) {
-    return new Response(
-      JSON.stringify({ error: "Username and password are required" }),
-      {
-        status: 400,
-        headers: { "Content-Type": "application/json" },
-      }
-    );
-  }
-
-  const user = await db
-    .select()
-    .from(users)
-    .where(eq(users.username, username))
-    .limit(1);
-
-  if (!user.length) {
-    return new Response(
-      JSON.stringify({ error: "Invalid username or password" }),
-      {
-        status: 401,
-        headers: { "Content-Type": "application/json" },
-      }
-    );
-  }
-
-  const isPasswordValid = await bcrypt.compare(password, user[0].password);
-
-  if (!isPasswordValid) {
-    return new Response(
-      JSON.stringify({ error: "Invalid username or password" }),
-      {
-        status: 401,
-        headers: { "Content-Type": "application/json" },
-      }
-    );
-  }
-
-  const { password: _, ...userWithoutPassword } = user[0];
-  const token = jwt.sign({ id: user[0].id }, JWT_SECRET, { expiresIn: "7d" });
-
-  return new Response(JSON.stringify({ token, user: userWithoutPassword }), {
-    status: 200,
-    headers: {
-      "Content-Type": "application/json",
-      "Set-Cookie": `token=${token}; Path=/; HttpOnly; SameSite=Strict; Max-Age=${
-        60 * 60 * 24 * 7
-      }`,
-    },
-  });
-};
--- a/src/pages/api/auth/legacy-backup/logout.ts
+++ b/src/pages/api/auth/legacy-backup/logout.ts
@@ -1,11 +0,0 @@
-import type { APIRoute } from "astro";
-
-export const POST: APIRoute = async () => {
-  return new Response(JSON.stringify({ success: true }), {
-    status: 200,
-    headers: {
-      "Content-Type": "application/json",
-      "Set-Cookie": "token=; Path=/; HttpOnly; SameSite=Strict; Max-Age=0",
-    },
-  });
-};
--- a/src/pages/api/auth/legacy-backup/register.ts
+++ b/src/pages/api/auth/legacy-backup/register.ts
@@ -1,72 +0,0 @@
-import type { APIRoute } from "astro";
-import bcrypt from "bcryptjs";
-import jwt from "jsonwebtoken";
-import { db, users } from "@/lib/db";
-import { eq, or } from "drizzle-orm";
-
-const JWT_SECRET = process.env.JWT_SECRET || "your-secret-key";
-
-export const POST: APIRoute = async ({ request }) => {
-  const { username, email, password } = await request.json();
-
-  if (!username || !email || !password) {
-    return new Response(
-      JSON.stringify({ error: "Username, email, and password are required" }),
-      {
-        status: 400,
-        headers: { "Content-Type": "application/json" },
-      }
-    );
-  }
-
-  // Check if username or email already exists
-  const existingUser = await db
-    .select()
-    .from(users)
-    .where(or(eq(users.username, username), eq(users.email, email)))
-    .limit(1);
-
-  if (existingUser.length) {
-    return new Response(
-      JSON.stringify({ error: "Username or email already exists" }),
-      {
-        status: 409,
-        headers: { "Content-Type": "application/json" },
-      }
-    );
-  }
-
-  // Hash password
-  const hashedPassword = await bcrypt.hash(password, 10);
-
-  // Generate UUID
-  const id = crypto.randomUUID();
-
-  // Create user
-  const newUser = await db
-    .insert(users)
-    .values({
-      id,
-      username,
-      email,
-      password: hashedPassword,
-      createdAt: new Date(),
-      updatedAt: new Date(),
-    })
-    .returning();
-
-  const { password: _, ...userWithoutPassword } = newUser[0];
-  const token = jwt.sign({ id: newUser[0].id }, JWT_SECRET, {
-    expiresIn: "7d",
-  });
-
-  return new Response(JSON.stringify({ token, user: userWithoutPassword }), {
-    status: 201,
-    headers: {
-      "Content-Type": "application/json",
-      "Set-Cookie": `token=${token}; Path=/; HttpOnly; SameSite=Strict; Max-Age=${
-        60 * 60 * 24 * 7
-      }`,
-    },
-  });
-};
--- a/src/pages/api/auth/oauth2/register.ts
+++ b/src/pages/api/auth/oauth2/register.ts
@@ -0,0 +1,137 @@
+import type { APIContext } from "astro";
+import { createSecureErrorResponse } from "@/lib/utils";
+import { requireAuth } from "@/lib/utils/auth-helpers";
+import { authClient } from "@/lib/auth-client";
+
+// POST /api/auth/oauth2/register - Register a new OAuth2 application
+export async function POST(context: APIContext) {
+  try {
+    const { response: authResponse } = await requireAuth(context);
+    if (authResponse) return authResponse;
+
+    const body = await context.request.json();
+    
+    // Extract and validate required fields
+    const {
+      client_name,
+      redirect_uris,
+      token_endpoint_auth_method = "client_secret_basic",
+      grant_types = ["authorization_code"],
+      response_types = ["code"],
+      client_uri,
+      logo_uri,
+      scope = "openid profile email",
+      contacts,
+      tos_uri,
+      policy_uri,
+      jwks_uri,
+      jwks,
+      metadata,
+      software_id,
+      software_version,
+      software_statement,
+    } = body;
+
+    // Validate required fields
+    if (!client_name || !redirect_uris || !Array.isArray(redirect_uris) || redirect_uris.length === 0) {
+      return new Response(
+        JSON.stringify({ 
+          error: "invalid_request",
+          error_description: "client_name and redirect_uris are required" 
+        }),
+        {
+          status: 400,
+          headers: { "Content-Type": "application/json" },
+        }
+      );
+    }
+
+    try {
+      // Use Better Auth client to register OAuth2 application
+      const response = await authClient.oauth2.register({
+        client_name,
+        redirect_uris,
+        token_endpoint_auth_method,
+        grant_types,
+        response_types,
+        client_uri,
+        logo_uri,
+        scope,
+        contacts,
+        tos_uri,
+        policy_uri,
+        jwks_uri,
+        jwks,
+        metadata,
+        software_id,
+        software_version,
+        software_statement,
+      });
+
+      // Check if response is an error
+      if ('error' in response && response.error) {
+        return new Response(
+          JSON.stringify({ 
+            error: response.error.code || "registration_error",
+            error_description: response.error.message || "Failed to register application" 
+          }),
+          {
+            status: 400,
+            headers: { "Content-Type": "application/json" },
+          }
+        );
+      }
+
+      // The response follows OAuth2 RFC format with snake_case
+      return new Response(JSON.stringify(response), {
+        status: 201,
+        headers: { 
+          "Content-Type": "application/json",
+          "Cache-Control": "no-store",
+          "Pragma": "no-cache"
+        },
+      });
+    } catch (error: any) {
+      // Handle Better Auth errors
+      if (error.message?.includes('already exists')) {
+        return new Response(
+          JSON.stringify({ 
+            error: "invalid_client_metadata",
+            error_description: "Client with this configuration already exists" 
+          }),
+          {
+            status: 400,
+            headers: { "Content-Type": "application/json" },
+          }
+        );
+      }
+      throw error;
+    }
+  } catch (error) {
+    return createSecureErrorResponse(error, "OAuth2 registration");
+  }
+}
+
+// GET /api/auth/oauth2/register - Get all registered OAuth2 applications
+export async function GET(context: APIContext) {
+  try {
+    const { response: authResponse } = await requireAuth(context);
+    if (authResponse) return authResponse;
+
+    // TODO: Implement listing of OAuth2 applications
+    // This would require querying the database directly
+    
+    return new Response(
+      JSON.stringify({ 
+        applications: [],
+        message: "OAuth2 application listing not yet implemented" 
+      }),
+      {
+        status: 200,
+        headers: { "Content-Type": "application/json" },
+      }
+    );
+  } catch (error) {
+    return createSecureErrorResponse(error, "OAuth2 application listing");
+  }
+}
--- a/src/pages/api/auth/sso/register.ts
+++ b/src/pages/api/auth/sso/register.ts
@@ -0,0 +1,163 @@
+import type { APIContext } from "astro";
+import { createSecureErrorResponse } from "@/lib/utils";
+import { requireAuth } from "@/lib/utils/auth-helpers";
+import { auth } from "@/lib/auth";
+
+// POST /api/auth/sso/register - Register a new SSO provider using Better Auth
+export async function POST(context: APIContext) {
+  try {
+    const { user, response: authResponse } = await requireAuth(context);
+    if (authResponse) return authResponse;
+
+    const body = await context.request.json();
+    
+    // Extract configuration based on provider type
+    const { providerId, issuer, domain, organizationId, providerType = "oidc" } = body;
+
+    // Validate required fields
+    if (!providerId || !issuer || !domain) {
+      return new Response(
+        JSON.stringify({ error: "Missing required fields: providerId, issuer, and domain" }),
+        {
+          status: 400,
+          headers: { "Content-Type": "application/json" },
+        }
+      );
+    }
+
+    let registrationBody: any = {
+      providerId,
+      issuer,
+      domain,
+      organizationId,
+    };
+
+    if (providerType === "saml") {
+      // SAML provider configuration
+      const { 
+        entryPoint, 
+        cert, 
+        callbackUrl,
+        audience,
+        wantAssertionsSigned = true,
+        signatureAlgorithm = "sha256",
+        digestAlgorithm = "sha256",
+        identifierFormat = "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
+        idpMetadata,
+        spMetadata,
+        mapping = {
+          id: "nameID",
+          email: "email",
+          name: "displayName",
+          firstName: "givenName",
+          lastName: "surname",
+        }
+      } = body;
+
+      registrationBody.samlConfig = {
+        entryPoint,
+        cert,
+        callbackUrl: callbackUrl || `${context.url.origin}/api/auth/sso/saml2/callback/${providerId}`,
+        audience: audience || context.url.origin,
+        wantAssertionsSigned,
+        signatureAlgorithm,
+        digestAlgorithm,
+        identifierFormat,
+        idpMetadata,
+        spMetadata,
+      };
+      registrationBody.mapping = mapping;
+    } else {
+      // OIDC provider configuration
+      const {
+        clientId,
+        clientSecret,
+        authorizationEndpoint,
+        tokenEndpoint,
+        jwksEndpoint,
+        discoveryEndpoint,
+        userInfoEndpoint,
+        scopes = ["openid", "email", "profile"],
+        pkce = true,
+        mapping = {
+          id: "sub",
+          email: "email",
+          emailVerified: "email_verified",
+          name: "name",
+          image: "picture",
+        }
+      } = body;
+
+      registrationBody.oidcConfig = {
+        clientId,
+        clientSecret,
+        authorizationEndpoint,
+        tokenEndpoint,
+        jwksEndpoint,
+        discoveryEndpoint,
+        userInfoEndpoint,
+        scopes,
+        pkce,
+      };
+      registrationBody.mapping = mapping;
+    }
+
+    // Get the user's auth headers to make the request
+    const headers = new Headers();
+    const cookieHeader = context.request.headers.get("cookie");
+    if (cookieHeader) {
+      headers.set("cookie", cookieHeader);
+    }
+
+    // Register the SSO provider using Better Auth's API
+    const response = await auth.api.registerSSOProvider({
+      body: registrationBody,
+      headers,
+    });
+
+    if (!response.ok) {
+      const error = await response.text();
+      return new Response(
+        JSON.stringify({ error: `Failed to register SSO provider: ${error}` }),
+        {
+          status: response.status,
+          headers: { "Content-Type": "application/json" },
+        }
+      );
+    }
+
+    const result = await response.json();
+    
+    return new Response(JSON.stringify(result), {
+      status: 201,
+      headers: { "Content-Type": "application/json" },
+    });
+  } catch (error) {
+    return createSecureErrorResponse(error, "SSO registration");
+  }
+}
+
+// GET /api/auth/sso/register - Get all registered SSO providers
+export async function GET(context: APIContext) {
+  try {
+    const { user, response: authResponse } = await requireAuth(context);
+    if (authResponse) return authResponse;
+
+    // For now, we'll need to query the database directly since Better Auth
+    // doesn't provide a built-in API to list SSO providers
+    // This will be implemented once we update the database schema
+    
+    return new Response(
+      JSON.stringify({ 
+        message: "SSO provider listing not yet implemented",
+        providers: [] 
+      }),
+      {
+        status: 200,
+        headers: { "Content-Type": "application/json" },
+      }
+    );
+  } catch (error) {
+    return createSecureErrorResponse(error, "SSO provider listing");
+  }
+}
--- a/src/pages/api/auth/sso/sp-metadata.ts
+++ b/src/pages/api/auth/sso/sp-metadata.ts
@@ -0,0 +1,64 @@
+import type { APIContext } from "astro";
+import { createSecureErrorResponse } from "@/lib/utils";
+import { auth } from "@/lib/auth";
+
+// GET /api/auth/sso/sp-metadata - Get Service Provider metadata for SAML
+export async function GET(context: APIContext) {
+  try {
+    const url = new URL(context.request.url);
+    const providerId = url.searchParams.get("providerId");
+    const format = url.searchParams.get("format") || "xml";
+
+    if (!providerId) {
+      return new Response(
+        JSON.stringify({ error: "Provider ID is required" }),
+        {
+          status: 400,
+          headers: { "Content-Type": "application/json" },
+        }
+      );
+    }
+
+    // Get SP metadata using Better Auth's API
+    const response = await auth.api.spMetadata({
+      query: {
+        providerId,
+        format,
+      },
+    });
+
+    if (!response.ok) {
+      const error = await response.text();
+      return new Response(
+        JSON.stringify({ error: `Failed to get SP metadata: ${error}` }),
+        {
+          status: response.status,
+          headers: { "Content-Type": "application/json" },
+        }
+      );
+    }
+
+    // Return the metadata in the requested format
+    if (format === "xml") {
+      const metadataXML = await response.text();
+      return new Response(metadataXML, {
+        status: 200,
+        headers: { 
+          "Content-Type": "application/samlmetadata+xml",
+          "Cache-Control": "public, max-age=86400", // Cache for 24 hours
+        },
+      });
+    } else {
+      const metadataJSON = await response.json();
+      return new Response(JSON.stringify(metadataJSON), {
+        status: 200,
+        headers: { 
+          "Content-Type": "application/json",
+          "Cache-Control": "public, max-age=86400",
+        },
+      });
+    }
+  } catch (error) {
+    return createSecureErrorResponse(error, "SP metadata");
+  }
+}
--- a/src/pages/api/config/index.ts
+++ b/src/pages/api/config/index.ts
@@ -4,7 +4,14 @@ import { v4 as uuidv4 } from "uuid";
 import { eq } from "drizzle-orm";
 import { calculateCleanupInterval } from "@/lib/cleanup-service";
 import { createSecureErrorResponse } from "@/lib/utils";
-import { mapUiToDbConfig, mapDbToUiConfig } from "@/lib/utils/config-mapper";
+import { 
+  mapUiToDbConfig, 
+  mapDbToUiConfig, 
+  mapUiScheduleToDb, 
+  mapUiCleanupToDb,
+  mapDbScheduleToUi,
+  mapDbCleanupToUi 
+} from "@/lib/utils/config-mapper";
 import { encrypt, decrypt, migrateToken } from "@/lib/utils/encryption";

 export const POST: APIRoute = async ({ request }) => {
@@ -78,62 +85,9 @@ export const POST: APIRoute = async ({ request }) => {
      mappedGiteaConfig.token = encrypt(mappedGiteaConfig.token);
    }

-    // Process schedule config - set/update nextRun if enabled, clear if disabled
-    const processedScheduleConfig = { ...scheduleConfig };
-    if (scheduleConfig.enabled) {
-      const now = new Date();
-      const interval = scheduleConfig.interval || 3600; // Default to 1 hour
-
-      // Check if we need to recalculate nextRun
-      // Recalculate if: no nextRun exists, or interval changed from existing config
-      let shouldRecalculate = !scheduleConfig.nextRun;
-
-      if (existingConfig && existingConfig.scheduleConfig) {
-        const existingScheduleConfig = existingConfig.scheduleConfig;
-        const existingInterval = existingScheduleConfig.interval || 3600;
-
-        // If interval changed, recalculate nextRun
-        if (interval !== existingInterval) {
-          shouldRecalculate = true;
-        }
-      }
-
-      if (shouldRecalculate) {
-        processedScheduleConfig.nextRun = new Date(now.getTime() + interval * 1000);
-      }
-    } else {
-      // Clear nextRun when disabled
-      processedScheduleConfig.nextRun = null;
-    }
-
-    // Process cleanup config - set/update nextRun if enabled, clear if disabled
-    const processedCleanupConfig = { ...cleanupConfig };
-    if (cleanupConfig.enabled) {
-      const now = new Date();
-      const retentionSeconds = cleanupConfig.retentionDays || 604800; // Default 7 days in seconds
-      const cleanupIntervalHours = calculateCleanupInterval(retentionSeconds);
-
-      // Check if we need to recalculate nextRun
-      // Recalculate if: no nextRun exists, or retention period changed from existing config
-      let shouldRecalculate = !cleanupConfig.nextRun;
-
-      if (existingConfig && existingConfig.cleanupConfig) {
-        const existingCleanupConfig = existingConfig.cleanupConfig;
-        const existingRetentionSeconds = existingCleanupConfig.retentionDays || 604800;
-
-        // If retention period changed, recalculate nextRun
-        if (retentionSeconds !== existingRetentionSeconds) {
-          shouldRecalculate = true;
-        }
-      }
-
-      if (shouldRecalculate) {
-        processedCleanupConfig.nextRun = new Date(now.getTime() + cleanupIntervalHours * 60 * 60 * 1000);
-      }
-    } else {
-      // Clear nextRun when disabled
-      processedCleanupConfig.nextRun = null;
-    }
+    // Map schedule and cleanup configs to database schema
+    const processedScheduleConfig = mapUiScheduleToDb(scheduleConfig);
+    const processedCleanupConfig = mapUiCleanupToDb(cleanupConfig);

    if (existingConfig) {
      // Update path
@@ -234,28 +188,34 @@ export const GET: APIRoute = async ({ request }) => {
      .limit(1);

    if (config.length === 0) {
-      // Return a default empty configuration with UI structure
+      // Return a default empty configuration with database structure
      const defaultDbConfig = {
        githubConfig: {
-          username: "",
+          owner: "",
+          type: "personal",
          token: "",
-          skipForks: false,
-          privateRepositories: false,
-          mirrorIssues: false,
-          mirrorWiki: false,
-          mirrorStarred: false,
-          useSpecificUser: false,
-          preserveOrgStructure: false,
-          skipStarredIssues: false,
+          includeStarred: false,
+          includeForks: true,
+          includeArchived: false,
+          includePrivate: false,
+          includePublic: true,
+          includeOrganizations: [],
+          starredReposOrg: "starred",
+          mirrorStrategy: "preserve",
+          defaultOrg: "github-mirrors",
        },
        giteaConfig: {
          url: "",
          token: "",
-          username: "",
-          organization: "github-mirrors",
+          defaultOwner: "",
+          mirrorInterval: "8h",
+          lfs: false,
+          wiki: false,
          visibility: "public",
-          starredReposOrg: "github",
-          preserveOrgStructure: false,
+          createOrg: true,
+          addTopics: true,
+          preserveVisibility: false,
+          forkStrategy: "reference",
        },
      };
      
@@ -319,9 +279,23 @@ export const GET: APIRoute = async ({ request }) => {
      
      const uiConfig = mapDbToUiConfig(decryptedConfig);
      
+      // Map schedule and cleanup configs to UI format
+      const uiScheduleConfig = mapDbScheduleToUi(dbConfig.scheduleConfig);
+      const uiCleanupConfig = mapDbCleanupToUi(dbConfig.cleanupConfig);
+      
      return new Response(JSON.stringify({
        ...dbConfig,
        ...uiConfig,
+        scheduleConfig: {
+          ...uiScheduleConfig,
+          lastRun: dbConfig.scheduleConfig.lastRun,
+          nextRun: dbConfig.scheduleConfig.nextRun,
+        },
+        cleanupConfig: {
+          ...uiCleanupConfig,
+          lastRun: dbConfig.cleanupConfig.lastRun,
+          nextRun: dbConfig.cleanupConfig.nextRun,
+        },
      }), {
        status: 200,
        headers: { "Content-Type": "application/json" },
@@ -330,9 +304,22 @@ export const GET: APIRoute = async ({ request }) => {
      console.error("Failed to decrypt tokens:", error);
      // Return config without decrypting tokens if there's an error
      const uiConfig = mapDbToUiConfig(dbConfig);
+      const uiScheduleConfig = mapDbScheduleToUi(dbConfig.scheduleConfig);
+      const uiCleanupConfig = mapDbCleanupToUi(dbConfig.cleanupConfig);
+      
      return new Response(JSON.stringify({
        ...dbConfig,
        ...uiConfig,
+        scheduleConfig: {
+          ...uiScheduleConfig,
+          lastRun: dbConfig.scheduleConfig.lastRun,
+          nextRun: dbConfig.scheduleConfig.nextRun,
+        },
+        cleanupConfig: {
+          ...uiCleanupConfig,
+          lastRun: dbConfig.cleanupConfig.lastRun,
+          nextRun: dbConfig.cleanupConfig.nextRun,
+        },
      }), {
        status: 200,
        headers: { "Content-Type": "application/json" },
--- a/src/pages/api/github/organizations.ts
+++ b/src/pages/api/github/organizations.ts
@@ -66,54 +66,39 @@ export const GET: APIRoute = async ({ request }) => {
          baseConditions.push(eq(repositories.isStarred, false));
        }

-        // Get total count with all user config filters applied
-        const totalConditions = [...baseConditions];
-        if (githubConfig.skipForks) {
-          totalConditions.push(eq(repositories.isForked, false));
-        }
-        if (!githubConfig.privateRepositories) {
-          totalConditions.push(eq(repositories.isPrivate, false));
-        }
-
+        // Get actual total count (without user config filters)
        const [totalCount] = await db
          .select({ count: count() })
          .from(repositories)
-          .where(and(...totalConditions));
-
-        // Get public count
-        const publicConditions = [...baseConditions, eq(repositories.isPrivate, false)];
-        if (githubConfig.skipForks) {
-          publicConditions.push(eq(repositories.isForked, false));
-        }
+          .where(and(...baseConditions));

+        // Get public count (actual count, not filtered)
        const [publicCount] = await db
          .select({ count: count() })
          .from(repositories)
-          .where(and(...publicConditions));
+          .where(and(...baseConditions, eq(repositories.isPrivate, false)));

-        // Get private count (only if private repos are enabled in config)
-        const [privateCount] = githubConfig.privateRepositories ? await db
+        // Get private count (always show actual count regardless of config)
+        const [privateCount] = await db
          .select({ count: count() })
          .from(repositories)
          .where(
            and(
              ...baseConditions,
-              eq(repositories.isPrivate, true),
-              ...(githubConfig.skipForks ? [eq(repositories.isForked, false)] : [])
+              eq(repositories.isPrivate, true)
            )
-          ) : [{ count: 0 }];
+          );

-        // Get fork count (only if forks are enabled in config)
-        const [forkCount] = !githubConfig.skipForks ? await db
+        // Get fork count (always show actual count regardless of config)
+        const [forkCount] = await db
          .select({ count: count() })
          .from(repositories)
          .where(
            and(
              ...baseConditions,
-              eq(repositories.isForked, true),
-              ...(!githubConfig.privateRepositories ? [eq(repositories.isPrivate, false)] : [])
+              eq(repositories.isForked, true)
            )
-          ) : [{ count: 0 }];
+          );

        return {
          ...org,
--- a/src/pages/api/github/repositories.ts
+++ b/src/pages/api/github/repositories.ts
@@ -45,17 +45,10 @@ export const GET: APIRoute = async ({ request }) => {
    // Build query conditions based on config
    const conditions = [eq(repositories.userId, userId)];

-    if (!githubConfig.mirrorStarred) {
-      conditions.push(eq(repositories.isStarred, false));
-    }
-
-    if (githubConfig.skipForks) {
-      conditions.push(eq(repositories.isForked, false));
-    }
-
-    if (!githubConfig.privateRepositories) {
-      conditions.push(eq(repositories.isPrivate, false));
-    }
+    // Note: We show ALL repositories in the list
+    // The mirrorStarred and privateRepositories flags only control what gets mirrored,
+    // not what's displayed in the repository list
+    // Only skipForks is used for filtering the display since forked repos are often noise

    const rawRepositories = await db
      .select()
--- a/src/pages/api/job/mirror-repo.ts
+++ b/src/pages/api/job/mirror-repo.ts
@@ -109,11 +109,11 @@ export const POST: APIRoute = async ({ request }) => {

          // For single-org and starred repos strategies, or when mirroring to an org,
          // always use the org mirroring function to ensure proper organization handling
-          const mirrorStrategy = config.giteaConfig?.mirrorStrategy || 
+          const mirrorStrategy = config.githubConfig?.mirrorStrategy || 
            (config.githubConfig?.preserveOrgStructure ? "preserve" : "flat-user");
          
          const shouldUseOrgMirror = 
-            owner !== config.giteaConfig?.username || // Different owner means org
+            owner !== config.giteaConfig?.defaultOwner || // Different owner means org
            mirrorStrategy === "single-org" || // Single-org strategy always uses org
            repoData.isStarred; // Starred repos always go to org

--- a/src/pages/api/job/retry-repo.ts
+++ b/src/pages/api/job/retry-repo.ts
@@ -143,11 +143,11 @@ export const POST: APIRoute = async ({ request }) => {

            // For single-org and starred repos strategies, or when mirroring to an org,
            // always use the org mirroring function to ensure proper organization handling
-            const mirrorStrategy = config.giteaConfig?.mirrorStrategy || 
+            const mirrorStrategy = config.githubConfig?.mirrorStrategy || 
              (config.githubConfig?.preserveOrgStructure ? "preserve" : "flat-user");
            
            const shouldUseOrgMirror = 
-              owner !== config.giteaConfig?.username || // Different owner means org
+              owner !== config.giteaConfig?.defaultOwner || // Different owner means org
              mirrorStrategy === "single-org" || // Single-org strategy always uses org
              repoData.isStarred; // Starred repos always go to org

--- a/src/pages/api/sync/organization.ts
+++ b/src/pages/api/sync/organization.ts
@@ -9,6 +9,8 @@ import type {
 } from "@/types/organizations";
 import type { RepositoryVisibility, RepoStatus } from "@/types/Repository";
 import { v4 as uuidv4 } from "uuid";
+import { decryptConfigTokens } from "@/lib/utils/config-encryption";
+import { createGitHubClient } from "@/lib/github";

 export const POST: APIRoute = async ({ request }) => {
  try {
@@ -44,32 +46,67 @@ export const POST: APIRoute = async ({ request }) => {
    const [config] = await db
      .select()
      .from(configs)
-      .where(eq(configs.userId, userId))
+      .where(and(eq(configs.userId, userId), eq(configs.isActive, true)))
      .limit(1);

    if (!config) {
      return jsonResponse({
-        data: { error: "No configuration found for this user" },
+        data: { error: "No active configuration found for this user" },
        status: 404,
      });
    }

    const configId = config.id;
-
-    const octokit = new Octokit();
+    
+    // Decrypt the config to get tokens
+    const decryptedConfig = decryptConfigTokens(config);
+    
+    // Check if we have a GitHub token
+    if (!decryptedConfig.githubConfig?.token) {
+      return jsonResponse({
+        data: { error: "GitHub token not configured" },
+        status: 401,
+      });
+    }
+    
+    // Create authenticated Octokit instance
+    const octokit = createGitHubClient(decryptedConfig.githubConfig.token);

    // Fetch org metadata
    const { data: orgData } = await octokit.orgs.get({ org });

-    // Fetch public repos using Octokit paginator
+    // Fetch repos based on config settings
+    const allRepos = [];
+    
+    // Fetch all repos (public, private, and member) to show in UI
    const publicRepos = await octokit.paginate(octokit.repos.listForOrg, {
      org,
      type: "public",
      per_page: 100,
    });
+    allRepos.push(...publicRepos);
+    
+    // Always fetch private repos to show them in the UI
+    const privateRepos = await octokit.paginate(octokit.repos.listForOrg, {
+      org,
+      type: "private",
+      per_page: 100,
+    });
+    allRepos.push(...privateRepos);
+    
+    // Also fetch member repos (includes private repos the user has access to)
+    const memberRepos = await octokit.paginate(octokit.repos.listForOrg, {
+      org,
+      type: "member",
+      per_page: 100,
+    });
+    // Filter out duplicates
+    const existingIds = new Set(allRepos.map(r => r.id));
+    const uniqueMemberRepos = memberRepos.filter(r => !existingIds.has(r.id));
+    allRepos.push(...uniqueMemberRepos);

    // Insert repositories
-    const repoRecords = publicRepos.map((repo) => ({
+    const repoRecords = allRepos.map((repo) => ({
      id: uuidv4(),
      userId,
      configId,
@@ -110,7 +147,7 @@ export const POST: APIRoute = async ({ request }) => {
      membershipRole: role,
      isIncluded: false,
      status: "imported" as RepoStatus,
-      repositoryCount: publicRepos.length,
+      repositoryCount: allRepos.length,
      createdAt: orgData.created_at ? new Date(orgData.created_at) : new Date(),
      updatedAt: orgData.updated_at ? new Date(orgData.updated_at) : new Date(),
    };
Author	SHA1	Message	Date
Arunavo Ray	f2c7728394	Release v3.1.0 ### Added - Support for GITHUB_EXCLUDED_ORGS environment variable - New textarea UI component for configuration forms ### Fixed - Mirror strategy configuration test failures - Organization repository routing logic - Starred repositories organization routing - SSO and OIDC authentication issues ### Improved - Organization configuration for repository routing - Mirror strategy handling in tests - Authentication error handling 🤖 Generated with Claude Code Co-Authored-By: Claude <noreply@anthropic.com>	2025-07-21 16:46:36 +05:30
Arunavo Ray	dcdb06ac39	fixed tests	2025-07-21 15:17:53 +05:30
Arunavo Ray	9fa10dae00	removed unused import	2025-07-21 12:30:04 +05:30
Arunavo Ray	99dd501a52	Added textarea comp	2025-07-21 12:26:31 +05:30
Arunavo Ray	d4aa665873	more SSO and OIDC fixes	2025-07-21 12:09:38 +05:30
Arunavo Ray	0244133e7b	Fix: Starred Repos Organization Bug \| Organization Repos Routing	2025-07-21 10:39:48 +05:30
ARUNAVO RAY	6ea5e9efb0	Merge pull request #47 from djmango/master Add GITHUB_EXCLUDED_ORGS support for organization filtering	2025-07-19 21:28:29 +05:30
Sulaiman Khan Ghori	8d7ca8dd8f	Add GITHUB_EXCLUDED_ORGS support for organization filtering	2025-07-18 15:58:04 -07:00
Arunavo Ray	8d2919717f	Removed old MIgration Guide	2025-07-19 00:36:46 +05:30
Arunavo Ray	1e06e2bd4b	Remove Auto Migrate	2025-07-19 00:28:12 +05:30
Arunavo Ray	67080a7ce9	v3.0.1	2025-07-18 23:53:23 +05:30
Arunavo Ray	9d5db86bdf	Updates to Org strategy	2025-07-18 09:52:55 +05:30
Arunavo Ray	3458891511	Updates for starred and personal repos	2025-07-18 09:37:38 +05:30
Arunavo Ray	d388f2e691	consistent and distinct colors for status	2025-07-18 08:37:00 +05:30
Arunavo Ray	7bd862606b	More fixes	2025-07-18 00:52:03 +05:30
Arunavo Ray	251baeb1aa	Fixed Private Repo Issues	2025-07-17 23:46:01 +05:30
Arunavo Ray	e6a31512ac	some more fixes	2025-07-17 23:31:45 +05:30