v3.8.4

Merge pull request #120 from RayLabsHQ/fix-org-destination-override
fix: Custom organization mirror destination issue
2025-12-06 19:46:44 +03:00 · 2025-10-22 09:07:02 +05:30 · 2025-10-22 09:06:13 +05:30 · 2025-10-22 09:03:27 +05:30 · 2025-10-22 08:59:07 +05:30 · 2025-10-22 08:44:22 +05:30
35 changed files with 2504 additions and 1201 deletions
--- a/.github/ci/values-ci.yaml
+++ b/.github/ci/values-ci.yaml
@@ -0,0 +1,59 @@
+image:
+  registry: ghcr.io
+  repository: raylabshq/gitea-mirror
+  tag: ""
+
+service:
+  type: ClusterIP
+  port: 8080
+
+ingress:
+  enabled: true
+  className: "nginx"
+  hosts:
+    - host: ci.example.com
+
+route:
+  enabled: true
+  forceHTTPS: true
+  domain: ["ci.example.com"]
+  gateway: "dummy-gw"
+  gatewayNamespace: "default"
+  http:
+    gatewaySection: "http"
+  https:
+    gatewaySection: "https"
+
+gitea-mirror:
+  nodeEnv: production
+  core:
+    databaseUrl: "file:data/gitea-mirror.db"
+    betterAuthSecret: "dummy"
+    betterAuthUrl: "http://localhost:4321"
+    betterAuthTrustedOrigins: "http://localhost:4321"
+  github:
+    username: "ci-user"
+    token: "not-used-in-template"
+    type: "personal"
+    privateRepositories: true
+    skipForks: false
+    starredCodeOnly: false
+  gitea:
+    url: "https://gitea.example.com"
+    token: "not-used-in-template"
+    username: "ci-user"
+    organization: "github-mirrors"
+    visibility: "public"
+  mirror:
+    releases: true
+    wiki: true
+    metadata: true
+    issues: true
+    pullRequests: true
+    starred: false
+  automation:
+    schedule_enabled: true
+    schedule_interval: "3600"
+  cleanup:
+    enabled: true
+    interval: "2592000"
--- a/.github/workflows/README.md
+++ b/.github/workflows/README.md
@@ -85,3 +85,10 @@ If a workflow fails:
   - Security vulnerabilities

 For persistent issues, consider opening an issue in the repository.
+
+
+### Helm Test (`helm-test.yml`)
+
+This workflow run on the main branch and pull requests. it:
+- Run yamllint to keep the formating unified
+- Run helm template with different value files
--- a/.github/workflows/docker-build.yml
+++ b/.github/workflows/docker-build.yml
@@ -10,6 +10,10 @@ on:
      - 'package.json'
      - 'bun.lock*'
      - '.github/workflows/docker-build.yml'
+      - 'docker-entrypoint.sh'
+      - 'drizzle/**'
+      - 'scripts/**'
+      - 'src/**'
  pull_request:
    paths:
      - 'Dockerfile'
@@ -17,6 +21,10 @@ on:
      - 'package.json'
      - 'bun.lock*'
      - '.github/workflows/docker-build.yml'
+      - 'docker-entrypoint.sh'
+      - 'drizzle/**'
+      - 'scripts/**'
+      - 'src/**'
  schedule:
    - cron: '0 0 * * 0'  # Weekly security scan on Sunday at midnight

@@ -48,7 +56,6 @@ jobs:

      - name: Log into registry
        uses: docker/login-action@v3
-        if: github.event_name != 'pull_request'
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
@@ -89,6 +96,7 @@ jobs:
            type=sha,prefix=,suffix=,format=short
            type=raw,value=latest,enable={{is_default_branch}}
            type=raw,value=${{ steps.tag_version.outputs.VERSION }}
+            type=ref,event=pr,prefix=pr-

      # Build and push Docker image
      - name: Build and push Docker image
@@ -97,20 +105,77 @@ jobs:
        with:
          context: .
          platforms: ${{ github.event_name == 'pull_request' && 'linux/amd64' || 'linux/amd64,linux/arm64' }}
-          push: ${{ github.event_name != 'pull_request' }}
-          load: ${{ github.event_name == 'pull_request' }}
-          tags: ${{ github.event_name == 'pull_request' && 'gitea-mirror:scan' || steps.meta.outputs.tags }}
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

+      # Load image locally for security scanning (PRs only)
+      - name: Load image for scanning
+        if: github.event_name == 'pull_request'
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          platforms: linux/amd64
+          load: true
+          tags: gitea-mirror:scan
+          cache-from: type=gha
+
      # Wait for image to be available in registry
      - name: Wait for image availability
-        if: github.event_name != 'pull_request'
        run: |
          echo "Waiting for image to be available in registry..."
          sleep 5

+      # Add comment to PR with image details
+      - name: Comment PR with image tag
+        if: github.event_name == 'pull_request'
+        uses: actions/github-script@v7
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const prNumber = context.payload.pull_request.number;
+            const imageTag = `pr-${prNumber}`;
+            const imagePath = `${{ env.REGISTRY }}/${{ env.IMAGE }}:${imageTag}`.toLowerCase();
+
+            const comment = `## 🐳 Docker Image Built Successfully
+
+            Your PR image is available for testing:
+
+            **Image Tag:** \`${imageTag}\`
+            **Full Image Path:** \`${imagePath}\`
+
+            ### Pull and Test
+            \`\`\`bash
+            docker pull ${imagePath}
+            docker run -d -p 3000:3000 --name gitea-mirror-test ${imagePath}
+            \`\`\`
+
+            ### Docker Compose Testing
+            \`\`\`yaml
+            services:
+              gitea-mirror:
+                image: ${imagePath}
+                ports:
+                  - "3000:3000"
+                environment:
+                  - BETTER_AUTH_SECRET=your-secret-here
+            \`\`\`
+
+            > 💡 **Note:** PR images are tagged as \`pr-<number>\` and only built for \`linux/amd64\` to speed up CI.
+            > Production images (\`latest\`, version tags) are multi-platform (\`linux/amd64\`, \`linux/arm64\`).
+
+            ---
+            📦 View in [GitHub Packages](https://github.com/${{ github.repository }}/pkgs/container/gitea-mirror)`;
+
+            github.rest.issues.createComment({
+              issue_number: prNumber,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              body: comment
+            });
+
      # Docker Scout comprehensive security analysis
      - name: Docker Scout - Vulnerability Analysis & Recommendations
        uses: docker/scout-action@v1
--- a/.github/workflows/helm-test.yml
+++ b/.github/workflows/helm-test.yml
@@ -0,0 +1,61 @@
+name: Helm Chart CI
+
+permissions:
+  contents: read
+
+on:
+  pull_request:
+    paths:
+      - 'helm/gitea-mirror/**'
+      - '.github/workflows/helm-test.yml'
+      - '.github/ci/values-ci.yaml'
+  push:
+    branches: [ main ]
+    paths:
+      - 'helm/gitea-mirror/**'
+      - '.github/workflows/helm-test.yml'
+      - '.github/ci/values-ci.yaml'
+  workflow_dispatch:
+
+jobs:
+  yamllint:
+    name: Lint YAML
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.x'
+      - name: Install yamllint
+        run: pip install --disable-pip-version-check yamllint
+      - name: Run yamllint
+        run: |
+          yamllint -c helm/gitea-mirror/.yamllint helm/gitea-mirror
+
+  helm-template:
+    name: Helm lint & template
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Setup Helm
+        uses: azure/setup-helm@v4
+        with:
+          version: v3.19.0
+      - name: Helm lint
+        run: |
+          helm lint ./helm/gitea-mirror
+      - name: Template with defaults
+        run: |
+          helm template test ./helm/gitea-mirror > /tmp/render-defaults.yaml
+          test -s /tmp/render-defaults.yaml
+      - name: Template with CI values
+        run: |
+          helm template test ./helm/gitea-mirror -f .github/ci/values-ci.yaml > /tmp/render-ci.yaml
+          test -s /tmp/render-ci.yaml
+      - name: Show a summary
+        run: |
+          echo "Rendered with defaults:"
+          awk 'NR<=50{print} NR==51{print "..."; exit}' /tmp/render-defaults.yaml
+          echo ""
+          echo "Rendered with CI values:"
+          awk 'NR<=50{print} NR==51{print "..."; exit}' /tmp/render-ci.yaml
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -193,7 +193,7 @@ export async function POST({ request }: APIContext) {

 ### Advanced Options (UI Fields)
 - **skipForks**: Skip forked repositories (default: false)
- **skipStarredIssues**: Skip issues for starred repositories (default: false) - enables "Lightweight mode" for starred repos
+- **starredCodeOnly**: Skip issues for starred repositories (default: false) - enables "Lightweight mode" for starred repos

 ### Repository Statuses
 Repositories can have the following statuses:
--- a/2
+++ b/2
@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1.4

-FROM oven/bun:1.2.21-alpine AS base
+FROM oven/bun:1.2.23-alpine AS base
 WORKDIR /app
 RUN apk add --no-cache libc6-compat python3 make g++ gcc wget sqlite openssl ca-certificates

--- a/bun.lock
+++ b/bun.lock
@@ -5,11 +5,11 @@
      "name": "gitea-mirror",
      "dependencies": {
        "@astrojs/check": "^0.9.4",
-        "@astrojs/mdx": "4.3.5",
-        "@astrojs/node": "9.4.3",
+        "@astrojs/mdx": "4.3.6",
+        "@astrojs/node": "9.4.4",
        "@astrojs/react": "^4.3.1",
-        "@better-auth/sso": "^1.3.9",
-        "@octokit/plugin-throttling": "^11.0.1",
+        "@better-auth/sso": "^1.3.24",
+        "@octokit/plugin-throttling": "^11.0.2",
        "@octokit/rest": "^22.0.0",
        "@radix-ui/react-accordion": "^1.2.12",
        "@radix-ui/react-avatar": "^1.1.10",
@@ -32,20 +32,20 @@
        "@tailwindcss/vite": "^4.1.13",
        "@tanstack/react-virtual": "^3.13.12",
        "@types/canvas-confetti": "^1.9.0",
-        "@types/react": "^19.1.12",
+        "@types/react": "^19.1.16",
        "@types/react-dom": "^19.1.9",
-        "astro": "^5.13.7",
+        "astro": "^5.14.1",
        "bcryptjs": "^3.0.2",
-        "better-auth": "^1.3.9",
+        "better-auth": "^1.3.24",
        "canvas-confetti": "^1.9.3",
        "class-variance-authority": "^0.7.1",
        "clsx": "^2.1.1",
        "cmdk": "^1.1.1",
-        "dotenv": "^17.2.2",
+        "dotenv": "^17.2.3",
        "drizzle-orm": "^0.44.5",
        "fuse.js": "^7.1.0",
        "jsonwebtoken": "^9.0.2",
-        "lucide-react": "^0.542.0",
+        "lucide-react": "^0.544.0",
        "next-themes": "^0.4.6",
        "react": "^19.1.1",
        "react-dom": "^19.1.1",
@@ -53,23 +53,23 @@
        "sonner": "^2.0.7",
        "tailwind-merge": "^3.3.1",
        "tailwindcss": "^4.1.13",
-        "tw-animate-css": "^1.3.8",
-        "typescript": "^5.9.2",
+        "tw-animate-css": "^1.4.0",
+        "typescript": "^5.9.3",
        "uuid": "^13.0.0",
        "vaul": "^1.1.2",
-        "zod": "^4.1.5",
+        "zod": "^4.1.11",
      },
      "devDependencies": {
-        "@testing-library/jest-dom": "^6.8.0",
+        "@testing-library/jest-dom": "^6.9.0",
        "@testing-library/react": "^16.3.0",
        "@types/bcryptjs": "^3.0.0",
-        "@types/bun": "^1.2.21",
+        "@types/bun": "^1.2.23",
        "@types/jsonwebtoken": "^9.0.10",
        "@types/uuid": "^10.0.0",
-        "@vitejs/plugin-react": "^5.0.2",
-        "drizzle-kit": "^0.31.4",
+        "@vitejs/plugin-react": "^5.0.4",
+        "drizzle-kit": "^0.31.5",
        "jsdom": "^26.1.0",
-        "tsx": "^4.20.5",
+        "tsx": "^4.20.6",
        "vitest": "^3.2.4",
      },
    },
@@ -89,15 +89,15 @@

    "@astrojs/compiler": ["@astrojs/compiler@2.12.2", "", {}, "sha512-w2zfvhjNCkNMmMMOn5b0J8+OmUaBL1o40ipMvqcG6NRpdC+lKxmTi48DT8Xw0SzJ3AfmeFLB45zXZXtmbsjcgw=="],

-    "@astrojs/internal-helpers": ["@astrojs/internal-helpers@0.7.2", "", {}, "sha512-KCkCqR3Goym79soqEtbtLzJfqhTWMyVaizUi35FLzgGSzBotSw8DB1qwsu7U96ihOJgYhDk2nVPz+3LnXPeX6g=="],
+    "@astrojs/internal-helpers": ["@astrojs/internal-helpers@0.7.3", "", {}, "sha512-6Pl0bQEIChuW5wqN7jdKrzWfCscW2rG/Cz+fzt4PhSQX2ivBpnhXgFUCs0M3DCYvjYHnPVG2W36X5rmFjZ62sw=="],

    "@astrojs/language-server": ["@astrojs/language-server@2.15.4", "", { "dependencies": { "@astrojs/compiler": "^2.10.3", "@astrojs/yaml2ts": "^0.2.2", "@jridgewell/sourcemap-codec": "^1.4.15", "@volar/kit": "~2.4.7", "@volar/language-core": "~2.4.7", "@volar/language-server": "~2.4.7", "@volar/language-service": "~2.4.7", "fast-glob": "^3.2.12", "muggle-string": "^0.4.1", "volar-service-css": "0.0.62", "volar-service-emmet": "0.0.62", "volar-service-html": "0.0.62", "volar-service-prettier": "0.0.62", "volar-service-typescript": "0.0.62", "volar-service-typescript-twoslash-queries": "0.0.62", "volar-service-yaml": "0.0.62", "vscode-html-languageservice": "^5.2.0", "vscode-uri": "^3.0.8" }, "peerDependencies": { "prettier": "^3.0.0", "prettier-plugin-astro": ">=0.11.0" }, "optionalPeers": ["prettier", "prettier-plugin-astro"], "bin": { "astro-ls": "bin/nodeServer.js" } }, "sha512-JivzASqTPR2bao9BWsSc/woPHH7OGSGc9aMxXL4U6egVTqBycB3ZHdBJPuOCVtcGLrzdWTosAqVPz1BVoxE0+A=="],

-    "@astrojs/markdown-remark": ["@astrojs/markdown-remark@6.3.6", "", { "dependencies": { "@astrojs/internal-helpers": "0.7.2", "@astrojs/prism": "3.3.0", "github-slugger": "^2.0.0", "hast-util-from-html": "^2.0.3", "hast-util-to-text": "^4.0.2", "import-meta-resolve": "^4.1.0", "js-yaml": "^4.1.0", "mdast-util-definitions": "^6.0.0", "rehype-raw": "^7.0.0", "rehype-stringify": "^10.0.1", "remark-gfm": "^4.0.1", "remark-parse": "^11.0.0", "remark-rehype": "^11.1.2", "remark-smartypants": "^3.0.2", "shiki": "^3.2.1", "smol-toml": "^1.3.4", "unified": "^11.0.5", "unist-util-remove-position": "^5.0.0", "unist-util-visit": "^5.0.0", "unist-util-visit-parents": "^6.0.1", "vfile": "^6.0.3" } }, "sha512-bwylYktCTsLMVoCOEHbn2GSUA3c5KT/qilekBKA3CBng0bo1TYjNZPr761vxumRk9kJGqTOtU+fgCAp5Vwokug=="],
+    "@astrojs/markdown-remark": ["@astrojs/markdown-remark@6.3.7", "", { "dependencies": { "@astrojs/internal-helpers": "0.7.3", "@astrojs/prism": "3.3.0", "github-slugger": "^2.0.0", "hast-util-from-html": "^2.0.3", "hast-util-to-text": "^4.0.2", "import-meta-resolve": "^4.2.0", "js-yaml": "^4.1.0", "mdast-util-definitions": "^6.0.0", "rehype-raw": "^7.0.0", "rehype-stringify": "^10.0.1", "remark-gfm": "^4.0.1", "remark-parse": "^11.0.0", "remark-rehype": "^11.1.2", "remark-smartypants": "^3.0.2", "shiki": "^3.12.2", "smol-toml": "^1.4.2", "unified": "^11.0.5", "unist-util-remove-position": "^5.0.0", "unist-util-visit": "^5.0.0", "unist-util-visit-parents": "^6.0.1", "vfile": "^6.0.3" } }, "sha512-KXGdq6/BC18doBCYXp08alHlWChH0hdD2B1qv9wIyOHbvwI5K6I7FhSta8dq1hBQNdun8YkKPR013D/Hm8xd0g=="],

-    "@astrojs/mdx": ["@astrojs/mdx@4.3.5", "", { "dependencies": { "@astrojs/markdown-remark": "6.3.6", "@mdx-js/mdx": "^3.1.1", "acorn": "^8.15.0", "es-module-lexer": "^1.7.0", "estree-util-visit": "^2.0.0", "hast-util-to-html": "^9.0.5", "kleur": "^4.1.5", "rehype-raw": "^7.0.0", "remark-gfm": "^4.0.1", "remark-smartypants": "^3.0.2", "source-map": "^0.7.6", "unist-util-visit": "^5.0.0", "vfile": "^6.0.3" }, "peerDependencies": { "astro": "^5.0.0" } }, "sha512-YB3Hhsvl1BxyY0ARe1OrnVzLNKDPXAz9epYvmL+MQ8A85duSsSLQaO3GHB6/qZJKNoLmP6PptOtCONCKkbhPeQ=="],
+    "@astrojs/mdx": ["@astrojs/mdx@4.3.6", "", { "dependencies": { "@astrojs/markdown-remark": "6.3.7", "@mdx-js/mdx": "^3.1.1", "acorn": "^8.15.0", "es-module-lexer": "^1.7.0", "estree-util-visit": "^2.0.0", "hast-util-to-html": "^9.0.5", "kleur": "^4.1.5", "rehype-raw": "^7.0.0", "remark-gfm": "^4.0.1", "remark-smartypants": "^3.0.2", "source-map": "^0.7.6", "unist-util-visit": "^5.0.0", "vfile": "^6.0.3" }, "peerDependencies": { "astro": "^5.0.0" } }, "sha512-jH04tYgaqLfq3To42+z1oEcXrXUzo3BxZ4fTkb+7BEmOJkQ9/c3iIixFEC+x0GgE8lJb4SuEDGldpAv7+1yY8A=="],

-    "@astrojs/node": ["@astrojs/node@9.4.3", "", { "dependencies": { "@astrojs/internal-helpers": "0.7.2", "send": "^1.2.0", "server-destroy": "^1.0.1" }, "peerDependencies": { "astro": "^5.7.0" } }, "sha512-P9BQHY8wQU1y9obknXzxV5SS3EpdaRnuDuHKr3RFC7t+2AzcMXeVmMJprQGijnQ8VdijJ8aS7+12tx325TURMQ=="],
+    "@astrojs/node": ["@astrojs/node@9.4.4", "", { "dependencies": { "@astrojs/internal-helpers": "0.7.3", "send": "^1.2.0", "server-destroy": "^1.0.1" }, "peerDependencies": { "astro": "^5.7.0" } }, "sha512-zQelZmeejnpw3Y5cj2gCyAZ6HT7tjgsWLZH8k40s3bTaT6lqJXlPtKJeIsuEcod21vZLODqBEQeu0CWrWm01EQ=="],

    "@astrojs/prism": ["@astrojs/prism@3.3.0", "", { "dependencies": { "prismjs": "^1.30.0" } }, "sha512-q8VwfU/fDZNoDOf+r7jUnMC2//H2l0TuQ6FkGJL8vD8nw/q5KiL3DS1KKBI3QhI9UQhpJ5dc7AtqfbXWuOgLCQ=="],

@@ -113,7 +113,7 @@

    "@babel/compat-data": ["@babel/compat-data@7.27.3", "", {}, "sha512-V42wFfx1ymFte+ecf6iXghnnP8kWTO+ZLXIyZq+1LAXHHvTZdVxicn4yiVYdYMGaCO3tmqub11AorKkv+iodqw=="],

-    "@babel/core": ["@babel/core@7.28.3", "", { "dependencies": { "@ampproject/remapping": "^2.2.0", "@babel/code-frame": "^7.27.1", "@babel/generator": "^7.28.3", "@babel/helper-compilation-targets": "^7.27.2", "@babel/helper-module-transforms": "^7.28.3", "@babel/helpers": "^7.28.3", "@babel/parser": "^7.28.3", "@babel/template": "^7.27.2", "@babel/traverse": "^7.28.3", "@babel/types": "^7.28.2", "convert-source-map": "^2.0.0", "debug": "^4.1.0", "gensync": "^1.0.0-beta.2", "json5": "^2.2.3", "semver": "^6.3.1" } }, "sha512-yDBHV9kQNcr2/sUr9jghVyz9C3Y5G2zUM2H2lo+9mKv4sFgbA8s8Z9t8D1jiTkGoO/NoIfKMyKWr4s6CN23ZwQ=="],
+    "@babel/core": ["@babel/core@7.28.4", "", { "dependencies": { "@babel/code-frame": "^7.27.1", "@babel/generator": "^7.28.3", "@babel/helper-compilation-targets": "^7.27.2", "@babel/helper-module-transforms": "^7.28.3", "@babel/helpers": "^7.28.4", "@babel/parser": "^7.28.4", "@babel/template": "^7.27.2", "@babel/traverse": "^7.28.4", "@babel/types": "^7.28.4", "@jridgewell/remapping": "^2.3.5", "convert-source-map": "^2.0.0", "debug": "^4.1.0", "gensync": "^1.0.0-beta.2", "json5": "^2.2.3", "semver": "^6.3.1" } }, "sha512-2BCOP7TN8M+gVDj7/ht3hsaO/B/n5oDbiAyyvnRlNOs+u1o+JWNYTQrmpuNp1/Wq2gcFrI01JAW+paEKDMx/CA=="],

    "@babel/generator": ["@babel/generator@7.28.3", "", { "dependencies": { "@babel/parser": "^7.28.3", "@babel/types": "^7.28.2", "@jridgewell/gen-mapping": "^0.3.12", "@jridgewell/trace-mapping": "^0.3.28", "jsesc": "^3.0.2" } }, "sha512-3lSpxGgvnmZznmBkCRnVREPUFJv2wrv9iAoFDvADJc0ypmdOxdUtcLeBgBJ6zE0PMeTKnxeQzyk0xTBq4Ep7zw=="],

@@ -133,9 +133,9 @@

    "@babel/helper-validator-option": ["@babel/helper-validator-option@7.27.1", "", {}, "sha512-YvjJow9FxbhFFKDSuFnVCe2WxXk1zWc22fFePVNEaWJEu8IrZVlda6N0uHwzZrUM1il7NC9Mlp4MaJYbYd9JSg=="],

-    "@babel/helpers": ["@babel/helpers@7.28.3", "", { "dependencies": { "@babel/template": "^7.27.2", "@babel/types": "^7.28.2" } }, "sha512-PTNtvUQihsAsDHMOP5pfobP8C6CM4JWXmP8DrEIt46c3r2bf87Ua1zoqevsMo9g+tWDwgWrFP5EIxuBx5RudAw=="],
+    "@babel/helpers": ["@babel/helpers@7.28.4", "", { "dependencies": { "@babel/template": "^7.27.2", "@babel/types": "^7.28.4" } }, "sha512-HFN59MmQXGHVyYadKLVumYsA9dBFun/ldYxipEjzA4196jpLZd8UjEEBLkbEkvfYreDqJhZxYAWFPtrfhNpj4w=="],

-    "@babel/parser": ["@babel/parser@7.28.3", "", { "dependencies": { "@babel/types": "^7.28.2" }, "bin": "./bin/babel-parser.js" }, "sha512-7+Ey1mAgYqFAx2h0RuoxcQT5+MlG3GTV0TQrgr7/ZliKsm/MNDxVVutlWaziMq7wJNAz8MTqz55XLpWvva6StA=="],
+    "@babel/parser": ["@babel/parser@7.28.4", "", { "dependencies": { "@babel/types": "^7.28.4" }, "bin": "./bin/babel-parser.js" }, "sha512-yZbBqeM6TkpP9du/I2pUZnJsRMGGvOuIrhjzC1AwHwW+6he4mni6Bp/m8ijn0iOuZuPI2BfkCoSRunpyjnrQKg=="],

    "@babel/plugin-transform-react-jsx-self": ["@babel/plugin-transform-react-jsx-self@7.27.1", "", { "dependencies": { "@babel/helper-plugin-utils": "^7.27.1" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-6UzkCs+ejGdZ5mFFC/OCUrv028ab2fp1znZmCZjAOBKiBK2jXD1O+BPSfX8X2qjJ75fZBMSnQn3Rq2mrBJK2mw=="],

@@ -145,13 +145,15 @@

    "@babel/template": ["@babel/template@7.27.2", "", { "dependencies": { "@babel/code-frame": "^7.27.1", "@babel/parser": "^7.27.2", "@babel/types": "^7.27.1" } }, "sha512-LPDZ85aEJyYSd18/DkjNh4/y1ntkE5KwUHWTiqgRxruuZL2F1yuHligVHLvcHY2vMHXttKFpJn6LwfI7cw7ODw=="],

-    "@babel/traverse": ["@babel/traverse@7.28.3", "", { "dependencies": { "@babel/code-frame": "^7.27.1", "@babel/generator": "^7.28.3", "@babel/helper-globals": "^7.28.0", "@babel/parser": "^7.28.3", "@babel/template": "^7.27.2", "@babel/types": "^7.28.2", "debug": "^4.3.1" } }, "sha512-7w4kZYHneL3A6NP2nxzHvT3HCZ7puDZZjFMqDpBPECub79sTtSO5CGXDkKrTQq8ksAwfD/XI2MRFX23njdDaIQ=="],
+    "@babel/traverse": ["@babel/traverse@7.28.4", "", { "dependencies": { "@babel/code-frame": "^7.27.1", "@babel/generator": "^7.28.3", "@babel/helper-globals": "^7.28.0", "@babel/parser": "^7.28.4", "@babel/template": "^7.27.2", "@babel/types": "^7.28.4", "debug": "^4.3.1" } }, "sha512-YEzuboP2qvQavAcjgQNVgsvHIDv6ZpwXvcvjmyySP2DIMuByS/6ioU5G9pYrWHM6T2YDfc7xga9iNzYOs12CFQ=="],

-    "@babel/types": ["@babel/types@7.28.2", "", { "dependencies": { "@babel/helper-string-parser": "^7.27.1", "@babel/helper-validator-identifier": "^7.27.1" } }, "sha512-ruv7Ae4J5dUYULmeXw1gmb7rYRz57OWCPM57pHojnLq/3Z1CK2lNSLTCVjxVk1F/TZHwOZZrOWi0ur95BbLxNQ=="],
+    "@babel/types": ["@babel/types@7.28.4", "", { "dependencies": { "@babel/helper-string-parser": "^7.27.1", "@babel/helper-validator-identifier": "^7.27.1" } }, "sha512-bkFqkLhh3pMBUQQkpVgWDWq/lqzc2678eUyDlTBhRqhCHFguYYGM0Efga7tYk4TogG/3x0EEl66/OQ+WGbWB/Q=="],

-    "@better-auth/sso": ["@better-auth/sso@1.3.9", "", { "dependencies": { "@better-fetch/fetch": "^1.1.18", "fast-xml-parser": "^5.2.5", "jose": "^5.10.0", "oauth2-mock-server": "^7.2.1", "samlify": "^2.10.1", "zod": "^4.1.5" }, "peerDependencies": { "better-auth": "1.3.9" } }, "sha512-rYbFtl/MpD6iEyKSnwTlG8jdu6xqYmDF1Bmx2P8NaXzTtkhb432Q045vqB7cWpZKpLCf2tNK5QeAyPhS0zg+Gw=="],
+    "@better-auth/core": ["@better-auth/core@1.3.24", "", { "dependencies": { "better-call": "1.0.19", "zod": "^4.1.5" } }, "sha512-nU4aj5SA0COXAls0p3htIWmGPOG+76HULd9tG8CEUfwcK95rRrUIUN74FKvsAu3b18AVj3E7cL4bYrQS3KYKRw=="],

-    "@better-auth/utils": ["@better-auth/utils@0.2.6", "", { "dependencies": { "uncrypto": "^0.1.3" } }, "sha512-3y/vaL5Ox33dBwgJ6ub3OPkVqr6B5xL2kgxNHG8eHZuryLyG/4JSPGqjbdRSgjuy9kALUZYDFl+ORIAxlWMSuA=="],
+    "@better-auth/sso": ["@better-auth/sso@1.3.24", "", { "dependencies": { "@better-fetch/fetch": "^1.1.18", "fast-xml-parser": "^5.2.5", "jose": "^6.1.0", "oauth2-mock-server": "^7.2.1", "samlify": "^2.10.1", "zod": "^4.1.5" }, "peerDependencies": { "better-auth": "1.3.24" } }, "sha512-amlUbuKpTotFPBOsl+6L4WvPYQ4Hd37DfLxAeeiCqCaKUiHLyiepgH7/zPll4vMSB5gYt1e312J70S1Kz9v53g=="],
+
+    "@better-auth/utils": ["@better-auth/utils@0.3.0", "", {}, "sha512-W+Adw6ZA6mgvnSnhOki270rwJ42t4XzSK6YWGF//BbVXL6SwCLWfyzBc1lN2m/4RM28KubdBKQ4X5VMoLRNPQw=="],

    "@better-fetch/fetch": ["@better-fetch/fetch@1.1.18", "", {}, "sha512-rEFOE1MYIsBmoMJtQbl32PGHHXuG2hDxvEd7rUHE0vCBoFQVSDqaVs9hkZEtHCxRoY+CljXKFCOuJ8uxqw1LcA=="],

@@ -185,7 +187,7 @@

    "@emnapi/runtime": ["@emnapi/runtime@1.4.5", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-++LApOtY0pEEz1zrd9vy1/zXVaVJJ/EbAF3u0fXIzPJEDtnITsBGbbK0EkM72amhl/R5b+5xx0Y/QhcVOpuulg=="],

-    "@esbuild-kit/esm-loader": ["tsx@4.20.5", "", { "dependencies": { "esbuild": "~0.25.0", "get-tsconfig": "^4.7.5" }, "optionalDependencies": { "fsevents": "~2.3.3" }, "bin": { "tsx": "dist/cli.mjs" } }, "sha512-+wKjMNU9w/EaQayHXb7WA7ZaHY6hN8WgfvHNQ3t1PnU91/7O8TcTnIhCDYTZwnt8JsO9IBqZ30Ln1r7pPF52Aw=="],
+    "@esbuild-kit/esm-loader": ["tsx@4.20.6", "", { "dependencies": { "esbuild": "~0.25.0", "get-tsconfig": "^4.7.5" }, "optionalDependencies": { "fsevents": "~2.3.3" }, "bin": { "tsx": "dist/cli.mjs" } }, "sha512-ytQKuwgmrrkDTFP4LjR0ToE2nqgy886GpvRSpU0JAnrdBYppuY5rLkRUYPU1yCryb24SsKBTL/hlDQAEFVwtZg=="],

    "@esbuild/aix-ppc64": ["@esbuild/aix-ppc64@0.25.9", "", { "os": "aix", "cpu": "ppc64" }, "sha512-OaGtL73Jck6pBKjNIe24BnFE6agGl+6KxDtTfHhy1HmhthfKouEcOhqpSL64K4/0WCtbKFLOdzD/44cJ4k9opA=="],

@@ -295,7 +297,7 @@

    "@isaacs/fs-minipass": ["@isaacs/fs-minipass@4.0.1", "", { "dependencies": { "minipass": "^7.0.4" } }, "sha512-wgm9Ehl2jpeqP3zw/7mo3kRHFp5MEDhqAdwy1fTGkHAwnkGOVsgpvQhL8B5n1qlb01jV3n/bI0ZfZp5lWA1k4w=="],

-    "@jridgewell/gen-mapping": ["@jridgewell/gen-mapping@0.3.8", "", { "dependencies": { "@jridgewell/set-array": "^1.2.1", "@jridgewell/sourcemap-codec": "^1.4.10", "@jridgewell/trace-mapping": "^0.3.24" } }, "sha512-imAbBGkb+ebQyxKgzv5Hu2nmROxoDOXHh80evxdoXNOrvAnVx7zimzc1Oo5h9RlfV4vPXaE2iM5pOFbvOCClWA=="],
+    "@jridgewell/gen-mapping": ["@jridgewell/gen-mapping@0.3.12", "", { "dependencies": { "@jridgewell/sourcemap-codec": "^1.5.0", "@jridgewell/trace-mapping": "^0.3.24" } }, "sha512-OuLGC46TjB5BbN1dH8JULVVZY4WTdkF7tV9Ys6wLL1rubZnCMstOhNHueU5bLCrnRuDhKPDM4g6sw4Bel5Gzqg=="],

    "@jridgewell/remapping": ["@jridgewell/remapping@2.3.5", "", { "dependencies": { "@jridgewell/gen-mapping": "^0.3.5", "@jridgewell/trace-mapping": "^0.3.24" } }, "sha512-LI9u/+laYG4Ds1TDKSJW2YPrIlcVYOwi2fUC6xB43lueCjgxV4lffOCZCtYFiH6TNOX+tQKXx97T4IKHbhyHEQ=="],

@@ -305,7 +307,7 @@

    "@jridgewell/sourcemap-codec": ["@jridgewell/sourcemap-codec@1.5.0", "", {}, "sha512-gv3ZRaISU3fjPAgNsriBRqGWQL6quFx04YMPW/zD8XMLsU32mhCCbfbO6KZFLjvYpCZ8zyDEgqsgf+PwPaM7GQ=="],

-    "@jridgewell/trace-mapping": ["@jridgewell/trace-mapping@0.3.25", "", { "dependencies": { "@jridgewell/resolve-uri": "^3.1.0", "@jridgewell/sourcemap-codec": "^1.4.14" } }, "sha512-vNk6aEwybGtawWmy/PzwnGDOjCkLWSD2wqvjGGAgOAwCGWySYXfYoxt00IJkTF+8Lb57DwOb3Aa0o9CApepiYQ=="],
+    "@jridgewell/trace-mapping": ["@jridgewell/trace-mapping@0.3.29", "", { "dependencies": { "@jridgewell/resolve-uri": "^3.1.0", "@jridgewell/sourcemap-codec": "^1.4.14" } }, "sha512-uw6guiW/gcAGPDhLmd77/6lW8QLeiV5RUTsAX46Db6oLhGaVj4lhnPwb184s1bkc8kdVg/+h988dro8GRDpmYQ=="],

    "@levischuck/tiny-cbor": ["@levischuck/tiny-cbor@0.2.11", "", {}, "sha512-llBRm4dT4Z89aRsm6u2oEZ8tfwL/2l6BwpZ7JcyieouniDECM5AqNgr/y08zalEIvW3RSK4upYyybDcmjXqAow=="],

@@ -329,7 +331,7 @@

    "@octokit/graphql": ["@octokit/graphql@9.0.1", "", { "dependencies": { "@octokit/request": "^10.0.2", "@octokit/types": "^14.0.0", "universal-user-agent": "^7.0.0" } }, "sha512-j1nQNU1ZxNFx2ZtKmL4sMrs4egy5h65OMDmSbVyuCzjOcwsHq6EaYjOTGXPQxgfiN8dJ4CriYHk6zF050WEULg=="],

-    "@octokit/openapi-types": ["@octokit/openapi-types@25.1.0", "", {}, "sha512-idsIggNXUKkk0+BExUn1dQ92sfysJrje03Q0bv0e+KPLrvyqZF8MnBpFz8UNfYDwB3Ie7Z0TByjWfzxt7vseaA=="],
+    "@octokit/openapi-types": ["@octokit/openapi-types@26.0.0", "", {}, "sha512-7AtcfKtpo77j7Ts73b4OWhOZHTKo/gGY8bB3bNBQz4H+GRSWqx2yvj8TXRsbdTE0eRmYmXOEY66jM7mJ7LzfsA=="],

    "@octokit/plugin-paginate-rest": ["@octokit/plugin-paginate-rest@13.0.1", "", { "dependencies": { "@octokit/types": "^14.1.0" }, "peerDependencies": { "@octokit/core": ">=6" } }, "sha512-m1KvHlueScy4mQJWvFDCxFBTIdXS0K1SgFGLmqHyX90mZdCIv6gWBbKRhatxRjhGlONuTK/hztYdaqrTXcFZdQ=="],

@@ -337,7 +339,7 @@

    "@octokit/plugin-rest-endpoint-methods": ["@octokit/plugin-rest-endpoint-methods@16.0.0", "", { "dependencies": { "@octokit/types": "^14.1.0" }, "peerDependencies": { "@octokit/core": ">=6" } }, "sha512-kJVUQk6/dx/gRNLWUnAWKFs1kVPn5O5CYZyssyEoNYaFedqZxsfYs7DwI3d67hGz4qOwaJ1dpm07hOAD1BXx6g=="],

-    "@octokit/plugin-throttling": ["@octokit/plugin-throttling@11.0.1", "", { "dependencies": { "@octokit/types": "^14.0.0", "bottleneck": "^2.15.3" }, "peerDependencies": { "@octokit/core": "^7.0.0" } }, "sha512-S+EVhy52D/272L7up58dr3FNSMXWuNZolkL4zMJBNIfIxyZuUcczsQAU4b5w6dewJXnKYVgSHSV5wxitMSW1kw=="],
+    "@octokit/plugin-throttling": ["@octokit/plugin-throttling@11.0.2", "", { "dependencies": { "@octokit/types": "^15.0.0", "bottleneck": "^2.15.3" }, "peerDependencies": { "@octokit/core": "^7.0.0" } }, "sha512-ntNIig4zZhQVOZF4fG9Wt8QCoz9ehb+xnlUwp74Ic2ANChCk8oKmRwV9zDDCtrvU1aERIOvtng8wsalEX7Jk5Q=="],

    "@octokit/request": ["@octokit/request@10.0.2", "", { "dependencies": { "@octokit/endpoint": "^11.0.0", "@octokit/request-error": "^7.0.0", "@octokit/types": "^14.0.0", "fast-content-type-parse": "^3.0.0", "universal-user-agent": "^7.0.2" } }, "sha512-iYj4SJG/2bbhh+iIpFmG5u49DtJ4lipQ+aPakjL9OKpsGY93wM8w06gvFbEQxcMsZcCvk5th5KkIm2m8o14aWA=="],

@@ -345,7 +347,7 @@

    "@octokit/rest": ["@octokit/rest@22.0.0", "", { "dependencies": { "@octokit/core": "^7.0.2", "@octokit/plugin-paginate-rest": "^13.0.1", "@octokit/plugin-request-log": "^6.0.0", "@octokit/plugin-rest-endpoint-methods": "^16.0.0" } }, "sha512-z6tmTu9BTnw51jYGulxrlernpsQYXpui1RK21vmXn8yF5bp6iX16yfTtJYGK5Mh1qDkvDOmp2n8sRMcQmR8jiA=="],

-    "@octokit/types": ["@octokit/types@14.1.0", "", { "dependencies": { "@octokit/openapi-types": "^25.1.0" } }, "sha512-1y6DgTy8Jomcpu33N+p5w58l6xyt55Ar2I91RPiIA0xCJBXyUAhXCcmZaDWSANiha7R9a6qJJ2CRomGPZ6f46g=="],
+    "@octokit/types": ["@octokit/types@15.0.0", "", { "dependencies": { "@octokit/openapi-types": "^26.0.0" } }, "sha512-8o6yDfmoGJUIeR9OfYU0/TUJTnMPG2r68+1yEdUeG2Fdqpj8Qetg0ziKIgcBm0RW/j29H41WP37CYCEhp6GoHQ=="],

    "@oslojs/encoding": ["@oslojs/encoding@1.1.0", "", {}, "sha512-70wQhgYmndg4GCPxPPxPGevRKqTIJ2Nh4OkiMWmDAVYsTQ+Ta7Sq+rPevXyXGdzr30/qZBnyOalCszoMxlyldQ=="],

@@ -451,7 +453,7 @@

    "@radix-ui/rect": ["@radix-ui/rect@1.1.1", "", {}, "sha512-HPwpGIzkl28mWyZqG52jiqDJ12waP11Pa1lGoiyUkIEuMLBP0oeK/C89esbXrxsky5we7dfd8U58nm0SgAWpVw=="],

-    "@rolldown/pluginutils": ["@rolldown/pluginutils@1.0.0-beta.34", "", {}, "sha512-LyAREkZHP5pMom7c24meKmJCdhf2hEyvam2q0unr3or9ydwDL+DJ8chTF6Av/RFPb3rH8UFBdMzO5MxTZW97oA=="],
+    "@rolldown/pluginutils": ["@rolldown/pluginutils@1.0.0-beta.38", "", {}, "sha512-N/ICGKleNhA5nc9XXQG/kkKHJ7S55u0x0XUJbbkmdCnFuoRkM1Il12q9q0eX19+M7KKUEPw/daUPIRnxhcxAIw=="],

    "@rollup/pluginutils": ["@rollup/pluginutils@5.3.0", "", { "dependencies": { "@types/estree": "^1.0.0", "estree-walker": "^2.0.2", "picomatch": "^4.0.2" }, "peerDependencies": { "rollup": "^1.20.0||^2.0.0||^3.0.0||^4.0.0" }, "optionalPeers": ["rollup"] }, "sha512-5EdhGZtnu3V88ces7s53hhfK5KSASnJZv8Lulpc04cWO3REESroJXg73DFsOmgbU2BhwV0E20bu2IDZb3VKW4Q=="],

@@ -551,7 +553,7 @@

    "@testing-library/dom": ["@testing-library/dom@10.4.0", "", { "dependencies": { "@babel/code-frame": "^7.10.4", "@babel/runtime": "^7.12.5", "@types/aria-query": "^5.0.1", "aria-query": "5.3.0", "chalk": "^4.1.0", "dom-accessibility-api": "^0.5.9", "lz-string": "^1.5.0", "pretty-format": "^27.0.2" } }, "sha512-pemlzrSESWbdAloYml3bAJMEfNh1Z7EduzqPKprCH5S341frlpYnUEW0H72dLxa6IsYr+mPno20GiSm+h9dEdQ=="],

-    "@testing-library/jest-dom": ["@testing-library/jest-dom@6.8.0", "", { "dependencies": { "@adobe/css-tools": "^4.4.0", "aria-query": "^5.0.0", "css.escape": "^1.5.1", "dom-accessibility-api": "^0.6.3", "picocolors": "^1.1.1", "redent": "^3.0.0" } }, "sha512-WgXcWzVM6idy5JaftTVC8Vs83NKRmGJz4Hqs4oyOuO2J4r/y79vvKZsb+CaGyCSEbUPI6OsewfPd0G1A0/TUZQ=="],
+    "@testing-library/jest-dom": ["@testing-library/jest-dom@6.9.0", "", { "dependencies": { "@adobe/css-tools": "^4.4.0", "aria-query": "^5.0.0", "css.escape": "^1.5.1", "dom-accessibility-api": "^0.6.3", "picocolors": "^1.1.1", "redent": "^3.0.0" } }, "sha512-QHdxYMJ0YPGKYofMc6zYvo7LOViVhdc6nPg/OtM2cf9MQrwEcTxFCs7d/GJ5eSyPkHzOiBkc/KfLdFJBHzldtQ=="],

    "@testing-library/react": ["@testing-library/react@16.3.0", "", { "dependencies": { "@babel/runtime": "^7.12.5" }, "peerDependencies": { "@testing-library/dom": "^10.0.0", "@types/react": "^18.0.0 || ^19.0.0", "@types/react-dom": "^18.0.0 || ^19.0.0", "react": "^18.0.0 || ^19.0.0", "react-dom": "^18.0.0 || ^19.0.0" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-kFSyxiEDwv1WLl2fgsq6pPBbw5aWKrsY2/noi1Id0TK0UParSF62oFQFGHXIyaG4pp2tEub/Zlel+fjjZILDsw=="],

@@ -567,7 +569,7 @@

    "@types/bcryptjs": ["@types/bcryptjs@3.0.0", "", { "dependencies": { "bcryptjs": "*" } }, "sha512-WRZOuCuaz8UcZZE4R5HXTco2goQSI2XxjGY3hbM/xDvwmqFWd4ivooImsMx65OKM6CtNKbnZ5YL+YwAwK7c1dg=="],

-    "@types/bun": ["@types/bun@1.2.21", "", { "dependencies": { "bun-types": "1.2.21" } }, "sha512-NiDnvEqmbfQ6dmZ3EeUO577s4P5bf4HCTXtI6trMc6f6RzirY5IrF3aIookuSpyslFzrnvv2lmEWv5HyC1X79A=="],
+    "@types/bun": ["@types/bun@1.2.23", "", { "dependencies": { "bun-types": "1.2.23" } }, "sha512-le8ueOY5b6VKYf19xT3McVbXqLqmxzPXHsQT/q9JHgikJ2X22wyTW3g3ohz2ZMnp7dod6aduIiq8A14Xyimm0A=="],

    "@types/canvas-confetti": ["@types/canvas-confetti@1.9.0", "", {}, "sha512-aBGj/dULrimR1XDZLtG9JwxX1b4HPRF6CX9Yfwh3NvstZEm1ZL7RBnel4keCPSqs1ANRu1u2Aoz9R+VmtjYuTg=="],

@@ -597,7 +599,7 @@

    "@types/node": ["@types/node@22.15.23", "", { "dependencies": { "undici-types": "~6.21.0" } }, "sha512-7Ec1zaFPF4RJ0eXu1YT/xgiebqwqoJz8rYPDi/O2BcZ++Wpt0Kq9cl0eg6NN6bYbPnR67ZLo7St5Q3UK0SnARw=="],

-    "@types/react": ["@types/react@19.1.12", "", { "dependencies": { "csstype": "^3.0.2" } }, "sha512-cMoR+FoAf/Jyq6+Df2/Z41jISvGZZ2eTlnsaJRptmZ76Caldwy1odD4xTr/gNV9VLj0AWgg/nmkevIyUfIIq5w=="],
+    "@types/react": ["@types/react@19.1.16", "", { "dependencies": { "csstype": "^3.0.2" } }, "sha512-WBM/nDbEZmDUORKnh5i1bTnAz6vTohUf9b8esSMu+b24+srbaxa04UbJgWx78CVfNXA20sNu0odEIluZDFdCog=="],

    "@types/react-dom": ["@types/react-dom@19.1.9", "", { "peerDependencies": { "@types/react": "^19.0.0" } }, "sha512-qXRuZaOsAdXKFyOhRBg6Lqqc0yay13vN7KrIg4L7N4aaHN68ma9OK3NE1BoDFgFOTfM7zg+3/8+2n8rLUH3OKQ=="],

@@ -607,7 +609,7 @@

    "@ungap/structured-clone": ["@ungap/structured-clone@1.3.0", "", {}, "sha512-WmoN8qaIAo7WTYWbAZuG8PYEhn5fkz7dZrqTBZ7dtt//lL2Gwms1IcnQ5yHqjDfX8Ft5j4YzDM23f87zBfDe9g=="],

-    "@vitejs/plugin-react": ["@vitejs/plugin-react@5.0.2", "", { "dependencies": { "@babel/core": "^7.28.3", "@babel/plugin-transform-react-jsx-self": "^7.27.1", "@babel/plugin-transform-react-jsx-source": "^7.27.1", "@rolldown/pluginutils": "1.0.0-beta.34", "@types/babel__core": "^7.20.5", "react-refresh": "^0.17.0" }, "peerDependencies": { "vite": "^4.2.0 || ^5.0.0 || ^6.0.0 || ^7.0.0" } }, "sha512-tmyFgixPZCx2+e6VO9TNITWcCQl8+Nl/E8YbAyPVv85QCc7/A3JrdfG2A8gIzvVhWuzMOVrFW1aReaNxrI6tbw=="],
+    "@vitejs/plugin-react": ["@vitejs/plugin-react@5.0.4", "", { "dependencies": { "@babel/core": "^7.28.4", "@babel/plugin-transform-react-jsx-self": "^7.27.1", "@babel/plugin-transform-react-jsx-source": "^7.27.1", "@rolldown/pluginutils": "1.0.0-beta.38", "@types/babel__core": "^7.20.5", "react-refresh": "^0.17.0" }, "peerDependencies": { "vite": "^4.2.0 || ^5.0.0 || ^6.0.0 || ^7.0.0" } }, "sha512-La0KD0vGkVkSk6K+piWDKRUyg8Rl5iAIKRMH0vMJI0Eg47bq1eOxmoObAaQG37WMW9MSyk7Cs8EIWwJC1PtzKA=="],

    "@vitest/expect": ["@vitest/expect@3.2.4", "", { "dependencies": { "@types/chai": "^5.2.2", "@vitest/spy": "3.2.4", "@vitest/utils": "3.2.4", "chai": "^5.2.0", "tinyrainbow": "^2.0.0" } }, "sha512-Io0yyORnB6sikFlt8QW5K7slY4OjqNX9jmJQ02QDda8lyM6B5oNgVWoSoKPac8/kgnCUzuHQKrSLtu/uOqqrig=="],

@@ -679,7 +681,7 @@

    "astring": ["astring@1.9.0", "", { "bin": { "astring": "bin/astring" } }, "sha512-LElXdjswlqjWrPpJFg1Fx4wpkOCxj1TDHlSV4PlaRxHGWko024xICaa97ZkMfs6DRKlCguiAI+rbXv5GWwXIkg=="],

-    "astro": ["astro@5.13.7", "", { "dependencies": { "@astrojs/compiler": "^2.12.2", "@astrojs/internal-helpers": "0.7.2", "@astrojs/markdown-remark": "6.3.6", "@astrojs/telemetry": "3.3.0", "@capsizecss/unpack": "^2.4.0", "@oslojs/encoding": "^1.1.0", "@rollup/pluginutils": "^5.2.0", "acorn": "^8.15.0", "aria-query": "^5.3.2", "axobject-query": "^4.1.0", "boxen": "8.0.1", "ci-info": "^4.3.0", "clsx": "^2.1.1", "common-ancestor-path": "^1.0.1", "cookie": "^1.0.2", "cssesc": "^3.0.0", "debug": "^4.4.1", "deterministic-object-hash": "^2.0.2", "devalue": "^5.1.1", "diff": "^5.2.0", "dlv": "^1.1.3", "dset": "^3.1.4", "es-module-lexer": "^1.7.0", "esbuild": "^0.25.0", "estree-walker": "^3.0.3", "flattie": "^1.1.1", "fontace": "~0.3.0", "github-slugger": "^2.0.0", "html-escaper": "3.0.3", "http-cache-semantics": "^4.2.0", "import-meta-resolve": "^4.2.0", "js-yaml": "^4.1.0", "kleur": "^4.1.5", "magic-string": "^0.30.18", "magicast": "^0.3.5", "mrmime": "^2.0.1", "neotraverse": "^0.6.18", "p-limit": "^6.2.0", "p-queue": "^8.1.0", "package-manager-detector": "^1.3.0", "picomatch": "^4.0.3", "prompts": "^2.4.2", "rehype": "^13.0.2", "semver": "^7.7.2", "shiki": "^3.12.0", "smol-toml": "^1.4.2", "tinyexec": "^0.3.2", "tinyglobby": "^0.2.14", "tsconfck": "^3.1.6", "ultrahtml": "^1.6.0", "unifont": "~0.5.2", "unist-util-visit": "^5.0.0", "unstorage": "^1.17.0", "vfile": "^6.0.3", "vite": "^6.3.6", "vitefu": "^1.1.1", "xxhash-wasm": "^1.1.0", "yargs-parser": "^21.1.1", "yocto-spinner": "^0.2.3", "zod": "^3.25.76", "zod-to-json-schema": "^3.24.6", "zod-to-ts": "^1.2.0" }, "optionalDependencies": { "sharp": "^0.34.0" }, "bin": { "astro": "astro.js" } }, "sha512-Of2tST7ErbE4y1dVb4aWDXaQSIRBAfraJ4jDqaA3PzPRJOn6Ina36+tQ+8BezjYqiWwRRJdOEE07PRAJXnsddw=="],
+    "astro": ["astro@5.14.1", "", { "dependencies": { "@astrojs/compiler": "^2.12.2", "@astrojs/internal-helpers": "0.7.3", "@astrojs/markdown-remark": "6.3.7", "@astrojs/telemetry": "3.3.0", "@capsizecss/unpack": "^2.4.0", "@oslojs/encoding": "^1.1.0", "@rollup/pluginutils": "^5.2.0", "acorn": "^8.15.0", "aria-query": "^5.3.2", "axobject-query": "^4.1.0", "boxen": "8.0.1", "ci-info": "^4.3.0", "clsx": "^2.1.1", "common-ancestor-path": "^1.0.1", "cookie": "^1.0.2", "cssesc": "^3.0.0", "debug": "^4.4.1", "deterministic-object-hash": "^2.0.2", "devalue": "^5.3.2", "diff": "^5.2.0", "dlv": "^1.1.3", "dset": "^3.1.4", "es-module-lexer": "^1.7.0", "esbuild": "^0.25.0", "estree-walker": "^3.0.3", "flattie": "^1.1.1", "fontace": "~0.3.0", "github-slugger": "^2.0.0", "html-escaper": "3.0.3", "http-cache-semantics": "^4.2.0", "import-meta-resolve": "^4.2.0", "js-yaml": "^4.1.0", "kleur": "^4.1.5", "magic-string": "^0.30.18", "magicast": "^0.3.5", "mrmime": "^2.0.1", "neotraverse": "^0.6.18", "p-limit": "^6.2.0", "p-queue": "^8.1.0", "package-manager-detector": "^1.3.0", "picomatch": "^4.0.3", "prompts": "^2.4.2", "rehype": "^13.0.2", "semver": "^7.7.2", "shiki": "^3.12.0", "smol-toml": "^1.4.2", "tinyexec": "^0.3.2", "tinyglobby": "^0.2.14", "tsconfck": "^3.1.6", "ultrahtml": "^1.6.0", "unifont": "~0.5.2", "unist-util-visit": "^5.0.0", "unstorage": "^1.17.0", "vfile": "^6.0.3", "vite": "^6.3.6", "vitefu": "^1.1.1", "xxhash-wasm": "^1.1.0", "yargs-parser": "^21.1.1", "yocto-spinner": "^0.2.3", "zod": "^3.25.76", "zod-to-json-schema": "^3.24.6", "zod-to-ts": "^1.2.0" }, "optionalDependencies": { "sharp": "^0.34.0" }, "bin": { "astro": "astro.js" } }, "sha512-gPa8NY7/lP8j8g81iy8UwANF3+aukKRWS68IlthZQNgykpg80ne6lbHOp6FErYycxQ1TUhgEfkXVDQZAoJx8Bg=="],

    "axobject-query": ["axobject-query@4.1.0", "", {}, "sha512-qIj0G9wZbMGNLjLmg1PT6v2mE9AH2zlnADJD/2tC6E00hgmhUOfEB6greHPAfLRSufHqROIUTkw6E+M3lH0PTQ=="],

@@ -695,9 +697,9 @@

    "before-after-hook": ["before-after-hook@4.0.0", "", {}, "sha512-q6tR3RPqIB1pMiTRMFcZwuG5T8vwp+vUvEG0vuI6B+Rikh5BfPp2fQ82c925FOs+b0lcFQ8CFrL+KbilfZFhOQ=="],

-    "better-auth": ["better-auth@1.3.9", "", { "dependencies": { "@better-auth/utils": "0.2.6", "@better-fetch/fetch": "^1.1.18", "@noble/ciphers": "^2.0.0", "@noble/hashes": "^2.0.0", "@simplewebauthn/browser": "^13.1.2", "@simplewebauthn/server": "^13.1.2", "better-call": "1.0.18", "defu": "^6.1.4", "jose": "^6.1.0", "kysely": "^0.28.5", "nanostores": "^0.11.4", "zod": "^4.1.5" }, "peerDependencies": { "@lynx-js/react": "*", "react": "^18.0.0 || ^19.0.0", "react-dom": "^18.0.0 || ^19.0.0" }, "optionalPeers": ["@lynx-js/react", "react", "react-dom"] }, "sha512-Ty6BHzuShlqSs7I4RMlBRQ3duOWNB7WWriIu2FJVGjQAOtTVvamzFCR4/j5ROFLoNkpvNTRF7BJozsrMICL1gw=="],
+    "better-auth": ["better-auth@1.3.24", "", { "dependencies": { "@better-auth/core": "1.3.24", "@better-auth/utils": "0.3.0", "@better-fetch/fetch": "^1.1.18", "@noble/ciphers": "^2.0.0", "@noble/hashes": "^2.0.0", "@simplewebauthn/browser": "^13.1.2", "@simplewebauthn/server": "^13.1.2", "better-call": "1.0.19", "defu": "^6.1.4", "jose": "^6.1.0", "kysely": "^0.28.5", "nanostores": "^1.0.1", "zod": "^4.1.5" } }, "sha512-LyxIbnB2FExhjqQ/J1G8S8EAbmTBDFOz6CjqHNNu15Gux+c4fF0Si1YNLprROEb4EGNuGUfslurW0Q6nZ+Dobg=="],

-    "better-call": ["better-call@1.0.18", "", { "dependencies": { "@better-fetch/fetch": "^1.1.4", "rou3": "^0.5.1", "set-cookie-parser": "^2.7.1", "uncrypto": "^0.1.3" } }, "sha512-Ojyck3P3fs/egBmCW50tvfbCJorNV5KphfPOKrkCxPfOr8Brth1ruDtAJuhHVHEUiWrXv+vpEgWQk7m7FzhbbQ=="],
+    "better-call": ["better-call@1.0.19", "", { "dependencies": { "@better-auth/utils": "^0.3.0", "@better-fetch/fetch": "^1.1.4", "rou3": "^0.5.1", "set-cookie-parser": "^2.7.1", "uncrypto": "^0.1.3" } }, "sha512-sI3GcA1SCVa3H+CDHl8W8qzhlrckwXOTKhqq3OOPXjgn5aTOMIqGY34zLY/pHA6tRRMjTUC3lz5Mi7EbDA24Kw=="],

    "blob-to-buffer": ["blob-to-buffer@1.2.9", "", {}, "sha512-BF033y5fN6OCofD3vgHmNtwZWRcq9NLyyxyILx9hfMy1sXYy4ojFl765hJ2lP0YaN2fuxPaLO2Vzzoxy0FLFFA=="],

@@ -715,7 +717,7 @@

    "buffer-equal-constant-time": ["buffer-equal-constant-time@1.0.1", "", {}, "sha512-zRpUiDwd/xk6ADqPMATG8vc9VPrkck7T07OIx0gnjmJAnHnTVXNQG3vfvWNuiZIkwu9KrKdA1iJKfsfTVxE6NA=="],

-    "bun-types": ["bun-types@1.2.21", "", { "dependencies": { "@types/node": "*" }, "peerDependencies": { "@types/react": "^19" } }, "sha512-sa2Tj77Ijc/NTLS0/Odjq/qngmEPZfbfnOERi0KRUYhT9R8M4VBioWVmMWE5GrYbKMc+5lVybXygLdibHaqVqw=="],
+    "bun-types": ["bun-types@1.2.23", "", { "dependencies": { "@types/node": "*" }, "peerDependencies": { "@types/react": "^19" } }, "sha512-R9f0hKAZXgFU3mlrA0YpE/fiDvwV0FT9rORApt2aQVWSuJDzZOyB5QLc0N/4HF57CS8IXJ6+L5E4W1bW6NS2Aw=="],

    "bytes": ["bytes@3.1.2", "", {}, "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg=="],

@@ -845,9 +847,9 @@

    "dom-accessibility-api": ["dom-accessibility-api@0.6.3", "", {}, "sha512-7ZgogeTnjuHbo+ct10G9Ffp0mif17idi0IyWNVA/wcwcm7NPOD/WEHVP3n7n3MhXqxoIYm8d6MuZohYWIZ4T3w=="],

-    "dotenv": ["dotenv@17.2.2", "", {}, "sha512-Sf2LSQP+bOlhKWWyhFsn0UsfdK/kCWRv1iuA2gXAwt3dyNabr6QSj00I2V10pidqz69soatm9ZwZvpQMTIOd5Q=="],
+    "dotenv": ["dotenv@17.2.3", "", {}, "sha512-JVUnt+DUIzu87TABbhPmNfVdBDt18BLOWjMUFJMSi/Qqg7NTYtabbvSNJGOJ7afbRuv9D/lngizHtP7QyLQ+9w=="],

-    "drizzle-kit": ["drizzle-kit@0.31.4", "", { "dependencies": { "@drizzle-team/brocli": "^0.10.2", "@esbuild-kit/esm-loader": "^2.5.5", "esbuild": "^0.25.4", "esbuild-register": "^3.5.0" }, "bin": { "drizzle-kit": "bin.cjs" } }, "sha512-tCPWVZWZqWVx2XUsVpJRnH9Mx0ClVOf5YUHerZ5so1OKSlqww4zy1R5ksEdGRcO3tM3zj0PYN6V48TbQCL1RfA=="],
+    "drizzle-kit": ["drizzle-kit@0.31.5", "", { "dependencies": { "@drizzle-team/brocli": "^0.10.2", "@esbuild-kit/esm-loader": "^2.5.5", "esbuild": "^0.25.4", "esbuild-register": "^3.5.0" }, "bin": { "drizzle-kit": "bin.cjs" } }, "sha512-+CHgPFzuoTQTt7cOYCV6MOw2w8vqEn/ap1yv4bpZOWL03u7rlVRQhUY0WYT3rHsgVTXwYQDZaSUJSQrMBUKuWg=="],

    "drizzle-orm": ["drizzle-orm@0.44.5", "", { "peerDependencies": { "@aws-sdk/client-rds-data": ">=3", "@cloudflare/workers-types": ">=4", "@electric-sql/pglite": ">=0.2.0", "@libsql/client": ">=0.10.0", "@libsql/client-wasm": ">=0.10.0", "@neondatabase/serverless": ">=0.10.0", "@op-engineering/op-sqlite": ">=2", "@opentelemetry/api": "^1.4.1", "@planetscale/database": ">=1.13", "@prisma/client": "*", "@tidbcloud/serverless": "*", "@types/better-sqlite3": "*", "@types/pg": "*", "@types/sql.js": "*", "@upstash/redis": ">=1.34.7", "@vercel/postgres": ">=0.8.0", "@xata.io/client": "*", "better-sqlite3": ">=7", "bun-types": "*", "expo-sqlite": ">=14.0.0", "gel": ">=2", "knex": "*", "kysely": "*", "mysql2": ">=2", "pg": ">=8", "postgres": ">=3", "sql.js": ">=1", "sqlite3": ">=5" }, "optionalPeers": ["@aws-sdk/client-rds-data", "@cloudflare/workers-types", "@electric-sql/pglite", "@libsql/client", "@libsql/client-wasm", "@neondatabase/serverless", "@op-engineering/op-sqlite", "@opentelemetry/api", "@planetscale/database", "@prisma/client", "@tidbcloud/serverless", "@types/better-sqlite3", "@types/pg", "@types/sql.js", "@upstash/redis", "@vercel/postgres", "@xata.io/client", "better-sqlite3", "bun-types", "expo-sqlite", "gel", "knex", "kysely", "mysql2", "pg", "postgres", "sql.js", "sqlite3"] }, "sha512-jBe37K7d8ZSKptdKfakQFdeljtu3P2Cbo7tJoJSVZADzIKOBo9IAJPOmMsH2bZl90bZgh8FQlD8BjxXA/zuBkQ=="],

@@ -1067,7 +1069,7 @@

    "jiti": ["jiti@2.4.2", "", { "bin": { "jiti": "lib/jiti-cli.mjs" } }, "sha512-rg9zJN+G4n2nfJl5MW3BMygZX56zKPNVEYYqq7adpmMh4Jn2QNEwhvQlFy6jPVdcod7txZtKHWnyZiA3a0zP7A=="],

-    "jose": ["jose@5.10.0", "", {}, "sha512-s+3Al/p9g32Iq+oqXxkW//7jk2Vig6FF1CFqzVXoTUXt2qz89YWbL+OwS17NFYEvxC35n0FKeGO2LGYSxeM2Gg=="],
+    "jose": ["jose@6.1.0", "", {}, "sha512-TTQJyoEoKcC1lscpVDCSsVgYzUDg/0Bt3WE//WiTPK6uOCQC2KZS4MpugbMWt/zyjkopgZoXhZuCi00gLudfUA=="],

    "js-tokens": ["js-tokens@4.0.0", "", {}, "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ=="],

@@ -1137,7 +1139,7 @@

    "lru-cache": ["lru-cache@10.4.3", "", {}, "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ=="],

-    "lucide-react": ["lucide-react@0.542.0", "", { "peerDependencies": { "react": "^16.5.1 || ^17.0.0 || ^18.0.0 || ^19.0.0" } }, "sha512-w3hD8/SQB7+lzU2r4VdFyzzOzKnUjTZIF/MQJGSSvni7Llewni4vuViRppfRAa2guOsY5k4jZyxw/i9DQHv+dw=="],
+    "lucide-react": ["lucide-react@0.544.0", "", { "peerDependencies": { "react": "^16.5.1 || ^17.0.0 || ^18.0.0 || ^19.0.0" } }, "sha512-t5tS44bqd825zAW45UQxpG2CvcC4urOwn2TrwSH8u+MjeE+1NnWl6QqeQ/6NdjMqdOygyiT9p3Ev0p1NJykxjw=="],

    "lz-string": ["lz-string@1.5.0", "", { "bin": { "lz-string": "bin/bin.js" } }, "sha512-h5bgJWpxJNswbU7qCrV0tIKQCaS3blPDrqKWx+QxzuzL1zGUzij9XCWLrSLsJPu5t+eWA/ycetzYAO5IOMcWAQ=="],

@@ -1289,7 +1291,7 @@

    "nanoid": ["nanoid@3.3.11", "", { "bin": { "nanoid": "bin/nanoid.cjs" } }, "sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w=="],

-    "nanostores": ["nanostores@0.11.4", "", {}, "sha512-k1oiVNN4hDK8NcNERSZLQiMfRzEGtfnvZvdBvey3SQbgn8Dcrk0h1I6vpxApjb10PFUflZrgJ2WEZyJQ+5v7YQ=="],
+    "nanostores": ["nanostores@1.0.1", "", {}, "sha512-kNZ9xnoJYKg/AfxjrVL4SS0fKX++4awQReGqWnwTRHxeHGZ1FJFVgTqr/eMrNQdp0Tz7M7tG/TDaX8QfHDwVCw=="],

    "negotiator": ["negotiator@0.6.3", "", {}, "sha512-+EUsqGPLsM+j/zdChZjsnX51g4XrHFOIXwfnCVPGlQk/k5giakcKsuxCObBRu6DSm9opw/O6slWbJdghQM4bBg=="],

@@ -1593,9 +1595,9 @@

    "tslib": ["tslib@2.8.1", "", {}, "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w=="],

-    "tsx": ["tsx@4.20.5", "", { "dependencies": { "esbuild": "~0.25.0", "get-tsconfig": "^4.7.5" }, "optionalDependencies": { "fsevents": "~2.3.3" }, "bin": { "tsx": "dist/cli.mjs" } }, "sha512-+wKjMNU9w/EaQayHXb7WA7ZaHY6hN8WgfvHNQ3t1PnU91/7O8TcTnIhCDYTZwnt8JsO9IBqZ30Ln1r7pPF52Aw=="],
+    "tsx": ["tsx@4.20.6", "", { "dependencies": { "esbuild": "~0.25.0", "get-tsconfig": "^4.7.5" }, "optionalDependencies": { "fsevents": "~2.3.3" }, "bin": { "tsx": "dist/cli.mjs" } }, "sha512-ytQKuwgmrrkDTFP4LjR0ToE2nqgy886GpvRSpU0JAnrdBYppuY5rLkRUYPU1yCryb24SsKBTL/hlDQAEFVwtZg=="],

-    "tw-animate-css": ["tw-animate-css@1.3.8", "", {}, "sha512-Qrk3PZ7l7wUcGYhwZloqfkWCmaXZAoqjkdbIDvzfGshwGtexa/DAs9koXxIkrpEasyevandomzCBAV1Yyop5rw=="],
+    "tw-animate-css": ["tw-animate-css@1.4.0", "", {}, "sha512-7bziOlRqH0hJx80h/3mbicLW7o8qLsH5+RaLR2t+OHM3D0JlWGODQKQ4cxbK7WlvmUxpcj6Kgu6EKqjrGFe3QQ=="],

    "type-fest": ["type-fest@4.41.0", "", {}, "sha512-TeTSQ6H5YHvpqVwBRcnLDCBnDOHWYu7IvGbHT6N8AOymcr9PJGjc1GTtiWZTYg0NCgYwvnYWEkVChQAr9bjfwA=="],

@@ -1603,7 +1605,7 @@

    "typesafe-path": ["typesafe-path@0.2.2", "", {}, "sha512-OJabfkAg1WLZSqJAJ0Z6Sdt3utnbzr/jh+NAHoyWHJe8CMSy79Gm085094M9nvTPy22KzTVn5Zq5mbapCI/hPA=="],

-    "typescript": ["typescript@5.9.2", "", { "bin": { "tsc": "bin/tsc", "tsserver": "bin/tsserver" } }, "sha512-CWBzXQrc/qOkhidw1OzBTQuYRbfyxDXJMVJ1XNwUHGROVmuaeiEm3OslpZ1RV96d7SKKjZKrSJu3+t/xlw3R9A=="],
+    "typescript": ["typescript@5.9.3", "", { "bin": { "tsc": "bin/tsc", "tsserver": "bin/tsserver" } }, "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw=="],

    "typescript-auto-import-cache": ["typescript-auto-import-cache@0.3.6", "", { "dependencies": { "semver": "^7.3.8" } }, "sha512-RpuHXrknHdVdK7wv/8ug3Fr0WNsNi5l5aB8MYYuXhq2UH5lnEB1htJ1smhtD5VeCsGr2p8mUDtd83LCQDFVgjQ=="],

@@ -1671,7 +1673,7 @@

    "vfile-message": ["vfile-message@4.0.2", "", { "dependencies": { "@types/unist": "^3.0.0", "unist-util-stringify-position": "^4.0.0" } }, "sha512-jRDZ1IMLttGj41KcZvlrYAaI3CfqpLpfpf+Mfig13viT6NKvRzWZ+lXz0Y5D60w6uJIBAOGq9mSHf0gktF0duw=="],

-    "vite": ["vite@6.3.5", "", { "dependencies": { "esbuild": "^0.25.0", "fdir": "^6.4.4", "picomatch": "^4.0.2", "postcss": "^8.5.3", "rollup": "^4.34.9", "tinyglobby": "^0.2.13" }, "optionalDependencies": { "fsevents": "~2.3.3" }, "peerDependencies": { "@types/node": "^18.0.0 || ^20.0.0 || >=22.0.0", "jiti": ">=1.21.0", "less": "*", "lightningcss": "^1.21.0", "sass": "*", "sass-embedded": "*", "stylus": "*", "sugarss": "*", "terser": "^5.16.0", "tsx": "^4.8.1", "yaml": "^2.4.2" }, "optionalPeers": ["@types/node", "jiti", "less", "lightningcss", "sass", "sass-embedded", "stylus", "sugarss", "terser", "tsx", "yaml"], "bin": { "vite": "bin/vite.js" } }, "sha512-cZn6NDFE7wdTpINgs++ZJ4N49W2vRp8LCKrn3Ob1kYNtOo21vfDoaV5GzBfLU4MovSAB8uNRm4jgzVQZ+mBzPQ=="],
+    "vite": ["vite@6.3.6", "", { "dependencies": { "esbuild": "^0.25.0", "fdir": "^6.4.4", "picomatch": "^4.0.2", "postcss": "^8.5.3", "rollup": "^4.34.9", "tinyglobby": "^0.2.13" }, "optionalDependencies": { "fsevents": "~2.3.3" }, "peerDependencies": { "@types/node": "^18.0.0 || ^20.0.0 || >=22.0.0", "jiti": ">=1.21.0", "less": "*", "lightningcss": "^1.21.0", "sass": "*", "sass-embedded": "*", "stylus": "*", "sugarss": "*", "terser": "^5.16.0", "tsx": "^4.8.1", "yaml": "^2.4.2" }, "optionalPeers": ["@types/node", "jiti", "less", "lightningcss", "sass", "sass-embedded", "stylus", "sugarss", "terser", "tsx", "yaml"], "bin": { "vite": "bin/vite.js" } }, "sha512-0msEVHJEScQbhkbVTb/4iHZdJ6SXp/AvxL2sjwYQFfBqleHtnCqv1J3sa9zbWz/6kW1m9Tfzn92vW+kZ1WV6QA=="],

    "vite-node": ["vite-node@3.2.4", "", { "dependencies": { "cac": "^6.7.14", "debug": "^4.4.1", "es-module-lexer": "^1.7.0", "pathe": "^2.0.3", "vite": "^5.0.0 || ^6.0.0 || ^7.0.0-0" }, "bin": { "vite-node": "vite-node.mjs" } }, "sha512-EbKSKh+bh1E1IFxeO0pg1n4dvoOTt0UDiXMd/qn++r98+jPO1xtJilvXldeuQ8giIB5IkpjCgMleHMNEsGH6pg=="],

@@ -1767,7 +1769,7 @@

    "yoctocolors": ["yoctocolors@2.1.1", "", {}, "sha512-GQHQqAopRhwU8Kt1DDM8NjibDXHC8eoh1erhGAJPEyveY9qqVeXvVikNKrDz69sHowPMorbPUrH/mx8c50eiBQ=="],

-    "zod": ["zod@4.1.5", "", {}, "sha512-rcUUZqlLJgBC33IT3PNMgsCq6TzLQEG/Ei/KTCU0PedSWRMAXoOUN+4t/0H+Q8bdnLPdqUYnvboJT0bn/229qg=="],
+    "zod": ["zod@4.1.11", "", {}, "sha512-WPsqwxITS2tzx1bzhIKsEs19ABD5vmCVa4xBo2tq/SrV4RNZtfws1EnCWQXM6yh8bD08a1idvkB5MZSBiZsjwg=="],

    "zod-to-json-schema": ["zod-to-json-schema@3.24.6", "", { "peerDependencies": { "zod": "^3.24.1" } }, "sha512-h/z3PKvcTcTetyjl1fkj79MHNEjm+HpD6NXheWjzOekY7kV+lwDYnHw+ivHkijnCSMz1yJaWBD9vu/Fcmk+vEg=="],

@@ -1775,23 +1777,19 @@

    "zwitch": ["zwitch@2.0.4", "", {}, "sha512-bXE4cR/kVZhKZX/RjPEflHaKVhUVl85noU3v6b8apfQEc1x4A+zBxjZ4lN8LqGd6WZ3dl98pY4o717VFmoPp+A=="],

-    "@astrojs/markdown-remark/import-meta-resolve": ["import-meta-resolve@4.1.0", "", {}, "sha512-I6fiaX09Xivtk+THaMfAwnA3MVA5Big1WHF1Dfx9hFuvNIWpXnorlkzhcQf6ehrqQiiZECRt1poOAkPmer3ruw=="],
+    "@ampproject/remapping/@jridgewell/gen-mapping": ["@jridgewell/gen-mapping@0.3.8", "", { "dependencies": { "@jridgewell/set-array": "^1.2.1", "@jridgewell/sourcemap-codec": "^1.4.10", "@jridgewell/trace-mapping": "^0.3.24" } }, "sha512-imAbBGkb+ebQyxKgzv5Hu2nmROxoDOXHh80evxdoXNOrvAnVx7zimzc1Oo5h9RlfV4vPXaE2iM5pOFbvOCClWA=="],

-    "@astrojs/markdown-remark/shiki": ["shiki@3.4.2", "", { "dependencies": { "@shikijs/core": "3.4.2", "@shikijs/engine-javascript": "3.4.2", "@shikijs/engine-oniguruma": "3.4.2", "@shikijs/langs": "3.4.2", "@shikijs/themes": "3.4.2", "@shikijs/types": "3.4.2", "@shikijs/vscode-textmate": "^10.0.2", "@types/hast": "^3.0.4" } }, "sha512-wuxzZzQG8kvZndD7nustrNFIKYJ1jJoWIPaBpVe2+KHSvtzMi4SBjOxrigs8qeqce/l3U0cwiC+VAkLKSunHQQ=="],
-
-    "@astrojs/markdown-remark/smol-toml": ["smol-toml@1.3.4", "", {}, "sha512-UOPtVuYkzYGee0Bd2Szz8d2G3RfMfJ2t3qVdZUAozZyAk+a0Sxa+QKix0YCwjL/A1RR0ar44nCxaoN9FxdJGwA=="],
+    "@ampproject/remapping/@jridgewell/trace-mapping": ["@jridgewell/trace-mapping@0.3.25", "", { "dependencies": { "@jridgewell/resolve-uri": "^3.1.0", "@jridgewell/sourcemap-codec": "^1.4.14" } }, "sha512-vNk6aEwybGtawWmy/PzwnGDOjCkLWSD2wqvjGGAgOAwCGWySYXfYoxt00IJkTF+8Lb57DwOb3Aa0o9CApepiYQ=="],

    "@astrojs/react/@vitejs/plugin-react": ["@vitejs/plugin-react@4.7.0", "", { "dependencies": { "@babel/core": "^7.28.0", "@babel/plugin-transform-react-jsx-self": "^7.27.1", "@babel/plugin-transform-react-jsx-source": "^7.27.1", "@rolldown/pluginutils": "1.0.0-beta.27", "@types/babel__core": "^7.20.5", "react-refresh": "^0.17.0" }, "peerDependencies": { "vite": "^4.2.0 || ^5.0.0 || ^6.0.0 || ^7.0.0" } }, "sha512-gUu9hwfWvvEDBBmgtAowQCojwZmJ5mcLn3aufeCsitijs3+f2NsrPtlAWIR6OPiqljl96GVCUbLe0HyqIpVaoA=="],

-    "@astrojs/react/vite": ["vite@6.3.6", "", { "dependencies": { "esbuild": "^0.25.0", "fdir": "^6.4.4", "picomatch": "^4.0.2", "postcss": "^8.5.3", "rollup": "^4.34.9", "tinyglobby": "^0.2.13" }, "optionalDependencies": { "fsevents": "~2.3.3" }, "peerDependencies": { "@types/node": "^18.0.0 || ^20.0.0 || >=22.0.0", "jiti": ">=1.21.0", "less": "*", "lightningcss": "^1.21.0", "sass": "*", "sass-embedded": "*", "stylus": "*", "sugarss": "*", "terser": "^5.16.0", "tsx": "^4.8.1", "yaml": "^2.4.2" }, "optionalPeers": ["@types/node", "jiti", "less", "lightningcss", "sass", "sass-embedded", "stylus", "sugarss", "terser", "tsx", "yaml"], "bin": { "vite": "bin/vite.js" } }, "sha512-0msEVHJEScQbhkbVTb/4iHZdJ6SXp/AvxL2sjwYQFfBqleHtnCqv1J3sa9zbWz/6kW1m9Tfzn92vW+kZ1WV6QA=="],
-
    "@astrojs/telemetry/ci-info": ["ci-info@4.2.0", "", {}, "sha512-cYY9mypksY8NRqgDB1XD1RiJL338v/551niynFTGkZOO2LHuB2OmOYxDIe/ttN9AHwrqdum1360G3ald0W9kCg=="],

    "@babel/core/semver": ["semver@6.3.1", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA=="],

-    "@babel/generator/@jridgewell/gen-mapping": ["@jridgewell/gen-mapping@0.3.12", "", { "dependencies": { "@jridgewell/sourcemap-codec": "^1.5.0", "@jridgewell/trace-mapping": "^0.3.24" } }, "sha512-OuLGC46TjB5BbN1dH8JULVVZY4WTdkF7tV9Ys6wLL1rubZnCMstOhNHueU5bLCrnRuDhKPDM4g6sw4Bel5Gzqg=="],
+    "@babel/generator/@babel/parser": ["@babel/parser@7.28.3", "", { "dependencies": { "@babel/types": "^7.28.2" }, "bin": "./bin/babel-parser.js" }, "sha512-7+Ey1mAgYqFAx2h0RuoxcQT5+MlG3GTV0TQrgr7/ZliKsm/MNDxVVutlWaziMq7wJNAz8MTqz55XLpWvva6StA=="],

-    "@babel/generator/@jridgewell/trace-mapping": ["@jridgewell/trace-mapping@0.3.29", "", { "dependencies": { "@jridgewell/resolve-uri": "^3.1.0", "@jridgewell/sourcemap-codec": "^1.4.14" } }, "sha512-uw6guiW/gcAGPDhLmd77/6lW8QLeiV5RUTsAX46Db6oLhGaVj4lhnPwb184s1bkc8kdVg/+h988dro8GRDpmYQ=="],
+    "@babel/generator/@babel/types": ["@babel/types@7.28.2", "", { "dependencies": { "@babel/helper-string-parser": "^7.27.1", "@babel/helper-validator-identifier": "^7.27.1" } }, "sha512-ruv7Ae4J5dUYULmeXw1gmb7rYRz57OWCPM57pHojnLq/3Z1CK2lNSLTCVjxVk1F/TZHwOZZrOWi0ur95BbLxNQ=="],

    "@babel/helper-compilation-targets/lru-cache": ["lru-cache@5.1.1", "", { "dependencies": { "yallist": "^3.0.2" } }, "sha512-KpNARQA3Iwv+jTA0utUVVbrh+Jlrr1Fv0e56GGzAFOXN7dk/FviaDW8LHmK52DlcH4WP2n6gI8vN1aesBFgo9w=="],

@@ -1801,13 +1799,25 @@

    "@babel/helper-module-imports/@babel/types": ["@babel/types@7.27.3", "", { "dependencies": { "@babel/helper-string-parser": "^7.27.1", "@babel/helper-validator-identifier": "^7.27.1" } }, "sha512-Y1GkI4ktrtvmawoSq+4FCVHNryea6uR+qUQy0AGxLSsjCX0nVmkYQMBLHDkXZuo5hGx7eYdnIaslsdBFm7zbUw=="],

+    "@babel/helper-module-transforms/@babel/traverse": ["@babel/traverse@7.28.3", "", { "dependencies": { "@babel/code-frame": "^7.27.1", "@babel/generator": "^7.28.3", "@babel/helper-globals": "^7.28.0", "@babel/parser": "^7.28.3", "@babel/template": "^7.27.2", "@babel/types": "^7.28.2", "debug": "^4.3.1" } }, "sha512-7w4kZYHneL3A6NP2nxzHvT3HCZ7puDZZjFMqDpBPECub79sTtSO5CGXDkKrTQq8ksAwfD/XI2MRFX23njdDaIQ=="],
+
    "@babel/template/@babel/parser": ["@babel/parser@7.27.3", "", { "dependencies": { "@babel/types": "^7.27.3" }, "bin": "./bin/babel-parser.js" }, "sha512-xyYxRj6+tLNDTWi0KCBcZ9V7yg3/lwL9DWh9Uwh/RIVlIfFidggcgxKX3GCXwCiswwcGRawBKbEg2LG/Y8eJhw=="],

    "@babel/template/@babel/types": ["@babel/types@7.27.3", "", { "dependencies": { "@babel/helper-string-parser": "^7.27.1", "@babel/helper-validator-identifier": "^7.27.1" } }, "sha512-Y1GkI4ktrtvmawoSq+4FCVHNryea6uR+qUQy0AGxLSsjCX0nVmkYQMBLHDkXZuo5hGx7eYdnIaslsdBFm7zbUw=="],

-    "@jridgewell/remapping/@jridgewell/gen-mapping": ["@jridgewell/gen-mapping@0.3.12", "", { "dependencies": { "@jridgewell/sourcemap-codec": "^1.5.0", "@jridgewell/trace-mapping": "^0.3.24" } }, "sha512-OuLGC46TjB5BbN1dH8JULVVZY4WTdkF7tV9Ys6wLL1rubZnCMstOhNHueU5bLCrnRuDhKPDM4g6sw4Bel5Gzqg=="],
+    "@octokit/core/@octokit/types": ["@octokit/types@14.1.0", "", { "dependencies": { "@octokit/openapi-types": "^25.1.0" } }, "sha512-1y6DgTy8Jomcpu33N+p5w58l6xyt55Ar2I91RPiIA0xCJBXyUAhXCcmZaDWSANiha7R9a6qJJ2CRomGPZ6f46g=="],

-    "@jridgewell/remapping/@jridgewell/trace-mapping": ["@jridgewell/trace-mapping@0.3.29", "", { "dependencies": { "@jridgewell/resolve-uri": "^3.1.0", "@jridgewell/sourcemap-codec": "^1.4.14" } }, "sha512-uw6guiW/gcAGPDhLmd77/6lW8QLeiV5RUTsAX46Db6oLhGaVj4lhnPwb184s1bkc8kdVg/+h988dro8GRDpmYQ=="],
+    "@octokit/endpoint/@octokit/types": ["@octokit/types@14.1.0", "", { "dependencies": { "@octokit/openapi-types": "^25.1.0" } }, "sha512-1y6DgTy8Jomcpu33N+p5w58l6xyt55Ar2I91RPiIA0xCJBXyUAhXCcmZaDWSANiha7R9a6qJJ2CRomGPZ6f46g=="],
+
+    "@octokit/graphql/@octokit/types": ["@octokit/types@14.1.0", "", { "dependencies": { "@octokit/openapi-types": "^25.1.0" } }, "sha512-1y6DgTy8Jomcpu33N+p5w58l6xyt55Ar2I91RPiIA0xCJBXyUAhXCcmZaDWSANiha7R9a6qJJ2CRomGPZ6f46g=="],
+
+    "@octokit/plugin-paginate-rest/@octokit/types": ["@octokit/types@14.1.0", "", { "dependencies": { "@octokit/openapi-types": "^25.1.0" } }, "sha512-1y6DgTy8Jomcpu33N+p5w58l6xyt55Ar2I91RPiIA0xCJBXyUAhXCcmZaDWSANiha7R9a6qJJ2CRomGPZ6f46g=="],
+
+    "@octokit/plugin-rest-endpoint-methods/@octokit/types": ["@octokit/types@14.1.0", "", { "dependencies": { "@octokit/openapi-types": "^25.1.0" } }, "sha512-1y6DgTy8Jomcpu33N+p5w58l6xyt55Ar2I91RPiIA0xCJBXyUAhXCcmZaDWSANiha7R9a6qJJ2CRomGPZ6f46g=="],
+
+    "@octokit/request/@octokit/types": ["@octokit/types@14.1.0", "", { "dependencies": { "@octokit/openapi-types": "^25.1.0" } }, "sha512-1y6DgTy8Jomcpu33N+p5w58l6xyt55Ar2I91RPiIA0xCJBXyUAhXCcmZaDWSANiha7R9a6qJJ2CRomGPZ6f46g=="],
+
+    "@octokit/request-error/@octokit/types": ["@octokit/types@14.1.0", "", { "dependencies": { "@octokit/openapi-types": "^25.1.0" } }, "sha512-1y6DgTy8Jomcpu33N+p5w58l6xyt55Ar2I91RPiIA0xCJBXyUAhXCcmZaDWSANiha7R9a6qJJ2CRomGPZ6f46g=="],

    "@rollup/pluginutils/estree-walker": ["estree-walker@2.0.2", "", {}, "sha512-Rfkk/Mp/DL7JVje3u18FxFujQlTNR2q6QfMSMB7AvCBx91NGj/ba3kCfza0f6dVDbw7YlRf/nDrn7pQrCCyQ/w=="],

@@ -1853,14 +1863,10 @@

    "astro/picomatch": ["picomatch@4.0.3", "", {}, "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q=="],

-    "astro/vite": ["vite@6.3.6", "", { "dependencies": { "esbuild": "^0.25.0", "fdir": "^6.4.4", "picomatch": "^4.0.2", "postcss": "^8.5.3", "rollup": "^4.34.9", "tinyglobby": "^0.2.13" }, "optionalDependencies": { "fsevents": "~2.3.3" }, "peerDependencies": { "@types/node": "^18.0.0 || ^20.0.0 || >=22.0.0", "jiti": ">=1.21.0", "less": "*", "lightningcss": "^1.21.0", "sass": "*", "sass-embedded": "*", "stylus": "*", "sugarss": "*", "terser": "^5.16.0", "tsx": "^4.8.1", "yaml": "^2.4.2" }, "optionalPeers": ["@types/node", "jiti", "less", "lightningcss", "sass", "sass-embedded", "stylus", "sugarss", "terser", "tsx", "yaml"], "bin": { "vite": "bin/vite.js" } }, "sha512-0msEVHJEScQbhkbVTb/4iHZdJ6SXp/AvxL2sjwYQFfBqleHtnCqv1J3sa9zbWz/6kW1m9Tfzn92vW+kZ1WV6QA=="],
-
    "astro/zod": ["zod@3.25.76", "", {}, "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ=="],

    "basic-auth/safe-buffer": ["safe-buffer@5.1.2", "", {}, "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g=="],

-    "better-auth/jose": ["jose@6.1.0", "", {}, "sha512-TTQJyoEoKcC1lscpVDCSsVgYzUDg/0Bt3WE//WiTPK6uOCQC2KZS4MpugbMWt/zyjkopgZoXhZuCi00gLudfUA=="],
-
    "body-parser/debug": ["debug@2.6.9", "", { "dependencies": { "ms": "2.0.0" } }, "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA=="],

    "body-parser/iconv-lite": ["iconv-lite@0.4.24", "", { "dependencies": { "safer-buffer": ">= 2.1.2 < 3" } }, "sha512-v3MXnZAcvnywkTUEZomIActle7RXXeedOR31wwl7VlyoXO4Qi9arvSenNQWne1TcRwhCL1HwLI21bEqdpj8/rA=="],
@@ -1903,6 +1909,8 @@

    "node-fetch/whatwg-url": ["whatwg-url@5.0.0", "", { "dependencies": { "tr46": "~0.0.3", "webidl-conversions": "^3.0.0" } }, "sha512-saE57nupxk6v3HY35+jzBwYa0rKSy0XR8JSxZPwgLr7ys0IBzhGviA1/TUGJLmSVqs8pb9AnvICXEuOHLprYTw=="],

+    "oauth2-mock-server/jose": ["jose@5.10.0", "", {}, "sha512-s+3Al/p9g32Iq+oqXxkW//7jk2Vig6FF1CFqzVXoTUXt2qz89YWbL+OwS17NFYEvxC35n0FKeGO2LGYSxeM2Gg=="],
+
    "ofetch/node-fetch-native": ["node-fetch-native@1.6.6", "", {}, "sha512-8Mc2HhqPdlIfedsuZoc3yioPuzp6b+L5jRCRY1QzuWZh2EGJVQrGppC6V6cF0bLdbW0+O2YpqCA25aF/1lvipQ=="],

    "parse-entities/@types/unist": ["@types/unist@2.0.11", "", {}, "sha512-CmBKiL6NNo/OqgmMn95Fk9Whlp2mtvIv+KNpQKN2F4SjvrEesubTRWGYSg+BnWZOnlCaSTU1sMpsBOzgbYhnsA=="],
@@ -1925,6 +1933,12 @@

    "vaul/@radix-ui/react-dialog": ["@radix-ui/react-dialog@1.1.14", "", { "dependencies": { "@radix-ui/primitive": "1.1.2", "@radix-ui/react-compose-refs": "1.1.2", "@radix-ui/react-context": "1.1.2", "@radix-ui/react-dismissable-layer": "1.1.10", "@radix-ui/react-focus-guards": "1.1.2", "@radix-ui/react-focus-scope": "1.1.7", "@radix-ui/react-id": "1.1.1", "@radix-ui/react-portal": "1.1.9", "@radix-ui/react-presence": "1.1.4", "@radix-ui/react-primitive": "2.1.3", "@radix-ui/react-slot": "1.2.3", "@radix-ui/react-use-controllable-state": "1.2.2", "aria-hidden": "^1.2.4", "react-remove-scroll": "^2.6.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-+CpweKjqpzTmwRwcYECQcNYbI8V9VSQt0SNFKeEBLgfucbsLssU6Ppq7wUdNXEGb573bMjFhVjKVll8rmV6zMw=="],

+    "vite/picomatch": ["picomatch@4.0.3", "", {}, "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q=="],
+
+    "vite-node/vite": ["vite@6.3.5", "", { "dependencies": { "esbuild": "^0.25.0", "fdir": "^6.4.4", "picomatch": "^4.0.2", "postcss": "^8.5.3", "rollup": "^4.34.9", "tinyglobby": "^0.2.13" }, "optionalDependencies": { "fsevents": "~2.3.3" }, "peerDependencies": { "@types/node": "^18.0.0 || ^20.0.0 || >=22.0.0", "jiti": ">=1.21.0", "less": "*", "lightningcss": "^1.21.0", "sass": "*", "sass-embedded": "*", "stylus": "*", "sugarss": "*", "terser": "^5.16.0", "tsx": "^4.8.1", "yaml": "^2.4.2" }, "optionalPeers": ["@types/node", "jiti", "less", "lightningcss", "sass", "sass-embedded", "stylus", "sugarss", "terser", "tsx", "yaml"], "bin": { "vite": "bin/vite.js" } }, "sha512-cZn6NDFE7wdTpINgs++ZJ4N49W2vRp8LCKrn3Ob1kYNtOo21vfDoaV5GzBfLU4MovSAB8uNRm4jgzVQZ+mBzPQ=="],
+
+    "vitest/vite": ["vite@6.3.5", "", { "dependencies": { "esbuild": "^0.25.0", "fdir": "^6.4.4", "picomatch": "^4.0.2", "postcss": "^8.5.3", "rollup": "^4.34.9", "tinyglobby": "^0.2.13" }, "optionalDependencies": { "fsevents": "~2.3.3" }, "peerDependencies": { "@types/node": "^18.0.0 || ^20.0.0 || >=22.0.0", "jiti": ">=1.21.0", "less": "*", "lightningcss": "^1.21.0", "sass": "*", "sass-embedded": "*", "stylus": "*", "sugarss": "*", "terser": "^5.16.0", "tsx": "^4.8.1", "yaml": "^2.4.2" }, "optionalPeers": ["@types/node", "jiti", "less", "lightningcss", "sass", "sass-embedded", "stylus", "sugarss", "terser", "tsx", "yaml"], "bin": { "vite": "bin/vite.js" } }, "sha512-cZn6NDFE7wdTpINgs++ZJ4N49W2vRp8LCKrn3Ob1kYNtOo21vfDoaV5GzBfLU4MovSAB8uNRm4jgzVQZ+mBzPQ=="],
+
    "vscode-json-languageservice/jsonc-parser": ["jsonc-parser@3.3.1", "", {}, "sha512-HUgH65KyejrUFPvHFPbqOY0rsFip3Bo5wb4ngvdi1EpCYWUQDC5V+Y7mZws+DLkr4M//zQJoanu1SP+87Dv1oQ=="],

    "widest-line/string-width": ["string-width@7.2.0", "", { "dependencies": { "emoji-regex": "^10.3.0", "get-east-asian-width": "^1.0.0", "strip-ansi": "^7.1.0" } }, "sha512-tsaTIkKW9b4N+AEj+SVA+WhJzV7/zMhcSu78mLKWSk7cXMOSHsBKFWUs0fWwq8QyK3MgJBQRX6Gbi4kYbdvGkQ=="],
@@ -1943,28 +1957,34 @@

    "yaml-language-server/yaml": ["yaml@2.2.2", "", {}, "sha512-CBKFWExMn46Foo4cldiChEzn7S7SRV+wqiluAb6xmueD/fGyRHIhX8m14vVGgeFWjN540nKCNVj6P21eQjgTuA=="],

-    "@astrojs/markdown-remark/shiki/@shikijs/core": ["@shikijs/core@3.4.2", "", { "dependencies": { "@shikijs/types": "3.4.2", "@shikijs/vscode-textmate": "^10.0.2", "@types/hast": "^3.0.4", "hast-util-to-html": "^9.0.5" } }, "sha512-AG8vnSi1W2pbgR2B911EfGqtLE9c4hQBYkv/x7Z+Kt0VxhgQKcW7UNDVYsu9YxwV6u+OJrvdJrMq6DNWoBjihQ=="],
-
-    "@astrojs/markdown-remark/shiki/@shikijs/engine-javascript": ["@shikijs/engine-javascript@3.4.2", "", { "dependencies": { "@shikijs/types": "3.4.2", "@shikijs/vscode-textmate": "^10.0.2", "oniguruma-to-es": "^4.3.3" } }, "sha512-1/adJbSMBOkpScCE/SB6XkjJU17ANln3Wky7lOmrnpl+zBdQ1qXUJg2GXTYVHRq+2j3hd1DesmElTXYDgtfSOQ=="],
-
-    "@astrojs/markdown-remark/shiki/@shikijs/engine-oniguruma": ["@shikijs/engine-oniguruma@3.4.2", "", { "dependencies": { "@shikijs/types": "3.4.2", "@shikijs/vscode-textmate": "^10.0.2" } }, "sha512-zcZKMnNndgRa3ORja6Iemsr3DrLtkX3cAF7lTJkdMB6v9alhlBsX9uNiCpqofNrXOvpA3h6lHcLJxgCIhVOU5Q=="],
-
-    "@astrojs/markdown-remark/shiki/@shikijs/langs": ["@shikijs/langs@3.4.2", "", { "dependencies": { "@shikijs/types": "3.4.2" } }, "sha512-H6azIAM+OXD98yztIfs/KH5H4PU39t+SREhmM8LaNXyUrqj2mx+zVkr8MWYqjceSjDw9I1jawm1WdFqU806rMA=="],
-
-    "@astrojs/markdown-remark/shiki/@shikijs/themes": ["@shikijs/themes@3.4.2", "", { "dependencies": { "@shikijs/types": "3.4.2" } }, "sha512-qAEuAQh+brd8Jyej2UDDf+b4V2g1Rm8aBIdvt32XhDPrHvDkEnpb7Kzc9hSuHUxz0Iuflmq7elaDuQAP9bHIhg=="],
-
-    "@astrojs/markdown-remark/shiki/@shikijs/types": ["@shikijs/types@3.4.2", "", { "dependencies": { "@shikijs/vscode-textmate": "^10.0.2", "@types/hast": "^3.0.4" } }, "sha512-zHC1l7L+eQlDXLnxvM9R91Efh2V4+rN3oMVS2swCBssbj2U/FBwybD1eeLaq8yl/iwT+zih8iUbTBCgGZOYlVg=="],
+    "@astrojs/react/@vitejs/plugin-react/@babel/core": ["@babel/core@7.28.3", "", { "dependencies": { "@ampproject/remapping": "^2.2.0", "@babel/code-frame": "^7.27.1", "@babel/generator": "^7.28.3", "@babel/helper-compilation-targets": "^7.27.2", "@babel/helper-module-transforms": "^7.28.3", "@babel/helpers": "^7.28.3", "@babel/parser": "^7.28.3", "@babel/template": "^7.27.2", "@babel/traverse": "^7.28.3", "@babel/types": "^7.28.2", "convert-source-map": "^2.0.0", "debug": "^4.1.0", "gensync": "^1.0.0-beta.2", "json5": "^2.2.3", "semver": "^6.3.1" } }, "sha512-yDBHV9kQNcr2/sUr9jghVyz9C3Y5G2zUM2H2lo+9mKv4sFgbA8s8Z9t8D1jiTkGoO/NoIfKMyKWr4s6CN23ZwQ=="],

    "@astrojs/react/@vitejs/plugin-react/@rolldown/pluginutils": ["@rolldown/pluginutils@1.0.0-beta.27", "", {}, "sha512-+d0F4MKMCbeVUJwG96uQ4SgAznZNSq93I3V+9NHA4OpvqG8mRCpGdKmK8l/dl02h2CCDHwW2FqilnTyDcAnqjA=="],

-    "@astrojs/react/vite/picomatch": ["picomatch@4.0.3", "", {}, "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q=="],
-
    "@babel/helper-compilation-targets/lru-cache/yallist": ["yallist@3.1.1", "", {}, "sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g=="],

    "@babel/helper-module-imports/@babel/traverse/@babel/generator": ["@babel/generator@7.27.3", "", { "dependencies": { "@babel/parser": "^7.27.3", "@babel/types": "^7.27.3", "@jridgewell/gen-mapping": "^0.3.5", "@jridgewell/trace-mapping": "^0.3.25", "jsesc": "^3.0.2" } }, "sha512-xnlJYj5zepml8NXtjkG0WquFUv8RskFqyFcVgTBp5k+NaA/8uw/K+OSVf8AMGw5e9HKP2ETd5xpK5MLZQD6b4Q=="],

    "@babel/helper-module-imports/@babel/traverse/@babel/parser": ["@babel/parser@7.27.3", "", { "dependencies": { "@babel/types": "^7.27.3" }, "bin": "./bin/babel-parser.js" }, "sha512-xyYxRj6+tLNDTWi0KCBcZ9V7yg3/lwL9DWh9Uwh/RIVlIfFidggcgxKX3GCXwCiswwcGRawBKbEg2LG/Y8eJhw=="],

+    "@babel/helper-module-transforms/@babel/traverse/@babel/parser": ["@babel/parser@7.28.3", "", { "dependencies": { "@babel/types": "^7.28.2" }, "bin": "./bin/babel-parser.js" }, "sha512-7+Ey1mAgYqFAx2h0RuoxcQT5+MlG3GTV0TQrgr7/ZliKsm/MNDxVVutlWaziMq7wJNAz8MTqz55XLpWvva6StA=="],
+
+    "@babel/helper-module-transforms/@babel/traverse/@babel/types": ["@babel/types@7.28.2", "", { "dependencies": { "@babel/helper-string-parser": "^7.27.1", "@babel/helper-validator-identifier": "^7.27.1" } }, "sha512-ruv7Ae4J5dUYULmeXw1gmb7rYRz57OWCPM57pHojnLq/3Z1CK2lNSLTCVjxVk1F/TZHwOZZrOWi0ur95BbLxNQ=="],
+
+    "@octokit/core/@octokit/types/@octokit/openapi-types": ["@octokit/openapi-types@25.1.0", "", {}, "sha512-idsIggNXUKkk0+BExUn1dQ92sfysJrje03Q0bv0e+KPLrvyqZF8MnBpFz8UNfYDwB3Ie7Z0TByjWfzxt7vseaA=="],
+
+    "@octokit/endpoint/@octokit/types/@octokit/openapi-types": ["@octokit/openapi-types@25.1.0", "", {}, "sha512-idsIggNXUKkk0+BExUn1dQ92sfysJrje03Q0bv0e+KPLrvyqZF8MnBpFz8UNfYDwB3Ie7Z0TByjWfzxt7vseaA=="],
+
+    "@octokit/graphql/@octokit/types/@octokit/openapi-types": ["@octokit/openapi-types@25.1.0", "", {}, "sha512-idsIggNXUKkk0+BExUn1dQ92sfysJrje03Q0bv0e+KPLrvyqZF8MnBpFz8UNfYDwB3Ie7Z0TByjWfzxt7vseaA=="],
+
+    "@octokit/plugin-paginate-rest/@octokit/types/@octokit/openapi-types": ["@octokit/openapi-types@25.1.0", "", {}, "sha512-idsIggNXUKkk0+BExUn1dQ92sfysJrje03Q0bv0e+KPLrvyqZF8MnBpFz8UNfYDwB3Ie7Z0TByjWfzxt7vseaA=="],
+
+    "@octokit/plugin-rest-endpoint-methods/@octokit/types/@octokit/openapi-types": ["@octokit/openapi-types@25.1.0", "", {}, "sha512-idsIggNXUKkk0+BExUn1dQ92sfysJrje03Q0bv0e+KPLrvyqZF8MnBpFz8UNfYDwB3Ie7Z0TByjWfzxt7vseaA=="],
+
+    "@octokit/request-error/@octokit/types/@octokit/openapi-types": ["@octokit/openapi-types@25.1.0", "", {}, "sha512-idsIggNXUKkk0+BExUn1dQ92sfysJrje03Q0bv0e+KPLrvyqZF8MnBpFz8UNfYDwB3Ie7Z0TByjWfzxt7vseaA=="],
+
+    "@octokit/request/@octokit/types/@octokit/openapi-types": ["@octokit/openapi-types@25.1.0", "", {}, "sha512-idsIggNXUKkk0+BExUn1dQ92sfysJrje03Q0bv0e+KPLrvyqZF8MnBpFz8UNfYDwB3Ie7Z0TByjWfzxt7vseaA=="],
+
    "@tailwindcss/node/magic-string/@jridgewell/sourcemap-codec": ["@jridgewell/sourcemap-codec@1.5.5", "", {}, "sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og=="],

    "accepts/mime-types/mime-db": ["mime-db@1.52.0", "", {}, "sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg=="],
@@ -2021,6 +2041,20 @@

    "yaml-language-server/vscode-languageserver/vscode-languageserver-protocol": ["vscode-languageserver-protocol@3.16.0", "", { "dependencies": { "vscode-jsonrpc": "6.0.0", "vscode-languageserver-types": "3.16.0" } }, "sha512-sdeUoAawceQdgIfTI+sdcwkiK2KU+2cbEYA0agzM2uqaUy2UpnnGHtWTHVEtS0ES4zHU0eMFRGN+oQgDxlD66A=="],

+    "@astrojs/react/@vitejs/plugin-react/@babel/core/@babel/helpers": ["@babel/helpers@7.28.3", "", { "dependencies": { "@babel/template": "^7.27.2", "@babel/types": "^7.28.2" } }, "sha512-PTNtvUQihsAsDHMOP5pfobP8C6CM4JWXmP8DrEIt46c3r2bf87Ua1zoqevsMo9g+tWDwgWrFP5EIxuBx5RudAw=="],
+
+    "@astrojs/react/@vitejs/plugin-react/@babel/core/@babel/parser": ["@babel/parser@7.28.3", "", { "dependencies": { "@babel/types": "^7.28.2" }, "bin": "./bin/babel-parser.js" }, "sha512-7+Ey1mAgYqFAx2h0RuoxcQT5+MlG3GTV0TQrgr7/ZliKsm/MNDxVVutlWaziMq7wJNAz8MTqz55XLpWvva6StA=="],
+
+    "@astrojs/react/@vitejs/plugin-react/@babel/core/@babel/traverse": ["@babel/traverse@7.28.3", "", { "dependencies": { "@babel/code-frame": "^7.27.1", "@babel/generator": "^7.28.3", "@babel/helper-globals": "^7.28.0", "@babel/parser": "^7.28.3", "@babel/template": "^7.27.2", "@babel/types": "^7.28.2", "debug": "^4.3.1" } }, "sha512-7w4kZYHneL3A6NP2nxzHvT3HCZ7puDZZjFMqDpBPECub79sTtSO5CGXDkKrTQq8ksAwfD/XI2MRFX23njdDaIQ=="],
+
+    "@astrojs/react/@vitejs/plugin-react/@babel/core/@babel/types": ["@babel/types@7.28.2", "", { "dependencies": { "@babel/helper-string-parser": "^7.27.1", "@babel/helper-validator-identifier": "^7.27.1" } }, "sha512-ruv7Ae4J5dUYULmeXw1gmb7rYRz57OWCPM57pHojnLq/3Z1CK2lNSLTCVjxVk1F/TZHwOZZrOWi0ur95BbLxNQ=="],
+
+    "@astrojs/react/@vitejs/plugin-react/@babel/core/semver": ["semver@6.3.1", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA=="],
+
+    "@babel/helper-module-imports/@babel/traverse/@babel/generator/@jridgewell/gen-mapping": ["@jridgewell/gen-mapping@0.3.8", "", { "dependencies": { "@jridgewell/set-array": "^1.2.1", "@jridgewell/sourcemap-codec": "^1.4.10", "@jridgewell/trace-mapping": "^0.3.24" } }, "sha512-imAbBGkb+ebQyxKgzv5Hu2nmROxoDOXHh80evxdoXNOrvAnVx7zimzc1Oo5h9RlfV4vPXaE2iM5pOFbvOCClWA=="],
+
+    "@babel/helper-module-imports/@babel/traverse/@babel/generator/@jridgewell/trace-mapping": ["@jridgewell/trace-mapping@0.3.25", "", { "dependencies": { "@jridgewell/resolve-uri": "^3.1.0", "@jridgewell/sourcemap-codec": "^1.4.14" } }, "sha512-vNk6aEwybGtawWmy/PzwnGDOjCkLWSD2wqvjGGAgOAwCGWySYXfYoxt00IJkTF+8Lb57DwOb3Aa0o9CApepiYQ=="],
+
    "boxen/string-width/strip-ansi/ansi-regex": ["ansi-regex@6.1.0", "", {}, "sha512-7HSX4QQb4CspciLpVFwyRe79O3xsIZDDLER21kERQ71oaPodF8jL725AgJMFAYbooIqolJoRLuM81SpeUkpkvA=="],

    "serve-static/send/debug/ms": ["ms@2.0.0", "", {}, "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A=="],
--- a/docker-entrypoint.sh
+++ b/docker-entrypoint.sh
@@ -120,161 +120,13 @@ fi
 # Dependencies are already installed during the Docker build process

 # Initialize the database if it doesn't exist
+# Note: Drizzle migrations will be run automatically when the app starts (see src/lib/db/index.ts)
 if [ ! -f "/app/data/gitea-mirror.db" ]; then
-  echo "Initializing database..."
-  if [ -f "dist/scripts/init-db.js" ]; then
-    bun dist/scripts/init-db.js
-  elif [ -f "dist/scripts/manage-db.js" ]; then
-    bun dist/scripts/manage-db.js init
-  elif [ -f "scripts/manage-db.ts" ]; then
-    bun scripts/manage-db.ts init
-  else
-    echo "Warning: Could not find database initialization scripts in dist/scripts."
-    echo "Creating and initializing database manually..."
-
-    # Create the database file
-    touch /app/data/gitea-mirror.db
-
-    # Initialize the database with required tables
-    sqlite3 /app/data/gitea-mirror.db <<EOF
-    CREATE TABLE IF NOT EXISTS users (
-      id TEXT PRIMARY KEY,
-      username TEXT NOT NULL,
-      password TEXT NOT NULL,
-      email TEXT NOT NULL,
-      created_at INTEGER NOT NULL,
-      updated_at INTEGER NOT NULL
-    );
-
-    CREATE TABLE IF NOT EXISTS configs (
-      id TEXT PRIMARY KEY,
-      user_id TEXT NOT NULL,
-      name TEXT NOT NULL,
-      is_active INTEGER NOT NULL DEFAULT 1,
-      github_config TEXT NOT NULL,
-      gitea_config TEXT NOT NULL,
-      include TEXT NOT NULL DEFAULT '["*"]',
-      exclude TEXT NOT NULL DEFAULT '[]',
-      schedule_config TEXT NOT NULL,
-      created_at INTEGER NOT NULL DEFAULT (strftime('%s','now')),
-      updated_at INTEGER NOT NULL DEFAULT (strftime('%s','now')),
-      FOREIGN KEY (user_id) REFERENCES users(id)
-    );
-
-    CREATE TABLE IF NOT EXISTS repositories (
-      id TEXT PRIMARY KEY,
-      user_id TEXT NOT NULL,
-      config_id TEXT NOT NULL,
-      name TEXT NOT NULL,
-      full_name TEXT NOT NULL,
-      url TEXT NOT NULL,
-      clone_url TEXT NOT NULL,
-      owner TEXT NOT NULL,
-      organization TEXT,
-      mirrored_location TEXT DEFAULT '',
-      destination_org TEXT,
-      is_private INTEGER NOT NULL DEFAULT 0,
-      is_fork INTEGER NOT NULL DEFAULT 0,
-      forked_from TEXT,
-      has_issues INTEGER NOT NULL DEFAULT 0,
-      is_starred INTEGER NOT NULL DEFAULT 0,
-      is_archived INTEGER NOT NULL DEFAULT 0,
-      size INTEGER NOT NULL DEFAULT 0,
-      has_lfs INTEGER NOT NULL DEFAULT 0,
-      has_submodules INTEGER NOT NULL DEFAULT 0,
-      language TEXT,
-      description TEXT,
-      default_branch TEXT NOT NULL,
-      visibility TEXT NOT NULL DEFAULT 'public',
-      status TEXT NOT NULL DEFAULT 'imported',
-      last_mirrored INTEGER,
-      error_message TEXT,
-      created_at INTEGER NOT NULL DEFAULT (strftime('%s','now')),
-      updated_at INTEGER NOT NULL DEFAULT (strftime('%s','now')),
-      FOREIGN KEY (user_id) REFERENCES users(id),
-      FOREIGN KEY (config_id) REFERENCES configs(id)
-    );
-
-    -- Uniqueness of (user_id, full_name) for repositories is enforced via drizzle migrations
-
-    CREATE TABLE IF NOT EXISTS organizations (
-      id TEXT PRIMARY KEY,
-      user_id TEXT NOT NULL,
-      config_id TEXT NOT NULL,
-      name TEXT NOT NULL,
-      avatar_url TEXT NOT NULL,
-      membership_role TEXT NOT NULL DEFAULT 'member',
-      is_included INTEGER NOT NULL DEFAULT 1,
-      status TEXT NOT NULL DEFAULT 'imported',
-      last_mirrored INTEGER,
-      error_message TEXT,
-      repository_count INTEGER NOT NULL DEFAULT 0,
-      created_at INTEGER NOT NULL DEFAULT (strftime('%s','now')),
-      updated_at INTEGER NOT NULL DEFAULT (strftime('%s','now')),
-      FOREIGN KEY (user_id) REFERENCES users(id),
-      FOREIGN KEY (config_id) REFERENCES configs(id)
-    );
-
-    CREATE TABLE IF NOT EXISTS mirror_jobs (
-      id TEXT PRIMARY KEY,
-      user_id TEXT NOT NULL,
-      repository_id TEXT,
-      repository_name TEXT,
-      organization_id TEXT,
-      organization_name TEXT,
-      details TEXT,
-      status TEXT NOT NULL DEFAULT 'imported',
-      message TEXT NOT NULL,
-      timestamp TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
-
-      -- New fields for job resilience
-      job_type TEXT NOT NULL DEFAULT 'mirror',
-      batch_id TEXT,
-      total_items INTEGER,
-      completed_items INTEGER DEFAULT 0,
-      item_ids TEXT, -- JSON array as text
-      completed_item_ids TEXT DEFAULT '[]', -- JSON array as text
-      in_progress INTEGER NOT NULL DEFAULT 0, -- Boolean as integer
-      started_at TIMESTAMP,
-      completed_at TIMESTAMP,
-      last_checkpoint TIMESTAMP,
-
-      FOREIGN KEY (user_id) REFERENCES users(id)
-    );
-
-    CREATE INDEX IF NOT EXISTS idx_mirror_jobs_user_id ON mirror_jobs(user_id);
-    CREATE INDEX IF NOT EXISTS idx_mirror_jobs_batch_id ON mirror_jobs(batch_id);
-    CREATE INDEX IF NOT EXISTS idx_mirror_jobs_in_progress ON mirror_jobs(in_progress);
-    CREATE INDEX IF NOT EXISTS idx_mirror_jobs_job_type ON mirror_jobs(job_type);
-    CREATE INDEX IF NOT EXISTS idx_mirror_jobs_timestamp ON mirror_jobs(timestamp);
-
-    CREATE TABLE IF NOT EXISTS events (
-      id TEXT PRIMARY KEY,
-      user_id TEXT NOT NULL,
-      channel TEXT NOT NULL,
-      payload TEXT NOT NULL,
-      read INTEGER NOT NULL DEFAULT 0,
-      created_at INTEGER NOT NULL DEFAULT (strftime('%s','now')),
-      FOREIGN KEY (user_id) REFERENCES users(id)
-    );
-
-    CREATE INDEX IF NOT EXISTS idx_events_user_channel ON events(user_id, channel);
-    CREATE INDEX IF NOT EXISTS idx_events_created_at ON events(created_at);
-    CREATE INDEX IF NOT EXISTS idx_events_read ON events(read);
-EOF
-    echo "Database initialized with required tables."
-  fi
+  echo "Database not found. It will be created and initialized via Drizzle migrations on first app startup..."
+  # Create empty database file so migrations can run
+  touch /app/data/gitea-mirror.db
 else
-  echo "Database already exists, checking for issues..."
-  if [ -f "dist/scripts/fix-db-issues.js" ]; then
-    bun dist/scripts/fix-db-issues.js
-  elif [ -f "dist/scripts/manage-db.js" ]; then
-    bun dist/scripts/manage-db.js fix
-  elif [ -f "scripts/manage-db.ts" ]; then
-    bun scripts/manage-db.ts fix
-  fi
-
-  echo "Database exists, checking integrity..."
+  echo "Database already exists, Drizzle will check for pending migrations on startup..."
 fi

 # Extract version from package.json and set as environment variable
--- a/drizzle/0005_polite_preak.sql
+++ b/drizzle/0005_polite_preak.sql
@@ -1 +1,11 @@
-CREATE UNIQUE INDEX `uniq_repositories_user_full_name` ON `repositories` (`user_id`,`full_name`);
+-- Step 1: Remove duplicate repositories, keeping the most recently updated one
+-- This handles cases where users have duplicate entries from before the unique constraint
+DELETE FROM repositories
+WHERE rowid NOT IN (
+  SELECT MAX(rowid)
+  FROM repositories
+  GROUP BY user_id, full_name
+);
+--> statement-breakpoint
+-- Step 2: Now create the unique index safely
+CREATE UNIQUE INDEX uniq_repositories_user_full_name ON repositories (user_id, full_name);
--- a/helm/gitea-mirror/.yamllint
+++ b/helm/gitea-mirror/.yamllint
@@ -0,0 +1,21 @@
+---
+extends: default
+
+ignore: |
+  .yamllint
+  node_modules
+  templates
+  unittests/bash
+
+rules:
+  truthy:
+    allowed-values: ['true', 'false']
+    check-keys: False
+    level: error
+  line-length: disable
+  document-start: disable
+  comments:
+    min-spaces-from-content: 1
+  braces:
+    max-spaces-inside: 2
+
--- a/helm/gitea-mirror/Chart.yaml
+++ b/helm/gitea-mirror/Chart.yaml
@@ -0,0 +1,12 @@
+apiVersion: v2
+name: gitea-mirror
+description: Kubernetes helm chart for gitea-mirror
+type: application
+version: 0.0.1
+appVersion: 3.7.2
+icon: https://github.com/RayLabsHQ/gitea-mirror/blob/main/.github/assets/logo.png
+keywords:
+  - git
+  - gitea
+sources:
+  - https://github.com/RayLabsHQ/gitea-mirror
--- a/helm/gitea-mirror/README.md
+++ b/helm/gitea-mirror/README.md
@@ -0,0 +1,307 @@
+# gitea-mirror (Helm Chart)
+
+Deploy **gitea-mirror** to Kubernetes using Helm. The chart packages a Deployment, Service, optional Ingress or Gateway API HTTPRoutes, ConfigMap and Secret, a PVC (optional), and an optional ServiceAccount.
+
+- **Chart name:** `gitea-mirror`
+- **Type:** `application`
+- **App version:** `3.7.2` (default image tag, can be overridden)
+
+---
+
+## Prerequisites
+
+- Kubernetes 1.23+
+- Helm 3.8+
+- (Optional) Gateway API (v1) if you plan to use `route.*` HTTPRoutes, see https://github.com/kubernetes-sigs/gateway-api/
+- (Optional) An Ingress controller if you plan to use `ingress.*`
+
+---
+
+## Quick start
+
+From the repo root (chart path: `helm/gitea-mirror`):
+
+```bash
+# Create a namespace (optional)
+kubectl create namespace gitea-mirror
+
+# Install with minimal required secrets/values
+helm upgrade --install gitea-mirror ./helm/gitea-mirror   --namespace gitea-mirror   --set "gitea-mirror.github.username=<your-gh-username>"   --set "gitea-mirror.github.token=<your-gh-token>"   --set "gitea-mirror.gitea.url=https://gitea.example.com"   --set "gitea-mirror.gitea.token=<your-gitea-token>"
+```
+
+The default Service is `ClusterIP` on port `8080`. You can expose it via Ingress or Gateway API; see below.
+
+---
+
+## Upgrading
+
+Standard Helm upgrade:
+
+```bash
+helm upgrade gitea-mirror ./helm/gitea-mirror -n gitea-mirror
+```
+
+If you change persistence settings or storage class, a rollout may require PVC recreation.
+
+---
+
+## Uninstalling
+
+```bash
+helm uninstall gitea-mirror -n gitea-mirror
+```
+
+If you enabled persistence with a PVC the data may persist; delete the PVC manually if you want a clean slate.
+
+---
+
+## Configuration
+
+### Global image & pod settings
+
+| Key | Type | Default | Description |
+| --- | --- | --- | --- |
+| `image.registry` | string | `ghcr.io` | Container registry. |
+| `image.repository` | string | `raylabshq/gitea-mirror` | Image repository. |
+| `image.tag` | string | `""` | Image tag; when empty, uses the chart `appVersion` (`3.7.2`). |
+| `image.pullPolicy` | string | `IfNotPresent` | K8s image pull policy. |
+| `imagePullSecrets` | list | `[]` | Image pull secrets. |
+| `podSecurityContext.runAsUser` | int | `1001` | UID. |
+| `podSecurityContext.runAsGroup` | int | `1001` | GID. |
+| `podSecurityContext.fsGroup` | int | `1001` | FS group. |
+| `podSecurityContext.fsGroupChangePolicy` | string | `OnRootMismatch` | FS group change policy. |
+| `nodeSelector` / `tolerations` / `affinity` / `topologySpreadConstraints` | — | — | Standard scheduling knobs. |
+| `extraVolumes` / `extraVolumeMounts` | list | `[]` | Append custom volumes/mounts. |
+| `priorityClassName` | string | `""` | Optional Pod priority class. |
+
+### Deployment
+
+| Key | Type | Default | Description |
+| --- | --- | --- | --- |
+| `deployment.port` | int | `8080` | Container port & named `http` port. |
+| `deployment.strategy.type` | string | `Recreate` | Update strategy (`Recreate` or `RollingUpdate`). |
+| `deployment.strategy.rollingUpdate.maxUnavailable/maxSurge` | string/int | — | Used when `type=RollingUpdate`. |
+| `deployment.env` | list | `[]` | Extra environment variables. |
+| `deployment.resources` | map | `{}` | CPU/memory requests & limits. |
+| `deployment.terminationGracePeriodSeconds` | int | `60` | Grace period. |
+| `livenessProbe.*` | — | enabled, `/api/health` | Liveness probe (HTTP GET to `/api/health`). |
+| `readinessProbe.*` | — | enabled, `/api/health` | Readiness probe. |
+| `startupProbe.*` | — | enabled, `/api/health` | Startup probe. |
+
+> The Pod mounts a volume at `/app/data` (PVC or `emptyDir` depending on `persistence.enabled`).
+
+### Service
+
+| Key | Type | Default | Description |
+| --- | --- | --- | --- |
+| `service.type` | string | `ClusterIP` | Service type. |
+| `service.port` | int | `8080` | Service port. |
+| `service.clusterIP` | string | `None` | ClusterIP (only when `type=ClusterIP`). |
+| `service.externalTrafficPolicy` | string | `""` | External traffic policy (LB). |
+| `service.loadBalancerIP` | string | `""` | LoadBalancer IP. |
+| `service.loadBalancerClass` | string | `""` | LoadBalancer class. |
+| `service.annotations` / `service.labels` | map | `{}` | Extra metadata. |
+
+### Ingress (optional)
+
+| Key | Type | Default | Description |
+| --- | --- | --- | --- |
+| `ingress.enabled` | bool | `false` | Enable Ingress. |
+| `ingress.className` | string | `""` | IngressClass name. |
+| `ingress.hosts[0].host` | string | `mirror.example.com` | Hostname. |
+| `ingress.tls` | list | `[]` | TLS blocks (secret name etc.). |
+| `ingress.annotations` | map | `{}` | Controller-specific annotations. |
+
+> The Ingress exposes `/` to the chart’s Service.
+
+### Gateway API HTTPRoutes (optional)
+
+| Key | Type | Default | Description |
+| --- | --- | --- | --- |
+| `route.enabled` | bool | `false` | Enable Gateway API HTTPRoutes. |
+| `route.forceHTTPS` | bool | `true` | If true, create an HTTP route that redirects to HTTPS (301). |
+| `route.domain` | list | `["mirror.example.com"]` | Hostnames. |
+| `route.gateway` | string | `""` | Gateway name. |
+| `route.gatewayNamespace` | string | `""` | Gateway namespace. |
+| `route.http.gatewaySection` | string | `""` | SectionName for HTTP listener. |
+| `route.https.gatewaySection` | string | `""` | SectionName for HTTPS listener. |
+| `route.http.filters` / `route.https.filters` | list | `[]` | Additional filters. (Defaults add HSTS header on HTTPS.) |
+
+### Persistence
+
+| Key | Type | Default | Description |
+| --- | --- | --- | --- |
+| `persistence.enabled` | bool | `true` | Enable persistent storage. |
+| `persistence.create` | bool | `true` | Create a PVC from the chart. |
+| `persistence.claimName` | string | `gitea-mirror-storage` | PVC name. |
+| `persistence.storageClass` | string | `""` | StorageClass to use. |
+| `persistence.accessModes` | list | `["ReadWriteOnce"]` | Access modes. |
+| `persistence.size` | string | `1Gi` | Requested size. |
+| `persistence.volumeName` | string | `""` | Bind to existing PV by name (optional). |
+| `persistence.annotations` | map | `{}` | PVC annotations. |
+
+### ServiceAccount (optional)
+
+| Key | Type | Default | Description |
+| --- | --- | --- | --- |
+| `serviceAccount.create` | bool | `false` | Create a ServiceAccount. |
+| `serviceAccount.name` | string | `""` | SA name (defaults to release fullname). |
+| `serviceAccount.automountServiceAccountToken` | bool | `false` | Automount token. |
+| `serviceAccount.annotations` / `labels` | map | `{}` | Extra metadata. |
+
+---
+
+## Application configuration (`gitea-mirror.*`)
+
+These values populate a **ConfigMap** (non-secret) and a **Secret** (for tokens and sensitive fields). Environment variables from both are consumed by the container.
+
+### Core
+
+| Key | Default | Mapped env |
+| --- | --- | --- |
+| `gitea-mirror.nodeEnv` | `production` | `NODE_ENV` |
+| `gitea-mirror.core.databaseUrl` | `file:data/gitea-mirror.db` | `DATABASE_URL` |
+| `gitea-mirror.core.encryptionSecret` | `""` | `ENCRYPTION_SECRET` (Secret) |
+| `gitea-mirror.core.betterAuthSecret` | `""` | `BETTER_AUTH_SECRET` |
+| `gitea-mirror.core.betterAuthUrl` | `http://localhost:4321` | `BETTER_AUTH_URL` |
+| `gitea-mirror.core.betterAuthTrustedOrigins` | `http://localhost:4321` | `BETTER_AUTH_TRUSTED_ORIGINS` |
+
+### GitHub
+
+| Key | Default | Mapped env |
+| --- | --- | --- |
+| `gitea-mirror.github.username` | `""` | `GITHUB_USERNAME` |
+| `gitea-mirror.github.token` | `""` | `GITHUB_TOKEN` (Secret) |
+| `gitea-mirror.github.type` | `personal` | `GITHUB_TYPE` |
+| `gitea-mirror.github.privateRepositories` | `true` | `PRIVATE_REPOSITORIES` |
+| `gitea-mirror.github.skipForks` | `false` | `SKIP_FORKS` |
+| `gitea-mirror.github.starredCodeOnly` | `false` | `SKIP_STARRED_ISSUES` |
+| `gitea-mirror.github.mirrorStarred` | `false` | `MIRROR_STARRED` |
+
+### Gitea
+
+| Key | Default | Mapped env |
+| --- | --- | --- |
+| `gitea-mirror.gitea.url` | `""` | `GITEA_URL` |
+| `gitea-mirror.gitea.token` | `""` | `GITEA_TOKEN` (Secret) |
+| `gitea-mirror.gitea.username` | `""` | `GITEA_USERNAME` |
+| `gitea-mirror.gitea.organization` | `github-mirrors` | `GITEA_ORGANIZATION` |
+| `gitea-mirror.gitea.visibility` | `public` | `GITEA_ORG_VISIBILITY` |
+
+### Mirror options
+
+| Key | Default | Mapped env |
+| --- | --- | --- |
+| `gitea-mirror.mirror.releases` | `true` | `MIRROR_RELEASES` |
+| `gitea-mirror.mirror.wiki` | `true` | `MIRROR_WIKI` |
+| `gitea-mirror.mirror.metadata` | `true` | `MIRROR_METADATA` |
+| `gitea-mirror.mirror.issues` | `true` | `MIRROR_ISSUES` |
+| `gitea-mirror.mirror.pullRequests` | `true` | `MIRROR_PULL_REQUESTS` |
+| `gitea-mirror.mirror.starred` | _(see note above)_ | `MIRROR_STARRED` |
+
+### Automation & cleanup
+
+| Key | Default | Mapped env |
+| --- | --- | --- |
+| `gitea-mirror.automation.schedule_enabled` | `true` | `SCHEDULE_ENABLED` |
+| `gitea-mirror.automation.schedule_interval` | `3600` | `SCHEDULE_INTERVAL` (seconds) |
+| `gitea-mirror.cleanup.enabled` | `true` | `CLEANUP_ENABLED` |
+| `gitea-mirror.cleanup.retentionDays` | `30` | `CLEANUP_RETENTION_DAYS` |
+
+> **Secrets:** If you set `gitea-mirror.existingSecret` (name of an existing Secret), the chart will **not** create its own Secret and will reference yours instead. Otherwise it creates a Secret with `GITHUB_TOKEN`, `GITEA_TOKEN`, `ENCRYPTION_SECRET`.
+
+---
+
+## Exposing the service
+
+### Using Ingress
+
+```yaml
+ingress:
+  enabled: true
+  className: "nginx"
+  hosts:
+    - host: mirror.example.com
+  tls:
+    - secretName: mirror-tls
+      hosts:
+        - mirror.example.com
+```
+
+This creates an Ingress routing `/` to the service on port `8080`.
+
+### Using Gateway API (HTTPRoute)
+
+```yaml
+route:
+  enabled: true
+  domain: ["mirror.example.com"]
+  gateway: "my-gateway"
+  gatewayNamespace: "gateway-system"
+  http:
+    gatewaySection: "http"
+  https:
+    gatewaySection: "https"
+    # Example extra filter already included by default: add HSTS header
+```
+
+If `forceHTTPS: true`, the chart emits an HTTP route that redirects to HTTPS with 301. An HTTPS route is always created when `route.enabled=true`.
+
+---
+
+## Persistence & data
+
+By default, the chart provisions a PVC named `gitea-mirror-storage` with `1Gi` and mounts it at `/app/data`. To use an existing PV or tune storage, adjust `persistence.*` in `values.yaml`. If you disable persistence, an `emptyDir` will be used instead.
+
+---
+
+## Environment & health endpoints
+
+The container listens on `PORT` (defaults to `deployment.port` = `8080`) and exposes `GET /api/health` for liveness/readiness/startup probes.
+
+---
+
+## Examples
+
+### Minimal (tokens via chart-managed Secret)
+
+```yaml
+gitea-mirror:
+  github:
+    username: "gitea-mirror"
+    token: "<gh-token>"
+  gitea:
+    url: "https://gitea.company.tld"
+    token: "<gitea-token>"
+```
+
+### Bring your own Secret
+
+```yaml
+gitea-mirror:
+  existingSecret: "gitea-mirror-secrets"
+  github:
+    username: "gitea-mirror"
+  gitea:
+    url: "https://gitea.company.tld"
+```
+
+Where `gitea-mirror-secrets` contains keys `GITHUB_TOKEN`, `GITEA_TOKEN`, `ENCRYPTION_SECRET`.
+
+---
+
+## Development
+
+Lint the chart:
+
+```bash
+yamllint -c helm/gitea-mirror/.yamllint helm/gitea-mirror
+```
+
+Tweak probes, resources, and scheduling as needed; see `values.yaml`.
+
+---
+
+## License
+
+This chart is part of the `RayLabsHQ/gitea-mirror` repository. See the repository for licensing details.
--- a/helm/gitea-mirror/templates/_helpers.tpl
+++ b/helm/gitea-mirror/templates/_helpers.tpl
@@ -0,0 +1,59 @@
+{{/*
+Expand the name of the chart.
+*/}}
+
+{{- define "gitea-mirror.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "gitea-mirror.fullname" -}}
+{{- if .Values.fullnameOverride -}}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- if contains $name .Release.Name -}}
+{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "gitea-mirror.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Common labels
+*/}}
+{{- define "gitea-mirror.labels" -}}
+helm.sh/chart: {{ include "gitea-mirror.chart" . }}
+app: {{ include "gitea-mirror.name" . }}
+{{ include "gitea-mirror.selectorLabels" . }}
+app.kubernetes.io/version: {{ .Values.image.tag | default .Chart.AppVersion | quote }}
+version: {{ .Values.image.tag | default .Chart.AppVersion | quote }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end -}}
+
+{{/*
+Selector labels
+*/}}
+{{- define "gitea-mirror.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "gitea-mirror.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end -}}
+
+{{/*
+ServiceAccount name
+*/}}
+{{- define "gitea-mirror.serviceAccountName" -}}
+{{ .Values.serviceAccount.name | default (include "gitea-mirror.fullname" .) }}
+{{- end -}}
--- a/helm/gitea-mirror/templates/configmap.yaml
+++ b/helm/gitea-mirror/templates/configmap.yaml
@@ -0,0 +1,38 @@
+{{- $gm := index .Values "gitea-mirror" -}}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "gitea-mirror.fullname" . }}
+  labels:
+    {{- include "gitea-mirror.labels" . | nindent 4 }}
+data:
+  NODE_ENV: {{ $gm.nodeEnv | quote }}
+  # Core configuration
+  DATABASE_URL: {{ $gm.core.databaseUrl | quote }}
+  BETTER_AUTH_SECRET: {{ $gm.core.betterAuthSecret | quote }}
+  BETTER_AUTH_URL: {{ $gm.core.betterAuthUrl | quote }}
+  BETTER_AUTH_TRUSTED_ORIGINS: {{ $gm.core.betterAuthTrustedOrigins | quote }}
+  # GitHub Config
+  GITHUB_USERNAME: {{ $gm.github.username | quote }}
+  GITHUB_TYPE: {{ $gm.github.type | quote }}
+  PRIVATE_REPOSITORIES: {{ $gm.github.privateRepositories | quote }}
+  MIRROR_STARRED: {{ $gm.github.mirrorStarred | quote }}
+  SKIP_FORKS: {{ $gm.github.skipForks | quote }}
+  SKIP_STARRED_ISSUES: {{ $gm.github.starredCodeOnly | quote }}
+  # Gitea Config
+  GITEA_URL: {{ $gm.gitea.url | quote }}
+  GITEA_USERNAME: {{ $gm.gitea.username | quote }}
+  GITEA_ORGANIZATION: {{ $gm.gitea.organization | quote }}
+  GITEA_ORG_VISIBILITY: {{ $gm.gitea.visibility | quote }}
+  # Mirror Options
+  MIRROR_RELEASES: {{ $gm.mirror.releases | quote }}
+  MIRROR_WIKI: {{ $gm.mirror.wiki | quote }}
+  MIRROR_METADATA: {{ $gm.mirror.metadata | quote }}
+  MIRROR_ISSUES: {{ $gm.mirror.issues | quote }}
+  MIRROR_PULL_REQUESTS: {{ $gm.mirror.pullRequests | quote }}
+  # Automation
+  SCHEDULE_ENABLED: {{ $gm.automation.schedule_enabled| quote  }}
+  SCHEDULE_INTERVAL: {{ $gm.automation.schedule_interval | quote }}
+  # Cleanup
+  CLEANUP_ENABLED: {{ $gm.cleanup.enabled | quote }}
+  CLEANUP_RETENTION_DAYS: {{ $gm.cleanup.retentionDays | quote }}
--- a/helm/gitea-mirror/templates/deployment.yaml
+++ b/helm/gitea-mirror/templates/deployment.yaml
@@ -0,0 +1,143 @@
+{{- $gm := index .Values "gitea-mirror" -}}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "gitea-mirror.fullname" . }}
+  {{- with .Values.deployment.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  labels:
+    {{- include "gitea-mirror.labels" . | nindent 4 }}
+    {{- if .Values.deployment.labels }}
+    {{- toYaml .Values.deployment.labels | nindent 4 }}
+    {{- end }}
+spec:
+  replicas: 1
+  strategy:
+    type: {{ .Values.deployment.strategy.type }}
+    {{- if eq .Values.deployment.strategy.type "RollingUpdate" }}
+    rollingUpdate:
+      maxUnavailable: {{ .Values.deployment.strategy.rollingUpdate.maxUnavailable }}
+      maxSurge: {{ .Values.deployment.strategy.rollingUpdate.maxSurge }}
+    {{- end }}
+  selector:
+    matchLabels:
+      {{- include "gitea-mirror.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "gitea-mirror.labels" . | nindent 8 }}
+        {{- if .Values.deployment.labels }}
+        {{- toYaml .Values.deployment.labels | nindent 8 }}
+        {{- end }}
+    spec:
+      {{- if (or .Values.serviceAccount.create .Values.serviceAccount.name) }}
+      serviceAccountName: {{ include "gitea-mirror.serviceAccountName" . }}
+      {{- end }}
+      {{- if .Values.priorityClassName }}
+      priorityClassName: "{{ .Values.priorityClassName }}"
+      {{- end }}
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.podSecurityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      terminationGracePeriodSeconds: {{ .Values.deployment.terminationGracePeriodSeconds }}
+      containers:
+        - name: gitea-mirror
+          image: {{ .Values.image.registry }}/{{ .Values.image.repository }}:{{ .Values.image.tag | default (printf "v%s" .Chart.AppVersion) }}
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          envFrom:
+            - configMapRef:
+                name: {{ include "gitea-mirror.fullname" . }}
+            {{- if $gm.existingSecret }}
+            - secretRef:
+                name: {{ $gm.existingSecret }}
+            {{- else }}
+            - secretRef:
+                name: {{ include "gitea-mirror.fullname" . }}
+            {{- end }}
+          env:
+            - name: PORT
+              value: "{{ .Values.deployment.port }}"
+            {{- if .Values.deployment.env }}
+            {{- toYaml .Values.deployment.env | nindent 12 }}
+            {{- end }}
+          ports:
+            - name: http
+              containerPort: {{ .Values.deployment.port }}
+          {{- if .Values.livenessProbe.enabled }}
+          livenessProbe:
+            httpGet:
+              path: /api/health
+              port: "http"
+            initialDelaySeconds: {{ .Values.livenessProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.livenessProbe.periodSeconds }}
+            timeoutSeconds: {{ .Values.livenessProbe.timeoutSeconds }}
+            failureThreshold: {{ .Values.livenessProbe.failureThreshold }}
+            successThreshold: {{ .Values.livenessProbe.successThreshold }}
+          {{- end }}
+          {{- if .Values.readinessProbe.enabled }}
+          readinessProbe:
+            httpGet:
+              path: /api/health
+              port: "http"
+            initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
+            timeoutSeconds: {{ .Values.readinessProbe.timeoutSeconds }}
+            failureThreshold: {{ .Values.readinessProbe.failureThreshold }}
+            successThreshold: {{ .Values.readinessProbe.successThreshold }}
+          {{- end }}
+          {{- if .Values.startupProbe.enabled }}
+          startupProbe:
+            httpGet:
+              path: /api/health
+              port: "http"
+            initialDelaySeconds: {{ .Values.startupProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.startupProbe.periodSeconds }}
+            timeoutSeconds: {{ .Values.startupProbe.timeoutSeconds }}
+            failureThreshold: {{ .Values.startupProbe.failureThreshold }}
+            successThreshold: {{ .Values.startupProbe.successThreshold }}
+          {{- end }}
+          volumeMounts:
+            - name: data
+              mountPath: /app/data
+            {{- if .Values.extraVolumeMounts }}
+              {{- toYaml .Values.extraVolumeMounts | nindent 12 }}
+            {{- end }}
+          {{- with .Values.deployment.resources }}
+          resources:
+            {{- toYaml .Values.deployment.resources | nindent 12 }}
+          {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      volumes:
+      {{- if .Values.persistence.enabled }}
+        - name: data
+          persistentVolumeClaim:
+            claimName: {{ .Values.persistence.claimName }}
+      {{- else if not .Values.persistence.enabled }}
+          - name: data
+            emptyDir: {}
+      {{- end }}
+      {{- if .Values.extraVolumes }}
+        {{- toYaml .Values.extraVolumes | nindent 8 }}
+      {{- end }}
--- a/helm/gitea-mirror/templates/httproute.yaml
+++ b/helm/gitea-mirror/templates/httproute.yaml
@@ -0,0 +1,77 @@
+{{- if .Values.route.enabled }}
+{{- if .Values.route.forceHTTPS }}
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: {{ include "gitea-mirror.fullname" . }}-http
+  labels:
+    {{- include "gitea-mirror.labels" . | nindent 4 }}
+spec:
+  parentRefs:
+    - name: {{ .Values.route.gateway }}
+      sectionName: {{ .Values.route.http.gatewaySection }}
+      namespace: {{ .Values.route.gatewayNamespace }}
+  hostnames: {{ .Values.route.domain }}
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            statusCode: 301
+        {{- with .Values.route.http.filters }}
+          {{ toYaml . | nindent 4 }}
+        {{- end }}
+{{- else }}
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: {{ include "gitea-mirror.fullname" . }}-http
+  labels:
+    {{- include "gitea-mirror.labels" . | nindent 4 }}
+spec:
+  parentRefs:
+    - name: {{ .Values.route.gateway }}
+      sectionName: {{ .Values.route.http.gatewaySection }}
+      namespace: {{ .Values.route.gatewayNamespace }}
+  hostnames: {{ .Values.route.domain }}
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        - name: {{ include "gitea-mirror.fullname" . }}
+          port: {{ .Values.service.port }}
+      {{- with .Values.route.http.filters }}
+      filters:
+         {{- toYaml . | nindent 8 }}
+      {{- end }}
+{{- end }}
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: {{ include "gitea-mirror.fullname" . }}-https
+  labels:
+    {{- include "gitea-mirror.labels" . | nindent 4 }}
+spec:
+  parentRefs:
+    - name: {{ .Values.route.gateway }}
+      sectionName: {{ .Values.route.https.gatewaySection }}
+      namespace: {{ .Values.route.gatewayNamespace }}
+  hostnames: {{ .Values.route.domain }}
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        - name: {{ include "gitea-mirror.fullname" . }}
+          port: {{ .Values.service.port }}
+      {{- with .Values.route.https.filters }}
+      filters:
+          {{- toYaml . | nindent 8 }}
+      {{- end }}
+{{- end }}
--- a/helm/gitea-mirror/templates/ingress.yaml
+++ b/helm/gitea-mirror/templates/ingress.yaml
@@ -0,0 +1,40 @@
+{{- if .Values.ingress.enabled -}}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ include "gitea-mirror.fullname" . }}
+  labels:
+    {{- include "gitea-mirror.labels" . | nindent 4 }}
+  {{- with .Values.ingress.annotations }}
+  annotations:
+    {{- . | toYaml | nindent 4 }}
+  {{- end }}
+spec:
+{{- if .Values.ingress.className }}
+  ingressClassName: {{ .Values.ingress.className }}
+{{- end }}
+{{- if .Values.ingress.tls }}
+  tls:
+  {{- range .Values.ingress.tls }}
+    - hosts:
+      {{- range .hosts }}
+        - {{ tpl . $ | quote }}
+      {{- end }}
+      secretName: {{ .secretName }}
+  {{- end }}
+{{- end }}
+  rules:
+    {{- range .Values.ingress.hosts }}
+    - host: {{ tpl .host $ | quote }}
+      http:
+        paths:
+          - path: {{ .path | default "/" }}
+            pathType: {{ .pathType | default "Prefix" }}
+            backend:
+              service:
+                name: {{ include "gitea-mirror.fullname" $ }}
+                port:
+                  number: {{ $.Values.service.port }}
+    {{- end }}
+{{- end }}
+
--- a/helm/gitea-mirror/templates/pvc.yaml
+++ b/helm/gitea-mirror/templates/pvc.yaml
@@ -0,0 +1,26 @@
+{{- if and .Values.persistence.enabled .Values.persistence.create }}
+{{- $gm := index .Values "gitea-mirror" -}}
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: {{ .Values.persistence.claimName }}
+  labels:
+    {{- include "gitea-mirror.labels" . | nindent 4 }}
+  {{- with .Values.persistence.annotations }}
+  annotations:
+    {{ . | toYaml | indent 4}}
+  {{- end }}
+spec:
+  accessModes:
+    {{- toYaml .Values.persistence.accessModes | nindent 4 }}
+  {{- with .Values.persistence.storageClass }}
+  storageClassName: {{ . }}
+  {{- end }}
+  volumeMode: Filesystem
+  {{- with .Values.persistence.volumeName }}
+  volumeName: {{ . }}
+  {{- end }}
+  resources:
+    requests:
+      storage: {{ .Values.persistence.size }}
+{{- end }}
--- a/helm/gitea-mirror/templates/secret.yaml
+++ b/helm/gitea-mirror/templates/secret.yaml
@@ -0,0 +1,14 @@
+{{- $gm := index .Values "gitea-mirror" -}}
+{{- if (empty $gm.existingSecret) }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "gitea-mirror.fullname" . }}
+  labels:
+    {{- include "gitea-mirror.labels" . | nindent 4 }}
+type: Opaque
+stringData:
+  GITHUB_TOKEN: {{ $gm.github.token | quote }}
+  GITEA_TOKEN: {{ $gm.gitea.token | quote }}
+  ENCRYPTION_SECRET: {{ $gm.core.encryptionSecret | quote }}
+{{- end }}
--- a/helm/gitea-mirror/templates/service.yaml
+++ b/helm/gitea-mirror/templates/service.yaml
@@ -0,0 +1,34 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "gitea-mirror.fullname" . }}
+  labels:
+    {{- include "gitea-mirror.labels" . | nindent 4 }}
+    {{- if .Values.service.labels }}
+      {{- toYaml .Values.service.labels  | nindent 4 }}
+    {{- end }}
+  annotations:
+    {{- toYaml .Values.service.annotations | nindent 4 }}
+spec:
+  type: {{ .Values.service.type }}
+  {{- if eq .Values.service.type "LoadBalancer" }}
+  {{- if .Values.service.loadBalancerClass }}
+  loadBalancerClass: {{ .Values.service.loadBalancerClass }}
+  {{- end }}
+  {{- if and .Values.service.loadBalancerIP }}
+  loadBalancerIP: {{ .Values.service.loadBalancerIP  }}
+  {{- end }}
+  {{- end }}
+  {{- if .Values.service.externalTrafficPolicy }}
+  externalTrafficPolicy: {{ .Values.service.externalTrafficPolicy }}
+  {{- end }}
+  {{- if and .Values.service.clusterIP (eq .Values.service.type "ClusterIP") }}
+  clusterIP: {{ .Values.service.clusterIP }}
+  {{- end }}
+  ports:
+    - name: http
+      port: {{ .Values.service.port }}
+      protocol: TCP
+      targetPort: http
+  selector:
+    {{- include "gitea-mirror.selectorLabels" . | nindent 4 }}
--- a/helm/gitea-mirror/templates/serviceaccount.yaml
+++ b/helm/gitea-mirror/templates/serviceaccount.yaml
@@ -0,0 +1,17 @@
+{{- if .Values.serviceAccount.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "gitea-mirror.serviceAccountName" . }}
+  labels:
+    {{- include "gitea-mirror.labels" . | nindent 4 }}
+    {{- with .Values.serviceAccount.labels }}
+      {{- . | toYaml | nindent 4 }}
+    {{- end }}
+  {{- with .Values.serviceAccount.annotations }}
+  annotations:
+    {{- . | toYaml | nindent 4 }}
+  {{- end }}
+automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
+{{- end }}
+
--- a/helm/gitea-mirror/values.yaml
+++ b/helm/gitea-mirror/values.yaml
@@ -0,0 +1,151 @@
+image:
+  registry: ghcr.io
+  repository: raylabshq/gitea-mirror
+  # Leave blank to use the Appversion tag
+  tag: ""
+  pullPolicy: IfNotPresent
+
+imagePullSecrets: []
+podSecurityContext:
+  runAsUser: 1001
+  runAsGroup: 1001
+  fsGroup: 1001
+  fsGroupChangePolicy: OnRootMismatch
+
+ingress:
+  enabled: false
+  className: ""
+  annotations: {}
+  hosts:
+    - host: mirror.example.com
+      paths:
+        - path: /
+          pathType: Prefix
+  tls: []
+  #  - secretName: chart-example-tls
+  #    hosts:
+  #      - mirror.example.com
+
+route:
+  enabled: false
+  forceHTTPS: true
+  domain: ["mirror.example.com"]
+  gateway: ""
+  gatewayNamespace: ""
+  http:
+    gatewaySection: ""
+    filters: []
+  https:
+    gatewaySection: ""
+    filters:
+      - type: ResponseHeaderModifier
+        responseHeaderModifier:
+          add:
+            - name: Strict-Transport-Security
+              value: "max-age=31536000; includeSubDomains; preload"
+
+service:
+  type: ClusterIP
+  port: 8080
+  clusterIP: None
+  annotations: {}
+  externalTrafficPolicy:
+  labels: {}
+  loadBalancerIP:
+  loadBalancerClass:
+
+deployment:
+  port: 8080
+  strategy:
+    type: Recreate
+  env: []
+  terminationGracePeriodSeconds: 60
+  labels: {}
+  annotations: {}
+  resources: {}
+
+livenessProbe:
+  enabled: true
+  initialDelaySeconds: 60
+  periodSeconds: 10
+  timeoutSeconds: 5
+  failureThreshold: 6
+  successThreshold: 1
+readinessProbe:
+  enabled: true
+  initialDelaySeconds: 60
+  periodSeconds: 10
+  timeoutSeconds: 5
+  failureThreshold: 6
+  successThreshold: 1
+startupProbe:
+  enabled: true
+  initialDelaySeconds: 60
+  periodSeconds: 10
+  timeoutSeconds: 5
+  failureThreshold: 6
+  successThreshold: 1
+
+persistence:
+  enabled: true
+  create: true
+  claimName: gitea-mirror-storage
+  storageClass: ""
+  accessModes:
+    - ReadWriteOnce
+  size: 1Gi
+
+affinity: {}
+nodeSelector: {}
+tolerations: []
+topologySpreadConstraints: []
+extraVolumes: []
+extraVolumeMounts: []
+
+serviceAccount:
+  create: false
+  name: ""
+  annotations: {}
+  labels: {}
+  automountServiceAccountToken: false
+
+gitea-mirror:
+  existingSecret: ""
+  nodeEnv: production
+  core:
+    databaseUrl: file:data/gitea-mirror.db
+    encryptionSecret: ""
+    betterAuthSecret: ""
+    betterAuthUrl: "http://localhost:4321"
+    betterAuthTrustedOrigins: "http://localhost:4321"
+
+  github:
+    username: ""
+    token: ""
+    type: personal
+    privateRepositories: true
+    mirrorStarred: false
+    skipForks: false
+    starredCodeOnly: false
+
+  gitea:
+    url: ""
+    token: ""
+    username: ""
+    organization: "github-mirrors"
+    visibility: "public"
+
+  mirror:
+    releases: true
+    wiki: true
+    metadata: true
+    issues: true
+    pullRequests: true
+
+  automation:
+    schedule_enabled: true
+    schedule_interval: 3600
+
+  cleanup:
+    enabled: true
+    retentionDays: 30
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
  "name": "gitea-mirror",
  "type": "module",
-  "version": "3.7.1",
+  "version": "3.8.4",
  "engines": {
    "bun": ">=1.2.9"
  },
@@ -43,11 +43,11 @@
  },
  "dependencies": {
    "@astrojs/check": "^0.9.4",
-    "@astrojs/mdx": "4.3.5",
-    "@astrojs/node": "9.4.3",
+    "@astrojs/mdx": "4.3.6",
+    "@astrojs/node": "9.4.4",
    "@astrojs/react": "^4.3.1",
-    "@better-auth/sso": "^1.3.9",
-    "@octokit/plugin-throttling": "^11.0.1",
+    "@better-auth/sso": "^1.3.24",
+    "@octokit/plugin-throttling": "^11.0.2",
    "@octokit/rest": "^22.0.0",
    "@radix-ui/react-accordion": "^1.2.12",
    "@radix-ui/react-avatar": "^1.1.10",
@@ -70,20 +70,20 @@
    "@tailwindcss/vite": "^4.1.13",
    "@tanstack/react-virtual": "^3.13.12",
    "@types/canvas-confetti": "^1.9.0",
-    "@types/react": "^19.1.12",
+    "@types/react": "^19.1.16",
    "@types/react-dom": "^19.1.9",
-    "astro": "^5.13.7",
+    "astro": "^5.14.1",
    "bcryptjs": "^3.0.2",
-    "better-auth": "^1.3.9",
+    "better-auth": "^1.3.24",
    "canvas-confetti": "^1.9.3",
    "class-variance-authority": "^0.7.1",
    "clsx": "^2.1.1",
    "cmdk": "^1.1.1",
-    "dotenv": "^17.2.2",
+    "dotenv": "^17.2.3",
    "drizzle-orm": "^0.44.5",
    "fuse.js": "^7.1.0",
    "jsonwebtoken": "^9.0.2",
-    "lucide-react": "^0.542.0",
+    "lucide-react": "^0.544.0",
    "next-themes": "^0.4.6",
    "react": "^19.1.1",
    "react-dom": "^19.1.1",
@@ -91,24 +91,24 @@
    "sonner": "^2.0.7",
    "tailwind-merge": "^3.3.1",
    "tailwindcss": "^4.1.13",
-    "tw-animate-css": "^1.3.8",
-    "typescript": "^5.9.2",
+    "tw-animate-css": "^1.4.0",
+    "typescript": "^5.9.3",
    "uuid": "^13.0.0",
    "vaul": "^1.1.2",
-    "zod": "^4.1.5"
+    "zod": "^4.1.11"
  },
  "devDependencies": {
-    "@testing-library/jest-dom": "^6.8.0",
+    "@testing-library/jest-dom": "^6.9.0",
    "@testing-library/react": "^16.3.0",
    "@types/bcryptjs": "^3.0.0",
-    "@types/bun": "^1.2.21",
+    "@types/bun": "^1.2.23",
    "@types/jsonwebtoken": "^9.0.10",
    "@types/uuid": "^10.0.0",
-    "@vitejs/plugin-react": "^5.0.2",
-    "drizzle-kit": "^0.31.4",
+    "@vitejs/plugin-react": "^5.0.4",
+    "drizzle-kit": "^0.31.5",
    "jsdom": "^26.1.0",
-    "tsx": "^4.20.5",
+    "tsx": "^4.20.6",
    "vitest": "^3.2.4"
  },
-  "packageManager": "bun@1.2.21"
+  "packageManager": "bun@1.2.23"
 }
--- a/src/components/config/AdvancedOptionsForm.tsx
+++ b/src/components/config/AdvancedOptionsForm.tsx
@@ -67,21 +67,21 @@ export function AdvancedOptionsForm({

          <div className="flex items-center">
            <Checkbox
-              id="skip-starred-issues"
-              checked={config.skipStarredIssues}
+              id="starred-code-only"
+              checked={config.starredCodeOnly}
              onCheckedChange={(checked) =>
-                handleChange("skipStarredIssues", Boolean(checked))
+                handleChange("starredCodeOnly", Boolean(checked))
              }
            />
            <label
-              htmlFor="skip-starred-issues"
+              htmlFor="starred-code-only"
              className="ml-2 text-sm select-none"
            >
-              Don't fetch issues for starred repos
+              Code-only mode for starred repos
            </label>
          </div>
          <p className="text-xs text-muted-foreground ml-6">
-            Skip mirroring issues and pull requests for starred repositories
+            Mirror only source code for starred repositories, skipping all metadata (issues, PRs, labels, milestones, wiki, releases)
          </p>
        </div>
      </CardContent>
--- a/src/components/config/ConfigTabs.tsx
+++ b/src/components/config/ConfigTabs.tsx
@@ -71,7 +71,7 @@ export function ConfigTabs() {
    },
    advancedOptions: {
      skipForks: false,
-      skipStarredIssues: false,
+      starredCodeOnly: false,
    },
  });
  const { user } = useAuth();
--- a/src/components/config/GitHubMirrorSettings.tsx
+++ b/src/components/config/GitHubMirrorSettings.tsx
@@ -89,10 +89,10 @@ export function GitHubMirrorSettings({
  // Calculate what content is included for starred repos
  const starredRepoContent = {
    code: true, // Always included
-    releases: !advancedOptions.skipStarredIssues && mirrorOptions.mirrorReleases,
-    issues: !advancedOptions.skipStarredIssues && mirrorOptions.mirrorMetadata && mirrorOptions.metadataComponents.issues,
-    pullRequests: !advancedOptions.skipStarredIssues && mirrorOptions.mirrorMetadata && mirrorOptions.metadataComponents.pullRequests,
-    wiki: !advancedOptions.skipStarredIssues && mirrorOptions.mirrorMetadata && mirrorOptions.metadataComponents.wiki,
+    releases: !advancedOptions.starredCodeOnly && mirrorOptions.mirrorReleases,
+    issues: !advancedOptions.starredCodeOnly && mirrorOptions.mirrorMetadata && mirrorOptions.metadataComponents.issues,
+    pullRequests: !advancedOptions.starredCodeOnly && mirrorOptions.mirrorMetadata && mirrorOptions.metadataComponents.pullRequests,
+    wiki: !advancedOptions.starredCodeOnly && mirrorOptions.mirrorMetadata && mirrorOptions.metadataComponents.wiki,
  };
  
  const starredContentCount = Object.entries(starredRepoContent).filter(([key, value]) => key !== 'code' && value).length;
@@ -168,7 +168,7 @@ export function GitHubMirrorSettings({
                    className="h-8 text-xs font-normal min-w-[140px] md:min-w-[140px] justify-between"
                  >
                    <span>
-                      {advancedOptions.skipStarredIssues ? (
+                      {advancedOptions.starredCodeOnly ? (
                        "Code only"
                      ) : starredContentCount === 0 ? (
                        "Code only"
@@ -206,8 +206,8 @@ export function GitHubMirrorSettings({
                      <div className="flex items-center space-x-3 py-1 px-1 rounded hover:bg-accent">
                        <Checkbox
                          id="starred-lightweight"
-                          checked={advancedOptions.skipStarredIssues}
-                          onCheckedChange={(checked) => handleAdvancedChange('skipStarredIssues', !!checked)}
+                          checked={advancedOptions.starredCodeOnly}
+                          onCheckedChange={(checked) => handleAdvancedChange('starredCodeOnly', !!checked)}
                        />
                        <Label
                          htmlFor="starred-lightweight"
@@ -222,7 +222,7 @@ export function GitHubMirrorSettings({
                        </Label>
                      </div>
                      
-                      {!advancedOptions.skipStarredIssues && (
+                      {!advancedOptions.starredCodeOnly && (
                        <>
                          <Separator className="my-2" />
                          <div className="space-y-2">
--- a/src/lib/db/schema.ts
+++ b/src/lib/db/schema.ts
@@ -27,7 +27,8 @@ export const githubConfigSchema = z.object({
  starredReposOrg: z.string().optional(),
  mirrorStrategy: z.enum(["preserve", "single-org", "flat-user", "mixed"]).default("preserve"),
  defaultOrg: z.string().optional(),
-  skipStarredIssues: z.boolean().default(false),
+  starredCodeOnly: z.boolean().default(false),
+  skipStarredIssues: z.boolean().optional(), // Deprecated: kept for backward compatibility, use starredCodeOnly instead
  starredDuplicateStrategy: z.enum(["suffix", "prefix", "owner-org"]).default("suffix").optional(),
 });

@@ -207,7 +208,7 @@ export const organizationSchema = z.object({
  configId: z.string(),
  name: z.string(),
  avatarUrl: z.string(),
-  membershipRole: z.enum(["admin", "member", "owner"]).default("member"),
+  membershipRole: z.enum(["member", "admin", "owner", "billing_manager"]).default("member"),
  isIncluded: z.boolean().default(true),
  destinationOrg: z.string().optional().nullable(),
  status: z
--- a/src/lib/env-config-loader.ts
+++ b/src/lib/env-config-loader.ts
@@ -21,7 +21,7 @@ interface EnvConfig {
    mirrorOrganizations?: boolean;
    preserveOrgStructure?: boolean;
    onlyMirrorOrgs?: boolean;
-    skipStarredIssues?: boolean;
+    starredCodeOnly?: boolean;
    starredReposOrg?: string;
    mirrorStrategy?: 'preserve' | 'single-org' | 'flat-user' | 'mixed';
  };
@@ -107,7 +107,7 @@ function parseEnvConfig(): EnvConfig {
      mirrorOrganizations: process.env.MIRROR_ORGANIZATIONS === 'true',
      preserveOrgStructure: process.env.PRESERVE_ORG_STRUCTURE === 'true',
      onlyMirrorOrgs: process.env.ONLY_MIRROR_ORGS === 'true',
-      skipStarredIssues: process.env.SKIP_STARRED_ISSUES === 'true',
+      starredCodeOnly: process.env.SKIP_STARRED_ISSUES === 'true',
      starredReposOrg: process.env.STARRED_REPOS_ORG,
      mirrorStrategy: process.env.MIRROR_STRATEGY as 'preserve' | 'single-org' | 'flat-user' | 'mixed',
    },
@@ -253,7 +253,7 @@ export async function initializeConfigFromEnv(): Promise<void> {
      starredReposOrg: envConfig.github.starredReposOrg || existingConfig?.[0]?.githubConfig?.starredReposOrg || 'starred',
      mirrorStrategy,
      defaultOrg: envConfig.gitea.organization || existingConfig?.[0]?.githubConfig?.defaultOrg || 'github-mirrors',
-      skipStarredIssues: envConfig.github.skipStarredIssues ?? existingConfig?.[0]?.githubConfig?.skipStarredIssues ?? false,
+      starredCodeOnly: envConfig.github.starredCodeOnly ?? existingConfig?.[0]?.githubConfig?.starredCodeOnly ?? false,
    };

    // Build Gitea config
--- a/src/lib/gitea.test.ts
+++ b/src/lib/gitea.test.ts
@@ -8,10 +8,19 @@ import { createMockResponse, mockFetch } from "@/tests/mock-fetch";
 // Mock the isRepoPresentInGitea function
 const mockIsRepoPresentInGitea = mock(() => Promise.resolve(false));

+let mockDbSelectResult: any[] = [];
+
 // Mock the database module
 mock.module("@/lib/db", () => {
  return {
    db: {
+      select: () => ({
+        from: () => ({
+          where: () => ({
+            limit: () => Promise.resolve(mockDbSelectResult)
+          })
+        })
+      }),
      update: () => ({
        set: () => ({
          where: () => Promise.resolve()
@@ -63,6 +72,7 @@ describe("Gitea Repository Mirroring", () => {
    originalConsoleError = console.error;
    console.log = mock(() => {});
    console.error = mock(() => {});
+    mockDbSelectResult = [];
  });

  afterEach(() => {
@@ -331,7 +341,7 @@ describe("getGiteaRepoOwner - Organization Override Tests", () => {
      excludeOrgs: [],
      mirrorPublicOrgs: false,
      publicOrgs: [],
-      skipStarredIssues: false,
+      starredCodeOnly: false,
      mirrorStrategy: "preserve"
    },
    giteaConfig: {
@@ -449,4 +459,37 @@ describe("getGiteaRepoOwner - Organization Override Tests", () => {
    const result = getGiteaRepoOwner({ config: configWithFlatUser, repository: repo });
    expect(result).toBe("giteauser");
  });
+
+  test("getGiteaRepoOwnerAsync honors organization override for owner role", async () => {
+    mockDbSelectResult = [
+      {
+        id: "org-id",
+        userId: "user-id",
+        configId: "config-id",
+        name: "myorg",
+        membershipRole: "owner",
+        status: "imported",
+        destinationOrg: "custom-org",
+        avatarUrl: "https://example.com/avatar.png",
+        isIncluded: true,
+        repositoryCount: 0,
+        createdAt: new Date(),
+        updatedAt: new Date()
+      }
+    ];
+
+    const configWithUser: Partial<Config> = {
+      ...baseConfig,
+      userId: "user-id"
+    };
+
+    const repo = { ...baseRepo, organization: "myorg" };
+
+    const result = await getGiteaRepoOwnerAsync({
+      config: configWithUser,
+      repository: repo
+    });
+
+    expect(result).toBe("custom-org");
+  });
 });
--- a/src/lib/gitea.ts
+++ b/src/lib/gitea.ts
@@ -200,6 +200,96 @@ export const isRepoPresentInGitea = async ({
  }
 };

+/**
+ * Check if a repository is currently being mirrored (in-progress state in database)
+ * This prevents race conditions where multiple concurrent operations try to mirror the same repo
+ */
+export const isRepoCurrentlyMirroring = async ({
+  config,
+  repoName,
+  expectedLocation,
+}: {
+  config: Partial<Config>;
+  repoName: string;
+  expectedLocation?: string; // Format: "owner/repo"
+}): Promise<boolean> => {
+  try {
+    if (!config.userId) {
+      return false;
+    }
+
+    const { or } = await import("drizzle-orm");
+
+    // Check database for any repository with "mirroring" or "syncing" status
+    const inProgressRepos = await db
+      .select()
+      .from(repositories)
+      .where(
+        and(
+          eq(repositories.userId, config.userId),
+          eq(repositories.name, repoName),
+          // Check for in-progress statuses
+          or(
+            eq(repositories.status, "mirroring"),
+            eq(repositories.status, "syncing")
+          )
+        )
+      );
+
+    if (inProgressRepos.length > 0) {
+      // Check if any of the in-progress repos are stale (stuck for > 2 hours)
+      const TWO_HOURS_MS = 2 * 60 * 60 * 1000;
+      const now = new Date().getTime();
+
+      const activeRepos = inProgressRepos.filter((repo) => {
+        if (!repo.updatedAt) return true; // No timestamp, assume active
+        const updatedTime = new Date(repo.updatedAt).getTime();
+        const isStale = (now - updatedTime) > TWO_HOURS_MS;
+
+        if (isStale) {
+          console.warn(
+            `[Idempotency] Repository ${repo.name} has been in "${repo.status}" status for over 2 hours. ` +
+            `Considering it stale and allowing retry.`
+          );
+        }
+
+        return !isStale;
+      });
+
+      if (activeRepos.length === 0) {
+        console.log(
+          `[Idempotency] All in-progress operations for ${repoName} are stale (>2h). Allowing retry.`
+        );
+        return false;
+      }
+
+      // If we have an expected location, verify it matches
+      if (expectedLocation) {
+        const matchingRepo = activeRepos.find(
+          (repo) => repo.mirroredLocation === expectedLocation
+        );
+        if (matchingRepo) {
+          console.log(
+            `[Idempotency] Repository ${repoName} is already being mirrored at ${expectedLocation}`
+          );
+          return true;
+        }
+      } else {
+        console.log(
+          `[Idempotency] Repository ${repoName} is already being mirrored (${activeRepos.length} in-progress operations found)`
+        );
+        return true;
+      }
+    }
+
+    return false;
+  } catch (error) {
+    console.error("Error checking if repo is currently mirroring:", error);
+    console.error("Error details:", error);
+    return false;
+  }
+};
+
 /**
 * Helper function to check if a repository exists in Gitea.
 * First checks the recorded mirroredLocation, then falls back to the expected location.
@@ -276,11 +366,11 @@ export const mirrorGithubRepoToGitea = async ({

    // Determine the actual repository name to use (handle duplicates for starred repos)
    let targetRepoName = repository.name;
-    
+
    if (repository.isStarred && config.githubConfig) {
      // Extract GitHub owner from full_name (format: owner/repo)
      const githubOwner = repository.fullName.split('/')[0];
-      
+
      targetRepoName = await generateUniqueRepoName({
        config,
        orgName: repoOwner,
@@ -288,7 +378,7 @@ export const mirrorGithubRepoToGitea = async ({
        githubOwner,
        strategy: config.githubConfig.starredDuplicateStrategy,
      });
-      
+
      if (targetRepoName !== repository.name) {
        console.log(
          `Starred repo ${repository.fullName} will be mirrored as ${repoOwner}/${targetRepoName} to avoid naming conflict`
@@ -296,6 +386,23 @@ export const mirrorGithubRepoToGitea = async ({
      }
    }

+    // IDEMPOTENCY CHECK: Check if this repo is already being mirrored
+    const expectedLocation = `${repoOwner}/${targetRepoName}`;
+    const isCurrentlyMirroring = await isRepoCurrentlyMirroring({
+      config,
+      repoName: targetRepoName,
+      expectedLocation,
+    });
+
+    if (isCurrentlyMirroring) {
+      console.log(
+        `[Idempotency] Skipping ${repository.fullName} - already being mirrored to ${expectedLocation}`
+      );
+
+      // Don't throw an error, just return to allow other repos to continue
+      return;
+    }
+
    const isExisting = await isRepoPresentInGitea({
      config,
      owner: repoOwner,
@@ -337,11 +444,30 @@ export const mirrorGithubRepoToGitea = async ({

    console.log(`Mirroring repository ${repository.name}`);

+    // DOUBLE-CHECK: Final idempotency check right before updating status
+    // This catches race conditions in the small window between first check and status update
+    const finalCheck = await isRepoCurrentlyMirroring({
+      config,
+      repoName: targetRepoName,
+      expectedLocation,
+    });
+
+    if (finalCheck) {
+      console.log(
+        `[Idempotency] Race condition detected - ${repository.fullName} is now being mirrored by another process. Skipping.`
+      );
+      return;
+    }
+
    // Mark repos as "mirroring" in DB
+    // CRITICAL: Set mirroredLocation NOW (not after success) so idempotency checks work
+    // This becomes the "target location" - where we intend to mirror to
+    // Without this, the idempotency check can't detect concurrent operations on first mirror
    await db
      .update(repositories)
      .set({
        status: repoStatusEnum.parse("mirroring"),
+        mirroredLocation: expectedLocation,
        updatedAt: new Date(),
      })
      .where(eq(repositories.id, repository.id!));
@@ -356,21 +482,8 @@ export const mirrorGithubRepoToGitea = async ({
      status: "mirroring",
    });

-    let cloneAddress = repository.cloneUrl;
-
-    // If the repository is private, inject the GitHub token into the clone URL
-    if (repository.isPrivate) {
-      if (!config.githubConfig.token) {
-        throw new Error(
-          "GitHub token is required to mirror private repositories."
-        );
-      }
-
-      cloneAddress = repository.cloneUrl.replace(
-        "https://",
-        `https://${decryptedConfig.githubConfig.token}@`
-      );
-    }
+    // Use clean clone URL without embedded credentials (Forgejo 12+ security requirement)
+    const cloneAddress = repository.cloneUrl;

    const apiUrl = `${config.giteaConfig.url}/api/v1/repos/migrate`;

@@ -384,17 +497,17 @@ export const mirrorGithubRepoToGitea = async ({
        });
      } catch (orgError) {
        console.error(`Failed to create/access organization ${repoOwner}: ${orgError instanceof Error ? orgError.message : String(orgError)}`);
-        
+
        // Check if we should fallback to user account
-        if (orgError instanceof Error && 
-            (orgError.message.includes('Permission denied') || 
+        if (orgError instanceof Error &&
+            (orgError.message.includes('Permission denied') ||
             orgError.message.includes('Authentication failed') ||
             orgError.message.includes('does not have permission'))) {
          console.warn(`[Fallback] Organization creation/access failed. Attempting to mirror to user account instead.`);
-          
+
          // Update the repository owner to use the user account
          repoOwner = config.giteaConfig.defaultOwner;
-          
+
          // Log this fallback in the database
          await db
            .update(repositories)
@@ -420,7 +533,7 @@ export const mirrorGithubRepoToGitea = async ({

    if (existingRepo && !existingRepo.mirror) {
      console.log(`Repository ${targetRepoName} exists but is not a mirror. Handling...`);
-      
+
      // Handle the existing non-mirror repository
      await handleExistingNonMirrorRepo({
        config,
@@ -428,33 +541,59 @@ export const mirrorGithubRepoToGitea = async ({
        repoInfo: existingRepo,
        strategy: "delete", // Can be configured: "skip", "delete", or "rename"
      });
-      
+
      // After handling, proceed with mirror creation
      console.log(`Proceeding with mirror creation for ${targetRepoName}`);
    }

+    // Prepare migration payload
+    // For private repos, use separate auth fields instead of embedding credentials in URL
+    // This is required for Forgejo 12+ which rejects URLs with embedded credentials
+    // Skip wiki for starred repos if starredCodeOnly is enabled
+    const shouldMirrorWiki = config.giteaConfig?.wiki &&
+      !(repository.isStarred && config.githubConfig?.starredCodeOnly);
+
+    const migratePayload: any = {
+      clone_addr: cloneAddress,
+      repo_name: targetRepoName,
+      mirror: true,
+      mirror_interval: config.giteaConfig?.mirrorInterval || "8h",
+      wiki: shouldMirrorWiki || false,
+      lfs: config.giteaConfig?.lfs || false,
+      private: repository.isPrivate,
+      repo_owner: repoOwner,
+      description: "",
+      service: "git",
+    };
+
+    // Add authentication for private repositories
+    if (repository.isPrivate) {
+      if (!config.githubConfig.token) {
+        throw new Error(
+          "GitHub token is required to mirror private repositories."
+        );
+      }
+      // Use separate auth fields (required for Forgejo 12+ compatibility)
+      migratePayload.auth_username = "oauth2"; // GitHub tokens work with any username
+      migratePayload.auth_token = decryptedConfig.githubConfig.token;
+    }
+
    const response = await httpPost(
      apiUrl,
-      {
-        clone_addr: cloneAddress,
-        repo_name: targetRepoName,
-        mirror: true,
-        mirror_interval: config.giteaConfig?.mirrorInterval || "8h", // Set mirror interval
-        wiki: config.giteaConfig?.wiki || false, // will mirror wiki if it exists
-        lfs: config.giteaConfig?.lfs || false, // Enable LFS mirroring if configured
-        private: repository.isPrivate,
-        repo_owner: repoOwner,
-        description: "",
-        service: "git",
-      },
+      migratePayload,
      {
        Authorization: `token ${decryptedConfig.giteaConfig.token}`,
      }
    );

    //mirror releases
-    console.log(`[Metadata] Release mirroring check: mirrorReleases=${config.giteaConfig?.mirrorReleases}`);
-    if (config.giteaConfig?.mirrorReleases) {
+    // Skip releases for starred repos if starredCodeOnly is enabled
+    const shouldMirrorReleases = config.giteaConfig?.mirrorReleases &&
+      !(repository.isStarred && config.githubConfig?.starredCodeOnly);
+
+    console.log(`[Metadata] Release mirroring check: mirrorReleases=${config.giteaConfig?.mirrorReleases}, isStarred=${repository.isStarred}, starredCodeOnly=${config.githubConfig?.starredCodeOnly}, shouldMirrorReleases=${shouldMirrorReleases}`);
+
+    if (shouldMirrorReleases) {
      try {
        await mirrorGitHubReleasesToGitea({
          config,
@@ -471,11 +610,11 @@ export const mirrorGithubRepoToGitea = async ({
    }

    // clone issues
-    // Skip issues for starred repos if skipStarredIssues is enabled
+    // Skip issues for starred repos if starredCodeOnly is enabled
    const shouldMirrorIssues = config.giteaConfig?.mirrorIssues && 
-      !(repository.isStarred && config.githubConfig?.skipStarredIssues);
+      !(repository.isStarred && config.githubConfig?.starredCodeOnly);
    
-    console.log(`[Metadata] Issue mirroring check: mirrorIssues=${config.giteaConfig?.mirrorIssues}, isStarred=${repository.isStarred}, skipStarredIssues=${config.githubConfig?.skipStarredIssues}, shouldMirrorIssues=${shouldMirrorIssues}`);
+    console.log(`[Metadata] Issue mirroring check: mirrorIssues=${config.giteaConfig?.mirrorIssues}, isStarred=${repository.isStarred}, starredCodeOnly=${config.githubConfig?.starredCodeOnly}, shouldMirrorIssues=${shouldMirrorIssues}`);
    
    if (shouldMirrorIssues) {
      try {
@@ -494,8 +633,13 @@ export const mirrorGithubRepoToGitea = async ({
    }

    // Mirror pull requests if enabled
-    console.log(`[Metadata] Pull request mirroring check: mirrorPullRequests=${config.giteaConfig?.mirrorPullRequests}`);
-    if (config.giteaConfig?.mirrorPullRequests) {
+    // Skip pull requests for starred repos if starredCodeOnly is enabled
+    const shouldMirrorPullRequests = config.giteaConfig?.mirrorPullRequests &&
+      !(repository.isStarred && config.githubConfig?.starredCodeOnly);
+
+    console.log(`[Metadata] Pull request mirroring check: mirrorPullRequests=${config.giteaConfig?.mirrorPullRequests}, isStarred=${repository.isStarred}, starredCodeOnly=${config.githubConfig?.starredCodeOnly}, shouldMirrorPullRequests=${shouldMirrorPullRequests}`);
+
+    if (shouldMirrorPullRequests) {
      try {
        await mirrorGitRepoPullRequestsToGitea({
          config,
@@ -512,8 +656,13 @@ export const mirrorGithubRepoToGitea = async ({
    }

    // Mirror labels if enabled (and not already done via issues)
-    console.log(`[Metadata] Label mirroring check: mirrorLabels=${config.giteaConfig?.mirrorLabels}, shouldMirrorIssues=${shouldMirrorIssues}`);
-    if (config.giteaConfig?.mirrorLabels && !shouldMirrorIssues) {
+    // Skip labels for starred repos if starredCodeOnly is enabled
+    const shouldMirrorLabels = config.giteaConfig?.mirrorLabels && !shouldMirrorIssues &&
+      !(repository.isStarred && config.githubConfig?.starredCodeOnly);
+
+    console.log(`[Metadata] Label mirroring check: mirrorLabels=${config.giteaConfig?.mirrorLabels}, shouldMirrorIssues=${shouldMirrorIssues}, isStarred=${repository.isStarred}, starredCodeOnly=${config.githubConfig?.starredCodeOnly}, shouldMirrorLabels=${shouldMirrorLabels}`);
+
+    if (shouldMirrorLabels) {
      try {
        await mirrorGitRepoLabelsToGitea({
          config,
@@ -530,8 +679,13 @@ export const mirrorGithubRepoToGitea = async ({
    }

    // Mirror milestones if enabled
-    console.log(`[Metadata] Milestone mirroring check: mirrorMilestones=${config.giteaConfig?.mirrorMilestones}`);
-    if (config.giteaConfig?.mirrorMilestones) {
+    // Skip milestones for starred repos if starredCodeOnly is enabled
+    const shouldMirrorMilestones = config.giteaConfig?.mirrorMilestones &&
+      !(repository.isStarred && config.githubConfig?.starredCodeOnly);
+
+    console.log(`[Metadata] Milestone mirroring check: mirrorMilestones=${config.giteaConfig?.mirrorMilestones}, isStarred=${repository.isStarred}, starredCodeOnly=${config.githubConfig?.starredCodeOnly}, shouldMirrorMilestones=${shouldMirrorMilestones}`);
+
+    if (shouldMirrorMilestones) {
      try {
        await mirrorGitRepoMilestonesToGitea({
          config,
@@ -653,32 +807,32 @@ async function generateUniqueRepoName({
  strategy?: string;
 }): Promise<string> {
  const duplicateStrategy = strategy || "suffix";
-  
+
  // First check if base name is available
  const baseExists = await isRepoPresentInGitea({
    config,
    owner: orgName,
    repoName: baseName,
  });
-  
+
  if (!baseExists) {
    return baseName;
  }
-  
+
  // Generate name based on strategy
  let candidateName: string;
  let attempt = 0;
  const maxAttempts = 10;
-  
+
  while (attempt < maxAttempts) {
    switch (duplicateStrategy) {
      case "prefix":
        // Prefix with owner: owner-reponame
-        candidateName = attempt === 0 
+        candidateName = attempt === 0
          ? `${githubOwner}-${baseName}`
          : `${githubOwner}-${baseName}-${attempt}`;
        break;
-        
+
      case "owner-org":
        // This would require creating sub-organizations, not supported in this PR
        // Fall back to suffix strategy
@@ -690,24 +844,31 @@ async function generateUniqueRepoName({
          : `${baseName}-${githubOwner}-${attempt}`;
        break;
    }
-    
+
    const exists = await isRepoPresentInGitea({
      config,
      owner: orgName,
      repoName: candidateName,
    });
-    
+
    if (!exists) {
      console.log(`Found unique name for duplicate starred repo: ${candidateName}`);
      return candidateName;
    }
-    
+
    attempt++;
  }
-  
-  // If all attempts failed, use timestamp as last resort
-  const timestamp = Date.now();
-  return `${baseName}-${githubOwner}-${timestamp}`;
+
+  // SECURITY FIX: Prevent infinite duplicate creation
+  // Instead of falling back to timestamp (which creates infinite duplicates),
+  // throw an error to prevent hundreds of duplicate repos
+  console.error(`Failed to find unique name for ${baseName} after ${maxAttempts} attempts`);
+  console.error(`Organization: ${orgName}, GitHub Owner: ${githubOwner}, Strategy: ${duplicateStrategy}`);
+  throw new Error(
+    `Unable to generate unique repository name for "${baseName}". ` +
+    `All ${maxAttempts} naming attempts resulted in conflicts. ` +
+    `Please manually resolve the naming conflict or adjust your duplicate strategy.`
+  );
 }

 export async function mirrorGitHubRepoToGiteaOrg({
@@ -737,11 +898,11 @@ export async function mirrorGitHubRepoToGiteaOrg({

    // Determine the actual repository name to use (handle duplicates for starred repos)
    let targetRepoName = repository.name;
-    
+
    if (repository.isStarred && config.githubConfig) {
      // Extract GitHub owner from full_name (format: owner/repo)
      const githubOwner = repository.fullName.split('/')[0];
-      
+
      targetRepoName = await generateUniqueRepoName({
        config,
        orgName,
@@ -749,7 +910,7 @@ export async function mirrorGitHubRepoToGiteaOrg({
        githubOwner,
        strategy: config.githubConfig.starredDuplicateStrategy,
      });
-      
+
      if (targetRepoName !== repository.name) {
        console.log(
          `Starred repo ${repository.fullName} will be mirrored as ${orgName}/${targetRepoName} to avoid naming conflict`
@@ -757,6 +918,23 @@ export async function mirrorGitHubRepoToGiteaOrg({
      }
    }

+    // IDEMPOTENCY CHECK: Check if this repo is already being mirrored
+    const expectedLocation = `${orgName}/${targetRepoName}`;
+    const isCurrentlyMirroring = await isRepoCurrentlyMirroring({
+      config,
+      repoName: targetRepoName,
+      expectedLocation,
+    });
+
+    if (isCurrentlyMirroring) {
+      console.log(
+        `[Idempotency] Skipping ${repository.fullName} - already being mirrored to ${expectedLocation}`
+      );
+
+      // Don't throw an error, just return to allow other repos to continue
+      return;
+    }
+
    const isExisting = await isRepoPresentInGitea({
      config,
      owner: orgName,
@@ -800,26 +978,33 @@ export async function mirrorGitHubRepoToGiteaOrg({
      `Mirroring repository ${repository.fullName} to organization ${orgName} as ${targetRepoName}`
    );

-    let cloneAddress = repository.cloneUrl;
+    // Use clean clone URL without embedded credentials (Forgejo 12+ security requirement)
+    const cloneAddress = repository.cloneUrl;

-    if (repository.isPrivate) {
-      if (!config.githubConfig?.token) {
-        throw new Error(
-          "GitHub token is required to mirror private repositories."
-        );
-      }
+    // DOUBLE-CHECK: Final idempotency check right before updating status
+    // This catches race conditions in the small window between first check and status update
+    const finalCheck = await isRepoCurrentlyMirroring({
+      config,
+      repoName: targetRepoName,
+      expectedLocation,
+    });

-      cloneAddress = repository.cloneUrl.replace(
-        "https://",
-        `https://${decryptedConfig.githubConfig.token}@`
+    if (finalCheck) {
+      console.log(
+        `[Idempotency] Race condition detected - ${repository.fullName} is now being mirrored by another process. Skipping.`
      );
+      return;
    }

    // Mark repos as "mirroring" in DB
+    // CRITICAL: Set mirroredLocation NOW (not after success) so idempotency checks work
+    // This becomes the "target location" - where we intend to mirror to
+    // Without this, the idempotency check can't detect concurrent operations on first mirror
    await db
      .update(repositories)
      .set({
        status: repoStatusEnum.parse("mirroring"),
+        mirroredLocation: expectedLocation,
        updatedAt: new Date(),
      })
      .where(eq(repositories.id, repository.id!));
@@ -829,26 +1014,52 @@ export async function mirrorGitHubRepoToGiteaOrg({

    const apiUrl = `${config.giteaConfig.url}/api/v1/repos/migrate`;

+    // Prepare migration payload
+    // For private repos, use separate auth fields instead of embedding credentials in URL
+    // This is required for Forgejo 12+ which rejects URLs with embedded credentials
+    // Skip wiki for starred repos if starredCodeOnly is enabled
+    const shouldMirrorWiki = config.giteaConfig?.wiki &&
+      !(repository.isStarred && config.githubConfig?.starredCodeOnly);
+
+    const migratePayload: any = {
+      clone_addr: cloneAddress,
+      uid: giteaOrgId,
+      repo_name: targetRepoName,
+      mirror: true,
+      mirror_interval: config.giteaConfig?.mirrorInterval || "8h",
+      wiki: shouldMirrorWiki || false,
+      lfs: config.giteaConfig?.lfs || false,
+      private: repository.isPrivate,
+    };
+
+    // Add authentication for private repositories
+    if (repository.isPrivate) {
+      if (!config.githubConfig?.token) {
+        throw new Error(
+          "GitHub token is required to mirror private repositories."
+        );
+      }
+      // Use separate auth fields (required for Forgejo 12+ compatibility)
+      migratePayload.auth_username = "oauth2"; // GitHub tokens work with any username
+      migratePayload.auth_token = decryptedConfig.githubConfig.token;
+    }
+
    const migrateRes = await httpPost(
      apiUrl,
-      {
-        clone_addr: cloneAddress,
-        uid: giteaOrgId,
-        repo_name: targetRepoName,
-        mirror: true,
-        mirror_interval: config.giteaConfig?.mirrorInterval || "8h", // Set mirror interval
-        wiki: config.giteaConfig?.wiki || false, // will mirror wiki if it exists
-        lfs: config.giteaConfig?.lfs || false, // Enable LFS mirroring if configured
-        private: repository.isPrivate,
-      },
+      migratePayload,
      {
        Authorization: `token ${decryptedConfig.giteaConfig.token}`,
      }
    );

    //mirror releases
-    console.log(`[Metadata] Release mirroring check: mirrorReleases=${config.giteaConfig?.mirrorReleases}`);
-    if (config.giteaConfig?.mirrorReleases) {
+    // Skip releases for starred repos if starredCodeOnly is enabled
+    const shouldMirrorReleases = config.giteaConfig?.mirrorReleases &&
+      !(repository.isStarred && config.githubConfig?.starredCodeOnly);
+
+    console.log(`[Metadata] Release mirroring check: mirrorReleases=${config.giteaConfig?.mirrorReleases}, isStarred=${repository.isStarred}, starredCodeOnly=${config.githubConfig?.starredCodeOnly}, shouldMirrorReleases=${shouldMirrorReleases}`);
+
+    if (shouldMirrorReleases) {
      try {
        await mirrorGitHubReleasesToGitea({
          config,
@@ -865,11 +1076,11 @@ export async function mirrorGitHubRepoToGiteaOrg({
    }

    // Clone issues
-    // Skip issues for starred repos if skipStarredIssues is enabled
+    // Skip issues for starred repos if starredCodeOnly is enabled
    const shouldMirrorIssues = config.giteaConfig?.mirrorIssues && 
-      !(repository.isStarred && config.githubConfig?.skipStarredIssues);
+      !(repository.isStarred && config.githubConfig?.starredCodeOnly);
    
-    console.log(`[Metadata] Issue mirroring check: mirrorIssues=${config.giteaConfig?.mirrorIssues}, isStarred=${repository.isStarred}, skipStarredIssues=${config.githubConfig?.skipStarredIssues}, shouldMirrorIssues=${shouldMirrorIssues}`);
+    console.log(`[Metadata] Issue mirroring check: mirrorIssues=${config.giteaConfig?.mirrorIssues}, isStarred=${repository.isStarred}, starredCodeOnly=${config.githubConfig?.starredCodeOnly}, shouldMirrorIssues=${shouldMirrorIssues}`);
    
    if (shouldMirrorIssues) {
      try {
@@ -888,8 +1099,13 @@ export async function mirrorGitHubRepoToGiteaOrg({
    }

    // Mirror pull requests if enabled
-    console.log(`[Metadata] Pull request mirroring check: mirrorPullRequests=${config.giteaConfig?.mirrorPullRequests}`);
-    if (config.giteaConfig?.mirrorPullRequests) {
+    // Skip pull requests for starred repos if starredCodeOnly is enabled
+    const shouldMirrorPullRequests = config.giteaConfig?.mirrorPullRequests &&
+      !(repository.isStarred && config.githubConfig?.starredCodeOnly);
+
+    console.log(`[Metadata] Pull request mirroring check: mirrorPullRequests=${config.giteaConfig?.mirrorPullRequests}, isStarred=${repository.isStarred}, starredCodeOnly=${config.githubConfig?.starredCodeOnly}, shouldMirrorPullRequests=${shouldMirrorPullRequests}`);
+
+    if (shouldMirrorPullRequests) {
      try {
        await mirrorGitRepoPullRequestsToGitea({
          config,
@@ -906,8 +1122,13 @@ export async function mirrorGitHubRepoToGiteaOrg({
    }

    // Mirror labels if enabled (and not already done via issues)
-    console.log(`[Metadata] Label mirroring check: mirrorLabels=${config.giteaConfig?.mirrorLabels}, shouldMirrorIssues=${shouldMirrorIssues}`);
-    if (config.giteaConfig?.mirrorLabels && !shouldMirrorIssues) {
+    // Skip labels for starred repos if starredCodeOnly is enabled
+    const shouldMirrorLabels = config.giteaConfig?.mirrorLabels && !shouldMirrorIssues &&
+      !(repository.isStarred && config.githubConfig?.starredCodeOnly);
+
+    console.log(`[Metadata] Label mirroring check: mirrorLabels=${config.giteaConfig?.mirrorLabels}, shouldMirrorIssues=${shouldMirrorIssues}, isStarred=${repository.isStarred}, starredCodeOnly=${config.githubConfig?.starredCodeOnly}, shouldMirrorLabels=${shouldMirrorLabels}`);
+
+    if (shouldMirrorLabels) {
      try {
        await mirrorGitRepoLabelsToGitea({
          config,
@@ -924,8 +1145,13 @@ export async function mirrorGitHubRepoToGiteaOrg({
    }

    // Mirror milestones if enabled
-    console.log(`[Metadata] Milestone mirroring check: mirrorMilestones=${config.giteaConfig?.mirrorMilestones}`);
-    if (config.giteaConfig?.mirrorMilestones) {
+    // Skip milestones for starred repos if starredCodeOnly is enabled
+    const shouldMirrorMilestones = config.giteaConfig?.mirrorMilestones &&
+      !(repository.isStarred && config.githubConfig?.starredCodeOnly);
+
+    console.log(`[Metadata] Milestone mirroring check: mirrorMilestones=${config.giteaConfig?.mirrorMilestones}, isStarred=${repository.isStarred}, starredCodeOnly=${config.githubConfig?.starredCodeOnly}, shouldMirrorMilestones=${shouldMirrorMilestones}`);
+
+    if (shouldMirrorMilestones) {
      try {
        await mirrorGitRepoMilestonesToGitea({
          config,
--- a/src/lib/utils/config-mapper.ts
+++ b/src/lib/utils/config-mapper.ts
@@ -54,7 +54,7 @@ export function mapUiToDbConfig(
    defaultOrg: giteaConfig.organization,
    
    // Advanced options
-    skipStarredIssues: advancedOptions.skipStarredIssues,
+    starredCodeOnly: advancedOptions.starredCodeOnly,
  };

  // Map Gitea config to match database schema
@@ -152,7 +152,8 @@ export function mapDbToUiConfig(dbConfig: any): {
  // Map advanced options
  const advancedOptions: AdvancedOptions = {
    skipForks: !(dbConfig.githubConfig?.includeForks ?? true), // Invert includeForks to get skipForks
-    skipStarredIssues: dbConfig.githubConfig?.skipStarredIssues || false,
+    // Support both old (skipStarredIssues) and new (starredCodeOnly) field names for backward compatibility
+    starredCodeOnly: dbConfig.githubConfig?.starredCodeOnly ?? (dbConfig.githubConfig as any)?.skipStarredIssues ?? false,
  };

  return {
--- a/src/types/config.ts
+++ b/src/types/config.ts
@@ -55,7 +55,7 @@ export interface MirrorOptions {

 export interface AdvancedOptions {
  skipForks: boolean;
-  skipStarredIssues: boolean;
+  starredCodeOnly: boolean;
 }

 export interface SaveConfigApiRequest {
--- a/src/types/organizations.ts
+++ b/src/types/organizations.ts
@@ -5,6 +5,7 @@ import type { RepoStatus } from "./Repository";
 export const membershipRoleEnum = z.enum([
  "member",
  "admin",
+  "owner",
  "billing_manager",
 ]);

--- a/www/package.json
+++ b/www/package.json
@@ -9,28 +9,28 @@
    "astro": "astro"
  },
  "dependencies": {
-    "@astrojs/mdx": "^4.3.4",
-    "@astrojs/react": "^4.3.0",
+    "@astrojs/mdx": "^4.3.6",
+    "@astrojs/react": "^4.4.0",
    "@radix-ui/react-icons": "^1.3.2",
    "@radix-ui/react-slot": "^1.2.3",
    "@splinetool/react-spline": "^4.1.0",
-    "@splinetool/runtime": "^1.10.52",
-    "@tailwindcss/vite": "^4.1.12",
+    "@splinetool/runtime": "^1.10.73",
+    "@tailwindcss/vite": "^4.1.14",
    "@types/canvas-confetti": "^1.9.0",
-    "@types/react": "^19.1.12",
-    "@types/react-dom": "^19.1.9",
-    "astro": "^5.13.4",
+    "@types/react": "^19.2.0",
+    "@types/react-dom": "^19.2.0",
+    "astro": "^5.14.3",
    "canvas-confetti": "^1.9.3",
    "class-variance-authority": "^0.7.1",
    "clsx": "^2.1.1",
-    "lucide-react": "^0.542.0",
-    "react": "^19.1.1",
-    "react-dom": "^19.1.1",
+    "lucide-react": "^0.544.0",
+    "react": "^19.2.0",
+    "react-dom": "^19.2.0",
    "tailwind-merge": "^3.3.1",
-    "tailwindcss": "^4.1.12"
+    "tailwindcss": "^4.1.14"
  },
  "devDependencies": {
-    "tw-animate-css": "^1.3.7"
+    "tw-animate-css": "^1.4.0"
  },
-  "packageManager": "pnpm@10.15.0"
+  "packageManager": "pnpm@10.18.0"
 }
--- a/www/pnpm-lock.yaml
+++ b/www/pnpm-lock.yaml
Author	SHA1	Message	Date
Arunavo Ray	3b53a29e71	v3.8.4	2025-10-22 09:07:02 +05:30
ARUNAVO RAY	64e73f9ca8	Merge pull request #120 from RayLabsHQ/fix-org-destination-override fix: Custom organization mirror destination issue	2025-10-22 09:06:13 +05:30
Arunavo Ray	7d23894e5f	fix: Custom organization mirror destination issue	2025-10-22 09:03:27 +05:30
ARUNAVO RAY	8f2a4683c1	Merge pull request #119 from RayLabsHQ/fix/duplicate-repos-issue-115 Fix/duplicate repos issue 115	2025-10-22 08:59:07 +05:30
Arunavo Ray	b5323ff8b4	chore: remove duplicate fix summary	2025-10-22 08:44:22 +05:30
Arunavo Ray	7fee2adb51	lib: harden mirror idempotency	2025-10-22 08:43:38 +05:30
ARUNAVO RAY	af139ecb2d	Merge pull request #114 from RayLabsHQ/dependabot/npm_and_yarn/www/npm_and_yarn-82a5d800d0 Bump astro from 5.14.1 to 5.14.3 in /www in the npm_and_yarn group across 1 directory	2025-10-11 11:40:53 +05:30
dependabot[bot]	fb827724b6	Bump astro in /www in the npm_and_yarn group across 1 directory Bumps the npm_and_yarn group with 1 update in the /www directory: [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro). Updates `astro` from 5.14.1 to 5.14.3 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/astro@5.14.3/packages/astro) --- updated-dependencies: - dependency-name: astro dependency-version: 5.14.3 dependency-type: direct:production dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>	2025-10-11 00:40:10 +00:00
ARUNAVO RAY	2812b576d0	Merge pull request #112 from V-Paranoiaque/fix-custom-image-tag Fix when using a custom tag	2025-10-05 18:22:47 +05:30
Virgil R.	347188f43d	Fix when using a custom tag	2025-10-04 14:52:42 +02:00
Arunavo Ray	56bee451de	[www] : updated packages	2025-10-03 09:53:33 +05:30
Arunavo Ray	0e9d54b517	fix: add backward compatibility for skipStarredIssues field Since githubConfig is stored as JSON in the database (not individual columns), no database migration is needed. However, we need to handle reading old configs that still use the 'skipStarredIssues' field name. Changes: - Added skipStarredIssues as optional field in Zod schema (marked deprecated) - Updated config mapper to check both starredCodeOnly and skipStarredIssues - Old configs will continue to work seamlessly - New configs will use starredCodeOnly field name This ensures zero-downtime upgrades for existing installations. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>	2025-10-03 09:44:38 +05:30
Arunavo Ray	7a04665b70	v3.8.3	2025-10-03 09:24:28 +05:30
Arunavo Ray	3a3ff314e0	refactor: rename skipStarredIssues to starredCodeOnly The previous name 'skipStarredIssues' was misleading as it now skips ALL metadata (not just issues) for starred repositories. The new name 'starredCodeOnly' better reflects the actual behavior - mirroring only source code for starred repos. Changes: - Renamed skipStarredIssues → starredCodeOnly in all files - Updated UI label from "Don't fetch issues" to "Code-only mode" - Updated description to clarify it skips ALL metadata types: issues, PRs, labels, milestones, wiki, and releases - Updated database schema, types, config mapper, and all components - Updated Helm charts, CI configs, and documentation 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>	2025-10-03 09:22:18 +05:30
Arunavo Ray	fed74ee901	fix: apply skipStarredIssues flag to releases mirroring Extended the skipStarredIssues flag to also skip releases for starred repos when "code-only" mode is enabled. Previously, releases were still being mirrored even when lightweight mode was selected. Now starred repos with "code-only" mode will skip: - Issues ✓ - Pull requests ✓ - Labels ✓ - Milestones ✓ - Wiki ✓ - Releases ✓ (this fix) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>	2025-10-03 09:18:35 +05:30
Arunavo Ray	85ea502276	fix: apply skipStarredIssues flag to all metadata types Previously, the skipStarredIssues flag (Lightweight mode for starred repos) only applied to issues. This caused starred repos to mirror all metadata (pull requests, labels, milestones, wiki) even when "code-only" was selected. Fixed by applying the skipStarredIssues check to: - Pull requests mirroring - Labels mirroring - Milestones mirroring - Wiki mirroring (in migration payload) Now starred repos with "code-only" mode truly mirror only source code, skipping all metadata as intended. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>	2025-10-03 09:13:58 +05:30
Arunavo Ray	ffb7bd3cb0	v3.8.2	2025-10-02 21:19:32 +05:30
ARUNAVO RAY	b39d7a2179	Merge pull request #107 from RayLabsHQ/fix/issue-97-migration-duplicates fix: resolve migration 0005 duplicate constraint failure (#97)	2025-10-02 07:45:42 +05:30
Arunavo Ray	bf99a95dc6	ci: add more paths to trigger Docker builds - Added docker-entrypoint.sh to trigger paths - Added drizzle/ for database migrations - Added scripts/ for database management scripts - Added src/** for source code changes This ensures Docker images are rebuilt when critical runtime files change, not just package dependencies.	2025-10-01 08:02:56 +05:30
Arunavo Ray	2ea917fdaa	fix: resolve migration 0005 duplicate constraint failure (#97 ) Problem: - Users upgrading to v3.7.2 encountered database migration failures - Migration 0005 tried to add unique index without handling existing duplicates - Hybrid initialization (manual SQL + Drizzle) caused schema inconsistencies - Error: "UNIQUE constraint failed: repositories.user_id, repositories.full_name" Solution: 1. Fixed Migration 0005: - Added deduplication step before creating unique index - Removes duplicate (user_id, full_name) entries, keeping most recent - Safely creates unique constraint after cleanup 2. Removed Hybrid Database Initialization: - Eliminated 154 lines of manual SQL from docker-entrypoint.sh - Now uses Drizzle exclusively for schema management - Single source of truth prevents schema drift - Migrations run automatically via src/lib/db/index.ts Testing: - ✅ Fresh database initialization works - ✅ Duplicate deduplication verified - ✅ Unique constraint properly enforced - ✅ All 6 migrations apply cleanly Changes: - docker-entrypoint.sh: Removed manual table creation SQL - drizzle/0005_polite_preak.sql: Added deduplication before index creation Fixes #97	2025-10-01 07:57:16 +05:30
Arunavo Ray	b841057f1a	updated packages	2025-10-01 07:29:39 +05:30
ARUNAVO RAY	d588ce91b4	Merge pull request #106 from RayLabsHQ/alert-autofix-33 Potential fix for code scanning alert no. 33: Workflow does not contain permissions	2025-10-01 07:06:58 +05:30
ARUNAVO RAY	553396483e	Potential fix for code scanning alert no. 33: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>	2025-10-01 07:06:06 +05:30
ARUNAVO RAY	ebeabdb4fc	Merge pull request #105 from RayLabsHQ/fix/forgejo-12-private-repos fix: Forgejo 12 compatibility - use separate auth fields for private repos (#102)	2025-10-01 07:02:30 +05:30
ARUNAVO RAY	ff209a6376	Merge pull request #101 from V-Paranoiaque/helm-chart Helm chart to deploy on Kubernetes	2025-10-01 07:01:19 +05:30
Arunavo Ray	096e0c03ac	images now tagged lowercase in comments	2025-09-30 23:43:27 +05:30
Virgil R.	63f20a7f04	Update helm-test.yml	2025-09-30 20:07:48 +02:00
Arunavo Ray	34f741beef	fix: Forgejo 12 compatibility - use separate auth fields for private repos (#102 ) ## Problem Forgejo 12.0+ rejects migration API calls with credentials embedded in URLs, causing HTTP 422 errors when mirroring private GitHub repositories. ## Root Cause Breaking security change in Forgejo 12.0 (July 2025) enforces credential separation to prevent accidental exposure in logs/errors. Previous versions (Forgejo 11.x, Gitea 1.x) accepted embedded credentials. ## Solution - Use separate `auth_username` and `auth_token` fields instead of embedding credentials in clone URLs - Set `auth_username` to "oauth2" for GitHub token authentication - Pass GitHub token via `auth_token` field ## Changes - src/lib/gitea.ts: - mirrorGithubRepoToGitea(): Use separate auth fields for private repos - mirrorGitHubRepoToGiteaOrg(): Use separate auth fields for private repos - .github/workflows/docker-build.yml: - Enable PR image building and pushing to GHCR - Tag PR images as pr-<number> for easy testing - Add automated PR comment with image details and testing instructions - Separate load step for security scanning ## Backward Compatibility ✅ Works with Forgejo 12.0+ ✅ Works with Forgejo 11.x and earlier ✅ Works with Gitea 1.x ## Testing Public repos: ✅ Working (no auth needed) Private repos: ✅ Fixed (separate auth fields) Fixes #102	2025-09-30 23:12:33 +05:30
V-Paranoiaque	1f98f441f3	Fix ingress + improve testing	2025-09-27 18:28:10 +02:00
V-Paranoiaque	9c1ac76ff9	Fix annotations	2025-09-27 15:18:52 +02:00
V-Paranoiaque	cf5027bafc	Fix CLEANUP_RETENTION_DAYS	2025-09-27 15:15:42 +02:00
V-Paranoiaque	6fd2774d43	Fix MIRROR_STARRED var	2025-09-27 15:13:54 +02:00
V-Paranoiaque	8f379baad4	Improve CI/CD	2025-09-27 10:34:20 +02:00
V-Paranoiaque	91fa3604b6	Add some basic CICD for testing	2025-09-27 10:24:18 +02:00
Virgil R.	c0fff30fcb	Create README.md	2025-09-27 10:12:29 +02:00
Virgil R.	18de63d192	Update deployment.yaml	2025-09-27 10:04:42 +02:00
V-Paranoiaque	1fe20c3e54	GITHUB_TYPE env var	2025-09-24 22:07:15 +02:00
V-Paranoiaque	7386b54a46	Fix env vars	2025-09-24 21:12:16 +02:00
V-Paranoiaque	432a2bc54d	Add missing podSecurityContext	2025-09-24 20:47:54 +02:00
V-Paranoiaque	f9d18f34ab	Fix image tag	2025-09-24 20:41:24 +02:00
V-Paranoiaque	cd86a09bbd	Minor fixes	2025-09-24 20:29:14 +02:00
V-Paranoiaque	1e2c1c686d	Add volumes	2025-09-21 21:15:50 +02:00
V-Paranoiaque	f701574e67	Move NODE_ENV to the configmap	2025-09-21 15:15:58 +02:00
V-Paranoiaque	4528be8cc6	Too many spaces	2025-09-21 12:29:02 +02:00
V-Paranoiaque	80fd43ef42	More features	2025-09-21 12:26:26 +02:00
V-Paranoiaque	3c52fe58aa	Missing space	2025-09-21 10:23:48 +02:00
V-Paranoiaque	319e7925ff	First commit TBT	2025-09-20 22:59:22 +02:00