chore: bump version to 3.19.0

Handle indexing when shift + clicking in the repository table (#316 )
chore: bump version to 3.18.0
2026-10-31 06:31:58 +01:00 · 2026-06-13 09:14:33 +05:30 · 2026-06-13 09:14:02 +05:30 · 2026-06-13 08:17:20 +05:30 · 2026-06-13 08:00:50 +05:30 · 2026-06-13 08:00:47 +05:30
52 changed files with 8470 additions and 867 deletions
@@ -21,6 +21,9 @@ DATABASE_URL=sqlite://data/gitea-mirror.db
 BETTER_AUTH_SECRET=change-this-to-a-secure-random-string-in-production
 BETTER_AUTH_URL=http://localhost:4321
 # ENCRYPTION_SECRET=optional-encryption-key-for-token-encryption # Generate with: openssl rand -base64 48
+# Better Auth log verbosity: debug | info | warn | error (default: warn).
+# Set to "debug" to trace SSO/OIDC sign-in and callback issues.
+# BETTER_AUTH_LOG_LEVEL=debug

 # ===========================================
 # REVERSE PROXY CONFIGURATION
@@ -60,7 +63,7 @@ PUBLIC_BETTER_AUTH_URL=http://localhost:4321

 # Docker Registry Configuration
 DOCKER_REGISTRY=ghcr.io
-DOCKER_IMAGE=raylabshq/gitea-mirror:
+DOCKER_IMAGE=raylabshq/gitea-mirror
 DOCKER_TAG=latest

 # ===========================================
@@ -88,6 +88,24 @@ jobs:

      - name: Start Gitea and git-server containers
        run: |
+          # Retry pulls before `up` — Docker Hub occasionally returns
+          # "context deadline exceeded" on the first attempt. Pulling
+          # separately also keeps the failure mode obvious if it persists.
+          echo "Pulling images..."
+          for attempt in 1 2 3; do
+            if docker compose -f tests/e2e/docker-compose.e2e.yml pull --quiet; then
+              echo "✓ Images pulled (attempt $attempt)"
+              break
+            fi
+            if [ "$attempt" -eq 3 ]; then
+              echo "ERROR: docker compose pull failed after 3 attempts"
+              exit 1
+            fi
+            sleep_s=$((attempt * 10))
+            echo "Pull attempt $attempt failed, retrying in ${sleep_s}s..."
+            sleep "$sleep_s"
+          done
+
          echo "Starting containers via docker compose..."
          docker compose -f tests/e2e/docker-compose.e2e.yml up -d

@@ -52,3 +52,4 @@ tests/e2e/git-repos/
 /blob-report/
 /playwright/.cache/
 /playwright/.auth/
+.playwright-mcp/
@@ -9,7 +9,8 @@
        "@astrojs/mdx": "5.0.0",
        "@astrojs/node": "10.0.1",
        "@astrojs/react": "^5.0.0",
-        "@better-auth/sso": "1.5.5",
+        "@better-auth/oauth-provider": "1.6.11",
+        "@better-auth/sso": "1.6.11",
        "@octokit/plugin-throttling": "^11.0.3",
        "@octokit/rest": "^22.0.1",
        "@radix-ui/react-accordion": "^1.2.12",
@@ -38,7 +39,7 @@
        "@types/react-dom": "^19.2.3",
        "astro": "^6.0.4",
        "bcryptjs": "^3.0.3",
-        "better-auth": "1.5.5",
+        "better-auth": "1.6.11",
        "buffer": "^6.0.3",
        "canvas-confetti": "^1.9.4",
        "class-variance-authority": "^0.7.1",
@@ -165,23 +166,25 @@

    "@babel/types": ["@babel/types@7.29.0", "", { "dependencies": { "@babel/helper-string-parser": "^7.27.1", "@babel/helper-validator-identifier": "^7.28.5" } }, "sha512-LwdZHpScM4Qz8Xw2iKSzS+cfglZzJGvofQICy7W7v4caru4EaAmyUuO6BGrbyQ2mYV11W0U8j5mBhd14dd3B0A=="],

-    "@better-auth/core": ["@better-auth/core@1.5.5", "", { "dependencies": { "@standard-schema/spec": "^1.1.0", "zod": "^4.3.6" }, "peerDependencies": { "@better-auth/utils": "0.3.1", "@better-fetch/fetch": "1.1.21", "@cloudflare/workers-types": ">=4", "better-call": "1.3.2", "jose": "^6.1.0", "kysely": "^0.28.5", "nanostores": "^1.0.1" }, "optionalPeers": ["@cloudflare/workers-types"] }, "sha512-1oR/2jAp821Dcf67kQYHUoyNcdc1TcShfw4QMK0YTVntuRES5mUOyvEJql5T6eIuLfaqaN4LOF78l0FtF66HXA=="],
+    "@better-auth/core": ["@better-auth/core@1.6.11", "", { "dependencies": { "@opentelemetry/semantic-conventions": "^1.39.0", "@standard-schema/spec": "^1.1.0", "zod": "^4.3.6" }, "peerDependencies": { "@better-auth/utils": "0.4.0", "@better-fetch/fetch": "1.1.21", "@cloudflare/workers-types": ">=4", "@opentelemetry/api": "^1.9.0", "better-call": "1.3.5", "jose": "^6.1.0", "kysely": "^0.28.5", "nanostores": "^1.0.1" }, "optionalPeers": ["@cloudflare/workers-types", "@opentelemetry/api"] }, "sha512-LrwidLCV8azdMGjvtwp30nj9tIv1BwI3VhtC0UaGSjQkAVWw4bN42I8qwbxRziPeSQoj+zUVkOpxZzAWBDARtQ=="],

-    "@better-auth/drizzle-adapter": ["@better-auth/drizzle-adapter@1.5.5", "", { "peerDependencies": { "@better-auth/core": "1.5.5", "@better-auth/utils": "^0.3.0", "drizzle-orm": ">=0.41.0" }, "optionalPeers": ["drizzle-orm"] }, "sha512-HAi9xAP40oDt48QZeYBFTcmg3vt1Jik90GwoRIfangd7VGbxesIIDBJSnvwMbZ52GBIc6+V4FRw9lasNiNrPfw=="],
+    "@better-auth/drizzle-adapter": ["@better-auth/drizzle-adapter@1.6.11", "", { "peerDependencies": { "@better-auth/core": "^1.6.11", "@better-auth/utils": "0.4.0", "drizzle-orm": "^0.45.2" }, "optionalPeers": ["drizzle-orm"] }, "sha512-4jpkETIGZOHCf7BK4jnu22fdN6jjomH0/HhEzkaWy3+Eppi5PYlHTF/460jrTmA3Xc+Vqwp9t282ymHiEPypGw=="],

-    "@better-auth/kysely-adapter": ["@better-auth/kysely-adapter@1.5.5", "", { "peerDependencies": { "@better-auth/core": "1.5.5", "@better-auth/utils": "^0.3.0", "kysely": "^0.27.0 || ^0.28.0" } }, "sha512-LmHffIVnqbfsxcxckMOoE8MwibWrbVFch+kwPKJ5OFDFv6lin75ufN7ZZ7twH0IMPLT/FcgzaRjP8jRrXRef9g=="],
+    "@better-auth/kysely-adapter": ["@better-auth/kysely-adapter@1.6.11", "", { "peerDependencies": { "@better-auth/core": "^1.6.11", "@better-auth/utils": "0.4.0", "kysely": "^0.28.17" }, "optionalPeers": ["kysely"] }, "sha512-/g8M9RfIjdcZDnbstSUvQiINkvdNlCeZr248zwqx2/PVksQI1MhQofbzUn3RnQnbPKp0EPwpX/dR3oudRFenUg=="],

-    "@better-auth/memory-adapter": ["@better-auth/memory-adapter@1.5.5", "", { "peerDependencies": { "@better-auth/core": "1.5.5", "@better-auth/utils": "^0.3.0" } }, "sha512-4X0j1/2L+nsgmObjmy9xEGUFWUv38Qjthp558fwS3DAp6ueWWyCaxaD6VJZ7m5qPNMrsBStO5WGP8CmJTEWm7g=="],
+    "@better-auth/memory-adapter": ["@better-auth/memory-adapter@1.6.11", "", { "peerDependencies": { "@better-auth/core": "^1.6.11", "@better-auth/utils": "0.4.0" } }, "sha512-hpdfw0BBf8MuzLkIdmbcUZICbY9r/bhLO2RxSnkzT5+/O+0I0u2I8+m0YUP7vNllP/ZCKASHOYgXPLO75Z0f9Q=="],

-    "@better-auth/mongo-adapter": ["@better-auth/mongo-adapter@1.5.5", "", { "peerDependencies": { "@better-auth/core": "1.5.5", "@better-auth/utils": "^0.3.0", "mongodb": "^6.0.0 || ^7.0.0" } }, "sha512-P1J9ljL5X5k740I8Rx1esPWNgWYPdJR5hf2CY7BwDSrQFPUHuzeCg0YhtEEP55niNateTXhBqGAcy0fVOeamZg=="],
+    "@better-auth/mongo-adapter": ["@better-auth/mongo-adapter@1.6.11", "", { "peerDependencies": { "@better-auth/core": "^1.6.11", "@better-auth/utils": "0.4.0", "mongodb": "^6.0.0 || ^7.0.0" }, "optionalPeers": ["mongodb"] }, "sha512-3Tor8rSv8vSEIMEaV2PFpPEuVhqc1gNoZ6eGvoh3LwExXXuj8madew6ob+H1pH7Aphn3Ar5PQ08AguT8TbwFAA=="],

-    "@better-auth/prisma-adapter": ["@better-auth/prisma-adapter@1.5.5", "", { "peerDependencies": { "@better-auth/core": "1.5.5", "@better-auth/utils": "^0.3.0", "@prisma/client": "^5.0.0 || ^6.0.0 || ^7.0.0", "prisma": "^5.0.0 || ^6.0.0 || ^7.0.0" }, "optionalPeers": ["@prisma/client", "prisma"] }, "sha512-CliDd78CXHzzwQIXhCdwGr5Ml53i6JdCHWV7PYwTIJz9EAm6qb2RVBdpP3nqEfNjINGM22A6gfleCgCdZkTIZg=="],
+    "@better-auth/oauth-provider": ["@better-auth/oauth-provider@1.6.11", "", { "dependencies": { "jose": "^6.1.3", "zod": "^4.3.6" }, "peerDependencies": { "@better-auth/core": "^1.6.11", "@better-auth/utils": "0.4.0", "@better-fetch/fetch": "1.1.21", "better-auth": "^1.6.11", "better-call": "1.3.5" } }, "sha512-iMywpOEAiAUdtvpaRS8yKye+wO3AieOB3Sfv8czkmPduzFuKBICCWuOEAElQEk5tQz3vzWx64zNlLBkgEAOhuw=="],

-    "@better-auth/sso": ["@better-auth/sso@1.5.5", "", { "dependencies": { "@better-auth/utils": "0.3.1", "@better-fetch/fetch": "1.1.21", "fast-xml-parser": "^5.4.1", "jose": "^6.1.3", "samlify": "^2.10.2", "tldts": "^6.1.0", "zod": "^4.3.6" }, "peerDependencies": { "@better-auth/core": "1.5.5", "better-auth": "1.5.5", "better-call": "1.3.2" } }, "sha512-G3tvv5oKtEfpmBrt7Db/hSl5A3xttUkB4EhEjb202UhHz/XBiT0Orv5CkRa0kmjRyyAwOzn/lKZzYsd3VrjViA=="],
+    "@better-auth/prisma-adapter": ["@better-auth/prisma-adapter@1.6.11", "", { "peerDependencies": { "@better-auth/core": "^1.6.11", "@better-auth/utils": "0.4.0", "@prisma/client": "^5.0.0 || ^6.0.0 || ^7.0.0", "prisma": "^5.0.0 || ^6.0.0 || ^7.0.0" }, "optionalPeers": ["@prisma/client", "prisma"] }, "sha512-Pw+7q7zTp+VSci1V+CYMvuxIbAeVMZLe4lRo46LJoAKMHfjFl5T/ycsyFvWs/DkWC7n9gZZzRDEbHp0I5FiKKw=="],

-    "@better-auth/telemetry": ["@better-auth/telemetry@1.5.5", "", { "dependencies": { "@better-auth/utils": "0.3.1", "@better-fetch/fetch": "1.1.21" }, "peerDependencies": { "@better-auth/core": "1.5.5" } }, "sha512-1+lklxArn4IMHuU503RcPdXrSG2tlXt4jnGG3omolmspQ7tktg/Y9XO/yAkYDurtvMn1xJ8X1Ov01Ji/r5s9BQ=="],
+    "@better-auth/sso": ["@better-auth/sso@1.6.11", "", { "dependencies": { "fast-xml-parser": "^5.5.7", "jose": "^6.1.3", "samlify": "~2.10.2", "tldts": "^6.1.0", "zod": "^4.3.6" }, "peerDependencies": { "@better-auth/core": "^1.6.11", "@better-auth/utils": "0.4.0", "@better-fetch/fetch": "1.1.21", "better-auth": "^1.6.11", "better-call": "1.3.5" } }, "sha512-lJHmoCayp9Woh/MPKTHDfGq7k1oQbU2yz5tIOZXl/pzrgLxV7fMGo9aJCyabHkw3GHMjBes4byC6aakHYzpZIg=="],

-    "@better-auth/utils": ["@better-auth/utils@0.3.1", "", {}, "sha512-+CGp4UmZSUrHHnpHhLPYu6cV+wSUSvVbZbNykxhUDocpVNTo9uFFxw/NqJlh1iC4wQ9HKKWGCKuZ5wUgS0v6Kg=="],
+    "@better-auth/telemetry": ["@better-auth/telemetry@1.6.11", "", { "peerDependencies": { "@better-auth/core": "^1.6.11", "@better-auth/utils": "0.4.0", "@better-fetch/fetch": "1.1.21" } }, "sha512-hsjDHc8MZbm6/AHeNdtywrWedXevnBjmdvnHTcZub+rTVjOv+Td0roI8USKuC6uUibmrl//2rJfVCsGbopihNA=="],
+
+    "@better-auth/utils": ["@better-auth/utils@0.4.0", "", { "dependencies": { "@noble/hashes": "^2.0.1" } }, "sha512-RpMtLUIQAEWMgdPLNVbIF5ON2mm+CH0U3rCdUCU1VyeAUui4m38DyK7/aXMLZov2YDjG684pS1D0MBllrmgjQA=="],

    "@better-fetch/fetch": ["@better-fetch/fetch@1.1.21", "", {}, "sha512-/ImESw0sskqlVR94jB+5+Pxjf+xBwDZF/N5+y2/q4EqD7IARUTSpPfIo8uf39SYpCxyOCtbyYpUrZ3F/k0zT4A=="],

@@ -353,14 +356,14 @@

    "@mdx-js/mdx": ["@mdx-js/mdx@3.1.1", "", { "dependencies": { "@types/estree": "^1.0.0", "@types/estree-jsx": "^1.0.0", "@types/hast": "^3.0.0", "@types/mdx": "^2.0.0", "acorn": "^8.0.0", "collapse-white-space": "^2.0.0", "devlop": "^1.0.0", "estree-util-is-identifier-name": "^3.0.0", "estree-util-scope": "^1.0.0", "estree-walker": "^3.0.0", "hast-util-to-jsx-runtime": "^2.0.0", "markdown-extensions": "^2.0.0", "recma-build-jsx": "^1.0.0", "recma-jsx": "^1.0.0", "recma-stringify": "^1.0.0", "rehype-recma": "^1.0.0", "remark-mdx": "^3.0.0", "remark-parse": "^11.0.0", "remark-rehype": "^11.0.0", "source-map": "^0.7.0", "unified": "^11.0.0", "unist-util-position-from-estree": "^2.0.0", "unist-util-stringify-position": "^4.0.0", "unist-util-visit": "^5.0.0", "vfile": "^6.0.0" } }, "sha512-f6ZO2ifpwAQIpzGWaBQT2TXxPv6z3RBzQKpVftEWN78Vl/YweF1uwussDx8ECAXVtr3Rs89fKyG9YlzUs9DyGQ=="],

-    "@mongodb-js/saslprep": ["@mongodb-js/saslprep@1.4.6", "", { "dependencies": { "sparse-bitfield": "^3.0.3" } }, "sha512-y+x3H1xBZd38n10NZF/rEBlvDOOMQ6LKUTHqr8R9VkJ+mmQOYtJFxIlkkK8fZrtOiL6VixbOBWMbZGBdal3Z1g=="],
-
    "@napi-rs/wasm-runtime": ["@napi-rs/wasm-runtime@1.1.1", "", { "dependencies": { "@emnapi/core": "^1.7.1", "@emnapi/runtime": "^1.7.1", "@tybys/wasm-util": "^0.10.1" } }, "sha512-p64ah1M1ld8xjWv3qbvFwHiFVWrq1yFvV4f7w+mzaqiR4IlSgkqhcRdHwsGgomwzBH51sRY4NEowLxnaBjcW/A=="],

    "@noble/ciphers": ["@noble/ciphers@2.1.1", "", {}, "sha512-bysYuiVfhxNJuldNXlFEitTVdNnYUc+XNJZd7Qm2a5j1vZHgY+fazadNFWFaMK/2vye0JVlxV3gHmC0WDfAOQw=="],

    "@noble/hashes": ["@noble/hashes@2.0.1", "", {}, "sha512-XlOlEbQcE9fmuXxrVTXCTlG2nlRXa9Rj3rr5Ue/+tX+nmkgbX720YHh0VR3hBF9xDvwnb8D2shVGOwNx+ulArw=="],

+    "@nodable/entities": ["@nodable/entities@2.1.0", "", {}, "sha512-nyT7T3nbMyBI/lvr6L5TyWbFJAI9FTgVRakNoBqCD+PmID8DzFrrNdLLtHMwMszOtqZa8PAOV24ZqDnQrhQINA=="],
+
    "@octokit/auth-token": ["@octokit/auth-token@6.0.0", "", {}, "sha512-P4YJBPdPSpWTQ1NU4XYdvHvXJJDxM6YwpS0FZHRgP7YFkdVxsWcpWGy/NVqlAA7PcPCnMacXlRm1y2PFZRWL/w=="],

    "@octokit/core": ["@octokit/core@7.0.6", "", { "dependencies": { "@octokit/auth-token": "^6.0.0", "@octokit/graphql": "^9.0.3", "@octokit/request": "^10.0.6", "@octokit/request-error": "^7.0.2", "@octokit/types": "^16.0.0", "before-after-hook": "^4.0.0", "universal-user-agent": "^7.0.0" } }, "sha512-DhGl4xMVFGVIyMwswXeyzdL4uXD5OGILGX5N8Y+f6W7LhC1Ze2poSNrkF/fedpVDHEEZ+PHFW0vL14I+mm8K3Q=="],
@@ -387,6 +390,8 @@

    "@octokit/types": ["@octokit/types@16.0.0", "", { "dependencies": { "@octokit/openapi-types": "^27.0.0" } }, "sha512-sKq+9r1Mm4efXW1FCk7hFSeJo4QKreL/tTbR0rz/qx/r1Oa2VV83LTA/H/MuCOX7uCIJmQVRKBcbmWoySjAnSg=="],

+    "@opentelemetry/semantic-conventions": ["@opentelemetry/semantic-conventions@1.41.1", "", {}, "sha512-/UhIkaZgPutTFmQ7RnIJGgDXZmtEJ7Dvi86xNTFWcnRxVRNk/aotsqDJYeEvDP+FSMB2SdW+pQzNMcWP0rwuNA=="],
+
    "@oslojs/encoding": ["@oslojs/encoding@1.1.0", "", {}, "sha512-70wQhgYmndg4GCPxPPxPGevRKqTIJ2Nh4OkiMWmDAVYsTQ+Ta7Sq+rPevXyXGdzr30/qZBnyOalCszoMxlyldQ=="],

    "@oxc-project/runtime": ["@oxc-project/runtime@0.115.0", "", {}, "sha512-Rg8Wlt5dCbXhQnsXPrkOjL1DTSvXLgb2R/KYfnf1/K+R0k6UMLEmbQXPM+kwrWqSmWA2t0B1EtHy2/3zikQpvQ=="],
@@ -683,10 +688,6 @@

    "@types/uuid": ["@types/uuid@11.0.0", "", { "dependencies": { "uuid": "*" } }, "sha512-HVyk8nj2m+jcFRNazzqyVKiZezyhDKrGUA3jlEcg/nZ6Ms+qHwocba1Y/AaVaznJTAM9xpdFSh+ptbNrhOGvZA=="],

-    "@types/webidl-conversions": ["@types/webidl-conversions@7.0.3", "", {}, "sha512-CiJJvcRtIgzadHCYXw7dqEnMNRjhGZlYK05Mj9OyktqV8uVT8fD2BFOB7S1uwBE3Kj2Z+4UyPmFw/Ixgw/LAlA=="],
-
-    "@types/whatwg-url": ["@types/whatwg-url@13.0.0", "", { "dependencies": { "@types/webidl-conversions": "*" } }, "sha512-N8WXpbE6Wgri7KUSvrmQcqrMllKZ9uxkYWMt+mCSGwNc0Hsw9VQTW7ApqI4XNrx6/SaM2QQJCzMPDEXE058s+Q=="],
-
    "@ungap/structured-clone": ["@ungap/structured-clone@1.3.0", "", {}, "sha512-WmoN8qaIAo7WTYWbAZuG8PYEhn5fkz7dZrqTBZ7dtt//lL2Gwms1IcnQ5yHqjDfX8Ft5j4YzDM23f87zBfDe9g=="],

    "@vitejs/plugin-react": ["@vitejs/plugin-react@6.0.1", "", { "dependencies": { "@rolldown/pluginutils": "1.0.0-rc.7" }, "peerDependencies": { "@rolldown/plugin-babel": "^0.1.7 || ^0.2.0", "babel-plugin-react-compiler": "^1.0.0", "vite": "^8.0.0" }, "optionalPeers": ["@rolldown/plugin-babel", "babel-plugin-react-compiler"] }, "sha512-l9X/E3cDb+xY3SWzlG1MOGt2usfEHGMNIaegaUGFsLkb3RCn/k8/TOXBcab+OndDI4TBtktT8/9BwwW8Vi9KUQ=="],
@@ -769,9 +770,9 @@

    "before-after-hook": ["before-after-hook@4.0.0", "", {}, "sha512-q6tR3RPqIB1pMiTRMFcZwuG5T8vwp+vUvEG0vuI6B+Rikh5BfPp2fQ82c925FOs+b0lcFQ8CFrL+KbilfZFhOQ=="],

-    "better-auth": ["better-auth@1.5.5", "", { "dependencies": { "@better-auth/core": "1.5.5", "@better-auth/drizzle-adapter": "1.5.5", "@better-auth/kysely-adapter": "1.5.5", "@better-auth/memory-adapter": "1.5.5", "@better-auth/mongo-adapter": "1.5.5", "@better-auth/prisma-adapter": "1.5.5", "@better-auth/telemetry": "1.5.5", "@better-auth/utils": "0.3.1", "@better-fetch/fetch": "1.1.21", "@noble/ciphers": "^2.1.1", "@noble/hashes": "^2.0.1", "better-call": "1.3.2", "defu": "^6.1.4", "jose": "^6.1.3", "kysely": "^0.28.11", "nanostores": "^1.1.1", "zod": "^4.3.6" }, "peerDependencies": { "@lynx-js/react": "*", "@prisma/client": "^5.0.0 || ^6.0.0 || ^7.0.0", "@sveltejs/kit": "^2.0.0", "@tanstack/react-start": "^1.0.0", "@tanstack/solid-start": "^1.0.0", "better-sqlite3": "^12.0.0", "drizzle-kit": ">=0.31.4", "drizzle-orm": ">=0.41.0", "mongodb": "^6.0.0 || ^7.0.0", "mysql2": "^3.0.0", "next": "^14.0.0 || ^15.0.0 || ^16.0.0", "pg": "^8.0.0", "prisma": "^5.0.0 || ^6.0.0 || ^7.0.0", "react": "^18.0.0 || ^19.0.0", "react-dom": "^18.0.0 || ^19.0.0", "solid-js": "^1.0.0", "svelte": "^4.0.0 || ^5.0.0", "vitest": "^2.0.0 || ^3.0.0 || ^4.0.0", "vue": "^3.0.0" }, "optionalPeers": ["@lynx-js/react", "@prisma/client", "@sveltejs/kit", "@tanstack/react-start", "@tanstack/solid-start", "better-sqlite3", "drizzle-kit", "drizzle-orm", "mongodb", "mysql2", "next", "pg", "prisma", "react", "react-dom", "solid-js", "svelte", "vitest", "vue"] }, "sha512-GpVPaV1eqr3mOovKfghJXXk6QvlcVeFbS3z+n+FPDid5rK/2PchnDtiaVCzWyXA9jH2KkirOfl+JhAUvnja0Eg=="],
+    "better-auth": ["better-auth@1.6.11", "", { "dependencies": { "@better-auth/core": "1.6.11", "@better-auth/drizzle-adapter": "1.6.11", "@better-auth/kysely-adapter": "1.6.11", "@better-auth/memory-adapter": "1.6.11", "@better-auth/mongo-adapter": "1.6.11", "@better-auth/prisma-adapter": "1.6.11", "@better-auth/telemetry": "1.6.11", "@better-auth/utils": "0.4.0", "@better-fetch/fetch": "1.1.21", "@noble/ciphers": "^2.1.1", "@noble/hashes": "^2.0.1", "better-call": "1.3.5", "defu": "^6.1.4", "jose": "^6.1.3", "kysely": "^0.28.17", "nanostores": "^1.1.1", "zod": "^4.3.6" }, "peerDependencies": { "@lynx-js/react": "*", "@prisma/client": "^5.0.0 || ^6.0.0 || ^7.0.0", "@sveltejs/kit": "^2.0.0", "@tanstack/react-start": "^1.0.0", "@tanstack/solid-start": "^1.0.0", "better-sqlite3": "^12.0.0", "drizzle-kit": ">=0.31.4", "drizzle-orm": "^0.45.2", "mongodb": "^6.0.0 || ^7.0.0", "mysql2": "^3.0.0", "next": "^14.0.0 || ^15.0.0 || ^16.0.0", "pg": "^8.0.0", "prisma": "^5.0.0 || ^6.0.0 || ^7.0.0", "react": "^18.0.0 || ^19.0.0", "react-dom": "^18.0.0 || ^19.0.0", "solid-js": "^1.0.0", "svelte": "^4.0.0 || ^5.0.0", "vitest": "^2.0.0 || ^3.0.0 || ^4.0.0", "vue": "^3.0.0" }, "optionalPeers": ["@lynx-js/react", "@prisma/client", "@sveltejs/kit", "@tanstack/react-start", "@tanstack/solid-start", "better-sqlite3", "drizzle-kit", "drizzle-orm", "mongodb", "mysql2", "next", "pg", "prisma", "react", "react-dom", "solid-js", "svelte", "vitest", "vue"] }, "sha512-Wwt6+q07dwIhsp6XiM7L1qSXVUWBEtNl+eZvwM778CguFqDZFBN9Pt6LtFaHl55t8Z+Zc//5kxcbgDY8/79vFQ=="],

-    "better-call": ["better-call@1.3.2", "", { "dependencies": { "@better-auth/utils": "^0.3.1", "@better-fetch/fetch": "^1.1.21", "rou3": "^0.7.12", "set-cookie-parser": "^3.0.1" }, "peerDependencies": { "zod": "^4.0.0" }, "optionalPeers": ["zod"] }, "sha512-4cZIfrerDsNTn3cm+MhLbUePN0gdwkhSXEuG7r/zuQ8c/H7iU0/jSK5TD3FW7U0MgKHce/8jGpPYNO4Ve+4NBw=="],
+    "better-call": ["better-call@1.3.5", "", { "dependencies": { "@better-auth/utils": "^0.4.0", "@better-fetch/fetch": "^1.1.21", "rou3": "^0.7.12", "set-cookie-parser": "^3.0.1" }, "peerDependencies": { "zod": "^4.0.0" }, "optionalPeers": ["zod"] }, "sha512-kOFJkBP7utAQLEYrobZm3vkTH8mXq5GNgvjc5/XEST1ilVHaxXUXfeDeFlqoETMtyqS4+3/h4ONX2i++ebZrvA=="],

    "bidi-js": ["bidi-js@1.0.3", "", { "dependencies": { "require-from-string": "^2.0.2" } }, "sha512-RKshQI1R3YQ+n9YJz2QQ147P66ELpa1FQEg20Dk8oW9t2KgLbpDLLp9aGZ7y8WHSshDknG0bknqGw5/tyCs5tw=="],

@@ -781,15 +782,13 @@

    "browserslist": ["browserslist@4.28.1", "", { "dependencies": { "baseline-browser-mapping": "^2.9.0", "caniuse-lite": "^1.0.30001759", "electron-to-chromium": "^1.5.263", "node-releases": "^2.0.27", "update-browserslist-db": "^1.2.0" }, "bin": { "browserslist": "cli.js" } }, "sha512-ZC5Bd0LgJXgwGqUknZY/vkUQ04r8NXnJZ3yYi4vDmSiZmC/pdSN0NbNRPxZpbtO4uAfDUAFffO8IZoM3Gj8IkA=="],

-    "bson": ["bson@7.2.0", "", {}, "sha512-YCEo7KjMlbNlyHhz7zAZNDpIpQbd+wOEHJYezv0nMYTn4x31eIUM2yomNNubclAt63dObUzKHWsBLJ9QcZNSnQ=="],
-
    "buffer": ["buffer@6.0.3", "", { "dependencies": { "base64-js": "^1.3.1", "ieee754": "^1.2.1" } }, "sha512-FTiCpNxtwiZZHEZbcbTIcZjERVICn9yq/pDFkTl95/AxzD1naBctN7YO68riM/gLSDY7sdrMby8hofADYuuqOA=="],

    "buffer-equal-constant-time": ["buffer-equal-constant-time@1.0.1", "", {}, "sha512-zRpUiDwd/xk6ADqPMATG8vc9VPrkck7T07OIx0gnjmJAnHnTVXNQG3vfvWNuiZIkwu9KrKdA1iJKfsfTVxE6NA=="],

    "bun-types": ["bun-types@1.3.10", "", { "dependencies": { "@types/node": "*" } }, "sha512-tcpfCCl6XWo6nCVnpcVrxQ+9AYN1iqMIzgrSKYMB/fjLtV2eyAVEg7AxQJuCq/26R6HpKWykQXuSOq/21RYcbg=="],

-    "camelcase": ["camelcase@9.0.0", "", {}, "sha512-TO9xmyXTZ9HUHI8M1OnvExxYB0eYVS/1e5s7IDMTAoIcwUd+aNcFODs6Xk83mobk0velyHFQgA1yIrvYc6wclw=="],
+    "camelcase": ["camelcase@6.3.0", "", {}, "sha512-Gmy6FhYlCY7uOElZUSbxo2UCDH8owEk996gkbrpsgGtrJLM3J7jGxl9Ic7Qwwj4ivOE5AWZWRMecDdF7hqGjFA=="],

    "caniuse-lite": ["caniuse-lite@1.0.30001779", "", {}, "sha512-U5og2PN7V4DMgF50YPNtnZJGWVLFjjsN3zb6uMT5VGYIewieDj1upwfuVNXf4Kor+89c3iCRJnSzMD5LmTvsfA=="],

@@ -961,7 +960,7 @@

    "fast-xml-builder": ["fast-xml-builder@1.2.0", "", { "dependencies": { "path-expression-matcher": "^1.5.0", "xml-naming": "^0.1.0" } }, "sha512-00aAWieqff+ZJhsXA4g1g7M8k+7AYoMUUHF+/zFb5U6Uv/P0Vl4QZo84/IcufzYalLuEj9928bXN9PbbFzMF0Q=="],

-    "fast-xml-parser": ["fast-xml-parser@5.5.6", "", { "dependencies": { "fast-xml-builder": "^1.1.4", "path-expression-matcher": "^1.1.3", "strnum": "^2.1.2" }, "bin": { "fxparser": "src/cli/cli.js" } }, "sha512-3+fdZyBRVg29n4rXP0joHthhcHdPUHaIC16cuyyd1iLsuaO6Vea36MPrxgAzbZna8lhvZeRL8Bc9GP56/J9xEw=="],
+    "fast-xml-parser": ["fast-xml-parser@5.8.0", "", { "dependencies": { "@nodable/entities": "^2.1.0", "fast-xml-builder": "^1.2.0", "path-expression-matcher": "^1.5.0", "strnum": "^2.3.0", "xml-naming": "^0.1.0" }, "bin": { "fxparser": "src/cli/cli.js" } }, "sha512-6bIM7fsJxeo3uXv7OncQYsBAMPJ7V16Slahl/6M98C/i2q+vB1+4a0MtrvYwDFEUrwDSbAmeLDRXsOBwrL7yAg=="],

    "fdir": ["fdir@6.5.0", "", { "peerDependencies": { "picomatch": "^3 || ^4" }, "optionalPeers": ["picomatch"] }, "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg=="],

@@ -1181,8 +1180,6 @@

    "mdn-data": ["mdn-data@2.27.1", "", {}, "sha512-9Yubnt3e8A0OKwxYSXyhLymGW4sCufcLG6VdiDdUGVkPhpqLxlvP5vl1983gQjJl3tqbrM731mjaZaP68AgosQ=="],

-    "memory-pager": ["memory-pager@1.5.0", "", {}, "sha512-ZS4Bp4r/Zoeq6+NLJpP+0Zzm0pR8whtGPf1XExKLJBAczGMnSi3It14OiNCStjQjM6NU1okjQGSxgEZN8eBYKg=="],
-
    "micromark": ["micromark@4.0.2", "", { "dependencies": { "@types/debug": "^4.0.0", "debug": "^4.0.0", "decode-named-character-reference": "^1.0.0", "devlop": "^1.0.0", "micromark-core-commonmark": "^2.0.0", "micromark-factory-space": "^2.0.0", "micromark-util-character": "^2.0.0", "micromark-util-chunked": "^2.0.0", "micromark-util-combine-extensions": "^2.0.0", "micromark-util-decode-numeric-character-reference": "^2.0.0", "micromark-util-encode": "^2.0.0", "micromark-util-normalize-identifier": "^2.0.0", "micromark-util-resolve-all": "^2.0.0", "micromark-util-sanitize-uri": "^2.0.0", "micromark-util-subtokenize": "^2.0.0", "micromark-util-symbol": "^2.0.0", "micromark-util-types": "^2.0.0" } }, "sha512-zpe98Q6kvavpCr1NPVSCMebCKfD7CA2NqZ+rykeNhONIJBpc1tFKt9hucLGwha3jNTNI8lHpctWJWoimVF4PfA=="],

    "micromark-core-commonmark": ["micromark-core-commonmark@2.0.3", "", { "dependencies": { "decode-named-character-reference": "^1.0.0", "devlop": "^1.0.0", "micromark-factory-destination": "^2.0.0", "micromark-factory-label": "^2.0.0", "micromark-factory-space": "^2.0.0", "micromark-factory-title": "^2.0.0", "micromark-factory-whitespace": "^2.0.0", "micromark-util-character": "^2.0.0", "micromark-util-chunked": "^2.0.0", "micromark-util-classify-character": "^2.0.0", "micromark-util-html-tag-name": "^2.0.0", "micromark-util-normalize-identifier": "^2.0.0", "micromark-util-resolve-all": "^2.0.0", "micromark-util-subtokenize": "^2.0.0", "micromark-util-symbol": "^2.0.0", "micromark-util-types": "^2.0.0" } }, "sha512-RDBrHEMSxVFLg6xvnXmb1Ayr2WzLAWjeSATAoxwKYJV94TeNavgoIdA0a9ytzDSVzBy2YKFK+emCPOEibLeCrg=="],
@@ -1259,10 +1256,6 @@

    "min-indent": ["min-indent@1.0.1", "", {}, "sha512-I9jwMn07Sy/IwOj3zVkVik2JTvgpaykDZEigL6Rx6N9LbMywwUSMtxET+7lVoDLLd3O3IXwJwvuuns8UB/HeAg=="],

-    "mongodb": ["mongodb@7.1.0", "", { "dependencies": { "@mongodb-js/saslprep": "^1.3.0", "bson": "^7.1.1", "mongodb-connection-string-url": "^7.0.0" }, "peerDependencies": { "@aws-sdk/credential-providers": "^3.806.0", "@mongodb-js/zstd": "^7.0.0", "gcp-metadata": "^7.0.1", "kerberos": "^7.0.0", "mongodb-client-encryption": ">=7.0.0 <7.1.0", "snappy": "^7.3.2", "socks": "^2.8.6" }, "optionalPeers": ["@aws-sdk/credential-providers", "@mongodb-js/zstd", "gcp-metadata", "kerberos", "mongodb-client-encryption", "snappy", "socks"] }, "sha512-kMfnKunbolQYwCIyrkxNJFB4Ypy91pYqua5NargS/f8ODNSJxT03ZU3n1JqL4mCzbSih8tvmMEMLpKTT7x5gCg=="],
-
-    "mongodb-connection-string-url": ["mongodb-connection-string-url@7.0.1", "", { "dependencies": { "@types/whatwg-url": "^13.0.0", "whatwg-url": "^14.1.0" } }, "sha512-h0AZ9A7IDVwwHyMxmdMXKy+9oNlF0zFoahHiX3vQ8e3KFcSP3VmsmfvtRSuLPxmyv2vjIDxqty8smTgie/SNRQ=="],
-
    "mrmime": ["mrmime@2.0.1", "", {}, "sha512-Y3wQdFg2Va6etvQ5I82yUhGdsKrcYox6p7FfL1LbK2J4V01F9TGlepTIhnK24t7koZibmg82KGglhA1XK5IsLQ=="],

    "ms": ["ms@2.1.3", "", {}, "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA=="],
@@ -1281,6 +1274,8 @@

    "node-fetch-native": ["node-fetch-native@1.6.7", "", {}, "sha512-g9yhqoedzIUm0nTnTqAQvueMPVOuIY16bqgAJJC8XOOubYFNwz6IER9qs0Gq2Xd0+CecCKFjtdDTMA4u4xG06Q=="],

+    "node-forge": ["node-forge@1.4.0", "", {}, "sha512-LarFH0+6VfriEhqMMcLX2F7SwSXeWwnEAJEsYm5QKWchiVYVvJyV9v7UDvUv+w5HO23ZpQTXDv/GxdDdMyOuoQ=="],
+
    "node-mock-http": ["node-mock-http@1.0.4", "", {}, "sha512-8DY+kFsDkNXy1sJglUfuODx1/opAGJGyrTuFqEoN90oRc2Vk0ZbD4K2qmKXBBEhZQzdKHIVfEJpDU8Ak2NJEvQ=="],

    "node-releases": ["node-releases@2.0.36", "", {}, "sha512-TdC8FSgHz8Mwtw9g5L4gR/Sh9XhSP/0DEkQxfEFXOpiul5IiHgHan2VhYYb6agDSfp4KuvltmGApc8HMgUrIkA=="],
@@ -1311,6 +1306,8 @@

    "package-manager-detector": ["package-manager-detector@1.6.0", "", {}, "sha512-61A5ThoTiDG/C8s8UMZwSorAGwMJ0ERVGj2OjoW5pAalsNOg15+iQiPzrLJ4jhZ1HJzmC2PIHT2oEiH3R5fzNA=="],

+    "pako": ["pako@1.0.11", "", {}, "sha512-4hLB8Py4zZce5s4yd9XzopqwVv/yGNhV1Bl8NTmCq1763HeK2+EwVTv+leGeL13Dnh2wfbqowVPXCIO0z4taYw=="],
+
    "parse-entities": ["parse-entities@4.0.2", "", { "dependencies": { "@types/unist": "^2.0.0", "character-entities-legacy": "^3.0.0", "character-reference-invalid": "^2.0.0", "decode-named-character-reference": "^1.0.0", "is-alphanumerical": "^2.0.0", "is-decimal": "^2.0.0", "is-hexadecimal": "^2.0.0" } }, "sha512-GG2AQYWoLgL877gQIKeRPGO1xF9+eG1ujIb5soS5gPvLQ1y2o8FL90w2QWNdf9I361Mpp7726c+lj3U0qK1uGw=="],

    "parse-latin": ["parse-latin@7.0.0", "", { "dependencies": { "@types/nlcst": "^2.0.0", "@types/unist": "^3.0.0", "nlcst-to-string": "^4.0.0", "unist-util-modify-children": "^4.0.0", "unist-util-visit-children": "^3.0.0", "vfile": "^6.0.0" } }, "sha512-mhHgobPPua5kZ98EF4HWiH167JWBfl4pvAIXXdbaVohtK7a6YBOy56kvhCqduqyo/f3yrHFWmqmiMg/BkBkYYQ=="],
@@ -1319,7 +1316,7 @@

    "path-browserify": ["path-browserify@1.0.1", "", {}, "sha512-b7uo2UCUOYZcnF/3ID0lulOJi/bafxa1xPe7ZPsammBSpjSWQkjNxlt635YGS2MiR9GjvuXCtz2emr3jbsz98g=="],

-    "path-expression-matcher": ["path-expression-matcher@1.1.3", "", {}, "sha512-qdVgY8KXmVdJZRSS1JdEPOKPdTiEK/pi0RkcT2sw1RhXxohdujUlJFPuS1TSkevZ9vzd3ZlL7ULl1MHGTApKzQ=="],
+    "path-expression-matcher": ["path-expression-matcher@1.5.0", "", {}, "sha512-cbrerZV+6rvdQrrD+iGMcZFEiiSrbv9Tfdkvnusy6y0x0GKBXREFg/Y65GhIfm0tnLntThhzCnfKwp1WRjeCyQ=="],

    "pathe": ["pathe@2.0.3", "", {}, "sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w=="],

@@ -1431,7 +1428,7 @@

    "safer-buffer": ["safer-buffer@2.1.2", "", {}, "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg=="],

-    "samlify": ["samlify@2.11.0", "", { "dependencies": { "@authenio/xml-encryption": "^2.0.2", "@xmldom/xmldom": "^0.8.11", "camelcase": "^9.0.0", "node-rsa": "^1.1.1", "xml": "^1.0.1", "xml-crypto": "^6.1.2", "xml-escape": "^1.1.0", "xpath": "^0.0.34" } }, "sha512-1C9ukjlf0rRsuyqdzztqikdItqa33j9NCCDZgeBiWk0etU6vxNB+SWJKW4Flk07ZlhXeev/twALEKrPhIAyfDg=="],
+    "samlify": ["samlify@2.10.2", "", { "dependencies": { "@authenio/xml-encryption": "^2.0.2", "@xmldom/xmldom": "^0.8.6", "camelcase": "^6.2.0", "node-forge": "^1.3.0", "node-rsa": "^1.1.1", "pako": "^1.0.10", "uuid": "^8.3.2", "xml": "^1.0.1", "xml-crypto": "^6.1.2", "xml-escape": "^1.1.0", "xpath": "^0.0.32" } }, "sha512-y5s1cHwclqwP8h7K2Wj9SfP1q+1S9+jrs5OAegYTLAiuFi7nDvuKqbiXLmUTvYPMpzHcX94wTY2+D604jgTKvA=="],

    "sax": ["sax@1.5.0", "", {}, "sha512-21IYA3Q5cQf089Z6tgaUTr7lDAyzoTPx5HRtbhsME8Udispad8dC/+sziTNugOEx54ilvatQ9YCzl4KQLPcRHA=="],

@@ -1467,8 +1464,6 @@

    "space-separated-tokens": ["space-separated-tokens@2.0.2", "", {}, "sha512-PEGlAwrG8yXGXRjW32fGbg66JAlOAwbObuqVoJpv/mRgoWDQfgH1wDPvtzWyUSNAXBGSk8h755YDbbcEy3SH2Q=="],

-    "sparse-bitfield": ["sparse-bitfield@3.0.3", "", { "dependencies": { "memory-pager": "^1.0.2" } }, "sha512-kvzhi7vqKTfkh0PZU+2D2PIllw2ymqJKujUcyPMd9Y75Nv4nPbGJZXNhxsgdQab2BmlDct1YnfQCguEvHr7VsQ=="],
-
    "stackback": ["stackback@0.0.2", "", {}, "sha512-1XMJE5fQo1jGH6Y/7ebnwPOBEkIEnT4QF32d5R1+VXdXveM0IBMJt8zfaxX1P3QhVwrYe+576+jkANtSS2mBbw=="],

    "statuses": ["statuses@2.0.2", "", {}, "sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw=="],
@@ -1483,7 +1478,7 @@

    "strip-indent": ["strip-indent@3.0.0", "", { "dependencies": { "min-indent": "^1.0.0" } }, "sha512-laJTa3Jb+VQpaC6DseHhF7dXVqHTfJPCRDaEbid/drOhgitgYku/letMUqOXFoWV0zIIUbjpdH2t+tYj4bQMRQ=="],

-    "strnum": ["strnum@2.2.0", "", {}, "sha512-Y7Bj8XyJxnPAORMZj/xltsfo55uOiyHcU2tnAVzHUnSJR/KsEX+9RoDeXEnsXtl/CX4fAcrt64gZ13aGaWPeBg=="],
+    "strnum": ["strnum@2.3.0", "", {}, "sha512-ums3KNd42PGyx5xaoVTO1mjU1bH3NpY4vsrVlnv9PNGqQj8wd7rJ6nEypLrJ7z5vxK5RP0yMLo6J/Gsm62DI5Q=="],

    "style-to-js": ["style-to-js@1.1.21", "", { "dependencies": { "style-to-object": "1.0.14" } }, "sha512-RjQetxJrrUJLQPHbLku6U/ocGtzyjbJMP9lCNK7Ag0CNh690nSH8woqWH9u16nMjYBAok+i7JO1NP2pOy8IsPQ=="],

@@ -1663,7 +1658,7 @@

    "xmlchars": ["xmlchars@2.2.0", "", {}, "sha512-JZnDKK8B0RCDw84FNdDAIpZK+JuJw+s7Lz8nksI7SIuU3UXJJslUthsi+uWBUYOwPFwW7W7PRLRfUKpxjtjFCw=="],

-    "xpath": ["xpath@0.0.34", "", {}, "sha512-FxF6+rkr1rNSQrhUNYrAFJpRXNzlDoMxeXN5qI84939ylEv3qqPFKa85Oxr6tDaJKqwW6KKyo2v26TSv3k6LeA=="],
+    "xpath": ["xpath@0.0.32", "", {}, "sha512-rxMJhSIoiO8vXcWvSifKqhvV96GjiD5wYb8/QHdoRyQvraTpp4IEv944nhGausZZ3u7dhQXteZuZbaqfpB7uYw=="],

    "xxhash-wasm": ["xxhash-wasm@1.1.0", "", {}, "sha512-147y/6YNh+tlp6nd/2pWq38i9h6mz/EuQ6njIrmW8D1BS5nCqs0P6DG+m6zTGnNz5I+uhZ0SHxBs9BsPrwcKDA=="],

@@ -1691,8 +1686,6 @@

    "@astrojs/react/vite": ["vite@7.3.1", "", { "dependencies": { "esbuild": "^0.27.0", "fdir": "^6.5.0", "picomatch": "^4.0.3", "postcss": "^8.5.6", "rollup": "^4.43.0", "tinyglobby": "^0.2.15" }, "optionalDependencies": { "fsevents": "~2.3.3" }, "peerDependencies": { "@types/node": "^20.19.0 || >=22.12.0", "jiti": ">=1.21.0", "less": "^4.0.0", "lightningcss": "^1.21.0", "sass": "^1.70.0", "sass-embedded": "^1.70.0", "stylus": ">=0.54.8", "sugarss": "^5.0.0", "terser": "^5.16.0", "tsx": "^4.8.1", "yaml": "^2.4.2" }, "optionalPeers": ["@types/node", "jiti", "less", "lightningcss", "sass", "sass-embedded", "stylus", "sugarss", "terser", "tsx", "yaml"], "bin": { "vite": "bin/vite.js" } }, "sha512-w+N7Hifpc3gRjZ63vYBXA56dvvRlNWRczTdmCBBa+CotUzAPf5b7YMdMR/8CQoeYE5LX3W4wj6RYTgonm1b9DA=="],

-    "@authenio/xml-encryption/xpath": ["xpath@0.0.32", "", {}, "sha512-rxMJhSIoiO8vXcWvSifKqhvV96GjiD5wYb8/QHdoRyQvraTpp4IEv944nhGausZZ3u7dhQXteZuZbaqfpB7uYw=="],
-
    "@babel/core/semver": ["semver@6.3.1", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA=="],

    "@babel/helper-compilation-targets/lru-cache": ["lru-cache@5.1.1", "", { "dependencies": { "yallist": "^3.0.2" } }, "sha512-KpNARQA3Iwv+jTA0utUVVbrh+Jlrr1Fv0e56GGzAFOXN7dk/FviaDW8LHmK52DlcH4WP2n6gI8vN1aesBFgo9w=="],
@@ -1759,14 +1752,10 @@

    "dom-serializer/entities": ["entities@4.5.0", "", {}, "sha512-V0hjH4dGPh9Ao5p0MoRY6BVqtwCjhz6vI5LT8AJ55H+4g9/4vbHx1I54fS0XuclLhDHArPQCiMjDxjaL8fPxhw=="],

-    "fast-xml-builder/path-expression-matcher": ["path-expression-matcher@1.5.0", "", {}, "sha512-cbrerZV+6rvdQrrD+iGMcZFEiiSrbv9Tfdkvnusy6y0x0GKBXREFg/Y65GhIfm0tnLntThhzCnfKwp1WRjeCyQ=="],
-
    "hast-util-from-html/parse5": ["parse5@7.3.0", "", { "dependencies": { "entities": "^6.0.0" } }, "sha512-IInvU7fabl34qmi9gY8XOVxhYyMyuH2xUNpb2q8/Y+7552KlejkRvqvD19nMoUW/uQGGbqNpA6Tufu5FL5BZgw=="],

    "hast-util-raw/parse5": ["parse5@7.3.0", "", { "dependencies": { "entities": "^6.0.0" } }, "sha512-IInvU7fabl34qmi9gY8XOVxhYyMyuH2xUNpb2q8/Y+7552KlejkRvqvD19nMoUW/uQGGbqNpA6Tufu5FL5BZgw=="],

-    "mongodb-connection-string-url/whatwg-url": ["whatwg-url@14.2.0", "", { "dependencies": { "tr46": "^5.1.0", "webidl-conversions": "^7.0.0" } }, "sha512-De72GdQZzNTUBBChsXueQUnPKDkg/5A5zp7pFDuQAj5UFoENpiACU0wlCvzpAGnTkj++ihpKwKyYewn/XNUbKw=="],
-
    "parse-entities/@types/unist": ["@types/unist@2.0.11", "", {}, "sha512-CmBKiL6NNo/OqgmMn95Fk9Whlp2mtvIv+KNpQKN2F4SjvrEesubTRWGYSg+BnWZOnlCaSTU1sMpsBOzgbYhnsA=="],

    "playwright/fsevents": ["fsevents@2.3.2", "", { "os": "darwin" }, "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA=="],
@@ -1775,6 +1764,8 @@

    "rolldown/@rolldown/pluginutils": ["@rolldown/pluginutils@1.0.0-rc.9", "", {}, "sha512-w6oiRWgEBl04QkFZgmW+jnU1EC9b57Oihi2ot3HNWIQRqgHp5PnYDia5iZ5FF7rpa4EQdiqMDXjlqKGXBhsoXw=="],

+    "samlify/uuid": ["uuid@8.3.2", "", { "bin": { "uuid": "dist/bin/uuid" } }, "sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg=="],
+
    "tough-cookie/tldts": ["tldts@7.0.25", "", { "dependencies": { "tldts-core": "^7.0.25" }, "bin": { "tldts": "bin/cli.js" } }, "sha512-keinCnPbwXEUG3ilrWQZU+CqcTTzHq9m2HhoUP2l7Xmi8l1LuijAXLpAJ5zRW+ifKTNscs4NdCkfkDCBYm352w=="],

    "tsx/esbuild": ["esbuild@0.27.4", "", { "optionalDependencies": { "@esbuild/aix-ppc64": "0.27.4", "@esbuild/android-arm": "0.27.4", "@esbuild/android-arm64": "0.27.4", "@esbuild/android-x64": "0.27.4", "@esbuild/darwin-arm64": "0.27.4", "@esbuild/darwin-x64": "0.27.4", "@esbuild/freebsd-arm64": "0.27.4", "@esbuild/freebsd-x64": "0.27.4", "@esbuild/linux-arm": "0.27.4", "@esbuild/linux-arm64": "0.27.4", "@esbuild/linux-ia32": "0.27.4", "@esbuild/linux-loong64": "0.27.4", "@esbuild/linux-mips64el": "0.27.4", "@esbuild/linux-ppc64": "0.27.4", "@esbuild/linux-riscv64": "0.27.4", "@esbuild/linux-s390x": "0.27.4", "@esbuild/linux-x64": "0.27.4", "@esbuild/netbsd-arm64": "0.27.4", "@esbuild/netbsd-x64": "0.27.4", "@esbuild/openbsd-arm64": "0.27.4", "@esbuild/openbsd-x64": "0.27.4", "@esbuild/openharmony-arm64": "0.27.4", "@esbuild/sunos-x64": "0.27.4", "@esbuild/win32-arm64": "0.27.4", "@esbuild/win32-ia32": "0.27.4", "@esbuild/win32-x64": "0.27.4" }, "bin": { "esbuild": "bin/esbuild" } }, "sha512-Rq4vbHnYkK5fws5NF7MYTU68FPRE1ajX7heQ/8QXXWqNgqqJ/GkmmyxIzUnf2Sr/bakf8l54716CcMGHYhMrrQ=="],
@@ -1927,10 +1918,6 @@

    "csso/css-tree/mdn-data": ["mdn-data@2.0.28", "", {}, "sha512-aylIc7Z9y4yzHYAJNuESG3hfhC+0Ibp/MAMiaOZgNv4pmEdFyfZhhhny4MNiAfWdBQ1RQ2mfDWmM1x8SvGyp8g=="],

-    "mongodb-connection-string-url/whatwg-url/tr46": ["tr46@5.1.1", "", { "dependencies": { "punycode": "^2.3.1" } }, "sha512-hdF5ZgjTqgAntKkklYw0R03MG2x/bSzTtkxmIRw/sTNV8YXsCJ1tfLAX23lhxhHJlEf3CRCOCGGWw3vI3GaSPw=="],
-
-    "mongodb-connection-string-url/whatwg-url/webidl-conversions": ["webidl-conversions@7.0.0", "", {}, "sha512-VwddBukDzu71offAQR975unBIGqfKZpM+8ZX6ySk8nYhVoo5CYaZyzt3YBvYtRtO+aoGlqxPg/B87NGVZ/fu6g=="],
-
    "tough-cookie/tldts/tldts-core": ["tldts-core@7.0.25", "", {}, "sha512-ZjCZK0rppSBu7rjHYDYsEaMOIbbT+nWF57hKkv4IUmZWBNrBWBOjIElc0mKRgLM8bm7x/BBlof6t2gi/Oq/Asw=="],

    "tsx/esbuild/@esbuild/aix-ppc64": ["@esbuild/aix-ppc64@0.27.4", "", { "os": "aix", "cpu": "ppc64" }, "sha512-cQPwL2mp2nSmHHJlCyoXgHGhbEPMrEEU5xhkcy3Hs/O7nGZqEpZ2sUtLaL9MORLtDfRvVl2/3PAuEkYZH0Ty8Q=="],
@@ -1409,9 +1409,9 @@
    url = "https://registry.npmjs.org/@xmldom/is-dom-node/-/is-dom-node-1.0.1.tgz";
    hash = "sha512-CJDxIgE5I0FH+ttq/Fxy6nRpxP70+e2O048EPe85J2use3XKdatVM7dDVvFNjQudd9B49NPoZ+8PG49zj4Er8Q==";
  };
-  "@xmldom/xmldom@0.8.11" = fetchurl {
-    url = "https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.8.11.tgz";
-    hash = "sha512-cQzWCtO6C8TQiYl1ruKNn2U6Ao4o4WBBcbL61yJl84x+j5sOWWFU9X7DpND8XZG3daDppSsigMdfAIl2upQBRw==";
+  "@xmldom/xmldom@0.8.13" = fetchurl {
+    url = "https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.8.13.tgz";
+    hash = "sha512-KRYzxepc14G/CEpEGc3Yn+JKaAeT63smlDr+vjB8jRfgTBBI9wRj/nkQEO+ucV8p8I9bfKLWp37uHgFrbntPvw==";
  };
  "acorn-jsx@5.3.2" = fetchurl {
    url = "https://registry.npmjs.org/acorn-jsx/-/acorn-jsx-5.3.2.tgz";
@@ -1701,9 +1701,9 @@
    url = "https://registry.npmjs.org/decode-named-character-reference/-/decode-named-character-reference-1.3.0.tgz";
    hash = "sha512-GtpQYB283KrPp6nRw50q3U9/VfOutZOe103qlN7BPP6Ad27xYnOIWv4lPzo8HCAL+mMZofJ9KEy30fq6MfaK6Q==";
  };
-  "defu@6.1.4" = fetchurl {
-    url = "https://registry.npmjs.org/defu/-/defu-6.1.4.tgz";
-    hash = "sha512-mEQCMmwJu317oSz8CwdIOdwf3xMif1ttiM8LTufzc3g6kR+9Pe236twL8j3IYT1F7GfRgGcW6MWxzZjLIkuHIg==";
+  "defu@6.1.7" = fetchurl {
+    url = "https://registry.npmjs.org/defu/-/defu-6.1.7.tgz";
+    hash = "sha512-7z22QmUWiQ/2d0KkdYmANbRUVABpZ9SNYyH5vx6PZ+nE5bcC0l7uFvEfHlyld/HcGBFTL536ClDt3DEcSlEJAQ==";
  };
  "depd@2.0.0" = fetchurl {
    url = "https://registry.npmjs.org/depd/-/depd-2.0.0.tgz";
@@ -1725,9 +1725,9 @@
    url = "https://registry.npmjs.org/detect-node-es/-/detect-node-es-1.1.0.tgz";
    hash = "sha512-ypdmJU/TbBby2Dxibuv7ZLW3Bs1QEmM7nHjEANfohJLvE0XVujisn1qPJcZxg+qDucsr+bP6fLD1rPS3AhJ7EQ==";
  };
-  "devalue@5.6.4" = fetchurl {
-    url = "https://registry.npmjs.org/devalue/-/devalue-5.6.4.tgz";
-    hash = "sha512-Gp6rDldRsFh/7XuouDbxMH3Mx8GMCcgzIb1pDTvNyn8pZGQ22u+Wa+lGV9dQCltFQ7uVw0MhRyb8XDskNFOReA==";
+  "devalue@5.8.1" = fetchurl {
+    url = "https://registry.npmjs.org/devalue/-/devalue-5.8.1.tgz";
+    hash = "sha512-4CXDYRBGqN+57wVJkuXBYmpAVUSg3L6JAQa/DFqm238G73E1wuyc/JhGQJzN7vUf/CMphYau2zXbfWzDR5aTEw==";
  };
  "devlop@1.1.0" = fetchurl {
    url = "https://registry.npmjs.org/devlop/-/devlop-1.1.0.tgz";
@@ -1773,9 +1773,9 @@
    url = "https://registry.npmjs.org/drizzle-kit/-/drizzle-kit-0.31.9.tgz";
    hash = "sha512-GViD3IgsXn7trFyBUUHyTFBpH/FsHTxYJ66qdbVggxef4UBPHRYxQaRzYLTuekYnk9i5FIEL9pbBIwMqX/Uwrg==";
  };
-  "drizzle-orm@0.45.1" = fetchurl {
-    url = "https://registry.npmjs.org/drizzle-orm/-/drizzle-orm-0.45.1.tgz";
-    hash = "sha512-Te0FOdKIistGNPMq2jscdqngBRfBpC8uMFVwqjf6gtTVJHIQ/dosgV/CLBU2N4ZJBsXL5savCba9b0YJskKdcA==";
+  "drizzle-orm@0.45.2" = fetchurl {
+    url = "https://registry.npmjs.org/drizzle-orm/-/drizzle-orm-0.45.2.tgz";
+    hash = "sha512-kY0BSaTNYWnoDMVoyY8uxmyHjpJW1geOmBMdSSicKo9CIIWkSxMIj2rkeSR51b8KAPB7m+qysjuHme5nKP+E5Q==";
  };
  "dset@3.1.4" = fetchurl {
    url = "https://registry.npmjs.org/dset/-/dset-3.1.4.tgz";
@@ -1909,17 +1909,17 @@
    url = "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz";
    hash = "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==";
  };
-  "fast-uri@3.1.0" = fetchurl {
-    url = "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.0.tgz";
-    hash = "sha512-iPeeDKJSWf4IEOasVVrknXpaBV0IApz/gp7S2bb7Z4Lljbl2MGJRqInZiUrQwV16cpzw/D3S5j5Julj/gT52AA==";
+  "fast-uri@3.1.2" = fetchurl {
+    url = "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.2.tgz";
+    hash = "sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==";
  };
-  "fast-xml-builder@1.1.3" = fetchurl {
-    url = "https://registry.npmjs.org/fast-xml-builder/-/fast-xml-builder-1.1.3.tgz";
-    hash = "sha512-1o60KoFw2+LWKQu3IdcfcFlGTW4dpqEWmjhYec6H82AYZU2TVBXep6tMl8Z1Y+wM+ZrzCwe3BZ9Vyd9N2rIvmg==";
+  "fast-xml-builder@1.2.0" = fetchurl {
+    url = "https://registry.npmjs.org/fast-xml-builder/-/fast-xml-builder-1.2.0.tgz";
+    hash = "sha512-00aAWieqff+ZJhsXA4g1g7M8k+7AYoMUUHF+/zFb5U6Uv/P0Vl4QZo84/IcufzYalLuEj9928bXN9PbbFzMF0Q==";
  };
-  "fast-xml-parser@5.5.5" = fetchurl {
-    url = "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.5.5.tgz";
-    hash = "sha512-NLY+V5NNbdmiEszx9n14mZBseJTC50bRq1VHsaxOmR72JDuZt+5J1Co+dC/4JPnyq+WrIHNM69r0sqf7BMb3Mg==";
+  "fast-xml-parser@5.5.6" = fetchurl {
+    url = "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.5.6.tgz";
+    hash = "sha512-3+fdZyBRVg29n4rXP0joHthhcHdPUHaIC16cuyyd1iLsuaO6Vea36MPrxgAzbZna8lhvZeRL8Bc9GP56/J9xEw==";
  };
  "fdir@6.5.0" = fetchurl {
    url = "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz";
@@ -2177,9 +2177,9 @@
    url = "https://registry.npmjs.org/kleur/-/kleur-4.1.5.tgz";
    hash = "sha512-o+NO+8WrRiQEE4/7nwRJhN1HWpVmJm511pBHUxPLtp0BUISzlBplORYSmTclCnJvQq2tKu/sgl3xVpkc7ZWuQQ==";
  };
-  "kysely@0.28.12" = fetchurl {
-    url = "https://registry.npmjs.org/kysely/-/kysely-0.28.12.tgz";
-    hash = "sha512-kWiueDWXhbCchgiotwXkwdxZE/6h56IHAeFWg4euUfW0YsmO9sxbAxzx1KLLv2lox15EfuuxHQvgJ1qIfZuHGw==";
+  "kysely@0.28.17" = fetchurl {
+    url = "https://registry.npmjs.org/kysely/-/kysely-0.28.17.tgz";
+    hash = "sha512-nbD8lB9EB3wNdMhOCdx5Li8DxnLbvKByylRLcJ1h+4SkrowVeECAyZlyiKMThF7xFdRz0jSQ2MoJr+wXux2y0Q==";
  };
  "lightningcss-android-arm64@1.31.1" = fetchurl {
    url = "https://registry.npmjs.org/lightningcss-android-arm64/-/lightningcss-android-arm64-1.31.1.tgz";
@@ -2305,9 +2305,9 @@
    url = "https://registry.npmjs.org/lodash.once/-/lodash.once-4.1.1.tgz";
    hash = "sha512-Sb487aTOCr9drQVL8pIxOzVhafOjZN9UU54hiN8PU3uAiSV7lx1yYNpbNmex2PK6dSJoNTSJUUswT651yww3Mg==";
  };
-  "lodash@4.17.21" = fetchurl {
-    url = "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz";
-    hash = "sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==";
+  "lodash@4.18.1" = fetchurl {
+    url = "https://registry.npmjs.org/lodash/-/lodash-4.18.1.tgz";
+    hash = "sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==";
  };
  "longest-streak@3.1.0" = fetchurl {
    url = "https://registry.npmjs.org/longest-streak/-/longest-streak-3.1.0.tgz";
@@ -2709,6 +2709,10 @@
    url = "https://registry.npmjs.org/path-expression-matcher/-/path-expression-matcher-1.1.3.tgz";
    hash = "sha512-qdVgY8KXmVdJZRSS1JdEPOKPdTiEK/pi0RkcT2sw1RhXxohdujUlJFPuS1TSkevZ9vzd3ZlL7ULl1MHGTApKzQ==";
  };
+  "path-expression-matcher@1.5.0" = fetchurl {
+    url = "https://registry.npmjs.org/path-expression-matcher/-/path-expression-matcher-1.5.0.tgz";
+    hash = "sha512-cbrerZV+6rvdQrrD+iGMcZFEiiSrbv9Tfdkvnusy6y0x0GKBXREFg/Y65GhIfm0tnLntThhzCnfKwp1WRjeCyQ==";
+  };
  "pathe@2.0.3" = fetchurl {
    url = "https://registry.npmjs.org/pathe/-/pathe-2.0.3.tgz";
    hash = "sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w==";
@@ -2721,13 +2725,9 @@
    url = "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz";
    hash = "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==";
  };
-  "picomatch@2.3.1" = fetchurl {
-    url = "https://registry.npmjs.org/picomatch/-/picomatch-2.3.1.tgz";
-    hash = "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==";
-  };
-  "picomatch@4.0.3" = fetchurl {
-    url = "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz";
-    hash = "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==";
+  "picomatch@4.0.4" = fetchurl {
+    url = "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz";
+    hash = "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==";
  };
  "playwright-core@1.58.2" = fetchurl {
    url = "https://registry.npmjs.org/playwright-core/-/playwright-core-1.58.2.tgz";
@@ -3421,6 +3421,10 @@
    url = "https://registry.npmjs.org/xml-name-validator/-/xml-name-validator-5.0.0.tgz";
    hash = "sha512-EvGK8EJ3DhaHfbRlETOWAS5pO9MZITeauHKJyb8wyajUfQUenkIg2MvLDTZ4T/TgIcm3HU0TFBgWWboAZ30UHg==";
  };
+  "xml-naming@0.1.0" = fetchurl {
+    url = "https://registry.npmjs.org/xml-naming/-/xml-naming-0.1.0.tgz";
+    hash = "sha512-k8KO9hrMyNk6tUWqUfkTEZbezRRpONVOzUTnc97VnCvyj6Tf9lyUR9EDAIeiVLv56jsMcoXEwjW8Kv5yPY52lw==";
+  };
  "xml@1.0.1" = fetchurl {
    url = "https://registry.npmjs.org/xml/-/xml-1.0.1.tgz";
    hash = "sha512-huCv9IH9Tcf95zuYCsQraZtWnJvBtLVE0QHMOs8bWyZAFZNDcYjsPq1nEx8jKA9y+Beo9v+7OBPRisQTjinQMw==";
@@ -3489,4 +3493,4 @@
    url = "https://registry.npmjs.org/zwitch/-/zwitch-2.0.4.tgz";
    hash = "sha512-bXE4cR/kVZhKZX/RjPEflHaKVhUVl85noU3v6b8apfQEc1x4A+zBxjZ4lN8LqGd6WZ3dl98pY4o717VFmoPp+A==";
  };
-}
+}
@@ -40,6 +40,7 @@ Essential application settings required for running Gitea Mirror.
 | `BETTER_AUTH_URL` | Authentication origin (scheme + host only, e.g. `https://git.example.com`). Do **not** include a path — any path is automatically stripped, and `BASE_URL` is applied separately. | `http://localhost:4321` | No |
 | `PUBLIC_BETTER_AUTH_URL` | Client-side auth origin for multi-origin access (same rule: origin only, no path). Set this to your primary domain when you need to access the app from different origins (e.g., both IP and domain). The client will use this URL for all auth requests instead of the current browser origin. | - | No |
 | `BETTER_AUTH_TRUSTED_ORIGINS` | Trusted origins for authentication requests. Comma-separated list of URLs. Use this to specify additional access URLs (e.g., local IP + domain: `http://10.10.20.45:4321,https://gitea-mirror.mydomain.tld`), SSO providers, reverse proxies, etc. | - | No |
+| `BETTER_AUTH_LOG_LEVEL` | Better Auth logger verbosity. Set to `debug` to surface the full SSO/OIDC sign-in and callback trace when troubleshooting authentication. Accepted values: `debug`, `info`, `warn`, `error`. (Better Auth does **not** use the `DEBUG` env var.) | `warn` | No |
 | `ENCRYPTION_SECRET` | Optional encryption key for tokens (generate with: `openssl rand -base64 48`) | - | No |

 ## HTTPS / TLS
@@ -113,7 +114,7 @@ Standard GitHub Enterprise Cloud on `github.com` works with the default — no o
 |----------|-------------|---------|---------|
 | `MIRROR_ORGANIZATIONS` | Mirror organization repositories | `false` | `true`, `false` |
 | `PRESERVE_ORG_STRUCTURE` | Preserve GitHub organization structure in Gitea | `false` | `true`, `false` |
-| `ONLY_MIRROR_ORGS` | Only mirror organization repos (skip personal) | `false` | `true`, `false` |
+| `ONLY_MIRROR_ORGS` | Only mirror organization repos (skip personal); sets `skipPersonalRepos: true` in GitHub config | `false` | `true`, `false` |
 | `MIRROR_STRATEGY` | Repository organization strategy | `preserve` | `preserve`, `single-org`, `flat-user`, `mixed` |

 ### Advanced Settings
@@ -4,15 +4,16 @@ This guide explains how to configure Single Sign-On (SSO) and OpenID Connect (OI

 ## Overview

-Gitea Mirror supports three authentication methods:
+Gitea Mirror supports four authentication methods:

 1. **Email & Password** - Traditional authentication (always enabled)
 2. **SSO (Single Sign-On)** - Allow users to authenticate using external OIDC providers
-3. **OIDC Provider** - Allow other applications to authenticate users through Gitea Mirror
+3. **Header / Forward Authentication** - Trust pre-authenticated requests from a reverse proxy (Authentik, Authelia, oauth2-proxy, etc.)
+4. **OIDC Provider** - Allow other applications to authenticate users through Gitea Mirror

 ## Configuration

-All SSO and OIDC settings are managed through the web UI in the Configuration page under the "Authentication" tab.
+SSO and OIDC Provider settings are managed through the web UI in the Configuration page under the "Authentication" tab. Header / Forward Authentication is configured via environment variables only — see [Setting up Header / Forward Authentication](#setting-up-header--forward-authentication) below.

 ## Setting up SSO (Single Sign-On)

@@ -27,7 +28,7 @@ SSO allows your users to sign in using external identity providers like Google,
 #### Required Fields

 - **Issuer URL**: The OIDC issuer URL (e.g., `https://accounts.google.com`)
- **Domain**: The email domain for this provider (e.g., `example.com`)
+- **Domain**: The email domain this provider serves (e.g., `example.com`). **This is load-bearing for account-linking trust — see [Account Linking](#account-linking) below.** Multi-domain IdPs can use a comma-separated list (`example.com,subsidiary.com`).
 - **Provider ID**: A unique identifier for this provider (e.g., `google-sso`)
 - **Client ID**: The OAuth client ID from your provider
 - **Client Secret**: The OAuth client secret from your provider
@@ -56,6 +57,22 @@ https://your-domain.com/api/auth/sso/callback/{provider-id}

 Replace `{provider-id}` with your chosen Provider ID.

+### Account Linking
+
+When a user signs in via SSO whose email matches an **existing** email/password account, Gitea Mirror will try to *link* the SSO identity to that account so the user lands on the same dashboard — instead of being bounced to the login page or creating a duplicate account.
+
+The trust model is **domain-scoped**:
+
+- Every SSO provider you register is automatically marked `domainVerified: true` for the **Domain** field you set on registration.
+- An SSO sign-in is auto-linked to an existing local account **only when** the user's email address actually belongs to that registered domain. Cross-domain emails are rejected even if the provider is registered.
+- Local email/password accounts in this app are never verified (no email-verification flow exists), so we deliberately turn off `requireLocalEmailVerified` on the linker — otherwise no one could ever link.
+
+**What this means for you:**
+
+- Set the **Domain** field to the email domain(s) your IdP actually issues identities for. Don't set it to `example.com` if your IdP issues `@elsewhere.com` emails — auto-linking will silently refuse them.
+- If your IdP allows users to self-register or claim arbitrary emails *within the registered domain*, an attacker on that IdP can absorb a local account by claiming the same email. This is a trust decision: by registering an IdP, you're vouching for its identity model for that domain.
+- Multi-domain IdPs (one Authentik serving `acme.com,acquired.io`) work fine — list every domain comma-separated in the **Domain** field.
+
 ### Example: Google SSO Setup

 1. Go to [Google Cloud Console](https://console.cloud.google.com/)
@@ -98,9 +115,80 @@ Working Authentik deployments (see [#134](https://github.com/RayLabsHQ/gitea-mir

 Notes:
 - Make sure `BETTER_AUTH_URL` and (if you serve the UI from multiple origins) `BETTER_AUTH_TRUSTED_ORIGINS` point at the public URL users reach. A mismatch can surface as 500 errors after redirect.
- Authentik must report the user’s email as verified (default behavior) so Gitea Mirror can auto-link accounts.
+- Set the **Domain** field to the email domain your Authentik users actually have. Auto-linking to an existing local admin only happens for emails in that domain — see [Account Linking](#account-linking) for the trust model. (Authentik's default email scope mapping returns `email_verified: False` for OIDC clients, which is why account linking is gated on the domain match here rather than the IdP's verified-email claim.)
 - If you created an Authentik provider before v3.8.10 you should delete it and re-add it after upgrading; older versions saved incomplete endpoint data which leads to the `url.startsWith` error explained in the Troubleshooting section.

+## Setting up Header / Forward Authentication
+
+Header authentication trusts a reverse proxy (Authentik, Authelia, oauth2-proxy, Traefik forward-auth, etc.) to authenticate users upstream and pass identity in HTTP headers. When enabled, Gitea Mirror reads the configured headers on each request and resolves the user automatically — no login form, no callback.
+
+> **Important — operator-controlled by design.** Header auth is configured via environment variables only, not the UI. This is intentional: trusting a header means trusting whatever upstream sets it, and that decision belongs to the operator who controls the reverse proxy, not to a logged-in user inside the app. Make sure your reverse proxy strips these headers from inbound client requests, otherwise anyone can spoof them.
+
+### Environment variables
+
+| Variable | Description | Default |
+|----------|-------------|---------|
+| `HEADER_AUTH_ENABLED` | Master switch — must be `true` to enable | `false` |
+| `HEADER_AUTH_USER_HEADER` | Header containing the username | `X-Authentik-Username` |
+| `HEADER_AUTH_EMAIL_HEADER` | Header containing the email address | `X-Authentik-Email` |
+| `HEADER_AUTH_NAME_HEADER` | Header containing the display name | `X-Authentik-Name` |
+| `HEADER_AUTH_AUTO_PROVISION` | If `true`, create a new user when an unknown username arrives. If `false`, unknown users are rejected. | `false` |
+| `HEADER_AUTH_ALLOWED_DOMAINS` | Comma-separated email domain allowlist. Empty = allow any. | _(empty)_ |
+
+See also: [`docs/ENVIRONMENT_VARIABLES.md`](./ENVIRONMENT_VARIABLES.md#header-authentication-reverse-proxy-sso).
+
+### Example: Docker Compose with Authentik
+
+```yaml
+services:
+  gitea-mirror:
+    image: ghcr.io/raylabshq/gitea-mirror:latest
+    environment:
+      HEADER_AUTH_ENABLED: "true"
+      HEADER_AUTH_USER_HEADER: "X-Authentik-Username"
+      HEADER_AUTH_EMAIL_HEADER: "X-Authentik-Email"
+      HEADER_AUTH_NAME_HEADER: "X-Authentik-Name"
+      HEADER_AUTH_AUTO_PROVISION: "true"
+      HEADER_AUTH_ALLOWED_DOMAINS: "example.com,example.org"
+```
+
+The defaults are Authentik-shaped, so for an Authentik proxy provider you generally only need to set `HEADER_AUTH_ENABLED=true` (and `HEADER_AUTH_AUTO_PROVISION=true` if you want first-login self-registration).
+
+### Example: Authelia
+
+Authelia uses different header names — override them:
+
+```yaml
+environment:
+  HEADER_AUTH_ENABLED: "true"
+  HEADER_AUTH_USER_HEADER: "Remote-User"
+  HEADER_AUTH_EMAIL_HEADER: "Remote-Email"
+  HEADER_AUTH_NAME_HEADER: "Remote-Name"
+  HEADER_AUTH_AUTO_PROVISION: "true"
+```
+
+Then configure Authelia's `authz` rules to protect the gitea-mirror route and inject the `Remote-*` headers.
+
+### Behaviour and lookup order
+
+- The middleware checks for a cookie session **first**. Header auth only fires when there is no existing session, so users who logged in via password or SSO are not affected.
+- Lookup is by `HEADER_AUTH_USER_HEADER` value matched against `users.username`; if no match and `HEADER_AUTH_EMAIL_HEADER` is set, a second lookup is tried against `users.email`.
+- If neither matches:
+  - With `HEADER_AUTH_AUTO_PROVISION=true`, a new user row is created (email defaults to `<username>@header-auth.local` if no email header is present).
+  - With `HEADER_AUTH_AUTO_PROVISION=false`, the request is rejected with a warning logged.
+- If `HEADER_AUTH_ALLOWED_DOMAINS` is non-empty and the email header arrives, the email's domain must be in the list or the request is rejected.
+
+### Verifying it's enabled
+
+When header auth is active, the Authentication settings page renders a green "Header Authentication / Via reverse proxy" badge under the auth-methods status block. You can also probe `/api/auth/header-status`, which returns `{ "enabled": true, ... }` once the env vars are set.
+
+### Security checklist
+
+1. **Strip the headers at your edge.** Your reverse proxy must remove inbound `HEADER_AUTH_USER_HEADER` / email / name headers from client requests before re-injecting its own. Otherwise any unauthenticated client can set `X-Authentik-Username: admin` and walk in.
+2. **Bind the app to the proxy only.** Don't expose Gitea Mirror's port directly to the network when header auth is on; only the trusted proxy should reach it.
+3. **Use HTTPS between proxy and clients.** Headers travel in plaintext on the link they cross.
+4. **Be conservative with `HEADER_AUTH_AUTO_PROVISION`.** With it off, you provision users in the UI/DB once and the proxy fills in sessions thereafter — safer for shared deployments.
+
 ## Setting up OIDC Provider

 The OIDC Provider feature allows other applications to use Gitea Mirror as their authentication provider.
@@ -185,7 +273,8 @@ When an application requests authentication:
 1. **"Invalid origin" error**: Check that your Gitea Mirror URL matches the configured redirect URI
 2. **"Provider not found" error**: Ensure the provider is properly configured and enabled
 3. **Redirect loop**: Verify the redirect URI in both Gitea Mirror and the SSO provider match exactly
-4. **`TypeError: undefined is not an object (evaluating 'url.startsWith')`**: This indicates the stored provider configuration is missing OIDC endpoints. Delete the provider from Gitea Mirror and re-register it using the **Discover** button so authorization/token URLs are saved (see [#73](https://github.com/RayLabsHQ/gitea-mirror/issues/73) and [#122](https://github.com/RayLabsHQ/gitea-mirror/issues/122) for examples).
+4. **`?error=UNKNOWN` on the homepage after a successful upstream login** (or `?error=account%20not%20linked` in development): the SSO callback succeeded but Better Auth refused to link the SSO identity to an existing local account. The most common cause is the SSO provider's registered **Domain** not matching the user's actual email domain — see [Account Linking](#account-linking). Set `BETTER_AUTH_LOG_LEVEL=debug` to see Better Auth's full callback trace (look for "User already exist but account isn't linked to ...") and confirm the diagnosis. The same symptom in production gets sanitized to `UNKNOWN` by Better Auth's error page before the redirect, which is why the visible error is opaque.
+5. **`TypeError: undefined is not an object (evaluating 'url.startsWith')`**: This indicates the stored provider configuration is missing OIDC endpoints. Delete the provider from Gitea Mirror and re-register it using the **Discover** button so authorization/token URLs are saved (see [#73](https://github.com/RayLabsHQ/gitea-mirror/issues/73) and [#122](https://github.com/RayLabsHQ/gitea-mirror/issues/122) for examples).

 ### OIDC Provider Issues

@@ -125,11 +125,59 @@ npm start

 ### Debug Mode:

-Enable debug logging by setting environment variable:
+> **Note:** Better Auth uses its own logger and does **not** read the `DEBUG`
+> environment variable (it is not based on the `debug` npm package). An older
+> version of this guide suggested `DEBUG=better-auth:*` — that has no effect.
+
+Better Auth's logger defaults to the `warn` level, so SSO/OIDC sign-in and
+callback details are hidden. Set the log level to `debug` to surface the full
+trace:
+
 ```bash
-DEBUG=better-auth:* bun run dev
+# Local dev
+BETTER_AUTH_LOG_LEVEL=debug bun run dev
 ```

+```yaml
+# Docker Compose
+services:
+  gitea-mirror:
+    environment:
+      - BETTER_AUTH_LOG_LEVEL=debug
+```
+
+Then watch the server logs (e.g. `docker compose logs -f gitea-mirror`) while you
+attempt an SSO login. Lines are prefixed with `[Better Auth]:`. Accepted values
+are `debug`, `info`, `warn`, and `error`.
+
+#### Debugging a login that bounces back to `/login`
+
+If clicking the SSO button sends you to the provider and then straight back to
+the login screen, the OAuth flow itself usually succeeded but **no session
+cookie was persisted**. Work through these checks:
+
+1. **Enable `BETTER_AUTH_LOG_LEVEL=debug`** (above) and look for errors during
+   the `/api/auth/sso/callback/<provider-id>` request.
+2. **Check for `?error=UNKNOWN` on the landing URL** (or `?error=account%20not%20linked` in dev).
+   That's Better Auth's account-linking step refusing to attach the SSO identity
+   to an existing email/password account. The debug log line to look for is
+   `User already exist but account isn't linked to <providerId>`. The fix is
+   almost always to set the SSO provider's **Domain** field to the email domain
+   your users actually have — auto-linking is gated on that domain match.
+   See [docs/SSO-OIDC-SETUP.md#account-linking](./SSO-OIDC-SETUP.md#account-linking).
+3. **Check the redirect URI** registered in your IdP exactly matches
+   `https://<your-domain>/api/auth/sso/callback/<provider-id>` (scheme, host,
+   and provider ID — no trailing slash).
+4. **Confirm the session cookie is set.** In the browser DevTools → Network,
+   inspect the callback response for a `Set-Cookie: better-auth-session=…`
+   header, and DevTools → Application → Cookies for the stored cookie. Behind a
+   reverse proxy, ensure `BETTER_AUTH_URL` is your **external HTTPS** URL so the
+   cookie is issued with the correct domain and `Secure` flag, and that the
+   proxy forwards `X-Forwarded-Proto: https` and `X-Forwarded-Host`.
+5. **A `401` on `/api/sso/applications` is unrelated** to client login — that
+   endpoint backs the OAuth *provider* (consent) management UI and requires an
+   existing session. It is not part of the Authentik/OIDC sign-in flow.
+
 ## Testing Different Scenarios

 ### 1. New User Registration
@@ -0,0 +1,126 @@
+-- Migrate the OAuth/OIDC *provider* feature from the deprecated
+-- `oidc-provider` plugin to `@better-auth/oauth-provider`.
+--
+-- Tables: oauth_applications -> oauth_clients, oauth_access_tokens reshaped,
+-- new oauth_refresh_tokens, oauth_consent -> oauth_consents, plus a `jwks`
+-- table for the `jwt` plugin (id_token signing keys).
+--
+-- Data preservation:
+--   * Registered clients are copied from oauth_applications into oauth_clients,
+--     converting the legacy comma-separated `redirect_urls` into the JSON
+--     string[] (`redirect_uris`) the new adapter expects.
+--   * Access tokens and consent records are NOT migrated: access tokens are
+--     short-lived (and the column shape changed entirely), and consents are
+--     cheaply re-granted on next authorization. Both old tables are dropped.
+--
+-- NOTE: legacy client secrets were stored in plaintext, whereas the new
+-- provider stores them hashed. Migrated client secrets will therefore not
+-- validate as-is — affected applications must rotate their secret after
+-- upgrade.
+
+CREATE TABLE `oauth_clients` (
+	`id` text PRIMARY KEY NOT NULL,
+	`client_id` text NOT NULL,
+	`client_secret` text,
+	`name` text,
+	`disabled` integer DEFAULT false,
+	`skip_consent` integer,
+	`enable_end_session` integer,
+	`subject_type` text,
+	`scopes` text,
+	`user_id` text,
+	`uri` text,
+	`icon` text,
+	`contacts` text,
+	`tos` text,
+	`policy` text,
+	`software_id` text,
+	`software_version` text,
+	`software_statement` text,
+	`redirect_uris` text NOT NULL,
+	`post_logout_redirect_uris` text,
+	`token_endpoint_auth_method` text,
+	`grant_types` text,
+	`response_types` text,
+	`public` integer,
+	`type` text,
+	`require_pkce` integer,
+	`reference_id` text,
+	`metadata` text,
+	`created_at` integer DEFAULT (unixepoch()),
+	`updated_at` integer DEFAULT (unixepoch()),
+	FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON UPDATE no action ON DELETE no action
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `oauth_clients_client_id_unique` ON `oauth_clients` (`client_id`);--> statement-breakpoint
+CREATE INDEX `idx_oauth_clients_client_id` ON `oauth_clients` (`client_id`);--> statement-breakpoint
+CREATE INDEX `idx_oauth_clients_user_id` ON `oauth_clients` (`user_id`);--> statement-breakpoint
+INSERT INTO `oauth_clients` (
+	`id`, `client_id`, `client_secret`, `name`, `disabled`, `user_id`,
+	`redirect_uris`, `type`, `metadata`, `created_at`, `updated_at`
+)
+SELECT
+	`id`, `client_id`, `client_secret`, `name`, `disabled`, `user_id`,
+	'["' || replace(`redirect_urls`, ',', '","') || '"]',
+	`type`, `metadata`, `created_at`, `updated_at`
+FROM `oauth_applications`;--> statement-breakpoint
+DROP TABLE `oauth_applications`;--> statement-breakpoint
+DROP TABLE `oauth_access_tokens`;--> statement-breakpoint
+CREATE TABLE `oauth_access_tokens` (
+	`id` text PRIMARY KEY NOT NULL,
+	`token` text,
+	`client_id` text NOT NULL,
+	`session_id` text,
+	`user_id` text,
+	`reference_id` text,
+	`refresh_id` text,
+	`expires_at` integer,
+	`created_at` integer DEFAULT (unixepoch()),
+	`scopes` text NOT NULL,
+	FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON UPDATE no action ON DELETE no action
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `oauth_access_tokens_token_unique` ON `oauth_access_tokens` (`token`);--> statement-breakpoint
+CREATE INDEX `idx_oauth_access_tokens_token` ON `oauth_access_tokens` (`token`);--> statement-breakpoint
+CREATE INDEX `idx_oauth_access_tokens_client_id` ON `oauth_access_tokens` (`client_id`);--> statement-breakpoint
+CREATE INDEX `idx_oauth_access_tokens_user_id` ON `oauth_access_tokens` (`user_id`);--> statement-breakpoint
+CREATE TABLE `oauth_refresh_tokens` (
+	`id` text PRIMARY KEY NOT NULL,
+	`token` text NOT NULL,
+	`client_id` text NOT NULL,
+	`session_id` text,
+	`user_id` text NOT NULL,
+	`reference_id` text,
+	`expires_at` integer,
+	`created_at` integer DEFAULT (unixepoch()),
+	`revoked` integer,
+	`auth_time` integer,
+	`scopes` text NOT NULL,
+	FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON UPDATE no action ON DELETE no action
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `oauth_refresh_tokens_token_unique` ON `oauth_refresh_tokens` (`token`);--> statement-breakpoint
+CREATE INDEX `idx_oauth_refresh_tokens_token` ON `oauth_refresh_tokens` (`token`);--> statement-breakpoint
+CREATE INDEX `idx_oauth_refresh_tokens_client_id` ON `oauth_refresh_tokens` (`client_id`);--> statement-breakpoint
+CREATE INDEX `idx_oauth_refresh_tokens_user_id` ON `oauth_refresh_tokens` (`user_id`);--> statement-breakpoint
+DROP TABLE `oauth_consent`;--> statement-breakpoint
+CREATE TABLE `oauth_consents` (
+	`id` text PRIMARY KEY NOT NULL,
+	`client_id` text NOT NULL,
+	`user_id` text,
+	`reference_id` text,
+	`scopes` text NOT NULL,
+	`created_at` integer DEFAULT (unixepoch()),
+	`updated_at` integer DEFAULT (unixepoch()),
+	FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON UPDATE no action ON DELETE no action
+);
+--> statement-breakpoint
+CREATE INDEX `idx_oauth_consents_client_id` ON `oauth_consents` (`client_id`);--> statement-breakpoint
+CREATE INDEX `idx_oauth_consents_user_id` ON `oauth_consents` (`user_id`);--> statement-breakpoint
+CREATE TABLE `jwks` (
+	`id` text PRIMARY KEY NOT NULL,
+	`public_key` text NOT NULL,
+	`private_key` text NOT NULL,
+	`created_at` integer DEFAULT (unixepoch()) NOT NULL,
+	`expires_at` integer
+);
@@ -0,0 +1,35 @@
+PRAGMA foreign_keys=OFF;--> statement-breakpoint
+CREATE TABLE `__new_organizations` (
+	`id` text PRIMARY KEY NOT NULL,
+	`user_id` text NOT NULL,
+	`config_id` text NOT NULL,
+	`name` text NOT NULL,
+	`normalized_name` text NOT NULL,
+	`avatar_url` text NOT NULL,
+	`membership_role` text DEFAULT 'member' NOT NULL,
+	`is_included` integer DEFAULT true NOT NULL,
+	`destination_org` text,
+	`status` text DEFAULT 'imported' NOT NULL,
+	`last_mirrored` integer,
+	`error_message` text,
+	`repository_count` integer DEFAULT 0 NOT NULL,
+	`public_repository_count` integer,
+	`private_repository_count` integer,
+	`fork_repository_count` integer,
+	`created_at` integer DEFAULT (unixepoch()) NOT NULL,
+	`updated_at` integer DEFAULT (unixepoch()) NOT NULL,
+	FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON UPDATE no action ON DELETE no action,
+	FOREIGN KEY (`config_id`) REFERENCES `configs`(`id`) ON UPDATE no action ON DELETE no action
+);
+--> statement-breakpoint
+INSERT INTO `__new_organizations`("id", "user_id", "config_id", "name", "normalized_name", "avatar_url", "membership_role", "is_included", "destination_org", "status", "last_mirrored", "error_message", "repository_count", "public_repository_count", "private_repository_count", "fork_repository_count", "created_at", "updated_at") SELECT "id", "user_id", "config_id", "name", "normalized_name", "avatar_url", "membership_role", "is_included", "destination_org", "status", "last_mirrored", "error_message", "repository_count", "public_repository_count", "private_repository_count", "fork_repository_count", "created_at", "updated_at" FROM `organizations`;--> statement-breakpoint
+DROP TABLE `organizations`;--> statement-breakpoint
+ALTER TABLE `__new_organizations` RENAME TO `organizations`;--> statement-breakpoint
+PRAGMA foreign_keys=ON;--> statement-breakpoint
+CREATE INDEX `idx_organizations_user_id` ON `organizations` (`user_id`);--> statement-breakpoint
+CREATE INDEX `idx_organizations_config_id` ON `organizations` (`config_id`);--> statement-breakpoint
+CREATE INDEX `idx_organizations_status` ON `organizations` (`status`);--> statement-breakpoint
+CREATE INDEX `idx_organizations_is_included` ON `organizations` (`is_included`);--> statement-breakpoint
+CREATE UNIQUE INDEX `uniq_organizations_user_normalized_name` ON `organizations` (`user_id`,`normalized_name`);--> statement-breakpoint
+ALTER TABLE `sso_providers` ADD `saml_config` text;--> statement-breakpoint
+ALTER TABLE `sso_providers` ADD `domain_verified` integer DEFAULT true NOT NULL;
@@ -85,6 +85,20 @@
      "when": 1774058400000,
      "tag": "0011_notification_config",
      "breakpoints": true
+    },
+    {
+      "idx": 12,
+      "version": "6",
+      "when": 1774062000000,
+      "tag": "0012_oauth_provider_migration",
+      "breakpoints": true
+    },
+    {
+      "idx": 13,
+      "version": "6",
+      "when": 1780377747526,
+      "tag": "0013_slim_galactus",
+      "breakpoints": true
    }
  ]
-}
+}
@@ -1,7 +1,7 @@
 {
  "name": "gitea-mirror",
  "type": "module",
-  "version": "3.16.0",
+  "version": "3.19.0",
  "engines": {
    "bun": ">=1.2.9"
  },
@@ -58,7 +58,8 @@
    "@astrojs/mdx": "5.0.0",
    "@astrojs/node": "10.0.1",
    "@astrojs/react": "^5.0.0",
-    "@better-auth/sso": "1.5.5",
+    "@better-auth/oauth-provider": "1.6.11",
+    "@better-auth/sso": "1.6.11",
    "@octokit/plugin-throttling": "^11.0.3",
    "@octokit/rest": "^22.0.1",
    "@radix-ui/react-accordion": "^1.2.12",
@@ -87,7 +88,7 @@
    "@types/react-dom": "^19.2.3",
    "astro": "^6.0.4",
    "bcryptjs": "^3.0.3",
-    "better-auth": "1.5.5",
+    "better-auth": "1.6.11",
    "buffer": "^6.0.3",
    "canvas-confetti": "^1.9.4",
    "class-variance-authority": "^0.7.1",
@@ -3,6 +3,10 @@
 import { Database } from "bun:sqlite";
 import { readFileSync } from "fs";
 import path from "path";
+import {
+  repairDuplicateSsoColumns,
+  restoreSsoDataAfter0013,
+} from "../src/lib/db/migration-repairs";

 type JournalEntry = {
  idx: number;
@@ -188,6 +192,202 @@ function verify0011Migration(db: any) {
  assert(parsed.provider === "ntfy", "Expected default notification_config.provider to be 'ntfy'");
 }

+function seedPre0012Database(db: any) {
+  // The harness has already run migrations 0000-0011, so the legacy
+  // oidc-provider tables exist. Seed a registered client (with the legacy
+  // comma-separated redirect_urls format) plus the related token/consent rows
+  // to exercise the create/transform/drop paths in 0012.
+  db.run("INSERT INTO users (id, email, username, name) VALUES ('u1', 'u1@example.com', 'user1', 'User One')");
+  db.run("INSERT INTO oauth_applications (id, client_id, client_secret, name, redirect_urls, type, disabled, user_id) VALUES ('app1', 'client-1', 'secret-1', 'Example App', 'https://example.com/callback,https://example.com/cb2', 'web', false, 'u1')");
+  db.run("INSERT INTO oauth_access_tokens (id, access_token, refresh_token, access_token_expires_at, refresh_token_expires_at, client_id, user_id, scopes) VALUES ('oat1', 'tok', 'rtok', 7000, 8000, 'client-1', 'u1', '[\"repo\"]')");
+  db.run("INSERT INTO oauth_consent (id, user_id, client_id, scopes, consent_given) VALUES ('cons1', 'u1', 'client-1', '[\"repo\"]', true)");
+}
+
+function verify0012Migration(db: any) {
+  // Old provider tables are dropped.
+  for (const table of ["oauth_applications", "oauth_consent"]) {
+    const row = db
+      .query("SELECT name FROM sqlite_master WHERE type='table' AND name = ?")
+      .get(table) as { name: string } | null;
+    assert(!row, `Expected ${table} table to be dropped after migration`);
+  }
+
+  // New provider tables exist.
+  for (const table of ["oauth_clients", "oauth_access_tokens", "oauth_refresh_tokens", "oauth_consents", "jwks"]) {
+    const row = db
+      .query("SELECT name FROM sqlite_master WHERE type='table' AND name = ?")
+      .get(table) as { name: string } | null;
+    assert(row, `Expected ${table} table to exist after migration`);
+  }
+
+  // The registered client is preserved and its redirect URIs converted from
+  // the legacy comma-separated string into a JSON string[].
+  const client = db
+    .query("SELECT client_id, client_secret, name, redirect_uris, type, user_id FROM oauth_clients WHERE id = 'app1'")
+    .get() as { client_id: string; client_secret: string; name: string; redirect_uris: string; type: string; user_id: string } | null;
+  assert(client, "Expected migrated oauth_clients row for app1");
+  assert(client.client_id === "client-1", "Expected client_id to be preserved");
+  assert(client.name === "Example App", "Expected client name to be preserved");
+  assert(client.user_id === "u1", "Expected owner user_id to be preserved");
+
+  const uris = JSON.parse(client.redirect_uris);
+  assert(
+    Array.isArray(uris) && uris.length === 2 && uris[0] === "https://example.com/callback" && uris[1] === "https://example.com/cb2",
+    `Expected redirect_uris to be a JSON array of the two callbacks, got ${client.redirect_uris}`,
+  );
+
+  // The reshaped tables accept the new column layout.
+  db.run("INSERT INTO oauth_clients (id, client_id, redirect_uris) VALUES ('app2', 'client-2', '[\"https://example.com/cb\"]')");
+  db.run("INSERT INTO oauth_refresh_tokens (id, token, client_id, user_id, scopes) VALUES ('rt1', 'refresh-1', 'client-2', 'u1', '[\"openid\"]')");
+  db.run("INSERT INTO oauth_access_tokens (id, token, client_id, user_id, scopes) VALUES ('at1', 'access-1', 'client-2', 'u1', '[\"openid\"]')");
+  db.run("INSERT INTO oauth_consents (id, client_id, user_id, scopes) VALUES ('co1', 'client-2', 'u1', '[\"openid\"]')");
+  db.run("INSERT INTO jwks (id, public_key, private_key) VALUES ('jwk1', 'public', 'private')");
+}
+
+function seedPre0013Database(db: any) {
+  // Migrations 0000-0012 have run, so sso_providers lacks samlConfig /
+  // domainVerified and the organizations table still carries the inherited
+  // DEFAULT '' on normalized_name from 0007. Seed both so the table-rebuild
+  // and the column-adds can be verified end-to-end.
+  db.run("INSERT INTO users (id, email, username, name) VALUES ('u-sso', 'sso@example.com', 'sso', 'SSO User')");
+  db.run("INSERT INTO configs (id, user_id, name, is_active, github_config, gitea_config, schedule_config, cleanup_config) VALUES ('cfg-pre13', 'u-sso', 'Default', 1, '{}', '{}', '{}', '{}')");
+  db.run("INSERT INTO sso_providers (id, issuer, domain, oidc_config, user_id, provider_id) VALUES ('sso-pre13', 'https://idp.example.com', 'example.com', '{\"clientId\":\"x\"}', 'u-sso', 'idp-pre13')");
+  db.run("INSERT INTO organizations (id, user_id, config_id, name, avatar_url, normalized_name) VALUES ('org-pre13', 'u-sso', 'cfg-pre13', 'Example', 'https://example.com/a.png', 'example')");
+}
+
+function verify0013Migration(db: any) {
+  // New columns on sso_providers.
+  const ssoCols = db
+    .query("PRAGMA table_info(sso_providers)")
+    .all() as Array<{ name: string; notnull: number; dflt_value: string | null }>;
+  const saml = ssoCols.find((c) => c.name === "saml_config");
+  const domainVerified = ssoCols.find((c) => c.name === "domain_verified");
+  assert(saml, "Expected sso_providers.saml_config column to exist");
+  assert(saml.notnull === 0, "Expected saml_config to be nullable");
+  assert(domainVerified, "Expected sso_providers.domain_verified column to exist");
+  assert(domainVerified.notnull === 1, "Expected domain_verified to be NOT NULL");
+  assert(
+    domainVerified.dflt_value === "true",
+    `Expected domain_verified DEFAULT true, got ${domainVerified.dflt_value}`,
+  );
+
+  // Pre-existing SSO row picked up the default (1 = true) on domain_verified.
+  const ssoRow = db
+    .query("SELECT provider_id, saml_config, domain_verified FROM sso_providers WHERE id = 'sso-pre13'")
+    .get() as { provider_id: string; saml_config: string | null; domain_verified: number } | null;
+  assert(ssoRow, "Expected pre-existing OIDC provider row to survive migration");
+  assert(ssoRow.saml_config === null, `Expected saml_config NULL, got ${ssoRow.saml_config}`);
+  assert(ssoRow.domain_verified === 1, `Expected domain_verified=1, got ${ssoRow.domain_verified}`);
+
+  // Organizations rebuild preserved the seeded row and dropped the inherited
+  // DEFAULT '' on normalized_name (drizzle reconciles to schema.ts).
+  const orgRow = db
+    .query("SELECT id, normalized_name FROM organizations WHERE id = 'org-pre13'")
+    .get() as { id: string; normalized_name: string } | null;
+  assert(orgRow, "Expected pre-existing organization row to survive table rebuild");
+  assert(orgRow.normalized_name === "example", `Expected organization normalized_name preserved, got ${orgRow.normalized_name}`);
+  const orgCols = db
+    .query("PRAGMA table_info(organizations)")
+    .all() as Array<{ name: string; dflt_value: string | null }>;
+  const normName = orgCols.find((c) => c.name === "normalized_name");
+  assert(normName, "Expected organizations.normalized_name column to exist");
+  assert(normName.dflt_value === null, `Expected normalized_name to have no default, got ${normName.dflt_value}`);
+}
+
+const MIGRATION_0012_TIMESTAMP = 1774062000000;
+const MIGRATION_0013_TIMESTAMP = 1780377747526;
+
+/**
+ * Reproduce the issue #312 crash state — sso_providers already carries
+ * saml_config / domain_verified before migration 0013 runs (stranded on an
+ * intermediate build), with __drizzle_migrations recorded only through 0012 —
+ * and verify repairDuplicateSsoColumns()/restoreSsoDataAfter0013() let the
+ * canonical 0013 run while preserving real SAML provider data.
+ */
+function validateBroken0013Repair() {
+  const migration0013 = migrations.find((m) => m.entry.tag === "0013_slim_galactus");
+  if (!migration0013) return; // 0013 not present (shouldn't happen) — nothing to test.
+
+  const db = new Database(":memory:");
+  try {
+    runMigrations(db, migrations.slice(0, 13)); // 0000-0012
+
+    // A real upgraded instance has a __drizzle_migrations table recorded
+    // through 0012 but not 0013.
+    db.run(
+      "CREATE TABLE IF NOT EXISTS `__drizzle_migrations` (id INTEGER PRIMARY KEY AUTOINCREMENT, hash text NOT NULL, created_at numeric)",
+    );
+    db.run("INSERT INTO `__drizzle_migrations` (hash, created_at) VALUES ('through-0012', ?)", [
+      MIGRATION_0012_TIMESTAMP,
+    ]);
+
+    // Stranded columns from the intermediate build.
+    db.run("ALTER TABLE sso_providers ADD saml_config text");
+    db.run("ALTER TABLE sso_providers ADD domain_verified integer DEFAULT true NOT NULL");
+
+    db.run("INSERT INTO users (id, email, username, name) VALUES ('u1', 'u1@example.com', 'u1', 'User One')");
+    const samlJson = '{"entryPoint":"https://idp.example.com/sso","cert":"ABC123"}';
+    db.run(
+      "INSERT INTO sso_providers (id, issuer, domain, oidc_config, user_id, provider_id, saml_config, domain_verified) VALUES ('oidc1', 'https://idp', 'a.com', '{}', 'u1', 'p-oidc', NULL, 1)",
+    );
+    db.run(
+      "INSERT INTO sso_providers (id, issuer, domain, oidc_config, user_id, provider_id, saml_config, domain_verified) VALUES ('saml1', 'https://idp', 'b.com', '{}', 'u1', 'p-saml', ?, 1)",
+      [samlJson],
+    );
+    db.run(
+      "INSERT INTO sso_providers (id, issuer, domain, oidc_config, user_id, provider_id, saml_config, domain_verified) VALUES ('unv1', 'https://idp', 'c.com', '{}', 'u1', 'p-unv', NULL, 0)",
+    );
+
+    const preserved = repairDuplicateSsoColumns(db);
+
+    const colsAfterRepair = (db.query("PRAGMA table_info(sso_providers)").all() as TableInfoRow[]).map(
+      (c) => c.name,
+    );
+    assert(!colsAfterRepair.includes("saml_config"), "Expected repair to drop stranded saml_config column");
+    assert(
+      !colsAfterRepair.includes("domain_verified"),
+      "Expected repair to drop stranded domain_verified column",
+    );
+    const preservedIds = preserved.map((r) => r.id).sort();
+    assert(
+      preservedIds.length === 2 && preservedIds[0] === "saml1" && preservedIds[1] === "unv1",
+      `Expected SAML + unverified rows to be preserved, got ${JSON.stringify(preservedIds)}`,
+    );
+
+    // The canonical 0013 must now run without a duplicate-column error.
+    runMigration(db, migration0013);
+    restoreSsoDataAfter0013(db, preserved);
+
+    const rows = db
+      .query("SELECT id, saml_config, domain_verified FROM sso_providers ORDER BY id")
+      .all() as Array<{ id: string; saml_config: string | null; domain_verified: number }>;
+    const byId = Object.fromEntries(rows.map((r) => [r.id, r]));
+
+    assert(byId.oidc1.saml_config === null, "Expected OIDC provider saml_config to remain NULL");
+    assert(byId.oidc1.domain_verified === 1, "Expected OIDC provider domain_verified default 1");
+    assert(byId.saml1.saml_config === samlJson, "Expected SAML provider config to be preserved");
+    assert(byId.saml1.domain_verified === 1, "Expected SAML provider domain_verified preserved as 1");
+    assert(byId.unv1.saml_config === null, "Expected unverified provider saml_config NULL");
+    assert(byId.unv1.domain_verified === 0, "Expected explicit domain_verified=0 to be preserved");
+
+    // Idempotency: 0013 is now applied, so a re-run of the repair is a no-op.
+    db.run("INSERT INTO `__drizzle_migrations` (hash, created_at) VALUES ('through-0013', ?)", [
+      MIGRATION_0013_TIMESTAMP,
+    ]);
+    const secondPass = repairDuplicateSsoColumns(db);
+    assert(secondPass.length === 0, "Expected repair to no-op once migration 0013 is recorded");
+    const colsAfterSecondPass = (
+      db.query("PRAGMA table_info(sso_providers)").all() as TableInfoRow[]
+    ).map((c) => c.name);
+    assert(
+      colsAfterSecondPass.includes("saml_config") && colsAfterSecondPass.includes("domain_verified"),
+      "Expected columns to remain intact on the no-op second pass",
+    );
+  } finally {
+    db.close();
+  }
+}
+
 const latestUpgradeFixtures: Record<string, UpgradeFixture> = {
  "0009_nervous_tyger_tiger": {
    seed: seedPre0009Database,
@@ -201,6 +401,14 @@ const latestUpgradeFixtures: Record<string, UpgradeFixture> = {
    seed: seedPre0011Database,
    verify: verify0011Migration,
  },
+  "0012_oauth_provider_migration": {
+    seed: seedPre0012Database,
+    verify: verify0012Migration,
+  },
+  "0013_slim_galactus": {
+    seed: seedPre0013Database,
+    verify: verify0013Migration,
+  },
 };

 function lintMigrations(selectedMigrations: Migration[]) {
@@ -251,8 +459,11 @@ function validateMigrations() {
    upgradeDb.close();
  }

+  // Exercise the runtime repair for the issue #312 duplicate-column crash.
+  validateBroken0013Repair();
+
  console.log(
-    `Validated ${migrations.length} migrations from scratch and upgrade path for ${latestMigration.entry.tag}.`,
+    `Validated ${migrations.length} migrations from scratch and upgrade path for ${latestMigration.entry.tag}, plus the #312 SSO-column repair.`,
  );
 }

@@ -1,6 +1,6 @@
 import { useCallback, useEffect, useState, useRef } from 'react';
 import { Button } from '@/components/ui/button';
-import { ChevronDown, Download, RefreshCw, Search, Trash2, Filter } from 'lucide-react';
+import { ChevronDown, Download, RefreshCw, Search, Trash2, Filter, StopCircle } from 'lucide-react';
 import {
  DropdownMenu,
  DropdownMenuContent,
@@ -85,6 +85,8 @@ export function ActivityLog() {
  const [activities, setActivities] = useState<MirrorJobWithKey[]>([]);
  const [isInitialLoading, setIsInitialLoading] = useState(false);
  const [showCleanupDialog, setShowCleanupDialog] = useState(false);
+  const [showCancelPendingDialog, setShowCancelPendingDialog] = useState(false);
+  const [isCancelPendingLoading, setIsCancelPendingLoading] = useState(false);

  // Ref to track if component is mounted to prevent state updates after unmount
  const isMountedRef = useRef(true);
@@ -354,6 +356,40 @@ export function ActivityLog() {
    setShowCleanupDialog(false);
  };

+  const confirmCancelPending = async () => {
+    if (!user?.id) return;
+
+    try {
+      setIsCancelPendingLoading(true);
+      setShowCancelPendingDialog(false);
+
+      const response = await fetch(withBase('/api/job/cancel-pending'), {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+      });
+
+      if (!response.ok) {
+        const errorData = await response.json().catch(() => ({ error: 'Unknown error occurred' }));
+        throw new Error(errorData.error || `HTTP ${response.status}: ${response.statusText}`);
+      }
+
+      const res = await response.json();
+
+      if (res.success) {
+        toast.success(res.message);
+        // Refresh to show the new activity log entry
+        await fetchActivities(false);
+      } else {
+        showErrorToast(res.error || 'Failed to cancel pending mirrors.', toast);
+      }
+    } catch (error) {
+      console.error('Error cancelling pending mirrors:', error);
+      showErrorToast(error, toast);
+    } finally {
+      setIsCancelPendingLoading(false);
+    }
+  };
+
  // Check if any filters are active
  const hasActiveFilters = !!(filter.status || filter.type || filter.name);
  const activeFilterCount = [filter.status, filter.type, filter.name].filter(Boolean).length;
@@ -552,11 +588,22 @@ export function ActivityLog() {
            <RefreshCw className="h-4 w-4" />
          </Button>
          
+          <Button
+            variant="outline"
+            size="icon"
+            onClick={() => setShowCancelPendingDialog(true)}
+            title="Stop pending mirrors"
+            className="text-amber-600 hover:text-amber-600 h-10 w-10 shrink-0"
+            disabled={isCancelPendingLoading}
+          >
+            <StopCircle className="h-4 w-4" />
+          </Button>
+
          <Button
            variant="outline"
            size="icon"
            onClick={handleCleanupClick}
-            title="Delete all activities"
+            title="Clear activity history"
            className="text-destructive hover:text-destructive h-10 w-10 shrink-0"
          >
            <Trash2 className="h-4 w-4" />
@@ -683,12 +730,24 @@ export function ActivityLog() {
            <RefreshCw className="h-4 w-4" />
          </Button>

-          {/* cleanup all activities */}
+          {/* stop pending mirrors */}
+          <Button
+            variant="outline"
+            size="icon"
+            onClick={() => setShowCancelPendingDialog(true)}
+            title="Stop pending mirrors"
+            className="text-amber-600 hover:text-amber-600 h-10 w-10"
+            disabled={isCancelPendingLoading}
+          >
+            <StopCircle className="h-4 w-4" />
+          </Button>
+
+          {/* clear activity history */}
          <Button
            variant="outline"
            size="icon"
            onClick={handleCleanupClick}
-            title="Delete all activities"
+            title="Clear activity history"
            className="text-destructive hover:text-destructive h-10 w-10"
          >
            <Trash2 className="h-4 w-4" />
@@ -709,9 +768,12 @@ export function ActivityLog() {
      <Dialog open={showCleanupDialog} onOpenChange={setShowCleanupDialog}>
        <DialogContent>
          <DialogHeader>
-            <DialogTitle>Delete All Activities</DialogTitle>
+            <DialogTitle>Clear Activity History</DialogTitle>
            <DialogDescription>
-              Are you sure you want to delete ALL activities? This action cannot be undone and will remove all mirror jobs and events from the database.
+              This clears the activity <strong>history log</strong> (mirror job records and events) — it does not stop
+              any pending or in-progress mirrors. Repositories keep their current status and the scheduler
+              will continue to pick up pending work. To stop pending mirrors, use the
+              &ldquo;Stop Pending Mirrors&rdquo; button instead.
            </DialogDescription>
          </DialogHeader>
          <DialogFooter>
@@ -723,7 +785,35 @@ export function ActivityLog() {
              onClick={confirmCleanup}
              disabled={isInitialLoading}
            >
-              {isInitialLoading ? 'Deleting...' : 'Delete All Activities'}
+              {isInitialLoading ? 'Clearing...' : 'Clear History'}
+            </Button>
+          </DialogFooter>
+        </DialogContent>
+      </Dialog>
+
+      {/* cancel pending mirrors confirmation dialog */}
+      <Dialog open={showCancelPendingDialog} onOpenChange={setShowCancelPendingDialog}>
+        <DialogContent>
+          <DialogHeader>
+            <DialogTitle>Stop Pending Mirrors</DialogTitle>
+            <DialogDescription>
+              This sets all repositories with status <strong>Imported</strong> or <strong>Failed</strong> to{' '}
+              <strong>Ignored</strong>, preventing the scheduler from mirroring them automatically.
+              Repositories that are currently mirroring are not affected.{' '}
+              You can re-enable individual repositories from the Repositories page.
+            </DialogDescription>
+          </DialogHeader>
+          <DialogFooter>
+            <Button variant="outline" onClick={() => setShowCancelPendingDialog(false)}>
+              Cancel
+            </Button>
+            <Button
+              variant="default"
+              className="bg-amber-600 hover:bg-amber-700"
+              onClick={confirmCancelPending}
+              disabled={isCancelPendingLoading}
+            >
+              {isCancelPendingLoading ? 'Stopping...' : 'Stop Pending Mirrors'}
            </Button>
          </DialogFooter>
        </DialogContent>
@@ -927,6 +927,26 @@ export function GitHubMirrorSettings({
              </p>
            </div>
          </div>
+
+          <div className="flex items-start space-x-3">
+            <Checkbox
+              id="skip-personal-repos"
+              checked={advancedOptions.skipPersonalRepos ?? false}
+              onCheckedChange={(checked) => handleAdvancedChange('skipPersonalRepos', !!checked)}
+            />
+            <div className="space-y-0.5 flex-1">
+              <Label
+                htmlFor="skip-personal-repos"
+                className="text-sm font-normal cursor-pointer flex items-center gap-2"
+              >
+                <Users className="h-3.5 w-3.5" />
+                Skip personal repositories (only mirror organization repos)
+              </Label>
+              <p className="text-xs text-muted-foreground">
+                Exclude repositories owned by your personal GitHub account; only mirror repos belonging to organizations
+              </p>
+            </div>
+          </div>
        </div>
      </div>
    </div>
@@ -90,41 +90,29 @@ export default function ConsentPage() {
  const handleConsent = async (accept: boolean) => {
    setIsSubmitting(true);
    try {
+      // The OAuth provider redirected here with the authorization request in
+      // the query string (client_id, scope, code). Hand that back via
+      // `oauth_query` so the provider can resume the flow. It validates the
+      // redirect URI server-side and returns the URL to navigate to — either
+      // with an authorization code (accept) or an error (deny).
+      const oauthQuery = window.location.search.replace(/^\?/, '');
      const result = await authClient.oauth2.consent({
        accept,
+        oauth_query: oauthQuery,
+        scope: Array.from(selectedScopes).join(' '),
      });

      if (result.error) {
        throw new Error(result.error.message || 'Consent failed');
      }

-      // The consent method should handle the redirect
-      if (!accept) {
-        // If denied, redirect back to the application with error
-        const params = new URLSearchParams(window.location.search);
-        const redirectUri = params.get('redirect_uri');
-        
-        if (redirectUri && application) {
-          // Validate redirect URI against authorized URIs
-          const authorizedUris = parseRedirectUris(application.redirectURLs);
-          
-          if (isValidRedirectUri(redirectUri, authorizedUris)) {
-            try {
-              // Parse and reconstruct the URL to ensure it's safe
-              const url = new URL(redirectUri);
-              url.searchParams.set('error', 'access_denied');
-              
-              // Safe to redirect - URI has been validated and sanitized
-              window.location.href = url.toString();
-            } catch (e) {
-              console.error('Failed to parse redirect URI:', e);
-              setError('Invalid redirect URI');
-            }
-          } else {
-            console.error('Unauthorized redirect URI:', redirectUri);
-            setError('Invalid redirect URI');
-          }
-        }
+      const redirectUri = (result.data as { redirect_uri?: string } | undefined)?.redirect_uri;
+      if (redirectUri) {
+        // The redirect URI is produced and validated server-side.
+        window.location.href = redirectUri;
+      } else if (!accept) {
+        // No redirect target returned on denial — return to the app.
+        window.location.href = '/';
      }
    } catch (error) {
      showErrorToast(error, toast);
@@ -99,6 +99,7 @@ export default function RepositoryTable({
  onDismissSync,
 }: RepositoryTableProps) {
  const tableParentRef = useRef<HTMLDivElement>(null);
+  const lastSelectedIndexRef = useRef<number | null>(null);
  const { giteaConfig } = useGiteaConfig();

  const handleUpdateDestination = async (repoId: string, newDestination: string | null) => {
@@ -235,6 +236,7 @@ export default function RepositoryTable({

  // Selection handlers
  const handleSelectAll = (checked: boolean) => {
+    lastSelectedIndexRef.current = null;
    if (checked) {
      const allIds = new Set(
        visibleRepositories
@@ -247,7 +249,7 @@ export default function RepositoryTable({
    }
  };

-  const handleSelectRepo = (repoId: string, checked: boolean) => {
+  const handleSelectRepo = (repoId: string, checked: boolean, index?: number) => {
    const newSelection = new Set(selectedRepoIds);
    if (checked) {
      newSelection.add(repoId);
@@ -255,6 +257,32 @@ export default function RepositoryTable({
      newSelection.delete(repoId);
    }
    onSelectionChange(newSelection);
+    if (index !== undefined) {
+      lastSelectedIndexRef.current = index;
+    }
+  };
+
+  const handleShiftRangeSelect = (currentIndex: number) => {
+    const lastIndex = lastSelectedIndexRef.current;
+    if (lastIndex === null) {
+      const repo = visibleRepositories[currentIndex];
+      if (repo?.id) {
+        const newSelection = new Set(selectedRepoIds);
+        newSelection.add(repo.id);
+        onSelectionChange(newSelection);
+        lastSelectedIndexRef.current = currentIndex;
+      }
+      return;
+    }
+    const start = Math.min(lastIndex, currentIndex);
+    const end = Math.max(lastIndex, currentIndex);
+    const newSelection = new Set(selectedRepoIds);
+    for (let i = start; i <= end; i++) {
+      const id = visibleRepositories[i]?.id;
+      if (id) newSelection.add(id);
+    }
+    onSelectionChange(newSelection);
+    lastSelectedIndexRef.current = currentIndex;
  };

  const isAllSelected =
@@ -263,7 +291,7 @@ export default function RepositoryTable({
  const isPartiallySelected = selectedRepoIds.size > 0 && !isAllSelected;

  // Mobile card layout for repository
-  const RepositoryCard = ({ repo }: { repo: Repository }) => {
+  const RepositoryCard = ({ repo, index }: { repo: Repository; index: number }) => {
    const isLoading = repo.id ? loadingRepoIds.has(repo.id) : false;
    const isSelected = repo.id ? selectedRepoIds.has(repo.id) : false;
    const giteaUrl = getGiteaRepoUrl(repo);
@@ -274,12 +302,21 @@ export default function RepositoryTable({
          <div className="flex flex-col gap-3">
            {/* Header with checkbox and repo name */}
            <div className="flex items-start gap-3">
-              <Checkbox
-                checked={isSelected}
-                onCheckedChange={(checked) => repo.id && handleSelectRepo(repo.id, checked as boolean)}
-                className="mt-1 h-5 w-5"
-                aria-label={`Select ${repo.name}`}
-              />
+              <div
+                onClickCapture={(e) => {
+                  if (e.shiftKey && repo.id) {
+                    e.stopPropagation();
+                    handleShiftRangeSelect(index);
+                  }
+                }}
+              >
+                <Checkbox
+                  checked={isSelected}
+                  onCheckedChange={(checked) => repo.id && handleSelectRepo(repo.id, checked as boolean, index)}
+                  className="mt-1 h-5 w-5"
+                  aria-label={`Select ${repo.name}`}
+                />
+              </div>
              <div className="flex-1 min-w-0">
                <h3 className="font-medium text-base truncate">{repo.name}</h3>
                <div className="flex items-center gap-2 mt-1 flex-wrap">
@@ -635,8 +672,8 @@ export default function RepositoryTable({
            </div>

            {/* Repository cards */}
-            {visibleRepositories.map((repo) => (
-              <RepositoryCard key={repo.id} repo={repo} />
+            {visibleRepositories.map((repo, index) => (
+              <RepositoryCard key={repo.id} repo={repo} index={index} />
            ))}
          </div>

@@ -701,10 +738,18 @@ export default function RepositoryTable({
                      className="h-[65px] flex items-center justify-between bg-transparent border-b hover:bg-muted/50"
                    >
                      {/* Checkbox */}
-                      <div className="h-full p-3 flex items-center justify-center flex-[0.3]">
+                      <div
+                        className="h-full p-3 flex items-center justify-center flex-[0.3]"
+                        onClickCapture={(e) => {
+                          if (e.shiftKey && repo.id) {
+                            e.stopPropagation();
+                            handleShiftRangeSelect(virtualRow.index);
+                          }
+                        }}
+                      >
                        <Checkbox
                          checked={repo.id ? selectedRepoIds.has(repo.id) : false}
-                          onCheckedChange={(checked) => repo.id && handleSelectRepo(repo.id, !!checked)}
+                          onCheckedChange={(checked) => repo.id && handleSelectRepo(repo.id, !!checked, virtualRow.index)}
                          aria-label={`Select ${repo.name}`}
                        />
                      </div>
@@ -1,6 +1,6 @@
 import "@/lib/polyfills/buffer";
 import { createAuthClient } from "better-auth/react";
-import { oidcClient } from "better-auth/client/plugins";
+import { oauthProviderClient } from "@better-auth/oauth-provider/client";
 import { ssoClient } from "@better-auth/sso/client";
 import type { Session as BetterAuthSession, User as BetterAuthUser } from "better-auth";
 import { withBase } from "@/lib/base-path";
@@ -41,7 +41,7 @@ export const authClient = createAuthClient({
  })(),
  basePath: withBase('/api/auth'), // Explicitly set the base path
  plugins: [
-    oidcClient(),
+    oauthProviderClient(),
    ssoClient(),
  ],
 });
@@ -0,0 +1,123 @@
+import { describe, expect, mock, test, beforeEach } from "bun:test";
+
+// Stub `./auth` so we can drive the response shape `mintSessionFromHeaders`
+// sees from the plugin endpoint without standing up the full Better Auth
+// stack + DB.
+const signInWithHeaderMock = mock<(args: unknown) => Promise<Response>>(
+  async () => new Response(null, { status: 500 }),
+);
+
+mock.module("@/lib/auth", () => ({
+  auth: {
+    api: {
+      signInWithHeader: signInWithHeaderMock,
+    },
+  },
+}));
+
+import { mintSessionFromHeaders } from "./auth-header-bridge";
+
+function makeRequest(headers: Record<string, string> = {}): Request {
+  return new Request("http://localhost/test", { headers });
+}
+
+describe("mintSessionFromHeaders", () => {
+  beforeEach(() => {
+    signInWithHeaderMock.mockReset();
+  });
+
+  test("returns user, session, and Set-Cookie values on a 200 response", async () => {
+    signInWithHeaderMock.mockImplementation(async () => {
+      const response = new Response(
+        JSON.stringify({
+          user: { id: "user-1", email: "u@example.com" },
+          session: { id: "sess-1", userId: "user-1" },
+        }),
+        { status: 200, headers: { "content-type": "application/json" } },
+      );
+      // Modern runtimes coalesce multiple Set-Cookie via append.
+      response.headers.append("set-cookie", "better-auth-session=abc; Path=/");
+      response.headers.append("set-cookie", "better-auth-remember=1; Path=/");
+      return response;
+    });
+
+    const result = await mintSessionFromHeaders(makeRequest());
+
+    expect(result).not.toBeNull();
+    expect(result?.user.id).toBe("user-1");
+    expect(result?.session.id).toBe("sess-1");
+    expect(result?.setCookies).toEqual([
+      "better-auth-session=abc; Path=/",
+      "better-auth-remember=1; Path=/",
+    ]);
+  });
+
+  test("returns null when the endpoint responds non-2xx (header auth disabled / unauthorized)", async () => {
+    signInWithHeaderMock.mockImplementation(
+      async () => new Response("Unauthorized", { status: 401 }),
+    );
+
+    const result = await mintSessionFromHeaders(makeRequest());
+
+    expect(result).toBeNull();
+  });
+
+  test("returns null when the endpoint throws (transient failure)", async () => {
+    signInWithHeaderMock.mockImplementation(async () => {
+      throw new Error("upstream unreachable");
+    });
+
+    const result = await mintSessionFromHeaders(makeRequest());
+
+    expect(result).toBeNull();
+  });
+
+  test("returns null when the response body is missing user or session", async () => {
+    signInWithHeaderMock.mockImplementation(
+      async () =>
+        new Response(JSON.stringify({ token: "abc" }), {
+          status: 200,
+          headers: { "content-type": "application/json" },
+        }),
+    );
+
+    const result = await mintSessionFromHeaders(makeRequest());
+
+    expect(result).toBeNull();
+  });
+
+  test("returns null when the body is malformed JSON", async () => {
+    signInWithHeaderMock.mockImplementation(
+      async () =>
+        new Response("not json at all", {
+          status: 200,
+          headers: { "content-type": "application/json" },
+        }),
+    );
+
+    const result = await mintSessionFromHeaders(makeRequest());
+
+    expect(result).toBeNull();
+  });
+
+  test("returns an empty setCookies array when no Set-Cookie headers were attached", async () => {
+    // Defensive — should never happen in practice because the plugin
+    // always calls setSessionCookie. If it does happen, we still want
+    // the user/session to come through so SSR works on this request.
+    signInWithHeaderMock.mockImplementation(
+      async () =>
+        new Response(
+          JSON.stringify({
+            user: { id: "user-1" },
+            session: { id: "sess-1" },
+          }),
+          { status: 200, headers: { "content-type": "application/json" } },
+        ),
+    );
+
+    const result = await mintSessionFromHeaders(makeRequest());
+
+    expect(result).not.toBeNull();
+    expect(result?.setCookies).toEqual([]);
+  });
+});
@@ -0,0 +1,56 @@
+import { auth } from "./auth";
+
+export interface BridgeResult {
+  user: any;
+  session: any;
+  setCookies: string[];
+}
+
+/**
+ * Calls the `header-auth` plugin endpoint to mint a real Better Auth
+ * session from trusted upstream headers (Authentik / Authelia /
+ * oauth2-proxy / Caddy), and returns the user, session, and the
+ * `Set-Cookie` headers for the middleware to forward onto the
+ * outbound response.
+ *
+ * Fail-open: returns null on any failure (endpoint disabled, headers
+ * missing, DB blip, malformed response). The middleware then sets
+ * locals to null and the request proceeds as anonymous — broken
+ * header auth must never lock everyone out of the cookie-auth path.
+ *
+ * Cookie extraction prefers `Response.headers.getSetCookie()` (Node 18+
+ * fetch, undici). Older runtimes that only expose `get('set-cookie')`
+ * fall through to the single-header form; that path coalesces all
+ * Set-Cookie values into one comma-separated string, which is wrong
+ * for cookies whose attributes contain commas (`Expires` does). We
+ * accept that risk because: (a) Bun and the supported Node versions
+ * for this project both implement `getSetCookie`, and (b) the
+ * fallback only fires on truly ancient runtimes that aren't in our
+ * support matrix.
+ */
+export async function mintSessionFromHeaders(
+  request: Request,
+): Promise<BridgeResult | null> {
+  try {
+    const response = await auth.api.signInWithHeader({
+      headers: request.headers,
+      asResponse: true,
+    });
+
+    if (!response.ok) return null;
+
+    const data = await response.json().catch(() => null);
+    if (!data?.user || !data?.session) return null;
+
+    const setCookies =
+      typeof response.headers.getSetCookie === "function"
+        ? response.headers.getSetCookie()
+        : response.headers.get("set-cookie")
+          ? [response.headers.get("set-cookie") as string]
+          : [];
+
+    return { user: data.user, session: data.session, setCookies };
+  } catch {
+    return null;
+  }
+}
@@ -0,0 +1,29 @@
+import { describe, expect, test } from "bun:test";
+import { headerAuthPlugin } from "./auth-header-plugin";
+
+describe("headerAuthPlugin", () => {
+  test("registers the `header-auth` plugin id", () => {
+    const plugin = headerAuthPlugin();
+    expect(plugin.id).toBe("header-auth");
+  });
+
+  test("exposes a `signInWithHeader` endpoint", () => {
+    const plugin = headerAuthPlugin();
+    expect(plugin.endpoints?.signInWithHeader).toBeDefined();
+  });
+
+  test("mounts the endpoint at POST /sign-in/header", () => {
+    // The Astro API route is /api/auth/<plugin-path>, so the resolved
+    // URL the middleware bridge talks to is /api/auth/sign-in/header.
+    // Locking that path down in a test prevents an accidental rename
+    // from silently breaking the React SPA's auth flow.
+    const plugin = headerAuthPlugin();
+    const endpoint = plugin.endpoints?.signInWithHeader as unknown as {
+      path: string;
+      options: { method: string };
+    };
+
+    expect(endpoint.path).toBe("/sign-in/header");
+    expect(endpoint.options.method).toBe("POST");
+  });
+});
@@ -0,0 +1,78 @@
+import type { BetterAuthPlugin } from "better-auth";
+import { APIError, createAuthEndpoint } from "better-auth/api";
+import { setSessionCookie } from "better-auth/cookies";
+import { authenticateWithHeaders, isHeaderAuthEnabled } from "./auth-header";
+
+/**
+ * Better Auth plugin that bridges header / forward authentication into a
+ * real Better Auth session.
+ *
+ * Why this exists: the Astro middleware historically populated
+ * `context.locals.user` from trusted upstream headers (Authentik /
+ * Authelia / oauth2-proxy / Caddy), but never minted a Better Auth
+ * session. Server-rendered pages saw the user, but the React SPA's
+ * `/api/auth/get-session` call hit Better Auth's handler — which only
+ * reads its session cookie — and got `null`. The auth guard then
+ * bounced to `/login`, so header auth was end-to-end broken.
+ *
+ * This plugin exposes `POST /sign-in/header`, which the middleware
+ * calls once per cold request (no cookie yet) when header auth is
+ * enabled. It verifies the trusted headers, creates a real session
+ * row via `internalAdapter.createSession`, and attaches the
+ * `Set-Cookie` to the response. The middleware then forwards that
+ * cookie to the outbound Astro response, so the SPA's next call to
+ * `get-session` carries the cookie and works.
+ *
+ * The endpoint trusts whatever upstream sets the configured headers —
+ * the security model here is "the operator controls the reverse
+ * proxy." Make sure the proxy strips inbound copies of these headers
+ * before forwarding (documented in docs/SSO-OIDC-SETUP.md).
+ */
+export const headerAuthPlugin = () =>
+  ({
+    id: "header-auth",
+    endpoints: {
+      signInWithHeader: createAuthEndpoint(
+        "/sign-in/header",
+        { method: "POST" },
+        async (ctx) => {
+          if (!isHeaderAuthEnabled()) {
+            throw new APIError("NOT_FOUND", {
+              message: "Header authentication is not enabled",
+            });
+          }
+
+          const headers = ctx.request?.headers ?? ctx.headers;
+          if (!headers) {
+            throw new APIError("BAD_REQUEST", {
+              message: "Request headers unavailable",
+            });
+          }
+
+          const user = await authenticateWithHeaders(headers);
+          if (!user) {
+            throw new APIError("UNAUTHORIZED", {
+              message: "Header authentication failed",
+            });
+          }
+
+          const session = await ctx.context.internalAdapter.createSession(
+            user.id,
+          );
+          if (!session) {
+            throw new APIError("INTERNAL_SERVER_ERROR", {
+              message: "Failed to create session",
+            });
+          }
+
+          await setSessionCookie(ctx, { session, user });
+
+          return ctx.json({
+            token: session.token,
+            user,
+            session,
+          });
+        },
+      ),
+    },
+  }) satisfies BetterAuthPlugin;
@@ -0,0 +1,158 @@
+import { describe, expect, test, beforeEach, afterEach } from "bun:test";
+import {
+  extractUserFromHeaders,
+  isHeaderAuthEnabled,
+  getHeaderAuthConfig,
+} from "./auth-header";
+
+// `auth-header` reads config from `process.env` at call time. We snapshot
+// the relevant keys and restore them after each test so cases don't bleed.
+const HEADER_ENV_KEYS = [
+  "HEADER_AUTH_ENABLED",
+  "HEADER_AUTH_AUTO_PROVISION",
+  "HEADER_AUTH_USER_HEADER",
+  "HEADER_AUTH_EMAIL_HEADER",
+  "HEADER_AUTH_NAME_HEADER",
+  "HEADER_AUTH_ALLOWED_DOMAINS",
+] as const;
+
+let savedEnv: Partial<Record<(typeof HEADER_ENV_KEYS)[number], string | undefined>> = {};
+
+function setEnv(vars: Partial<Record<(typeof HEADER_ENV_KEYS)[number], string>>) {
+  for (const key of HEADER_ENV_KEYS) {
+    if (key in vars) {
+      process.env[key] = vars[key]!;
+    } else {
+      delete process.env[key];
+    }
+  }
+}
+
+beforeEach(() => {
+  savedEnv = Object.fromEntries(
+    HEADER_ENV_KEYS.map((k) => [k, process.env[k]]),
+  ) as typeof savedEnv;
+});
+
+afterEach(() => {
+  for (const key of HEADER_ENV_KEYS) {
+    const v = savedEnv[key];
+    if (v === undefined) delete process.env[key];
+    else process.env[key] = v;
+  }
+});
+
+describe("isHeaderAuthEnabled", () => {
+  test("returns false when HEADER_AUTH_ENABLED is unset", () => {
+    setEnv({});
+    expect(isHeaderAuthEnabled()).toBe(false);
+  });
+
+  test("returns false when HEADER_AUTH_ENABLED is anything other than the string 'true'", () => {
+    setEnv({ HEADER_AUTH_ENABLED: "1" });
+    expect(isHeaderAuthEnabled()).toBe(false);
+    setEnv({ HEADER_AUTH_ENABLED: "yes" });
+    expect(isHeaderAuthEnabled()).toBe(false);
+  });
+
+  test("returns true only for HEADER_AUTH_ENABLED='true' exactly", () => {
+    setEnv({ HEADER_AUTH_ENABLED: "true" });
+    expect(isHeaderAuthEnabled()).toBe(true);
+  });
+});
+
+describe("extractUserFromHeaders", () => {
+  test("returns null when header auth is disabled", () => {
+    setEnv({});
+    const headers = new Headers({ "X-Authentik-Username": "u" });
+    expect(extractUserFromHeaders(headers)).toBeNull();
+  });
+
+  test("returns null when the configured user header is absent", () => {
+    setEnv({ HEADER_AUTH_ENABLED: "true" });
+    const headers = new Headers({ "X-Some-Other-Header": "u" });
+    expect(extractUserFromHeaders(headers)).toBeNull();
+  });
+
+  test("returns username, email, and name from default Authentik headers", () => {
+    setEnv({ HEADER_AUTH_ENABLED: "true" });
+    const headers = new Headers({
+      "X-Authentik-Username": "alice",
+      "X-Authentik-Email": "alice@example.com",
+      "X-Authentik-Name": "Alice Q",
+    });
+
+    expect(extractUserFromHeaders(headers)).toEqual({
+      username: "alice",
+      email: "alice@example.com",
+      name: "Alice Q",
+    });
+  });
+
+  test("respects HEADER_AUTH_USER_HEADER override (Caddy / caddy-security style)", () => {
+    setEnv({
+      HEADER_AUTH_ENABLED: "true",
+      HEADER_AUTH_USER_HEADER: "X-Token-User-Email",
+      HEADER_AUTH_EMAIL_HEADER: "X-Token-User-Email",
+      HEADER_AUTH_NAME_HEADER: "X-Token-User-Name",
+    });
+    const headers = new Headers({
+      "X-Token-User-Email": "bob@example.com",
+      "X-Token-User-Name": "Bob",
+    });
+
+    // lanrat's reported config: username and email are both pulled from
+    // the same header. Both should resolve to that value.
+    expect(extractUserFromHeaders(headers)).toEqual({
+      username: "bob@example.com",
+      email: "bob@example.com",
+      name: "Bob",
+    });
+  });
+
+  test("rejects when email domain is not on the allow list", () => {
+    setEnv({
+      HEADER_AUTH_ENABLED: "true",
+      HEADER_AUTH_ALLOWED_DOMAINS: "example.com,corp.example",
+    });
+    const headers = new Headers({
+      "X-Authentik-Username": "evil",
+      "X-Authentik-Email": "evil@elsewhere.test",
+    });
+
+    expect(extractUserFromHeaders(headers)).toBeNull();
+  });
+
+  test("accepts when email domain matches the allow list", () => {
+    setEnv({
+      HEADER_AUTH_ENABLED: "true",
+      HEADER_AUTH_ALLOWED_DOMAINS: "example.com,corp.example",
+    });
+    const headers = new Headers({
+      "X-Authentik-Username": "alice",
+      "X-Authentik-Email": "alice@corp.example",
+    });
+
+    expect(extractUserFromHeaders(headers)).toEqual({
+      username: "alice",
+      email: "alice@corp.example",
+      name: undefined,
+    });
+  });
+});
+
+describe("getHeaderAuthConfig", () => {
+  test("merges env overrides over defaults without leaking unset env values", () => {
+    setEnv({
+      HEADER_AUTH_ENABLED: "true",
+      HEADER_AUTH_USER_HEADER: "X-Forwarded-User",
+    });
+
+    const config = getHeaderAuthConfig();
+    expect(config.enabled).toBe(true);
+    expect(config.userHeader).toBe("X-Forwarded-User");
+    // Unset overrides should fall back to defaults, not become undefined.
+    expect(config.emailHeader).toBe("X-Authentik-Email");
+    expect(config.nameHeader).toBe("X-Authentik-Name");
+  });
+});
@@ -1,11 +1,13 @@
 import { betterAuth } from "better-auth";
 import { drizzleAdapter } from "better-auth/adapters/drizzle";
-import { oidcProvider } from "better-auth/plugins";
+import { jwt } from "better-auth/plugins";
+import { oauthProvider } from "@better-auth/oauth-provider";
 import { sso } from "@better-auth/sso";
 import { db, users } from "./db";
 import * as schema from "./db/schema";
 import { eq } from "drizzle-orm";
 import { withBase } from "./base-path";
+import { headerAuthPlugin } from "./auth-header-plugin";

 /**
 * Resolves the list of trusted origins for Better Auth CSRF validation.
@@ -73,6 +75,23 @@ export async function resolveTrustedOrigins(request?: Request): Promise<string[]
  return uniqueOrigins;
 }

+/**
+ * Resolves the Better Auth logger level from BETTER_AUTH_LOG_LEVEL.
+ * Returns undefined for unset/invalid values so Better Auth falls back
+ * to its built-in default ("warn"). "success" is intentionally excluded
+ * — it is an output level, not a valid threshold.
+ */
+function resolveAuthLogLevel(): "debug" | "info" | "warn" | "error" | undefined {
+  const raw = process.env.BETTER_AUTH_LOG_LEVEL?.trim().toLowerCase();
+  if (raw === "debug" || raw === "info" || raw === "warn" || raw === "error") {
+    return raw;
+  }
+  if (raw) {
+    console.warn(`Invalid BETTER_AUTH_LOG_LEVEL: "${raw}", using default ("warn")`);
+  }
+  return undefined;
+}
+
 export const auth = betterAuth({
  // Database configuration
  database: drizzleAdapter(db, {
@@ -84,6 +103,17 @@ export const auth = betterAuth({
  // Secret for signing tokens
  secret: process.env.BETTER_AUTH_SECRET,

+  // Logger configuration.
+  //
+  // Better Auth ships its own logger (it does NOT read the `DEBUG` env
+  // var / the `debug` npm package — `DEBUG=better-auth:*` is a no-op).
+  // The default level is "warn", so SSO/OIDC debug and info messages
+  // are hidden out of the box. Set BETTER_AUTH_LOG_LEVEL=debug to surface
+  // the full sign-in / callback trace when troubleshooting SSO.
+  logger: {
+    level: resolveAuthLogLevel(),
+  },
+
  // Base URL configuration - use the primary URL (Better Auth only supports single baseURL)
  baseURL: (() => {
    const url = process.env.BETTER_AUTH_URL;
@@ -153,26 +183,71 @@ export const auth = betterAuth({
    },
  },

+  // Account linking configuration.
+  //
+  // Lets a user who first registered with email/password sign in through SSO
+  // and land on the *same* account, instead of being bounced back to /login.
+  // Better Auth's auto-link path (link-account.mjs) refuses unless BOTH sides
+  // pass:
+  //   - upstream: provider is "trusted" (either listed in `trustedProviders`
+  //               or the SSO plugin marks it trusted via domainVerified +
+  //               domain match) OR userInfo.emailVerified === true
+  //   - local:    existing user is verified (or requireLocalEmailVerified=false)
+  //
+  // We don't wire an email-verification flow, so the local admin always has
+  // emailVerified=false — `requireLocalEmailVerified: false` is required.
+  //
+  // We deliberately do NOT use the catch-all `trustedProviders` list (which
+  // would blanket-trust every registered IdP). Instead the SSO provider's
+  // own `domainVerified` flag — set to true at registration time, scoped to
+  // the operator-supplied `domain` — gates linking. The SSO plugin enforces
+  // `validateEmailDomain(userInfo.email, provider.domain)` on top of it, so
+  // a sign-in is only auto-linked when (a) the operator vouched for the IdP
+  // by registering it, and (b) the user's email actually belongs to the
+  // domain that was vouched for. Cross-domain claims from a compromised or
+  // permissive IdP do not silently absorb local accounts. (Same-domain
+  // claims still require the operator to trust their IdP's identity model.)
+  account: {
+    accountLinking: {
+      enabled: true,
+      requireLocalEmailVerified: false,
+      // Keep the default (false): never link accounts whose emails differ.
+      allowDifferentEmails: false,
+    },
+  },
+
  // Plugins configuration
  plugins: [
-    // OIDC Provider plugin - allows this app to act as an OIDC provider
-    oidcProvider({
+    // JWT plugin — provides the JWKS keypair that the OAuth provider uses to
+    // sign OIDC id_tokens with an asymmetric key (what most relying parties
+    // expect). Required by @better-auth/oauth-provider unless disableJwtPlugin
+    // is set. Keys are persisted in the `jwks` table.
+    jwt(),
+
+    // OAuth 2.1 / OIDC Provider — allows this app to act as an identity
+    // provider for other applications. Replaces the deprecated `oidcProvider`
+    // plugin (which Better Auth will remove in a future release). Client and
+    // consent records now live in the oauth_clients / oauth_consents tables.
+    oauthProvider({
      loginPage: withBase("/login"),
      consentPage: withBase("/oauth/consent"),
      // Allow dynamic client registration for flexibility
      allowDynamicClientRegistration: true,
-      // Note: trustedClients would be configured here if Better Auth supports it
-      // For now, we'll use dynamic registration
-      // Customize user info claims based on scopes
-      getAdditionalUserInfoClaim: (user, scopes) => {
+      // Mirror the old getAdditionalUserInfoClaim: expose our extra `username`
+      // field on both the userinfo endpoint and the id_token when the
+      // "profile" scope is granted.
+      customUserInfoClaims: ({ user, scopes }) => {
        const claims: Record<string, any> = {};
-        if (scopes.includes("profile")) {
-          claims.username = user.username;
-        }
+        if (scopes.includes("profile")) claims.username = (user as any).username;
+        return claims;
+      },
+      customIdTokenClaims: ({ user, scopes }) => {
+        const claims: Record<string, any> = {};
+        if (scopes.includes("profile")) claims.username = (user as any).username;
        return claims;
      },
    }),
-    
+
    // SSO plugin - allows users to authenticate with external OIDC providers
    sso({
      // Provision new users when they sign in with SSO
@@ -204,7 +279,27 @@ export const auth = betterAuth({
      disableImplicitSignUp: false,
      // Trust email_verified claims from the upstream provider so we can link by matching email
      trustEmailVerified: true,
+      // Surface `domainVerified` to the model so account-linking can read it.
+      //
+      // Better Auth's adapter transformOutput (factory.mjs) only copies fields
+      // that are declared in the plugin's model schema; the SSO plugin only
+      // declares `domainVerified` when this option is enabled. Without it the
+      // column is in the DB but stripped from the returned provider object, so
+      // the trust check `"domainVerified" in provider` is silently false and
+      // sign-ins land on /?error=UNKNOWN. We don't use the DNS-based
+      // verify-domain flow this option also exposes — we set
+      // `domainVerified: true` directly in src/pages/api/auth/sso/register.ts
+      // after the plugin's create, scoped by the operator-supplied `domain`.
+      domainVerification: { enabled: true },
    }),
+
+    // Header / forward authentication bridge. Exposes
+    // POST /api/auth/sign-in/header so the middleware can mint a real
+    // Better Auth session from trusted upstream headers (Authentik /
+    // Authelia / oauth2-proxy / Caddy). Without this the SPA's
+    // /api/auth/get-session call returns null on header-auth-only
+    // requests and bounces the user to /login. See auth-header-plugin.ts.
+    headerAuthPlugin(),
  ],
 });

@@ -3,6 +3,7 @@ import { drizzle } from "drizzle-orm/bun-sqlite";
 import fs from "fs";
 import path from "path";
 import { migrate } from "drizzle-orm/bun-sqlite/migrator";
+import { repairDuplicateSsoColumns, restoreSsoDataAfter0013 } from "./migration-repairs";

 // Skip database initialization in test environment
 let db: ReturnType<typeof drizzle>;
@@ -95,9 +96,17 @@ if (process.env.NODE_ENV !== "test") {
      // Fix any migrations that were recorded but actually failed (e.g. v3.13.0 bug)
      repairFailedMigrations();

+      // Fix the v3.17.0 duplicate-column crash: reconcile stranded sso_providers
+      // columns so migration 0013 can run (see #312). Returns data to re-apply
+      // once 0013 has re-added the columns.
+      const preservedSsoData = repairDuplicateSsoColumns(sqlite);
+
      // Run migrations using Drizzle migrate function
      migrate(db, { migrationsFolder: "./drizzle" });

+      // Re-apply any SSO provider data preserved by the repair above.
+      restoreSsoDataAfter0013(sqlite, preservedSsoData);
+
      console.log("✅ Database migrations completed successfully");
    } catch (error) {
      console.error("❌ Error running migrations:", error);
@@ -123,9 +132,11 @@ export {
  accounts,
  verificationTokens,
  verifications,
-  oauthApplications,
+  oauthClients,
  oauthAccessTokens,
-  oauthConsent,
+  oauthRefreshTokens,
+  oauthConsents,
+  jwkss,
  ssoProviders,
  rateLimits
 } from "./schema";
@@ -0,0 +1,117 @@
+import type { Database } from "bun:sqlite";
+
+/**
+ * Pre-migration repairs that reconcile a database into the exact shape Drizzle's
+ * migrator expects, so a previously-failed migration can complete on the next
+ * boot. These run BEFORE `migrate()` and are deliberately defensive: any failure
+ * is logged and swallowed so they never make a recoverable database worse.
+ */
+
+/** Migration 0013 journal timestamp (from drizzle/meta/_journal.json, idx 13). */
+const MIGRATION_0013_TIMESTAMP = 1780377747526;
+
+export type PreservedSsoRow = {
+  id: string;
+  saml_config?: string | null;
+  domain_verified?: number;
+};
+
+/**
+ * Repair the v3.17.0 (PR #307) "duplicate column name: saml_config" crash loop
+ * reported in issue #312.
+ *
+ * Some instances ended up with `sso_providers.saml_config` / `domain_verified`
+ * already present BEFORE migration 0013 ran — the columns were declared in
+ * schema.ts and entered the DB via `db:push` or an SSO-register round-trip on an
+ * intermediate build, while `__drizzle_migrations` never recorded a 0013 row.
+ *
+ * Migration 0013 runs as a single transaction (organizations rebuild + the two
+ * `ALTER TABLE sso_providers ADD ...`). The ADD hits the pre-existing column,
+ * throws "duplicate column", and rolls back the ENTIRE transaction — so 0013 is
+ * never recorded and is retried, failing identically, on every boot.
+ *
+ * This is the mirror image of the 0009 repair in index.ts (record present,
+ * column missing): here the column is present but the record is missing. We
+ * reconcile `sso_providers` back to its true pre-0013 shape so the canonical
+ * 0013 can run in full (the organizations rebuild MUST NOT be skipped),
+ * preserving any real SAML provider config across the drop/re-add.
+ *
+ * Returns the rows whose values must be re-applied by {@link restoreSsoDataAfter0013}
+ * once 0013 has re-added the columns. Returns an empty array when there is
+ * nothing to do (fresh install, clean upgrade, or genuine pre-0013 shape).
+ */
+export function repairDuplicateSsoColumns(sqlite: Database): PreservedSsoRow[] {
+  try {
+    const migrationsTableExists = sqlite
+      .query("SELECT name FROM sqlite_master WHERE type='table' AND name='__drizzle_migrations'")
+      .get();
+
+    // Fresh install — no migrations recorded yet, vanilla migrate() handles it.
+    if (!migrationsTableExists) return [];
+
+    // 0013 already recorded (clean upgrade / already healed) — nothing to do.
+    const alreadyApplied = sqlite
+      .query("SELECT 1 FROM __drizzle_migrations WHERE created_at >= ? LIMIT 1")
+      .get(MIGRATION_0013_TIMESTAMP);
+    if (alreadyApplied) return [];
+
+    const ssoExists = sqlite
+      .query("SELECT name FROM sqlite_master WHERE type='table' AND name='sso_providers'")
+      .get();
+    if (!ssoExists) return [];
+
+    const cols = sqlite.query("PRAGMA table_info(sso_providers)").all() as { name: string }[];
+    const hasSaml = cols.some((c) => c.name === "saml_config");
+    const hasDomainVerified = cols.some((c) => c.name === "domain_verified");
+
+    // Genuine pre-0013 shape — let migration 0013 add the columns as-is.
+    if (!hasSaml && !hasDomainVerified) return [];
+
+    console.log(
+      "🔧 Detected stranded SSO columns (migration 0013 not recorded). Reconciling sso_providers so 0013 can run...",
+    );
+
+    // Preserve any real data before dropping. SAML providers store JSON config
+    // in saml_config; domain_verified may have been explicitly set to false.
+    const selectCols = ["id"];
+    if (hasSaml) selectCols.push("saml_config");
+    if (hasDomainVerified) selectCols.push("domain_verified");
+    const preserved = sqlite
+      .query(`SELECT ${selectCols.join(", ")} FROM sso_providers`)
+      .all() as PreservedSsoRow[];
+
+    // SQLite >= 3.35 (bun:sqlite ships much newer) supports DROP COLUMN.
+    if (hasSaml) sqlite.run("ALTER TABLE sso_providers DROP COLUMN saml_config");
+    if (hasDomainVerified) sqlite.run("ALTER TABLE sso_providers DROP COLUMN domain_verified");
+
+    // Only rows whose values differ from the 0013 defaults (saml_config NULL,
+    // domain_verified true/1) need restoring after the columns are re-added.
+    return preserved.filter(
+      (r) => (hasSaml && r.saml_config != null) || (hasDomainVerified && r.domain_verified === 0),
+    );
+  } catch (error) {
+    console.warn("⚠️ SSO column repair check failed (non-fatal):", error);
+    return [];
+  }
+}
+
+/**
+ * Re-apply the SSO provider values preserved by {@link repairDuplicateSsoColumns}
+ * once migration 0013 has re-added saml_config / domain_verified with their
+ * defaults (saml_config NULL, domain_verified = 1). No-op when nothing was
+ * preserved (the common OIDC-only case).
+ */
+export function restoreSsoDataAfter0013(sqlite: Database, preserved: PreservedSsoRow[]): void {
+  if (preserved.length === 0) return;
+  try {
+    const stmt = sqlite.prepare(
+      "UPDATE sso_providers SET saml_config = ?, domain_verified = ? WHERE id = ?",
+    );
+    for (const r of preserved) {
+      stmt.run(r.saml_config ?? null, r.domain_verified ?? 1, r.id);
+    }
+    console.log(`✅ Restored ${preserved.length} preserved SSO provider value(s) after migration 0013.`);
+  } catch (error) {
+    console.warn("⚠️ Failed to restore preserved SSO data (non-fatal):", error);
+  }
+}
@@ -34,6 +34,7 @@ export const githubConfigSchema = z.object({
  autoMirrorStarred: z.boolean().default(false),
  skipStarredIssues: z.boolean().optional(), // Deprecated: kept for backward compatibility, use starredCodeOnly instead
  starredDuplicateStrategy: z.enum(["suffix", "prefix", "owner-org"]).default("suffix").optional(),
+  skipPersonalRepos: z.boolean().default(false),
 });

 export const backupStrategyEnum = z.enum([
@@ -156,7 +157,9 @@ export const configSchema = z.object({
  isActive: z.boolean().default(true),
  githubConfig: githubConfigSchema,
  giteaConfig: giteaConfigSchema,
+  // Unused/reserved — stored for future glob support but not currently read
  include: z.array(z.string()).default(["*"]),
+  // Unused/reserved — stored for future glob support but not currently read
  exclude: z.array(z.string()).default([]),
  scheduleConfig: scheduleConfigSchema,
  cleanupConfig: cleanupConfigSchema,
@@ -618,69 +621,121 @@ export const verifications = sqliteTable("verifications", {

 // ===== OIDC Provider Tables =====

-// OAuth Applications table
-export const oauthApplications = sqliteTable("oauth_applications", {
+// ===== OAuth 2.1 / OIDC Provider tables (@better-auth/oauth-provider) =====
+//
+// These back the OAuth/OIDC *provider* feature (gitea-mirror acting as an
+// identity provider for other apps). They are managed entirely by Better
+// Auth's drizzle adapter, so:
+//   - the exported binding name must equal the plugin model name pluralized
+//     under `usePlural: true` (oauthClient -> oauthClients, jwks -> jwkss);
+//   - the object property names must match the plugin field names (camelCase),
+//     while the SQL column names may be snake_case;
+//   - `string[]` and `json` fields are serialized to JSON text by the adapter,
+//     so they are plain `text` columns here.
+//
+// Migrated from the deprecated `oidc-provider` plugin (tables
+// oauth_applications / oauth_access_tokens / oauth_consent). See the
+// accompanying Drizzle migration for the data-preserving upgrade path.
+
+// OAuth clients (replaces the old `oauth_applications` table)
+export const oauthClients = sqliteTable("oauth_clients", {
  id: text("id").primaryKey(),
  clientId: text("client_id").notNull().unique(),
-  clientSecret: text("client_secret").notNull(),
-  name: text("name").notNull(),
-  redirectURLs: text("redirect_urls").notNull(), // Comma-separated list
-  metadata: text("metadata"), // JSON string
-  type: text("type").notNull(), // web, mobile, etc
-  disabled: integer("disabled", { mode: "boolean" }).notNull().default(false),
-  userId: text("user_id"), // Optional - owner of the application
-  createdAt: integer("created_at", { mode: "timestamp" })
-    .notNull()
-    .default(sql`(unixepoch())`),
-  updatedAt: integer("updated_at", { mode: "timestamp" })
-    .notNull()
-    .default(sql`(unixepoch())`),
+  clientSecret: text("client_secret"),
+  name: text("name"),
+  disabled: integer("disabled", { mode: "boolean" }).default(false),
+  skipConsent: integer("skip_consent", { mode: "boolean" }),
+  enableEndSession: integer("enable_end_session", { mode: "boolean" }),
+  subjectType: text("subject_type"),
+  scopes: text("scopes"), // JSON string[]
+  userId: text("user_id").references(() => users.id),
+  uri: text("uri"),
+  icon: text("icon"),
+  contacts: text("contacts"), // JSON string[]
+  tos: text("tos"),
+  policy: text("policy"),
+  softwareId: text("software_id"),
+  softwareVersion: text("software_version"),
+  softwareStatement: text("software_statement"),
+  redirectUris: text("redirect_uris").notNull(), // JSON string[]
+  postLogoutRedirectUris: text("post_logout_redirect_uris"), // JSON string[]
+  tokenEndpointAuthMethod: text("token_endpoint_auth_method"),
+  grantTypes: text("grant_types"), // JSON string[]
+  responseTypes: text("response_types"), // JSON string[]
+  public: integer("public", { mode: "boolean" }),
+  type: text("type"),
+  requirePKCE: integer("require_pkce", { mode: "boolean" }),
+  referenceId: text("reference_id"),
+  metadata: text("metadata"), // JSON
+  createdAt: integer("created_at", { mode: "timestamp" }).default(sql`(unixepoch())`),
+  updatedAt: integer("updated_at", { mode: "timestamp" }).default(sql`(unixepoch())`),
 }, (table) => [
-  index("idx_oauth_applications_client_id").on(table.clientId),
-  index("idx_oauth_applications_user_id").on(table.userId),
+  index("idx_oauth_clients_client_id").on(table.clientId),
+  index("idx_oauth_clients_user_id").on(table.userId),
 ]);

-// OAuth Access Tokens table
+// OAuth access tokens
 export const oauthAccessTokens = sqliteTable("oauth_access_tokens", {
  id: text("id").primaryKey(),
-  accessToken: text("access_token").notNull(),
-  refreshToken: text("refresh_token"),
-  accessTokenExpiresAt: integer("access_token_expires_at", { mode: "timestamp" }).notNull(),
-  refreshTokenExpiresAt: integer("refresh_token_expires_at", { mode: "timestamp" }),
+  token: text("token").unique(),
  clientId: text("client_id").notNull(),
-  userId: text("user_id").notNull().references(() => users.id),
-  scopes: text("scopes").notNull(), // Comma-separated list
-  createdAt: integer("created_at", { mode: "timestamp" })
-    .notNull()
-    .default(sql`(unixepoch())`),
-  updatedAt: integer("updated_at", { mode: "timestamp" })
-    .notNull()
-    .default(sql`(unixepoch())`),
+  sessionId: text("session_id"),
+  userId: text("user_id").references(() => users.id),
+  referenceId: text("reference_id"),
+  refreshId: text("refresh_id"),
+  expiresAt: integer("expires_at", { mode: "timestamp" }),
+  createdAt: integer("created_at", { mode: "timestamp" }).default(sql`(unixepoch())`),
+  scopes: text("scopes").notNull(), // JSON string[]
 }, (table) => [
-  index("idx_oauth_access_tokens_access_token").on(table.accessToken),
-  index("idx_oauth_access_tokens_user_id").on(table.userId),
+  index("idx_oauth_access_tokens_token").on(table.token),
  index("idx_oauth_access_tokens_client_id").on(table.clientId),
+  index("idx_oauth_access_tokens_user_id").on(table.userId),
 ]);

-// OAuth Consent table
-export const oauthConsent = sqliteTable("oauth_consent", {
+// OAuth refresh tokens (new in the OAuth 2.1 provider)
+export const oauthRefreshTokens = sqliteTable("oauth_refresh_tokens", {
  id: text("id").primaryKey(),
-  userId: text("user_id").notNull().references(() => users.id),
+  token: text("token").notNull().unique(),
  clientId: text("client_id").notNull(),
-  scopes: text("scopes").notNull(), // Comma-separated list
-  consentGiven: integer("consent_given", { mode: "boolean" }).notNull(),
-  createdAt: integer("created_at", { mode: "timestamp" })
-    .notNull()
-    .default(sql`(unixepoch())`),
-  updatedAt: integer("updated_at", { mode: "timestamp" })
-    .notNull()
-    .default(sql`(unixepoch())`),
+  sessionId: text("session_id"),
+  userId: text("user_id").notNull().references(() => users.id),
+  referenceId: text("reference_id"),
+  expiresAt: integer("expires_at", { mode: "timestamp" }),
+  createdAt: integer("created_at", { mode: "timestamp" }).default(sql`(unixepoch())`),
+  revoked: integer("revoked", { mode: "timestamp" }),
+  authTime: integer("auth_time", { mode: "timestamp" }),
+  scopes: text("scopes").notNull(), // JSON string[]
 }, (table) => [
-  index("idx_oauth_consent_user_id").on(table.userId),
-  index("idx_oauth_consent_client_id").on(table.clientId),
-  index("idx_oauth_consent_user_client").on(table.userId, table.clientId),
+  index("idx_oauth_refresh_tokens_token").on(table.token),
+  index("idx_oauth_refresh_tokens_client_id").on(table.clientId),
+  index("idx_oauth_refresh_tokens_user_id").on(table.userId),
 ]);

+// OAuth consent records
+export const oauthConsents = sqliteTable("oauth_consents", {
+  id: text("id").primaryKey(),
+  clientId: text("client_id").notNull(),
+  userId: text("user_id").references(() => users.id),
+  referenceId: text("reference_id"),
+  scopes: text("scopes").notNull(), // JSON string[]
+  createdAt: integer("created_at", { mode: "timestamp" }).default(sql`(unixepoch())`),
+  updatedAt: integer("updated_at", { mode: "timestamp" }).default(sql`(unixepoch())`),
+}, (table) => [
+  index("idx_oauth_consents_client_id").on(table.clientId),
+  index("idx_oauth_consents_user_id").on(table.userId),
+]);
+
+// JWKS keypairs for signing OIDC id_tokens (better-auth `jwt` plugin).
+// Model name "jwks" pluralizes to the binding name "jwkss" under usePlural,
+// while the physical table stays "jwks".
+export const jwkss = sqliteTable("jwks", {
+  id: text("id").primaryKey(),
+  publicKey: text("public_key").notNull(),
+  privateKey: text("private_key").notNull(),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull().default(sql`(unixepoch())`),
+  expiresAt: integer("expires_at", { mode: "timestamp" }),
+});
+
 // ===== SSO Provider Tables =====

 // SSO Providers table
@@ -689,6 +744,15 @@ export const ssoProviders = sqliteTable("sso_providers", {
  issuer: text("issuer").notNull(),
  domain: text("domain").notNull(),
  oidcConfig: text("oidc_config").notNull(), // JSON string with OIDC configuration
+  // The upgraded @better-auth/sso plugin writes this on every insert (null for OIDC providers).
+  // Drizzle's adapter rejects unknown fields, so the column must exist.
+  samlConfig: text("saml_config"),
+  // Used by the SSO plugin's account-linking trust check: a sign-in is treated
+  // as trusted when this is true AND the user's email domain matches `domain`
+  // above. We set this to true on register (see /api/auth/sso/register.ts) so
+  // domain-scoped auto-linking works out of the box; the column default keeps
+  // existing rows trusted after upgrade.
+  domainVerified: integer("domain_verified", { mode: "boolean" }).notNull().default(true),
  userId: text("user_id").notNull(), // Admin who created this provider
  providerId: text("provider_id").notNull().unique(), // Unique identifier for the provider
  organizationId: text("organization_id"), // Optional - if provider is linked to an organization
@@ -285,6 +285,8 @@ export async function initializeConfigFromEnv(): Promise<void> {
      starredCodeOnly: envConfig.github.starredCodeOnly ?? existingConfig?.[0]?.githubConfig?.starredCodeOnly ?? false,
      autoMirrorStarred: envConfig.github.autoMirrorStarred ?? existingConfig?.[0]?.githubConfig?.autoMirrorStarred ?? false,
      starredLists: envConfig.github.starredLists ?? existingConfig?.[0]?.githubConfig?.starredLists ?? [],
+      // ONLY_MIRROR_ORGS=true maps to skipPersonalRepos: true
+      skipPersonalRepos: envConfig.github.onlyMirrorOrgs ?? existingConfig?.[0]?.githubConfig?.skipPersonalRepos ?? false,
    };

    // Build Gitea config
@@ -43,13 +43,18 @@ type SyncDependencies = {
 /**
 * Enhanced repository information including mirror status
 */
-interface GiteaRepoInfo {
+export interface GiteaRepoInfo {
  id: number;
  name: string;
  owner: { login: string } | string;
  mirror: boolean;
  mirror_interval?: string;
  clone_url?: string;
+  // Original migration source URL. Gitea/Forgejo populate this with the
+  // upstream clone address for migrated/mirrored repos, so it is the
+  // authoritative way to tell whether an existing mirror points at THIS
+  // GitHub source (vs. a same-named mirror of a different source).
+  original_url?: string;
  private: boolean;
 }

@@ -421,9 +426,18 @@ export async function syncGiteaRepoEnhanced({
      throw new Error(`Repository ${repository.name} is not a mirror. Cannot sync.`);
    }

+    // Parse repository metadata state up-front. The force-push
+    // detection below needs the acknowledgedDeletions list to suppress
+    // already-handled deletions, and a successful snapshot needs to
+    // record new entries back into the same state object. The
+    // metadata-mirroring block downstream reuses this same variable.
+    const metadataState = parseRepositoryMetadataState(repository.metadata);
+    let metadataUpdated = false;
+
    // ---- Smart backup strategy with force-push detection ----
    const backupStrategy = resolveBackupStrategy(config);
    let forcePushDetected = false;
+    let forcePushAffected: ReadonlyArray<{ name: string; reason: string; giteaSha: string }> = [];

    if (backupStrategy !== "disabled") {
      // Run force-push detection if the strategy requires it
@@ -441,9 +455,11 @@ export async function syncGiteaRepoEnhanced({
              octokit: fpOctokit,
              githubOwner: repository.owner,
              githubRepo: repository.name,
+              acknowledgedDeletions: metadataState.acknowledgedDeletions,
            });

            forcePushDetected = detectionResult.detected;
+            forcePushAffected = detectionResult.affectedBranches;

            if (detectionResult.skipped) {
              console.log(
@@ -457,6 +473,39 @@ export async function syncGiteaRepoEnhanced({
                `[Sync] Force-push detected on ${repository.name}: ${branchNames}`,
              );
            }
+
+            // Record each detected "deleted" branch into the
+            // acknowledged list. We do this based on detection alone,
+            // BEFORE the backup attempt below, so that:
+            //   - concurrent sync invocations both add the entry
+            //     (the second one whose `createPreSyncBundleBackup`
+            //     short-circuits would otherwise skip the push and
+            //     race its empty in-memory state onto the metadata
+            //     row, undoing the first invocation's write);
+            //   - if the backup later fails the deletion is still
+            //     acknowledged (the branch is genuinely gone from
+            //     GitHub; not re-detecting it next sync is correct
+            //     regardless of whether THIS invocation's backup
+            //     succeeded — prior backups still exist on disk and
+            //     the user can re-trigger one manually if needed).
+            const newAcknowledged = forcePushAffected
+              .filter((b) => b.reason === "deleted")
+              .map((b) => ({ branch: b.name, giteaSha: b.giteaSha }));
+            if (newAcknowledged.length > 0) {
+              const existingKeys = new Set(
+                metadataState.acknowledgedDeletions.map(
+                  (e) => `${e.branch}@${e.giteaSha}`,
+                ),
+              );
+              for (const entry of newAcknowledged) {
+                const key = `${entry.branch}@${entry.giteaSha}`;
+                if (!existingKeys.has(key)) {
+                  metadataState.acknowledgedDeletions.push(entry);
+                  existingKeys.add(key);
+                  metadataUpdated = true;
+                }
+              }
+            }
          } else {
            console.log(
              `[Sync] Skipping force-push detection for ${repository.name}: no GitHub token`,
@@ -500,9 +549,12 @@ export async function syncGiteaRepoEnhanced({

      // Create backup if strategy says so
      if (shouldBackupForStrategy(backupStrategy, forcePushDetected)) {
-        const cloneUrl =
-          repoInfo.clone_url ||
-          `${config.giteaConfig.url.replace(/\/$/, "")}/${repoOwner}/${repoName}.git`;
+        // Always derive the clone URL from the user-configured Gitea URL rather
+        // than repoInfo.clone_url (which reflects Gitea's ROOT_URL and may be
+        // unreachable from the app — e.g. Tailscale MagicDNS deployments where
+        // ROOT_URL resolves externally but the app talks to Gitea on a private
+        // address).
+        const cloneUrl = `${config.giteaConfig.url.replace(/\/$/, "")}/${repoOwner}/${repoName}.git`;

        try {
          const backupResult = await createPreSyncBundleBackup({
@@ -519,8 +571,17 @@ export async function syncGiteaRepoEnhanced({
            repositoryName: repository.name,
            message: `Snapshot created for ${repository.name}`,
            details: `Pre-sync snapshot created at ${backupResult.bundlePath}.`,
-            status: "syncing",
+            // The snapshot is already complete (createPreSyncBundleBackup
+            // returned above). Using "syncing" here left the row in a
+            // non-terminal state and there was no later code path to
+            // advance it, so every force-push-triggered backup leaked an
+            // orphan row that accumulated on the jobs page forever.
+            status: "synced",
          });
+          // Note: acknowledging the deletion happens earlier (right
+          // after detection) so concurrent sync invocations both
+          // record the entry. Don't move it back here — see the
+          // detection block above for the rationale.
        } catch (backupError) {
          const errorMessage =
            backupError instanceof Error ? backupError.message : String(backupError);
@@ -584,8 +645,9 @@ export async function syncGiteaRepoEnhanced({
        Authorization: `token ${decryptedConfig.giteaConfig.token}`,
      });

-      const metadataState = parseRepositoryMetadataState(repository.metadata);
-      let metadataUpdated = false;
+      // metadataState + metadataUpdated are hoisted above the backup
+      // strategy block so force-push detection can read/write the
+      // acknowledged-deletions list. Don't shadow them here.
      const skipMetadataForStarred =
        repository.isStarred && config.githubConfig?.starredCodeOnly;
      let metadataOctokit: Octokit | null = null;
@@ -832,6 +894,32 @@ export async function syncGiteaRepoEnhanced({
            status: "failed",
          });
        }
+      } else if (syncError instanceof HttpError && syncError.status === 405) {
+        // Gitea returns HTTP 405 (with an empty body) when the repository is not
+        // a pull-mirror in its database — e.g. Gitea auto-disabled the mirror or
+        // the repo lost its mirror state after a manual edit.
+        const actionableMessage =
+          `Gitea reports this repository is not a pull mirror (HTTP 405). ` +
+          `In Gitea check Settings → Mirror Settings; if the mirror section is ` +
+          `missing, delete the repository in Gitea and re-mirror it from gitea-mirror.`;
+
+        await db
+          .update(repositories)
+          .set({
+            status: repoStatusEnum.parse("failed"),
+            updatedAt: new Date(),
+            errorMessage: actionableMessage,
+          })
+          .where(eq(repositories.id, repository.id!));
+
+        await createMirrorJob({
+          userId: config.userId,
+          repositoryId: repository.id,
+          repositoryName: repository.name,
+          message: `Sync failed: ${repository.name} is not a pull mirror in Gitea (HTTP 405)`,
+          details: actionableMessage,
+          status: "failed",
+        });
      }
      throw syncError;
    }
@@ -0,0 +1,200 @@
+/**
+ * Regression test for duplicate milestone & label creation on every sync.
+ *
+ * Observed in production (May 2026): a Gitea instance accumulated
+ * 11,847 duplicate closed milestones across 4 mirrored repos after only
+ * a handful of scheduled syncs. Two compounding bugs in
+ * `mirrorGitRepoMilestonesToGitea`:
+ *
+ *   (1) The existing-milestones GET to Gitea did NOT pass `state=all`.
+ *       Gitea's /milestones endpoint defaults to `state=open`, so the
+ *       `existingMilestones` Set never contained any closed milestone
+ *       title. Every closed GitHub milestone was misclassified as
+ *       missing and re-POSTed on every sync.
+ *
+ *   (2) The existing-milestones GET was a single unpaginated call.
+ *       Gitea caps response size at `[api].MAX_RESPONSE_ITEMS`
+ *       (default 50), so any repo with more milestones than that
+ *       silently truncates even when (1) is fixed.
+ *
+ * `mirrorGitRepoLabelsToGitea` has the same pagination bug (2). It
+ * doesn't have bug (1) because /labels has no state filter, and it
+ * hadn't yet shown duplicates in production only because no mirrored
+ * repo had crossed 50 distinct labels — but it would the moment one
+ * did.
+ *
+ * These tests assert on the *structure* of the source rather than
+ * invoking the functions, because behavioral tests for the metadata
+ * pipeline require heavy module mocks that pollute other test files
+ * (bun's mock.module is process-wide). Same convention as
+ * `gitea-issue-dedup-on-retry.test.ts` and
+ * `gitea-mirror-failure-recovery.test.ts`.
+ */
+import { describe, test, expect } from "bun:test";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+const SOURCE = readFileSync(join(import.meta.dir, "gitea.ts"), "utf8");
+
+/**
+ * Locate the body of a function declaration by name. Walks from the
+ * declaration, balances parens to skip the parameter list (which can
+ * contain destructured object literals with their own braces), then
+ * finds the body's opening brace and its matching close.
+ */
+function extractFunctionBody(source: string, declarationStart: RegExp): string {
+  const match = source.match(declarationStart);
+  if (!match) {
+    throw new Error(`Could not locate declaration ${declarationStart}`);
+  }
+  let i = match.index! + match[0].length;
+  while (i < source.length && source[i] !== "(") i++;
+  if (source[i] !== "(") {
+    throw new Error(`No '(' after ${declarationStart}`);
+  }
+  let parenDepth = 0;
+  for (; i < source.length; i++) {
+    if (source[i] === "(") parenDepth++;
+    else if (source[i] === ")") {
+      parenDepth--;
+      if (parenDepth === 0) {
+        i++;
+        break;
+      }
+    }
+  }
+  while (i < source.length && source[i] !== "{") i++;
+  if (source[i] !== "{") {
+    throw new Error(`No body '{' for ${declarationStart}`);
+  }
+  let braceDepth = 0;
+  const startIdx = i;
+  for (; i < source.length; i++) {
+    if (source[i] === "{") braceDepth++;
+    else if (source[i] === "}") {
+      braceDepth--;
+      if (braceDepth === 0) {
+        return source.slice(startIdx, i + 1);
+      }
+    }
+  }
+  throw new Error(`Unterminated body for ${declarationStart}`);
+}
+
+describe("milestone dedup on sync", () => {
+  const body = extractFunctionBody(
+    SOURCE,
+    /export async function mirrorGitRepoMilestonesToGitea\b/
+  );
+
+  test("body contains the per-milestone create branch we expect to guard", () => {
+    // Sanity check: anchor the rest of this suite to the right path.
+    expect(
+      body.includes("existingMilestones"),
+      "expected the existingMilestones set/map used for dedup"
+    ).toBe(true);
+    expect(
+      body.match(
+        /await httpPost\(\s*`\$\{config\.giteaConfig\.url\}\/api\/v1\/repos\/\$\{giteaOwner\}\/\$\{repoName\}\/milestones`/
+      ),
+      "expected the create-milestone httpPost call"
+    ).toBeTruthy();
+  });
+
+  test("existing-milestones GET must include state=all", () => {
+    // Without state=all, Gitea returns only open milestones, so every
+    // closed GitHub milestone is misclassified as missing and re-POSTed
+    // on every sync. This was the root cause of the production blowup.
+    const getMatch = body.match(
+      /httpGet\(\s*`\$\{config\.giteaConfig\.url\}\/api\/v1\/repos\/\$\{giteaOwner\}\/\$\{repoName\}\/milestones\?[^`]*`/
+    );
+    expect(
+      getMatch,
+      "expected a milestones httpGet call with a query string"
+    ).toBeTruthy();
+    expect(
+      /state=all/.test(getMatch![0]),
+      "the existing-milestones GET must pass state=all (Gitea defaults to state=open)"
+    ).toBe(true);
+  });
+
+  test("existing-milestones GET must paginate with both Link and X-Total-Count fallback", () => {
+    // Even with state=all, a single unpaginated call only ever sees
+    // the first 50 milestones (Gitea's MAX_RESPONSE_ITEMS cap).
+    //
+    // Gitea's /milestones endpoint does NOT emit a Link header — only
+    // `X-Total-Count`. A strict Link-only check terminates after page 1
+    // and re-POSTs every milestone past index 50 on every sync (the
+    // 9-milestone leak observed on Subnet-Calculator after the
+    // Link-only version of this fix shipped).
+    expect(
+      /milestonesPage\s*\+=\s*1/.test(body),
+      "expected a page-increment loop for existing milestones"
+    ).toBe(true);
+    expect(
+      /\.headers\.get\(\s*["']link["']\s*\)/.test(body) &&
+        /rel="next"/.test(body),
+      "the milestones pagination loop must check the Link header (rel=\"next\")"
+    ).toBe(true);
+    expect(
+      /\.headers\.get\(\s*["']x-total-count["']\s*\)/.test(body),
+      "the milestones pagination loop must fall back to X-Total-Count when Link header is absent (Gitea /milestones only emits X-Total-Count)"
+    ).toBe(true);
+  });
+
+  test("newly-created milestone must be cached into existingMilestones", () => {
+    // Defensive: if `milestones` ever contains a same-named entry
+    // twice (unlikely but cheap to guard), we shouldn't POST it twice.
+    expect(
+      /existingMilestones\.add\(\s*milestone\.title\s*\)/.test(body),
+      "after a successful create, the new milestone title must be added to existingMilestones"
+    ).toBe(true);
+  });
+});
+
+describe("label dedup on sync", () => {
+  const body = extractFunctionBody(
+    SOURCE,
+    /export async function mirrorGitRepoLabelsToGitea\b/
+  );
+
+  test("body contains the per-label create branch we expect to guard", () => {
+    expect(
+      body.includes("existingLabels"),
+      "expected the existingLabels set used for dedup"
+    ).toBe(true);
+    expect(
+      body.match(
+        /await httpPost\(\s*`\$\{config\.giteaConfig\.url\}\/api\/v1\/repos\/\$\{giteaOwner\}\/\$\{repoName\}\/labels`/
+      ),
+      "expected the create-label httpPost call"
+    ).toBeTruthy();
+  });
+
+  test("existing-labels GET must paginate with both Link and X-Total-Count fallback", () => {
+    // Same Gitea MAX_RESPONSE_ITEMS=50 cap as milestones / issues.
+    // Gitea's /labels endpoint, like /milestones, does NOT emit a Link
+    // header — only `X-Total-Count`. Strict Link-only check would
+    // silently truncate after page 1.
+    expect(
+      /labelsPage\s*\+=\s*1/.test(body),
+      "expected a page-increment loop for existing labels"
+    ).toBe(true);
+    expect(
+      /\.headers\.get\(\s*["']link["']\s*\)/.test(body) &&
+        /rel="next"/.test(body),
+      "the labels pagination loop must check the Link header (rel=\"next\")"
+    ).toBe(true);
+    expect(
+      /\.headers\.get\(\s*["']x-total-count["']\s*\)/.test(body),
+      "the labels pagination loop must fall back to X-Total-Count when Link header is absent (Gitea /labels only emits X-Total-Count)"
+    ).toBe(true);
+  });
+
+  test("newly-created label must be cached into existingLabels", () => {
+    expect(
+      /existingLabels\.add\(\s*label\.name\s*\)/.test(body),
+      "after a successful create, the new label name must be added to existingLabels"
+    ).toBe(true);
+  });
+});
@@ -0,0 +1,150 @@
+/**
+ * Unit tests for release reconciliation logic — regression for #310.
+ *
+ * Root-cause verdict: Theory A (not Theory B).
+ *
+ * The old `needsRecreation` check compared published_at-based expected indices
+ * against Gitea's API order (which mirrors sort by tag-commit-date, not
+ * published_at). For repos where published_at order permanently disagrees with
+ * tag-commit-date order, `currentExpectedIdx < nextExpectedIdx` evaluates true
+ * on every single sync, triggering delete-and-recreate forever.
+ *
+ * Discriminating evidence — unaconfig_dart fixture:
+ *   v0.1.1 published_at 2024-01-13T23:44 (earlier) → expectedOrder index 0
+ *   v0.1.0 published_at 2024-01-16T00:23 (later)   → expectedOrder index 1
+ *   v0.1.0 tagged       2024-01-13T23:30 (earlier tag commit)
+ *   v0.1.1 tagged       2024-01-13T23:42 (later tag commit)
+ *   → Gitea tag-commit order: [v0.1.1, v0.1.0] (v0.1.1 has newer commit)
+ *   → Old check: currentExpectedIdx(v0.1.1)=0 < nextExpectedIdx(v0.1.0)=1  → TRUE
+ *   → needsRecreation fires on every sync, forever.
+ *
+ * Theory B (operator inversion) would fire for ALL repos with >1 release, but
+ * field evidence shows only ~2 of 150 repos are affected — ruling it out.
+ *
+ * Fix: replaced `needsRecreation` machinery with set-based reconciliation via
+ * `classifyReleasesForReconciliation`. Releases are created when missing, skipped
+ * (or PATCH-updated if content drifted) when present. No deletions for ordering.
+ */
+
+import { describe, expect, it } from "bun:test";
+import { classifyReleasesForReconciliation } from "@/lib/gitea";
+
+describe("classifyReleasesForReconciliation", () => {
+  describe("normal repo — published_at order matches tag-commit order", () => {
+    it("creates releases missing in Gitea", () => {
+      const github = ["v1.0.0", "v1.1.0", "v1.2.0"];
+      const gitea: string[] = [];
+
+      const { toCreate, toSkip } = classifyReleasesForReconciliation(github, gitea);
+
+      expect(toCreate).toEqual(["v1.0.0", "v1.1.0", "v1.2.0"]);
+      expect(toSkip).toEqual([]);
+    });
+
+    it("skips releases already present in Gitea", () => {
+      const github = ["v1.0.0", "v1.1.0", "v1.2.0"];
+      const gitea = ["v1.0.0", "v1.1.0", "v1.2.0"];
+
+      const { toCreate, toSkip } = classifyReleasesForReconciliation(github, gitea);
+
+      expect(toCreate).toEqual([]);
+      expect(toSkip).toEqual(["v1.0.0", "v1.1.0", "v1.2.0"]);
+    });
+
+    it("creates missing releases while skipping existing ones", () => {
+      const github = ["v1.0.0", "v1.1.0", "v1.2.0"];
+      const gitea = ["v1.0.0", "v1.2.0"]; // v1.1.0 is missing
+
+      const { toCreate, toSkip } = classifyReleasesForReconciliation(github, gitea);
+
+      expect(toCreate).toEqual(["v1.1.0"]);
+      expect(toSkip).toEqual(["v1.0.0", "v1.2.0"]);
+    });
+
+    it("does NOT produce any deletions — order mismatches are ignored", () => {
+      // Even if Gitea has them in a different order, the function never suggests deletion
+      const github = ["v1.0.0", "v1.1.0"];
+      const gitea = ["v1.1.0", "v1.0.0"]; // reversed order from Gitea
+
+      const { toCreate, toSkip } = classifyReleasesForReconciliation(github, gitea);
+
+      expect(toCreate).toEqual([]);
+      expect(toSkip).toHaveLength(2);
+      expect(toSkip).toContain("v1.0.0");
+      expect(toSkip).toContain("v1.1.0");
+    });
+  });
+
+  describe("unaconfig_dart regression — published_at order disagrees with tag-commit order (#310)", () => {
+    // v0.1.0: tagged 2024-01-13T23:30, published_at 2024-01-16T00:23 (published AFTER v0.1.1)
+    // v0.1.1: tagged 2024-01-13T23:42, published_at 2024-01-13T23:44 (published BEFORE v0.1.0)
+    //
+    // Gitea display order (by tag-commit date): [v0.1.1, v0.1.0]  (v0.1.1 tagged later)
+    // GitHub published_at order (oldest first):  [v0.1.1, v0.1.0]  (v0.1.1 published earlier)
+    // Wait — in this specific case the orders AGREE. The inversion scenario is:
+    //   GitHub sorts descending (newest first): [v0.1.0, v0.1.1]
+    //   Gitea API returns by tag-commit DESC:   [v0.1.1, v0.1.0]
+    //   Old expectedOrder (ascending published): v0.1.1→0, v0.1.0→1
+    //   Check for [v0.1.1, v0.1.0]: current=v0.1.1(idx=0) < next=v0.1.0(idx=1) → TRUE every time
+
+    it("does NOT trigger recreation when published_at order and tag-commit order disagree", () => {
+      // Both releases already in Gitea (as they would be after first successful sync).
+      // Old code would fire needsRecreation=true here on every subsequent sync.
+      // New code: set-based check — both present → toCreate is empty → no deletions.
+      const github = ["v0.1.0", "v0.1.1"]; // GitHub API returns newest published_at first
+      const gitea = ["v0.1.1", "v0.1.0"];  // Gitea tag-commit order (v0.1.1 tagged later)
+
+      const { toCreate, toSkip } = classifyReleasesForReconciliation(github, gitea);
+
+      expect(toCreate).toEqual([]); // nothing to create
+      expect(toSkip).toHaveLength(2);
+      expect(toSkip).toContain("v0.1.0");
+      expect(toSkip).toContain("v0.1.1");
+    });
+
+    it("creates v0.1.0 and v0.1.1 when Gitea has no releases yet (first sync)", () => {
+      const github = ["v0.1.0", "v0.1.1"];
+      const gitea: string[] = [];
+
+      const { toCreate, toSkip } = classifyReleasesForReconciliation(github, gitea);
+
+      expect(toCreate).toEqual(["v0.1.0", "v0.1.1"]);
+      expect(toSkip).toEqual([]);
+    });
+
+    it("only creates the missing release when one of the two already exists", () => {
+      const github = ["v0.1.0", "v0.1.1"];
+      const gitea = ["v0.1.1"]; // only v0.1.1 was created so far
+
+      const { toCreate, toSkip } = classifyReleasesForReconciliation(github, gitea);
+
+      expect(toCreate).toEqual(["v0.1.0"]);
+      expect(toSkip).toEqual(["v0.1.1"]);
+    });
+  });
+
+  describe("edge cases", () => {
+    it("handles empty GitHub releases list", () => {
+      const { toCreate, toSkip } = classifyReleasesForReconciliation([], ["v1.0.0"]);
+      expect(toCreate).toEqual([]);
+      expect(toSkip).toEqual([]);
+    });
+
+    it("handles both lists empty", () => {
+      const { toCreate, toSkip } = classifyReleasesForReconciliation([], []);
+      expect(toCreate).toEqual([]);
+      expect(toSkip).toEqual([]);
+    });
+
+    it("ignores Gitea releases that are not in the GitHub set (orphans, handled by retention cleanup)", () => {
+      const github = ["v1.0.0"];
+      const gitea = ["v1.0.0", "v0.9.0"]; // v0.9.0 is an orphan not in GitHub's limited set
+
+      const { toCreate, toSkip } = classifyReleasesForReconciliation(github, gitea);
+
+      expect(toCreate).toEqual([]);
+      expect(toSkip).toEqual(["v1.0.0"]);
+      // v0.9.0 not mentioned in either output — handled by retention cleanup, not here
+    });
+  });
+});
@@ -579,7 +579,27 @@ export const mirrorGithubRepoToGitea = async ({
    // Determine the actual repository name to use (handle duplicates for starred repos)
    let targetRepoName = repository.name;

-    if (
+    // REUSE-FIRST (issues #315 / #309): before generating any (suffixed) name,
+    // check whether this exact source is already mirrored — either at the
+    // recorded mirroredLocation or at the base name. If so, reuse that location
+    // and route into the "already mirrored" handling below instead of creating
+    // a duplicate. This must run before generateUniqueRepoName so the names
+    // converge under concurrency (the in-flight guard then becomes effective).
+    const { findExistingMirror } = await import("./utils/mirror-source-match");
+    const existingMirror = await findExistingMirror({
+      repository,
+      config,
+      candidateOwner: repoOwner,
+      candidateName: repository.name,
+    });
+
+    if (existingMirror) {
+      repoOwner = existingMirror.owner;
+      targetRepoName = existingMirror.repoName;
+      console.log(
+        `Reusing existing same-source mirror for ${repository.fullName} at ${repoOwner}/${targetRepoName}`
+      );
+    } else if (
      repository.isStarred &&
      config.githubConfig &&
      (config.githubConfig.starredReposMode || "dedicated-org") === "dedicated-org"
@@ -594,6 +614,7 @@ export const mirrorGithubRepoToGitea = async ({
        githubOwner,
        fullName: repository.fullName,
        strategy: config.githubConfig.starredDuplicateStrategy,
+        sourceCloneUrl: repository.cloneUrl,
      });

      if (targetRepoName !== repository.name) {
@@ -643,45 +664,72 @@ export const mirrorGithubRepoToGitea = async ({
          strategy: "delete", // Can be configured: "skip", "delete", or "rename"
        });
      } else if (existingRepoInfo?.mirror) {
-        console.log(
-          `Repository ${targetRepoName} already exists in Gitea under ${repoOwner}. Updating database status.`
-        );
+        // PHANTOM-FORK GUARD (#309): a mirror at this name is only "ours" if it
+        // mirrors THIS source. existingMirror short-circuits the check
+        // because findExistingMirror already confirmed the source match.
+        const { isMirrorOfSource } = await import("./utils/mirror-source-match");
+        const sameSource =
+          !!existingMirror ||
+          isMirrorOfSource(existingRepoInfo, repository.cloneUrl);

-        await syncRepositoryMetadataToGitea({
-          config,
-          octokit,
-          repository,
-          giteaOwner: repoOwner,
-          giteaRepoName: targetRepoName,
-          giteaToken: decryptedConfig.giteaConfig.token,
-        });
+        if (!sameSource) {
+          // A different source occupies this name. Treat as a genuine collision:
+          // generate a unique name and fall through to create a separate mirror.
+          console.warn(
+            `[Mirror] ${repoOwner}/${targetRepoName} is a mirror of a different source. ` +
+            `Generating a unique name for ${repository.fullName} to avoid overwriting it.`
+          );
+          targetRepoName = await generateUniqueRepoName({
+            config,
+            orgName: repoOwner,
+            baseName: repository.name,
+            githubOwner: repository.fullName.split("/")[0],
+            fullName: repository.fullName,
+            strategy: config.githubConfig?.starredDuplicateStrategy,
+            sourceCloneUrl: repository.cloneUrl,
+          });
+          // expectedLocation is recomputed below before the "mirroring" write.
+        } else {
+          console.log(
+            `Repository ${targetRepoName} already exists in Gitea under ${repoOwner}. Updating database status.`
+          );

-        // Update database to reflect that the repository is already mirrored
-        await db
-          .update(repositories)
-          .set({
-            status: repoStatusEnum.parse("mirrored"),
-            updatedAt: new Date(),
-            lastMirrored: new Date(),
-            errorMessage: null,
-            mirroredLocation: `${repoOwner}/${targetRepoName}`,
-          })
-          .where(eq(repositories.id, repository.id!));
+          await syncRepositoryMetadataToGitea({
+            config,
+            octokit,
+            repository,
+            giteaOwner: repoOwner,
+            giteaRepoName: targetRepoName,
+            giteaToken: decryptedConfig.giteaConfig.token,
+          });

-        // Append log for "mirrored" status
-        await createMirrorJob({
-          userId: config.userId,
-          repositoryId: repository.id,
-          repositoryName: repository.name,
-          message: `Repository ${repository.name} already exists in Gitea`,
-          details: `Repository ${repository.name} was found to already exist in Gitea under ${repoOwner} and database status was updated.`,
-          status: "mirrored",
-        });
+          // Update database to reflect that the repository is already mirrored
+          await db
+            .update(repositories)
+            .set({
+              status: repoStatusEnum.parse("mirrored"),
+              updatedAt: new Date(),
+              lastMirrored: new Date(),
+              errorMessage: null,
+              mirroredLocation: `${repoOwner}/${targetRepoName}`,
+            })
+            .where(eq(repositories.id, repository.id!));

-        console.log(
-          `Repository ${repository.name} database status updated to mirrored`
-        );
-        return;
+          // Append log for "mirrored" status
+          await createMirrorJob({
+            userId: config.userId,
+            repositoryId: repository.id,
+            repositoryName: repository.name,
+            message: `Repository ${repository.name} already exists in Gitea`,
+            details: `Repository ${repository.name} was found to already exist in Gitea under ${repoOwner} and database status was updated.`,
+            status: "mirrored",
+          });
+
+          console.log(
+            `Repository ${repository.name} database status updated to mirrored`
+          );
+          return;
+        }
      } else {
        console.warn(
          `[Mirror] Repository ${repoOwner}/${targetRepoName} exists but mirror status could not be verified. Continuing with mirror creation flow.`
@@ -689,6 +737,10 @@ export const mirrorGithubRepoToGitea = async ({
      }
    }

+    // Recompute the target location in case a phantom-fork collision above
+    // forced a renamed target after the initial expectedLocation was derived.
+    const targetLocation = `${repoOwner}/${targetRepoName}`;
+
    console.log(`Mirroring repository ${repository.name}`);

    // DOUBLE-CHECK: Final idempotency check right before updating status
@@ -696,7 +748,7 @@ export const mirrorGithubRepoToGitea = async ({
    const finalCheck = await isRepoCurrentlyMirroring({
      config,
      repoName: targetRepoName,
-      expectedLocation,
+      expectedLocation: targetLocation,
    });

    if (finalCheck) {
@@ -714,7 +766,7 @@ export const mirrorGithubRepoToGitea = async ({
      .update(repositories)
      .set({
        status: repoStatusEnum.parse("mirroring"),
-        mirroredLocation: expectedLocation,
+        mirroredLocation: targetLocation,
        updatedAt: new Date(),
      })
      .where(eq(repositories.id, repository.id!));
@@ -1177,6 +1229,14 @@ async function isMirroredLocationClaimedInDb({
 * Checks both the Gitea instance (HTTP) and the local DB (mirroredLocation)
 * to reduce collisions during concurrent batch mirroring.
 *
+ * Source-aware (issues #315 / #309): when a candidate name is already occupied
+ * by a mirror of THIS SAME GitHub source, the name is REUSED rather than
+ * suffixed — this is what previously caused starred repos to spawn `-owner`,
+ * `-owner-1`, … duplicates on every re-mirror. Suffixing only happens on a
+ * genuine different-source collision (preserving the #95/#236 cross-owner
+ * behavior). The per-user DB claim check is retained so two users mirroring the
+ * same source into a shared org stay separated.
+ *
 * NOTE: This function only checks availability — it does NOT claim the name.
 * The actual claim happens later when mirroredLocation is written at the
 * status="mirroring" DB update, which is protected by a unique partial index
@@ -1189,6 +1249,7 @@ async function generateUniqueRepoName({
  githubOwner,
  fullName,
  strategy,
+  sourceCloneUrl,
 }: {
  config: Partial<Config>;
  orgName: string;
@@ -1196,6 +1257,10 @@ async function generateUniqueRepoName({
  githubOwner: string;
  fullName: string;
  strategy?: string;
+  // Source GitHub clone URL, used to decide whether an occupied name belongs to
+  // THIS repo's mirror (reuse) or a different source (suffix). When omitted,
+  // behavior degrades to the legacy "any occupant collides" semantics.
+  sourceCloneUrl?: string;
 }): Promise<string> {
  if (!fullName?.includes("/")) {
    throw new Error(
@@ -1206,33 +1271,55 @@ async function generateUniqueRepoName({
  const duplicateStrategy = strategy || "suffix";
  const userId = config.userId || "";

-  // Helper: check both Gitea and local DB for a candidate name
-  const isNameTaken = async (candidateName: string): Promise<boolean> => {
+  const { getGiteaRepoInfo } = await import("./gitea-enhanced");
+  const { classifyCandidateName } = await import("./utils/mirror-source-match");
+
+  // Resolve the I/O for a candidate name (Gitea existence, DB claim, repo info)
+  // and defer the available/reusable/taken decision to the pure, unit-tested
+  // classifyCandidateName helper.
+  const classifyName = async (candidateName: string) => {
    const existsInGitea = await isRepoPresentInGitea({
      config,
      owner: orgName,
      repoName: candidateName,
    });
-    if (existsInGitea) return true;

-    // Also check local DB to catch concurrent batch operations
-    // where another repo claimed this location but hasn't created it in Gitea yet
+    // A DB claim by a DIFFERENT repo (concurrent batch) always blocks reuse.
+    let claimedByOther = false;
    if (userId) {
-      const claimedInDb = await isMirroredLocationClaimedInDb({
+      claimedByOther = await isMirroredLocationClaimedInDb({
        userId,
        candidateLocation: `${orgName}/${candidateName}`,
        excludeFullName: fullName,
      });
-      if (claimedInDb) return true;
    }

-    return false;
+    // Only fetch repo info when it can actually change the decision (existing,
+    // same-source candidate that is not DB-claimed by another repo).
+    const repoInfo =
+      existsInGitea && sourceCloneUrl && !claimedByOther
+        ? await getGiteaRepoInfo({
+            config,
+            owner: orgName,
+            repoName: candidateName,
+          })
+        : null;
+
+    return classifyCandidateName({
+      existsInGitea,
+      claimedByOther,
+      repoInfo,
+      sourceCloneUrl,
+    });
  };

-  // First check if base name is available
-  const baseExists = await isNameTaken(baseName);
-
-  if (!baseExists) {
+  // First check the base name — reuse it if it already holds our own mirror.
+  const baseClass = await classifyName(baseName);
+  if (baseClass === "available") {
+    return baseName;
+  }
+  if (baseClass === "reusable") {
+    console.log(`Reusing existing same-source mirror name: ${orgName}/${baseName}`);
    return baseName;
  }

@@ -1262,9 +1349,14 @@ async function generateUniqueRepoName({
        break;
    }

-    const exists = await isNameTaken(candidateName);
+    const candidateClass = await classifyName(candidateName);

-    if (!exists) {
+    if (candidateClass === "reusable") {
+      console.log(`Reusing existing same-source mirror name: ${orgName}/${candidateName}`);
+      return candidateName;
+    }
+
+    if (candidateClass === "available") {
      console.log(`Found unique name for duplicate starred repo: ${candidateName}`);
      return candidateName;
    }
@@ -1314,8 +1406,29 @@ export async function mirrorGitHubRepoToGiteaOrg({

    // Determine the actual repository name to use (handle duplicates for starred repos)
    let targetRepoName = repository.name;
+    // The org we will record/reuse for. Stays === orgName on the create path
+    // (migration uses orgName + giteaOrgId); a reuse hit may repoint it to the
+    // recorded mirroredLocation's owner for the early-return DB update.
+    let targetOwner = orgName;

-    if (
+    // REUSE-FIRST (issues #315 / #309): reuse an existing same-source mirror
+    // before generating any suffixed name. See mirrorGithubRepoToGitea for the
+    // rationale. Routes a hit into the "already mirrored" handling below.
+    const { findExistingMirror } = await import("./utils/mirror-source-match");
+    const existingMirror = await findExistingMirror({
+      repository,
+      config,
+      candidateOwner: orgName,
+      candidateName: repository.name,
+    });
+
+    if (existingMirror) {
+      targetOwner = existingMirror.owner;
+      targetRepoName = existingMirror.repoName;
+      console.log(
+        `Reusing existing same-source mirror for ${repository.fullName} at ${targetOwner}/${targetRepoName}`
+      );
+    } else if (
      repository.isStarred &&
      config.githubConfig &&
      (config.githubConfig.starredReposMode || "dedicated-org") === "dedicated-org"
@@ -1330,6 +1443,7 @@ export async function mirrorGitHubRepoToGiteaOrg({
        githubOwner,
        fullName: repository.fullName,
        strategy: config.githubConfig.starredDuplicateStrategy,
+        sourceCloneUrl: repository.cloneUrl,
      });

      if (targetRepoName !== repository.name) {
@@ -1340,7 +1454,7 @@ export async function mirrorGitHubRepoToGiteaOrg({
    }

    // IDEMPOTENCY CHECK: Check if this repo is already being mirrored
-    const expectedLocation = `${orgName}/${targetRepoName}`;
+    const expectedLocation = `${targetOwner}/${targetRepoName}`;
    const isCurrentlyMirroring = await isRepoCurrentlyMirroring({
      config,
      repoName: targetRepoName,
@@ -1358,7 +1472,7 @@ export async function mirrorGitHubRepoToGiteaOrg({

    const isExisting = await isRepoPresentInGitea({
      config,
-      owner: orgName,
+      owner: targetOwner,
      repoName: targetRepoName,
    });

@@ -1366,7 +1480,7 @@ export async function mirrorGitHubRepoToGiteaOrg({
      const { getGiteaRepoInfo, handleExistingNonMirrorRepo } = await import("./gitea-enhanced");
      const existingRepoInfo = await getGiteaRepoInfo({
        config,
-        owner: orgName,
+        owner: targetOwner,
        repoName: targetRepoName,
      });

@@ -1379,52 +1493,83 @@ export async function mirrorGitHubRepoToGiteaOrg({
          strategy: "delete", // Can be configured: "skip", "delete", or "rename"
        });
      } else if (existingRepoInfo?.mirror) {
-        console.log(
-          `Repository ${targetRepoName} already exists in Gitea organization ${orgName}. Updating database status.`
-        );
+        // PHANTOM-FORK GUARD (#309): only treat this as "ours" if it mirrors
+        // THIS source. existingMirror short-circuits because findExistingMirror already
+        // confirmed the source match.
+        const { isMirrorOfSource } = await import("./utils/mirror-source-match");
+        const sameSource =
+          !!existingMirror ||
+          isMirrorOfSource(existingRepoInfo, repository.cloneUrl);

-        await syncRepositoryMetadataToGitea({
-          config,
-          octokit,
-          repository,
-          giteaOwner: orgName,
-          giteaRepoName: targetRepoName,
-          giteaToken: decryptedConfig.giteaConfig.token,
-        });
+        if (!sameSource) {
+          // Different source occupies this name: generate a unique name and
+          // fall through to create a separate mirror under orgName/giteaOrgId.
+          console.warn(
+            `[Mirror] ${targetOwner}/${targetRepoName} is a mirror of a different source. ` +
+            `Generating a unique name for ${repository.fullName} to avoid overwriting it.`
+          );
+          targetOwner = orgName;
+          targetRepoName = await generateUniqueRepoName({
+            config,
+            orgName,
+            baseName: repository.name,
+            githubOwner: repository.fullName.split("/")[0],
+            fullName: repository.fullName,
+            strategy: config.githubConfig?.starredDuplicateStrategy,
+            sourceCloneUrl: repository.cloneUrl,
+          });
+        } else {
+          console.log(
+            `Repository ${targetRepoName} already exists in Gitea organization ${targetOwner}. Updating database status.`
+          );

-        // Update database to reflect that the repository is already mirrored
-        await db
-          .update(repositories)
-          .set({
-            status: repoStatusEnum.parse("mirrored"),
-            updatedAt: new Date(),
-            lastMirrored: new Date(),
-            errorMessage: null,
-            mirroredLocation: `${orgName}/${targetRepoName}`,
-          })
-          .where(eq(repositories.id, repository.id!));
+          await syncRepositoryMetadataToGitea({
+            config,
+            octokit,
+            repository,
+            giteaOwner: targetOwner,
+            giteaRepoName: targetRepoName,
+            giteaToken: decryptedConfig.giteaConfig.token,
+          });

-        // Create a mirror job log entry
-        await createMirrorJob({
-          userId: config.userId,
-          repositoryId: repository.id,
-          repositoryName: repository.name,
-          message: `Repository ${targetRepoName} already exists in Gitea organization ${orgName}`,
-          details: `Repository ${targetRepoName} was found to already exist in Gitea organization ${orgName} and database status was updated.`,
-          status: "mirrored",
-        });
+          // Update database to reflect that the repository is already mirrored
+          await db
+            .update(repositories)
+            .set({
+              status: repoStatusEnum.parse("mirrored"),
+              updatedAt: new Date(),
+              lastMirrored: new Date(),
+              errorMessage: null,
+              mirroredLocation: `${targetOwner}/${targetRepoName}`,
+            })
+            .where(eq(repositories.id, repository.id!));

-        console.log(
-          `Repository ${targetRepoName} database status updated to mirrored in organization ${orgName}`
-        );
-        return;
+          // Create a mirror job log entry
+          await createMirrorJob({
+            userId: config.userId,
+            repositoryId: repository.id,
+            repositoryName: repository.name,
+            message: `Repository ${targetRepoName} already exists in Gitea organization ${targetOwner}`,
+            details: `Repository ${targetRepoName} was found to already exist in Gitea organization ${targetOwner} and database status was updated.`,
+            status: "mirrored",
+          });
+
+          console.log(
+            `Repository ${targetRepoName} database status updated to mirrored in organization ${targetOwner}`
+          );
+          return;
+        }
      } else {
        console.warn(
-          `[Mirror] Repository ${orgName}/${targetRepoName} exists but mirror status could not be verified. Continuing with mirror creation flow.`
+          `[Mirror] Repository ${targetOwner}/${targetRepoName} exists but mirror status could not be verified. Continuing with mirror creation flow.`
        );
      }
    }

+    // Recompute the target location in case a phantom-fork collision above
+    // forced a renamed target after the initial expectedLocation was derived.
+    const targetLocation = `${orgName}/${targetRepoName}`;
+
    console.log(
      `Mirroring repository ${repository.fullName} to organization ${orgName} as ${targetRepoName}`
    );
@@ -1437,7 +1582,7 @@ export async function mirrorGitHubRepoToGiteaOrg({
    const finalCheck = await isRepoCurrentlyMirroring({
      config,
      repoName: targetRepoName,
-      expectedLocation,
+      expectedLocation: targetLocation,
    });

    if (finalCheck) {
@@ -1455,7 +1600,7 @@ export async function mirrorGitHubRepoToGiteaOrg({
      .update(repositories)
      .set({
        status: repoStatusEnum.parse("mirroring"),
-        mirroredLocation: expectedLocation,
+        mirroredLocation: targetLocation,
        updatedAt: new Date(),
      })
      .where(eq(repositories.id, repository.id!));
@@ -2515,6 +2660,37 @@ export const mirrorGitRepoIssuesToGitea = async ({
  );
 };

+/**
+ * Classify a set of GitHub releases against the set already present in Gitea.
+ *
+ * Returns:
+ *   - `toCreate`: tag names that exist on GitHub but are missing from Gitea
+ *   - `toSkip`:   tag names that already exist in Gitea (will be handled by PATCH-if-content-changed)
+ *
+ * Deliberately does NOT return anything to delete based on ordering — Gitea mirrors
+ * order releases by tag-commit date, which can permanently disagree with GitHub's
+ * published_at order (e.g. unaconfig_dart v0.1.0/v0.1.1 — #310). Destroying and
+ * re-emitting releases for a cosmetic display-order difference is never worth it.
+ */
+export function classifyReleasesForReconciliation(
+  githubTagNames: string[],
+  giteaTagNames: string[]
+): { toCreate: string[]; toSkip: string[] } {
+  const giteaSet = new Set(giteaTagNames);
+  const toCreate: string[] = [];
+  const toSkip: string[] = [];
+
+  for (const tag of githubTagNames) {
+    if (giteaSet.has(tag)) {
+      toSkip.push(tag);
+    } else {
+      toCreate.push(tag);
+    }
+  }
+
+  return { toCreate, toSkip };
+}
+
 export async function mirrorGitHubReleasesToGitea({
  octokit,
  repository,
@@ -2601,23 +2777,10 @@ export async function mirrorGitHubReleasesToGitea({
  let mirroredCount = 0;
  let skippedCount = 0;

-  const getReleaseTimestamp = (release: (typeof limitedReleases)[number]) => {
-    // Use published_at first (when the release was published on GitHub)
-    // Fall back to created_at (when the git tag was created) only if published_at is missing
-    // This matches GitHub's sorting behavior and handles cases where multiple tags
-    // point to the same commit but have different publish dates
-    const sourceDate = release.published_at ?? release.created_at ?? "";
-    const timestamp = sourceDate ? new Date(sourceDate).getTime() : 0;
-    return Number.isFinite(timestamp) ? timestamp : 0;
-  };
+  // Process releases in their GitHub API order (newest first by default)
+  const releasesToProcess = limitedReleases.slice();

-  // Capture the latest releases, then process them oldest-to-newest so Gitea mirrors keep chronological order
-  const releasesToProcess = limitedReleases
-    .slice()
-    .sort((a, b) => getReleaseTimestamp(b) - getReleaseTimestamp(a))
-    .sort((a, b) => getReleaseTimestamp(a) - getReleaseTimestamp(b));
-
-  console.log(`[Releases] Processing ${releasesToProcess.length} releases in chronological order (oldest to newest by published date)`);
+  console.log(`[Releases] Processing ${releasesToProcess.length} releases for ${repository.fullName}`);
  releasesToProcess.forEach((rel, idx) => {
    const publishedDate = new Date(rel.published_at || rel.created_at);
    const createdDate = new Date(rel.created_at);
@@ -2627,85 +2790,10 @@ export async function mirrorGitHubReleasesToGitea({
    console.log(`[Releases] ${idx + 1}. ${rel.tag_name} - ${dateInfo}`);
  });

-  // Check if existing releases in Gitea are in the wrong order
-  // If so, we need to delete and recreate them to fix the ordering
-  let needsRecreation = false;
-  try {
-    const existingReleasesResponse = await httpGet(
-      `${config.giteaConfig.url}/api/v1/repos/${repoOwner}/${repoName}/releases?per_page=100`,
-      {
-        Authorization: `token ${decryptedConfig.giteaConfig.token}`,
-      }
-    ).catch(() => null);
-
-    if (existingReleasesResponse && existingReleasesResponse.data && Array.isArray(existingReleasesResponse.data)) {
-      const existingReleases = existingReleasesResponse.data;
-
-      if (existingReleases.length > 0) {
-        console.log(`[Releases] Found ${existingReleases.length} existing releases in Gitea, checking chronological order...`);
-
-        // Create a map of tag_name to expected chronological index (0 = oldest, n = newest)
-        const expectedOrder = new Map<string, number>();
-        releasesToProcess.forEach((rel, idx) => {
-          expectedOrder.set(rel.tag_name, idx);
-        });
-
-        // Check if existing releases are in the correct order based on created_unix
-        // Gitea sorts by created_unix DESC, so newer releases should have higher created_unix values
-        const releasesThatShouldExist = existingReleases.filter(r => expectedOrder.has(r.tag_name));
-
-        if (releasesThatShouldExist.length > 1) {
-          for (let i = 0; i < releasesThatShouldExist.length - 1; i++) {
-            const current = releasesThatShouldExist[i];
-            const next = releasesThatShouldExist[i + 1];
-
-            const currentExpectedIdx = expectedOrder.get(current.tag_name)!;
-            const nextExpectedIdx = expectedOrder.get(next.tag_name)!;
-
-            // Since Gitea returns releases sorted by created_unix DESC:
-            // - Earlier releases in the list should have HIGHER expected indices (newer)
-            // - Later releases in the list should have LOWER expected indices (older)
-            if (currentExpectedIdx < nextExpectedIdx) {
-              console.log(`[Releases] ⚠️  Incorrect ordering detected: ${current.tag_name} (index ${currentExpectedIdx}) appears before ${next.tag_name} (index ${nextExpectedIdx})`);
-              needsRecreation = true;
-              break;
-            }
-          }
-        }
-
-        if (needsRecreation) {
-          console.log(`[Releases] ⚠️  Releases are in incorrect chronological order. Will delete and recreate all releases.`);
-
-          // Delete all existing releases that we're about to recreate
-          for (const existingRelease of releasesThatShouldExist) {
-            try {
-              console.log(`[Releases] Deleting incorrectly ordered release: ${existingRelease.tag_name}`);
-              await httpDelete(
-                `${config.giteaConfig.url}/api/v1/repos/${repoOwner}/${repoName}/releases/${existingRelease.id}`,
-                {
-                  Authorization: `token ${decryptedConfig.giteaConfig.token}`,
-                }
-              );
-            } catch (deleteError) {
-              console.error(`[Releases] Failed to delete release ${existingRelease.tag_name}: ${deleteError instanceof Error ? deleteError.message : String(deleteError)}`);
-            }
-          }
-
-          console.log(`[Releases] ✅ Deleted ${releasesThatShouldExist.length} releases. Will recreate in correct chronological order.`);
-        } else {
-          console.log(`[Releases] ✅ Existing releases are in correct chronological order.`);
-        }
-      }
-    }
-  } catch (orderCheckError) {
-    console.warn(`[Releases] Could not verify release order: ${orderCheckError instanceof Error ? orderCheckError.message : String(orderCheckError)}`);
-    // Continue with normal processing
-  }
-
  for (const release of releasesToProcess) {
    try {
-      // Check if release already exists (skip check if we just deleted all releases)
-      const existingReleasesResponse = needsRecreation ? null : await httpGet(
+      // Always check if release already exists — reconcile by tag set, not by ordering
+      const existingReleasesResponse = await httpGet(
        `${config.giteaConfig.url}/api/v1/repos/${repoOwner}/${repoName}/releases/tags/${release.tag_name}`,
        {
          Authorization: `token ${decryptedConfig.giteaConfig.token}`,
@@ -2842,12 +2930,6 @@ export async function mirrorGitHubReleasesToGitea({
      mirroredCount++;
      const noteInfo = originalReleaseNote ? ` with ${originalReleaseNote.length} character changelog` : " without changelog";
      console.log(`[Releases] Successfully mirrored release: ${release.tag_name}${noteInfo}`);
-
-      // Add delay to ensure proper timestamp ordering in Gitea
-      // Gitea sorts releases by created_unix DESC, and all releases created in quick succession
-      // will have nearly identical timestamps. The 1-second delay ensures proper chronological order.
-      console.log(`[Releases] Waiting 1 second to ensure proper timestamp ordering in Gitea...`);
-      await new Promise(resolve => setTimeout(resolve, 1000));
    } catch (error) {
      console.error(`[Releases] Failed to mirror release ${release.tag_name}: ${error instanceof Error ? error.message : String(error)}`);
    }
@@ -3408,17 +3490,49 @@ export async function mirrorGitRepoLabelsToGitea({
    return;
  }

-  // Get existing labels from Gitea
-  const giteaLabelsRes = await httpGet(
-    `${config.giteaConfig.url}/api/v1/repos/${giteaOwner}/${repoName}/labels`,
-    {
-      Authorization: `token ${decryptedConfig.giteaConfig.token}`,
-    }
-  );
+  // Get existing labels from Gitea. Paginate because Gitea caps
+  // response size at `[api].MAX_RESPONSE_ITEMS` (default 50), so a
+  // single unpaginated GET only sees the first 50 labels. Once a repo
+  // crosses that threshold every label past it would be re-POSTed as a
+  // duplicate on every sync.
+  //
+  // Pagination signal: prefer Link header (RFC 5988) when present, but
+  // Gitea's /labels and /milestones endpoints do NOT emit Link headers
+  // — they only emit `X-Total-Count`. Without the fallback, a strict
+  // Link-only check terminated after page 1 and re-POSTed every label
+  // past index 50 on every sync. (Repro found during the milestone
+  // dedup fix: 9 unique milestones leaked past page 1 on a 74-row
+  // /milestones response.)
+  const existingLabels = new Set<string>();
+  const labelsPerPage = 50;
+  let labelsPage = 1;
+  let labelsFetched = 0;
+  while (true) {
+    const giteaLabelsRes = await httpGet(
+      `${config.giteaConfig.url}/api/v1/repos/${giteaOwner}/${repoName}/labels?page=${labelsPage}&limit=${labelsPerPage}`,
+      {
+        Authorization: `token ${decryptedConfig.giteaConfig.token}`,
+      }
+    );
+    const pageLabels = Array.isArray(giteaLabelsRes.data) ? giteaLabelsRes.data : [];
+    if (!pageLabels.length) break;
+    for (const lbl of pageLabels) existingLabels.add(lbl.name);
+    labelsFetched += pageLabels.length;

-  const existingLabels = new Set(
-    giteaLabelsRes.data.map((label: any) => label.name)
-  );
+    const linkHeader = giteaLabelsRes.headers.get("link") || "";
+    if (/\brel="next"/.test(linkHeader)) {
+      labelsPage += 1;
+      continue;
+    }
+    // No Link header (or no rel=next). Fall back to X-Total-Count.
+    const totalStr = giteaLabelsRes.headers.get("x-total-count");
+    const total = totalStr ? Number.parseInt(totalStr, 10) : NaN;
+    if (Number.isFinite(total) && labelsFetched < total) {
+      labelsPage += 1;
+      continue;
+    }
+    break;
+  }

  let mirroredCount = 0;
  for (const label of labels) {
@@ -3435,6 +3549,9 @@ export async function mirrorGitRepoLabelsToGitea({
            Authorization: `token ${decryptedConfig.giteaConfig.token}`,
          }
        );
+        // Track locally so a duplicate in `labels` (shouldn't happen,
+        // but defensive) doesn't trigger a second POST in the same run.
+        existingLabels.add(label.name);
        mirroredCount++;
      } catch (error) {
        console.error(
@@ -3508,17 +3625,54 @@ export async function mirrorGitRepoMilestonesToGitea({
    return;
  }

-  // Get existing milestones from Gitea
-  const giteaMilestonesRes = await httpGet(
-    `${config.giteaConfig.url}/api/v1/repos/${giteaOwner}/${repoName}/milestones`,
-    {
-      Authorization: `token ${decryptedConfig.giteaConfig.token}`,
-    }
-  );
+  // Get existing milestones from Gitea. Two correctness requirements:
+  //   1. `state=all` — Gitea's /milestones endpoint defaults to OPEN
+  //      only, so without this every CLOSED GitHub milestone is
+  //      misclassified as missing and re-POSTed on every sync. This
+  //      was the root cause of the 11k+ duplicate-closed-milestone
+  //      blowup observed in production.
+  //   2. Pagination via Link header (RFC 5988) — Gitea caps response
+  //      size at `[api].MAX_RESPONSE_ITEMS` (default 50), so any repo
+  //      with more than ~50 milestones in a given state silently
+  //      truncates without it. Same Gitea-side cap that bit the
+  //      issues / PRs pre-fetch in commit b76073b.
+  // Pagination signal: prefer Link header (RFC 5988) when present, but
+  // Gitea's /milestones endpoint does NOT emit a Link header — it only
+  // emits `X-Total-Count`. A strict Link-only check terminates after
+  // page 1 and re-POSTs every milestone past index 50 on every sync.
+  // (Repro: post-fix deploy on Subnet-Calculator leaked 9 unique
+  // milestones past page 1 of a 74-row /milestones response.)
+  const existingMilestones = new Set<string>();
+  const milestonesPerPage = 50;
+  let milestonesPage = 1;
+  let milestonesFetched = 0;
+  while (true) {
+    const giteaMilestonesRes = await httpGet(
+      `${config.giteaConfig.url}/api/v1/repos/${giteaOwner}/${repoName}/milestones?state=all&page=${milestonesPage}&limit=${milestonesPerPage}`,
+      {
+        Authorization: `token ${decryptedConfig.giteaConfig.token}`,
+      }
+    );
+    const pageMilestones = Array.isArray(giteaMilestonesRes.data)
+      ? giteaMilestonesRes.data
+      : [];
+    if (!pageMilestones.length) break;
+    for (const ms of pageMilestones) existingMilestones.add(ms.title);
+    milestonesFetched += pageMilestones.length;

-  const existingMilestones = new Set(
-    giteaMilestonesRes.data.map((milestone: any) => milestone.title)
-  );
+    const linkHeader = giteaMilestonesRes.headers.get("link") || "";
+    if (/\brel="next"/.test(linkHeader)) {
+      milestonesPage += 1;
+      continue;
+    }
+    const totalStr = giteaMilestonesRes.headers.get("x-total-count");
+    const total = totalStr ? Number.parseInt(totalStr, 10) : NaN;
+    if (Number.isFinite(total) && milestonesFetched < total) {
+      milestonesPage += 1;
+      continue;
+    }
+    break;
+  }

  let mirroredCount = 0;
  for (const milestone of milestones) {
@@ -3536,6 +3690,9 @@ export async function mirrorGitRepoMilestonesToGitea({
            Authorization: `token ${decryptedConfig.giteaConfig.token}`,
          }
        );
+        // Track locally so a duplicate within `milestones` (shouldn't
+        // happen, but defensive) doesn't trigger a second POST.
+        existingMilestones.add(milestone.title);
        mirroredCount++;
      } catch (error) {
        console.error(
@@ -1,15 +1,23 @@
 import { describe, expect, test, mock } from "bun:test";
 import { getGithubRepositories } from "@/lib/github";

-function makeRepo() {
+function makeRepo(overrides: Partial<{
+  name: string;
+  full_name: string;
+  ownerLogin: string;
+  ownerType: string;
+  fork: boolean;
+}> = {}) {
+  const ownerLogin = overrides.ownerLogin ?? "octo";
+  const ownerType = overrides.ownerType ?? "User";
  return {
-    name: "demo",
-    full_name: "octo/demo",
-    html_url: "https://github.com/octo/demo",
-    clone_url: "https://github.com/octo/demo.git",
-    owner: { login: "octo", type: "User" },
+    name: overrides.name ?? "demo",
+    full_name: overrides.full_name ?? `${ownerLogin}/${overrides.name ?? "demo"}`,
+    html_url: `https://github.com/${ownerLogin}/${overrides.name ?? "demo"}`,
+    clone_url: `https://github.com/${ownerLogin}/${overrides.name ?? "demo"}.git`,
+    owner: { login: ownerLogin, type: ownerType },
    private: false,
-    fork: false,
+    fork: overrides.fork ?? false,
    has_issues: true,
    archived: false,
    size: 1,
@@ -23,11 +31,11 @@ function makeRepo() {
  };
 }

-function makeOctokit() {
+function makeOctokit(reposToReturn?: ReturnType<typeof makeRepo>[]) {
  let captured: Record<string, unknown> | null = null;
  const paginate = mock(async (_method: unknown, options?: Record<string, unknown>) => {
    captured = options ?? null;
-    return [makeRepo()];
+    return reposToReturn ?? [makeRepo()];
  });
  return {
    octokit: {
@@ -98,3 +106,61 @@ describe("getGithubRepositories - affiliation", () => {
    }
  });
 });
+
+describe("getGithubRepositories - skipPersonalRepos", () => {
+  const personalRepo = makeRepo({ name: "my-lib", ownerLogin: "octo", ownerType: "User" });
+  const orgRepo = makeRepo({ name: "org-lib", ownerLogin: "my-org", ownerType: "Organization" });
+  const otherUserRepo = makeRepo({ name: "collab-lib", ownerLogin: "other-user", ownerType: "User" });
+
+  test("default false — keeps all repos including personal", async () => {
+    const { octokit } = makeOctokit([personalRepo, orgRepo]);
+    const repos = await getGithubRepositories({
+      octokit,
+      config: { githubConfig: { owner: "octo", skipPersonalRepos: false } as any },
+    });
+    expect(repos.map((r) => r.name)).toContain("my-lib");
+    expect(repos.map((r) => r.name)).toContain("org-lib");
+  });
+
+  test("skipPersonalRepos=true — drops repos owned by authenticated user", async () => {
+    const { octokit } = makeOctokit([personalRepo, orgRepo]);
+    const repos = await getGithubRepositories({
+      octokit,
+      config: { githubConfig: { owner: "octo", skipPersonalRepos: true } as any },
+    });
+    expect(repos.map((r) => r.name)).not.toContain("my-lib");
+    expect(repos.map((r) => r.name)).toContain("org-lib");
+  });
+
+  test("skipPersonalRepos=true — keeps repos owned by other users (collaborator repos)", async () => {
+    const { octokit } = makeOctokit([personalRepo, orgRepo, otherUserRepo]);
+    const repos = await getGithubRepositories({
+      octokit,
+      config: { githubConfig: { owner: "octo", skipPersonalRepos: true } as any },
+    });
+    expect(repos.map((r) => r.name)).not.toContain("my-lib");
+    expect(repos.map((r) => r.name)).toContain("org-lib");
+    expect(repos.map((r) => r.name)).toContain("collab-lib");
+  });
+
+  test("skipPersonalRepos=true with no owner configured — keeps all repos (safe fallback)", async () => {
+    const { octokit } = makeOctokit([personalRepo, orgRepo]);
+    const repos = await getGithubRepositories({
+      octokit,
+      config: { githubConfig: { owner: "", skipPersonalRepos: true } as any },
+    });
+    // Empty owner means we can't identify the user, so nothing should be dropped
+    expect(repos.map((r) => r.name)).toContain("my-lib");
+    expect(repos.map((r) => r.name)).toContain("org-lib");
+  });
+
+  test("skipPersonalRepos=true — unset (undefined) behaves like false", async () => {
+    const { octokit } = makeOctokit([personalRepo, orgRepo]);
+    const repos = await getGithubRepositories({
+      octokit,
+      config: { githubConfig: { owner: "octo" } as any },
+    });
+    expect(repos.map((r) => r.name)).toContain("my-lib");
+    expect(repos.map((r) => r.name)).toContain("org-lib");
+  });
+});
@@ -263,10 +263,21 @@ export async function getGithubRepositories({
    );

    const skipForks = config.githubConfig?.skipForks ?? false;
+    const skipPersonalRepos = config.githubConfig?.skipPersonalRepos ?? false;
+    // The authenticated user's login — used to identify personally-owned repos
+    const authenticatedUserLogin = config.githubConfig?.owner ?? "";

    const filteredRepos = repos.filter((repo) => {
      const isForkAllowed = !skipForks || !repo.fork;
-      return isForkAllowed;
+      // When skipPersonalRepos is true, drop repos owned by the authenticated user
+      // (owner.type === "User" and owner.login matches the configured GitHub username).
+      // Org repos have owner.type === "Organization" so they are always kept.
+      const isPersonalRepo =
+        skipPersonalRepos &&
+        authenticatedUserLogin.length > 0 &&
+        repo.owner.login === authenticatedUserLogin &&
+        repo.owner.type === "User";
+      return isForkAllowed && !isPersonalRepo;
    });

    return filteredRepos.map((repo) => ({
@@ -6,9 +6,22 @@ interface MetadataComponentsState {
  milestones: boolean;
 }

+/**
+ * One-shot record of a deleted-branch backup we already took, so the
+ * force-push detector knows to skip the same (branch, giteaSha) pair
+ * next sync. Without this, deleted-on-GitHub branches that linger in
+ * the Gitea mirror trip the detector every cycle and create a new
+ * "Snapshot created" job row forever.
+ */
+export interface AcknowledgedDeletion {
+  branch: string;
+  giteaSha: string;
+}
+
 export interface RepositoryMetadataState {
  components: MetadataComponentsState;
  lastSyncedAt?: string;
+  acknowledgedDeletions: AcknowledgedDeletion[];
 }

 const defaultComponents: MetadataComponentsState = {
@@ -22,6 +35,7 @@ const defaultComponents: MetadataComponentsState = {
 export function createDefaultMetadataState(): RepositoryMetadataState {
  return {
    components: { ...defaultComponents },
+    acknowledgedDeletions: [],
  };
 }

@@ -65,6 +79,20 @@ export function parseRepositoryMetadataState(
    base.lastSyncedAt = parsed.lastMetadataSync;
  }

+  if (Array.isArray(parsed.acknowledgedDeletions)) {
+    base.acknowledgedDeletions = parsed.acknowledgedDeletions.flatMap(
+      (entry: unknown): AcknowledgedDeletion[] => {
+        if (!entry || typeof entry !== "object") return [];
+        const branch = (entry as { branch?: unknown }).branch;
+        const giteaSha = (entry as { giteaSha?: unknown }).giteaSha;
+        if (typeof branch !== "string" || typeof giteaSha !== "string") {
+          return [];
+        }
+        return [{ branch, giteaSha }];
+      }
+    );
+  }
+
  return base;
 }

@@ -103,6 +103,28 @@ describe("Scheduler Service - Ignored Repository Handling", () => {
    ]);
  });

+  test("auto-start gate: enabled=true → should start, enabled=false → should not start even with mirrorInterval", () => {
+    // Mirror the gate logic from checkAutoStartConfiguration / performInitialAutoStart.
+    // The enabled flag is the single authoritative signal; a configured
+    // mirrorInterval is a timing detail and must not bypass a disabled toggle.
+    const shouldAutoStart = (scheduleConfig?: { enabled?: boolean }) =>
+      scheduleConfig?.enabled === true;
+
+    expect(shouldAutoStart({ enabled: true })).toBe(true);
+    expect(shouldAutoStart({ enabled: false })).toBe(false);
+    expect(shouldAutoStart({})).toBe(false);
+    expect(shouldAutoStart(undefined)).toBe(false);
+
+    // Simulating: user disabled scheduling but has a mirrorInterval configured.
+    // The old code checked `scheduleEnabled || hasMirrorInterval`; the fix
+    // ensures only the enabled flag is checked.
+    const configWithIntervalButDisabled = {
+      scheduleConfig: { enabled: false },
+      giteaConfig: { mirrorInterval: "8h" },
+    };
+    expect(shouldAutoStart(configWithIntervalButDisabled.scheduleConfig)).toBe(false);
+  });
+
  test("should validate all repository status enum values", () => {
    const validStatuses = [
      "imported",
@@ -266,6 +266,27 @@ async function runScheduledSync(config: any): Promise<void> {
                    visibility: repositoryVisibilityEnum.parse(repo.visibility),
                  };

+                  // A `failed` repo whose recorded location still resolves to a
+                  // live same-source mirror (e.g. migrate succeeded but metadata
+                  // failed) must be SYNCED, not re-created — otherwise the
+                  // re-create loop spawns suffixed duplicates (#315). The create
+                  // path also reuses now, but routing to sync here avoids a
+                  // wasted migrate attempt and keeps recovery cheap.
+                  if (repo.status === 'failed' && repository.mirroredLocation) {
+                    const { findExistingMirror } = await import('@/lib/utils/mirror-source-match');
+                    const existing = await findExistingMirror({
+                      repository,
+                      config,
+                      candidateOwner: repository.mirroredLocation.split('/')[0] || '',
+                      candidateName: repository.name,
+                    });
+                    if (existing) {
+                      await syncGiteaRepo({ config, repository });
+                      console.log(`[Scheduler] Re-synced failed repository with live mirror: ${repo.fullName}`);
+                      return;
+                    }
+                  }
+
                  await mirrorGithubRepoToGitea({ octokit, repository, config });
                  console.log(`[Scheduler] Auto-mirrored repository: ${repo.fullName}`);
                } catch (error) {
@@ -431,13 +452,16 @@ async function checkAutoStartConfiguration(): Promise<boolean> {
      .where(eq(configs.isActive, true));
    
    for (const config of activeConfigs) {
-      // Check if scheduling is enabled via environment
+      // Check if scheduling is enabled.
+      // Note: env-config-loader already sets scheduleConfig.enabled=true when
+      // GITEA_MIRROR_INTERVAL is set at startup, so the enabled flag is the
+      // single authoritative gate here. Checking hasMirrorInterval directly
+      // would allow a configured interval to trigger auto-start even after the
+      // user explicitly disabled scheduling via the UI.
      const scheduleEnabled = config.scheduleConfig?.enabled === true;
-      const hasMirrorInterval = !!config.giteaConfig?.mirrorInterval;
-      
-      // If either SCHEDULE_ENABLED=true or GITEA_MIRROR_INTERVAL is set, we should auto-start
-      if (scheduleEnabled || hasMirrorInterval) {
-        console.log(`[Scheduler] Auto-start conditions met for user ${config.userId} (scheduleEnabled=${scheduleEnabled}, hasMirrorInterval=${hasMirrorInterval})`);
+
+      if (scheduleEnabled) {
+        console.log(`[Scheduler] Auto-start conditions met for user ${config.userId} (scheduleEnabled=${scheduleEnabled})`);
        return true;
      }
    }
@@ -472,10 +496,12 @@ async function performInitialAutoStart(): Promise<void> {
      }
      
      const scheduleEnabled = config.scheduleConfig?.enabled === true;
-      const hasMirrorInterval = !!config.giteaConfig?.mirrorInterval;
-      
-      // Only process configs that have scheduling or mirror interval configured
-      if (!scheduleEnabled && !hasMirrorInterval) {
+
+      // Only process configs where scheduling is explicitly enabled.
+      // env-config-loader already sets enabled=true when GITEA_MIRROR_INTERVAL
+      // is present, so this single check covers both the UI toggle and the
+      // env-var boot path without letting a bare interval override a disabled toggle.
+      if (!scheduleEnabled) {
        continue;
      }
      
@@ -1,303 +0,0 @@
-/**
- * Enhanced handler for starred repositories with improved error handling
- */
-
-import type { Config, Repository } from "./db/schema";
-import { Octokit } from "@octokit/rest";
-import { processWithRetry } from "./utils/concurrency";
-import { 
-  getOrCreateGiteaOrgEnhanced, 
-  getGiteaRepoInfo,
-  handleExistingNonMirrorRepo,
-  createOrganizationsSequentially 
-} from "./gitea-enhanced";
-import { mirrorGithubRepoToGitea } from "./gitea";
-import { getMirrorStrategyConfig } from "./utils/mirror-strategies";
-import { createMirrorJob } from "./helpers";
-
-/**
- * Process starred repositories with enhanced error handling
- */
-export async function processStarredRepositories({
-  config,
-  repositories,
-  octokit,
-}: {
-  config: Config;
-  repositories: Repository[];
-  octokit: Octokit;
-}): Promise<void> {
-  if (!config.userId) {
-    throw new Error("User ID is required");
-  }
-
-  const strategyConfig = getMirrorStrategyConfig();
-  
-  console.log(`Processing ${repositories.length} starred repositories`);
-  console.log(`Using strategy config:`, strategyConfig);
-
-  // Step 1: Pre-create organizations to avoid race conditions
-  if (strategyConfig.sequentialOrgCreation) {
-    await preCreateOrganizations({ config, repositories });
-  }
-
-  // Step 2: Process repositories with enhanced error handling
-  await processWithRetry(
-    repositories,
-    async (repository) => {
-      try {
-        await processStarredRepository({
-          config,
-          repository,
-          octokit,
-          strategyConfig,
-        });
-        return repository;
-      } catch (error) {
-        console.error(`Failed to process starred repository ${repository.name}:`, error);
-        throw error;
-      }
-    },
-    {
-      concurrencyLimit: strategyConfig.repoBatchSize,
-      maxRetries: 2,
-      retryDelay: 2000,
-      onProgress: (completed, total, result) => {
-        const percentComplete = Math.round((completed / total) * 100);
-        if (result) {
-          console.log(
-            `Processed starred repository "${result.name}" (${completed}/${total}, ${percentComplete}%)`
-          );
-        }
-      },
-      onRetry: (repo, error, attempt) => {
-        console.log(
-          `Retrying starred repository ${repo.name} (attempt ${attempt}): ${error.message}`
-        );
-      },
-    }
-  );
-}
-
-/**
- * Pre-create all required organizations sequentially
- */
-async function preCreateOrganizations({
-  config,
-  repositories,
-}: {
-  config: Config;
-  repositories: Repository[];
-}): Promise<void> {
-  // Get unique organization names
-  const orgNames = new Set<string>();
-  
-  const starredReposMode = config.githubConfig?.starredReposMode || "dedicated-org";
-
-  if (starredReposMode === "preserve-owner") {
-    for (const repo of repositories) {
-      orgNames.add(repo.organization || repo.owner);
-    }
-  } else if (config.githubConfig?.starredReposOrg) {
-    orgNames.add(config.githubConfig.starredReposOrg);
-  } else {
-    orgNames.add("starred");
-  }
-
-  // Add any other organizations based on mirror strategy
-  for (const repo of repositories) {
-    if (repo.destinationOrg) {
-      orgNames.add(repo.destinationOrg);
-    }
-  }
-
-  console.log(`Pre-creating ${orgNames.size} organizations sequentially`);
-
-  // Create organizations sequentially
-  await createOrganizationsSequentially({
-    config,
-    orgNames: Array.from(orgNames),
-  });
-}
-
-/**
- * Process a single starred repository with enhanced error handling
- */
-async function processStarredRepository({
-  config,
-  repository,
-  octokit,
-  strategyConfig,
-}: {
-  config: Config;
-  repository: Repository;
-  octokit: Octokit;
-  strategyConfig: ReturnType<typeof getMirrorStrategyConfig>;
-}): Promise<void> {
-  const starredReposMode = config.githubConfig?.starredReposMode || "dedicated-org";
-  const starredOrg =
-    starredReposMode === "preserve-owner"
-      ? repository.organization || repository.owner
-      : config.githubConfig?.starredReposOrg || "starred";
-  
-  // Check if repository exists in Gitea
-  const existingRepo = await getGiteaRepoInfo({
-    config,
-    owner: starredOrg,
-    repoName: repository.name,
-  });
-
-  if (existingRepo) {
-    if (existingRepo.mirror) {
-      console.log(`Starred repository ${repository.name} already exists as a mirror`);
-      
-      // Update database status
-      const { db, repositories: reposTable } = await import("./db");
-      const { eq } = await import("drizzle-orm");
-      const { repoStatusEnum } = await import("@/types/Repository");
-      
-      await db
-        .update(reposTable)
-        .set({
-          status: repoStatusEnum.parse("mirrored"),
-          updatedAt: new Date(),
-          lastMirrored: new Date(),
-          errorMessage: null,
-          mirroredLocation: `${starredOrg}/${repository.name}`,
-        })
-        .where(eq(reposTable.id, repository.id!));
-      
-      return;
-    } else {
-      // Repository exists but is not a mirror
-      console.warn(`Starred repository ${repository.name} exists but is not a mirror`);
-      
-      await handleExistingNonMirrorRepo({
-        config,
-        repository,
-        repoInfo: existingRepo,
-        strategy: strategyConfig.nonMirrorStrategy,
-      });
-      
-      // If we deleted it, continue to create the mirror
-      if (strategyConfig.nonMirrorStrategy !== "delete") {
-        return; // Skip if we're not deleting
-      }
-    }
-  }
-
-  // Create the mirror
-  try {
-    await mirrorGithubRepoToGitea({
-      octokit,
-      repository,
-      config,
-    });
-  } catch (error) {
-    // Enhanced error handling for specific scenarios
-    if (error instanceof Error) {
-      const errorMessage = error.message.toLowerCase();
-      
-      if (errorMessage.includes("already exists")) {
-        // Handle race condition where repo was created by another process
-        console.log(`Repository ${repository.name} was created by another process`);
-        
-        // Check if it's a mirror now
-        const recheck = await getGiteaRepoInfo({
-          config,
-          owner: starredOrg,
-          repoName: repository.name,
-        });
-        
-        if (recheck && recheck.mirror) {
-          // It's now a mirror, update database
-          const { db, repositories: reposTable } = await import("./db");
-          const { eq } = await import("drizzle-orm");
-          const { repoStatusEnum } = await import("@/types/Repository");
-          
-          await db
-            .update(reposTable)
-            .set({
-              status: repoStatusEnum.parse("mirrored"),
-              updatedAt: new Date(),
-              lastMirrored: new Date(),
-              errorMessage: null,
-              mirroredLocation: `${starredOrg}/${repository.name}`,
-            })
-            .where(eq(reposTable.id, repository.id!));
-          
-          return;
-        }
-      }
-    }
-    
-    throw error;
-  }
-}
-
-/**
- * Sync all starred repositories
- */
-export async function syncStarredRepositories({
-  config,
-  repositories,
-}: {
-  config: Config;
-  repositories: Repository[];
-}): Promise<void> {
-  const strategyConfig = getMirrorStrategyConfig();
-  
-  console.log(`Syncing ${repositories.length} starred repositories`);
-
-  await processWithRetry(
-    repositories,
-    async (repository) => {
-      try {
-        // Import syncGiteaRepo
-        const { syncGiteaRepo } = await import("./gitea");
-        
-        await syncGiteaRepo({
-          config,
-          repository,
-        });
-        
-        return repository;
-      } catch (error) {
-        if (error instanceof Error && error.message.includes("not a mirror")) {
-          console.warn(`Repository ${repository.name} is not a mirror, handling...`);
-          
-          const starredReposMode = config.githubConfig?.starredReposMode || "dedicated-org";
-          const starredOrg =
-            starredReposMode === "preserve-owner"
-              ? repository.organization || repository.owner
-              : config.githubConfig?.starredReposOrg || "starred";
-          const repoInfo = await getGiteaRepoInfo({
-            config,
-            owner: starredOrg,
-            repoName: repository.name,
-          });
-          
-          if (repoInfo) {
-            await handleExistingNonMirrorRepo({
-              config,
-              repository,
-              repoInfo,
-              strategy: strategyConfig.nonMirrorStrategy,
-            });
-          }
-        }
-        
-        throw error;
-      }
-    },
-    {
-      concurrencyLimit: strategyConfig.repoBatchSize,
-      maxRetries: 1,
-      retryDelay: 1000,
-      onProgress: (completed, total) => {
-        const percentComplete = Math.round((completed / total) * 100);
-        console.log(`Sync progress: ${completed}/${total} (${percentComplete}%)`);
-      },
-    }
-  );
-}
@@ -124,3 +124,37 @@ test("githubConfigSchema parses includeCollaboratorRepos with true default", ()
  });
  expect(parsed.includeCollaboratorRepos).toBe(true);
 });
+
+test("skipPersonalRepos defaults to false in githubConfigSchema", () => {
+  const parsed = githubConfigSchema.parse({
+    owner: "octo",
+    type: "personal",
+    token: "",
+  });
+  expect(parsed.skipPersonalRepos).toBe(false);
+});
+
+test("skipPersonalRepos round-trips UI -> DB -> UI when true", () => {
+  const ui = buildMinimalUiConfigs();
+  const advancedWithSkip: AdvancedOptions = { ...ui.advancedOptions, skipPersonalRepos: true };
+  const db = mapUiToDbConfig(ui.githubConfig, ui.giteaConfig, ui.mirrorOptions, advancedWithSkip);
+  expect(db.githubConfig.skipPersonalRepos).toBe(true);
+
+  const roundTripped = mapDbToUiConfig({ githubConfig: db.githubConfig, giteaConfig: db.giteaConfig });
+  expect(roundTripped.advancedOptions.skipPersonalRepos).toBe(true);
+});
+
+test("skipPersonalRepos round-trips UI -> DB -> UI when false", () => {
+  const ui = buildMinimalUiConfigs();
+  const advancedWithSkip: AdvancedOptions = { ...ui.advancedOptions, skipPersonalRepos: false };
+  const db = mapUiToDbConfig(ui.githubConfig, ui.giteaConfig, ui.mirrorOptions, advancedWithSkip);
+  expect(db.githubConfig.skipPersonalRepos).toBe(false);
+
+  const roundTripped = mapDbToUiConfig({ githubConfig: db.githubConfig, giteaConfig: db.giteaConfig });
+  expect(roundTripped.advancedOptions.skipPersonalRepos).toBe(false);
+});
+
+test("DB row missing skipPersonalRepos defaults to false on read", () => {
+  const ui = mapDbToUiConfig({ githubConfig: { owner: "octo", token: "" } });
+  expect(ui.advancedOptions.skipPersonalRepos).toBe(false);
+});
@@ -71,6 +71,7 @@ export function mapUiToDbConfig(
    // Advanced options
    starredCodeOnly: advancedOptions.starredCodeOnly,
    autoMirrorStarred: advancedOptions.autoMirrorStarred ?? false,
+    skipPersonalRepos: advancedOptions.skipPersonalRepos ?? false,
  };

  // Map Gitea config to match database schema
@@ -194,6 +195,7 @@ export function mapDbToUiConfig(dbConfig: any): {
    // Support both old (skipStarredIssues) and new (starredCodeOnly) field names for backward compatibility
    starredCodeOnly: dbConfig.githubConfig?.starredCodeOnly ?? (dbConfig.githubConfig as any)?.skipStarredIssues ?? false,
    autoMirrorStarred: dbConfig.githubConfig?.autoMirrorStarred ?? false,
+    skipPersonalRepos: dbConfig.githubConfig?.skipPersonalRepos ?? false,
  };

  return {
@@ -316,4 +316,189 @@ describe("detectForcePush", () => {
    expect(result.skipped).toBe(true);
    expect(result.skipReason).toContain("Failed to fetch GitHub branches");
  });
+
+  // --- acknowledgedDeletions: suppress already-handled deleted branches ---
+  //
+  // Production reproduction (Simple-WP-Helpdesk, May 2026): a branch
+  // deleted on GitHub remained in the Gitea mirror because gitea-mirror
+  // is one-way. Every 4h sync re-detected it as "deleted" and inserted
+  // a fresh "Snapshot created" job row — 7 zombies accumulated in 24h.
+  // Fix: caller threads in the list of (branch, giteaSha) pairs already
+  // backed up; detector suppresses matching entries.
+
+  it("suppresses a deleted branch when acknowledged at the same giteaSha", async () => {
+    const deps = makeDeps({
+      giteaBranches: [
+        { name: "main", sha: "aaa" },
+        { name: "fix/abandoned", sha: "bbb" },
+      ],
+      githubBranches: [{ name: "main", sha: "aaa" }],
+    });
+
+    const result = await detectForcePush({
+      ...baseArgs,
+      octokit: dummyOctokit,
+      acknowledgedDeletions: [{ branch: "fix/abandoned", giteaSha: "bbb" }],
+      _deps: deps,
+    });
+
+    expect(result.detected).toBe(false);
+    expect(result.affectedBranches).toHaveLength(0);
+  });
+
+  it("re-flags a previously-acknowledged branch if its giteaSha changed", async () => {
+    // Edge case: a deleted branch was restored (Gitea picked up the
+    // new history), then re-deleted. Same name but different giteaSha
+    // means the acknowledged entry doesn't match — back up the new
+    // state.
+    const deps = makeDeps({
+      giteaBranches: [
+        { name: "main", sha: "aaa" },
+        { name: "fix/abandoned", sha: "ccc" },
+      ],
+      githubBranches: [{ name: "main", sha: "aaa" }],
+    });
+
+    const result = await detectForcePush({
+      ...baseArgs,
+      octokit: dummyOctokit,
+      acknowledgedDeletions: [{ branch: "fix/abandoned", giteaSha: "bbb" }], // stale SHA
+      _deps: deps,
+    });
+
+    expect(result.detected).toBe(true);
+    expect(result.affectedBranches).toHaveLength(1);
+    expect(result.affectedBranches[0]).toMatchObject({
+      name: "fix/abandoned",
+      reason: "deleted",
+      giteaSha: "ccc",
+    });
+  });
+
+  it("suppresses only the acknowledged deletion when multiple deletions exist", async () => {
+    const deps = makeDeps({
+      giteaBranches: [
+        { name: "main", sha: "aaa" },
+        { name: "fix/old", sha: "bbb" },
+        { name: "fix/new", sha: "ccc" },
+      ],
+      githubBranches: [{ name: "main", sha: "aaa" }],
+    });
+
+    const result = await detectForcePush({
+      ...baseArgs,
+      octokit: dummyOctokit,
+      acknowledgedDeletions: [{ branch: "fix/old", giteaSha: "bbb" }],
+      _deps: deps,
+    });
+
+    expect(result.detected).toBe(true);
+    expect(result.affectedBranches).toHaveLength(1);
+    expect(result.affectedBranches[0]?.name).toBe("fix/new");
+  });
+
+  it("treats undefined acknowledgedDeletions as empty (back-compat with callers that don't pass it)", async () => {
+    const deps = makeDeps({
+      giteaBranches: [
+        { name: "main", sha: "aaa" },
+        { name: "fix/abandoned", sha: "bbb" },
+      ],
+      githubBranches: [{ name: "main", sha: "aaa" }],
+    });
+
+    const result = await detectForcePush({
+      ...baseArgs,
+      octokit: dummyOctokit,
+      // acknowledgedDeletions omitted
+      _deps: deps,
+    });
+
+    expect(result.detected).toBe(true);
+    expect(result.affectedBranches[0]?.reason).toBe("deleted");
+  });
+
+  it("does not suppress diverged branches via the acknowledgedDeletions list", async () => {
+    // The suppression list is specifically for `reason: "deleted"`.
+    // A divergence at the same name + matching old giteaSha (an
+    // impossible-in-practice combination, but be explicit about the
+    // boundary) must still report.
+    const deps = makeDeps({
+      giteaBranches: [{ name: "main", sha: "aaa" }],
+      githubBranches: [{ name: "main", sha: "rewritten" }],
+      ancestryResult: false,
+    });
+
+    const result = await detectForcePush({
+      ...baseArgs,
+      octokit: dummyOctokit,
+      acknowledgedDeletions: [{ branch: "main", giteaSha: "aaa" }],
+      _deps: deps,
+    });
+
+    expect(result.detected).toBe(true);
+    expect(result.affectedBranches[0]?.reason).toBe("diverged");
+  });
+});
+
+// --- metadata-state round-trip for the new acknowledgedDeletions field ---
+
+describe("metadata-state acknowledgedDeletions persistence", () => {
+  it("parse → mutate → serialize → parse round-trips entries cleanly", async () => {
+    const {
+      parseRepositoryMetadataState,
+      serializeRepositoryMetadataState,
+      createDefaultMetadataState,
+    } = await import("../metadata-state");
+
+    const state = createDefaultMetadataState();
+    state.acknowledgedDeletions.push(
+      { branch: "fix/abandoned", giteaSha: "bbb" },
+      { branch: "fix/other", giteaSha: "ccc" },
+    );
+
+    const reparsed = parseRepositoryMetadataState(
+      serializeRepositoryMetadataState(state),
+    );
+
+    expect(reparsed.acknowledgedDeletions).toEqual([
+      { branch: "fix/abandoned", giteaSha: "bbb" },
+      { branch: "fix/other", giteaSha: "ccc" },
+    ]);
+  });
+
+  it("defaults acknowledgedDeletions to [] for legacy metadata blobs", async () => {
+    const { parseRepositoryMetadataState } = await import("../metadata-state");
+
+    // Metadata that predates this field — no acknowledgedDeletions key
+    const legacy = JSON.stringify({
+      components: {
+        releases: true,
+        issues: false,
+        pullRequests: false,
+        labels: false,
+        milestones: false,
+      },
+      lastSyncedAt: "2026-05-01T00:00:00Z",
+    });
+
+    expect(parseRepositoryMetadataState(legacy).acknowledgedDeletions).toEqual([]);
+  });
+
+  it("drops malformed acknowledged entries without throwing", async () => {
+    const { parseRepositoryMetadataState } = await import("../metadata-state");
+
+    const malformed = JSON.stringify({
+      components: {},
+      acknowledgedDeletions: [
+        { branch: "good", giteaSha: "abc" },
+        { branch: 42, giteaSha: "abc" }, // bad type
+        null,
+        { branch: "missing-sha" },
+      ],
+    });
+
+    expect(parseRepositoryMetadataState(malformed).acknowledgedDeletions).toEqual([
+      { branch: "good", giteaSha: "abc" },
+    ]);
+  });
 });
@@ -11,6 +11,7 @@

 import type { Octokit } from "@octokit/rest";
 import { httpGet, HttpError } from "@/lib/http-client";
+import type { AcknowledgedDeletion } from "@/lib/metadata-state";

 // ---- Types ----

@@ -172,6 +173,7 @@ export async function detectForcePush({
  octokit,
  githubOwner,
  githubRepo,
+  acknowledgedDeletions,
  _deps,
 }: {
  giteaUrl: string;
@@ -181,6 +183,18 @@ export async function detectForcePush({
  octokit: Octokit;
  githubOwner: string;
  githubRepo: string;
+  /**
+   * Deleted-branch backups we already took. A Gitea branch missing
+   * from GitHub is suppressed from `affectedBranches` when its current
+   * giteaSha matches an entry here. Without this, deleted branches
+   * trip detection every sync because gitea-mirror is one-way:
+   * deletions never propagate to the Gitea mirror, so the "branch in
+   * Gitea, gone from GitHub" condition holds forever and we'd take a
+   * fresh snapshot on every cycle.
+   *
+   * Stored on the repository row via RepositoryMetadataState.
+   */
+  acknowledgedDeletions?: readonly AcknowledgedDeletion[];
  /** @internal — test-only dependency injection */
  _deps?: {
    fetchGiteaBranches: typeof fetchGiteaBranches;
@@ -189,6 +203,9 @@ export async function detectForcePush({
  };
 }): Promise<ForcePushDetectionResult> {
  const deps = _deps ?? { fetchGiteaBranches, fetchGitHubBranches, checkAncestry };
+  const acknowledged = new Set(
+    (acknowledgedDeletions ?? []).map((entry) => `${entry.branch}@${entry.giteaSha}`),
+  );

  // 1. Fetch Gitea branches
  let giteaBranches: BranchInfo[];
@@ -237,7 +254,16 @@ export async function detectForcePush({
    const githubSha = githubBranchMap.get(giteaBranch.name);

    if (githubSha === undefined) {
-      // Branch was deleted on GitHub
+      // Branch was deleted on GitHub. Suppress if we already took a
+      // snapshot at this exact giteaSha — the deletion is permanent
+      // on the GitHub side but the branch lingers in the Gitea
+      // mirror, so without this check the detector trips every sync.
+      // If the giteaSha later changes (branch restored, then deleted
+      // again with new history), the entry won't match and we'll
+      // back up the new state.
+      if (acknowledged.has(`${giteaBranch.name}@${giteaBranch.sha}`)) {
+        continue;
+      }
      affected.push({
        name: giteaBranch.name,
        reason: "deleted",
@@ -0,0 +1,420 @@
+import { describe, test, expect } from "bun:test";
+import {
+  normalizeCloneUrl,
+  cloneUrlsMatch,
+  isMirrorOfSource,
+  classifyCandidateName,
+  findExistingMirror,
+} from "./mirror-source-match";
+import type { Repository } from "@/lib/db/schema";
+import type { Config } from "@/types/config";
+
+// Minimal Repository factory for tests. Only the fields read by the helper
+// matter (cloneUrl, mirroredLocation, fullName, name).
+function makeRepo(overrides: Partial<Repository> = {}): Repository {
+  return {
+    id: "repo-1",
+    userId: "user-1",
+    configId: "config-1",
+    name: "Update",
+    fullName: "NostalgiaForInfinity/Update",
+    url: "https://github.com/NostalgiaForInfinity/Update",
+    cloneUrl: "https://github.com/NostalgiaForInfinity/Update.git",
+    owner: "NostalgiaForInfinity",
+    organization: undefined,
+    mirroredLocation: "",
+    isPrivate: false,
+    isForked: false,
+    forkedFrom: undefined,
+    hasIssues: false,
+    isStarred: true,
+    isArchived: false,
+    size: 0,
+    hasLFS: false,
+    hasSubmodules: false,
+    language: undefined,
+    description: undefined,
+    defaultBranch: "main",
+    visibility: "public",
+    status: "imported",
+    lastMirrored: undefined,
+    errorMessage: undefined,
+    createdAt: new Date(),
+    updatedAt: new Date(),
+    ...overrides,
+  } as unknown as Repository;
+}
+
+const config: Partial<Config> = {
+  userId: "user-1",
+  giteaConfig: { url: "https://gitea.example.com", token: "t" } as any,
+};
+
+describe("normalizeCloneUrl", () => {
+  test("strips trailing .git", () => {
+    expect(normalizeCloneUrl("https://github.com/a/b.git")).toBe(
+      "https://github.com/a/b"
+    );
+  });
+
+  test("strips embedded credentials", () => {
+    expect(normalizeCloneUrl("https://x-access-token:ghp_secret@github.com/a/b.git")).toBe(
+      "https://github.com/a/b"
+    );
+  });
+
+  test("strips trailing slash", () => {
+    expect(normalizeCloneUrl("https://github.com/a/b/")).toBe(
+      "https://github.com/a/b"
+    );
+  });
+
+  test("lowercases host (and value)", () => {
+    expect(normalizeCloneUrl("https://GitHub.com/a/b")).toBe(
+      "https://github.com/a/b"
+    );
+  });
+
+  test("returns empty string for blank/invalid input", () => {
+    expect(normalizeCloneUrl("")).toBe("");
+    expect(normalizeCloneUrl(null)).toBe("");
+    expect(normalizeCloneUrl(undefined)).toBe("");
+  });
+
+  test("handles scp-style git URLs via fallback", () => {
+    expect(normalizeCloneUrl("git@github.com:a/b.git")).toBe("git@github.com:a/b");
+  });
+});
+
+describe("cloneUrlsMatch", () => {
+  test("https vs token-embedded URL match", () => {
+    expect(
+      cloneUrlsMatch(
+        "https://github.com/a/b.git",
+        "https://x-access-token:tok@github.com/a/b.git"
+      )
+    ).toBe(true);
+  });
+
+  test(".git suffix and trailing slash differences match", () => {
+    expect(
+      cloneUrlsMatch("https://github.com/a/b", "https://github.com/a/b.git/")
+    ).toBe(true);
+  });
+
+  test("host case-insensitive match", () => {
+    expect(
+      cloneUrlsMatch("https://GITHUB.com/a/b", "https://github.com/a/b")
+    ).toBe(true);
+  });
+
+  test("different repos do not match", () => {
+    expect(
+      cloneUrlsMatch("https://github.com/a/b", "https://github.com/c/d")
+    ).toBe(false);
+  });
+
+  test("empty/unknown URL never matches", () => {
+    expect(cloneUrlsMatch("", "https://github.com/a/b")).toBe(false);
+    expect(cloneUrlsMatch("https://github.com/a/b", undefined)).toBe(false);
+  });
+});
+
+describe("isMirrorOfSource", () => {
+  test("true when mirror with matching original_url", () => {
+    expect(
+      isMirrorOfSource(
+        { mirror: true, original_url: "https://github.com/a/b" } as any,
+        "https://github.com/a/b.git"
+      )
+    ).toBe(true);
+  });
+
+  test("false when not a mirror", () => {
+    expect(
+      isMirrorOfSource(
+        { mirror: false, original_url: "https://github.com/a/b" } as any,
+        "https://github.com/a/b"
+      )
+    ).toBe(false);
+  });
+
+  test("false when original_url is for a different source (phantom fork)", () => {
+    expect(
+      isMirrorOfSource(
+        { mirror: true, original_url: "https://github.com/other/repo" } as any,
+        "https://github.com/a/b"
+      )
+    ).toBe(false);
+  });
+
+  test("false when original_url missing (cannot confirm)", () => {
+    expect(
+      isMirrorOfSource({ mirror: true } as any, "https://github.com/a/b")
+    ).toBe(false);
+  });
+
+  test("false for null repoInfo", () => {
+    expect(isMirrorOfSource(null, "https://github.com/a/b")).toBe(false);
+  });
+});
+
+describe("findExistingMirror", () => {
+  test("reuses existing same-source mirror at base candidate name (#315)", async () => {
+    const repo = makeRepo();
+    const getRepoInfo = async ({ owner, repoName }: any) => {
+      if (owner === "starred" && repoName === "Update") {
+        return {
+          mirror: true,
+          original_url: "https://github.com/NostalgiaForInfinity/Update",
+        } as any;
+      }
+      return null;
+    };
+
+    const match = await findExistingMirror({
+      repository: repo,
+      config,
+      candidateOwner: "starred",
+      candidateName: "Update",
+      getRepoInfo,
+    });
+
+    expect(match).not.toBeNull();
+    expect(match!.owner).toBe("starred");
+    expect(match!.repoName).toBe("Update");
+  });
+
+  test("reuses via mirroredLocation even when base name differs (strategy change, #309)", async () => {
+    // Strategy changed; current candidate name would be "Update" under "starred",
+    // but the historical mirror lives at "myorg/Update-NostalgiaForInfinity".
+    const repo = makeRepo({
+      mirroredLocation: "myorg/Update-NostalgiaForInfinity",
+    });
+    const getRepoInfo = async ({ owner, repoName }: any) => {
+      if (owner === "myorg" && repoName === "Update-NostalgiaForInfinity") {
+        return {
+          mirror: true,
+          original_url: "https://github.com/NostalgiaForInfinity/Update",
+        } as any;
+      }
+      return null;
+    };
+
+    const match = await findExistingMirror({
+      repository: repo,
+      config,
+      candidateOwner: "starred",
+      candidateName: "Update",
+      getRepoInfo,
+    });
+
+    expect(match).not.toBeNull();
+    expect(match!.owner).toBe("myorg");
+    expect(match!.repoName).toBe("Update-NostalgiaForInfinity");
+  });
+
+  test("returns null on genuine different-source collision (regression guard #95/#236)", async () => {
+    const repo = makeRepo();
+    const getRepoInfo = async ({ owner, repoName }: any) => {
+      if (owner === "starred" && repoName === "Update") {
+        // Same name, but it mirrors a DIFFERENT source.
+        return {
+          mirror: true,
+          original_url: "https://github.com/someoneelse/Update",
+        } as any;
+      }
+      return null;
+    };
+
+    const match = await findExistingMirror({
+      repository: repo,
+      config,
+      candidateOwner: "starred",
+      candidateName: "Update",
+      getRepoInfo,
+    });
+
+    expect(match).toBeNull();
+  });
+
+  test("returns null for phantom fork (non-mirror at the name)", async () => {
+    const repo = makeRepo();
+    const getRepoInfo = async ({ owner, repoName }: any) => {
+      if (owner === "starred" && repoName === "Update") {
+        return { mirror: false, original_url: "" } as any;
+      }
+      return null;
+    };
+
+    const match = await findExistingMirror({
+      repository: repo,
+      config,
+      candidateOwner: "starred",
+      candidateName: "Update",
+      getRepoInfo,
+    });
+
+    expect(match).toBeNull();
+  });
+
+  test("falls back to fresh creation when mirroredLocation is stale (Gitea repo deleted)", async () => {
+    const repo = makeRepo({ mirroredLocation: "starred/Update" });
+    // Both the recorded location and the base candidate are gone.
+    const getRepoInfo = async () => null;
+
+    const match = await findExistingMirror({
+      repository: repo,
+      config,
+      candidateOwner: "starred",
+      candidateName: "Update",
+      getRepoInfo,
+    });
+
+    expect(match).toBeNull();
+  });
+
+  test("matches mirror even when original_url is token-embedded / .git-suffixed", async () => {
+    const repo = makeRepo();
+    const getRepoInfo = async ({ owner, repoName }: any) => {
+      if (owner === "starred" && repoName === "Update") {
+        return {
+          mirror: true,
+          original_url:
+            "https://x-access-token:tok@github.com/NostalgiaForInfinity/Update.git",
+        } as any;
+      }
+      return null;
+    };
+
+    const match = await findExistingMirror({
+      repository: repo,
+      config,
+      candidateOwner: "starred",
+      candidateName: "Update",
+      getRepoInfo,
+    });
+
+    expect(match).not.toBeNull();
+  });
+
+  test("skips a candidate whose lookup throws and still resolves a later candidate", async () => {
+    const repo = makeRepo({ mirroredLocation: "myorg/Update" });
+    const getRepoInfo = async ({ owner }: any) => {
+      if (owner === "myorg") {
+        throw new Error("network blip");
+      }
+      if (owner === "starred") {
+        return {
+          mirror: true,
+          original_url: "https://github.com/NostalgiaForInfinity/Update",
+        } as any;
+      }
+      return null;
+    };
+
+    const match = await findExistingMirror({
+      repository: repo,
+      config,
+      candidateOwner: "starred",
+      candidateName: "Update",
+      getRepoInfo,
+    });
+
+    expect(match).not.toBeNull();
+    expect(match!.owner).toBe("starred");
+  });
+});
+
+describe("classifyCandidateName — suffix vs reuse decision (#315/#309)", () => {
+  const SOURCE = "https://github.com/NostalgiaForInfinity/Update.git";
+
+  test("free name → available", () => {
+    expect(
+      classifyCandidateName({
+        existsInGitea: false,
+        claimedByOther: false,
+        repoInfo: null,
+        sourceCloneUrl: SOURCE,
+      })
+    ).toBe("available");
+  });
+
+  test("name occupied by OUR same-source mirror → reusable (no suffix, #315)", () => {
+    expect(
+      classifyCandidateName({
+        existsInGitea: true,
+        claimedByOther: false,
+        repoInfo: {
+          mirror: true,
+          original_url: "https://github.com/NostalgiaForInfinity/Update",
+        } as any,
+        sourceCloneUrl: SOURCE,
+      })
+    ).toBe("reusable");
+  });
+
+  test("name occupied by a DIFFERENT source → taken (suffix, regression #95/#236)", () => {
+    expect(
+      classifyCandidateName({
+        existsInGitea: true,
+        claimedByOther: false,
+        repoInfo: {
+          mirror: true,
+          original_url: "https://github.com/someoneelse/Update",
+        } as any,
+        sourceCloneUrl: SOURCE,
+      })
+    ).toBe("taken");
+  });
+
+  test("name occupied by a NON-mirror → taken (phantom-fork guard, #309)", () => {
+    expect(
+      classifyCandidateName({
+        existsInGitea: true,
+        claimedByOther: false,
+        repoInfo: { mirror: false, original_url: "" } as any,
+        sourceCloneUrl: SOURCE,
+      })
+    ).toBe("taken");
+  });
+
+  test("our same-source mirror but DB-claimed by ANOTHER repo → taken (per-user separation)", () => {
+    expect(
+      classifyCandidateName({
+        existsInGitea: true,
+        claimedByOther: true,
+        repoInfo: {
+          mirror: true,
+          original_url: "https://github.com/NostalgiaForInfinity/Update",
+        } as any,
+        sourceCloneUrl: SOURCE,
+      })
+    ).toBe("taken");
+  });
+
+  test("free in Gitea but DB-claimed by another concurrent op → taken", () => {
+    expect(
+      classifyCandidateName({
+        existsInGitea: false,
+        claimedByOther: true,
+        repoInfo: null,
+        sourceCloneUrl: SOURCE,
+      })
+    ).toBe("taken");
+  });
+
+  test("existing mirror but unknown source (no sourceCloneUrl) → taken", () => {
+    expect(
+      classifyCandidateName({
+        existsInGitea: true,
+        claimedByOther: false,
+        repoInfo: {
+          mirror: true,
+          original_url: "https://github.com/NostalgiaForInfinity/Update",
+        } as any,
+        sourceCloneUrl: undefined,
+      })
+    ).toBe("taken");
+  });
+});
@@ -0,0 +1,213 @@
+import type { Config } from "@/types/config";
+import type { Repository } from "@/lib/db/schema";
+import type { GiteaRepoInfo } from "@/lib/gitea-enhanced";
+
+/**
+ * Source-identity matching for mirror reuse.
+ *
+ * Starred (and other) repos were duplicating on every re-mirror because the
+ * existence check only asked "does a repo with this name exist?" — never
+ * "is the existing repo a mirror of THIS same GitHub source?". This module
+ * answers the second question so callers can reuse an existing same-source
+ * mirror instead of generating a suffixed duplicate. See issues #315 / #309.
+ */
+
+/**
+ * Normalize a git clone URL for source-identity comparison.
+ * Strips embedded credentials, a trailing ".git", a trailing slash, and
+ * lowercases the host (hosts are case-insensitive; paths are not). Returns an
+ * empty string for blank/invalid input so callers can treat it as "unknown".
+ */
+export function normalizeCloneUrl(rawUrl?: string | null): string {
+  if (typeof rawUrl !== "string") return "";
+  let url = rawUrl.trim();
+  if (!url) return "";
+
+  try {
+    const parsed = new URL(url);
+    // Drop any embedded credentials (e.g. https://user:token@host/...).
+    parsed.username = "";
+    parsed.password = "";
+    const host = parsed.host.toLowerCase();
+    // Strip trailing slash(es) first so a ".git/" suffix still normalizes.
+    const path = parsed.pathname.replace(/\/+$/, "").replace(/\.git$/i, "");
+    return `${parsed.protocol}//${host}${path}`.toLowerCase();
+  } catch {
+    // Fall back to best-effort string normalization for non-standard URLs
+    // (e.g. scp-style git@host:owner/repo). Strip credentials before "@",
+    // drop ".git"/trailing slash, and lowercase the whole thing.
+    url = url.replace(/^([a-z]+:\/\/)[^@/]+@/i, "$1");
+    url = url.replace(/\/+$/, "").replace(/\.git$/i, "");
+    return url.toLowerCase();
+  }
+}
+
+/**
+ * Whether two clone URLs point at the same source repository, ignoring
+ * credentials, ".git" suffix, trailing slash, and host case.
+ */
+export function cloneUrlsMatch(a?: string | null, b?: string | null): boolean {
+  const normA = normalizeCloneUrl(a);
+  const normB = normalizeCloneUrl(b);
+  if (!normA || !normB) return false;
+  return normA === normB;
+}
+
+/**
+ * Whether an existing Gitea repo is a mirror of the given GitHub source.
+ * Uses Gitea's original_url (the recorded migration source) when present;
+ * if Gitea didn't expose original_url, we cannot positively confirm the
+ * source and return false (callers then treat the name as a genuine
+ * collision rather than risk mapping onto an unrelated repo — #309).
+ */
+export function isMirrorOfSource(
+  repoInfo: GiteaRepoInfo | null,
+  sourceCloneUrl?: string | null
+): boolean {
+  if (!repoInfo || !repoInfo.mirror) return false;
+  return cloneUrlsMatch(repoInfo.original_url, sourceCloneUrl);
+}
+
+export type CandidateNameClassification = "available" | "reusable" | "taken";
+
+/**
+ * Classify a candidate mirror name for the suffix-vs-reuse decision in
+ * generateUniqueRepoName. Pure (all I/O is pre-resolved by the caller):
+ *   - "available": free in Gitea and not DB-claimed by another repo → use it
+ *   - "reusable":  occupied in Gitea by a mirror of THIS source, not DB-claimed
+ *                  by another repo → reuse it (no suffix)
+ *   - "taken":     occupied by a different source / non-mirror, or DB-claimed by
+ *                  another repo → must suffix
+ *
+ * A DB claim by a DIFFERENT repo always blocks reuse so two users mirroring the
+ * same source into a shared org stay separated.
+ */
+export function classifyCandidateName({
+  existsInGitea,
+  claimedByOther,
+  repoInfo,
+  sourceCloneUrl,
+}: {
+  existsInGitea: boolean;
+  claimedByOther: boolean;
+  repoInfo: GiteaRepoInfo | null;
+  sourceCloneUrl?: string | null;
+}): CandidateNameClassification {
+  if (existsInGitea) {
+    if (!claimedByOther && isMirrorOfSource(repoInfo, sourceCloneUrl)) {
+      return "reusable";
+    }
+    return "taken";
+  }
+
+  // Not in Gitea, but possibly claimed in the DB by a concurrent operation.
+  if (claimedByOther) return "taken";
+  return "available";
+}
+
+export interface ExistingMirrorMatch {
+  owner: string;
+  repoName: string;
+  repoInfo: GiteaRepoInfo;
+}
+
+/**
+ * Resolve an existing same-source mirror for a repository, if one exists.
+ *
+ * Resolution order (backward compatible):
+ *   1. The recorded repository.mirroredLocation — if it still resolves to a
+ *      live mirror of THIS source, reuse it even when the base candidate name
+ *      differs from the current naming strategy (handles strategy changes — #309).
+ *   2. The provided candidate owner/name — if that resolves to a live mirror of
+ *      THIS source, reuse it (handles the self-collision that drove suffixing — #315).
+ *
+ * Returns null when no live same-source mirror is found (caller should create
+ * a fresh mirror, generating a unique name if the candidate name is taken by a
+ * DIFFERENT source).
+ */
+export async function findExistingMirror({
+  repository,
+  config,
+  candidateOwner,
+  candidateName,
+  getRepoInfo,
+}: {
+  repository: Repository;
+  config: Partial<Config>;
+  candidateOwner: string;
+  candidateName: string;
+  // Injectable for testing; defaults to the real Gitea lookup.
+  getRepoInfo?: (args: {
+    config: Partial<Config>;
+    owner: string;
+    repoName: string;
+  }) => Promise<GiteaRepoInfo | null>;
+}): Promise<ExistingMirrorMatch | null> {
+  const lookup =
+    getRepoInfo ??
+    (async (args: {
+      config: Partial<Config>;
+      owner: string;
+      repoName: string;
+    }) => {
+      const { getGiteaRepoInfo } = await import("@/lib/gitea-enhanced");
+      return getGiteaRepoInfo(args);
+    });
+
+  const sourceCloneUrl = repository.cloneUrl;
+
+  // Candidate locations to probe, in priority order. Dedupe so we don't issue
+  // the same HTTP lookup twice when mirroredLocation equals the candidate.
+  const candidates: Array<{ owner: string; repoName: string }> = [];
+  const seen = new Set<string>();
+  const pushCandidate = (owner?: string | null, repoName?: string | null) => {
+    const o = (owner || "").trim();
+    const r = (repoName || "").trim();
+    if (!o || !r) return;
+    const key = `${o}/${r}`.toLowerCase();
+    if (seen.has(key)) return;
+    seen.add(key);
+    candidates.push({ owner: o, repoName: r });
+  };
+
+  if (repository.mirroredLocation && repository.mirroredLocation.trim()) {
+    const slashIndex = repository.mirroredLocation.indexOf("/");
+    if (slashIndex > 0 && slashIndex < repository.mirroredLocation.length - 1) {
+      pushCandidate(
+        repository.mirroredLocation.slice(0, slashIndex),
+        repository.mirroredLocation.slice(slashIndex + 1)
+      );
+    }
+  }
+  pushCandidate(candidateOwner, candidateName);
+
+  for (const candidate of candidates) {
+    let repoInfo: GiteaRepoInfo | null;
+    try {
+      repoInfo = await lookup({
+        config,
+        owner: candidate.owner,
+        repoName: candidate.repoName,
+      });
+    } catch (error) {
+      // A failed lookup (network/auth) should not be mistaken for "no mirror";
+      // skip this candidate and let the caller fall back to its normal flow.
+      console.warn(
+        `[Mirror] Could not look up ${candidate.owner}/${candidate.repoName} while resolving existing mirror for ${repository.fullName}: ${
+          error instanceof Error ? error.message : String(error)
+        }`
+      );
+      continue;
+    }
+
+    if (isMirrorOfSource(repoInfo, sourceCloneUrl)) {
+      return {
+        owner: candidate.owner,
+        repoName: candidate.repoName,
+        repoInfo: repoInfo as GiteaRepoInfo,
+      };
+    }
+  }
+
+  return null;
+}
@@ -6,7 +6,8 @@ import { startRepositoryCleanupService, stopRepositoryCleanupService } from './l
 import { initializeShutdownManager, registerShutdownCallback } from './lib/shutdown-manager';
 import { setupSignalHandlers } from './lib/signal-handlers';
 import { auth } from './lib/auth';
-import { isHeaderAuthEnabled, authenticateWithHeaders } from './lib/auth-header';
+import { isHeaderAuthEnabled } from './lib/auth-header';
+import { mintSessionFromHeaders } from './lib/auth-header-bridge';
 import { initializeConfigFromEnv } from './lib/env-config-loader';
 import { db, users } from './lib/db';
 import { getBasePath } from './lib/base-path';
@@ -37,6 +38,13 @@ let envConfigCheckCount = 0; // Track attempts to avoid excessive checking
 export const onRequest = defineMiddleware(async (context, next) => {
  const basePath = getBasePath();

+  // Set-Cookie headers we mint during the header-auth bridge below.
+  // Forwarded onto the outbound response after `next()` so the browser
+  // persists the Better Auth session cookie. Until that happens the
+  // SPA's /api/auth/get-session call returns null and bounces to
+  // /login — see the bridge block for the full rationale.
+  let pendingSetCookies: string[] = [];
+
  // First, try Better Auth session (cookie-based)
  try {
    const session = await auth.api.getSession({
@@ -46,36 +54,26 @@ export const onRequest = defineMiddleware(async (context, next) => {
    if (session) {
      context.locals.user = session.user;
      context.locals.session = session.session;
-    } else {
-      // No cookie session, check for header authentication
-      if (isHeaderAuthEnabled()) {
-        const headerUser = await authenticateWithHeaders(context.request.headers);
-        if (headerUser) {
-          // Create a session-like object for header auth
-          context.locals.user = {
-            id: headerUser.id,
-            email: headerUser.email,
-            emailVerified: headerUser.emailVerified,
-            name: headerUser.name || headerUser.username,
-            username: headerUser.username,
-            createdAt: headerUser.createdAt,
-            updatedAt: headerUser.updatedAt,
-          };
-          context.locals.session = {
-            id: `header-${headerUser.id}`,
-            userId: headerUser.id,
-            expiresAt: new Date(Date.now() + 24 * 60 * 60 * 1000), // 1 day
-            ipAddress: context.request.headers.get('x-forwarded-for') || context.clientAddress,
-            userAgent: context.request.headers.get('user-agent'),
-          };
-        } else {
-          context.locals.user = null;
-          context.locals.session = null;
-        }
+    } else if (isHeaderAuthEnabled()) {
+      // No cookie session, but header auth is on. Call the
+      // header-auth plugin endpoint to mint a real Better Auth
+      // session from the trusted upstream headers, then forward the
+      // Set-Cookie onto the outbound response so the SPA's next
+      // /api/auth/get-session call carries the cookie. Without this
+      // bridge the React app sees null on mount and redirects to
+      // /login even though server-rendered code paths know the user.
+      const bridge = await mintSessionFromHeaders(context.request);
+      if (bridge) {
+        context.locals.user = bridge.user;
+        context.locals.session = bridge.session;
+        pendingSetCookies = bridge.setCookies;
      } else {
        context.locals.user = null;
        context.locals.session = null;
      }
+    } else {
+      context.locals.user = null;
+      context.locals.session = null;
    }
  } catch (error) {
    // If there's an error getting the session, set to null
@@ -252,6 +250,17 @@ export const onRequest = defineMiddleware(async (context, next) => {
  // Continue with the request
  const response = await next();

+  // Forward any Set-Cookie headers minted by the header-auth bridge
+  // onto the outbound response. Done before the early returns below so
+  // every return path (basePath rewrite, non-HTML responses, etc.)
+  // carries the cookie. The body-rewrite branch further down clones
+  // `response.headers`, so anything appended here survives the clone.
+  if (pendingSetCookies.length > 0) {
+    for (const cookie of pendingSetCookies) {
+      response.headers.append("set-cookie", cookie);
+    }
+  }
+
  if (basePath === "/") {
    return response;
  }
@@ -47,8 +47,11 @@ export async function POST(context: APIContext) {
    }

    try {
-      // Use Better Auth server API to register OAuth2 application
-      const response = await auth.api.registerOAuthApplication({
+      // Use Better Auth server API to register OAuth2 client (RFC 7591
+      // dynamic client registration via @better-auth/oauth-provider).
+      // Note: jwks / jwks_uri / metadata are not part of the new
+      // registration body and are intentionally omitted.
+      const response = await auth.api.registerOAuthClient({
        body: {
          client_name,
          redirect_uris,
@@ -61,9 +64,6 @@ export async function POST(context: APIContext) {
          contacts,
          tos_uri,
          policy_uri,
-          jwks_uri,
-          jwks,
-          metadata,
          software_id,
          software_version,
          software_statement,
@@ -152,25 +152,14 @@ export async function POST(context: APIContext) {
      headers.set("cookie", cookieHeader);
    }

-    // Register the SSO provider using Better Auth's API
-    const response = await auth.api.registerSSOProvider({
+    // Register the SSO provider using Better Auth's API.
+    // auth.api.* returns the parsed result directly (not a fetch Response); it
+    // throws APIError on failure, which createSecureErrorResponse handles below.
+    const result = await auth.api.registerSSOProvider({
      body: registrationBody,
      headers,
    });

-    if (!response.ok) {
-      const error = await response.text();
-      return new Response(
-        JSON.stringify({ error: `Failed to register SSO provider: ${error}` }),
-        {
-          status: response.status,
-          headers: { "Content-Type": "application/json" },
-        }
-      );
-    }
-
-    const result = await response.json();
-
    // Mirror provider entry into local SSO table for UI listing
    try {
      const existing = await db
@@ -183,6 +172,13 @@ export async function POST(context: APIContext) {
        issuer: registrationBody.issuer,
        domain: registrationBody.domain,
        organizationId: registrationBody.organizationId,
+        // Mark this provider as trusted for the `domain` it was registered
+        // under. Better Auth's SSO plugin gates account auto-linking on this
+        // flag together with an email-domain match (validateEmailDomain), so
+        // sign-ins from users outside the registered domain are NOT
+        // auto-linked even though the provider is trusted. The plugin's own
+        // create call hardcodes this to false, so we set it here.
+        domainVerified: true,
        updatedAt: new Date(),
      };

@@ -210,6 +206,7 @@ export async function POST(context: APIContext) {
          userId: user.id,
          providerId: registrationBody.providerId,
          organizationId: registrationBody.organizationId,
+          domainVerified: true,
        });
      }
    } catch (mirroringError) {
@@ -0,0 +1,89 @@
+import type { APIRoute } from "astro";
+import { db, repositories } from "@/lib/db";
+import { and, eq, inArray } from "drizzle-orm";
+import { repoStatusEnum } from "@/types/Repository";
+import { createMirrorJob } from "@/lib/helpers";
+import { createSecureErrorResponse } from "@/lib/utils";
+import { requireAuthenticatedUserId } from "@/lib/auth-guards";
+
+/**
+ * POST /api/job/cancel-pending
+ *
+ * Sets this user's repositories that are waiting to be mirrored
+ * (status: "imported" or "failed") to "ignored", preventing the scheduler
+ * from picking them up.  Repos with status "mirroring" or "syncing" are
+ * left alone because they have in-flight work that cannot be aborted here.
+ *
+ * Returns the count of affected repositories and logs one activity entry.
+ */
+export const POST: APIRoute = async ({ request, locals }) => {
+  try {
+    const authResult = await requireAuthenticatedUserId({ request, locals });
+    if ("response" in authResult) return authResult.response;
+    const userId = authResult.userId;
+
+    // Statuses that represent queued-but-not-started work.
+    // "imported"  → repo was discovered, never mirrored
+    // "failed"    → last mirror attempt failed; scheduler will retry
+    const cancelableStatuses = ["imported", "failed"] as const;
+
+    // Fetch repos to cancel so we can count them and log meaningful details.
+    const toCancel = await db
+      .select({ id: repositories.id })
+      .from(repositories)
+      .where(
+        and(
+          eq(repositories.userId, userId),
+          inArray(repositories.status, cancelableStatuses),
+        ),
+      );
+
+    const cancelCount = toCancel.length;
+
+    if (cancelCount > 0) {
+      const ids = toCancel.map((r) => r.id);
+
+      await db
+        .update(repositories)
+        .set({
+          status: repoStatusEnum.parse("ignored"),
+          updatedAt: new Date(),
+          errorMessage: "Cancelled by user — set to ignored via Stop Pending Mirrors.",
+        })
+        .where(
+          and(
+            eq(repositories.userId, userId),
+            inArray(repositories.id, ids),
+          ),
+        );
+    }
+
+    // Log a single activity summarising the bulk action.
+    await createMirrorJob({
+      userId,
+      message: `Stopped pending mirrors: ${cancelCount} repositor${cancelCount === 1 ? "y" : "ies"} set to Ignored`,
+      details:
+        cancelCount > 0
+          ? `${cancelCount} repositor${cancelCount === 1 ? "y" : "ies"} with status "imported" or "failed" have been set to "ignored". ` +
+            `They can be re-enabled from the Repositories page.`
+          : `No repositories in a pending state were found for this user.`,
+      status: cancelCount > 0 ? "ignored" : "skipped",
+      skipDuplicateEvent: false,
+      skipNotification: true,
+    });
+
+    return new Response(
+      JSON.stringify({
+        success: true,
+        message:
+          cancelCount > 0
+            ? `${cancelCount} repositor${cancelCount === 1 ? "y has" : "ies have"} been set to Ignored.`
+            : "No repositories in a pending state were found.",
+        cancelledCount: cancelCount,
+      }),
+      { status: 200, headers: { "Content-Type": "application/json" } },
+    );
+  } catch (error) {
+    return createSecureErrorResponse(error, "cancel pending mirrors", 500);
+  }
+};
@@ -1,26 +1,61 @@
 import type { APIContext } from "astro";
 import { createSecureErrorResponse } from "@/lib/utils";
 import { requireAuth } from "@/lib/utils/auth-helpers";
-import { db, oauthApplications } from "@/lib/db";
-import { nanoid } from "nanoid";
+import { auth } from "@/lib/auth";
+import { db, oauthClients } from "@/lib/db";
 import { eq } from "drizzle-orm";
-import { generateRandomString } from "@/lib/utils";

-// GET /api/sso/applications - List all OAuth applications
+// Backward-compatible OAuth application management API.
+//
+// Migrated from the deprecated `oidc-provider` plugin to
+// `@better-auth/oauth-provider`. Clients now live in the `oauth_clients`
+// table and are managed by the plugin (which generates and hashes the
+// client secret), so mutations delegate to `auth.api.*OAuthClient`. Reads
+// are served straight from the table and mapped back to the legacy response
+// shape (`redirectURLs` as a comma-separated string) so existing consumers
+// — notably the consent page — keep working.
+
+// `redirectUris` is stored by the adapter as a JSON-encoded string[].
+function parseRedirectUris(value: unknown): string[] {
+  if (Array.isArray(value)) return value as string[];
+  if (typeof value === "string" && value.length > 0) {
+    try {
+      const parsed = JSON.parse(value);
+      if (Array.isArray(parsed)) return parsed;
+    } catch {
+      // Legacy comma-separated fallback
+      return value.split(",").map((s) => s.trim()).filter(Boolean);
+    }
+  }
+  return [];
+}
+
+// Map a new oauth_clients row onto the legacy application response shape.
+function toLegacyApplication(row: typeof oauthClients.$inferSelect) {
+  return {
+    id: row.id,
+    clientId: row.clientId,
+    name: row.name ?? "",
+    redirectURLs: parseRedirectUris(row.redirectUris).join(","),
+    type: row.type ?? "web",
+    disabled: row.disabled ?? false,
+    createdAt: row.createdAt,
+    updatedAt: row.updatedAt,
+    // Never expose the (hashed) client secret in list responses
+    clientSecret: undefined,
+  };
+}
+
+// GET /api/sso/applications - List all OAuth clients
 export async function GET(context: APIContext) {
  try {
-    const { user, response } = await requireAuth(context);
+    const { response } = await requireAuth(context);
    if (response) return response;

-    const applications = await db.select().from(oauthApplications);
+    const rows = await db.select().from(oauthClients);
+    const sanitized = rows.map(toLegacyApplication);

-    // Don't send client secrets in list response
-    const sanitizedApps = applications.map(app => ({
-      ...app,
-      clientSecret: undefined,
-    }));
-
-    return new Response(JSON.stringify(sanitizedApps), {
+    return new Response(JSON.stringify(sanitized), {
      status: 200,
      headers: { "Content-Type": "application/json" },
    });
@@ -29,10 +64,10 @@ export async function GET(context: APIContext) {
  }
 }

-// POST /api/sso/applications - Create a new OAuth application
+// POST /api/sso/applications - Register a new OAuth client
 export async function POST(context: APIContext) {
  try {
-    const { user, response } = await requireAuth(context);
+    const { response } = await requireAuth(context);
    if (response) return response;

    const body = await context.request.json();
@@ -49,27 +84,27 @@ export async function POST(context: APIContext) {
      );
    }

-    // Generate client credentials
-    const clientId = `client_${generateRandomString(32)}`;
-    const clientSecret = `secret_${generateRandomString(48)}`;
+    const redirect_uris = Array.isArray(redirectURLs)
+      ? redirectURLs
+      : String(redirectURLs)
+          .split(",")
+          .map((s) => s.trim())
+          .filter(Boolean);

-    // Insert new application
-    const [newApp] = await db
-      .insert(oauthApplications)
-      .values({
-        id: nanoid(),
-        clientId,
-        clientSecret,
-        name,
-        redirectURLs: Array.isArray(redirectURLs) ? redirectURLs.join(",") : redirectURLs,
+    // Delegate to the OAuth provider plugin so the client_id / client_secret
+    // are generated and the secret is stored using the plugin's hashing.
+    const created = await auth.api.createOAuthClient({
+      headers: context.request.headers,
+      body: {
+        client_name: name,
+        redirect_uris,
        type,
-        metadata: metadata ? JSON.stringify(metadata) : null,
-        userId: user.id,
-        disabled: false,
-      })
-      .returning();
+      },
+    });

-    return new Response(JSON.stringify(newApp), {
+    // The plugin returns RFC-style snake_case fields. Surface them plus the
+    // one-time client_secret (only returned here, never again).
+    return new Response(JSON.stringify(created), {
      status: 201,
      headers: { "Content-Type": "application/json" },
    });
@@ -78,18 +113,19 @@ export async function POST(context: APIContext) {
  }
 }

-// PUT /api/sso/applications/:id - Update an OAuth application
+// PUT /api/sso/applications?id=<clientId> - Update an OAuth client
 export async function PUT(context: APIContext) {
  try {
-    const { user, response } = await requireAuth(context);
+    const { response } = await requireAuth(context);
    if (response) return response;

    const url = new URL(context.request.url);
-    const appId = url.pathname.split("/").pop();
+    // Accept the OAuth client_id either from the query string or the path.
+    const clientId = url.searchParams.get("id") || url.pathname.split("/").pop();

-    if (!appId) {
+    if (!clientId) {
      return new Response(
-        JSON.stringify({ error: "Application ID is required" }),
+        JSON.stringify({ error: "Client ID is required" }),
        {
          status: 400,
          headers: { "Content-Type": "application/json" },
@@ -98,35 +134,26 @@ export async function PUT(context: APIContext) {
    }

    const body = await context.request.json();
-    const { name, redirectURLs, disabled, metadata } = body;
+    const { name, redirectURLs, disabled } = body;

-    const updateData: any = {};
-    if (name !== undefined) updateData.name = name;
+    const updateBody: Record<string, unknown> = { client_id: clientId };
+    if (name !== undefined) updateBody.client_name = name;
+    if (disabled !== undefined) updateBody.disabled = disabled;
    if (redirectURLs !== undefined) {
-      updateData.redirectURLs = Array.isArray(redirectURLs) 
-        ? redirectURLs.join(",") 
-        : redirectURLs;
-    }
-    if (disabled !== undefined) updateData.disabled = disabled;
-    if (metadata !== undefined) updateData.metadata = JSON.stringify(metadata);
-
-    const [updated] = await db
-      .update(oauthApplications)
-      .set({
-        ...updateData,
-        updatedAt: new Date(),
-      })
-      .where(eq(oauthApplications.id, appId))
-      .returning();
-
-    if (!updated) {
-      return new Response(JSON.stringify({ error: "Application not found" }), {
-        status: 404,
-        headers: { "Content-Type": "application/json" },
-      });
+      updateBody.redirect_uris = Array.isArray(redirectURLs)
+        ? redirectURLs
+        : String(redirectURLs)
+            .split(",")
+            .map((s) => s.trim())
+            .filter(Boolean);
    }

-    return new Response(JSON.stringify({ ...updated, clientSecret: undefined }), {
+    const updated = await auth.api.updateOAuthClient({
+      headers: context.request.headers,
+      body: updateBody as any,
+    });
+
+    return new Response(JSON.stringify(updated), {
      status: 200,
      headers: { "Content-Type": "application/json" },
    });
@@ -135,18 +162,18 @@ export async function PUT(context: APIContext) {
  }
 }

-// DELETE /api/sso/applications/:id - Delete an OAuth application
+// DELETE /api/sso/applications?id=<clientId> - Delete an OAuth client
 export async function DELETE(context: APIContext) {
  try {
-    const { user, response } = await requireAuth(context);
+    const { response } = await requireAuth(context);
    if (response) return response;

    const url = new URL(context.request.url);
-    const appId = url.searchParams.get("id");
+    const clientId = url.searchParams.get("id");

-    if (!appId) {
+    if (!clientId) {
      return new Response(
-        JSON.stringify({ error: "Application ID is required" }),
+        JSON.stringify({ error: "Client ID is required" }),
        {
          status: 400,
          headers: { "Content-Type": "application/json" },
@@ -154,18 +181,26 @@ export async function DELETE(context: APIContext) {
      );
    }

-    const deleted = await db
-      .delete(oauthApplications)
-      .where(eq(oauthApplications.id, appId))
-      .returning();
+    // Ensure the client exists so we can return a 404 (the plugin endpoint
+    // may otherwise succeed silently).
+    const existing = await db
+      .select()
+      .from(oauthClients)
+      .where(eq(oauthClients.clientId, clientId))
+      .limit(1);

-    if (deleted.length === 0) {
+    if (existing.length === 0) {
      return new Response(JSON.stringify({ error: "Application not found" }), {
        status: 404,
        headers: { "Content-Type": "application/json" },
      });
    }

+    await auth.api.deleteOAuthClient({
+      headers: context.request.headers,
+      body: { client_id: clientId },
+    });
+
    return new Response(JSON.stringify({ success: true }), {
      status: 200,
      headers: { "Content-Type": "application/json" },
@@ -173,4 +208,4 @@ export async function DELETE(context: APIContext) {
  } catch (error) {
    return createSecureErrorResponse(error, "SSO applications API");
  }
-}
+}
@@ -86,6 +86,7 @@ export interface AdvancedOptions {
  skipForks: boolean;
  starredCodeOnly: boolean;
  autoMirrorStarred?: boolean;
+  skipPersonalRepos?: boolean;
 }

 export interface SaveConfigApiRequest {
Author	SHA1	Message	Date
Arunavo Ray	da23941369	chore: bump version to 3.19.0	2026-06-13 09:14:33 +05:30
Brendan Davidson	906ce57e8c	Handle indexing when shift + clicking in the repository table (#316 )	2026-06-13 09:14:02 +05:30
Arunavo Ray	1b84c75a97	chore: bump version to 3.18.0	2026-06-13 08:17:20 +05:30
ARUNAVO RAY	0b6b6b76bf	feat(github): add skipPersonalRepos toggle to mirror only org repos (#304 ) (#320 ) - Add `skipPersonalRepos: z.boolean().default(false)` to githubConfigSchema - Filter out user-owned repos in getGithubRepositories when flag is true - Wire ONLY_MIRROR_ORGS env var to skipPersonalRepos in env-config-loader - Add checkbox UI in GitHubMirrorSettings Filtering & Behavior section - Round-trip skipPersonalRepos through config-mapper (UI ↔ DB) - Add skipPersonalRepos to AdvancedOptions TypeScript type - Mark include/exclude arrays in configSchema as unused/reserved - Update ENVIRONMENT_VARIABLES.md to document ONLY_MIRROR_ORGS effect	2026-06-13 08:00:50 +05:30
ARUNAVO RAY	7610a614da	fix: scheduler auto-start gate, backup clone URL, cancel-pending action, actionable 405 (#319 ) * fix(scheduler): make enabled flag authoritative for auto-start checkAutoStartConfiguration() and performInitialAutoStart() previously used `scheduleEnabled \|\| hasMirrorInterval`, allowing a configured GITEA_MIRROR_INTERVAL to trigger boot-time auto-start even after the user disabled scheduling via the UI toggle. env-config-loader already writes scheduleConfig.enabled=true when GITEA_MIRROR_INTERVAL is set at container startup, so the interval is a timing detail, not an enable signal. The documented env-var contract is preserved: GITEA_MIRROR_INTERVAL at boot → env-config-loader sets enabled=true → auto-start fires. But a later UI disable now sticks. Add a focused unit test for the gate logic. * fix(backup): always derive clone URL from user-configured Gitea URL The pre-sync backup preferred repoInfo.clone_url, which reflects Gitea's ROOT_URL setting. In Tailscale MagicDNS deployments (and any setup where ROOT_URL is an external address), this URL is unreachable from the app itself, causing bundle backup to fail. Always build the clone URL as: ${config.giteaConfig.url.trimEnd('/')}/${owner}/${repo}.git This matches the URL the app already uses for all other Gitea API calls and is guaranteed reachable. * feat(jobs): cancel-pending endpoint + fix misleading Delete All copy Add POST /api/job/cancel-pending that sets the current user's repositories with status "imported" or "failed" to "ignored", preventing the scheduler from re-queuing them. In-flight "mirroring" rows are left alone. Returns the count and logs one activity entry. Fix the "Delete All Activities" dialog to clearly state it only clears the history log and does not stop pending work. Rename button/title to "Clear History" so intent is unambiguous. Add a "Stop Pending Mirrors" button (StopCircle icon, amber) in both mobile and desktop activity log toolbars, with a confirmation dialog explaining repos are set to Ignored and can be re-enabled from the Repositories page. * fix(sync): actionable 405 error for non-pull-mirror repos Gitea returns HTTP 405 with an empty body when the target repository is no longer a pull mirror — e.g. the mirror was auto-disabled by Gitea or the repository lost its mirror state after a manual edit. Previously this fell through to the generic error handler which stored the raw HttpError message (often empty) giving the user no guidance. Now a 405 response is caught alongside the existing 400 handler and sets the repository to "failed" with an actionable error message: "Gitea reports this repository is not a pull mirror (HTTP 405). In Gitea check Settings → Mirror Settings; if the mirror section is missing, delete the repository in Gitea and re-mirror it from gitea-mirror." The same message is written to the activity log for visibility in the dashboard.	2026-06-13 08:00:47 +05:30
ARUNAVO RAY	c28dcc209f	fix(releases): stop delete/recreate cycle on permanent order mismatch (#310 ) (#318 ) Root cause (Theory A): the `needsRecreation` check compared GitHub published_at-based expected indices against Gitea's API order. Gitea mirror repos sort releases by tag-commit date, which can permanently disagree with published_at order (e.g. unaconfig_dart v0.1.0 published after v0.1.1 but tagged before). This made `currentExpectedIdx < nextExpectedIdx` evaluate true on every sync, triggering delete-all-and-recreate forever — spamming Gitea's activity feed with "released X" events (#310). Fix: replace the destructive order-check machinery with set-based reconciliation via `classifyReleasesForReconciliation`. Releases are created when missing in Gitea and skipped (or PATCH-updated if content drifted) when already present. No deletions are ever triggered by ordering. Retain the existing release-limit trimming (retention cleanup) unchanged. Also removes the 1-second per-release delay that was only needed for the creation-order dance, significantly speeding up initial mirrors. Adds unit tests covering: normal ordered repos, the unaconfig_dart inversion fixture, missing→create, present→skip, and edge cases.	2026-06-13 08:00:44 +05:30
ARUNAVO RAY	40ee3cbc44	fix(mirror): reuse existing same-source mirrors instead of creating suffixed duplicates (#315 ) (#317 ) Starred (and other) repos duplicated on every re-mirror (starred/Repo, Repo-owner, Repo-owner-1, ...) because the existence check only asked "does a repo with this name exist?" and never "is the existing repo a mirror of THIS same source?". The repo's own prior mirror counted as a collision, so generateUniqueRepoName bumped to the next suffix each run, repointing mirroredLocation at the newest copy. Under a single re-call, 3 concurrent/retried jobs each computed a DIFFERENT suffixed name, so the location-based in-flight guard never matched and the race produced extra copies. Fix (source-identity aware): - New shared helper src/lib/utils/mirror-source-match.ts: - normalizeCloneUrl / cloneUrlsMatch: credential-, .git-, slash- and host-case-insensitive clone URL comparison. - isMirrorOfSource: a Gitea repo is "ours" only if it is a mirror AND its original_url matches this repo's source. - findExistingMirror: resolves an existing same-source mirror via the recorded mirroredLocation first (survives strategy changes — #309), then the base candidate name. - classifyCandidateName: pure available/reusable/taken decision. - gitea-enhanced: export GiteaRepoInfo and add original_url (Gitea's recorded migration source) for source matching. - Both create paths (mirrorGithubRepoToGitea, mirrorGitHubRepoToGiteaOrg): run findExistingMirror BEFORE name generation; on a hit, reuse that location and route into the existing "already mirrored" handling rather than calling generateUniqueRepoName. Names now converge under concurrency so the in-flight guard becomes effective. - generateUniqueRepoName is now source-aware: an occupied name held by a mirror of the SAME source is reused (no suffix); suffixing only happens on a genuine different-source collision, preserving #95/#236 behavior. The per-user DB claim check is retained so two users mirroring the same source into a shared org stay separated. - Phantom-fork guard (#309): the existingRepoInfo.mirror branches now verify same-source before marking "mirrored"; on mismatch they fall through to unique-name generation and create a separate mirror. - Scheduler: a `failed` repo whose mirroredLocation still resolves to a live same-source mirror is routed to syncGiteaRepo instead of re-create, breaking the failed-metadata re-create loop cheaply. - Remove dead src/lib/starred-repos-handler.ts (zero importers across all git history); its correct base-name/.mirror reuse logic now lives in the shared helper. Tests: src/lib/utils/mirror-source-match.test.ts (30 cases) covers URL normalization, reuse at base name, reuse via mirroredLocation across a strategy change, genuine different-source collision (suffix), phantom fork, stale mirroredLocation fallback, per-user DB-claim separation, and the suffix-vs-reuse classification. Full suite: 319 pass, 0 fail.	2026-06-13 08:00:41 +05:30
Arunavo Ray	699a5771f5	chore: bump version to 3.17.1	2026-06-05 18:42:11 +05:30
ARUNAVO RAY	e862714d6a	fix(db): self-heal sso_providers duplicate-column crash on upgrade (#312 ) (#313 ) Migration 0013 runs as a single transaction that rebuilds `organizations` and then `ALTER TABLE sso_providers ADD saml_config` / `ADD domain_verified`. On instances where those columns were already created outside Drizzle (declared in schema.ts and added via db:push / an SSO-register round-trip on an intermediate build), the ADD throws "duplicate column name: saml_config". That rolls back the entire 0013 transaction, so 0013 is never recorded in `__drizzle_migrations` and is retried — failing identically — on every boot, crash-looping the server. Add a pre-migrate repair (mirroring the existing repairFailedMigrations() for the 0009 case): when 0013 is unrecorded but the columns already exist, preserve any real SAML provider config, drop the stranded columns so the canonical 0013 runs in full (organizations rebuild included), then restore the preserved values once the columns are re-added. No-op on fresh installs, clean upgrades, and already-migrated databases. This lets affected instances recover automatically on the next boot after upgrading — no manual SQLite surgery required. - src/lib/db/migration-repairs.ts: repairDuplicateSsoColumns + restoreSsoDataAfter0013 - src/lib/db/index.ts: wire both around migrate() - scripts/validate-migrations.ts: cover the broken-upgrade + data-preservation path	2026-06-05 18:41:46 +05:30
Arunavo Ray	716981aa04	chore: bump version to 3.17.0	2026-06-02 11:41:24 +05:30
ARUNAVO RAY	66e3284898	fix(sso): repair SSO login bounce + migrate to @better-auth/oauth-provider (#307 ) Resolves #306. SSO sign-in via OIDC (Authentik / Keycloak / etc.) now links the SSO identity to an existing email/password admin instead of bouncing to /login with `?error=UNKNOWN`. Account-linking is gated on the operator-supplied Domain field — cross-domain claims from a compromised IdP are refused. Also bundles the deprecated `oidcProvider` → `@better-auth/oauth-provider` migration. Operators using the OAuth-provider feature must rotate registered client secrets after upgrade (legacy plaintext → hashed storage; see the 0012 migration notes). Verified end-to-end on the pr-307 image against a real Authentik instance: SSO login lands on the dashboard, `accounts` table gets both `credential` and `authentik` rows for the same user. See PR description for full details.	2026-06-02 11:40:54 +05:30
IYUANWEIZE	695f0ff005	Fix Docker image line in .env.example (#305 )	2026-05-28 13:49:32 +05:30
Arunavo Ray	53f2cf36fc	chore: bump version to 3.16.3	2026-05-27 14:53:34 +05:30
ARUNAVO RAY	8ffcf3bdc6	fix: bridge header auth into a real Better Auth session (#303 ) Header / forward authentication has been end-to-end broken since the v3 rewrite. The middleware populated `context.locals.user` from trusted upstream headers (Authentik / Authelia / oauth2-proxy / Caddy), but never minted a Better Auth session, and never set a cookie. Server-rendered pages saw the user, but the React SPA's `/api/auth/get-session` call hit Better Auth's handler — which only reads its session cookie — and got `null`. The auth guard then redirected to `/login`, even though the upstream proxy had already authenticated the user. Reported on issue #29 by @lanrat with a clean repro on v3.16.1. Fix: add a small Better Auth plugin (`header-auth`) that exposes `POST /api/auth/sign-in/header`. The endpoint validates the trusted headers via `authenticateWithHeaders`, creates a real session row via `internalAdapter.createSession`, and attaches the `Set-Cookie` via `setSessionCookie` — the same pattern the magic-link, anonymous, and phone-number plugins use after their respective verification steps. The Astro middleware now calls this endpoint when no cookie session exists and header auth is enabled, forwards the `Set-Cookie` onto the outbound response, and populates `context.locals` from the minted session. After the first request the browser has the cookie; every subsequent request takes the normal cookie-auth fast path and the bridge doesn't fire. Fail-open everywhere: any endpoint failure (header auth disabled, auth rejected, DB blip, malformed response) returns null from the bridge and the request proceeds as anonymous. A broken header-auth configuration must never lock everyone out of the cookie-auth path. Tests: - `auth-header.test.ts` — unit tests for `extractUserFromHeaders` and `isHeaderAuthEnabled`, including lanrat's reported config shape (same header for username and email). - `auth-header-plugin.test.ts` — locks down plugin id, endpoint key, path, and method so an accidental rename can't silently break the middleware bridge. - `auth-header-bridge.test.ts` — covers the cookie-extraction logic and the fail-open paths (non-2xx, thrown error, malformed JSON, missing fields, no Set-Cookie attached). Stacks on top of #301 (better-auth 1.6.11 bump). Refs: #29	2026-05-27 14:53:16 +05:30
ARUNAVO RAY	a07af96f84	chore: bump better-auth to 1.6.11 (#301 ) Updates `better-auth` and `@better-auth/sso` from 1.5.5 to 1.6.11 to pick up the patch fixes that have landed since (OAuth state CSRF verification, scrypt non-blocking password hashing, account cookie comparison fix, session freshness alignment, etc.). All 270 local tests pass against the new version. The only behavioral surface to watch: - `freshAge` now aligns with session `createdAt` instead of `updatedAt`. Not applicable here — we don't gate anything on session freshness. - 1.6.2 adds OAuth state-parameter CSRF verification. Applies to OIDC/SAML SSO flows; no code changes needed. - 1.6 emits a deprecation warning for `oidc-provider` in favor of `@better-auth/oauth-provider`. The plugin still works in 1.6.x; migrating it is a separate cleanup. Prep work for an upcoming header-auth fix (issue #29 follow-up).	2026-05-27 14:44:17 +05:30
Arunavo Ray	b1daa65228	chore: bump version to 3.16.2	2026-05-26 11:09:31 +05:30
Sean MousseauandClaude Opus 4.7	dd1c42264e	fix: stop snapshot-row zombies + flapping force-push on deleted branches (#300 ) * fix: stop snapshot-row zombies + flapping force-push on deleted branches Two bugs caused Simple-WP-Helpdesk to accumulate one orphan "Snapshot created" job row per scheduled sync — 7 zombies in 24h against a deleted GitHub branch (`fix/v4.0.2-webhook-comment-author`). (1) gitea-enhanced.ts:522 created the post-snapshot job record with status="syncing". The snapshot was already complete at that point (createPreSyncBundleBackup had returned), and no later code path advanced the row to a terminal status — it just lingered. Set status="synced" to reflect reality. (2) force-push-detection treated any Gitea branch missing from GitHub as a "deleted" force-push. But gitea-mirror is one-way (GitHub → Gitea), so deletions never propagate back to the Gitea mirror — the branch lingers in Gitea forever, the missing-from-GitHub condition holds on every subsequent sync, and detection re-fires endlessly. Each re-fire triggered backupBeforeSync=true to take a fresh snapshot of the exact same state we already backed up the previous cycle. Fix: detector accepts an `acknowledgedDeletions: { branch, giteaSha }[]` list (persisted in RepositoryMetadataState). A Gitea branch missing from GitHub is suppressed when its current giteaSha matches an entry. If the giteaSha later changes (branch restored, then re-deleted with new history), the entry won't match and detection fires again — back up the new state, then acknowledge the new SHA. After a successful snapshot, the call site appends each just-backed-up "deleted" branch to the acknowledged list and persists the metadata blob. Hoists parseRepositoryMetadataState above the backup-strategy block so both the detection-time read and post-snapshot append happen against the same in-memory state object; the existing metadata-mirror block just stops re-declaring it. Adds 9 new test cases covering: - deleted branch suppressed when acknowledged at matching giteaSha - re-flagged when giteaSha differs (restored-then-redeleted) - mixed deletions (only matching one suppressed) - undefined list = back-compat (existing callers unaffected) - acknowledgedDeletions does not suppress "diverged" - metadata-state parse/serialize round-trips the new field - legacy metadata defaults acknowledgedDeletions to [] - malformed entries dropped without throwing All 76 tests in the affected suites pass. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix: acknowledge deletion before backup, not after, to fix concurrent-sync race When two sync invocations fire for the same repo within the same backup window (observed in prod via UI trigger pipeline: a single click ends up producing two parallel processWithResilience callbacks that both run syncGiteaRepoEnhanced), the second invocation's createPreSyncBundleBackup short-circuits (file already exists from the first), so the second invocation never reached the acknowledge-push that lived inside the backup try block. Then both invocations wrote metadata: invocation A with acknowledgedDeletions=[forged], invocation B (with its stale in-memory state) with acknowledgedDeletions=[], and B's write landed last — overwriting A. Net result: the deletion never got acknowledged, and the next sync re-detected it, the next-next sync re-detected it, etc. Same flapping behavior as before the fix. Fix: move the acknowledge-push to run right after detection, based on detectionResult.affectedBranches alone. Semantically correct — once we've detected the branch is gone from GitHub, we know it's a permanent deletion; whether THIS particular invocation took a backup or short-circuited is orthogonal (a previous backup on disk is fine, and in the rare case where no backup ever succeeded, the user can re-trigger a manual backup). Both concurrent invocations now push the same entry; both write the same metadata; race is benign. Verified locally: 59 tests pass across force-push-detection, gitea-enhanced, repo-backup. --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-26 11:06:27 +05:30
Arunavo Ray	384fbbbe10	docs: document Header / Forward Authentication setup Header auth has been a working feature since v2.x but was missing from SSO-OIDC-SETUP.md, leading users to think it was dropped in the v3 rewrite (see #29). Adds a dedicated section covering env-var config, Authentik + Authelia examples, lookup order, verification, and the must-strip-inbound-headers security checklist.	2026-05-25 10:37:39 +05:30
Sean Mousseau	1a54010950	fix: prevent duplicate milestones & labels on every sync (#299 ) Paginate /milestones and /labels with Link header + X-Total-Count fallback, and pass state=all on milestones so closed milestones aren't re-POSTed on every sync. Caches newly-created items in the in-memory dedup set.	2026-05-25 08:28:40 +05:30
CrumblyLiquid	9bf22791a9	Regenerated bun.nix (#298 )	2026-05-25 08:26:19 +05:30
Arunavo Ray	5d82f22b12	chore: sync version to 3.16.1	2026-05-23 20:25:16 +05:30