indraq_cli 1.5.8 → 1.9.1

package/cloud-api/src/index.ts

@@ -0,0 +1,1254 @@
+import 'dotenv/config';
+import express, { type NextFunction, type Request, type Response } from 'express';
+import bcrypt from 'bcryptjs';
+import jwt from 'jsonwebtoken';
+import pg from 'pg';
+import nodemailer from 'nodemailer';
+import { IAMClient, CreateAccessKeyCommand, DeleteAccessKeyCommand, ListAccessKeysCommand } from '@aws-sdk/client-iam';
+import { createCipheriv, createDecipheriv, randomBytes, randomInt } from 'node:crypto';
+import { isIP } from 'node:net';
+import { readdir, readFile } from 'node:fs/promises';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const { Pool } = pg;
+const pool = new Pool({ connectionString: process.env.DATABASE_URL });
+const app = express();
+app.use(express.json({ limit: '1mb' }));
+
+const jwtSecret = process.env.JWT_SECRET || '';
+if (jwtSecret.length < 32) throw new Error('JWT_SECRET must be at least 32 characters.');
+const masterHex = process.env.MASTER_KEY || '';
+if (!/^[a-fA-F0-9]{64}$/.test(masterHex)) throw new Error('MASTER_KEY must be exactly 64 hex characters (32 bytes).');
+const masterKey = Buffer.from(masterHex, 'hex');
+
+type Role = 'user' | 'manager' | 'admin';
+type Auth = { id: string; email: string; name: string; role: Role; mustChangePassword: boolean };
+interface AuthedRequest extends Request { auth?: Auth }
+
+const encrypt = (text: string): string => {
+  const iv = randomBytes(12);
+  const cipher = createCipheriv('aes-256-gcm', masterKey, iv);
+  const body = Buffer.concat([cipher.update(text, 'utf8'), cipher.final()]);
+  return [iv, cipher.getAuthTag(), body].map((part) => part.toString('base64url')).join('.');
+};
+
+const decrypt = (value: string): string => {
+  const [ivString, tagString, bodyString] = value.split('.');
+  if (!ivString || !tagString || !bodyString) throw new Error('Invalid encrypted value');
+  const decipher = createDecipheriv('aes-256-gcm', masterKey, Buffer.from(ivString, 'base64url'));
+  decipher.setAuthTag(Buffer.from(tagString, 'base64url'));
+  return Buffer.concat([decipher.update(Buffer.from(bodyString, 'base64url')), decipher.final()]).toString('utf8');
+};
+
+const auth = async (req: AuthedRequest, res: Response, next: NextFunction): Promise<void> => {
+  const rawHeader = req.headers.authorization;
+  const header = Array.isArray(rawHeader) ? rawHeader[0] : rawHeader;
+  if (!header?.startsWith('Bearer ')) { res.status(401).json({ error: 'Authentication required' }); return; }
+  try {
+    const token = jwt.verify(header.slice(7), jwtSecret) as Partial<Auth>;
+    if (!token.id) { res.status(401).json({ error: 'Invalid or expired token' }); return; }
+    // Roles and account state are resolved from the database on every request.
+    // This makes admin/manager demotion and account disabling effective
+    // immediately instead of trusting a stale role embedded in a 12-hour JWT.
+    const current = await pool.query('SELECT id,email,name,role,is_active,must_change_password FROM users WHERE id=$1', [token.id]);
+    const user = current.rows[0];
+    if (!user || !user.is_active || !['user','manager','admin'].includes(user.role)) {
+      res.status(401).json({ error: 'Account is disabled or no longer available' }); return;
+    }
+    req.auth = { id: user.id, email: user.email, name: user.name, role: user.role as Role, mustChangePassword: !!user.must_change_password };
+    if (user.must_change_password && !['/auth/me','/auth/first-login-password'].includes(req.path)) {
+      res.status(428).json({ error: 'Temporary password must be changed before using IndraQ. Run `indraq login` and complete the first-login password change.' }); return;
+    }
+    next();
+  } catch {
+    res.status(401).json({ error: 'Invalid or expired token' });
+  }
+};
+
+const allow = (...roles: Role[]) => [
+  auth,
+  (req: AuthedRequest, res: Response, next: NextFunction) => roles.includes(req.auth!.role)
+    ? next()
+    : res.status(403).json({ error: 'Insufficient role' })
+] as const;
+
+const audit = async (
+  actor: string | undefined,
+  action: string,
+  type: string,
+  id: string | undefined,
+  reason: string | undefined,
+  metadata: unknown = {}
+): Promise<void> => {
+  await pool.query(
+    'INSERT INTO audit_logs(actor_id,action,resource_type,resource_id,reason,metadata) VALUES($1,$2,$3,$4,$5,$6)',
+    [actor || null, action, type, id || null, reason || null, metadata]
+  );
+};
+
+const routeParam = (value: string | string[] | undefined): string => {
+  if (!value) throw new Error('Missing route parameter');
+  return Array.isArray(value) ? (value[0] ?? '') : value;
+};
+
+const requireReason = (req: Request, res: Response): string | null => {
+  const reason = typeof req.body?.reason === 'string' ? req.body.reason.trim() : '';
+  if (reason.length < 3) {
+    res.status(400).json({ error: 'A reason of at least 3 characters is required.' });
+    return null;
+  }
+  return reason;
+};
+
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+
+const ensureUuid = (value: string, label = 'ID'): string => {
+  if (!UUID_RE.test(value)) {
+    const error = new Error(`${label} must be a valid UUID. If the local project link is damaged, run \`indraq project link\`.`) as Error & { statusCode?: number };
+    error.statusCode = 400;
+    throw error;
+  }
+  return value;
+};
+
+const listQuery = (req: Request, defaultLimit = 10, maximum = 5000): { search: string; limit: number; all: boolean } => {
+  const search = typeof req.query.search === 'string' ? req.query.search.trim() : '';
+  const all = req.query.all === 'true' || req.query.all === '1';
+  const parsed = Number(typeof req.query.limit === 'string' ? req.query.limit : defaultLimit);
+  const limit = all ? maximum : Math.max(1, Math.min(maximum, Number.isInteger(parsed) ? parsed : defaultLimit));
+  return { search, limit, all };
+};
+
+type ProjectAccess = 'view' | 'write';
+const projectAccessLevel = async (projectIdRaw: string, user: Auth): Promise<ProjectAccess | null> => {
+  const projectId = ensureUuid(projectIdRaw, 'Project ID');
+  const result = await pool.query(
+    `SELECT p.id,p.created_by,pm.role,pm.access_level
+       FROM projects p
+       LEFT JOIN project_members pm ON pm.project_id=p.id AND pm.user_id=$2
+      WHERE p.id=$1
+      LIMIT 1`,
+    [projectId, user.id]
+  );
+  if (!result.rowCount) return null;
+  if (user.role === 'admin' || user.role === 'manager') return 'write';
+  const row = result.rows[0];
+  if (row.created_by === user.id || row.role === 'owner' || row.access_level === 'write') return 'write';
+  // Every authenticated organization user can discover/read every project.
+  return 'view';
+};
+
+const hasProjectAccess = async (projectId: string, user: Auth): Promise<boolean> =>
+  (await projectAccessLevel(projectId, user)) !== null;
+
+const hasProjectWriteAccess = async (projectId: string, user: Auth): Promise<boolean> =>
+  (await projectAccessLevel(projectId, user)) === 'write';
+
+const hasProjectResourceAccess = async (resourceIdRaw: string, user: Auth, manage = false): Promise<boolean> => {
+  const resourceId = ensureUuid(resourceIdRaw, 'Project resource ID');
+  if (user.role === 'admin' || user.role === 'manager') return true;
+  const resource = await pool.query('SELECT project_id,created_by FROM project_resources WHERE id=$1', [resourceId]);
+  if (!resource.rowCount) return false;
+  const access = await projectAccessLevel(resource.rows[0].project_id, user);
+  if (!manage) return access !== null;
+  if (access === 'write' || resource.rows[0].created_by === user.id) return true;
+  const grant = await pool.query(
+    "SELECT 1 FROM project_resource_grants WHERE project_resource_id=$1 AND user_id=$2 AND permission='manage' LIMIT 1",
+    [resourceId, user.id]
+  );
+  return !!grant.rowCount;
+};
+
+const providerName = (raw: string): string => {
+  const value = String(raw || '').trim().toLowerCase();
+  if (!/^[a-z0-9][a-z0-9._-]{0,63}$/.test(value)) throw new Error('Invalid provider name');
+  return value;
+};
+
+const resourceType = (raw: string): string => {
+  const value = String(raw || '').trim().toLowerCase();
+  if (!/^[a-z0-9][a-z0-9._-]{0,63}$/.test(value)) throw new Error('Invalid resource type');
+  return value;
+};
+
+const environmentName = (raw: unknown): string => {
+  const value = String(raw || 'dev').trim().toLowerCase();
+  if (!/^[a-z0-9][a-z0-9._-]{0,63}$/.test(value)) throw new Error('Invalid environment');
+  return value;
+};
+
+
+const providerIntegration = async (userId: string, provider: string): Promise<{ config: any; secret: any } | null> => {
+  const result = await pool.query('SELECT config,encrypted_secret FROM user_integrations WHERE user_id=$1 AND provider=$2', [userId, provider]);
+  if (!result.rowCount) return null;
+  const encrypted = result.rows[0].encrypted_secret;
+  return { config: result.rows[0].config || {}, secret: encrypted ? JSON.parse(decrypt(encrypted)) : null };
+};
+
+const saveProviderIntegrationForUser = async (userId: string, provider: string, config: unknown, secret: unknown): Promise<void> => {
+  await pool.query(
+    `INSERT INTO user_integrations(user_id,provider,config,encrypted_secret)
+     VALUES($1,$2,$3,$4)
+     ON CONFLICT(user_id,provider) DO UPDATE SET config=excluded.config,encrypted_secret=excluded.encrypted_secret,updated_at=now()`,
+    [userId, provider, config || {}, encrypt(JSON.stringify(secret || {}))]
+  );
+};
+
+const awsIamClientForUser = async (userId: string): Promise<IAMClient> => {
+  const integration = await providerIntegration(userId, 'aws');
+  if (!integration?.config?.region || !integration?.secret?.accessKeyId || !integration?.secret?.secretAccessKey) {
+    throw new Error('AWS management credentials are unavailable for this operation.');
+  }
+  const credentials = {
+    accessKeyId: String(integration.secret.accessKeyId),
+    secretAccessKey: String(integration.secret.secretAccessKey),
+    ...(integration.secret.sessionToken ? { sessionToken: String(integration.secret.sessionToken) } : {})
+  };
+  return new IAMClient({ region: String(integration.config.region), credentials });
+};
+
+interface ManagedAwsRow {
+  id: string;
+  cloud_user_id: string;
+  aws_username: string;
+  access_key_id: string;
+  encrypted_secret_access_key: string;
+  indraq_role: Role;
+  created_by: string | null;
+  managed_by_user_id: string | null;
+}
+
+const managedAwsCredentialRow = async (cloudUserId: string, awsUsername: string): Promise<ManagedAwsRow | null> => {
+  const result = await pool.query(
+    `SELECT id,cloud_user_id,aws_username,access_key_id,encrypted_secret_access_key,indraq_role,created_by,managed_by_user_id
+       FROM managed_aws_credentials
+      WHERE cloud_user_id=$1 AND aws_username=$2
+      LIMIT 1`,
+    [cloudUserId, awsUsername]
+  );
+  return (result.rows[0] as ManagedAwsRow | undefined) || null;
+};
+
+const awsRotationOperatorUserId = async (actor: Auth, row: ManagedAwsRow): Promise<string> => {
+  if (actor.role === 'manager' || actor.role === 'admin') return actor.id;
+  const managerId = row.managed_by_user_id || row.created_by;
+  if (!managerId) throw new Error('No manager/admin AWS credential is available to rotate this access key. Ask an IndraQ manager or admin.');
+  const manager = await pool.query(
+    `SELECT u.id,u.role,u.is_active
+       FROM users u
+       JOIN user_integrations ui ON ui.user_id=u.id AND ui.provider='aws'
+      WHERE u.id=$1
+      LIMIT 1`,
+    [managerId]
+  );
+  const resolved = manager.rows[0];
+  if (!resolved?.is_active || !['manager','admin'].includes(resolved.role)) {
+    throw new Error('The manager/admin AWS credential that manages this IAM user is unavailable. Ask an IndraQ manager or admin to rotate the key.');
+  }
+  return resolved.id;
+};
+
+const rotateManagedAwsAccessKey = async (
+  actor: Auth,
+  targetCloudUserId: string,
+  awsUsername: string,
+  reason: string
+): Promise<{ awsUsername: string; accessKeyId: string; secretAccessKey: string; previousAccessKeyId: string | null }> => {
+  const row = await managedAwsCredentialRow(targetCloudUserId, awsUsername);
+  if (!row) throw Object.assign(new Error('Stored AWS credentials were not found for this IndraQ user.'), { statusCode: 404 });
+
+  const operatorUserId = await awsRotationOperatorUserId(actor, row);
+  const iam = await awsIamClientForUser(operatorUserId);
+  const keys = await iam.send(new ListAccessKeysCommand({ UserName: awsUsername }));
+  const keyIds = (keys.AccessKeyMetadata || []).map((item) => item.AccessKeyId).filter((value): value is string => !!value);
+  if (keyIds.length >= 2) {
+    throw Object.assign(
+      new Error(`AWS IAM user ${awsUsername} already has two access keys. Remove the extra/unmanaged key before rotating through IndraQ.`),
+      { statusCode: 409 }
+    );
+  }
+
+  const oldAccessKeyId = row.access_key_id || null;
+  const oldSecretAccessKey = decrypt(row.encrypted_secret_access_key);
+  const targetIntegration = await providerIntegration(targetCloudUserId, 'aws');
+  const previousProviderConfig = targetIntegration?.config || {};
+  const previousProviderSecret = targetIntegration?.secret || { accessKeyId: oldAccessKeyId, secretAccessKey: oldSecretAccessKey };
+
+  const created = await iam.send(new CreateAccessKeyCommand({ UserName: awsUsername }));
+  const newKey = created.AccessKey;
+  if (!newKey?.AccessKeyId || !newKey.SecretAccessKey) throw new Error('AWS did not return a complete replacement access key.');
+
+  try {
+    await pool.query(
+      `UPDATE managed_aws_credentials
+          SET access_key_id=$1,
+              encrypted_secret_access_key=$2,
+              managed_by_user_id=$3,
+              updated_at=now()
+        WHERE id=$4`,
+      [newKey.AccessKeyId, encrypt(newKey.SecretAccessKey), operatorUserId, row.id]
+    );
+    await saveProviderIntegrationForUser(
+      targetCloudUserId,
+      'aws',
+      previousProviderConfig,
+      { accessKeyId: newKey.AccessKeyId, secretAccessKey: newKey.SecretAccessKey }
+    );
+  } catch (persistError) {
+    try { await iam.send(new DeleteAccessKeyCommand({ UserName: awsUsername, AccessKeyId: newKey.AccessKeyId })); } catch { /* best-effort rollback */ }
+    throw persistError;
+  }
+
+  if (oldAccessKeyId && keyIds.includes(oldAccessKeyId) && oldAccessKeyId !== newKey.AccessKeyId) {
+    try {
+      await iam.send(new DeleteAccessKeyCommand({ UserName: awsUsername, AccessKeyId: oldAccessKeyId }));
+    } catch (deleteError) {
+      // Restore Cloud state to the old working credential and delete the new
+      // key when possible. This avoids silently leaving Cloud pointed at a key
+      // that was not fully rotated.
+      try {
+        await pool.query(
+          `UPDATE managed_aws_credentials
+              SET access_key_id=$1,
+                  encrypted_secret_access_key=$2,
+                  updated_at=now()
+            WHERE id=$3`,
+          [oldAccessKeyId, encrypt(oldSecretAccessKey), row.id]
+        );
+        await saveProviderIntegrationForUser(targetCloudUserId, 'aws', previousProviderConfig, previousProviderSecret);
+      } catch { /* best effort */ }
+      try { await iam.send(new DeleteAccessKeyCommand({ UserName: awsUsername, AccessKeyId: newKey.AccessKeyId })); } catch { /* best effort */ }
+      throw new Error(`AWS created a replacement key but the previous key could not be removed, so IndraQ attempted to roll back: ${deleteError instanceof Error ? deleteError.message : String(deleteError)}`);
+    }
+  }
+
+  await audit(actor.id, 'aws.credentials.rotate', 'user', targetCloudUserId, reason, {
+    awsUsername,
+    previousAccessKeyId: oldAccessKeyId,
+    newAccessKeyId: newKey.AccessKeyId,
+    operatorUserId
+  });
+  return {
+    awsUsername,
+    accessKeyId: newKey.AccessKeyId,
+    secretAccessKey: newKey.SecretAccessKey,
+    previousAccessKeyId: oldAccessKeyId
+  };
+};
+
+const npmAdminResetPassword = async (managerUserId: string, targetIdentity: string, newPassword: string): Promise<{ config: any }> => {
+  const integration = await providerIntegration(managerUserId, 'npm');
+  if (!integration?.config?.url || !integration?.secret?.identity || !integration?.secret?.secret) throw new Error('NPM management credentials are unavailable. Ask an admin/manager with NPM configured to manage this account.');
+  const base = String(integration.config.url).replace(/\/+$/, '');
+  const tokenResponse = await fetch(`${base}/api/tokens`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ identity: integration.secret.identity, secret: integration.secret.secret }) });
+  if (!tokenResponse.ok) throw new Error(`NPM management authentication failed (HTTP ${tokenResponse.status}).`);
+  const token = (await tokenResponse.json() as { token?: string }).token;
+  if (!token) throw new Error('NPM did not return a management token.');
+  const headers = { authorization: `Bearer ${token}`, 'content-type': 'application/json' };
+  const usersResponse = await fetch(`${base}/api/users?expand=permissions`, { headers });
+  if (!usersResponse.ok) throw new Error(`Unable to list NPM users (HTTP ${usersResponse.status}).`);
+  const users = await usersResponse.json() as Array<{ id: number; email?: string; nickname?: string; name?: string }>;
+  const wanted = targetIdentity.toLowerCase();
+  const target = users.find((u) => String(u.email || '').toLowerCase() === wanted || String(u.nickname || '').toLowerCase() === wanted || String(u.name || '').toLowerCase() === wanted);
+  if (!target) throw new Error(`NPM user ${targetIdentity} was not found.`);
+  const update = await fetch(`${base}/api/users/${target.id}/auth`, { method: 'PUT', headers, body: JSON.stringify({ type: 'password', secret: newPassword }) });
+  if (!update.ok) throw new Error(`NPM password reset failed (HTTP ${update.status}).`);
+  return { config: { url: base } };
+};
+
+const jenkinsRequestHeaders = async (url: string, username: string, secret: string): Promise<Record<string,string>> => {
+  const baseAuth = `Basic ${Buffer.from(`${username}:${secret}`).toString('base64')}`;
+  const headers: Record<string,string> = { authorization: baseAuth };
+  const response = await fetch(`${url.replace(/\/+$/, '')}/crumbIssuer/api/json`, { headers, redirect: 'manual' });
+  if (!response.ok) return headers;
+  const crumb = await response.json() as { crumbRequestField?: string; crumb?: string };
+  if (crumb.crumbRequestField && crumb.crumb) headers[crumb.crumbRequestField] = crumb.crumb;
+  const h = response.headers as Headers & { getSetCookie?: () => string[] };
+  const cookies = typeof h.getSetCookie === 'function' ? h.getSetCookie() : (response.headers.get('set-cookie') ? [response.headers.get('set-cookie')!] : []);
+  const cookie = cookies.map((v) => v.split(';',1)[0]?.trim()).filter(Boolean).join('; ');
+  if (cookie) headers.cookie = cookie;
+  return headers;
+};
+
+const jenkinsAdminResetPassword = async (managerUserId: string, provider: 'jenkins-dev'|'jenkins-prod', username: string, newPassword: string): Promise<{ config: any }> => {
+  const integration = await providerIntegration(managerUserId, provider);
+  if (!integration?.config?.url || !integration?.secret?.username || !integration?.secret?.secret) throw new Error(`Jenkins management credentials (${provider}) are unavailable.`);
+  const url = String(integration.config.url).replace(/\/+$/, '');
+  const script = `import hudson.security.HudsonPrivateSecurityRealm\ndef user = hudson.model.User.getById(${JSON.stringify(username)}, false)\nif (user == null) throw new IllegalStateException('Jenkins user not found')\nuser.addProperty(HudsonPrivateSecurityRealm.Details.fromPlainPassword(${JSON.stringify(newPassword)}))\nuser.save()\nprintln 'updated'`;
+  const response = await fetch(`${url}/scriptText`, { method: 'POST', headers: { ...(await jenkinsRequestHeaders(url, integration.secret.username, integration.secret.secret)), 'content-type': 'application/x-www-form-urlencoded' }, body: new URLSearchParams({ script }).toString() });
+  const text = await response.text();
+  if (!response.ok || !text.includes('updated')) throw new Error(`Jenkins password reset failed (HTTP ${response.status}): ${text.trim() || response.statusText}`);
+  return { config: { url } };
+};
+
+const resetManagedExternalPasswords = async (cloudUserId: string, newPassword: string, targets: string[]): Promise<Array<{ provider: string; ok: boolean; error?: string }>> => {
+  const accounts = await pool.query(
+    `SELECT mea.provider,mea.external_username,mea.external_email,mea.managed_by_user_id,mea.config
+       FROM managed_external_accounts mea
+      WHERE mea.cloud_user_id=$1
+      ORDER BY mea.provider`, [cloudUserId]
+  );
+  const results: Array<{ provider: string; ok: boolean; error?: string }> = [];
+  for (const account of accounts.rows) {
+    const family = String(account.provider).startsWith('jenkins-') ? 'jenkins' : String(account.provider);
+    if (!targets.includes(family) && !targets.includes(account.provider)) continue;
+    let managerId: string | null = account.managed_by_user_id;
+    if (!managerId) {
+      const fallback = await pool.query(`SELECT u.id FROM users u JOIN user_integrations ui ON ui.user_id=u.id AND ui.provider=$1 WHERE u.is_active=true AND u.role IN ('admin','manager') ORDER BY CASE WHEN u.role='admin' THEN 0 ELSE 1 END,u.created_at LIMIT 1`, [account.provider]);
+      managerId = fallback.rows[0]?.id || null;
+    }
+    if (!managerId) { results.push({ provider: account.provider, ok: false, error: 'No manager/admin provider credential is available.' }); continue; }
+    try {
+      if (account.provider === 'npm') {
+        const changed = await npmAdminResetPassword(managerId, account.external_email || account.external_username, newPassword);
+        await saveProviderIntegrationForUser(cloudUserId, 'npm', changed.config, { identity: account.external_email || account.external_username, secret: newPassword });
+      } else if (account.provider === 'jenkins-dev' || account.provider === 'jenkins-prod') {
+        const changed = await jenkinsAdminResetPassword(managerId, account.provider, account.external_username, newPassword);
+        await saveProviderIntegrationForUser(cloudUserId, account.provider, changed.config, { username: account.external_username, secret: newPassword });
+      }
+      results.push({ provider: account.provider, ok: true });
+    } catch (error) {
+      results.push({ provider: account.provider, ok: false, error: error instanceof Error ? error.message : String(error) });
+    }
+  }
+  return results;
+};
+
+const mailTransport = () => {
+  const host = process.env.SMTP_HOST;
+  const from = process.env.SMTP_FROM;
+  if (!host || !from) throw new Error('Password reset email is not configured. Set SMTP_HOST and SMTP_FROM on IndraQ Cloud.');
+  const port = Number(process.env.SMTP_PORT || 587);
+  return {
+    transporter: nodemailer.createTransport({
+      host,
+      port,
+      secure: String(process.env.SMTP_SECURE || '').toLowerCase() === 'true',
+      ...(process.env.SMTP_USER ? { auth: { user: process.env.SMTP_USER, pass: process.env.SMTP_PASS || '' } } : {})
+    }),
+    from
+  };
+};
+
+const runMigrations = async (): Promise<void> => {
+  await pool.query(`CREATE TABLE IF NOT EXISTS schema_migrations (
+    name text PRIMARY KEY,
+    applied_at timestamptz NOT NULL DEFAULT now()
+  )`);
+  const moduleDir = dirname(fileURLToPath(import.meta.url));
+  const sqlDir = resolve(moduleDir, '../sql');
+  const files = (await readdir(sqlDir)).filter((name) => /^\d+.*\.sql$/i.test(name)).sort();
+  for (const file of files) {
+    const alreadyApplied = await pool.query('SELECT 1 FROM schema_migrations WHERE name=$1', [file]);
+    if (alreadyApplied.rowCount) continue;
+    const sql = await readFile(resolve(sqlDir, file), 'utf8');
+    const client = await pool.connect();
+    try {
+      await client.query('BEGIN');
+      await client.query(sql);
+      await client.query('INSERT INTO schema_migrations(name) VALUES($1)', [file]);
+      await client.query('COMMIT');
+      console.log(`Applied database migration ${file}`);
+    } catch (error) {
+      await client.query('ROLLBACK');
+      throw error;
+    } finally {
+      client.release();
+    }
+  }
+};
+
+app.get('/health', async (_req, res) => {
+  await pool.query('SELECT 1');
+  res.json({ status: 'ok' });
+});
+
+app.post('/auth/login', async (req, res) => {
+  const { email, password } = req.body || {};
+  const result = await pool.query(
+    'SELECT id,email,name,password_hash,role,is_active,must_change_password FROM users WHERE lower(email)=lower($1)',
+    [email]
+  );
+  const user = result.rows[0];
+  if (!user || !user.is_active || !(await bcrypt.compare(String(password || ''), user.password_hash))) {
+    res.status(401).json({ error: 'Invalid credentials' }); return;
+  }
+  await pool.query('UPDATE users SET last_login_at=now() WHERE id=$1', [user.id]);
+  const token = jwt.sign({ id: user.id, email: user.email, role: user.role }, jwtSecret, { expiresIn: '12h' });
+  res.json({ token, user: { id: user.id, email: user.email, name: user.name, role: user.role, mustChangePassword: !!user.must_change_password } });
+});
+app.get('/auth/me', auth, (req: AuthedRequest, res) => res.json(req.auth));
+
+app.post('/auth/first-login-password', auth, async (req: AuthedRequest, res) => {
+  const newPassword = String(req.body?.password || '');
+  if (!req.auth!.mustChangePassword) { res.status(400).json({ error: 'This account does not require a first-login password change.' }); return; }
+  if (newPassword.length < 10) { res.status(400).json({ error: 'Password must be at least 10 characters.' }); return; }
+  const external = await resetManagedExternalPasswords(req.auth!.id, newPassword, ['npm','jenkins']);
+  const failed = external.filter((item) => !item.ok);
+  if (failed.length) { res.status(502).json({ error: 'Could not rotate the temporary password on every managed provider. Retry or ask an admin.', results: external }); return; }
+  await pool.query('UPDATE users SET password_hash=$1,must_change_password=false,password_changed_at=now(),updated_at=now() WHERE id=$2', [await bcrypt.hash(newPassword, 12), req.auth!.id]);
+  await audit(req.auth!.id, 'user.password.first-login', 'user', req.auth!.id, 'Required first-login password change', { providers: external.map((item) => item.provider) });
+  res.json({ ok: true, results: [{ provider: 'cloud', ok: true }, ...external] });
+});
+
+app.post('/auth/password-reset/request', async (req, res) => {
+  const email = String(req.body?.email || '').trim().toLowerCase();
+  if (!/^\S+@\S+\.\S+$/.test(email)) { res.status(400).json({ error: 'Enter a valid email address.' }); return; }
+  const userResult = await pool.query('SELECT id,email,name,is_active FROM users WHERE lower(email)=lower($1)', [email]);
+  const user = userResult.rows[0];
+  // Always return the same response shape to avoid account enumeration.
+  if (!user || !user.is_active) { res.status(202).json({ ok: true }); return; }
+  const recent = await pool.query("SELECT 1 FROM password_reset_otps WHERE user_id=$1 AND created_at > now() - interval '60 seconds' LIMIT 1", [user.id]);
+  if (recent.rowCount) { res.status(429).json({ error: 'A reset code was sent recently. Wait one minute before requesting another.' }); return; }
+  const otp = String(randomInt(100000, 1000000));
+  await pool.query('UPDATE password_reset_otps SET used_at=now() WHERE user_id=$1 AND used_at IS NULL', [user.id]);
+  await pool.query("INSERT INTO password_reset_otps(user_id,otp_hash,expires_at) VALUES($1,$2,now()+interval '10 minutes')", [user.id, await bcrypt.hash(otp, 10)]);
+  const { transporter, from } = mailTransport();
+  await transporter.sendMail({ from, to: user.email, subject: 'IndraQ password reset code', text: `Your IndraQ password reset code is ${otp}. It expires in 10 minutes. If you did not request this, ignore this email.` });
+  res.status(202).json({ ok: true });
+});
+
+app.post('/auth/password-reset/verify', async (req, res) => {
+  const email = String(req.body?.email || '').trim().toLowerCase();
+  const otp = String(req.body?.otp || '').trim();
+  const newPassword = String(req.body?.password || '');
+  const rawTargets: string[] = Array.isArray(req.body?.targets) ? req.body.targets.map((v: unknown) => String(v).toLowerCase()) : ['cloud'];
+  const targets: string[] = [...new Set<string>(rawTargets.filter((v) => ['cloud','npm','jenkins'].includes(v)))];
+  if (!targets.length) { res.status(400).json({ error: 'Choose at least one password target: cloud, npm, or jenkins.' }); return; }
+  if (newPassword.length < 10) { res.status(400).json({ error: 'Password must be at least 10 characters.' }); return; }
+  const userResult = await pool.query('SELECT id,email,is_active FROM users WHERE lower(email)=lower($1)', [email]);
+  const user = userResult.rows[0];
+  if (!user || !user.is_active) { res.status(400).json({ error: 'Invalid or expired reset code.' }); return; }
+  const otpResult = await pool.query('SELECT id,otp_hash,expires_at,attempts,max_attempts FROM password_reset_otps WHERE user_id=$1 AND used_at IS NULL ORDER BY created_at DESC LIMIT 1', [user.id]);
+  const row = otpResult.rows[0];
+  if (!row || new Date(row.expires_at).getTime() < Date.now() || row.attempts >= row.max_attempts) { res.status(400).json({ error: 'Invalid or expired reset code.' }); return; }
+  const valid = await bcrypt.compare(otp, row.otp_hash);
+  if (!valid) { await pool.query('UPDATE password_reset_otps SET attempts=attempts+1 WHERE id=$1', [row.id]); res.status(400).json({ error: 'Invalid or expired reset code.' }); return; }
+  const results: Array<{ provider: string; ok: boolean; error?: string }> = [];
+  if (targets.includes('npm') || targets.includes('jenkins')) results.push(...await resetManagedExternalPasswords(user.id, newPassword, targets));
+  if (targets.includes('cloud')) {
+    await pool.query('UPDATE users SET password_hash=$1,must_change_password=false,password_changed_at=now(),updated_at=now() WHERE id=$2', [await bcrypt.hash(newPassword, 12), user.id]);
+    results.unshift({ provider: 'cloud', ok: true });
+  }
+  await pool.query('UPDATE password_reset_otps SET used_at=now() WHERE id=$1', [row.id]);
+  await audit(user.id, 'user.password.self-reset', 'user', user.id, 'Email OTP password reset', { targets, results: results.map((r) => ({ provider: r.provider, ok: r.ok })) });
+  res.setHeader('Cache-Control', 'no-store');
+  res.json({ ok: results.every((r) => r.ok), results });
+});
+
+app.post('/users', ...allow('manager', 'admin'), async (req: AuthedRequest, res) => {
+  const reason = requireReason(req, res); if (!reason) return;
+  const { email, name, password, role = 'user' } = req.body || {};
+  if (!['user', 'manager', 'admin'].includes(role)) { res.status(400).json({ error: 'Role must be user, manager, or admin.' }); return; }
+  if (req.auth!.role === 'manager' && role !== 'user') { res.status(403).json({ error: 'Managers may only create users.' }); return; }
+  if ((role === 'manager' || role === 'admin') && req.auth!.role !== 'admin') { res.status(403).json({ error: 'Only admins may create managers or admins.' }); return; }
+  if (String(password || '').length < 10) { res.status(400).json({ error: 'Password must be at least 10 characters.' }); return; }
+  const hash = await bcrypt.hash(password, 12);
+  const result = await pool.query(
+    'INSERT INTO users(email,name,password_hash,role,created_by,must_change_password) VALUES(lower($1),$2,$3,$4,$5,true) RETURNING id,email,name,role,must_change_password,created_at',
+    [email, name, hash, role, req.auth!.id]
+  );
+  await audit(req.auth!.id, 'user.create', 'user', result.rows[0].id, reason, { role });
+  res.status(201).json(result.rows[0]);
+});
+
+app.patch('/users/:id/password', ...allow('manager', 'admin'), async (req: AuthedRequest, res) => {
+  const reason = requireReason(req, res); if (!reason) return;
+  const id = routeParam(req.params.id);
+  const target = await pool.query('SELECT role FROM users WHERE id=$1', [id]);
+  if (!target.rowCount) { res.status(404).json({ error: 'User not found' }); return; }
+  if (req.auth!.role === 'manager' && target.rows[0].role !== 'user') { res.status(403).json({ error: 'Managers may only manage users.' }); return; }
+  const password = String(req.body.password || '');
+  if (password.length < 10) { res.status(400).json({ error: 'Password must be at least 10 characters.' }); return; }
+  await pool.query('UPDATE users SET password_hash=$1,must_change_password=true,updated_at=now() WHERE id=$2', [await bcrypt.hash(password, 12), id]);
+  await audit(req.auth!.id, 'user.password.update', 'user', id, reason);
+  res.status(204).end();
+});
+
+app.delete('/users/:id', ...allow('manager', 'admin'), async (req: AuthedRequest, res) => {
+  const reason = requireReason(req, res); if (!reason) return;
+  const id = routeParam(req.params.id);
+  const target = await pool.query('SELECT role FROM users WHERE id=$1', [id]);
+  if (!target.rowCount) { res.status(404).json({ error: 'User not found' }); return; }
+  if (req.auth!.role === 'manager' && target.rows[0].role !== 'user') { res.status(403).json({ error: 'Managers may only delete users.' }); return; }
+  await pool.query('UPDATE users SET is_active=false,updated_at=now() WHERE id=$1', [id]);
+  await audit(req.auth!.id, 'user.disable', 'user', id, reason);
+  res.status(204).end();
+});
+
+app.get('/users', ...allow('manager', 'admin'), async (req: AuthedRequest, res) => {
+  const { search, limit } = listQuery(req);
+  const result = await pool.query(
+    `SELECT id,email,name,role,is_active,must_change_password,created_at,updated_at,last_login_at
+       FROM users
+      WHERE ($1='' OR email ILIKE '%'||$1||'%' OR name ILIKE '%'||$1||'%' OR role ILIKE '%'||$1||'%')
+      ORDER BY created_at DESC
+      LIMIT $2`, [search, limit]
+  );
+  res.json(result.rows);
+});
+
+app.patch('/users/:id/role', ...allow('admin'), async (req: AuthedRequest, res) => {
+  const reason = requireReason(req, res); if (!reason) return;
+  const id = routeParam(req.params.id);
+  const role = String(req.body?.role || '').trim().toLowerCase();
+  if (!['user', 'manager', 'admin'].includes(role)) { res.status(400).json({ error: 'Role must be user, manager, or admin.' }); return; }
+  if (id === req.auth!.id && role !== 'admin') { res.status(400).json({ error: 'An admin cannot demote their own active session through this endpoint.' }); return; }
+  const result = await pool.query('UPDATE users SET role=$1,updated_at=now() WHERE id=$2 RETURNING id,email,name,role,is_active,updated_at', [role, id]);
+  if (!result.rowCount) { res.status(404).json({ error: 'User not found' }); return; }
+  await audit(req.auth!.id, 'user.role.update', 'user', id, reason, { role });
+  res.json(result.rows[0]);
+});
+
+app.post('/users/:id/aws-credentials', ...allow('manager', 'admin'), async (req: AuthedRequest, res) => {
+  const reason = requireReason(req, res); if (!reason) return;
+  const id = routeParam(req.params.id);
+  const target = await pool.query('SELECT id,role,is_active FROM users WHERE id=$1', [id]);
+  if (!target.rowCount) { res.status(404).json({ error: 'User not found' }); return; }
+  if (req.auth!.role === 'manager' && target.rows[0].role !== 'user') { res.status(403).json({ error: 'Managers may only store credentials for users.' }); return; }
+  const awsUsername = String(req.body?.awsUsername || '').trim();
+  const accessKeyId = String(req.body?.accessKeyId || '').trim();
+  const secretAccessKey = String(req.body?.secretAccessKey || '');
+  const indraqRole = String(req.body?.indraqRole || target.rows[0].role || 'user').trim().toLowerCase();
+  if (!awsUsername || !accessKeyId || !secretAccessKey) { res.status(400).json({ error: 'awsUsername, accessKeyId and secretAccessKey are required.' }); return; }
+  if (!['user','manager','admin'].includes(indraqRole)) { res.status(400).json({ error: 'indraqRole must be user, manager, or admin.' }); return; }
+  const encryptedSecret = encrypt(secretAccessKey);
+  const result = await pool.query(
+    `INSERT INTO managed_aws_credentials(cloud_user_id,aws_username,access_key_id,encrypted_secret_access_key,indraq_role,created_by,managed_by_user_id)
+     VALUES($1,$2,$3,$4,$5,$6,$6)
+     ON CONFLICT(cloud_user_id,aws_username) DO UPDATE SET
+       access_key_id=excluded.access_key_id,
+       encrypted_secret_access_key=excluded.encrypted_secret_access_key,
+       indraq_role=excluded.indraq_role,
+       managed_by_user_id=excluded.managed_by_user_id,
+       updated_at=now()
+     RETURNING id,cloud_user_id,aws_username,access_key_id,indraq_role,created_at,updated_at`,
+    [id, awsUsername, accessKeyId, encryptedSecret, indraqRole, req.auth!.id]
+  );
+  await audit(req.auth!.id, 'aws.credentials.store', 'user', id, reason, { awsUsername, accessKeyId, indraqRole });
+  res.status(201).json(result.rows[0]);
+});
+
+app.delete('/users/:id/aws-credentials/:awsUsername', ...allow('manager', 'admin'), async (req: AuthedRequest, res) => {
+  const reason = requireReason(req, res); if (!reason) return;
+  const id = routeParam(req.params.id);
+  const awsUsername = routeParam(req.params.awsUsername);
+  const target = await pool.query('SELECT id,role FROM users WHERE id=$1', [id]);
+  if (!target.rowCount) { res.status(404).json({ error: 'User not found' }); return; }
+  if (req.auth!.role === 'manager' && target.rows[0].role !== 'user') { res.status(403).json({ error: 'Managers may only remove credentials for users.' }); return; }
+  const result = await pool.query(
+    'DELETE FROM managed_aws_credentials WHERE cloud_user_id=$1 AND aws_username=$2 RETURNING access_key_id',
+    [id, awsUsername]
+  );
+  if (!result.rowCount) { res.status(404).json({ error: 'Stored AWS credentials not found.' }); return; }
+  await audit(req.auth!.id, 'aws.credentials.delete', 'user', id, reason, { awsUsername, accessKeyId: result.rows[0].access_key_id });
+  res.status(204).end();
+});
+
+app.get('/me/aws-credentials', auth, async (req: AuthedRequest, res) => {
+  const result = await pool.query(
+    'SELECT id,aws_username,access_key_id,indraq_role,created_at,updated_at FROM managed_aws_credentials WHERE cloud_user_id=$1 ORDER BY aws_username',
+    [req.auth!.id]
+  );
+  res.json(result.rows);
+});
+
+app.get('/aws-credentials', ...allow('manager', 'admin'), async (req: AuthedRequest, res) => {
+  const { search, limit } = listQuery(req);
+  const result = await pool.query(
+    `SELECT mac.id,mac.cloud_user_id,mac.aws_username,mac.access_key_id,mac.indraq_role,mac.created_at,mac.updated_at,
+            u.email,u.name,u.role AS user_role,u.is_active
+       FROM managed_aws_credentials mac
+       JOIN users u ON u.id=mac.cloud_user_id
+      WHERE ($1='' OR mac.aws_username ILIKE '%'||$1||'%' OR mac.access_key_id ILIKE '%'||$1||'%' OR u.email ILIKE '%'||$1||'%' OR u.name ILIKE '%'||$1||'%')
+      ORDER BY u.email,mac.aws_username
+      LIMIT $2`,
+    [search, limit]
+  );
+  res.json(result.rows);
+});
+
+app.post('/me/aws-credentials/:awsUsername/rotate', auth, async (req: AuthedRequest, res) => {
+  const reason = requireReason(req, res); if (!reason) return;
+  const awsUsername = routeParam(req.params.awsUsername);
+  const rotated = await rotateManagedAwsAccessKey(req.auth!, req.auth!.id, awsUsername, reason);
+  res.setHeader('Cache-Control', 'no-store');
+  res.setHeader('Pragma', 'no-cache');
+  res.json(rotated);
+});
+
+app.post('/users/:id/aws-credentials/:awsUsername/rotate', ...allow('manager', 'admin'), async (req: AuthedRequest, res) => {
+  const reason = requireReason(req, res); if (!reason) return;
+  const id = ensureUuid(routeParam(req.params.id), 'User ID');
+  const awsUsername = routeParam(req.params.awsUsername);
+  const target = await pool.query('SELECT id,role,is_active FROM users WHERE id=$1', [id]);
+  if (!target.rowCount || !target.rows[0].is_active) { res.status(404).json({ error: 'User not found' }); return; }
+  const rotated = await rotateManagedAwsAccessKey(req.auth!, id, awsUsername, reason);
+  res.setHeader('Cache-Control', 'no-store');
+  res.setHeader('Pragma', 'no-cache');
+  res.json(rotated);
+});
+
+app.get('/users/:id/aws-credentials', ...allow('manager', 'admin'), async (req: AuthedRequest, res) => {
+  const id = routeParam(req.params.id);
+  const target = await pool.query('SELECT id,role FROM users WHERE id=$1', [id]);
+  if (!target.rowCount) { res.status(404).json({ error: 'User not found' }); return; }
+  if (req.auth!.role === 'manager' && target.rows[0].role !== 'user') { res.status(403).json({ error: 'Managers may inspect AWS mappings only for normal users.' }); return; }
+  const result = await pool.query(
+    'SELECT id,aws_username,access_key_id,indraq_role,created_at,updated_at FROM managed_aws_credentials WHERE cloud_user_id=$1 ORDER BY aws_username',
+    [id]
+  );
+  res.json(result.rows);
+});
+
+app.post('/me/aws-credentials/:awsUsername/resolve', auth, async (req: AuthedRequest, res) => {
+  const reason = requireReason(req, res); if (!reason) return;
+  const awsUsername = routeParam(req.params.awsUsername);
+  const result = await pool.query(
+    'SELECT id,aws_username,access_key_id,encrypted_secret_access_key,indraq_role FROM managed_aws_credentials WHERE cloud_user_id=$1 AND aws_username=$2',
+    [req.auth!.id, awsUsername]
+  );
+  if (!result.rowCount) { res.status(404).json({ error: 'Stored AWS credentials not found for this IndraQ user.' }); return; }
+  await audit(req.auth!.id, 'aws.credentials.resolve', 'user', req.auth!.id, reason, { awsUsername, accessKeyId: result.rows[0].access_key_id });
+  res.setHeader('Cache-Control', 'no-store');
+  res.setHeader('Pragma', 'no-cache');
+  res.json({ awsUsername: result.rows[0].aws_username, accessKeyId: result.rows[0].access_key_id, secretAccessKey: decrypt(result.rows[0].encrypted_secret_access_key), indraqRole: result.rows[0].indraq_role });
+});
+
+app.get('/projects', auth, async (req: AuthedRequest, res) => {
+  const { search, limit } = listQuery(req);
+  const privileged = req.auth!.role === 'manager' || req.auth!.role === 'admin';
+  const result = await pool.query(
+    `SELECT p.*,u.email AS creator_email,
+      CASE
+        WHEN $3::boolean THEN 'write'
+        WHEN p.created_by=$1 THEN 'write'
+        WHEN pm.role='owner' OR pm.access_level='write' THEN 'write'
+        ELSE 'view'
+      END AS effective_access
+     FROM projects p
+     JOIN users u ON u.id=p.created_by
+     LEFT JOIN project_members pm ON pm.project_id=p.id AND pm.user_id=$1
+     WHERE ($2='' OR p.name ILIKE '%'||$2||'%' OR p.kind ILIKE '%'||$2||'%' OR u.email ILIKE '%'||$2||'%')
+     ORDER BY p.created_at DESC
+     LIMIT $4`, [req.auth!.id, search, privileged, limit]
+  );
+  res.json(result.rows);
+});
+
+app.post('/projects', auth, async (req: AuthedRequest, res) => {
+  const reason = typeof req.body?.reason === 'string' && req.body.reason.trim().length >= 3
+    ? req.body.reason.trim()
+    : 'Create project from IndraQ CLI';
+  const name = String(req.body?.name || '').trim();
+  const kind = String(req.body?.kind || '').trim();
+  const config = req.body?.config || {};
+  if (!name) { res.status(400).json({ error: 'Project name is required.' }); return; }
+  const duplicate = await pool.query('SELECT id,name FROM projects WHERE lower(name)=lower($1) LIMIT 1', [name]);
+  if (duplicate.rowCount) { res.status(409).json({ error: `Project name "${name}" already exists organization-wide. Delete the old project or run \`indraq project link --search ${name}\`.` }); return; }
+  const result = await pool.query(
+    'INSERT INTO projects(name,kind,config,created_by) VALUES($1,$2,$3,$4) RETURNING *',
+    [name, kind, config, req.auth!.id]
+  );
+  await pool.query(
+    "INSERT INTO project_members(project_id,user_id,role,access_level,added_by) VALUES($1,$2,'owner','write',$3) ON CONFLICT(project_id,user_id) DO NOTHING",
+    [result.rows[0].id, req.auth!.id, req.auth!.id]
+  );
+  await audit(req.auth!.id, 'project.create', 'project', result.rows[0].id, reason);
+  res.status(201).json({ ...result.rows[0], effective_access: 'write' });
+});
+
+app.get('/projects/:id', auth, async (req: AuthedRequest, res) => {
+  const id = ensureUuid(routeParam(req.params.id), 'Project ID');
+  const access = await projectAccessLevel(id, req.auth!);
+  if (!access) { res.status(404).json({ error: 'Project not found' }); return; }
+  const result = await pool.query('SELECT p.*,u.email AS creator_email FROM projects p JOIN users u ON u.id=p.created_by WHERE p.id=$1', [id]);
+  if (!result.rowCount) { res.status(404).json({ error: 'Project not found' }); return; }
+  res.json({ ...result.rows[0], effective_access: access });
+});
+
+app.patch('/projects/:id', ...allow('manager', 'admin'), async (req: AuthedRequest, res) => {
+  const reason = requireReason(req, res); if (!reason) return;
+  const id = ensureUuid(routeParam(req.params.id), 'Project ID');
+  if (typeof req.body?.name === 'string' && req.body.name.trim()) {
+    const duplicate = await pool.query('SELECT id FROM projects WHERE lower(name)=lower($1) AND id<>$2 LIMIT 1', [req.body.name.trim(), id]);
+    if (duplicate.rowCount) { res.status(409).json({ error: `Project name "${req.body.name.trim()}" already exists organization-wide.` }); return; }
+  }
+  const result = await pool.query(
+    'UPDATE projects SET config=COALESCE($1,config),name=COALESCE($2,name),updated_at=now() WHERE id=$3 RETURNING *',
+    [req.body.config || null, req.body.name || null, id]
+  );
+  if (!result.rowCount) { res.status(404).json({ error: 'Project not found' }); return; }
+  await audit(req.auth!.id, 'project.update', 'project', id, reason);
+  res.json(result.rows[0]);
+});
+
+app.delete('/projects/:id', ...allow('manager', 'admin'), async (req: AuthedRequest, res) => {
+  const reason = requireReason(req, res); if (!reason) return;
+  const id = routeParam(req.params.id);
+  const result = await pool.query('DELETE FROM projects WHERE id=$1 RETURNING id,name', [id]);
+  if (!result.rowCount) { res.status(404).json({ error: 'Project not found' }); return; }
+  await audit(req.auth!.id, 'project.delete', 'project', id, reason, { name: result.rows[0].name });
+  res.status(204).end();
+});
+
+app.get('/projects/:id/members', ...allow('manager', 'admin'), async (req: AuthedRequest, res) => {
+  const id = routeParam(req.params.id);
+  const result = await pool.query(`SELECT pm.project_id,pm.user_id,pm.role,pm.access_level,pm.added_at,u.email,u.name,u.role AS user_role
+      FROM project_members pm JOIN users u ON u.id=pm.user_id
+      WHERE pm.project_id=$1 AND u.is_active=true ORDER BY u.email`, [id]);
+  res.json(result.rows);
+});
+
+app.post('/projects/:id/members', ...allow('manager', 'admin'), async (req: AuthedRequest, res) => {
+  const reason = requireReason(req, res); if (!reason) return;
+  const id = routeParam(req.params.id);
+  const userId = String(req.body?.userId || '');
+  const project = await pool.query('SELECT id FROM projects WHERE id=$1', [id]);
+  if (!project.rowCount) { res.status(404).json({ error: 'Project not found' }); return; }
+  const target = await pool.query('SELECT id,email,role,is_active FROM users WHERE id=$1', [userId]);
+  if (!target.rowCount || !target.rows[0].is_active) { res.status(404).json({ error: 'User not found' }); return; }
+  if (req.auth!.role === 'manager' && target.rows[0].role !== 'user') { res.status(403).json({ error: 'Managers may add only normal users to projects.' }); return; }
+  const accessLevel = req.body?.accessLevel === 'view' ? 'view' : 'write';
+  await pool.query(`INSERT INTO project_members(project_id,user_id,role,access_level,added_by)
+      VALUES($1,$2,'user',$3,$4)
+      ON CONFLICT(project_id,user_id) DO UPDATE SET access_level=excluded.access_level,added_by=excluded.added_by,added_at=now()`, [id, userId, accessLevel, req.auth!.id]);
+  await audit(req.auth!.id, 'project.member.add', 'project', id, reason, { userId, email: target.rows[0].email, accessLevel });
+  res.status(201).json({ projectId: id, userId, email: target.rows[0].email, accessLevel });
+});
+
+app.delete('/projects/:id/members/:userId', ...allow('manager', 'admin'), async (req: AuthedRequest, res) => {
+  const reason = requireReason(req, res); if (!reason) return;
+  const id = routeParam(req.params.id);
+  const userId = routeParam(req.params.userId);
+  const target = await pool.query('SELECT email,role FROM users WHERE id=$1', [userId]);
+  if (req.auth!.role === 'manager' && target.rows[0]?.role && target.rows[0].role !== 'user') { res.status(403).json({ error: 'Managers may remove only normal users from projects.' }); return; }
+  const result = await pool.query("DELETE FROM project_members WHERE project_id=$1 AND user_id=$2 AND role<>'owner' RETURNING user_id", [id, userId]);
+  if (!result.rowCount) { res.status(404).json({ error: 'Project membership not found or owner membership cannot be removed.' }); return; }
+  await pool.query(`DELETE FROM project_resource_grants g USING project_resources pr
+      WHERE g.project_resource_id=pr.id AND pr.project_id=$1 AND g.user_id=$2`, [id, userId]);
+  await audit(req.auth!.id, 'project.member.remove', 'project', id, reason, { userId, email: target.rows[0]?.email });
+  res.status(204).end();
+});
+
+// Shared deployment environments are generic admin-managed named server targets.
+// They do not carry PRIMARY/SECONDARY semantics. Failover roles are assigned only
+// when a user creates/reconciles a Route53 FAILOVER record.
+app.get('/environments', auth, async (req, res) => {
+  const { search, limit } = listQuery(req);
+  const result = await pool.query(`
+    SELECT id,name,description,host(ipv4) ipv4,region,health_path AS "healthPath",created_at,updated_at
+    FROM environments
+    WHERE ($1='' OR name ILIKE '%'||$1||'%' OR coalesce(description,'') ILIKE '%'||$1||'%' OR host(ipv4) ILIKE '%'||$1||'%')
+    ORDER BY name
+    LIMIT $2
+  `, [search, limit]);
+  res.json(result.rows);
+});
+
+app.post('/environments', ...allow('admin'), async (req: AuthedRequest, res) => {
+  const reason = requireReason(req, res); if (!reason) return;
+  const name = String(req.body?.name || '').trim().toLowerCase();
+  const ipv4 = String(req.body?.ipv4 || '').trim();
+  const description = req.body?.description ? String(req.body.description).trim() : null;
+  const region = req.body?.region ? String(req.body.region).trim() : null;
+  const rawHealthPath = String(req.body?.healthPath || '/health').trim() || '/health';
+  const healthPath = rawHealthPath.startsWith('/') ? rawHealthPath : `/${rawHealthPath}`;
+  if (!/^[a-z0-9][a-z0-9._-]{0,63}$/.test(name)) { res.status(400).json({ error: 'Environment name may contain letters, numbers, dots, hyphens and underscores.' }); return; }
+  if (isIP(ipv4) !== 4) { res.status(400).json({ error: 'Environment IPv4 must be a valid IPv4 address.' }); return; }
+  const result = await pool.query(
+    'INSERT INTO environments(name,description,ipv4,region,health_path,created_by) VALUES($1,$2,$3,$4,$5,$6) RETURNING id,name,description,host(ipv4) ipv4,region,health_path AS "healthPath",created_at,updated_at',
+    [name, description, ipv4, region, healthPath, req.auth!.id]
+  );
+  await audit(req.auth!.id, 'environment.create', 'environment', result.rows[0].id, reason, { name, ipv4, region });
+  res.status(201).json(result.rows[0]);
+});
+
+app.put('/environments/:id', ...allow('admin'), async (req: AuthedRequest, res) => {
+  const reason = requireReason(req, res); if (!reason) return;
+  const id = routeParam(req.params.id);
+  const name = String(req.body?.name || '').trim().toLowerCase();
+  const ipv4 = String(req.body?.ipv4 || '').trim();
+  const description = req.body?.description ? String(req.body.description).trim() : null;
+  const region = req.body?.region ? String(req.body.region).trim() : null;
+  const rawHealthPath = String(req.body?.healthPath || '/health').trim() || '/health';
+  const healthPath = rawHealthPath.startsWith('/') ? rawHealthPath : `/${rawHealthPath}`;
+  if (!/^[a-z0-9][a-z0-9._-]{0,63}$/.test(name)) { res.status(400).json({ error: 'Invalid environment name.' }); return; }
+  if (isIP(ipv4) !== 4) { res.status(400).json({ error: 'Environment IPv4 must be a valid IPv4 address.' }); return; }
+  const result = await pool.query(
+    'UPDATE environments SET name=$1,description=$2,ipv4=$3,region=$4,health_path=$5,updated_at=now() WHERE id=$6 RETURNING id,name,description,host(ipv4) ipv4,region,health_path AS "healthPath",created_at,updated_at',
+    [name, description, ipv4, region, healthPath, id]
+  );
+  if (!result.rowCount) { res.status(404).json({ error: 'Environment not found' }); return; }
+  await audit(req.auth!.id, 'environment.update', 'environment', id, reason, { name, ipv4, region });
+  res.json(result.rows[0]);
+});
+
+app.delete('/environments/:id', ...allow('admin'), async (req: AuthedRequest, res) => {
+  const reason = requireReason(req, res); if (!reason) return;
+  const id = routeParam(req.params.id);
+  const result = await pool.query('DELETE FROM environments WHERE id=$1 RETURNING id,name', [id]);
+  if (!result.rowCount) { res.status(404).json({ error: 'Environment not found' }); return; }
+  await audit(req.auth!.id, 'environment.delete', 'environment', id, reason, { name: result.rows[0].name });
+  res.status(204).end();
+});
+
+app.get('/servers', auth, async (_req, res) => {
+  res.json((await pool.query('SELECT id,name,environment,host(ipv4) ipv4,health_path,is_backup,created_at FROM servers ORDER BY environment,name')).rows);
+});
+
+app.post('/servers', ...allow('admin'), async (req: AuthedRequest, res) => {
+  const { name, environment, ipv4, healthPath = '/health', isBackup = false } = req.body || {};
+  const result = await pool.query(
+    'INSERT INTO servers(name,environment,ipv4,health_path,is_backup,created_by) VALUES($1,$2,$3,$4,$5,$6) RETURNING id,name,environment,host(ipv4) ipv4,health_path,is_backup',
+    [name, environment, ipv4, healthPath, isBackup, req.auth!.id]
+  );
+  await audit(req.auth!.id, 'server.create', 'server', result.rows[0].id, req.body.reason);
+  res.status(201).json(result.rows[0]);
+});
+
+// Reusable provider credentials are scoped to the authenticated IndraQ user.
+// A user configures AWS/NPM/Jenkins/GHCR once and can reuse that profile across
+// every project they are allowed to access. Secrets are encrypted at rest and
+// every resolve is audited. No user can read another user's provider secret.
+app.get('/me/integrations', auth, async (req: AuthedRequest, res) => {
+  const result = await pool.query(
+    'SELECT id,provider,config,(encrypted_secret IS NOT NULL) has_secret,updated_at FROM user_integrations WHERE user_id=$1 ORDER BY provider',
+    [req.auth!.id]
+  );
+  res.json(result.rows);
+});
+
+// Managers/admins may provision a provider profile for a target user. This is
+// used by unified user creation so generated AWS credentials are immediately
+// usable by that user's IndraQ CLI without a second manual provider setup.
+app.put('/users/:id/integrations/:provider', ...allow('manager', 'admin'), async (req: AuthedRequest, res) => {
+  const reason = requireReason(req, res); if (!reason) return;
+  const userId = routeParam(req.params.id);
+  const target = await pool.query('SELECT id,email,role,is_active FROM users WHERE id=$1', [userId]);
+  if (!target.rowCount || !target.rows[0].is_active) { res.status(404).json({ error: 'User not found' }); return; }
+  if (req.auth!.role === 'manager' && target.rows[0].role !== 'user') { res.status(403).json({ error: 'Managers may provision providers only for normal users.' }); return; }
+  let provider: string;
+  try { provider = providerName(routeParam(req.params.provider)); }
+  catch { res.status(400).json({ error: 'Invalid provider name' }); return; }
+  const secret = req.body.secret ? encrypt(JSON.stringify(req.body.secret)) : null;
+  const result = await pool.query(
+    `INSERT INTO user_integrations(user_id,provider,config,encrypted_secret)
+     VALUES($1,$2,$3,$4)
+     ON CONFLICT(user_id,provider) DO UPDATE SET
+       config=excluded.config,
+       encrypted_secret=COALESCE(excluded.encrypted_secret,user_integrations.encrypted_secret),
+       updated_at=now()
+     RETURNING id,user_id,provider,config,(encrypted_secret IS NOT NULL) has_secret,updated_at`,
+    [userId, provider, req.body.config || {}, secret]
+  );
+  await audit(req.auth!.id, 'user.integration.provision', 'user-integration', result.rows[0].id, reason, { userId, provider, email: target.rows[0].email });
+  res.json(result.rows[0]);
+});
+
+app.get('/me/external-accounts', auth, async (req: AuthedRequest, res) => {
+  const result = await pool.query('SELECT provider,external_username,external_email,config,updated_at FROM managed_external_accounts WHERE cloud_user_id=$1 ORDER BY provider', [req.auth!.id]);
+  res.json(result.rows);
+});
+
+app.put('/users/:id/external-accounts/:provider', ...allow('manager', 'admin'), async (req: AuthedRequest, res) => {
+  const reason = requireReason(req, res); if (!reason) return;
+  const userId = ensureUuid(routeParam(req.params.id), 'User ID');
+  const provider = providerName(routeParam(req.params.provider));
+  if (!['npm','jenkins-dev','jenkins-prod'].includes(provider)) { res.status(400).json({ error: 'Managed external provider must be npm, jenkins-dev, or jenkins-prod.' }); return; }
+  const target = await pool.query('SELECT id,email,role,is_active FROM users WHERE id=$1', [userId]);
+  if (!target.rowCount || !target.rows[0].is_active) { res.status(404).json({ error: 'User not found' }); return; }
+  if (req.auth!.role === 'manager' && target.rows[0].role !== 'user') { res.status(403).json({ error: 'Managers may manage external identities only for normal users.' }); return; }
+  const externalUsername = String(req.body?.externalUsername || '').trim();
+  const externalEmail = req.body?.externalEmail ? String(req.body.externalEmail).trim() : null;
+  if (!externalUsername) { res.status(400).json({ error: 'externalUsername is required.' }); return; }
+  const result = await pool.query(
+    `INSERT INTO managed_external_accounts(cloud_user_id,provider,external_username,external_email,managed_by_user_id,config)
+     VALUES($1,$2,$3,$4,$5,$6)
+     ON CONFLICT(cloud_user_id,provider) DO UPDATE SET external_username=excluded.external_username,external_email=excluded.external_email,managed_by_user_id=excluded.managed_by_user_id,config=excluded.config,updated_at=now()
+     RETURNING id,cloud_user_id,provider,external_username,external_email,managed_by_user_id,config,updated_at`,
+    [userId, provider, externalUsername, externalEmail, req.auth!.id, req.body?.config || {}]
+  );
+  await audit(req.auth!.id, 'user.external-account.upsert', 'user', userId, reason, { provider, externalUsername, externalEmail });
+  res.json(result.rows[0]);
+});
+
+app.delete('/users/:id/external-accounts/:provider', ...allow('manager', 'admin'), async (req: AuthedRequest, res) => {
+  const reason = requireReason(req, res); if (!reason) return;
+  const userId = ensureUuid(routeParam(req.params.id), 'User ID');
+  const provider = providerName(routeParam(req.params.provider));
+  const target = await pool.query('SELECT role FROM users WHERE id=$1', [userId]);
+  if (!target.rowCount) { res.status(404).json({ error: 'User not found' }); return; }
+  if (req.auth!.role === 'manager' && target.rows[0].role !== 'user') { res.status(403).json({ error: 'Managers may manage external identities only for normal users.' }); return; }
+  await pool.query('DELETE FROM managed_external_accounts WHERE cloud_user_id=$1 AND provider=$2', [userId, provider]);
+  await pool.query('DELETE FROM user_integrations WHERE user_id=$1 AND provider=$2', [userId, provider]);
+  await audit(req.auth!.id, 'user.external-account.delete', 'user', userId, reason, { provider });
+  res.status(204).end();
+});
+
+app.put('/me/integrations/:provider', auth, async (req: AuthedRequest, res) => {
+  const reason = requireReason(req, res); if (!reason) return;
+  let provider: string;
+  try { provider = providerName(routeParam(req.params.provider)); }
+  catch { res.status(400).json({ error: 'Invalid provider name' }); return; }
+  const secret = req.body.secret ? encrypt(JSON.stringify(req.body.secret)) : null;
+  const result = await pool.query(
+    `INSERT INTO user_integrations(user_id,provider,config,encrypted_secret)
+     VALUES($1,$2,$3,$4)
+     ON CONFLICT(user_id,provider) DO UPDATE SET
+       config=excluded.config,
+       encrypted_secret=COALESCE(excluded.encrypted_secret,user_integrations.encrypted_secret),
+       updated_at=now()
+     RETURNING id,provider,config,(encrypted_secret IS NOT NULL) has_secret,updated_at`,
+    [req.auth!.id, provider, req.body.config || {}, secret]
+  );
+  await audit(req.auth!.id, 'user.integration.upsert', 'user-integration', result.rows[0].id, reason, { provider, hasSecret: !!secret });
+  res.json(result.rows[0]);
+});
+
+app.post('/me/integrations/:provider/resolve', auth, async (req: AuthedRequest, res) => {
+  const reason = requireReason(req, res); if (!reason) return;
+  const projectId = req.body.projectId ? String(req.body.projectId) : '';
+  if (projectId && !(await hasProjectAccess(projectId, req.auth!))) {
+    res.status(404).json({ error: 'Project not found or access denied' }); return;
+  }
+  let provider: string;
+  try { provider = providerName(routeParam(req.params.provider)); }
+  catch { res.status(400).json({ error: 'Invalid provider name' }); return; }
+  const result = await pool.query(
+    'SELECT id,config,encrypted_secret FROM user_integrations WHERE user_id=$1 AND provider=$2',
+    [req.auth!.id, provider]
+  );
+  if (!result.rowCount) { res.status(404).json({ error: `Provider ${provider} is not configured for the current user` }); return; }
+  const encrypted = result.rows[0].encrypted_secret;
+  const secret = encrypted ? JSON.parse(decrypt(encrypted)) : null;
+  await audit(req.auth!.id, 'user.integration.resolve', projectId ? 'project' : 'user-integration', projectId || result.rows[0].id, reason, { provider });
+  res.setHeader('Cache-Control', 'no-store');
+  res.setHeader('Pragma', 'no-cache');
+  res.json({ config: result.rows[0].config || {}, secret });
+});
+
+app.get('/projects/:projectId/resources', auth, async (req: AuthedRequest, res) => {
+  const projectId = routeParam(req.params.projectId);
+  if (!(await hasProjectAccess(projectId, req.auth!))) { res.status(404).json({ error: 'Project not found or access denied' }); return; }
+  const env = typeof req.query.environment === 'string' ? req.query.environment : undefined;
+  const params: unknown[] = [projectId];
+  let where = 'pr.project_id=$1';
+  if (env) { params.push(environmentName(env)); where += ` AND pr.environment=$${params.length}`; }
+  const result = await pool.query(
+    `SELECT pr.id,pr.project_id,pr.environment,pr.environment_id,pr.resource_type,pr.provider,pr.provider_user_id,pr.external_id,pr.config,pr.created_by,pr.created_at,pr.updated_at
+       FROM project_resources pr WHERE ${where} ORDER BY pr.environment,pr.resource_type`,
+    params
+  );
+  res.json(result.rows);
+});
+
+app.get('/projects/:projectId/resources/:type', auth, async (req: AuthedRequest, res) => {
+  const projectId = routeParam(req.params.projectId);
+  if (!(await hasProjectAccess(projectId, req.auth!))) { res.status(404).json({ error: 'Project not found or access denied' }); return; }
+  let type: string;
+  try { type = resourceType(routeParam(req.params.type)); }
+  catch { res.status(400).json({ error: 'Invalid resource type' }); return; }
+  const environment = environmentName(req.query.environment || 'dev');
+  const result = await pool.query(
+    'SELECT id,project_id,environment,environment_id,resource_type,provider,provider_user_id,external_id,config,created_by,created_at,updated_at FROM project_resources WHERE project_id=$1 AND environment=$2 AND resource_type=$3',
+    [projectId, environment, type]
+  );
+  if (!result.rowCount) { res.status(404).json({ error: 'Project resource not configured' }); return; }
+  if (!(await hasProjectResourceAccess(result.rows[0].id, req.auth!))) { res.status(404).json({ error: 'Project resource not configured or access denied' }); return; }
+  res.json(result.rows[0]);
+});
+
+app.put('/projects/:projectId/resources/:type', auth, async (req: AuthedRequest, res) => {
+  const projectId = routeParam(req.params.projectId);
+  if (!(await hasProjectWriteAccess(projectId, req.auth!))) { res.status(403).json({ error: 'WRITE access is required to change project infrastructure. Ask a manager/admin to grant WRITE access.' }); return; }
+  const reason = requireReason(req, res); if (!reason) return;
+  let type: string;
+  try { type = resourceType(routeParam(req.params.type)); }
+  catch { res.status(400).json({ error: 'Invalid resource type' }); return; }
+  const provider = providerName(String(req.body.provider || type));
+  const environment = environmentName(req.body.environment || 'dev');
+  const existing = await pool.query('SELECT id FROM project_resources WHERE project_id=$1 AND environment=$2 AND resource_type=$3', [projectId, environment, type]);
+  if (existing.rowCount && !(await hasProjectResourceAccess(existing.rows[0].id, req.auth!, true))) {
+    res.status(403).json({ error: 'You are not allowed to update this project resource. Ask a manager/admin to grant access.' }); return;
+  }
+  const externalId = req.body.externalId ? String(req.body.externalId) : null;
+  const fullImage = provider === 'ghcr' && req.body?.config?.fullImage ? String(req.body.config.fullImage).trim().toLowerCase() : '';
+  if (fullImage) {
+    const claimed = await pool.query(`SELECT project_id FROM project_resources WHERE provider='ghcr' AND lower(config->>'fullImage')=$1 AND NOT (project_id=$2 AND environment=$3 AND resource_type=$4) LIMIT 1`, [fullImage, projectId, environment, type]);
+    if (claimed.rowCount) { res.status(409).json({ error: `GHCR image ${fullImage} is already associated with another IndraQ project. Choose a unique image name.` }); return; }
+  }
+  const result = await pool.query(
+    `INSERT INTO project_resources(project_id,environment,environment_id,resource_type,provider,provider_user_id,external_id,config,created_by,updated_by)
+     VALUES($1,$2,$8,$3,$4,$5,$6,$7,$5,$5)
+     ON CONFLICT(project_id,environment,resource_type) DO UPDATE SET
+       provider=excluded.provider,
+       environment_id=excluded.environment_id,
+       provider_user_id=excluded.provider_user_id,
+       external_id=excluded.external_id,
+       config=excluded.config,
+       updated_by=excluded.updated_by,
+       updated_at=now()
+     RETURNING id,project_id,environment,resource_type,provider,provider_user_id,external_id,config,created_by,created_at,updated_at`,
+    [projectId, environment, type, provider, req.auth!.id, externalId, req.body.config || {}, req.body.environmentId || req.body.config?.environmentId || null]
+  );
+  await pool.query(`INSERT INTO project_resource_grants(project_resource_id,user_id,permission,created_by)
+      VALUES($1,$2,'manage',$2)
+      ON CONFLICT(project_resource_id,user_id) DO UPDATE SET permission='manage'`, [result.rows[0].id, req.auth!.id]);
+  await audit(req.auth!.id, 'project.resource.upsert', 'project-resource', result.rows[0].id, reason, { projectId, type, provider, environment, externalId });
+  res.json(result.rows[0]);
+});
+
+app.get('/users/:id/resource-grants', ...allow('manager', 'admin'), async (req: AuthedRequest, res) => {
+  const userId = routeParam(req.params.id);
+  const target = await pool.query('SELECT id,email,role,is_active FROM users WHERE id=$1', [userId]);
+  if (!target.rowCount) { res.status(404).json({ error: 'User not found' }); return; }
+  if (req.auth!.role === 'manager' && target.rows[0].role !== 'user') { res.status(403).json({ error: 'Managers may inspect grants only for normal users.' }); return; }
+  const result = await pool.query(`SELECT g.id,g.project_resource_id,g.user_id,g.permission,g.created_at,
+      pr.project_id,p.name AS project_name,pr.resource_type,pr.provider,pr.environment,pr.external_id,pr.config
+      FROM project_resource_grants g
+      JOIN project_resources pr ON pr.id=g.project_resource_id
+      JOIN projects p ON p.id=pr.project_id
+      WHERE g.user_id=$1
+      ORDER BY p.name,pr.provider,pr.resource_type`, [userId]);
+  res.json(result.rows);
+});
+
+app.get('/projects/:projectId/resource-grants', ...allow('manager', 'admin'), async (req: AuthedRequest, res) => {
+  const projectId = routeParam(req.params.projectId);
+  const userId = typeof req.query.userId === 'string' ? req.query.userId : undefined;
+  const result = await pool.query(`SELECT g.id,g.project_resource_id,g.user_id,g.permission,g.created_at,
+      u.email,u.name,pr.resource_type,pr.provider,pr.environment,pr.external_id,pr.config
+      FROM project_resource_grants g
+      JOIN project_resources pr ON pr.id=g.project_resource_id
+      JOIN users u ON u.id=g.user_id
+      WHERE pr.project_id=$1 ${userId ? 'AND g.user_id=$2' : ''}
+      ORDER BY u.email,pr.provider,pr.resource_type`, userId ? [projectId, userId] : [projectId]);
+  res.json(result.rows);
+});
+
+app.post('/projects/:projectId/resources/:resourceId/grants', ...allow('manager', 'admin'), async (req: AuthedRequest, res) => {
+  const reason = requireReason(req, res); if (!reason) return;
+  const projectId = routeParam(req.params.projectId);
+  const resourceId = routeParam(req.params.resourceId);
+  const userId = String(req.body?.userId || '');
+  const permission = req.body?.permission === 'view' ? 'view' : 'manage';
+  const resource = await pool.query('SELECT id,provider,resource_type,external_id,config FROM project_resources WHERE id=$1 AND project_id=$2', [resourceId, projectId]);
+  if (!resource.rowCount) { res.status(404).json({ error: 'Project resource not found' }); return; }
+  const target = await pool.query('SELECT id,email,role,is_active FROM users WHERE id=$1', [userId]);
+  if (!target.rowCount || !target.rows[0].is_active) { res.status(404).json({ error: 'User not found' }); return; }
+  if (req.auth!.role === 'manager' && target.rows[0].role !== 'user') { res.status(403).json({ error: 'Managers may grant resources only to normal users.' }); return; }
+  await pool.query(`INSERT INTO project_resource_grants(project_resource_id,user_id,permission,created_by)
+      VALUES($1,$2,$3,$4)
+      ON CONFLICT(project_resource_id,user_id) DO UPDATE SET permission=excluded.permission,created_by=excluded.created_by,created_at=now()`, [resourceId, userId, permission, req.auth!.id]);
+  await audit(req.auth!.id, 'project.resource.grant', 'project-resource', resourceId, reason, { projectId, userId, email: target.rows[0].email, permission, provider: resource.rows[0].provider });
+  res.status(201).json({ resourceId, userId, permission, resource: resource.rows[0] });
+});
+
+app.delete('/projects/:projectId/resources/:resourceId/grants/:userId', ...allow('manager', 'admin'), async (req: AuthedRequest, res) => {
+  const reason = requireReason(req, res); if (!reason) return;
+  const projectId = routeParam(req.params.projectId);
+  const resourceId = routeParam(req.params.resourceId);
+  const userId = routeParam(req.params.userId);
+  const target = await pool.query('SELECT email,role FROM users WHERE id=$1', [userId]);
+  if (req.auth!.role === 'manager' && target.rows[0]?.role && target.rows[0].role !== 'user') { res.status(403).json({ error: 'Managers may revoke resources only from normal users.' }); return; }
+  const result = await pool.query(`DELETE FROM project_resource_grants g
+      USING project_resources pr
+      WHERE g.project_resource_id=pr.id AND pr.project_id=$1 AND g.project_resource_id=$2 AND g.user_id=$3
+      RETURNING g.id`, [projectId, resourceId, userId]);
+  if (!result.rowCount) { res.status(404).json({ error: 'Resource grant not found' }); return; }
+  await audit(req.auth!.id, 'project.resource.revoke', 'project-resource', resourceId, reason, { projectId, userId, email: target.rows[0]?.email });
+  res.status(204).end();
+});
+
+// Legacy v1.6 project-level provider credential endpoints are retained so old clients do not break.
+app.put('/projects/:projectId/integrations/:provider', auth, async (req: AuthedRequest, res) => {
+  const projectId = routeParam(req.params.projectId);
+  if (!(await hasProjectAccess(projectId, req.auth!))) { res.status(404).json({ error: 'Project not found or access denied' }); return; }
+  const reason = requireReason(req, res); if (!reason) return;
+  let provider: string;
+  try { provider = providerName(routeParam(req.params.provider)); }
+  catch { res.status(400).json({ error: 'Invalid provider name' }); return; }
+  const secret = req.body.secret ? encrypt(JSON.stringify(req.body.secret)) : null;
+  const result = await pool.query(
+    `INSERT INTO project_integrations(project_id,provider,config,encrypted_secret) VALUES($1,$2,$3,$4)
+     ON CONFLICT(project_id,provider) DO UPDATE SET config=excluded.config, encrypted_secret=COALESCE(excluded.encrypted_secret,project_integrations.encrypted_secret)
+     RETURNING id,project_id,provider,config,(encrypted_secret IS NOT NULL) has_secret`,
+    [projectId, provider, req.body.config || {}, secret]
+  );
+  await audit(req.auth!.id, 'integration.upsert.legacy', 'project', projectId, reason, { provider, hasSecret: !!secret });
+  res.json(result.rows[0]);
+});
+
+app.get('/projects/:projectId/integrations', auth, async (req: AuthedRequest, res) => {
+  const projectId = routeParam(req.params.projectId);
+  if (!(await hasProjectAccess(projectId, req.auth!))) { res.status(404).json({ error: 'Project not found or access denied' }); return; }
+  const result = await pool.query(
+    'SELECT id,project_id,provider,config,(encrypted_secret IS NOT NULL) has_secret FROM project_integrations WHERE project_id=$1 ORDER BY provider',
+    [projectId]
+  );
+  res.json(result.rows);
+});
+
+app.post('/projects/:projectId/integrations/:provider/resolve', auth, async (req: AuthedRequest, res) => {
+  const projectId = routeParam(req.params.projectId);
+  if (!(await hasProjectAccess(projectId, req.auth!))) { res.status(404).json({ error: 'Project not found or access denied' }); return; }
+  const reason = requireReason(req, res); if (!reason) return;
+  let provider: string;
+  try { provider = providerName(routeParam(req.params.provider)); }
+  catch { res.status(400).json({ error: 'Invalid provider name' }); return; }
+  const result = await pool.query('SELECT config,encrypted_secret FROM project_integrations WHERE project_id=$1 AND provider=$2', [projectId, provider]);
+  if (!result.rowCount) { res.status(404).json({ error: 'Provider integration not found' }); return; }
+  const encrypted = result.rows[0].encrypted_secret;
+  const secret = encrypted ? JSON.parse(decrypt(encrypted)) : null;
+  await audit(req.auth!.id, 'integration.secret.resolve.legacy', 'project', projectId, reason, { provider });
+  res.setHeader('Cache-Control', 'no-store');
+  res.json({ config: result.rows[0].config || {}, secret });
+});
+
+app.post('/audit', auth, async (req: AuthedRequest, res) => {
+  const reason = requireReason(req, res); if (!reason) return;
+  const { action, resourceType, resourceId, metadata = {} } = req.body || {};
+  if (!action || !resourceType) { res.status(400).json({ error: 'action and resourceType are required' }); return; }
+  await audit(req.auth!.id, String(action), String(resourceType), resourceId ? String(resourceId) : undefined, reason, metadata);
+  res.status(201).json({ ok: true });
+});
+
+app.get('/logs', ...allow('manager', 'admin'), async (req, res) => {
+  const { search, limit } = listQuery(req);
+  res.json((await pool.query(
+    `SELECT l.*,u.email actor_email
+       FROM audit_logs l LEFT JOIN users u ON u.id=l.actor_id
+      WHERE ($1='' OR coalesce(u.email,'') ILIKE '%'||$1||'%' OR l.action ILIKE '%'||$1||'%' OR l.resource_type ILIKE '%'||$1||'%' OR coalesce(l.resource_id,'') ILIKE '%'||$1||'%' OR coalesce(l.reason,'') ILIKE '%'||$1||'%')
+      ORDER BY l.created_at DESC LIMIT $2`, [search, limit]
+  )).rows);
+});
+
+app.use((err: unknown, _req: Request, res: Response, _next: NextFunction) => {
+  console.error(err);
+  const error = err as { code?: string; message?: string; statusCode?: number };
+  if (error.statusCode) { res.status(error.statusCode).json({ error: error.message || 'Request failed' }); return; }
+  if (error.code === '22P02') { res.status(400).json({ error: 'Invalid identifier. If this came from .indraq/project.json, run `indraq project link` to repair the local project reference.' }); return; }
+  if (error.code === '23505') { res.status(409).json({ error: 'Resource already exists' }); return; }
+  res.status(500).json({ error: 'Internal server error' });
+});
+
+const bootstrap = async (): Promise<void> => {
+  const email = process.env.BOOTSTRAP_ADMIN_EMAIL;
+  const password = process.env.BOOTSTRAP_ADMIN_PASSWORD;
+  if (!email || !password) return;
+  const result = await pool.query('SELECT 1 FROM users WHERE role=$1 LIMIT 1', ['admin']);
+  if (!result.rowCount) {
+    if (password.length < 12) throw new Error('BOOTSTRAP_ADMIN_PASSWORD must be at least 12 characters.');
+    await pool.query(
+      'INSERT INTO users(email,name,password_hash,role) VALUES(lower($1),$2,$3,$4)',
+      [email, 'IndraQ Admin', await bcrypt.hash(password, 12), 'admin']
+    );
+    console.log('Bootstrap admin created.');
+  }
+};
+
+await runMigrations();
+await bootstrap();
+app.listen(Number(process.env.PORT || 4010), () => console.log(`IndraQ Cloud API listening on ${process.env.PORT || 4010}`));