Add package dependencies and project settings page

Package Dependencies: - Add artifact dependency management system - Add dependency API endpoints (get, resolve, reverse) - Add ensure file parsing for declaring dependencies - Add circular dependency and conflict detection - Add frontend dependency visualization with graph modal - Add migration for artifact_dependencies table Project Settings Page (#65): - Add dedicated settings page for project admins - General settings section (description, visibility) - Access management section (moved from project page) - Danger zone with inline delete confirmation - Add Settings button to project page header
Merge branch 'fix/reset-stage-before-tests' into 'main'
2026-01-27 15:29:51 +00:00 · 2026-01-26 09:13:04 -06:00 · 2026-01-26 09:13:03 -06:00 · 2026-01-23 15:37:09 -07:00 · 2026-01-23 15:37:09 -07:00 · 2026-01-23 16:16:03 -06:00
27 changed files with 5091 additions and 93 deletions
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -36,9 +36,68 @@ stages:
  - analyze
  - deploy

+# Override Prosper template jobs to exclude tag pipelines
+# Tags only run deploy_prod and smoke_test_prod (image already built on main)
+build_image:
+  rules:
+    - if: '$CI_COMMIT_TAG'
+      when: never
+    - when: on_success
+
+test_image:
+  rules:
+    - if: '$CI_COMMIT_TAG'
+      when: never
+    - when: on_success
+
+hadolint:
+  rules:
+    - if: '$CI_COMMIT_TAG'
+      when: never
+    - when: on_success
+
 kics:
  variables:
    KICS_CONFIG: kics.config
+  rules:
+    - if: '$CI_COMMIT_TAG'
+      when: never
+    - when: on_success
+
+secrets:
+  rules:
+    - if: '$CI_COMMIT_TAG'
+      when: never
+    - when: on_success
+
+app_deps_scan:
+  rules:
+    - if: '$CI_COMMIT_TAG'
+      when: never
+    - when: on_success
+
+cve_scan:
+  rules:
+    - if: '$CI_COMMIT_TAG'
+      when: never
+    - when: on_success
+
+app_sbom_analysis:
+  rules:
+    - if: '$CI_COMMIT_TAG'
+      when: never
+    - when: on_success
+
+cve_sbom_analysis:
+  rules:
+    - if: '$CI_COMMIT_TAG'
+      when: never
+    - when: on_success
+
+# Override release job to wait for stage integration tests before creating tag
+# This ensures the tag (which triggers prod deploy) is only created after stage passes
+release:
+  needs: [integration_test_stage, changelog]

 # Full integration test suite template (for feature/stage deployments)
 # Runs the complete pytest integration test suite against the deployed environment
@@ -138,22 +197,13 @@ kics:
      PYTEST_SCRIPT

 # Integration tests for stage deployment (full suite)
-integration_test_stage:
-  <<: *integration_test_template
-  needs: [deploy_stage]
-  variables:
-    ORCHARD_TEST_URL: $STAGE_URL
-  rules:
-    - if: '$CI_COMMIT_BRANCH == "main"'
-      when: on_success
-
-# Reset stage environment after integration tests (clean slate for next run)
+# Reset stage template - shared by pre and post test reset jobs
 # Calls the /api/v1/admin/factory-reset endpoint which handles DB and S3 cleanup
-reset_stage:
+.reset_stage_template: &reset_stage_template
  stage: deploy
-  needs: [integration_test_stage]
  image: deps.global.bsf.tools/docker/python:3.12-slim
  timeout: 5m
+  retry: 1  # Retry once on transient failures
  before_script:
    - pip install --index-url "$PIP_INDEX_URL" httpx
  script:
@@ -161,48 +211,89 @@ reset_stage:
      python - <<'RESET_SCRIPT'
      import httpx
      import sys
+      import os
+      import time

-      BASE_URL = "${STAGE_URL}"
+      BASE_URL = os.environ.get("STAGE_URL", "")
      ADMIN_USER = "admin"
      ADMIN_PASS = "changeme123"  # Default admin password
+      MAX_RETRIES = 3
+      RETRY_DELAY = 5  # seconds
+
+      if not BASE_URL:
+          print("ERROR: STAGE_URL environment variable not set")
+          sys.exit(1)

      print(f"=== Resetting stage environment at {BASE_URL} ===")

-      client = httpx.Client(base_url=BASE_URL, timeout=60.0)
+      def do_reset():
+          with httpx.Client(base_url=BASE_URL, timeout=120.0) as client:
+              # Login as admin
+              print("Logging in as admin...")
+              login_response = client.post(
+                  "/api/v1/auth/login",
+                  json={"username": ADMIN_USER, "password": ADMIN_PASS},
+              )
+              if login_response.status_code != 200:
+                  raise Exception(f"Login failed: {login_response.status_code} - {login_response.text}")
+              print("Login successful")

-      # Login as admin
-      print("Logging in as admin...")
-      login_response = client.post(
-          "/api/v1/auth/login",
-          json={"username": ADMIN_USER, "password": ADMIN_PASS},
-      )
-      if login_response.status_code != 200:
-          print(f"Login failed: {login_response.status_code} - {login_response.text}")
-          sys.exit(1)
-      print("Login successful")
+              # Call factory reset endpoint
+              print("Calling factory reset endpoint...")
+              reset_response = client.post(
+                  "/api/v1/admin/factory-reset",
+                  headers={"X-Confirm-Reset": "yes-delete-all-data"},
+              )

-      # Call factory reset endpoint
-      print("Calling factory reset endpoint...")
-      reset_response = client.post(
-          "/api/v1/admin/factory-reset",
-          headers={"X-Confirm-Reset": "yes-delete-all-data"},
-      )
+              if reset_response.status_code == 200:
+                  result = reset_response.json()
+                  print("Factory reset successful!")
+                  print(f"  Database tables dropped: {result['results']['database_tables_dropped']}")
+                  print(f"  S3 objects deleted: {result['results']['s3_objects_deleted']}")
+                  print(f"  Database reinitialized: {result['results']['database_reinitialized']}")
+                  print(f"  Seeded: {result['results']['seeded']}")
+                  return True
+              else:
+                  raise Exception(f"Factory reset failed: {reset_response.status_code} - {reset_response.text}")

-      if reset_response.status_code == 200:
-          result = reset_response.json()
-          print(f"Factory reset successful!")
-          print(f"  Database tables dropped: {result['results']['database_tables_dropped']}")
-          print(f"  S3 objects deleted: {result['results']['s3_objects_deleted']}")
-          print(f"  Database reinitialized: {result['results']['database_reinitialized']}")
-          print(f"  Seeded: {result['results']['seeded']}")
-          sys.exit(0)
-      else:
-          print(f"Factory reset failed: {reset_response.status_code} - {reset_response.text}")
-          sys.exit(1)
+      # Retry loop
+      for attempt in range(1, MAX_RETRIES + 1):
+          try:
+              print(f"Attempt {attempt}/{MAX_RETRIES}")
+              if do_reset():
+                  sys.exit(0)
+          except Exception as e:
+              print(f"Attempt {attempt} failed: {e}")
+              if attempt < MAX_RETRIES:
+                  print(f"Retrying in {RETRY_DELAY} seconds...")
+                  time.sleep(RETRY_DELAY)
+              else:
+                  print("All retry attempts failed")
+                  sys.exit(1)
      RESET_SCRIPT
  rules:
    - if: '$CI_COMMIT_BRANCH == "main"'
      when: on_success
+
+# Reset stage BEFORE integration tests (ensure known state)
+reset_stage_pre:
+  <<: *reset_stage_template
+  needs: [deploy_stage]
+
+# Integration tests for stage deployment (full suite)
+integration_test_stage:
+  <<: *integration_test_template
+  needs: [reset_stage_pre]
+  variables:
+    ORCHARD_TEST_URL: $STAGE_URL
+  rules:
+    - if: '$CI_COMMIT_BRANCH == "main"'
+      when: on_success
+
+# Reset stage AFTER integration tests (clean slate for next run)
+reset_stage:
+  <<: *reset_stage_template
+  needs: [integration_test_stage]
  allow_failure: true  # Don't fail pipeline if reset has issues

 # Integration tests for feature deployment (full suite)
@@ -247,6 +338,10 @@ python_unit_tests:
        coverage_format: cobertura
        path: backend/coverage.xml
  coverage: '/TOTAL.*\s+(\d+%)/'
+  rules:
+    - if: '$CI_COMMIT_TAG'
+      when: never
+    - when: on_success

 # Run frontend tests
 frontend_tests:
@@ -276,6 +371,10 @@ frontend_tests:
        coverage_format: cobertura
        path: frontend/coverage/cobertura-coverage.xml
  coverage: '/All files[^|]*\|[^|]*\s+([\d\.]+)/'
+  rules:
+    - if: '$CI_COMMIT_TAG'
+      when: never
+    - when: on_success

 # Shared deploy configuration
 .deploy_template: &deploy_template
@@ -403,12 +502,11 @@ cleanup_feature:
 # Deploy to production (version tags only)
 deploy_prod:
  stage: deploy
-  # For tag pipelines, most jobs don't run (trusting main was tested)
-  # We only need build_image to have the image available
-  needs: [build_image]
+  # For tag pipelines, no other jobs run - image was already built when commit was on main
+  needs: []
  image: deps.global.bsf.tools/registry-1.docker.io/alpine/k8s:1.29.12
  variables:
-    NAMESPACE: orch-prod-namespace
+    NAMESPACE: orch-namespace
    VALUES_FILE: helm/orchard/values-prod.yaml
    BASE_URL: $PROD_URL
  before_script:
--- a/.gitleaks.toml
+++ b/.gitleaks.toml
@@ -0,0 +1,8 @@
+# Gitleaks configuration
+# https://github.com/gitleaks/gitleaks#configuration
+
+[allowlist]
+# Test files that contain variable names matching secret patterns (e.g., s3_key)
+paths = [
+  '''backend/tests/.*\.py''',
+]
--- a/.gitleaksignore
+++ b/.gitleaksignore
@@ -4,6 +4,7 @@
 # False positive: s3_key is an attribute name in test assertions, not a secret
 # These are historical commits - files have since been deleted or updated with inline comments
 7e68baed0886a3c928644cd01aa3b39f92d4f976:backend/tests/test_duplicate_detection.py:generic-api-key:154
+81458b3bcb5ace97109ba4c16f4afa6e55b1b8bd:backend/tests/test_duplicate_detection.py:generic-api-key:154
 2f1891cf0126ec0e7d4c789d872a2cb2dd3a1745:backend/tests/unit/test_storage.py:generic-api-key:381
 10d36947948de796f0bacea3827f4531529c405d:backend/tests/unit/test_storage.py:generic-api-key:381
 bccbc71c13570d14b8b26a11335c45f102fe3072:backend/tests/unit/test_storage.py:generic-api-key:381
@@ -15,3 +16,4 @@ bccbc71c13570d14b8b26a11335c45f102fe3072:backend/tests/unit/test_storage.py:gene
 08dce6cbb836b687002751fed4159bfc2da61f8b:backend/tests/unit/test_storage.py:generic-api-key:381
 617bcbe89cff9a009d77e4f1f1864efed1820e63:backend/tests/unit/test_storage.py:generic-api-key:381
 1cbd33544388e0fe6db752fa8886fab33cf9ce7c:backend/tests/unit/test_storage.py:generic-api-key:381
+7cfad28f678f5a5b8b927d694a17b9ba446b7138:backend/tests/unit/test_storage.py:generic-api-key:381
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,54 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

 ## [Unreleased]
 ### Added
+- Added Project Settings page accessible to project admins (#65)
+  - General settings section for editing description and visibility
+  - Access Management section (moved from project page)
+  - Danger Zone section with inline delete confirmation requiring project name
+  - Settings button (gear icon) on project page header for admins
+- Added artifact dependency management system (#76, #77, #78, #79, #80, #81)
+  - `artifact_dependencies` table with version/tag constraints and check constraints
+  - `ArtifactDependency` SQLAlchemy model with indexes for fast lookups
+  - Ensure file parsing (`orchard.ensure` YAML format) during artifact upload
+  - Circular dependency detection at upload time (rejected with 400)
+  - Dependency conflict detection at resolution time (409 with conflict details)
+- Added dependency API endpoints (#78, #79):
+  - `GET /api/v1/artifact/{artifact_id}/dependencies` - Get dependencies by artifact ID
+  - `GET /api/v1/project/{project}/{package}/+/{ref}/dependencies` - Get dependencies by ref
+  - `GET /api/v1/project/{project}/{package}/reverse-dependencies` - Get reverse dependencies (paginated)
+  - `GET /api/v1/project/{project}/{package}/+/{ref}/resolve` - Resolve full dependency tree
+- Added dependency resolution with topological sorting (#79)
+  - Returns flat list of all artifacts needed in dependency order
+  - Includes download URLs, sizes, and version info for each artifact
+- Added frontend dependency visualization (#84, #85, #86):
+  - Dependencies section on package page showing direct dependencies for selected tag
+  - Tag/version selector to switch between artifacts
+  - "Used By" section showing reverse dependencies with pagination
+  - Interactive dependency graph modal with:
+    - Tree visualization with collapsible nodes
+    - Zoom (mouse wheel + buttons) and pan (click-drag)
+    - Click to navigate to package
+    - Hover tooltip with package details
+    - Error display for circular dependencies and conflicts
+- Added migration `008_artifact_dependencies.sql` for dependency schema
+- Added `dependencies.py` module with parsing, validation, and resolution logic
+- Added comprehensive integration tests for all dependency features
+
+### Changed
+- Added pre-test stage reset to ensure known environment state before integration tests (#54)
+- Upload endpoint now accepts optional `ensure` file parameter for declaring dependencies
+- Updated upload API documentation with ensure file format and examples
+
+## [0.5.1] - 2026-01-23
+### Changed
+- Simplified tag pipeline to only run deploy and smoke tests (image already built on main) (#54)
+
+### Fixed
+- Fixed production CI deployment namespace to use correct `orch-namespace` (#54)
+- Added gitleaks config to allowlist test files from secret scanning (#54)
+
+## [0.5.0] - 2026-01-23
+### Added
 - Added factory reset endpoint `POST /api/v1/admin/factory-reset` for test environment cleanup (#54)
  - Requires admin authentication and `X-Confirm-Reset: yes-delete-all-data` header
  - Drops all database tables, clears S3 bucket, reinitializes schema, re-seeds default data
@@ -15,20 +63,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Added AWS Secrets Manager CSI driver support for database credentials (#54)
 - Added SecretProviderClass template for Secrets Manager integration (#54)
 - Added IRSA service account annotations for prod and stage environments (#54)
-
-### Changed
- Configured stage and prod to use AWS RDS instead of PostgreSQL subchart (#54)
- Configured stage and prod to use AWS S3 instead of MinIO subchart (#54)
- Changed prod deployment from manual to automatic on version tags (#54)
- Updated S3 client to support IRSA credentials when no explicit keys provided (#54)
- Changed prod image pullPolicy to Always (#54)
- Added proxy-body-size annotation to prod ingress for large uploads (#54)
-
-### Removed
- Disabled PostgreSQL subchart for stage and prod environments (#54)
- Disabled MinIO subchart for stage and prod environments (#54)
-
-### Added
 - Added comprehensive upload/download tests for size boundaries (1B to 1GB) (#38)
 - Added concurrent upload/download tests (2, 5, 10 parallel operations) (#38)
 - Added data integrity tests (binary, text, unicode, compressed content) (#38)
@@ -83,6 +117,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Added internal proxy configuration for npm, pip, helm, and apt (#51)

 ### Changed
+- Configured stage and prod to use AWS RDS instead of PostgreSQL subchart (#54)
+- Configured stage and prod to use AWS S3 instead of MinIO subchart (#54)
+- Changed prod deployment from manual to automatic on version tags (#54)
+- Updated S3 client to support IRSA credentials when no explicit keys provided (#54)
+- Changed prod image pullPolicy to Always (#54)
+- Added proxy-body-size annotation to prod ingress for large uploads (#54)
 - CI integration tests now run full pytest suite (~350 tests) against deployed environment instead of 3 smoke tests
 - CI production deployment uses lightweight smoke tests only (no test data creation in prod)
 - CI pipeline improvements: shared pip cache, `interruptible` flag on test jobs, retry on integration tests
@@ -103,6 +143,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Improved pod naming: Orchard pods now named `orchard-{env}-server-*` for clarity (#51)

 ### Fixed
+- Fixed factory reset not creating default admin user after reset (#60)
+- Admin user was only created at server startup, not after factory reset
+- CI reset job would fail to login because admin user didn't exist
+- Improved reset_stage CI job reliability (#60)
+- Added application-level retry logic (3 attempts with 5s delay)
+- Added job-level retry for transient failures
+- Fixed httpx client to use proper context manager
+- Increased timeout to 120s for reset operations
 - Fixed CI integration test rate limiting: added configurable `ORCHARD_LOGIN_RATE_LIMIT` env var, relaxed to 1000/minute for dev/stage
 - Fixed duplicate `TestSecurityEdgeCases` class definition in test_auth_api.py
 - Fixed integration tests auth: session-scoped client, configurable credentials via env vars, fail-fast on auth errors
@@ -123,6 +171,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

 ### Removed
 - Removed unused `store_streaming()` method from storage.py (#51)
+- Disabled PostgreSQL subchart for stage and prod environments (#54)
+- Disabled MinIO subchart for stage and prod environments (#54)

 ## [0.4.0] - 2026-01-12
 ### Added
--- a/backend/app/dependencies.py
+++ b/backend/app/dependencies.py
@@ -0,0 +1,723 @@
+"""
+Dependency management module for artifact dependencies.
+
+Handles:
+- Parsing orchard.ensure files
+- Storing dependencies in the database
+- Querying dependencies and reverse dependencies
+- Dependency resolution with topological sorting
+- Circular dependency detection
+- Conflict detection
+"""
+
+import yaml
+from typing import List, Dict, Any, Optional, Set, Tuple
+from sqlalchemy.orm import Session
+from sqlalchemy import and_
+
+from .models import (
+    Project,
+    Package,
+    Artifact,
+    Tag,
+    ArtifactDependency,
+    PackageVersion,
+)
+from .schemas import (
+    EnsureFileContent,
+    EnsureFileDependency,
+    DependencyResponse,
+    ArtifactDependenciesResponse,
+    DependentInfo,
+    ReverseDependenciesResponse,
+    ResolvedArtifact,
+    DependencyResolutionResponse,
+    DependencyConflict,
+    PaginationMeta,
+)
+
+
+class DependencyError(Exception):
+    """Base exception for dependency errors."""
+    pass
+
+
+class CircularDependencyError(DependencyError):
+    """Raised when a circular dependency is detected."""
+    def __init__(self, cycle: List[str]):
+        self.cycle = cycle
+        super().__init__(f"Circular dependency detected: {' -> '.join(cycle)}")
+
+
+class DependencyConflictError(DependencyError):
+    """Raised when conflicting dependency versions are detected."""
+    def __init__(self, conflicts: List[DependencyConflict]):
+        self.conflicts = conflicts
+        super().__init__(f"Dependency conflicts detected: {len(conflicts)} conflict(s)")
+
+
+class DependencyNotFoundError(DependencyError):
+    """Raised when a dependency cannot be resolved."""
+    def __init__(self, project: str, package: str, constraint: str):
+        self.project = project
+        self.package = package
+        self.constraint = constraint
+        super().__init__(f"Dependency not found: {project}/{package}@{constraint}")
+
+
+class InvalidEnsureFileError(DependencyError):
+    """Raised when the ensure file is invalid."""
+    pass
+
+
+class DependencyDepthExceededError(DependencyError):
+    """Raised when dependency resolution exceeds max depth."""
+    def __init__(self, max_depth: int):
+        self.max_depth = max_depth
+        super().__init__(f"Dependency resolution exceeded maximum depth of {max_depth}")
+
+
+# Safety limits to prevent DoS attacks
+MAX_DEPENDENCY_DEPTH = 50  # Maximum levels of nested dependencies
+MAX_DEPENDENCIES_PER_ARTIFACT = 200  # Maximum direct dependencies per artifact
+
+
+def parse_ensure_file(content: bytes) -> EnsureFileContent:
+    """
+    Parse an orchard.ensure file.
+
+    Args:
+        content: Raw bytes of the ensure file
+
+    Returns:
+        Parsed EnsureFileContent
+
+    Raises:
+        InvalidEnsureFileError: If the file is invalid YAML or has wrong structure
+    """
+    try:
+        data = yaml.safe_load(content.decode('utf-8'))
+    except yaml.YAMLError as e:
+        raise InvalidEnsureFileError(f"Invalid YAML: {e}")
+    except UnicodeDecodeError as e:
+        raise InvalidEnsureFileError(f"Invalid encoding: {e}")
+
+    if data is None:
+        return EnsureFileContent(dependencies=[])
+
+    if not isinstance(data, dict):
+        raise InvalidEnsureFileError("Ensure file must be a YAML dictionary")
+
+    dependencies = []
+    deps_data = data.get('dependencies', [])
+
+    if not isinstance(deps_data, list):
+        raise InvalidEnsureFileError("'dependencies' must be a list")
+
+    # Safety limit: prevent DoS through excessive dependencies
+    if len(deps_data) > MAX_DEPENDENCIES_PER_ARTIFACT:
+        raise InvalidEnsureFileError(
+            f"Too many dependencies: {len(deps_data)} exceeds maximum of {MAX_DEPENDENCIES_PER_ARTIFACT}"
+        )
+
+    for i, dep in enumerate(deps_data):
+        if not isinstance(dep, dict):
+            raise InvalidEnsureFileError(f"Dependency {i} must be a dictionary")
+
+        project = dep.get('project')
+        package = dep.get('package')
+        version = dep.get('version')
+        tag = dep.get('tag')
+
+        if not project:
+            raise InvalidEnsureFileError(f"Dependency {i} missing 'project'")
+        if not package:
+            raise InvalidEnsureFileError(f"Dependency {i} missing 'package'")
+        if not version and not tag:
+            raise InvalidEnsureFileError(
+                f"Dependency {i} must have either 'version' or 'tag'"
+            )
+        if version and tag:
+            raise InvalidEnsureFileError(
+                f"Dependency {i} cannot have both 'version' and 'tag'"
+            )
+
+        dependencies.append(EnsureFileDependency(
+            project=project,
+            package=package,
+            version=version,
+            tag=tag,
+        ))
+
+    return EnsureFileContent(dependencies=dependencies)
+
+
+def validate_dependencies(
+    db: Session,
+    dependencies: List[EnsureFileDependency],
+) -> List[str]:
+    """
+    Validate that all dependency projects exist.
+
+    Args:
+        db: Database session
+        dependencies: List of dependencies to validate
+
+    Returns:
+        List of error messages (empty if all valid)
+    """
+    errors = []
+
+    for dep in dependencies:
+        project = db.query(Project).filter(Project.name == dep.project).first()
+        if not project:
+            errors.append(f"Project '{dep.project}' not found")
+
+    return errors
+
+
+def store_dependencies(
+    db: Session,
+    artifact_id: str,
+    dependencies: List[EnsureFileDependency],
+) -> List[ArtifactDependency]:
+    """
+    Store dependencies for an artifact.
+
+    Args:
+        db: Database session
+        artifact_id: The artifact ID that has these dependencies
+        dependencies: List of dependencies to store
+
+    Returns:
+        List of created ArtifactDependency objects
+    """
+    created = []
+
+    for dep in dependencies:
+        artifact_dep = ArtifactDependency(
+            artifact_id=artifact_id,
+            dependency_project=dep.project,
+            dependency_package=dep.package,
+            version_constraint=dep.version,
+            tag_constraint=dep.tag,
+        )
+        db.add(artifact_dep)
+        created.append(artifact_dep)
+
+    return created
+
+
+def get_artifact_dependencies(
+    db: Session,
+    artifact_id: str,
+) -> List[DependencyResponse]:
+    """
+    Get all dependencies for an artifact.
+
+    Args:
+        db: Database session
+        artifact_id: The artifact ID
+
+    Returns:
+        List of DependencyResponse objects
+    """
+    deps = db.query(ArtifactDependency).filter(
+        ArtifactDependency.artifact_id == artifact_id
+    ).all()
+
+    return [DependencyResponse.from_orm_model(dep) for dep in deps]
+
+
+def get_reverse_dependencies(
+    db: Session,
+    project_name: str,
+    package_name: str,
+    page: int = 1,
+    limit: int = 50,
+) -> ReverseDependenciesResponse:
+    """
+    Get all artifacts that depend on a given package.
+
+    Args:
+        db: Database session
+        project_name: Target project name
+        package_name: Target package name
+        page: Page number (1-indexed)
+        limit: Results per page
+
+    Returns:
+        ReverseDependenciesResponse with dependents and pagination
+    """
+    # Query dependencies that point to this project/package
+    query = db.query(ArtifactDependency).filter(
+        ArtifactDependency.dependency_project == project_name,
+        ArtifactDependency.dependency_package == package_name,
+    )
+
+    total = query.count()
+    offset = (page - 1) * limit
+    deps = query.offset(offset).limit(limit).all()
+
+    dependents = []
+    for dep in deps:
+        # Get artifact info to find the project/package/version
+        artifact = db.query(Artifact).filter(Artifact.id == dep.artifact_id).first()
+        if not artifact:
+            continue
+
+        # Find which package this artifact belongs to via tags or versions
+        tag = db.query(Tag).filter(Tag.artifact_id == dep.artifact_id).first()
+        if tag:
+            pkg = db.query(Package).filter(Package.id == tag.package_id).first()
+            if pkg:
+                proj = db.query(Project).filter(Project.id == pkg.project_id).first()
+                if proj:
+                    # Get version if available
+                    version_record = db.query(PackageVersion).filter(
+                        PackageVersion.artifact_id == dep.artifact_id,
+                        PackageVersion.package_id == pkg.id,
+                    ).first()
+
+                    dependents.append(DependentInfo(
+                        artifact_id=dep.artifact_id,
+                        project=proj.name,
+                        package=pkg.name,
+                        version=version_record.version if version_record else None,
+                        constraint_type="version" if dep.version_constraint else "tag",
+                        constraint_value=dep.version_constraint or dep.tag_constraint,
+                    ))
+
+    total_pages = (total + limit - 1) // limit
+
+    return ReverseDependenciesResponse(
+        project=project_name,
+        package=package_name,
+        dependents=dependents,
+        pagination=PaginationMeta(
+            page=page,
+            limit=limit,
+            total=total,
+            total_pages=total_pages,
+            has_more=page < total_pages,
+        ),
+    )
+
+
+def _resolve_dependency_to_artifact(
+    db: Session,
+    project_name: str,
+    package_name: str,
+    version: Optional[str],
+    tag: Optional[str],
+) -> Optional[Tuple[str, str, int]]:
+    """
+    Resolve a dependency constraint to an artifact ID.
+
+    Args:
+        db: Database session
+        project_name: Project name
+        package_name: Package name
+        version: Version constraint (exact)
+        tag: Tag constraint
+
+    Returns:
+        Tuple of (artifact_id, resolved_version_or_tag, size) or None if not found
+    """
+    # Get project and package
+    project = db.query(Project).filter(Project.name == project_name).first()
+    if not project:
+        return None
+
+    package = db.query(Package).filter(
+        Package.project_id == project.id,
+        Package.name == package_name,
+    ).first()
+    if not package:
+        return None
+
+    if version:
+        # Look up by version
+        pkg_version = db.query(PackageVersion).filter(
+            PackageVersion.package_id == package.id,
+            PackageVersion.version == version,
+        ).first()
+        if pkg_version:
+            artifact = db.query(Artifact).filter(
+                Artifact.id == pkg_version.artifact_id
+            ).first()
+            if artifact:
+                return (artifact.id, version, artifact.size)
+
+        # Also check if there's a tag with this exact name
+        tag_record = db.query(Tag).filter(
+            Tag.package_id == package.id,
+            Tag.name == version,
+        ).first()
+        if tag_record:
+            artifact = db.query(Artifact).filter(
+                Artifact.id == tag_record.artifact_id
+            ).first()
+            if artifact:
+                return (artifact.id, version, artifact.size)
+
+    if tag:
+        # Look up by tag
+        tag_record = db.query(Tag).filter(
+            Tag.package_id == package.id,
+            Tag.name == tag,
+        ).first()
+        if tag_record:
+            artifact = db.query(Artifact).filter(
+                Artifact.id == tag_record.artifact_id
+            ).first()
+            if artifact:
+                return (artifact.id, tag, artifact.size)
+
+    return None
+
+
+def _detect_package_cycle(
+    db: Session,
+    project_name: str,
+    package_name: str,
+    target_project: str,
+    target_package: str,
+    visiting: Set[str],
+    visited: Set[str],
+    path: List[str],
+) -> Optional[List[str]]:
+    """
+    Detect cycles at the package level using DFS.
+
+    Args:
+        db: Database session
+        project_name: Current project being visited
+        package_name: Current package being visited
+        target_project: The project we're checking for cycles back to
+        target_package: The package we're checking for cycles back to
+        visiting: Set of package keys currently in the recursion stack
+        visited: Set of fully processed package keys
+        path: Current path for cycle reporting
+
+    Returns:
+        Cycle path if detected, None otherwise
+    """
+    pkg_key = f"{project_name}/{package_name}"
+
+    # Check if we've reached the target package (cycle detected)
+    if project_name == target_project and package_name == target_package:
+        return path + [pkg_key]
+
+    if pkg_key in visiting:
+        # Unexpected internal cycle
+        return None
+
+    if pkg_key in visited:
+        return None
+
+    visiting.add(pkg_key)
+    path.append(pkg_key)
+
+    # Get the package and find any artifacts with dependencies
+    project = db.query(Project).filter(Project.name == project_name).first()
+    if project:
+        package = db.query(Package).filter(
+            Package.project_id == project.id,
+            Package.name == package_name,
+        ).first()
+        if package:
+            # Find all artifacts in this package via tags
+            tags = db.query(Tag).filter(Tag.package_id == package.id).all()
+            artifact_ids = {t.artifact_id for t in tags}
+
+            # Get dependencies from all artifacts in this package
+            for artifact_id in artifact_ids:
+                deps = db.query(ArtifactDependency).filter(
+                    ArtifactDependency.artifact_id == artifact_id
+                ).all()
+
+                for dep in deps:
+                    cycle = _detect_package_cycle(
+                        db,
+                        dep.dependency_project,
+                        dep.dependency_package,
+                        target_project,
+                        target_package,
+                        visiting,
+                        visited,
+                        path,
+                    )
+                    if cycle:
+                        return cycle
+
+    path.pop()
+    visiting.remove(pkg_key)
+    visited.add(pkg_key)
+
+    return None
+
+
+def check_circular_dependencies(
+    db: Session,
+    artifact_id: str,
+    new_dependencies: List[EnsureFileDependency],
+    project_name: Optional[str] = None,
+    package_name: Optional[str] = None,
+) -> Optional[List[str]]:
+    """
+    Check if adding the new dependencies would create a circular dependency.
+
+    Args:
+        db: Database session
+        artifact_id: The artifact that will have these dependencies
+        new_dependencies: Dependencies to be added
+        project_name: Project name (optional, will try to look up from tag if not provided)
+        package_name: Package name (optional, will try to look up from tag if not provided)
+
+    Returns:
+        Cycle path if detected, None otherwise
+    """
+    # First, get the package info for this artifact to build path labels
+    if project_name and package_name:
+        current_path = f"{project_name}/{package_name}"
+    else:
+        # Try to look up from tag
+        artifact = db.query(Artifact).filter(Artifact.id == artifact_id).first()
+        if not artifact:
+            return None
+
+        # Find package for this artifact
+        tag = db.query(Tag).filter(Tag.artifact_id == artifact_id).first()
+        if not tag:
+            return None
+
+        package = db.query(Package).filter(Package.id == tag.package_id).first()
+        if not package:
+            return None
+
+        project = db.query(Project).filter(Project.id == package.project_id).first()
+        if not project:
+            return None
+
+        current_path = f"{project.name}/{package.name}"
+
+    # Extract target project and package from current_path
+    if "/" in current_path:
+        target_project, target_package = current_path.split("/", 1)
+    else:
+        return None
+
+    # For each new dependency, check if it would create a cycle back to our package
+    for dep in new_dependencies:
+        # Check if this dependency (transitively) depends on us at the package level
+        visiting: Set[str] = set()
+        visited: Set[str] = set()
+        path: List[str] = [current_path]
+
+        # Check from the dependency's package
+        cycle = _detect_package_cycle(
+            db,
+            dep.project,
+            dep.package,
+            target_project,
+            target_package,
+            visiting,
+            visited,
+            path,
+        )
+        if cycle:
+            return cycle
+
+    return None
+
+
+def resolve_dependencies(
+    db: Session,
+    project_name: str,
+    package_name: str,
+    ref: str,
+    base_url: str,
+) -> DependencyResolutionResponse:
+    """
+    Resolve all dependencies for an artifact recursively.
+
+    Args:
+        db: Database session
+        project_name: Project name
+        package_name: Package name
+        ref: Tag or version reference
+        base_url: Base URL for download URLs
+
+    Returns:
+        DependencyResolutionResponse with all resolved artifacts
+
+    Raises:
+        DependencyNotFoundError: If a dependency cannot be resolved
+        CircularDependencyError: If circular dependencies are detected
+        DependencyConflictError: If conflicting versions are required
+    """
+    # Resolve the initial artifact
+    project = db.query(Project).filter(Project.name == project_name).first()
+    if not project:
+        raise DependencyNotFoundError(project_name, package_name, ref)
+
+    package = db.query(Package).filter(
+        Package.project_id == project.id,
+        Package.name == package_name,
+    ).first()
+    if not package:
+        raise DependencyNotFoundError(project_name, package_name, ref)
+
+    # Try to find artifact by tag or version
+    resolved = _resolve_dependency_to_artifact(
+        db, project_name, package_name, ref, ref
+    )
+    if not resolved:
+        raise DependencyNotFoundError(project_name, package_name, ref)
+
+    root_artifact_id, root_version, root_size = resolved
+
+    # Track resolved artifacts and their versions
+    resolved_artifacts: Dict[str, ResolvedArtifact] = {}
+    # Track version requirements for conflict detection
+    version_requirements: Dict[str, List[Dict[str, Any]]] = {}  # pkg_key -> [(version, required_by)]
+    # Track visiting/visited for cycle detection
+    visiting: Set[str] = set()
+    visited: Set[str] = set()
+    # Resolution order (topological)
+    resolution_order: List[str] = []
+
+    def _resolve_recursive(
+        artifact_id: str,
+        proj_name: str,
+        pkg_name: str,
+        version_or_tag: str,
+        size: int,
+        required_by: Optional[str],
+        depth: int = 0,
+    ):
+        """Recursively resolve dependencies with cycle/conflict detection."""
+        # Safety limit: prevent DoS through deeply nested dependencies
+        if depth > MAX_DEPENDENCY_DEPTH:
+            raise DependencyDepthExceededError(MAX_DEPENDENCY_DEPTH)
+
+        pkg_key = f"{proj_name}/{pkg_name}"
+
+        # Cycle detection (at artifact level)
+        if artifact_id in visiting:
+            # Build cycle path
+            raise CircularDependencyError([pkg_key, pkg_key])
+
+        # Conflict detection - check if we've seen this package before with a different version
+        if pkg_key in version_requirements:
+            existing_versions = {r["version"] for r in version_requirements[pkg_key]}
+            if version_or_tag not in existing_versions:
+                # Conflict detected - same package, different version
+                requirements = version_requirements[pkg_key] + [
+                    {"version": version_or_tag, "required_by": required_by}
+                ]
+                raise DependencyConflictError([
+                    DependencyConflict(
+                        project=proj_name,
+                        package=pkg_name,
+                        requirements=[
+                            {
+                                "version": r["version"],
+                                "required_by": [{"path": r["required_by"]}] if r["required_by"] else []
+                            }
+                            for r in requirements
+                        ],
+                    )
+                ])
+            # Same version already resolved - skip
+            if artifact_id in visited:
+                return
+
+        if artifact_id in visited:
+            return
+
+        visiting.add(artifact_id)
+
+        # Track version requirement
+        if pkg_key not in version_requirements:
+            version_requirements[pkg_key] = []
+        version_requirements[pkg_key].append({
+            "version": version_or_tag,
+            "required_by": required_by,
+        })
+
+        # Get dependencies
+        deps = db.query(ArtifactDependency).filter(
+            ArtifactDependency.artifact_id == artifact_id
+        ).all()
+
+        # Resolve each dependency first (depth-first)
+        for dep in deps:
+            resolved_dep = _resolve_dependency_to_artifact(
+                db,
+                dep.dependency_project,
+                dep.dependency_package,
+                dep.version_constraint,
+                dep.tag_constraint,
+            )
+
+            if not resolved_dep:
+                constraint = dep.version_constraint or dep.tag_constraint
+                raise DependencyNotFoundError(
+                    dep.dependency_project,
+                    dep.dependency_package,
+                    constraint,
+                )
+
+            dep_artifact_id, dep_version, dep_size = resolved_dep
+            _resolve_recursive(
+                dep_artifact_id,
+                dep.dependency_project,
+                dep.dependency_package,
+                dep_version,
+                dep_size,
+                pkg_key,
+                depth + 1,
+            )
+
+        visiting.remove(artifact_id)
+        visited.add(artifact_id)
+
+        # Add to resolution order (dependencies before dependents)
+        resolution_order.append(artifact_id)
+
+        # Store resolved artifact info
+        resolved_artifacts[artifact_id] = ResolvedArtifact(
+            artifact_id=artifact_id,
+            project=proj_name,
+            package=pkg_name,
+            version=version_or_tag,
+            size=size,
+            download_url=f"{base_url}/api/v1/project/{proj_name}/{pkg_name}/+/{version_or_tag}",
+        )
+
+    # Start resolution from root
+    _resolve_recursive(
+        root_artifact_id,
+        project_name,
+        package_name,
+        root_version,
+        root_size,
+        None,
+    )
+
+    # Build response in topological order
+    resolved_list = [resolved_artifacts[aid] for aid in resolution_order]
+    total_size = sum(r.size for r in resolved_list)
+
+    return DependencyResolutionResponse(
+        requested={
+            "project": project_name,
+            "package": package_name,
+            "ref": ref,
+        },
+        resolved=resolved_list,
+        total_size=total_size,
+        artifact_count=len(resolved_list),
+    )
--- a/backend/app/models.py
+++ b/backend/app/models.py
@@ -117,6 +117,9 @@ class Artifact(Base):
    tags = relationship("Tag", back_populates="artifact")
    uploads = relationship("Upload", back_populates="artifact")
    versions = relationship("PackageVersion", back_populates="artifact")
+    dependencies = relationship(
+        "ArtifactDependency", back_populates="artifact", cascade="all, delete-orphan"
+    )

    @property
    def sha256(self) -> str:
@@ -507,3 +510,54 @@ class PackageHistory(Base):
        Index("idx_package_history_changed_at", "changed_at"),
        Index("idx_package_history_package_changed_at", "package_id", "changed_at"),
    )
+
+
+class ArtifactDependency(Base):
+    """Dependency declared by an artifact on another package.
+
+    Each artifact can declare dependencies on other packages, specifying either
+    an exact version or a tag. This enables recursive dependency resolution.
+    """
+
+    __tablename__ = "artifact_dependencies"
+
+    id = Column(UUID(as_uuid=True), primary_key=True, default=uuid.uuid4)
+    artifact_id = Column(
+        String(64),
+        ForeignKey("artifacts.id", ondelete="CASCADE"),
+        nullable=False,
+    )
+    dependency_project = Column(String(255), nullable=False)
+    dependency_package = Column(String(255), nullable=False)
+    version_constraint = Column(String(255), nullable=True)
+    tag_constraint = Column(String(255), nullable=True)
+    created_at = Column(DateTime(timezone=True), default=datetime.utcnow)
+
+    # Relationship to the artifact that declares this dependency
+    artifact = relationship("Artifact", back_populates="dependencies")
+
+    __table_args__ = (
+        # Exactly one of version_constraint or tag_constraint must be set
+        CheckConstraint(
+            "(version_constraint IS NOT NULL AND tag_constraint IS NULL) OR "
+            "(version_constraint IS NULL AND tag_constraint IS NOT NULL)",
+            name="check_constraint_type",
+        ),
+        # Each artifact can only depend on a specific project/package once
+        Index(
+            "idx_artifact_dependencies_artifact_id",
+            "artifact_id",
+        ),
+        Index(
+            "idx_artifact_dependencies_target",
+            "dependency_project",
+            "dependency_package",
+        ),
+        Index(
+            "idx_artifact_dependencies_unique",
+            "artifact_id",
+            "dependency_project",
+            "dependency_package",
+            unique=True,
+        ),
+    )
--- a/backend/app/routes.py
+++ b/backend/app/routes.py
@@ -14,7 +14,7 @@ from fastapi import (
    Cookie,
    status,
 )
-from fastapi.responses import StreamingResponse, RedirectResponse
+from fastapi.responses import StreamingResponse, RedirectResponse, PlainTextResponse
 from sqlalchemy.orm import Session
 from sqlalchemy import or_, and_, func, text
 from typing import List, Optional, Literal
@@ -47,6 +47,7 @@ from .models import (
    User,
    AccessPermission,
    PackageVersion,
+    ArtifactDependency,
 )
 from .schemas import (
    ProjectCreate,
@@ -120,8 +121,28 @@ from .schemas import (
    OIDCLoginResponse,
    PackageVersionResponse,
    PackageVersionDetailResponse,
+    ArtifactDependenciesResponse,
+    DependencyResponse,
+    ReverseDependenciesResponse,
+    DependencyResolutionResponse,
+    CircularDependencyError as CircularDependencyErrorSchema,
+    DependencyConflictError as DependencyConflictErrorSchema,
 )
 from .metadata import extract_metadata
+from .dependencies import (
+    parse_ensure_file,
+    validate_dependencies,
+    store_dependencies,
+    get_artifact_dependencies,
+    get_reverse_dependencies,
+    check_circular_dependencies,
+    resolve_dependencies,
+    InvalidEnsureFileError,
+    CircularDependencyError,
+    DependencyConflictError,
+    DependencyNotFoundError,
+    DependencyDepthExceededError,
+)
 from .config import get_settings
 from .checksum import (
    ChecksumMismatchError,
@@ -144,6 +165,18 @@ def sanitize_filename(filename: str) -> str:
    return re.sub(r'[\r\n"]', "", filename)


+def read_ensure_file(ensure_file: UploadFile) -> bytes:
+    """Read the content of an ensure file upload.
+
+    Args:
+        ensure_file: The uploaded ensure file
+
+    Returns:
+        Raw bytes content of the file
+    """
+    return ensure_file.file.read()
+
+
 def build_content_disposition(filename: str) -> str:
    """Build a Content-Disposition header value with proper encoding.

@@ -2272,6 +2305,7 @@ def upload_artifact(
    package_name: str,
    request: Request,
    file: UploadFile = File(...),
+    ensure: Optional[UploadFile] = File(None, description="Optional orchard.ensure file with dependencies"),
    tag: Optional[str] = Form(None),
    version: Optional[str] = Form(None),
    db: Session = Depends(get_db),
@@ -2303,6 +2337,26 @@ def upload_artifact(
    - `throughput_mbps`: Upload throughput in MB/s
    - `deduplicated`: True if content already existed

+    **Dependencies (orchard.ensure file):**
+    Optionally include an `ensure` file to declare dependencies for this artifact.
+    The file must be valid YAML with the following format:
+
+    ```yaml
+    dependencies:
+      - project: some-project
+        package: some-lib
+        version: "1.2.3"      # Exact version (mutually exclusive with tag)
+
+      - project: another-project
+        package: another-lib
+        tag: stable           # Tag reference (mutually exclusive with version)
+    ```
+
+    **Dependency validation:**
+    - Each dependency must specify either `version` or `tag`, not both
+    - Referenced projects must exist (packages are not validated at upload time)
+    - Circular dependencies are rejected at upload time
+
    **Example (curl):**
    ```bash
    curl -X POST "http://localhost:8080/api/v1/project/myproject/mypackage/upload" \\
@@ -2311,6 +2365,15 @@ def upload_artifact(
      -F "tag=v1.0.0"
    ```

+    **Example with dependencies (curl):**
+    ```bash
+    curl -X POST "http://localhost:8080/api/v1/project/myproject/mypackage/upload" \\
+      -H "Authorization: Bearer <api-key>" \\
+      -F "file=@myfile.tar.gz" \\
+      -F "ensure=@orchard.ensure" \\
+      -F "tag=v1.0.0"
+    ```
+
    **Example (Python requests):**
    ```python
    import requests
@@ -2611,6 +2674,45 @@ def upload_artifact(
            f"ref_count={artifact.ref_count}, saved_bytes={saved_bytes}"
        )

+    # Process ensure file if provided
+    dependencies_stored = []
+    if ensure:
+        try:
+            ensure_content = read_ensure_file(ensure)
+            parsed_ensure = parse_ensure_file(ensure_content)
+
+            if parsed_ensure.dependencies:
+                # Validate dependencies (projects must exist)
+                validation_errors = validate_dependencies(db, parsed_ensure.dependencies)
+                if validation_errors:
+                    raise HTTPException(
+                        status_code=400,
+                        detail=f"Invalid ensure file: {'; '.join(validation_errors)}"
+                    )
+
+                # Check for circular dependencies
+                cycle = check_circular_dependencies(
+                    db, storage_result.sha256, parsed_ensure.dependencies,
+                    project_name=project_name, package_name=package_name
+                )
+                if cycle:
+                    raise HTTPException(
+                        status_code=400,
+                        detail=f"Circular dependency detected: {' -> '.join(cycle)}"
+                    )
+
+                # Store dependencies
+                dependencies_stored = store_dependencies(
+                    db, storage_result.sha256, parsed_ensure.dependencies
+                )
+                logger.info(
+                    f"Stored {len(dependencies_stored)} dependencies for artifact "
+                    f"{storage_result.sha256[:12]}..."
+                )
+
+        except InvalidEnsureFileError as e:
+            raise HTTPException(status_code=400, detail=f"Invalid ensure file: {e}")
+
    # Audit log
    _log_audit(
        db,
@@ -6427,7 +6529,9 @@ def factory_reset(
            detail="Factory reset requires X-Confirm-Reset header set to 'yes-delete-all-data'",
        )

-    logger.warning(f"Factory reset initiated by admin user: {current_user.username}")
+    # Capture username before we drop tables (user object will become invalid)
+    admin_username = current_user.username
+    logger.warning(f"Factory reset initiated by admin user: {admin_username}")

    results = {
        "database_tables_dropped": 0,
@@ -6472,17 +6576,26 @@ def factory_reset(

        # Step 3: Reinitialize database schema
        logger.info("Reinitializing database schema...")
-        from .database import init_db
+        from .database import init_db, SessionLocal
        init_db()
        results["database_reinitialized"] = True

-        # Step 4: Re-seed with default data
+        # Step 4: Re-seed with default data (need fresh session after schema recreate)
        logger.info("Seeding database with defaults...")
        from .seed import seed_database
-        seed_database()
+        from .auth import create_default_admin
+        fresh_db = SessionLocal()
+        try:
+            # Create default admin user first (normally done at startup)
+            create_default_admin(fresh_db)
+            # Then seed other test data
+            seed_database(fresh_db)
+            fresh_db.commit()
+        finally:
+            fresh_db.close()
        results["seeded"] = True

-        logger.warning(f"Factory reset completed by {current_user.username}")
+        logger.warning(f"Factory reset completed by {admin_username}")

        return {
            "status": "success",
@@ -6497,3 +6610,324 @@ def factory_reset(
            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
            detail=f"Factory reset failed: {str(e)}",
        )
+
+
+# =============================================================================
+# Dependency Management Endpoints
+# =============================================================================
+
+
+@router.get(
+    "/api/v1/artifact/{artifact_id}/dependencies",
+    response_model=ArtifactDependenciesResponse,
+    tags=["dependencies"],
+)
+def get_artifact_dependencies_endpoint(
+    artifact_id: str,
+    db: Session = Depends(get_db),
+    current_user: Optional[User] = Depends(get_current_user_optional),
+):
+    """
+    Get all dependencies for an artifact by its ID.
+
+    Returns the list of packages this artifact depends on.
+    """
+    # Verify artifact exists
+    artifact = db.query(Artifact).filter(Artifact.id == artifact_id).first()
+    if not artifact:
+        raise HTTPException(status_code=404, detail="Artifact not found")
+
+    deps = get_artifact_dependencies(db, artifact_id)
+
+    return ArtifactDependenciesResponse(
+        artifact_id=artifact_id,
+        dependencies=deps,
+    )
+
+
+@router.get(
+    "/api/v1/project/{project_name}/{package_name}/+/{ref}/dependencies",
+    response_model=ArtifactDependenciesResponse,
+    tags=["dependencies"],
+)
+def get_dependencies_by_ref(
+    project_name: str,
+    package_name: str,
+    ref: str,
+    db: Session = Depends(get_db),
+    current_user: Optional[User] = Depends(get_current_user_optional),
+):
+    """
+    Get dependencies for an artifact by project/package/ref.
+
+    The ref can be a tag name or version.
+    """
+    # Check project access (handles private project authorization)
+    project = check_project_access(db, project_name, current_user, "read")
+
+    package = db.query(Package).filter(
+        Package.project_id == project.id,
+        Package.name == package_name,
+    ).first()
+    if not package:
+        raise HTTPException(status_code=404, detail="Package not found")
+
+    # Try to resolve ref to an artifact
+    artifact_id = None
+
+    # Try as tag first
+    tag = db.query(Tag).filter(
+        Tag.package_id == package.id,
+        Tag.name == ref,
+    ).first()
+    if tag:
+        artifact_id = tag.artifact_id
+
+    # Try as version if not found as tag
+    if not artifact_id:
+        version_record = db.query(PackageVersion).filter(
+            PackageVersion.package_id == package.id,
+            PackageVersion.version == ref,
+        ).first()
+        if version_record:
+            artifact_id = version_record.artifact_id
+
+    # Try as artifact ID prefix
+    if not artifact_id and len(ref) >= 8:
+        artifact = db.query(Artifact).filter(
+            Artifact.id.like(f"{ref}%")
+        ).first()
+        if artifact:
+            artifact_id = artifact.id
+
+    if not artifact_id:
+        raise HTTPException(
+            status_code=404,
+            detail=f"Reference '{ref}' not found in {project_name}/{package_name}"
+        )
+
+    deps = get_artifact_dependencies(db, artifact_id)
+
+    return ArtifactDependenciesResponse(
+        artifact_id=artifact_id,
+        dependencies=deps,
+    )
+
+
+@router.get(
+    "/api/v1/project/{project_name}/{package_name}/+/{ref}/ensure",
+    response_class=PlainTextResponse,
+    tags=["dependencies"],
+)
+def get_ensure_file(
+    project_name: str,
+    package_name: str,
+    ref: str,
+    db: Session = Depends(get_db),
+    current_user: Optional[User] = Depends(get_current_user_optional),
+):
+    """
+    Get the orchard.ensure file content for an artifact.
+
+    Returns the dependencies in YAML format that can be used as an ensure file.
+    """
+    # Check project access
+    project = check_project_access(db, project_name, current_user, "read")
+
+    package = db.query(Package).filter(
+        Package.project_id == project.id,
+        Package.name == package_name,
+    ).first()
+    if not package:
+        raise HTTPException(status_code=404, detail="Package not found")
+
+    # Resolve ref to artifact
+    artifact_id = None
+
+    # Try as tag first
+    tag = db.query(Tag).filter(
+        Tag.package_id == package.id,
+        Tag.name == ref,
+    ).first()
+    if tag:
+        artifact_id = tag.artifact_id
+
+    # Try as version
+    if not artifact_id:
+        version = db.query(PackageVersion).filter(
+            PackageVersion.package_id == package.id,
+            PackageVersion.version == ref,
+        ).first()
+        if version:
+            artifact_id = version.artifact_id
+
+    # Try as artifact ID prefix
+    if not artifact_id and len(ref) >= 8:
+        artifact = db.query(Artifact).filter(
+            Artifact.id.like(f"{ref}%")
+        ).first()
+        if artifact:
+            artifact_id = artifact.id
+
+    if not artifact_id:
+        raise HTTPException(status_code=404, detail="Artifact not found")
+
+    # Get artifact details
+    artifact = db.query(Artifact).filter(Artifact.id == artifact_id).first()
+
+    # Get version info if available
+    version_record = db.query(PackageVersion).filter(
+        PackageVersion.package_id == package.id,
+        PackageVersion.artifact_id == artifact_id,
+    ).first()
+    version_str = version_record.version if version_record else None
+
+    # Get dependencies
+    deps = get_artifact_dependencies(db, artifact_id)
+
+    # Build YAML content with full format
+    lines = []
+
+    # Header comment
+    lines.append(f"# orchard.ensure - Generated from {project_name}/{package_name}@{ref}")
+    lines.append(f"# Artifact: {artifact_id}")
+    if version_str:
+        lines.append(f"# Version: {version_str}")
+    lines.append(f"# Generated: {datetime.now(timezone.utc).isoformat()}")
+    lines.append("")
+
+    # Top-level project
+    lines.append(f"project: {project_name}")
+    lines.append("")
+
+    # Projects section
+    lines.append("projects:")
+    lines.append(f"  - name: {project_name}")
+
+    if deps:
+        lines.append("    dependencies:")
+        for dep in deps:
+            # Determine if cross-project dependency
+            is_cross_project = dep.project != project_name
+
+            lines.append(f"      - package: {dep.package}")
+            if is_cross_project:
+                lines.append(f"        project: {dep.project}  # Cross-project dependency")
+            if dep.version:
+                lines.append(f"        version: \"{dep.version}\"")
+            elif dep.tag:
+                lines.append(f"        tag: {dep.tag}")
+            # Suggest a path based on package name
+            lines.append(f"        path: {dep.package}/")
+    else:
+        lines.append("    dependencies: []")
+
+    lines.append("")
+
+    return PlainTextResponse(
+        "\n".join(lines),
+        media_type="text/yaml",
+    )
+
+
+@router.get(
+    "/api/v1/project/{project_name}/{package_name}/reverse-dependencies",
+    response_model=ReverseDependenciesResponse,
+    tags=["dependencies"],
+)
+def get_package_reverse_dependencies(
+    project_name: str,
+    package_name: str,
+    page: int = Query(1, ge=1),
+    limit: int = Query(50, ge=1, le=100),
+    db: Session = Depends(get_db),
+    current_user: Optional[User] = Depends(get_current_user_optional),
+):
+    """
+    Get packages that depend on this package (reverse dependencies).
+
+    Returns a paginated list of artifacts that declare a dependency on this package.
+    """
+    # Check project access (handles private project authorization)
+    project = check_project_access(db, project_name, current_user, "read")
+
+    package = db.query(Package).filter(
+        Package.project_id == project.id,
+        Package.name == package_name,
+    ).first()
+    if not package:
+        raise HTTPException(status_code=404, detail="Package not found")
+
+    return get_reverse_dependencies(db, project_name, package_name, page, limit)
+
+
+@router.get(
+    "/api/v1/project/{project_name}/{package_name}/+/{ref}/resolve",
+    response_model=DependencyResolutionResponse,
+    tags=["dependencies"],
+)
+def resolve_artifact_dependencies(
+    project_name: str,
+    package_name: str,
+    ref: str,
+    request: Request,
+    db: Session = Depends(get_db),
+    current_user: Optional[User] = Depends(get_current_user_optional),
+):
+    """
+    Resolve all dependencies for an artifact recursively.
+
+    Returns a flat list of all artifacts needed, in topological order
+    (dependencies before dependents). Includes download URLs for each artifact.
+
+    **Error Responses:**
+    - 404: Artifact or dependency not found
+    - 409: Circular dependency or version conflict detected
+    """
+    # Check project access (handles private project authorization)
+    check_project_access(db, project_name, current_user, "read")
+
+    # Build base URL for download links
+    base_url = str(request.base_url).rstrip("/")
+
+    try:
+        return resolve_dependencies(db, project_name, package_name, ref, base_url)
+    except DependencyNotFoundError as e:
+        raise HTTPException(
+            status_code=404,
+            detail=f"Dependency not found: {e.project}/{e.package}@{e.constraint}"
+        )
+    except CircularDependencyError as e:
+        raise HTTPException(
+            status_code=409,
+            detail={
+                "error": "circular_dependency",
+                "message": str(e),
+                "cycle": e.cycle,
+            }
+        )
+    except DependencyConflictError as e:
+        raise HTTPException(
+            status_code=409,
+            detail={
+                "error": "dependency_conflict",
+                "message": str(e),
+                "conflicts": [
+                    {
+                        "project": c.project,
+                        "package": c.package,
+                        "requirements": c.requirements,
+                    }
+                    for c in e.conflicts
+                ],
+            }
+        )
+    except DependencyDepthExceededError as e:
+        raise HTTPException(
+            status_code=400,
+            detail={
+                "error": "dependency_depth_exceeded",
+                "message": str(e),
+                "max_depth": e.max_depth,
+            }
+        )
--- a/backend/app/schemas.py
+++ b/backend/app/schemas.py
@@ -916,3 +916,140 @@ class ProjectWithAccessResponse(ProjectResponse):
    """Project response with user's access level"""
    user_access_level: Optional[str] = None

+
+# Artifact Dependency schemas
+class DependencyCreate(BaseModel):
+    """Schema for creating a dependency"""
+    project: str
+    package: str
+    version: Optional[str] = None
+    tag: Optional[str] = None
+
+    @field_validator('version', 'tag')
+    @classmethod
+    def validate_constraint(cls, v, info):
+        return v
+
+    def model_post_init(self, __context):
+        """Validate that exactly one of version or tag is set"""
+        if self.version is None and self.tag is None:
+            raise ValueError("Either 'version' or 'tag' must be specified")
+        if self.version is not None and self.tag is not None:
+            raise ValueError("Cannot specify both 'version' and 'tag'")
+
+
+class DependencyResponse(BaseModel):
+    """Schema for dependency response"""
+    id: UUID
+    artifact_id: str
+    project: str
+    package: str
+    version: Optional[str] = None
+    tag: Optional[str] = None
+    created_at: datetime
+
+    class Config:
+        from_attributes = True
+
+    @classmethod
+    def from_orm_model(cls, dep) -> "DependencyResponse":
+        """Create from ORM model with field mapping"""
+        return cls(
+            id=dep.id,
+            artifact_id=dep.artifact_id,
+            project=dep.dependency_project,
+            package=dep.dependency_package,
+            version=dep.version_constraint,
+            tag=dep.tag_constraint,
+            created_at=dep.created_at,
+        )
+
+
+class ArtifactDependenciesResponse(BaseModel):
+    """Response containing all dependencies for an artifact"""
+    artifact_id: str
+    dependencies: List[DependencyResponse]
+
+
+class DependentInfo(BaseModel):
+    """Information about an artifact that depends on a package"""
+    artifact_id: str
+    project: str
+    package: str
+    version: Optional[str] = None
+    constraint_type: str  # 'version' or 'tag'
+    constraint_value: str
+
+
+class ReverseDependenciesResponse(BaseModel):
+    """Response containing packages that depend on a given package"""
+    project: str
+    package: str
+    dependents: List[DependentInfo]
+    pagination: PaginationMeta
+
+
+class EnsureFileDependency(BaseModel):
+    """Dependency entry from orchard.ensure file"""
+    project: str
+    package: str
+    version: Optional[str] = None
+    tag: Optional[str] = None
+
+    @field_validator('version', 'tag')
+    @classmethod
+    def validate_constraint(cls, v, info):
+        return v
+
+    def model_post_init(self, __context):
+        """Validate that exactly one of version or tag is set"""
+        if self.version is None and self.tag is None:
+            raise ValueError("Either 'version' or 'tag' must be specified")
+        if self.version is not None and self.tag is not None:
+            raise ValueError("Cannot specify both 'version' and 'tag'")
+
+
+class EnsureFileContent(BaseModel):
+    """Parsed content of orchard.ensure file"""
+    dependencies: List[EnsureFileDependency] = []
+
+
+class ResolvedArtifact(BaseModel):
+    """A resolved artifact in the dependency tree"""
+    artifact_id: str
+    project: str
+    package: str
+    version: Optional[str] = None
+    tag: Optional[str] = None
+    size: int
+    download_url: str
+
+
+class DependencyResolutionResponse(BaseModel):
+    """Response from dependency resolution endpoint"""
+    requested: Dict[str, str]  # project, package, ref
+    resolved: List[ResolvedArtifact]
+    total_size: int
+    artifact_count: int
+
+
+class DependencyConflict(BaseModel):
+    """Details about a dependency conflict"""
+    project: str
+    package: str
+    requirements: List[Dict[str, Any]]  # version/tag and required_by info
+
+
+class DependencyConflictError(BaseModel):
+    """Error response for dependency conflicts"""
+    error: str = "dependency_conflict"
+    message: str
+    conflicts: List[DependencyConflict]
+
+
+class CircularDependencyError(BaseModel):
+    """Error response for circular dependencies"""
+    error: str = "circular_dependency"
+    message: str
+    cycle: List[str]  # List of "project/package" strings showing the cycle
+
--- a/backend/app/seed.py
+++ b/backend/app/seed.py
@@ -5,7 +5,7 @@ import hashlib
 import logging
 from sqlalchemy.orm import Session

-from .models import Project, Package, Artifact, Tag, Upload, PackageVersion
+from .models import Project, Package, Artifact, Tag, Upload, PackageVersion, ArtifactDependency
 from .storage import get_storage

 logger = logging.getLogger(__name__)
@@ -123,6 +123,17 @@ TEST_ARTIFACTS = [
    },
 ]

+# Dependencies to create (source artifact -> dependency)
+# Format: (source_project, source_package, source_version, dep_project, dep_package, version_constraint, tag_constraint)
+TEST_DEPENDENCIES = [
+    # ui-components v1.1.0 depends on design-tokens v1.0.0
+    ("frontend-libs", "ui-components", "1.1.0", "frontend-libs", "design-tokens", "1.0.0", None),
+    # auth-lib v1.0.0 depends on common-utils v2.0.0
+    ("backend-services", "auth-lib", "1.0.0", "backend-services", "common-utils", "2.0.0", None),
+    # auth-lib v1.0.0 also depends on design-tokens (stable tag)
+    ("backend-services", "auth-lib", "1.0.0", "frontend-libs", "design-tokens", None, "latest"),
+]
+

 def is_database_empty(db: Session) -> bool:
    """Check if the database has any projects."""
@@ -240,6 +251,40 @@ def seed_database(db: Session) -> None:
            db.add(tag)
            tag_count += 1

+    db.flush()
+
+    # Create dependencies
+    dependency_count = 0
+    for dep_data in TEST_DEPENDENCIES:
+        src_project, src_package, src_version, dep_project, dep_package, version_constraint, tag_constraint = dep_data
+
+        # Find the source artifact by looking up its version
+        src_pkg = package_map.get((src_project, src_package))
+        if not src_pkg:
+            logger.warning(f"Source package not found: {src_project}/{src_package}")
+            continue
+
+        # Find the artifact for this version
+        src_version_record = db.query(PackageVersion).filter(
+            PackageVersion.package_id == src_pkg.id,
+            PackageVersion.version == src_version,
+        ).first()
+
+        if not src_version_record:
+            logger.warning(f"Source version not found: {src_project}/{src_package}@{src_version}")
+            continue
+
+        # Create the dependency
+        dependency = ArtifactDependency(
+            artifact_id=src_version_record.artifact_id,
+            dependency_project=dep_project,
+            dependency_package=dep_package,
+            version_constraint=version_constraint,
+            tag_constraint=tag_constraint,
+        )
+        db.add(dependency)
+        dependency_count += 1
+
    db.commit()
-    logger.info(f"Created {artifact_count} artifacts, {tag_count} tags, and {version_count} versions")
+    logger.info(f"Created {artifact_count} artifacts, {tag_count} tags, {version_count} versions, and {dependency_count} dependencies")
    logger.info("Database seeding complete")
--- a/backend/tests/test_dependencies.py
+++ b/backend/tests/test_dependencies.py
--- a/frontend/src/App.tsx
+++ b/frontend/src/App.tsx
@@ -10,6 +10,7 @@ import ChangePasswordPage from './pages/ChangePasswordPage';
 import APIKeysPage from './pages/APIKeysPage';
 import AdminUsersPage from './pages/AdminUsersPage';
 import AdminOIDCPage from './pages/AdminOIDCPage';
+import ProjectSettingsPage from './pages/ProjectSettingsPage';

 // Component that checks if user must change password
 function RequirePasswordChange({ children }: { children: React.ReactNode }) {
@@ -45,6 +46,7 @@ function AppRoutes() {
                <Route path="/admin/users" element={<AdminUsersPage />} />
                <Route path="/admin/oidc" element={<AdminOIDCPage />} />
                <Route path="/project/:projectName" element={<ProjectPage />} />
+                <Route path="/project/:projectName/settings" element={<ProjectSettingsPage />} />
                <Route path="/project/:projectName/:packageName" element={<PackagePage />} />
              </Routes>
            </Layout>
--- a/frontend/src/api.ts
+++ b/frontend/src/api.ts
@@ -33,6 +33,9 @@ import {
  OIDCConfigUpdate,
  OIDCStatus,
  PackageVersion,
+  ArtifactDependenciesResponse,
+  ReverseDependenciesResponse,
+  DependencyResolutionResponse,
 } from './types';

 const API_BASE = '/api/v1';
@@ -171,6 +174,30 @@ export async function getProject(name: string): Promise<Project> {
  return handleResponse<Project>(response);
 }

+export async function updateProject(
+  projectName: string,
+  data: { description?: string; is_public?: boolean }
+): Promise<Project> {
+  const response = await fetch(`${API_BASE}/projects/${projectName}`, {
+    method: 'PUT',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify(data),
+    credentials: 'include',
+  });
+  return handleResponse<Project>(response);
+}
+
+export async function deleteProject(projectName: string): Promise<void> {
+  const response = await fetch(`${API_BASE}/projects/${projectName}`, {
+    method: 'DELETE',
+    credentials: 'include',
+  });
+  if (!response.ok) {
+    const error = await response.json().catch(() => ({ detail: 'Unknown error' }));
+    throw new Error(error.detail || `HTTP ${response.status}`);
+  }
+}
+
 // Package API
 export async function listPackages(projectName: string, params: PackageListParams = {}): Promise<PaginatedResponse<Package>> {
  const query = buildQueryString(params as Record<string, unknown>);
@@ -488,3 +515,50 @@ export async function deleteVersion(
    throw new Error(error.detail || `HTTP ${response.status}`);
  }
 }
+
+// Dependency API
+export async function getArtifactDependencies(artifactId: string): Promise<ArtifactDependenciesResponse> {
+  const response = await fetch(`${API_BASE}/artifact/${artifactId}/dependencies`);
+  return handleResponse<ArtifactDependenciesResponse>(response);
+}
+
+export async function getDependenciesByRef(
+  projectName: string,
+  packageName: string,
+  ref: string
+): Promise<ArtifactDependenciesResponse> {
+  const response = await fetch(`${API_BASE}/project/${projectName}/${packageName}/+/${ref}/dependencies`);
+  return handleResponse<ArtifactDependenciesResponse>(response);
+}
+
+export async function getReverseDependencies(
+  projectName: string,
+  packageName: string,
+  params: { page?: number; limit?: number } = {}
+): Promise<ReverseDependenciesResponse> {
+  const query = buildQueryString(params as Record<string, unknown>);
+  const response = await fetch(`${API_BASE}/project/${projectName}/${packageName}/reverse-dependencies${query}`);
+  return handleResponse<ReverseDependenciesResponse>(response);
+}
+
+export async function resolveDependencies(
+  projectName: string,
+  packageName: string,
+  ref: string
+): Promise<DependencyResolutionResponse> {
+  const response = await fetch(`${API_BASE}/project/${projectName}/${packageName}/+/${ref}/resolve`);
+  return handleResponse<DependencyResolutionResponse>(response);
+}
+
+export async function getEnsureFile(
+  projectName: string,
+  packageName: string,
+  ref: string
+): Promise<string> {
+  const response = await fetch(`${API_BASE}/project/${projectName}/${packageName}/+/${ref}/ensure`);
+  if (!response.ok) {
+    const error = await response.json().catch(() => ({ detail: 'Unknown error' }));
+    throw new ApiError(error.detail || `HTTP ${response.status}`, response.status);
+  }
+  return response.text();
+}
--- a/frontend/src/components/DependencyGraph.css
+++ b/frontend/src/components/DependencyGraph.css
@@ -0,0 +1,338 @@
+/* Dependency Graph Modal */
+.dependency-graph-modal {
+  position: fixed;
+  top: 0;
+  left: 0;
+  right: 0;
+  bottom: 0;
+  background: rgba(0, 0, 0, 0.8);
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  z-index: 1000;
+  padding: 24px;
+}
+
+.dependency-graph-content {
+  background: var(--bg-secondary);
+  border: 1px solid var(--border-primary);
+  border-radius: var(--radius-lg);
+  width: 100%;
+  max-width: 1200px;
+  height: 80vh;
+  display: flex;
+  flex-direction: column;
+  overflow: hidden;
+}
+
+.dependency-graph-header {
+  display: flex;
+  align-items: center;
+  gap: 16px;
+  padding: 16px 20px;
+  border-bottom: 1px solid var(--border-primary);
+  background: var(--bg-tertiary);
+}
+
+.dependency-graph-header h2 {
+  margin: 0;
+  font-size: 1.125rem;
+  font-weight: 600;
+  color: var(--text-primary);
+}
+
+.dependency-graph-info {
+  display: flex;
+  align-items: center;
+  gap: 12px;
+  flex: 1;
+  font-size: 0.875rem;
+  color: var(--text-secondary);
+}
+
+.graph-stats {
+  color: var(--text-muted);
+  font-size: 0.8125rem;
+}
+
+.close-btn {
+  background: transparent;
+  border: none;
+  color: var(--text-secondary);
+  cursor: pointer;
+  padding: 4px;
+  border-radius: var(--radius-sm);
+  display: flex;
+  align-items: center;
+  justify-content: center;
+}
+
+.close-btn:hover {
+  background: var(--bg-hover);
+  color: var(--text-primary);
+}
+
+.dependency-graph-toolbar {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  padding: 12px 20px;
+  border-bottom: 1px solid var(--border-primary);
+  background: var(--bg-secondary);
+}
+
+.zoom-level {
+  margin-left: auto;
+  font-size: 0.8125rem;
+  color: var(--text-muted);
+  font-family: 'JetBrains Mono', monospace;
+}
+
+.dependency-graph-container {
+  flex: 1;
+  overflow: hidden;
+  position: relative;
+  background:
+    linear-gradient(90deg, var(--border-primary) 1px, transparent 1px),
+    linear-gradient(var(--border-primary) 1px, transparent 1px);
+  background-size: 20px 20px;
+  background-position: center center;
+}
+
+.graph-canvas {
+  padding: 40px;
+  min-width: 100%;
+  min-height: 100%;
+  transform-origin: center center;
+  transition: transform 0.1s ease-out;
+}
+
+/* Graph Nodes */
+.graph-node-container {
+  display: flex;
+  flex-direction: column;
+  align-items: flex-start;
+}
+
+.graph-node {
+  background: var(--bg-tertiary);
+  border: 2px solid var(--border-primary);
+  border-radius: var(--radius-md);
+  padding: 12px 16px;
+  min-width: 200px;
+  cursor: pointer;
+  transition: all var(--transition-fast);
+  position: relative;
+}
+
+.graph-node:hover {
+  border-color: var(--accent-primary);
+  box-shadow: 0 4px 12px rgba(16, 185, 129, 0.2);
+}
+
+.graph-node--root {
+  background: linear-gradient(135deg, rgba(16, 185, 129, 0.15) 0%, rgba(5, 150, 105, 0.15) 100%);
+  border-color: var(--accent-primary);
+}
+
+.graph-node--hovered {
+  transform: scale(1.02);
+}
+
+.graph-node__header {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  margin-bottom: 4px;
+}
+
+.graph-node__name {
+  font-weight: 600;
+  color: var(--accent-primary);
+  font-family: 'JetBrains Mono', monospace;
+  font-size: 0.875rem;
+}
+
+.graph-node__toggle {
+  background: var(--bg-hover);
+  border: 1px solid var(--border-primary);
+  border-radius: 4px;
+  width: 20px;
+  height: 20px;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  cursor: pointer;
+  font-size: 0.875rem;
+  color: var(--text-secondary);
+  font-weight: 600;
+  margin-left: auto;
+}
+
+.graph-node__toggle:hover {
+  background: var(--bg-tertiary);
+  color: var(--text-primary);
+}
+
+.graph-node__details {
+  display: flex;
+  align-items: center;
+  gap: 12px;
+  font-size: 0.75rem;
+  color: var(--text-muted);
+}
+
+.graph-node__version {
+  font-family: 'JetBrains Mono', monospace;
+  color: var(--text-secondary);
+}
+
+.graph-node__size {
+  color: var(--text-muted);
+}
+
+/* Graph Children / Tree Structure */
+.graph-children {
+  display: flex;
+  padding-left: 24px;
+  margin-top: 8px;
+  position: relative;
+}
+
+.graph-connector {
+  position: absolute;
+  left: 12px;
+  top: 0;
+  bottom: 50%;
+  width: 12px;
+  border-left: 2px solid var(--border-primary);
+  border-bottom: 2px solid var(--border-primary);
+  border-bottom-left-radius: 8px;
+}
+
+.graph-children-list {
+  display: flex;
+  flex-direction: column;
+  gap: 8px;
+  position: relative;
+}
+
+.graph-children-list::before {
+  content: '';
+  position: absolute;
+  left: -12px;
+  top: 20px;
+  bottom: 20px;
+  border-left: 2px solid var(--border-primary);
+}
+
+.graph-children-list > .graph-node-container {
+  position: relative;
+}
+
+.graph-children-list > .graph-node-container::before {
+  content: '';
+  position: absolute;
+  left: -12px;
+  top: 20px;
+  width: 12px;
+  border-top: 2px solid var(--border-primary);
+}
+
+/* Loading, Error, Empty States */
+.graph-loading,
+.graph-error,
+.graph-empty {
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  justify-content: center;
+  height: 100%;
+  gap: 16px;
+  color: var(--text-muted);
+}
+
+.graph-loading .spinner {
+  width: 32px;
+  height: 32px;
+  border: 3px solid var(--border-primary);
+  border-top-color: var(--accent-primary);
+  border-radius: 50%;
+  animation: spin 1s linear infinite;
+}
+
+@keyframes spin {
+  to { transform: rotate(360deg); }
+}
+
+.graph-error {
+  color: var(--error-color, #ef4444);
+}
+
+.graph-error svg {
+  opacity: 0.6;
+}
+
+.graph-error p {
+  max-width: 400px;
+  text-align: center;
+  line-height: 1.5;
+}
+
+/* Tooltip */
+.graph-tooltip {
+  position: fixed;
+  bottom: 24px;
+  left: 50%;
+  transform: translateX(-50%);
+  background: var(--bg-tertiary);
+  border: 1px solid var(--border-primary);
+  border-radius: var(--radius-md);
+  padding: 12px 16px;
+  font-size: 0.8125rem;
+  box-shadow: 0 8px 24px rgba(0, 0, 0, 0.4);
+  z-index: 1001;
+}
+
+.graph-tooltip strong {
+  display: block;
+  color: var(--accent-primary);
+  font-family: 'JetBrains Mono', monospace;
+  margin-bottom: 4px;
+}
+
+.graph-tooltip div {
+  color: var(--text-secondary);
+  margin-top: 2px;
+}
+
+.tooltip-hint {
+  margin-top: 8px;
+  padding-top: 8px;
+  border-top: 1px solid var(--border-primary);
+  color: var(--text-muted);
+  font-size: 0.75rem;
+}
+
+/* Responsive */
+@media (max-width: 768px) {
+  .dependency-graph-modal {
+    padding: 0;
+  }
+
+  .dependency-graph-content {
+    height: 100vh;
+    border-radius: 0;
+    max-width: none;
+  }
+
+  .dependency-graph-header {
+    flex-wrap: wrap;
+  }
+
+  .dependency-graph-info {
+    flex-basis: 100%;
+    order: 3;
+    margin-top: 8px;
+  }
+}
--- a/frontend/src/components/DependencyGraph.tsx
+++ b/frontend/src/components/DependencyGraph.tsx
@@ -0,0 +1,323 @@
+import { useState, useEffect, useCallback, useRef } from 'react';
+import { useNavigate } from 'react-router-dom';
+import { ResolvedArtifact, DependencyResolutionResponse, Dependency } from '../types';
+import { resolveDependencies, getArtifactDependencies } from '../api';
+import './DependencyGraph.css';
+
+interface DependencyGraphProps {
+  projectName: string;
+  packageName: string;
+  tagName: string;
+  onClose: () => void;
+}
+
+interface GraphNode {
+  id: string;
+  project: string;
+  package: string;
+  version: string | null;
+  size: number;
+  depth: number;
+  children: GraphNode[];
+  isRoot?: boolean;
+}
+
+function formatBytes(bytes: number): string {
+  if (bytes === 0) return '0 B';
+  const k = 1024;
+  const sizes = ['B', 'KB', 'MB', 'GB'];
+  const i = Math.floor(Math.log(bytes) / Math.log(k));
+  return parseFloat((bytes / Math.pow(k, i)).toFixed(1)) + ' ' + sizes[i];
+}
+
+function DependencyGraph({ projectName, packageName, tagName, onClose }: DependencyGraphProps) {
+  const navigate = useNavigate();
+  const containerRef = useRef<HTMLDivElement>(null);
+
+  const [loading, setLoading] = useState(true);
+  const [error, setError] = useState<string | null>(null);
+  const [resolution, setResolution] = useState<DependencyResolutionResponse | null>(null);
+  const [graphRoot, setGraphRoot] = useState<GraphNode | null>(null);
+  const [hoveredNode, setHoveredNode] = useState<GraphNode | null>(null);
+  const [zoom, setZoom] = useState(1);
+  const [pan, setPan] = useState({ x: 0, y: 0 });
+  const [isDragging, setIsDragging] = useState(false);
+  const [dragStart, setDragStart] = useState({ x: 0, y: 0 });
+  const [collapsedNodes, setCollapsedNodes] = useState<Set<string>>(new Set());
+
+  // Build graph structure from resolution data
+  const buildGraph = useCallback(async (resolutionData: DependencyResolutionResponse) => {
+    const artifactMap = new Map<string, ResolvedArtifact>();
+    resolutionData.resolved.forEach(artifact => {
+      artifactMap.set(artifact.artifact_id, artifact);
+    });
+
+    // Fetch dependencies for each artifact to build the tree
+    const depsMap = new Map<string, Dependency[]>();
+
+    for (const artifact of resolutionData.resolved) {
+      try {
+        const deps = await getArtifactDependencies(artifact.artifact_id);
+        depsMap.set(artifact.artifact_id, deps.dependencies);
+      } catch {
+        depsMap.set(artifact.artifact_id, []);
+      }
+    }
+
+    // Find the root artifact (the requested one)
+    const rootArtifact = resolutionData.resolved.find(
+      a => a.project === resolutionData.requested.project &&
+           a.package === resolutionData.requested.package
+    );
+
+    if (!rootArtifact) {
+      return null;
+    }
+
+    // Build tree recursively
+    const visited = new Set<string>();
+
+    const buildNode = (artifact: ResolvedArtifact, depth: number): GraphNode => {
+      const nodeId = `${artifact.project}/${artifact.package}`;
+      visited.add(artifact.artifact_id);
+
+      const deps = depsMap.get(artifact.artifact_id) || [];
+      const children: GraphNode[] = [];
+
+      for (const dep of deps) {
+        // Find the resolved artifact for this dependency
+        const childArtifact = resolutionData.resolved.find(
+          a => a.project === dep.project && a.package === dep.package
+        );
+
+        if (childArtifact && !visited.has(childArtifact.artifact_id)) {
+          children.push(buildNode(childArtifact, depth + 1));
+        }
+      }
+
+      return {
+        id: nodeId,
+        project: artifact.project,
+        package: artifact.package,
+        version: artifact.version || artifact.tag,
+        size: artifact.size,
+        depth,
+        children,
+        isRoot: depth === 0,
+      };
+    };
+
+    return buildNode(rootArtifact, 0);
+  }, []);
+
+  useEffect(() => {
+    async function loadData() {
+      setLoading(true);
+      setError(null);
+
+      try {
+        const result = await resolveDependencies(projectName, packageName, tagName);
+        setResolution(result);
+
+        const graph = await buildGraph(result);
+        setGraphRoot(graph);
+      } catch (err) {
+        if (err instanceof Error) {
+          // Check if it's a resolution error
+          try {
+            const errorData = JSON.parse(err.message);
+            if (errorData.error === 'circular_dependency') {
+              setError(`Circular dependency detected: ${errorData.cycle?.join(' → ')}`);
+            } else if (errorData.error === 'dependency_conflict') {
+              setError(`Dependency conflict: ${errorData.message}`);
+            } else {
+              setError(err.message);
+            }
+          } catch {
+            setError(err.message);
+          }
+        } else {
+          setError('Failed to load dependency graph');
+        }
+      } finally {
+        setLoading(false);
+      }
+    }
+
+    loadData();
+  }, [projectName, packageName, tagName, buildGraph]);
+
+  const handleNodeClick = (node: GraphNode) => {
+    navigate(`/project/${node.project}/${node.package}`);
+    onClose();
+  };
+
+  const handleNodeToggle = (node: GraphNode, e: React.MouseEvent) => {
+    e.stopPropagation();
+    setCollapsedNodes(prev => {
+      const next = new Set(prev);
+      if (next.has(node.id)) {
+        next.delete(node.id);
+      } else {
+        next.add(node.id);
+      }
+      return next;
+    });
+  };
+
+  const handleWheel = (e: React.WheelEvent) => {
+    e.preventDefault();
+    const delta = e.deltaY > 0 ? -0.1 : 0.1;
+    setZoom(z => Math.max(0.25, Math.min(2, z + delta)));
+  };
+
+  const handleMouseDown = (e: React.MouseEvent) => {
+    if (e.target === containerRef.current || (e.target as HTMLElement).classList.contains('graph-canvas')) {
+      setIsDragging(true);
+      setDragStart({ x: e.clientX - pan.x, y: e.clientY - pan.y });
+    }
+  };
+
+  const handleMouseMove = (e: React.MouseEvent) => {
+    if (isDragging) {
+      setPan({ x: e.clientX - dragStart.x, y: e.clientY - dragStart.y });
+    }
+  };
+
+  const handleMouseUp = () => {
+    setIsDragging(false);
+  };
+
+  const resetView = () => {
+    setZoom(1);
+    setPan({ x: 0, y: 0 });
+  };
+
+  const renderNode = (node: GraphNode, index: number = 0): JSX.Element => {
+    const isCollapsed = collapsedNodes.has(node.id);
+    const hasChildren = node.children.length > 0;
+
+    return (
+      <div key={`${node.id}-${index}`} className="graph-node-container">
+        <div
+          className={`graph-node ${node.isRoot ? 'graph-node--root' : ''} ${hoveredNode?.id === node.id ? 'graph-node--hovered' : ''}`}
+          onClick={() => handleNodeClick(node)}
+          onMouseEnter={() => setHoveredNode(node)}
+          onMouseLeave={() => setHoveredNode(null)}
+        >
+          <div className="graph-node__header">
+            <span className="graph-node__name">{node.project}/{node.package}</span>
+            {hasChildren && (
+              <button
+                className="graph-node__toggle"
+                onClick={(e) => handleNodeToggle(node, e)}
+                title={isCollapsed ? 'Expand' : 'Collapse'}
+              >
+                {isCollapsed ? '+' : '-'}
+              </button>
+            )}
+          </div>
+          <div className="graph-node__details">
+            {node.version && <span className="graph-node__version">@ {node.version}</span>}
+            <span className="graph-node__size">{formatBytes(node.size)}</span>
+          </div>
+        </div>
+
+        {hasChildren && !isCollapsed && (
+          <div className="graph-children">
+            <div className="graph-connector"></div>
+            <div className="graph-children-list">
+              {node.children.map((child, i) => renderNode(child, i))}
+            </div>
+          </div>
+        )}
+      </div>
+    );
+  };
+
+  return (
+    <div className="dependency-graph-modal" onClick={onClose}>
+      <div className="dependency-graph-content" onClick={e => e.stopPropagation()}>
+        <div className="dependency-graph-header">
+          <h2>Dependency Graph</h2>
+          <div className="dependency-graph-info">
+            <span>{projectName}/{packageName} @ {tagName}</span>
+            {resolution && (
+              <span className="graph-stats">
+                {resolution.artifact_count} packages • {formatBytes(resolution.total_size)} total
+              </span>
+            )}
+          </div>
+          <button className="close-btn" onClick={onClose} title="Close">
+            <svg width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" strokeWidth="2">
+              <line x1="18" y1="6" x2="6" y2="18"></line>
+              <line x1="6" y1="6" x2="18" y2="18"></line>
+            </svg>
+          </button>
+        </div>
+
+        <div className="dependency-graph-toolbar">
+          <button className="btn btn-secondary btn-small" onClick={() => setZoom(z => Math.min(2, z + 0.25))}>
+            Zoom In
+          </button>
+          <button className="btn btn-secondary btn-small" onClick={() => setZoom(z => Math.max(0.25, z - 0.25))}>
+            Zoom Out
+          </button>
+          <button className="btn btn-secondary btn-small" onClick={resetView}>
+            Reset View
+          </button>
+          <span className="zoom-level">{Math.round(zoom * 100)}%</span>
+        </div>
+
+        <div
+          ref={containerRef}
+          className="dependency-graph-container"
+          onWheel={handleWheel}
+          onMouseDown={handleMouseDown}
+          onMouseMove={handleMouseMove}
+          onMouseUp={handleMouseUp}
+          onMouseLeave={handleMouseUp}
+        >
+          {loading ? (
+            <div className="graph-loading">
+              <div className="spinner"></div>
+              <span>Resolving dependencies...</span>
+            </div>
+          ) : error ? (
+            <div className="graph-error">
+              <svg width="48" height="48" viewBox="0 0 24 24" fill="none" stroke="currentColor" strokeWidth="2">
+                <circle cx="12" cy="12" r="10"></circle>
+                <line x1="12" y1="8" x2="12" y2="12"></line>
+                <line x1="12" y1="16" x2="12.01" y2="16"></line>
+              </svg>
+              <p>{error}</p>
+            </div>
+          ) : graphRoot ? (
+            <div
+              className="graph-canvas"
+              style={{
+                transform: `translate(${pan.x}px, ${pan.y}px) scale(${zoom})`,
+                cursor: isDragging ? 'grabbing' : 'grab',
+              }}
+            >
+              {renderNode(graphRoot)}
+            </div>
+          ) : (
+            <div className="graph-empty">No dependencies to display</div>
+          )}
+        </div>
+
+        {hoveredNode && (
+          <div className="graph-tooltip">
+            <strong>{hoveredNode.project}/{hoveredNode.package}</strong>
+            {hoveredNode.version && <div>Version: {hoveredNode.version}</div>}
+            <div>Size: {formatBytes(hoveredNode.size)}</div>
+            <div className="tooltip-hint">Click to navigate</div>
+          </div>
+        )}
+      </div>
+    </div>
+  );
+}
+
+export default DependencyGraph;
--- a/frontend/src/components/Layout.tsx
+++ b/frontend/src/components/Layout.tsx
@@ -193,7 +193,6 @@ function Layout({ children }: LayoutProps) {
          </div>
          <div className="footer-links">
            <a href="/docs">Documentation</a>
-            <a href="/api/v1">API</a>
          </div>
        </div>
      </footer>
--- a/frontend/src/pages/Home.css
+++ b/frontend/src/pages/Home.css
@@ -358,6 +358,12 @@
  gap: 4px;
 }

+.page-header__actions {
+  display: flex;
+  align-items: center;
+  gap: 12px;
+}
+
 /* Package card styles */
 .package-card__header {
  display: flex;
--- a/frontend/src/pages/PackagePage.css
+++ b/frontend/src/pages/PackagePage.css
@@ -127,6 +127,12 @@ h2 {
  font-size: 0.75rem;
 }

+/* Action buttons in table */
+.action-buttons {
+  display: flex;
+  gap: 8px;
+}
+
 /* Download by Artifact ID Section */
 .download-by-id-section {
  margin-top: 32px;
@@ -424,6 +430,340 @@ tr:hover .copy-btn {
  white-space: nowrap;
 }

+/* Dependencies Section */
+.dependencies-section {
+  margin-top: 32px;
+  background: var(--bg-secondary);
+}
+
+.dependencies-header {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  margin-bottom: 12px;
+}
+
+.dependencies-header h3 {
+  margin: 0;
+  color: var(--text-primary);
+  font-size: 1rem;
+  font-weight: 600;
+}
+
+.dependencies-controls {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+}
+
+.dependencies-controls .btn {
+  display: inline-flex;
+  align-items: center;
+}
+
+.dependencies-tag-select {
+  margin-bottom: 16px;
+}
+
+.tag-selector {
+  padding: 8px 12px;
+  background: var(--bg-tertiary);
+  border: 1px solid var(--border-primary);
+  border-radius: var(--radius-md);
+  color: var(--text-primary);
+  font-size: 0.875rem;
+  cursor: pointer;
+  min-width: 200px;
+}
+
+.tag-selector:focus {
+  outline: none;
+  border-color: var(--accent-primary);
+}
+
+.deps-loading {
+  color: var(--text-muted);
+  font-size: 0.875rem;
+  padding: 16px 0;
+}
+
+.deps-error {
+  color: var(--error-color, #ef4444);
+  font-size: 0.875rem;
+  padding: 12px 16px;
+  background: rgba(239, 68, 68, 0.1);
+  border-radius: var(--radius-md);
+}
+
+.deps-empty {
+  color: var(--text-muted);
+  font-size: 0.875rem;
+  padding: 16px 0;
+}
+
+.deps-summary {
+  color: var(--text-secondary);
+  font-size: 0.875rem;
+  margin-bottom: 12px;
+}
+
+.deps-summary strong {
+  color: var(--accent-primary);
+}
+
+.deps-items {
+  list-style: none;
+  margin: 0;
+  padding: 0;
+  display: flex;
+  flex-direction: column;
+  gap: 8px;
+}
+
+.dep-item {
+  display: flex;
+  align-items: center;
+  gap: 12px;
+  padding: 12px 16px;
+  background: var(--bg-tertiary);
+  border-radius: var(--radius-md);
+  border: 1px solid var(--border-primary);
+}
+
+.dep-link {
+  color: var(--accent-primary);
+  font-weight: 500;
+  text-decoration: none;
+  font-family: 'JetBrains Mono', 'Fira Code', 'Consolas', monospace;
+  font-size: 0.875rem;
+}
+
+.dep-link:hover {
+  text-decoration: underline;
+}
+
+.dep-constraint {
+  color: var(--text-muted);
+  font-size: 0.8125rem;
+  font-family: 'JetBrains Mono', 'Fira Code', 'Consolas', monospace;
+}
+
+.dep-status {
+  margin-left: auto;
+  font-size: 0.875rem;
+  font-weight: 600;
+}
+
+.dep-status--ok {
+  color: var(--success-color, #10b981);
+}
+
+.dep-status--missing {
+  color: var(--warning-color, #f59e0b);
+}
+
+/* Tag name link in table */
+.tag-name-link {
+  color: var(--accent-primary);
+  transition: opacity var(--transition-fast);
+}
+
+.tag-name-link:hover {
+  opacity: 0.8;
+}
+
+.tag-name-link.selected {
+  text-decoration: underline;
+}
+
+/* Used By (Reverse Dependencies) Section */
+.used-by-section {
+  margin-top: 32px;
+  background: var(--bg-secondary);
+}
+
+.used-by-section h3 {
+  margin-bottom: 16px;
+  color: var(--text-primary);
+  font-size: 1rem;
+  font-weight: 600;
+}
+
+.reverse-dep-item {
+  display: flex;
+  align-items: center;
+  gap: 12px;
+  flex-wrap: wrap;
+}
+
+.dep-version {
+  color: var(--accent-primary);
+  font-family: 'JetBrains Mono', 'Fira Code', 'Consolas', monospace;
+  font-size: 0.8125rem;
+  background: rgba(16, 185, 129, 0.1);
+  padding: 2px 8px;
+  border-radius: var(--radius-sm);
+}
+
+.dep-requires {
+  color: var(--text-muted);
+  font-size: 0.8125rem;
+  font-family: 'JetBrains Mono', 'Fira Code', 'Consolas', monospace;
+  margin-left: auto;
+}
+
+.reverse-deps-pagination {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  gap: 16px;
+  margin-top: 16px;
+  padding-top: 16px;
+  border-top: 1px solid var(--border-primary);
+}
+
+.pagination-info {
+  color: var(--text-secondary);
+  font-size: 0.875rem;
+}
+
+/* Ensure File Modal */
+.modal-overlay {
+  position: fixed;
+  top: 0;
+  left: 0;
+  right: 0;
+  bottom: 0;
+  background: rgba(0, 0, 0, 0.7);
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  z-index: 1000;
+  padding: 20px;
+}
+
+.ensure-file-modal {
+  background: var(--bg-secondary);
+  border: 1px solid var(--border-primary);
+  border-radius: var(--radius-lg);
+  max-width: 700px;
+  width: 100%;
+  max-height: 80vh;
+  display: flex;
+  flex-direction: column;
+  box-shadow: 0 20px 50px rgba(0, 0, 0, 0.5);
+}
+
+.ensure-file-header {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  padding: 16px 20px;
+  border-bottom: 1px solid var(--border-primary);
+}
+
+.ensure-file-header h3 {
+  margin: 0;
+  color: var(--text-primary);
+  font-size: 1rem;
+  font-weight: 600;
+}
+
+.ensure-file-actions {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+}
+
+.ensure-file-actions .copy-btn {
+  opacity: 1;
+  width: 32px;
+  height: 32px;
+}
+
+.modal-close {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  width: 32px;
+  height: 32px;
+  padding: 0;
+  background: transparent;
+  border: none;
+  border-radius: var(--radius-sm);
+  color: var(--text-muted);
+  cursor: pointer;
+  transition: all var(--transition-fast);
+}
+
+.modal-close:hover {
+  background: var(--bg-hover);
+  color: var(--text-primary);
+}
+
+.ensure-file-content {
+  flex: 1;
+  overflow: auto;
+  padding: 20px;
+}
+
+.ensure-file-loading {
+  color: var(--text-muted);
+  text-align: center;
+  padding: 40px 20px;
+}
+
+.ensure-file-error {
+  color: var(--error-color, #ef4444);
+  padding: 16px;
+  background: rgba(239, 68, 68, 0.1);
+  border-radius: var(--radius-md);
+}
+
+.ensure-file-empty {
+  color: var(--text-muted);
+  text-align: center;
+  padding: 40px 20px;
+  font-style: italic;
+}
+
+.ensure-file-yaml {
+  margin: 0;
+  padding: 16px;
+  background: #0d0d0f;
+  border: 1px solid var(--border-primary);
+  border-radius: var(--radius-md);
+  overflow-x: auto;
+}
+
+.ensure-file-yaml code {
+  font-family: 'JetBrains Mono', 'Fira Code', 'Consolas', monospace;
+  font-size: 0.8125rem;
+  color: #e2e8f0;
+  white-space: pre;
+}
+
+.ensure-file-footer {
+  padding: 16px 20px;
+  border-top: 1px solid var(--border-primary);
+  background: var(--bg-tertiary);
+  border-radius: 0 0 var(--radius-lg) var(--radius-lg);
+}
+
+.ensure-file-hint {
+  margin: 0;
+  color: var(--text-muted);
+  font-size: 0.8125rem;
+}
+
+.ensure-file-hint code {
+  background: rgba(0, 0, 0, 0.2);
+  padding: 2px 6px;
+  border-radius: var(--radius-sm);
+  font-family: 'JetBrains Mono', 'Fira Code', 'Consolas', monospace;
+  color: var(--accent-primary);
+}
+
 /* Responsive adjustments */
@media (max-width: 768px) {
  .upload-form {
@@ -439,4 +779,18 @@ tr:hover .copy-btn {
    flex-wrap: wrap;
    gap: 12px;
  }
+
+  .dependencies-header {
+    flex-direction: column;
+    align-items: flex-start;
+    gap: 12px;
+  }
+
+  .tag-selector {
+    width: 100%;
+  }
+
+  .ensure-file-modal {
+    max-height: 90vh;
+  }
 }
--- a/frontend/src/pages/PackagePage.tsx
+++ b/frontend/src/pages/PackagePage.tsx
@@ -1,7 +1,7 @@
 import { useState, useEffect, useCallback } from 'react';
-import { useParams, useSearchParams, useNavigate, useLocation } from 'react-router-dom';
-import { TagDetail, Package, PaginatedResponse, AccessLevel } from '../types';
-import { listTags, getDownloadUrl, getPackage, getMyProjectAccess, createTag, UnauthorizedError, ForbiddenError } from '../api';
+import { useParams, useSearchParams, useNavigate, useLocation, Link } from 'react-router-dom';
+import { TagDetail, Package, PaginatedResponse, AccessLevel, Dependency, DependentInfo } from '../types';
+import { listTags, getDownloadUrl, getPackage, getMyProjectAccess, createTag, getArtifactDependencies, getReverseDependencies, getEnsureFile, UnauthorizedError, ForbiddenError } from '../api';
 import { Breadcrumb } from '../components/Breadcrumb';
 import { Badge } from '../components/Badge';
 import { SearchInput } from '../components/SearchInput';
@@ -10,6 +10,7 @@ import { DataTable } from '../components/DataTable';
 import { Pagination } from '../components/Pagination';
 import { DragDropUpload, UploadResult } from '../components/DragDropUpload';
 import { useAuth } from '../contexts/AuthContext';
+import DependencyGraph from '../components/DependencyGraph';
 import './Home.css';
 import './PackagePage.css';

@@ -68,6 +69,30 @@ function PackagePage() {
  const [createTagArtifactId, setCreateTagArtifactId] = useState('');
  const [createTagLoading, setCreateTagLoading] = useState(false);

+  // Dependencies state
+  const [selectedTag, setSelectedTag] = useState<TagDetail | null>(null);
+  const [dependencies, setDependencies] = useState<Dependency[]>([]);
+  const [depsLoading, setDepsLoading] = useState(false);
+  const [depsError, setDepsError] = useState<string | null>(null);
+
+  // Reverse dependencies state
+  const [reverseDeps, setReverseDeps] = useState<DependentInfo[]>([]);
+  const [reverseDepsLoading, setReverseDepsLoading] = useState(false);
+  const [reverseDepsError, setReverseDepsError] = useState<string | null>(null);
+  const [reverseDepsPage, setReverseDepsPage] = useState(1);
+  const [reverseDepsTotal, setReverseDepsTotal] = useState(0);
+  const [reverseDepsHasMore, setReverseDepsHasMore] = useState(false);
+
+  // Dependency graph modal state
+  const [showGraph, setShowGraph] = useState(false);
+
+  // Ensure file modal state
+  const [showEnsureFile, setShowEnsureFile] = useState(false);
+  const [ensureFileContent, setEnsureFileContent] = useState<string | null>(null);
+  const [ensureFileLoading, setEnsureFileLoading] = useState(false);
+  const [ensureFileError, setEnsureFileError] = useState<string | null>(null);
+  const [ensureFileTagName, setEnsureFileTagName] = useState<string | null>(null);
+
  // Derived permissions
  const canWrite = accessLevel === 'write' || accessLevel === 'admin';

@@ -128,6 +153,98 @@ function PackagePage() {
    loadData();
  }, [loadData]);

+  // Auto-select tag when tags are loaded (prefer version from URL, then first tag)
+  // Re-run when package changes to pick up new tags
+  useEffect(() => {
+    if (tagsData?.items && tagsData.items.length > 0) {
+      const versionParam = searchParams.get('version');
+      if (versionParam) {
+        // Find tag matching the version parameter
+        const matchingTag = tagsData.items.find(t => t.version === versionParam);
+        if (matchingTag) {
+          setSelectedTag(matchingTag);
+          setDependencies([]);
+          return;
+        }
+      }
+      // Fall back to first tag
+      setSelectedTag(tagsData.items[0]);
+      setDependencies([]);
+    }
+  }, [tagsData, searchParams, projectName, packageName]);
+
+  // Fetch dependencies when selected tag changes
+  const fetchDependencies = useCallback(async (artifactId: string) => {
+    setDepsLoading(true);
+    setDepsError(null);
+    try {
+      const result = await getArtifactDependencies(artifactId);
+      setDependencies(result.dependencies);
+    } catch (err) {
+      setDepsError(err instanceof Error ? err.message : 'Failed to load dependencies');
+      setDependencies([]);
+    } finally {
+      setDepsLoading(false);
+    }
+  }, []);
+
+  useEffect(() => {
+    if (selectedTag) {
+      fetchDependencies(selectedTag.artifact_id);
+    }
+  }, [selectedTag, fetchDependencies]);
+
+  // Fetch reverse dependencies
+  const fetchReverseDeps = useCallback(async (pageNum: number = 1) => {
+    if (!projectName || !packageName) return;
+
+    setReverseDepsLoading(true);
+    setReverseDepsError(null);
+    try {
+      const result = await getReverseDependencies(projectName, packageName, { page: pageNum, limit: 10 });
+      setReverseDeps(result.dependents);
+      setReverseDepsTotal(result.pagination.total);
+      setReverseDepsHasMore(result.pagination.has_more);
+      setReverseDepsPage(pageNum);
+    } catch (err) {
+      setReverseDepsError(err instanceof Error ? err.message : 'Failed to load reverse dependencies');
+      setReverseDeps([]);
+    } finally {
+      setReverseDepsLoading(false);
+    }
+  }, [projectName, packageName]);
+
+  useEffect(() => {
+    if (projectName && packageName && !loading) {
+      fetchReverseDeps(1);
+    }
+  }, [projectName, packageName, loading, fetchReverseDeps]);
+
+  // Fetch ensure file for a specific tag
+  const fetchEnsureFileForTag = useCallback(async (tagName: string) => {
+    if (!projectName || !packageName) return;
+
+    setEnsureFileTagName(tagName);
+    setEnsureFileLoading(true);
+    setEnsureFileError(null);
+    try {
+      const content = await getEnsureFile(projectName, packageName, tagName);
+      setEnsureFileContent(content);
+      setShowEnsureFile(true);
+    } catch (err) {
+      setEnsureFileError(err instanceof Error ? err.message : 'Failed to load ensure file');
+      setShowEnsureFile(true);
+    } finally {
+      setEnsureFileLoading(false);
+    }
+  }, [projectName, packageName]);
+
+  // Fetch ensure file for selected tag
+  const fetchEnsureFile = useCallback(async () => {
+    if (!selectedTag) return;
+    fetchEnsureFileForTag(selectedTag.name);
+  }, [selectedTag, fetchEnsureFileForTag]);
+
  // Keyboard navigation - go back with backspace
  useEffect(() => {
    const handleKeyDown = (e: KeyboardEvent) => {
@@ -202,12 +319,24 @@ function PackagePage() {
  const tags = tagsData?.items || [];
  const pagination = tagsData?.pagination;

+  const handleTagSelect = (tag: TagDetail) => {
+    setSelectedTag(tag);
+  };
+
  const columns = [
    {
      key: 'name',
      header: 'Tag',
      sortable: true,
-      render: (t: TagDetail) => <strong>{t.name}</strong>,
+      render: (t: TagDetail) => (
+        <strong
+          className={`tag-name-link ${selectedTag?.id === t.id ? 'selected' : ''}`}
+          onClick={() => handleTagSelect(t)}
+          style={{ cursor: 'pointer' }}
+        >
+          {t.name}
+        </strong>
+      ),
    },
    {
      key: 'version',
@@ -261,13 +390,22 @@ function PackagePage() {
      key: 'actions',
      header: 'Actions',
      render: (t: TagDetail) => (
-        <a
-          href={getDownloadUrl(projectName!, packageName!, t.name)}
-          className="btn btn-secondary btn-small"
-          download
-        >
-          Download
-        </a>
+        <div className="action-buttons">
+          <button
+            className="btn btn-secondary btn-small"
+            onClick={() => fetchEnsureFileForTag(t.name)}
+            title="View orchard.ensure file"
+          >
+            Ensure
+          </button>
+          <a
+            href={getDownloadUrl(projectName!, packageName!, t.name)}
+            className="btn btn-secondary btn-small"
+            download
+          >
+            Download
+          </a>
+        </div>
      ),
    },
  ];
@@ -439,6 +577,166 @@ function PackagePage() {
        />
      )}

+      {/* Dependencies Section */}
+      {tags.length > 0 && (
+        <div className="dependencies-section card">
+          <div className="dependencies-header">
+            <h3>Dependencies</h3>
+            <div className="dependencies-controls">
+              {selectedTag && (
+                <>
+                  <button
+                    className="btn btn-secondary btn-small"
+                    onClick={fetchEnsureFile}
+                    disabled={ensureFileLoading}
+                    title="View orchard.ensure file"
+                  >
+                    <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" strokeWidth="2" style={{ marginRight: '6px' }}>
+                      <path d="M14 2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2V8z"></path>
+                      <polyline points="14 2 14 8 20 8"></polyline>
+                      <line x1="16" y1="13" x2="8" y2="13"></line>
+                      <line x1="16" y1="17" x2="8" y2="17"></line>
+                      <polyline points="10 9 9 9 8 9"></polyline>
+                    </svg>
+                    {ensureFileLoading ? 'Loading...' : 'View Ensure File'}
+                  </button>
+                  <button
+                    className="btn btn-secondary btn-small"
+                    onClick={() => setShowGraph(true)}
+                    title="View full dependency tree"
+                  >
+                    <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" strokeWidth="2" style={{ marginRight: '6px' }}>
+                      <circle cx="12" cy="12" r="3"></circle>
+                      <circle cx="4" cy="4" r="2"></circle>
+                      <circle cx="20" cy="4" r="2"></circle>
+                      <circle cx="4" cy="20" r="2"></circle>
+                      <circle cx="20" cy="20" r="2"></circle>
+                      <line x1="9.5" y1="9.5" x2="5.5" y2="5.5"></line>
+                      <line x1="14.5" y1="9.5" x2="18.5" y2="5.5"></line>
+                      <line x1="9.5" y1="14.5" x2="5.5" y2="18.5"></line>
+                      <line x1="14.5" y1="14.5" x2="18.5" y2="18.5"></line>
+                    </svg>
+                    View Graph
+                  </button>
+                </>
+              )}
+            </div>
+          </div>
+          <div className="dependencies-tag-select">
+            {selectedTag && (
+              <select
+                className="tag-selector"
+                value={selectedTag.id}
+                onChange={(e) => {
+                  const tag = tags.find(t => t.id === e.target.value);
+                  if (tag) setSelectedTag(tag);
+                }}
+              >
+                {tags.map(t => (
+                  <option key={t.id} value={t.id}>
+                    {t.name}{t.version ? ` (${t.version})` : ''}
+                  </option>
+                ))}
+              </select>
+            )}
+          </div>
+
+          {depsLoading ? (
+            <div className="deps-loading">Loading dependencies...</div>
+          ) : depsError ? (
+            <div className="deps-error">{depsError}</div>
+          ) : dependencies.length === 0 ? (
+            <div className="deps-empty">
+              {selectedTag ? (
+                <span><strong>{selectedTag.name}</strong> has no dependencies</span>
+              ) : (
+                <span>No dependencies</span>
+              )}
+            </div>
+          ) : (
+            <div className="deps-list">
+              <div className="deps-summary">
+                <strong>{selectedTag?.name}</strong> has {dependencies.length} {dependencies.length === 1 ? 'dependency' : 'dependencies'}:
+              </div>
+              <ul className="deps-items">
+                {dependencies.map((dep) => (
+                  <li key={dep.id} className="dep-item">
+                    <Link
+                      to={`/project/${dep.project}/${dep.package}`}
+                      className="dep-link"
+                    >
+                      {dep.project}/{dep.package}
+                    </Link>
+                    <span className="dep-constraint">
+                      @ {dep.version || dep.tag}
+                    </span>
+                    <span className="dep-status dep-status--ok" title="Package exists">
+                      &#10003;
+                    </span>
+                  </li>
+                ))}
+              </ul>
+            </div>
+          )}
+        </div>
+      )}
+
+      {/* Used By (Reverse Dependencies) Section */}
+      <div className="used-by-section card">
+        <h3>Used By</h3>
+
+        {reverseDepsLoading ? (
+          <div className="deps-loading">Loading reverse dependencies...</div>
+        ) : reverseDepsError ? (
+          <div className="deps-error">{reverseDepsError}</div>
+        ) : reverseDeps.length === 0 ? (
+          <div className="deps-empty">No packages depend on this package</div>
+        ) : (
+          <div className="reverse-deps-list">
+            <div className="deps-summary">
+              {reverseDepsTotal} {reverseDepsTotal === 1 ? 'package depends' : 'packages depend'} on this:
+            </div>
+            <ul className="deps-items">
+              {reverseDeps.map((dep) => (
+                <li key={dep.artifact_id} className="dep-item reverse-dep-item">
+                  <Link
+                    to={`/project/${dep.project}/${dep.package}${dep.version ? `?version=${dep.version}` : ''}`}
+                    className="dep-link"
+                  >
+                    {dep.project}/{dep.package}
+                    {dep.version && (
+                      <span className="dep-version">v{dep.version}</span>
+                    )}
+                  </Link>
+                  <span className="dep-requires">
+                    requires @ {dep.constraint_value}
+                  </span>
+                </li>
+              ))}
+            </ul>
+            {(reverseDepsHasMore || reverseDepsPage > 1) && (
+              <div className="reverse-deps-pagination">
+                <button
+                  className="btn btn-secondary btn-small"
+                  onClick={() => fetchReverseDeps(reverseDepsPage - 1)}
+                  disabled={reverseDepsPage <= 1 || reverseDepsLoading}
+                >
+                  Previous
+                </button>
+                <span className="pagination-info">Page {reverseDepsPage}</span>
+                <button
+                  className="btn btn-secondary btn-small"
+                  onClick={() => fetchReverseDeps(reverseDepsPage + 1)}
+                  disabled={!reverseDepsHasMore || reverseDepsLoading}
+                >
+                  Next
+                </button>
+              </div>
+            )}
+          </div>
+        )}
+      </div>
+
      <div className="download-by-id-section card">
        <h3>Download by Artifact ID</h3>
        <div className="download-by-id-form">
@@ -522,6 +820,58 @@ function PackagePage() {
          <code>curl -O {window.location.origin}/api/v1/project/{projectName}/{packageName}/+/v1.0.0</code>
        </pre>
      </div>
+
+      {/* Dependency Graph Modal */}
+      {showGraph && selectedTag && (
+        <DependencyGraph
+          projectName={projectName!}
+          packageName={packageName!}
+          tagName={selectedTag.name}
+          onClose={() => setShowGraph(false)}
+        />
+      )}
+
+      {/* Ensure File Modal */}
+      {showEnsureFile && (
+        <div className="modal-overlay" onClick={() => setShowEnsureFile(false)}>
+          <div className="ensure-file-modal" onClick={(e) => e.stopPropagation()}>
+            <div className="ensure-file-header">
+              <h3>orchard.ensure for {ensureFileTagName}</h3>
+              <div className="ensure-file-actions">
+                {ensureFileContent && (
+                  <CopyButton text={ensureFileContent} />
+                )}
+                <button
+                  className="modal-close"
+                  onClick={() => setShowEnsureFile(false)}
+                  title="Close"
+                >
+                  <svg width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" strokeWidth="2">
+                    <line x1="18" y1="6" x2="6" y2="18"></line>
+                    <line x1="6" y1="6" x2="18" y2="18"></line>
+                  </svg>
+                </button>
+              </div>
+            </div>
+            <div className="ensure-file-content">
+              {ensureFileLoading ? (
+                <div className="ensure-file-loading">Loading...</div>
+              ) : ensureFileError ? (
+                <div className="ensure-file-error">{ensureFileError}</div>
+              ) : ensureFileContent ? (
+                <pre className="ensure-file-yaml"><code>{ensureFileContent}</code></pre>
+              ) : (
+                <div className="ensure-file-empty">No dependencies defined for this artifact.</div>
+              )}
+            </div>
+            <div className="ensure-file-footer">
+              <p className="ensure-file-hint">
+                Save this as <code>orchard.ensure</code> in your project root to declare dependencies.
+              </p>
+            </div>
+          </div>
+        </div>
+      )}
    </div>
  );
 }
--- a/frontend/src/pages/ProjectPage.tsx
+++ b/frontend/src/pages/ProjectPage.tsx
@@ -8,7 +8,6 @@ import { DataTable } from '../components/DataTable';
 import { SearchInput } from '../components/SearchInput';
 import { FilterChip, FilterChipGroup } from '../components/FilterChip';
 import { Pagination } from '../components/Pagination';
-import { AccessManagement } from '../components/AccessManagement';
 import { useAuth } from '../contexts/AuthContext';
 import './Home.css';

@@ -211,15 +210,30 @@ function ProjectPage() {
            <span className="meta-item">by {project.created_by}</span>
          </div>
        </div>
-        {canWrite ? (
-          <button className="btn btn-primary" onClick={() => setShowForm(!showForm)}>
-            {showForm ? 'Cancel' : '+ New Package'}
-          </button>
-        ) : user ? (
-          <span className="text-muted" title="You have read-only access to this project">
-            Read-only access
-          </span>
-        ) : null}
+        <div className="page-header__actions">
+          {canAdmin && (
+            <button
+              className="btn btn-secondary"
+              onClick={() => navigate(`/project/${projectName}/settings`)}
+              title="Project Settings"
+            >
+              <svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round">
+                <circle cx="12" cy="12" r="3" />
+                <path d="M19.4 15a1.65 1.65 0 0 0 .33 1.82l.06.06a2 2 0 0 1 0 2.83 2 2 0 0 1-2.83 0l-.06-.06a1.65 1.65 0 0 0-1.82-.33 1.65 1.65 0 0 0-1 1.51V21a2 2 0 0 1-2 2 2 2 0 0 1-2-2v-.09A1.65 1.65 0 0 0 9 19.4a1.65 1.65 0 0 0-1.82.33l-.06.06a2 2 0 0 1-2.83 0 2 2 0 0 1 0-2.83l.06-.06a1.65 1.65 0 0 0 .33-1.82 1.65 1.65 0 0 0-1.51-1H3a2 2 0 0 1-2-2 2 2 0 0 1 2-2h.09A1.65 1.65 0 0 0 4.6 9a1.65 1.65 0 0 0-.33-1.82l-.06-.06a2 2 0 0 1 0-2.83 2 2 0 0 1 2.83 0l.06.06a1.65 1.65 0 0 0 1.82.33H9a1.65 1.65 0 0 0 1-1.51V3a2 2 0 0 1 2-2 2 2 0 0 1 2 2v.09a1.65 1.65 0 0 0 1 1.51 1.65 1.65 0 0 0 1.82-.33l.06-.06a2 2 0 0 1 2.83 0 2 2 0 0 1 0 2.83l-.06.06a1.65 1.65 0 0 0-.33 1.82V9a1.65 1.65 0 0 0 1.51 1H21a2 2 0 0 1 2 2 2 2 0 0 1-2 2h-.09a1.65 1.65 0 0 0-1.51 1z" />
+              </svg>
+              Settings
+            </button>
+          )}
+          {canWrite ? (
+            <button className="btn btn-primary" onClick={() => setShowForm(!showForm)}>
+              {showForm ? 'Cancel' : '+ New Package'}
+            </button>
+          ) : user ? (
+            <span className="text-muted" title="You have read-only access to this project">
+              Read-only access
+            </span>
+          ) : null}
+        </div>
      </div>

      {error && <div className="error-message">{error}</div>}
@@ -371,10 +385,6 @@ function ProjectPage() {
          onPageChange={handlePageChange}
        />
      )}
-
-      {canAdmin && projectName && (
-        <AccessManagement projectName={projectName} />
-      )}
    </div>
  );
 }
--- a/frontend/src/pages/ProjectSettingsPage.css
+++ b/frontend/src/pages/ProjectSettingsPage.css
@@ -0,0 +1,476 @@
+.project-settings-page {
+  max-width: 900px;
+  margin: 0 auto;
+}
+
+.project-settings-header {
+  margin-bottom: 32px;
+}
+
+.project-settings-header h1 {
+  font-size: 1.75rem;
+  font-weight: 600;
+  color: var(--text-primary);
+  margin-bottom: 8px;
+  letter-spacing: -0.02em;
+}
+
+.project-settings-subtitle {
+  color: var(--text-tertiary);
+  font-size: 0.9375rem;
+}
+
+.project-settings-loading {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  gap: 12px;
+  padding: 64px 24px;
+  color: var(--text-tertiary);
+  font-size: 0.9375rem;
+}
+
+.project-settings-spinner {
+  width: 20px;
+  height: 20px;
+  border: 2px solid var(--border-secondary);
+  border-top-color: var(--accent-primary);
+  border-radius: 50%;
+  animation: project-settings-spin 0.6s linear infinite;
+}
+
+@keyframes project-settings-spin {
+  to {
+    transform: rotate(360deg);
+  }
+}
+
+.project-settings-error {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  background: var(--error-bg);
+  border: 1px solid rgba(239, 68, 68, 0.2);
+  color: var(--error);
+  padding: 12px 16px;
+  border-radius: var(--radius-md);
+  margin-bottom: 24px;
+  font-size: 0.875rem;
+}
+
+.project-settings-success {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  background: var(--success-bg);
+  border: 1px solid rgba(34, 197, 94, 0.2);
+  color: var(--success);
+  padding: 12px 16px;
+  border-radius: var(--radius-md);
+  margin-bottom: 24px;
+  font-size: 0.875rem;
+  animation: project-settings-fade-in 0.2s ease;
+}
+
+@keyframes project-settings-fade-in {
+  from {
+    opacity: 0;
+    transform: translateY(-8px);
+  }
+  to {
+    opacity: 1;
+    transform: translateY(0);
+  }
+}
+
+.project-settings-section {
+  background: var(--bg-secondary);
+  border: 1px solid var(--border-primary);
+  border-radius: var(--radius-lg);
+  padding: 24px;
+  margin-bottom: 24px;
+}
+
+.project-settings-section h2 {
+  font-size: 1.125rem;
+  font-weight: 600;
+  color: var(--text-primary);
+  margin-bottom: 20px;
+  padding-bottom: 16px;
+  border-bottom: 1px solid var(--border-primary);
+}
+
+.project-settings-form {
+  display: flex;
+  flex-direction: column;
+  gap: 16px;
+}
+
+.project-settings-form-group {
+  display: flex;
+  flex-direction: column;
+  gap: 6px;
+}
+
+.project-settings-form-group label {
+  font-size: 0.8125rem;
+  font-weight: 500;
+  color: var(--text-secondary);
+}
+
+.project-settings-form-group textarea,
+.project-settings-form-group input[type="text"] {
+  padding: 12px 14px;
+  background: var(--bg-tertiary);
+  border: 1px solid var(--border-primary);
+  border-radius: var(--radius-md);
+  font-size: 0.875rem;
+  color: var(--text-primary);
+  transition: all var(--transition-fast);
+  font-family: inherit;
+  resize: vertical;
+}
+
+.project-settings-form-group textarea {
+  min-height: 100px;
+}
+
+.project-settings-form-group textarea::placeholder,
+.project-settings-form-group input::placeholder {
+  color: var(--text-muted);
+}
+
+.project-settings-form-group textarea:hover:not(:disabled),
+.project-settings-form-group input:hover:not(:disabled) {
+  border-color: var(--border-secondary);
+  background: var(--bg-elevated);
+}
+
+.project-settings-form-group textarea:focus,
+.project-settings-form-group input:focus {
+  outline: none;
+  border-color: var(--accent-primary);
+  box-shadow: 0 0 0 3px rgba(16, 185, 129, 0.15);
+  background: var(--bg-elevated);
+}
+
+.project-settings-form-group textarea:disabled,
+.project-settings-form-group input:disabled {
+  opacity: 0.6;
+  cursor: not-allowed;
+}
+
+.project-settings-checkbox-group {
+  flex-direction: row;
+  align-items: center;
+}
+
+.project-settings-checkbox-label {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  cursor: pointer;
+  font-size: 0.875rem;
+  font-weight: 400;
+  color: var(--text-secondary);
+  user-select: none;
+}
+
+.project-settings-checkbox-label input[type="checkbox"] {
+  position: absolute;
+  opacity: 0;
+  width: 0;
+  height: 0;
+}
+
+.project-settings-checkbox-custom {
+  width: 18px;
+  height: 18px;
+  background: var(--bg-tertiary);
+  border: 1px solid var(--border-secondary);
+  border-radius: var(--radius-sm);
+  transition: all var(--transition-fast);
+  position: relative;
+  flex-shrink: 0;
+}
+
+.project-settings-checkbox-label input[type="checkbox"]:checked + .project-settings-checkbox-custom {
+  background: var(--accent-primary);
+  border-color: var(--accent-primary);
+}
+
+.project-settings-checkbox-label input[type="checkbox"]:checked + .project-settings-checkbox-custom::after {
+  content: '';
+  position: absolute;
+  left: 5px;
+  top: 2px;
+  width: 5px;
+  height: 9px;
+  border: solid white;
+  border-width: 0 2px 2px 0;
+  transform: rotate(45deg);
+}
+
+.project-settings-checkbox-label input[type="checkbox"]:focus + .project-settings-checkbox-custom {
+  box-shadow: 0 0 0 3px rgba(16, 185, 129, 0.15);
+}
+
+.project-settings-checkbox-label:hover .project-settings-checkbox-custom {
+  border-color: var(--accent-primary);
+}
+
+.project-settings-form-actions {
+  display: flex;
+  justify-content: flex-end;
+  gap: 12px;
+  margin-top: 8px;
+}
+
+.project-settings-save-button {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  gap: 8px;
+  padding: 10px 18px;
+  background: var(--accent-gradient);
+  border: none;
+  border-radius: var(--radius-md);
+  font-size: 0.875rem;
+  font-weight: 500;
+  color: white;
+  cursor: pointer;
+  transition: all var(--transition-fast);
+  min-width: 120px;
+}
+
+.project-settings-save-button:hover:not(:disabled) {
+  transform: translateY(-1px);
+  box-shadow: var(--shadow-sm), 0 0 20px rgba(16, 185, 129, 0.2);
+}
+
+.project-settings-save-button:disabled {
+  opacity: 0.5;
+  cursor: not-allowed;
+  transform: none;
+}
+
+.project-settings-button-spinner {
+  width: 14px;
+  height: 14px;
+  border: 2px solid rgba(255, 255, 255, 0.3);
+  border-top-color: white;
+  border-radius: 50%;
+  animation: project-settings-spin 0.6s linear infinite;
+}
+
+/* Danger Zone */
+.project-settings-danger-zone {
+  background: var(--bg-secondary);
+  border: 1px solid rgba(239, 68, 68, 0.3);
+  border-radius: var(--radius-lg);
+  padding: 24px;
+  margin-bottom: 24px;
+}
+
+.project-settings-danger-zone h2 {
+  font-size: 1.125rem;
+  font-weight: 600;
+  color: var(--error);
+  margin-bottom: 20px;
+  padding-bottom: 16px;
+  border-bottom: 1px solid rgba(239, 68, 68, 0.2);
+}
+
+.project-settings-danger-item {
+  display: flex;
+  justify-content: space-between;
+  align-items: flex-start;
+  gap: 24px;
+}
+
+.project-settings-danger-info h3 {
+  font-size: 0.9375rem;
+  font-weight: 600;
+  color: var(--text-primary);
+  margin-bottom: 4px;
+}
+
+.project-settings-danger-info p {
+  color: var(--text-tertiary);
+  font-size: 0.8125rem;
+  max-width: 400px;
+}
+
+.project-settings-delete-button {
+  padding: 10px 18px;
+  background: transparent;
+  border: 1px solid rgba(239, 68, 68, 0.3);
+  border-radius: var(--radius-md);
+  font-size: 0.875rem;
+  font-weight: 500;
+  color: var(--error);
+  cursor: pointer;
+  transition: all var(--transition-fast);
+  flex-shrink: 0;
+}
+
+.project-settings-delete-button:hover:not(:disabled) {
+  background: var(--error-bg);
+  border-color: rgba(239, 68, 68, 0.5);
+}
+
+.project-settings-delete-button:disabled {
+  opacity: 0.5;
+  cursor: not-allowed;
+}
+
+/* Delete Confirmation */
+.project-settings-delete-confirm {
+  margin-top: 20px;
+  padding-top: 20px;
+  border-top: 1px solid rgba(239, 68, 68, 0.2);
+  animation: project-settings-fade-in 0.2s ease;
+}
+
+.project-settings-delete-confirm p {
+  color: var(--text-secondary);
+  font-size: 0.875rem;
+  margin-bottom: 12px;
+}
+
+.project-settings-delete-confirm strong {
+  color: var(--text-primary);
+  font-family: 'JetBrains Mono', 'Fira Code', 'SF Mono', Monaco, monospace;
+  background: var(--bg-tertiary);
+  padding: 2px 6px;
+  border-radius: var(--radius-sm);
+}
+
+.project-settings-delete-confirm-input {
+  width: 100%;
+  padding: 12px 14px;
+  background: var(--bg-tertiary);
+  border: 1px solid var(--border-primary);
+  border-radius: var(--radius-md);
+  font-size: 0.875rem;
+  color: var(--text-primary);
+  transition: all var(--transition-fast);
+  margin-bottom: 16px;
+}
+
+.project-settings-delete-confirm-input:focus {
+  outline: none;
+  border-color: var(--error);
+  box-shadow: 0 0 0 3px rgba(239, 68, 68, 0.15);
+}
+
+.project-settings-delete-confirm-input::placeholder {
+  color: var(--text-muted);
+}
+
+.project-settings-delete-confirm-actions {
+  display: flex;
+  gap: 12px;
+}
+
+.project-settings-confirm-delete-button {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  gap: 8px;
+  padding: 10px 18px;
+  background: var(--error);
+  border: none;
+  border-radius: var(--radius-md);
+  font-size: 0.875rem;
+  font-weight: 500;
+  color: white;
+  cursor: pointer;
+  transition: all var(--transition-fast);
+  min-width: 120px;
+}
+
+.project-settings-confirm-delete-button:hover:not(:disabled) {
+  opacity: 0.9;
+}
+
+.project-settings-confirm-delete-button:disabled {
+  opacity: 0.5;
+  cursor: not-allowed;
+}
+
+.project-settings-cancel-button {
+  padding: 10px 18px;
+  background: transparent;
+  border: 1px solid var(--border-primary);
+  border-radius: var(--radius-md);
+  font-size: 0.875rem;
+  font-weight: 500;
+  color: var(--text-secondary);
+  cursor: pointer;
+  transition: all var(--transition-fast);
+}
+
+.project-settings-cancel-button:hover:not(:disabled) {
+  background: var(--bg-hover);
+  border-color: var(--border-secondary);
+  color: var(--text-primary);
+}
+
+.project-settings-cancel-button:disabled {
+  opacity: 0.5;
+  cursor: not-allowed;
+}
+
+.project-settings-delete-spinner {
+  width: 14px;
+  height: 14px;
+  border: 2px solid rgba(255, 255, 255, 0.3);
+  border-top-color: white;
+  border-radius: 50%;
+  animation: project-settings-spin 0.6s linear infinite;
+}
+
+/* Access denied */
+.project-settings-access-denied {
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  justify-content: center;
+  padding: 80px 24px;
+  text-align: center;
+}
+
+.project-settings-access-denied h2 {
+  font-size: 1.5rem;
+  font-weight: 600;
+  color: var(--text-primary);
+  margin-bottom: 12px;
+}
+
+.project-settings-access-denied p {
+  color: var(--text-tertiary);
+  font-size: 0.9375rem;
+  max-width: 400px;
+}
+
+/* Responsive */
+@media (max-width: 768px) {
+  .project-settings-danger-item {
+    flex-direction: column;
+    gap: 16px;
+  }
+
+  .project-settings-delete-button {
+    align-self: flex-start;
+  }
+
+  .project-settings-delete-confirm-actions {
+    flex-direction: column;
+  }
+
+  .project-settings-confirm-delete-button,
+  .project-settings-cancel-button {
+    width: 100%;
+  }
+}
--- a/frontend/src/pages/ProjectSettingsPage.tsx
+++ b/frontend/src/pages/ProjectSettingsPage.tsx
@@ -0,0 +1,308 @@
+import { useState, useEffect, useCallback } from 'react';
+import { useParams, useNavigate } from 'react-router-dom';
+import { Project } from '../types';
+import {
+  getProject,
+  updateProject,
+  deleteProject,
+  getMyProjectAccess,
+  UnauthorizedError,
+  ForbiddenError,
+} from '../api';
+import { Breadcrumb } from '../components/Breadcrumb';
+import { AccessManagement } from '../components/AccessManagement';
+import { useAuth } from '../contexts/AuthContext';
+import './ProjectSettingsPage.css';
+
+function ProjectSettingsPage() {
+  const { projectName } = useParams<{ projectName: string }>();
+  const navigate = useNavigate();
+  const { user } = useAuth();
+
+  const [project, setProject] = useState<Project | null>(null);
+  const [loading, setLoading] = useState(true);
+  const [error, setError] = useState<string | null>(null);
+  const [success, setSuccess] = useState<string | null>(null);
+  const [accessDenied, setAccessDenied] = useState(false);
+  const [canAdmin, setCanAdmin] = useState(false);
+
+  // General settings form state
+  const [description, setDescription] = useState('');
+  const [isPublic, setIsPublic] = useState(false);
+  const [saving, setSaving] = useState(false);
+
+  // Delete confirmation state
+  const [showDeleteConfirm, setShowDeleteConfirm] = useState(false);
+  const [deleteConfirmText, setDeleteConfirmText] = useState('');
+  const [deleting, setDeleting] = useState(false);
+
+  const loadData = useCallback(async () => {
+    if (!projectName) return;
+
+    try {
+      setLoading(true);
+      setAccessDenied(false);
+      const [projectData, accessResult] = await Promise.all([
+        getProject(projectName),
+        getMyProjectAccess(projectName),
+      ]);
+      setProject(projectData);
+      setDescription(projectData.description || '');
+      setIsPublic(projectData.is_public);
+
+      const hasAdminAccess = accessResult.access_level === 'admin';
+      setCanAdmin(hasAdminAccess);
+
+      if (!hasAdminAccess) {
+        setAccessDenied(true);
+      }
+
+      setError(null);
+    } catch (err) {
+      if (err instanceof UnauthorizedError) {
+        navigate('/login', { state: { from: `/project/${projectName}/settings` } });
+        return;
+      }
+      if (err instanceof ForbiddenError) {
+        setAccessDenied(true);
+        setLoading(false);
+        return;
+      }
+      setError(err instanceof Error ? err.message : 'Failed to load project');
+    } finally {
+      setLoading(false);
+    }
+  }, [projectName, navigate]);
+
+  useEffect(() => {
+    loadData();
+  }, [loadData]);
+
+  const handleSaveSettings = async (e: React.FormEvent) => {
+    e.preventDefault();
+    if (!projectName) return;
+
+    try {
+      setSaving(true);
+      setError(null);
+      const updatedProject = await updateProject(projectName, {
+        description: description || undefined,
+        is_public: isPublic,
+      });
+      setProject(updatedProject);
+      setSuccess('Settings saved successfully');
+      setTimeout(() => setSuccess(null), 3000);
+    } catch (err) {
+      setError(err instanceof Error ? err.message : 'Failed to save settings');
+    } finally {
+      setSaving(false);
+    }
+  };
+
+  const handleDeleteProject = async () => {
+    if (!projectName || deleteConfirmText !== projectName) return;
+
+    try {
+      setDeleting(true);
+      setError(null);
+      await deleteProject(projectName);
+      navigate('/');
+    } catch (err) {
+      setError(err instanceof Error ? err.message : 'Failed to delete project');
+      setDeleting(false);
+    }
+  };
+
+  const handleCancelDelete = () => {
+    setShowDeleteConfirm(false);
+    setDeleteConfirmText('');
+  };
+
+  if (loading) {
+    return (
+      <div className="project-settings-page">
+        <Breadcrumb
+          items={[
+            { label: 'Projects', href: '/' },
+            { label: projectName || '', href: `/project/${projectName}` },
+            { label: 'Settings' },
+          ]}
+        />
+        <div className="project-settings-loading">
+          <div className="project-settings-spinner" />
+          <span>Loading...</span>
+        </div>
+      </div>
+    );
+  }
+
+  if (accessDenied || !canAdmin) {
+    return (
+      <div className="project-settings-page">
+        <Breadcrumb
+          items={[
+            { label: 'Projects', href: '/' },
+            { label: projectName || '', href: `/project/${projectName}` },
+            { label: 'Settings' },
+          ]}
+        />
+        <div className="project-settings-access-denied">
+          <h2>Access Denied</h2>
+          <p>You must be a project admin to access settings.</p>
+          {!user && (
+            <p style={{ marginTop: '16px' }}>
+              <a href="/login" className="btn btn-primary">
+                Sign in
+              </a>
+            </p>
+          )}
+        </div>
+      </div>
+    );
+  }
+
+  if (!project) {
+    return (
+      <div className="project-settings-page">
+        <Breadcrumb
+          items={[
+            { label: 'Projects', href: '/' },
+            { label: projectName || '' },
+          ]}
+        />
+        <div className="project-settings-error">Project not found</div>
+      </div>
+    );
+  }
+
+  return (
+    <div className="project-settings-page">
+      <Breadcrumb
+        items={[
+          { label: 'Projects', href: '/' },
+          { label: project.name, href: `/project/${project.name}` },
+          { label: 'Settings' },
+        ]}
+      />
+
+      <div className="project-settings-header">
+        <h1>Project Settings</h1>
+        <p className="project-settings-subtitle">Manage settings for {project.name}</p>
+      </div>
+
+      {error && <div className="project-settings-error">{error}</div>}
+      {success && <div className="project-settings-success">{success}</div>}
+
+      {/* General Settings Section */}
+      <div className="project-settings-section">
+        <h2>General</h2>
+        <form className="project-settings-form" onSubmit={handleSaveSettings}>
+          <div className="project-settings-form-group">
+            <label htmlFor="description">Description</label>
+            <textarea
+              id="description"
+              value={description}
+              onChange={(e) => setDescription(e.target.value)}
+              placeholder="Describe your project..."
+              disabled={saving}
+            />
+          </div>
+
+          <div className="project-settings-form-group project-settings-checkbox-group">
+            <label className="project-settings-checkbox-label">
+              <input
+                type="checkbox"
+                checked={isPublic}
+                onChange={(e) => setIsPublic(e.target.checked)}
+                disabled={saving}
+              />
+              <span className="project-settings-checkbox-custom" />
+              <span>Public project (visible to everyone)</span>
+            </label>
+          </div>
+
+          <div className="project-settings-form-actions">
+            <button type="submit" className="project-settings-save-button" disabled={saving}>
+              {saving ? (
+                <>
+                  <span className="project-settings-button-spinner" />
+                  Saving...
+                </>
+              ) : (
+                'Save Changes'
+              )}
+            </button>
+          </div>
+        </form>
+      </div>
+
+      {/* Access Management Section */}
+      <AccessManagement projectName={projectName!} />
+
+      {/* Danger Zone Section */}
+      <div className="project-settings-danger-zone">
+        <h2>Danger Zone</h2>
+        <div className="project-settings-danger-item">
+          <div className="project-settings-danger-info">
+            <h3>Delete this project</h3>
+            <p>
+              Once you delete a project, there is no going back. This will permanently delete the
+              project, all packages, artifacts, and tags.
+            </p>
+          </div>
+          {!showDeleteConfirm && (
+            <button
+              className="project-settings-delete-button"
+              onClick={() => setShowDeleteConfirm(true)}
+              disabled={deleting}
+            >
+              Delete Project
+            </button>
+          )}
+        </div>
+
+        {showDeleteConfirm && (
+          <div className="project-settings-delete-confirm">
+            <p>
+              Type <strong>{project.name}</strong> to confirm deletion:
+            </p>
+            <input
+              type="text"
+              className="project-settings-delete-confirm-input"
+              value={deleteConfirmText}
+              onChange={(e) => setDeleteConfirmText(e.target.value)}
+              placeholder={project.name}
+              disabled={deleting}
+              autoFocus
+            />
+            <div className="project-settings-delete-confirm-actions">
+              <button
+                className="project-settings-confirm-delete-button"
+                onClick={handleDeleteProject}
+                disabled={deleting || deleteConfirmText !== project.name}
+              >
+                {deleting ? (
+                  <>
+                    <span className="project-settings-delete-spinner" />
+                    Deleting...
+                  </>
+                ) : (
+                  'Yes, delete this project'
+                )}
+              </button>
+              <button
+                className="project-settings-cancel-button"
+                onClick={handleCancelDelete}
+                disabled={deleting}
+              >
+                Cancel
+              </button>
+            </div>
+          </div>
+        )}
+      </div>
+    </div>
+  );
+}
+
+export default ProjectSettingsPage;
--- a/frontend/src/types.ts
+++ b/frontend/src/types.ts
@@ -373,3 +373,77 @@ export interface OIDCStatus {
  enabled: boolean;
  issuer_url?: string;
 }
+
+// Dependency types
+export interface Dependency {
+  id: string;
+  artifact_id: string;
+  project: string;
+  package: string;
+  version: string | null;
+  tag: string | null;
+  created_at: string;
+}
+
+export interface ArtifactDependenciesResponse {
+  artifact_id: string;
+  dependencies: Dependency[];
+}
+
+export interface DependentInfo {
+  artifact_id: string;
+  project: string;
+  package: string;
+  version: string | null;
+  constraint_type: 'version' | 'tag';
+  constraint_value: string;
+}
+
+export interface ReverseDependenciesResponse {
+  project: string;
+  package: string;
+  dependents: DependentInfo[];
+  pagination: {
+    page: number;
+    limit: number;
+    total: number;
+    total_pages: number;
+    has_more: boolean;
+  };
+}
+
+// Dependency Resolution types
+export interface ResolvedArtifact {
+  artifact_id: string;
+  project: string;
+  package: string;
+  version: string | null;
+  tag: string | null;
+  size: number;
+  download_url: string;
+}
+
+export interface DependencyResolutionResponse {
+  requested: {
+    project: string;
+    package: string;
+    ref: string;
+  };
+  resolved: ResolvedArtifact[];
+  total_size: number;
+  artifact_count: number;
+}
+
+export interface DependencyResolutionError {
+  error: 'circular_dependency' | 'dependency_conflict' | 'not_found';
+  message: string;
+  cycle?: string[];
+  conflicts?: Array<{
+    project: string;
+    package: string;
+    requirements: Array<{
+      version: string;
+      required_by: Array<{ path: string }>;
+    }>;
+  }>;
+}
--- a/helm/orchard/templates/deployment.yaml
+++ b/helm/orchard/templates/deployment.yaml
@@ -69,6 +69,8 @@ spec:
              containerPort: {{ .Values.orchard.server.port }}
              protocol: TCP
          env:
+            - name: ORCHARD_ENV
+              value: {{ .Values.orchard.env | default "development" | quote }}
            - name: ORCHARD_SERVER_HOST
              value: {{ .Values.orchard.server.host | quote }}
            - name: ORCHARD_SERVER_PORT
--- a/helm/orchard/values-dev.yaml
+++ b/helm/orchard/values-dev.yaml
@@ -85,6 +85,7 @@ tolerations: []
 affinity: {}

 orchard:
+  env: "development"  # Allows seed data for testing
  server:
    host: "0.0.0.0"
    port: 8080
--- a/helm/orchard/values-prod.yaml
+++ b/helm/orchard/values-prod.yaml
@@ -88,6 +88,7 @@ tolerations: []
 affinity: {}

 orchard:
+  env: "production"  # Disables seed data
  server:
    host: "0.0.0.0"
    port: 8080
--- a/helm/orchard/values-stage.yaml
+++ b/helm/orchard/values-stage.yaml
@@ -90,6 +90,7 @@ affinity: {}

 # Orchard server configuration
 orchard:
+  env: "development"  # Allows seed data for testing
  server:
    host: "0.0.0.0"
    port: 8080
--- a/migrations/008_artifact_dependencies.sql
+++ b/migrations/008_artifact_dependencies.sql
@@ -0,0 +1,48 @@
+-- Migration 008: Artifact Dependencies
+-- Adds support for declaring dependencies between artifacts
+-- Part of Package Dependency Management feature (#76)
+
+-- Create artifact_dependencies table
+CREATE TABLE IF NOT EXISTS artifact_dependencies (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    artifact_id VARCHAR(64) NOT NULL REFERENCES artifacts(id) ON DELETE CASCADE,
+    dependency_project VARCHAR(255) NOT NULL,
+    dependency_package VARCHAR(255) NOT NULL,
+    version_constraint VARCHAR(255),
+    tag_constraint VARCHAR(255),
+    created_at TIMESTAMP WITH TIME ZONE DEFAULT CURRENT_TIMESTAMP,
+
+    -- Exactly one of version_constraint or tag_constraint must be set
+    CONSTRAINT check_constraint_type CHECK (
+        (version_constraint IS NOT NULL AND tag_constraint IS NULL) OR
+        (version_constraint IS NULL AND tag_constraint IS NOT NULL)
+    ),
+
+    -- Each artifact can only have one dependency on a specific project/package
+    CONSTRAINT unique_artifact_dependency UNIQUE (artifact_id, dependency_project, dependency_package)
+);
+
+-- Index for fast lookups by artifact_id (get all deps for an artifact)
+CREATE INDEX IF NOT EXISTS idx_artifact_dependencies_artifact_id
+    ON artifact_dependencies(artifact_id);
+
+-- Index for reverse dependency lookups (find what depends on a package)
+CREATE INDEX IF NOT EXISTS idx_artifact_dependencies_target
+    ON artifact_dependencies(dependency_project, dependency_package);
+
+-- Index for finding dependencies with specific version constraints
+CREATE INDEX IF NOT EXISTS idx_artifact_dependencies_version
+    ON artifact_dependencies(dependency_project, dependency_package, version_constraint)
+    WHERE version_constraint IS NOT NULL;
+
+-- Index for finding dependencies with specific tag constraints
+CREATE INDEX IF NOT EXISTS idx_artifact_dependencies_tag
+    ON artifact_dependencies(dependency_project, dependency_package, tag_constraint)
+    WHERE tag_constraint IS NOT NULL;
+
+COMMENT ON TABLE artifact_dependencies IS 'Stores dependencies declared by artifacts on other packages';
+COMMENT ON COLUMN artifact_dependencies.artifact_id IS 'The artifact that declares this dependency';
+COMMENT ON COLUMN artifact_dependencies.dependency_project IS 'Project name of the dependency';
+COMMENT ON COLUMN artifact_dependencies.dependency_package IS 'Package name of the dependency';
+COMMENT ON COLUMN artifact_dependencies.version_constraint IS 'Exact version required (mutually exclusive with tag_constraint)';
+COMMENT ON COLUMN artifact_dependencies.tag_constraint IS 'Tag name required (mutually exclusive with version_constraint)';
Author	SHA1	Message	Date
Mondo Diaz	ba7cd96107	Add package dependencies and project settings page Package Dependencies: - Add artifact dependency management system - Add dependency API endpoints (get, resolve, reverse) - Add ensure file parsing for declaring dependencies - Add circular dependency and conflict detection - Add frontend dependency visualization with graph modal - Add migration for artifact_dependencies table Project Settings Page (#65): - Add dedicated settings page for project admins - General settings section (description, visibility) - Access management section (moved from project page) - Danger zone with inline delete confirmation - Add Settings button to project page header	2026-01-27 15:29:51 +00:00
Mondo Diaz	6c8b922818	Merge branch 'fix/reset-stage-before-tests' into 'main' Add pre-test stage reset to ensure known environment state See merge request esv/bsf/bsf-integration/orchard/orchard-mvp!44	2026-01-26 09:13:04 -06:00
Mondo Diaz	99d28cf9c6	Add pre-test stage reset to ensure known environment state	2026-01-26 09:13:03 -06:00
Dane Moss	b5579f1643	Merge branch 'release_0.5.1' into 'main' add CL entry to bump version See merge request esv/bsf/bsf-integration/orchard/orchard-mvp!43	2026-01-23 15:37:09 -07:00
Dane Moss	fafa03e4ce	add CL entry to bump version	2026-01-23 15:37:09 -07:00
Mondo Diaz	d4b2da3232	Merge branch 'fix/release-wait-for-stage-tests' into 'main' Add gitleaks fingerprint for test file false positive See merge request esv/bsf/bsf-integration/orchard/orchard-mvp!42	2026-01-23 16:16:03 -06:00
Mondo Diaz	7b04bbdf05	Add gitleaks fingerprint for test file false positive	2026-01-23 16:16:02 -06:00
Mondo Diaz	3a807870a3	Merge branch 'fix/ci-prod-namespace' into 'main' Fix production CI deployment and simplify tag pipeline See merge request esv/bsf/bsf-integration/orchard/orchard-mvp!41	2026-01-23 15:50:24 -06:00
Mondo Diaz	f966fde7df	Fix production CI deployment and simplify tag pipeline	2026-01-23 15:50:24 -06:00
Mondo Diaz	133d9cbfd6	Merge branch 'bump_version' into 'main' add changelog entry to cut a new release See merge request esv/bsf/bsf-integration/orchard/orchard-mvp!40	2026-01-23 13:00:51 -06:00
Dane Moss	276b4f2743	add changelog entry to cut a new release	2026-01-23 10:46:20 -07:00
Mondo Diaz	67ac6bb3f8	Merge branch 'fix/factory-reset-admin-user' into 'main' Update CHANGELOG with factory reset fixes (#60) See merge request esv/bsf/bsf-integration/orchard/orchard-mvp!39	2026-01-23 09:33:01 -06:00
Mondo Diaz	b0bb3ed569	Update CHANGELOG with factory reset fixes (#60 )	2026-01-21 23:44:45 +00:00
Mondo Diaz	1ac75e1017	Fix factory reset and improve reset_stage CI job - Add create_default_admin() call to factory reset (admin user wasn't being created after reset, only on server restart) - Add retry logic to reset_stage CI job (3 attempts with 5s delay) - Use proper context manager for httpx client - Increase timeout to 120s for reset operation - Add retry: 1 at job level for transient failures	2026-01-21 23:20:48 +00:00
Mondo Diaz	693613f111	Fix factory reset - capture username before dropping tables	2026-01-21 23:18:29 +00:00
Mondo Diaz	9da4ae8c0d	Add gitleaks fingerprint for test file false positive	2026-01-21 22:59:08 +00:00
Mondo Diaz	7ffdc64364	Fix seed_database call in factory reset - pass fresh db session	2026-01-21 22:51:03 +00:00
Mondo Diaz	6abc0c88b0	Merge branch 'feature/stage-reset-job' into 'main' Fix reset_stage job to read STAGE_URL from environment See merge request esv/bsf/bsf-integration/orchard/orchard-mvp!38	2026-01-21 16:39:39 -06:00
Mondo Diaz	e96dc5cde8	Fix reset_stage job to read STAGE_URL from environment	2026-01-21 22:25:04 +00:00