diff --git a/.agents/skills/golang-pro/SKILL.md b/.agents/skills/golang-pro/SKILL.md
index 378bf7ea..4023f53e 100644
--- a/.agents/skills/golang-pro/SKILL.md
+++ b/.agents/skills/golang-pro/SKILL.md
@@ -97,9 +97,10 @@ Key properties demonstrated: bounded goroutine lifetime via `ctx`, error propaga
 - Handle all errors explicitly (no naked returns)
 - Write table-driven tests with subtests
 - Document all exported functions, types, and packages
-- Use `X | Y` union constraints for generics (Go 1.18+)
+	- Use `X | Y` union constraints for generics (Go 1.18+)
 - Propagate errors with fmt.Errorf("%w", err)
 - Run race detector on tests (-race flag)
+- Maintain pure domain entities (strict DDD): NEVER use `json:"..."`, `db:"..."` or other presentation/infrastructure tags in `internal/core/domain`. Map in **`internal/presentation/dto/`**: outbound **`{Type}FromDomain(domain.X)`** package funcs; inbound **`(r R) ToDomain()`** / **`ToPatch()`** on request DTOs. **Never pass `dto.*` to repositories** — only `domain.*` crosses the port boundary.
 
 ### MUST NOT DO
 - Ignore errors (avoid _ assignment without justification)
diff --git a/.agents/skills/golang-pro/references/wpd-message-gateway.md b/.agents/skills/golang-pro/references/wpd-message-gateway.md
index c3c3be72..64ebbcac 100644
--- a/.agents/skills/golang-pro/references/wpd-message-gateway.md
+++ b/.agents/skills/golang-pro/references/wpd-message-gateway.md
@@ -29,7 +29,7 @@ Router → Middleware → Handler → Service → Port ← Repository / Provider
 | Port | `internal/core/port/` | domain, `pkg/contracts` | implementations |
 | Service | `internal/core/service/` | port, domain, `pkg/contracts`, `pkg/registry` | SQL, HTTP, Echo |
 | Infrastructure | `internal/infrastructure/` | port, domain | presentation |
-| Presentation | `internal/presentation/` | service, port, domain | direct SQL |
+| Presentation | `internal/presentation/` | service, port, domain, **dto** | direct SQL; **inline HTTP DTOs in handlers**; **passing dto to port/repo** |
 | Public SDK | `pkg/*` | `pkg/*` only | `internal/*` |
 
 Sender interfaces (`EmailSender`, `SMSSender`, …) live in **`pkg/contracts/`**, not `internal/core/port/`.
@@ -42,7 +42,7 @@ Sender interfaces (`EmailSender`, `SMSSender`, …) live in **`pkg/contracts/`**
 2. Register via `init()` in `register.go` → `pkg/registry`
 3. Blank-import in **`internal/app/imports.go`** (server mode only)
 
-Do **not** add providers under `internal/infrastructure/provider/` (deprecated).
+Add providers only under **`pkg/provider/<name>/`** (registered via `pkg/registry`, blank-imported in `internal/app/imports.go`).
 
 ---
 
@@ -60,6 +60,7 @@ Do **not** add providers under `internal/infrastructure/provider/` (deprecated).
 - Wrap with `fmt.Errorf("…: %w", err)`
 - Domain/port sentinels: `port.ErrNotFound`, `port.ErrConflict`, etc.
 - Handlers: generic messages on 500; full error in slog only (`send_helper.go` pattern)
+- **HTTP DTOs:** live in **`internal/presentation/dto/`** — never in handlers. Outbound: **`dto.XFromDomain(domain.Y)`** package funcs. Inbound: **`(r R) ToDomain()`** (→ `domain.*`) or **`ToPatch()`** (→ `service.*Patch`). **Ports/repos use `domain.*` only** — never import or accept `dto.*` (see `docs/backend/code-conventions.md`).
 
 ### Concurrency
 
@@ -106,7 +107,7 @@ wpd-message-gateway/
 │   ├── app/              # wire, imports, config
 │   ├── core/             # domain, port, service
 │   ├── infrastructure/   # postgres repos, logger, inbox store
-│   └── presentation/     # router, handlers, middleware
+│   └── presentation/     # router, handlers, middleware, dto/
 ├── pkg/
 │   ├── contracts/        # message types + sender interfaces
 │   ├── gateway/          # embedded SDK
diff --git a/.agents/skills/software-architecture/SKILL.md b/.agents/skills/software-architecture/SKILL.md
index 4aff70f7..8aa6af9f 100644
--- a/.agents/skills/software-architecture/SKILL.md
+++ b/.agents/skills/software-architecture/SKILL.md
@@ -40,6 +40,7 @@ This skill provides guidance for quality focused software development and archit
 - **Clean Architecture & DDD Principles:**
   - Follow domain-driven design and ubiquitous language
   - Separate domain entities from infrastructure concerns
+  - **Strict boundary**: Presentation data transfer objects (DTOs) must be completely separate from Domain entities. The Presentation layer is responsible for mapping Domain objects to DTOs. Domain objects must never contain presentation tags (e.g. JSON) and must never be serialized directly.
   - Keep business logic independent of frameworks
   - Define use cases clearly and keep them isolated
 - **Naming Conventions:**
diff --git a/.agents/skills/software-architecture/references/wpd-message-gateway.md b/.agents/skills/software-architecture/references/wpd-message-gateway.md
index 0acc68f0..b57e6c68 100644
--- a/.agents/skills/software-architecture/references/wpd-message-gateway.md
+++ b/.agents/skills/software-architecture/references/wpd-message-gateway.md
@@ -40,7 +40,7 @@ Router → Middleware → Handler → Service → Port ← Repository / Provider
 | `MGW.ARCH-PKG-INTERNAL` | `pkg/` imports `internal/` |
 | `MGW.ARCH-HANDLER-SQL` | SQL or provider SDK in handlers |
 | `MGW.ARCH-SERVICE-HTTP` | Echo/HTTP types in services |
-| `MGW.ARCH-PROVIDER-INTERNAL` | New provider under `internal/infrastructure/provider/` |
+| `MGW.ARCH-PROVIDER-INTERNAL` | New provider under `internal/` instead of `pkg/provider/<name>/` |
 | `MGW.ARCH-FAT-HANDLER` | Handler > ~200 lines or business logic in handler |
 
 **Prefer:** split handlers by portal concern (`portal_auth_handler`, `portal_workspace_handler`, …). Keep handlers thin — decode, call service, map response.
diff --git a/.claude/commands/smell.md b/.claude/commands/smell.md
index 16020700..dcd750e6 100644
--- a/.claude/commands/smell.md
+++ b/.claude/commands/smell.md
@@ -101,11 +101,11 @@ Router → Middleware → Handler → Service → Port ← Repository / Provider
 
 | Area | Violation |
 | ---- | --------- |
-| `internal/core/domain/` | Imports Echo, HTTP, infra, or presentation |
+| `internal/core/domain/` | Imports Echo, HTTP, infra, presentation, or contains struct tags (`json`, `db`) |
 | `internal/core/port/` | Contains implementation instead of interfaces |
 | `internal/core/service/` | Direct SQL/HTTP; missing `ctx`; orchestration left in handler |
-| `internal/infrastructure/` | Business rules; bypasses port interfaces |
-| `internal/presentation/` | Business logic; handler → repository without service; RBAC in handler instead of middleware |
+| `internal/infrastructure/` | Business rules; bypasses port interfaces; imports `presentation/dto` |
+| `internal/presentation/` | Business logic; handler → repository without service; RBAC in handler instead of middleware; **request/response structs or JSON mappers in `handler/*.go`** |
 | `pkg/gateway`, `pkg/contracts` | Imports `internal/*`; embedded SDK requires PostgreSQL |
 | Providers | No `init()` registration or missing blank import in `internal/app/imports.go` |
 | Auth | Portal mutations without JWT + `RequirePermission`; internal ingest open outside local dev |
@@ -184,6 +184,8 @@ Do not invent issues. If the diff is clean, say so.
 | MGW.MIGRATION | Migration hygiene failure |
 | MGW.LOG-SECRET | Secrets or PII in logs |
 | MGW.N+1-QUERY | Query inside a loop |
+| MGW.HANDLER-DTO | HTTP struct or mapper (`XFromDomain` / `ToDomain` / `ToPatch`) in `handler/*.go` instead of `presentation/dto/` |
+| MGW.DTO-IN-REPO | Repository or port interface accepts `presentation/dto.*` instead of `domain.*` |
 | MGW.GOROUTINE-LEAK | Goroutine without lifecycle control |
 
 **Frontend**
@@ -219,6 +221,7 @@ Do not invent issues. If the diff is clean, say so.
 | -- | ------- |
 | DDD.LAYER | Business rule or orchestration in the wrong layer (handler/UI/infra) |
 | DDD.BOUNDARY | Bounded context violated (feature↔feature, `pkg`→`internal`, shared→feature) |
+| DDD.DOMAIN-LEAK | Domain object returned directly from handler without DTO mapping, or containing presentation tags (`json`) |
 | DDD.VALUE-TYPE | Domain concept as raw string/number — use typed constant in domain + API/FE mirror |
 
 **General — SOLID**
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d1247e62..d0b33a42 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -201,13 +201,19 @@ jobs:
       # Wait for server
       - name: Wait for server to be ready
         run: |
+          ready=0
           for i in {1..30}; do
-            if curl -s http://localhost:10101/health > /dev/null 2>&1; then
+            if curl -sf http://localhost:10101/health > /dev/null 2>&1; then
               echo "Server ready"
+              ready=1
               break
             fi
             sleep 1
           done
+          if [ "$ready" -ne 1 ]; then
+            echo "Server did not become ready within 30s"
+            exit 1
+          fi
 
       - name: Install Bruno CLI
         run: npm install -g @usebruno/cli
diff --git a/Makefile b/Makefile
index bdbc0c02..5822ca87 100644
--- a/Makefile
+++ b/Makefile
@@ -1,4 +1,4 @@
-.PHONY: it install upgrade setup specify spec clarify clr plan pln tasks tsk implement impl analyze alyz checklist chk pr sync agents agents-kill start stop test audit build clean docker-check dev dev-down seed-demo help ui-install ui ui-build ui-format ui-test ui-lint storybook
+.PHONY: it install upgrade setup specify spec clarify clr plan pln tasks tsk implement impl analyze alyz checklist chk pr sync agents agents-kill start stop test audit build clean docker-check dev dev-down db-init seed-demo help ui-install ui ui-build ui-format ui-test ui-lint storybook
 
 # ============================================================================
 # ANSI Color Codes
@@ -300,11 +300,19 @@ docker-check:
 dev: docker-check
 	@printf "\n"
 	@printf "$(BOLD)$(CYAN)🐳 Starting Gateway, database, and Portal UI via Docker...$(RESET)\n"
-	@docker compose up -d --build
+	@docker compose up -d --build --renew-anon-volumes
 	@printf "$(GREEN)✅ All services started!$(RESET)\n"
 	@printf "\n"
-	@printf "   $(BOLD)Gateway API:$(RESET)  http://localhost:10101\n"
-	@printf "   $(BOLD)Portal UI:$(RESET)    http://localhost:10104\n"
+	@printf "   ╭───────────────────────────────────────────────────╮\n"
+	@printf "   │                                                   │\n"
+	@printf "   │  $(BOLD)Gateway API:$(RESET)  http://localhost:10101             │\n"
+	@printf "   │  $(BOLD)Portal UI:$(RESET)    http://localhost:10104             │\n"
+	@printf "   │                                                   │\n"
+	@printf "   │  $(BOLD)Demo Account$(RESET)                                     │\n"
+	@printf "   │  Email:    demo@weprodev.com                      │\n"
+	@printf "   │  Password: secret                                 │\n"
+	@printf "   │                                                   │\n"
+	@printf "   ╰───────────────────────────────────────────────────╯\n"
 	@printf "\n"
 
 ## Stop Docker Compose
@@ -314,13 +322,22 @@ dev-down: docker-check
 	@docker compose down
 	@printf "$(GREEN)✅ Stopped!$(RESET)\n"
 
-## Re-apply SQL seeds to the running Postgres container (demo user, RBAC, providers)
-seed-demo: docker-check
+## Apply schema when Postgres volume exists but tables are missing (then restart gateway)
+db-init: docker-check
 	@printf "\n"
-	@printf "$(BOLD)$(CYAN)🌱 Applying database seeds...$(RESET)\n"
+	@printf "$(BOLD)$(CYAN)🗄️  Initializing database schema...$(RESET)\n"
 	@docker compose exec -T -e POSTGRES_USER=gateway -e POSTGRES_DB=gateway db \
-		bash /docker-entrypoint-initdb.d/apply-seeds.sh /docker-entrypoint-initdb.d/seeds
-	@printf "$(GREEN)✅ Seeds applied (demo@weprodev.com / secret)$(RESET)\n"
+		bash /docker-entrypoint-initdb.d/init-db.sh
+	@docker compose restart gateway
+	@printf "$(GREEN)✅ Database ready — gateway will apply seeds on startup (demo@weprodev.com / secret)$(RESET)\n"
+	@printf "\n"
+
+## Re-apply SQL seeds by restarting the gateway (seeds run on every startup)
+seed-demo: docker-check
+	@printf "\n"
+	@printf "$(BOLD)$(CYAN)🌱 Re-applying database seeds (gateway restart)...$(RESET)\n"
+	@docker compose restart gateway
+	@printf "$(GREEN)✅ Seeds applied on gateway startup (demo@weprodev.com / secret)$(RESET)\n"
 	@printf "\n"
 
 
@@ -368,7 +385,8 @@ help:
 	@printf "$(BOLD)$(GREEN)🐳 Docker$(RESET)\n"
 	@printf "   $(YELLOW)make dev$(RESET)          Start Gateway, DB, and UI via Docker (with hot-reloading)\n"
 	@printf "   $(YELLOW)make dev-down$(RESET)     Stop Docker containers\n"
-	@printf "   $(YELLOW)make seed-demo$(RESET)    Re-apply SQL seeds (demo@weprodev.com / secret)\n"
+	@printf "   $(YELLOW)make db-init$(RESET)      Apply schema if DB volume is empty; gateway seeds on start\n"
+	@printf "   $(YELLOW)make seed-demo$(RESET)    Re-apply seeds via gateway restart\n"
 	@printf "\n"
 
 	@printf "$(BOLD)$(CYAN)━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━$(RESET)\n"
diff --git a/Readme.md b/Readme.md
index 7db6392b..84c00018 100644
--- a/Readme.md
+++ b/Readme.md
@@ -108,12 +108,12 @@ Seeded on first DB init. Reset anytime: `make seed-demo`.
 |--|--|
 | Portal | `demo@weprodev.com` / `secret` |
 | API key | `demo-client-id` / `demo-secret` |
-| Workspace key | `demo` |
+| Workspace ID | `00000000-0000-0000-0000-000000000001` |
 
 ```bash
 curl -X POST http://localhost:10101/v1/email \
   -u "demo-client-id:demo-secret" \
-  -H "X-Workspace-Key: demo" \
+  -H "X-Workspace-Key: 00000000-0000-0000-0000-000000000001" \
   -H "Content-Type: application/json" \
   -d '{"to":["user@example.com"],"subject":"Hello","html":"<h1>World</h1>"}'
 ```
diff --git a/cmd/server/init.go b/cmd/server/init.go
new file mode 100644
index 00000000..df218735
--- /dev/null
+++ b/cmd/server/init.go
@@ -0,0 +1,33 @@
+package main
+
+import (
+	"fmt"
+
+	pkglogger "github.com/weprodev/go-pkg/logger"
+
+	"github.com/weprodev/wpd-message-gateway/internal/app"
+	applogger "github.com/weprodev/wpd-message-gateway/internal/infrastructure/logger"
+)
+
+func loadAppConfig(configPath string) (*app.Config, error) {
+	return app.LoadAppConfig(configPath)
+}
+
+func validateAppConfig(cfg *app.Config) error {
+	if err := app.ValidateConfig(cfg); err != nil {
+		return fmt.Errorf("configuration error: %w (hint: copy configs/local.example.yml to configs/local.yml)", err)
+	}
+	return nil
+}
+
+func setLogger(cfg *app.Config) (*pkglogger.Logger, error) {
+	return applogger.New(cfg.EnvironmentName())
+}
+
+func wireApplication(cfg *app.Config) (*app.Application, error) {
+	sysLogger, err := setLogger(cfg)
+	if err != nil {
+		return nil, fmt.Errorf("init logger: %w", err)
+	}
+	return app.Wire(cfg, sysLogger)
+}
diff --git a/cmd/server/main.go b/cmd/server/main.go
index 8d76101b..267c02b6 100644
--- a/cmd/server/main.go
+++ b/cmd/server/main.go
@@ -1,74 +1,69 @@
 package main
 
 import (
+	"context"
+	"flag"
 	"fmt"
 	"log/slog"
+	"net/http"
 	"os"
-
-	"github.com/weprodev/wpd-message-gateway/internal/app"
-	"github.com/weprodev/wpd-message-gateway/internal/infrastructure/logger"
+	"os/signal"
+	"syscall"
+	"time"
 )
 
 func main() {
-	// Initialise the structured logger first so every subsequent slog call is
-	// formatted and levelled correctly. Uses APP_ENVIRONMENT to pick text (local)
-	// vs JSON (production) format.
-	env := os.Getenv("APP_ENVIRONMENT")
-	sysLogger, err := logger.New(env)
-	if err != nil {
-		// Logger not yet up — fall back to bare stderr before exiting.
-		fmt.Fprintf(os.Stderr, "FATAL: init logger: %v\n", err)
+	if err := run(); err != nil {
+		fmt.Fprintf(os.Stderr, "fatal error: %v\n", err)
 		os.Exit(1)
 	}
+}
+
+func run() error {
+	configPath := flag.String("config", "", "Path to config file (default: CONFIG_PATH env or configs/local.yml)")
+	flag.Parse()
 
-	configPath := os.Getenv("CONFIG_PATH")
-	cfg, err := app.LoadConfig(configPath)
+	cfg, err := loadAppConfig(*configPath)
 	if err != nil {
-		slog.Error("failed to load config", "error", err)
-		os.Exit(1)
+		return fmt.Errorf("load config: %w", err)
 	}
 
-	if err := app.ValidateConfig(cfg); err != nil {
-		slog.Error("configuration error",
-			"error", err,
-			"hint", "each message type requires a default provider (e.g. memory, mailgun); "+
-				"copy configs/local.example.yml to configs/local.yml and configure providers",
-		)
-		os.Exit(1)
+	if err := validateAppConfig(cfg); err != nil {
+		return err
 	}
 
-	application, err := app.Wire(cfg, sysLogger)
+	application, err := wireApplication(cfg)
 	if err != nil {
-		slog.Error("failed to initialise application", "error", err)
-		os.Exit(1)
+		return fmt.Errorf("wire application: %w", err)
 	}
 
-	logConfiguration(cfg)
+	ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
+	defer stop()
 
-	port := resolvePort(cfg)
-	slog.Info("gateway server starting", "port", port, "environment", cfg.Environment)
+	cfg.LogSummary()
+	slog.Info("gateway server starting")
 
-	if err := application.Echo.Start(":" + port); err != nil {
-		slog.Error("server stopped", "error", err)
-		os.Exit(1)
+	errCh := make(chan error, 1)
+	go func() {
+		if err := application.Echo.Start(cfg.ListenAddr()); err != nil && err != http.ErrServerClosed {
+			errCh <- err
+		}
+	}()
+
+	select {
+	case err := <-errCh:
+		return fmt.Errorf("server stopped unexpectedly: %w", err)
+	case <-ctx.Done():
+		slog.Info("shutdown signal received")
 	}
-}
 
-func logConfiguration(cfg *app.Config) {
-	slog.Info("loaded configuration",
-		"email_provider", cfg.DefaultEmailProvider(),
-		"sms_provider", cfg.DefaultSMSProvider(),
-		"push_provider", cfg.DefaultPushProvider(),
-		"chat_provider", cfg.DefaultChatProvider(),
-	)
-}
+	shutdownCtx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
 
-func resolvePort(cfg *app.Config) string {
-	if port := os.Getenv("PORT"); port != "" {
-		return port
-	}
-	if cfg.Server.Port != 0 {
-		return fmt.Sprintf("%d", cfg.Server.Port)
+	if err := application.Shutdown(shutdownCtx); err != nil {
+		return fmt.Errorf("graceful shutdown: %w", err)
 	}
-	return "10101"
+
+	slog.Info("server stopped")
+	return nil
 }
diff --git a/database/apply-seeds.sh b/database/apply-seeds.sh
deleted file mode 100755
index 34cceb3a..00000000
--- a/database/apply-seeds.sh
+++ /dev/null
@@ -1,16 +0,0 @@
-#!/bin/bash
-# Apply idempotent SQL seeds in order. Used by init-db.sh and `make seed-demo`.
-set -euo pipefail
-
-SEEDS_DIR="${1:-/docker-entrypoint-initdb.d/seeds}"
-PSQL=(psql -v ON_ERROR_STOP=1 --username "${POSTGRES_USER:?}" --dbname "${POSTGRES_DB:?}")
-
-for seed in \
-  001_seed_permissions.sql \
-  002_seed_providers.sql \
-  003_seed_mailgun_config.sql \
-  004_demo_workspace.sql
-do
-  echo "→ seeds/$seed"
-  "${PSQL[@]}" -f "$SEEDS_DIR/$seed"
-done
diff --git a/database/init-db.sh b/database/init-db.sh
index 00958835..f13789a7 100755
--- a/database/init-db.sh
+++ b/database/init-db.sh
@@ -3,12 +3,16 @@ set -e
 
 echo "=== Running Database Init Script ==="
 
+TABLE_EXISTS=$(psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" -tAc \
+  "SELECT EXISTS (SELECT 1 FROM information_schema.tables WHERE table_schema = 'public' AND table_name = 'users');")
+
+if [ "$TABLE_EXISTS" = "t" ]; then
+  echo "Schema already present — skipping migration."
+  exit 0
+fi
+
 echo "Applying migrations..."
 psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" \
   -f /docker-entrypoint-initdb.d/migrations/20260318000000_init_gateway.up.sql
 
-echo "Applying seeds..."
-export POSTGRES_USER POSTGRES_DB
-bash /docker-entrypoint-initdb.d/apply-seeds.sh /docker-entrypoint-initdb.d/seeds
-
-echo "=== Database Init Script Completed ==="
+echo "=== Database Init Script Completed (seeds run on gateway startup) ==="
diff --git a/database/migrations/20260318000000_init_gateway.down.sql b/database/migrations/20260318000000_init_gateway.down.sql
index 8dec95e1..1601b1c7 100644
--- a/database/migrations/20260318000000_init_gateway.down.sql
+++ b/database/migrations/20260318000000_init_gateway.down.sql
@@ -6,6 +6,7 @@ DROP TABLE IF EXISTS workspace_access_audits CASCADE;
 DROP TABLE IF EXISTS workspace_settings CASCADE;
 DROP TABLE IF EXISTS template_components CASCADE;
 DROP TABLE IF EXISTS templates CASCADE;
+DROP TABLE IF EXISTS message_request_payloads CASCADE;
 DROP TABLE IF EXISTS message_request_logs CASCADE;
 DROP TABLE IF EXISTS api_keys CASCADE;
 DROP TABLE IF EXISTS integrations CASCADE;
diff --git a/database/migrations/20260318000000_init_gateway.up.sql b/database/migrations/20260318000000_init_gateway.up.sql
index 5b9bc09f..07207d64 100644
--- a/database/migrations/20260318000000_init_gateway.up.sql
+++ b/database/migrations/20260318000000_init_gateway.up.sql
@@ -62,6 +62,9 @@ CREATE TRIGGER trg_workspaces_set_updated_at
     FOR EACH ROW EXECUTE FUNCTION set_updated_at();
 
 CREATE INDEX idx_workspaces_owner_id ON workspaces(owner_id);
+CREATE INDEX idx_workspaces_active_list
+    ON workspaces (status, is_private, name)
+    WHERE status = 'active';
 
 -- ==============================================================================
 -- 3. ROLES TABLE (RBAC)
@@ -70,7 +73,7 @@ CREATE INDEX idx_workspaces_owner_id ON workspaces(owner_id);
 CREATE TABLE roles (
     id           UUID        PRIMARY KEY DEFAULT gen_random_uuid(),
     name         TEXT        NOT NULL,
-    guard_name   TEXT        NOT NULL DEFAULT 'web',
+    guard_name   TEXT        NOT NULL DEFAULT 'msg_web',
     display_name TEXT,
     created_at   TIMESTAMPTZ NOT NULL DEFAULT NOW(),
     updated_at   TIMESTAMPTZ NOT NULL DEFAULT NOW(),
@@ -123,7 +126,9 @@ CREATE UNIQUE INDEX idx_invitations_pending_per_workspace_email
 
 CREATE INDEX idx_invitations_workspace_id ON invitations(workspace_id);
 CREATE INDEX idx_invitations_token_hash   ON invitations(token_hash);
-CREATE INDEX idx_invitations_role_id       ON invitations(role_id);
+CREATE INDEX idx_invitations_workspace_pending
+    ON invitations (workspace_id, status, expires_at)
+    WHERE status = 'pending';
 
 -- ==============================================================================
 -- 6. WORKSPACE_CHANNELS TABLE
@@ -186,6 +191,8 @@ CREATE TRIGGER trg_provider_config_fields_set_updated_at
     BEFORE UPDATE ON provider_config_fields
     FOR EACH ROW EXECUTE FUNCTION set_updated_at();
 
+CREATE INDEX idx_provider_config_fields_provider_id ON provider_config_fields(provider_id);
+
 -- ==============================================================================
 -- 9. INTEGRATIONS TABLE (Workspace ↔ Provider Credentials)
 -- ==============================================================================
@@ -217,6 +224,8 @@ CREATE UNIQUE INDEX idx_integrations_default_per_channel
 
 CREATE INDEX idx_integrations_provider_id ON integrations(provider_id);
 CREATE INDEX idx_integrations_workspace_channel ON integrations(workspace_id, channel_type);
+CREATE INDEX idx_integrations_workspace_channel_status
+    ON integrations (workspace_id, channel_type, status, is_default DESC, created_at DESC);
 
 CREATE TRIGGER trg_integrations_set_updated_at
     BEFORE UPDATE ON integrations
@@ -241,6 +250,7 @@ CREATE TABLE api_keys (
 );
 
 CREATE INDEX idx_api_keys_workspace_id ON api_keys(workspace_id);
+CREATE INDEX idx_api_keys_workspace_created ON api_keys (workspace_id, created_at DESC);
 
 -- ==============================================================================
 -- 11. MESSAGE_REQUEST_LOGS TABLE (Append-only)
@@ -258,6 +268,7 @@ CREATE TABLE message_request_logs (
     request_id    VARCHAR(64),
     duration_ms   INT          CHECK (duration_ms >= 0),
     error_message TEXT,
+    inbox_message_id UUID,
     created_at    TIMESTAMPTZ  NOT NULL DEFAULT NOW()
 );
 
@@ -272,6 +283,24 @@ CREATE INDEX idx_message_request_logs_workspace_api_created
     ON message_request_logs (workspace_id, api_key_id, created_at DESC)
     WHERE api_key_id IS NOT NULL;
 
+CREATE INDEX idx_message_request_logs_workspace_channel_created
+    ON message_request_logs (workspace_id, channel_type, created_at DESC);
+
+CREATE INDEX idx_message_request_logs_workspace_inbox_message
+    ON message_request_logs (workspace_id, inbox_message_id)
+    WHERE inbox_message_id IS NOT NULL;
+
+-- ==============================================================================
+-- 11.5. MESSAGE_REQUEST_PAYLOADS TABLE (Append-only body storage)
+-- ==============================================================================
+
+CREATE TABLE message_request_payloads (
+    log_id        UUID        PRIMARY KEY REFERENCES message_request_logs(id) ON DELETE CASCADE,
+    request_body  TEXT,
+    response_body TEXT,
+    created_at    TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
 -- ==============================================================================
 -- 12. TEMPLATES TABLE
 -- ==============================================================================
@@ -370,7 +399,7 @@ CREATE INDEX idx_workspace_access_audits_actor_user_id
 CREATE TABLE permissions (
     id           UUID        PRIMARY KEY DEFAULT gen_random_uuid(),
     name         TEXT        NOT NULL,
-    guard_name   TEXT        NOT NULL DEFAULT 'web',
+    guard_name   TEXT        NOT NULL DEFAULT 'msg_web',
     created_at   TIMESTAMPTZ NOT NULL DEFAULT NOW(),
     updated_at   TIMESTAMPTZ NOT NULL DEFAULT NOW(),
 
diff --git a/database/seeds/001_seed_permissions.sql b/database/seeds/001_seed_permissions.sql
index 5cc17afb..d13a1eb7 100644
--- a/database/seeds/001_seed_permissions.sql
+++ b/database/seeds/001_seed_permissions.sql
@@ -1,31 +1,31 @@
 -- Default RBAC Permissions & Role Bindings for WPD Message Gateway
 
 -- 1. Insert default roles
-INSERT INTO roles (id, name, display_name)
+INSERT INTO roles (id, name, display_name, guard_name)
 VALUES
-    ('00000000-0000-0000-0000-000000000020', 'admin', 'Admin'),
-    ('00000000-0000-0000-0000-000000000021', 'member', 'Member')
+    ('00000000-0000-0000-0000-000000000020', 'admin', 'Admin', 'msg_web'),
+    ('00000000-0000-0000-0000-000000000021', 'member', 'Member', 'msg_web')
 ON CONFLICT (name, guard_name) DO NOTHING;
 
 -- 2. Insert permissions
 INSERT INTO permissions (id, name, guard_name)
 VALUES
-    (gen_random_uuid(), 'workspaces.read', 'web'),
-    (gen_random_uuid(), 'workspaces.write', 'web'),
-    (gen_random_uuid(), 'members.read', 'web'),
-    (gen_random_uuid(), 'members.write', 'web'),
-    (gen_random_uuid(), 'apikeys.read', 'web'),
-    (gen_random_uuid(), 'apikeys.write', 'web'),
-    (gen_random_uuid(), 'logs.read', 'web'),
-    (gen_random_uuid(), 'integrations.read', 'web'),
-    (gen_random_uuid(), 'integrations.write', 'web'),
-    (gen_random_uuid(), 'templates.read', 'web'),
-    (gen_random_uuid(), 'templates.write', 'web'),
-    (gen_random_uuid(), 'settings.read', 'web'),
-    (gen_random_uuid(), 'settings.write', 'web'),
-    (gen_random_uuid(), 'invitations.read', 'web'),
-    (gen_random_uuid(), 'invitations.write', 'web'),
-    (gen_random_uuid(), 'send.test', 'web')
+    (gen_random_uuid(), 'workspaces.read', 'msg_web'),
+    (gen_random_uuid(), 'workspaces.write', 'msg_web'),
+    (gen_random_uuid(), 'members.read', 'msg_web'),
+    (gen_random_uuid(), 'members.write', 'msg_web'),
+    (gen_random_uuid(), 'apikeys.read', 'msg_web'),
+    (gen_random_uuid(), 'apikeys.write', 'msg_web'),
+    (gen_random_uuid(), 'logs.read', 'msg_web'),
+    (gen_random_uuid(), 'integrations.read', 'msg_web'),
+    (gen_random_uuid(), 'integrations.write', 'msg_web'),
+    (gen_random_uuid(), 'templates.read', 'msg_web'),
+    (gen_random_uuid(), 'templates.write', 'msg_web'),
+    (gen_random_uuid(), 'settings.read', 'msg_web'),
+    (gen_random_uuid(), 'settings.write', 'msg_web'),
+    (gen_random_uuid(), 'invitations.read', 'msg_web'),
+    (gen_random_uuid(), 'invitations.write', 'msg_web'),
+    (gen_random_uuid(), 'inbox.write', 'msg_web')
 ON CONFLICT (name, guard_name) DO NOTHING;
 
 -- 3. Bind permissions to 'admin' role
@@ -36,7 +36,7 @@ CROSS JOIN roles r
 WHERE r.name = 'admin'
 ON CONFLICT (permission_id, role_id) DO NOTHING;
 
--- 4. Bind permissions to 'member' role (read-only + send.test)
+-- 4. Bind permissions to 'member' role (read-only + inbox.write)
 INSERT INTO role_has_permissions (permission_id, role_id)
 SELECT p.id, r.id
 FROM permissions p
@@ -51,6 +51,6 @@ WHERE r.name = 'member'
     'templates.read',
     'settings.read',
     'invitations.read',
-    'send.test'
+    'inbox.write'
   )
 ON CONFLICT (permission_id, role_id) DO NOTHING;
diff --git a/docs/agents/delivery-agent.md b/docs/agents/delivery-agent.md
index 622908a4..aed90fd2 100644
--- a/docs/agents/delivery-agent.md
+++ b/docs/agents/delivery-agent.md
@@ -16,7 +16,7 @@ Orchestration note: the **[master-agent](./master-agent.md)** classifies request
 - **Traceability:** Before multi-file edits, state a **short plan** (files/areas + verification). After edits, summarize **what changed** and **how it was verified**.
 - **Bounded retries:** If [verification](./verification.md) fails twice for the **same** mistake class, **stop**, re-read output, and **narrow scope** instead of looping.
 - **No secret material (Data Exposure limits):** Do not echo or commit API keys, JWTs, or pasted credentials. **Hard requirement:** Any code generating secrets must use crypto-safe `crypto/rand`, and secrets must exclusively live in ENV or hashed in Postgres.
-- **Engineering principles (implement time):** Apply **KISS** (smallest correct diff), **DRY** (extract on second duplication), **DDD** (domain constants/types in `internal/core/domain/` + FE `*.types.ts`), **SOLID** (thin handlers, services orchestrate, ports for I/O). Remove dead code and stale comments/docs you touch — do not leave refactor debris.
+- **Engineering principles (implement time):** Apply **KISS**, **DRY**, **DDD**, **SOLID**. Portal HTTP shapes in **`internal/presentation/dto/`**; map to **`domain.*`** before calling services — **never pass DTOs to repositories**.
 - **Comments:** Add only when behavior is non-obvious; delete comments that restate code or became wrong after your edit.
 
 ## 1. Safety & Robustness Pre-Check
diff --git a/docs/agents/review-agent.md b/docs/agents/review-agent.md
index 299c8044..3215afd8 100644
--- a/docs/agents/review-agent.md
+++ b/docs/agents/review-agent.md
@@ -68,6 +68,7 @@ Derived from [backend-engineer.md](../backend/backend-engineer.md) and [code-con
 - [ ] **Database Schema**: If columns/tables changed, the DB diagram and relative docs must be updated.
 - [ ] **Robustness & Scalability**: No goroutine leaks.
 - [ ] **Tests**: Table-driven tests covering **edge cases** and **expected failures**.
+- [ ] **Presentation DTOs**: Types/mappers in `internal/presentation/dto/`; **`domain.*` only** on port/repo interfaces (`MGW.HANDLER-DTO`, `MGW.DTO-IN-REPO`).
 - [ ] **Principles**: Domain constants for statuses/enums; no handler business rules; no `pkg`→`internal` (`DDD.VALUE-TYPE`, `DDD.LAYER`, `SOLID.DIP`).
 
 ## 4. Frontend review checklist
@@ -87,7 +88,7 @@ Derived from [frontend-engineer.md](../frontend/frontend-engineer.md) and [conve
 
 - [ ] **Architecture Check**: If a new layer or directory was created, does it align with the documented architecture? Are docs updated?
 - [ ] **Anti-patterns**: Ensure new patterns introduced do not conflict with existing boundaries.
-- [ ] **No stale docs**: Portal capability claims match code (remove “REST only” when UI exists).
+- [ ] **No stale docs**: Portal capability claims match code (UI pages, permissions, and API tables stay in sync with `frontend/src/core/router/` and `internal/presentation/router.go`).
 
 ## 6. Severity guidance & Reporting
 
diff --git a/docs/backend/architecture.md b/docs/backend/architecture.md
index c473262b..674c7670 100644
--- a/docs/backend/architecture.md
+++ b/docs/backend/architecture.md
@@ -138,7 +138,7 @@ gw.SendEmail(ctx, &contracts.Email{
 │  ┌──────────────────────────────────────────────────────────┐   │
 │  │   GatewayService                                         │   │
 │  │   SendEmail() · SendSMS() · SendPush() · SendChat()      │   │
-│  │   Reads dispatch_mode from workspace_settings            │   │
+│  │   Reads message_dispatch_mode from workspace_settings    │   │
 │  │   Reads provider credentials from integrations table     │   │
 │  └──────────────────────────────────────────────────────────┘   │
 │  ┌──────────────────────────────────────────────────────────┐   │
@@ -186,7 +186,7 @@ Portal accounts use **email + password** (passwords are stored hashed). All mana
 The core service layer decouples from `wpd-gogate` by depending on the `port.AuthorizationGate` interface. The implementation adapter lives in `internal/infrastructure/authgate/gate_adapter.go`.
 
 - **admin**: Full read/write access to settings, integrations, templates, API keys, and member removal. Assigned automatically to the creator of a workspace.
-- **member**: Read-only access to workspaces, settings, templates, API keys, plus permission to send test messages (`send.test`).
+- **member**: Read-only access to workspaces, settings, templates, API keys, and logs, plus inbox mutations (`inbox.write`).
 
 Public workspaces (`is_private = false`) are dynamically accessible to any authenticated user as a `"viewer"` with read-only permissions (i.e. `*.read` operations are bypassed and approved automatically without requiring explicit membership or Casbin checks). All write operations on public workspaces remain strictly restricted to workspace admins.
 
@@ -200,7 +200,7 @@ Authorization: Bearer <workspace-jwt-token>
     OR
 X-Api-Client-Id: wk_abc123
 X-Api-Client-Secret: <secret>
-X-Workspace-Key: <workspace-unique-key>
+X-Workspace-Key: <workspace-id-or-slug>
 ```
 
 ### Dual Authorization Design
@@ -231,27 +231,46 @@ Provider credentials are stored AES-encrypted in the `integrations` table. Confi
 
 ### Portal UI coverage
 
-The React Portal (`frontend/`) currently implements: auth, workspace list, **integrations**, message **logs**, and **send test**. API keys, templates, members, settings, and memory inbox browsing are REST/Bruno only.
+The React Portal (`frontend/`) includes:
+
+| Area | Pages |
+| ---- | ----- |
+| **Auth** | Register, sign in |
+| **Workspaces** | List, create, join |
+| **Logs** | Overview (all channels) + per-channel tabs (SMS, push, chat) |
+| **Email** | Captured inbox browser, templates, Get started curl guide |
+| **Integrations** | Connect and manage providers |
+| **Settings** | General, API keys, message dispatch |
+
+**API-only today:** team invites/members UI (placeholder), SMS/push/chat captured-message browsers (email inbox only), internal inbox ingest.
 
 ---
 
-## Message Dispatch Modes
+## Message Dispatch & Content Storage
+
+Each workspace controls outbound routing and inbox content capture with **two orthogonal settings**:
 
-Each workspace independently controls how outbound messages are handled:
+| Setting | Values | Purpose |
+| ------- | ------ | ------- |
+| `message_dispatch_mode` | `memory` (default) \| `provider` | Where the message is routed |
+| `store_message_content` | `false` (default) \| `true` | Whether message bodies are captured in the portal inbox (in-process) |
 
-| Mode                  | Behavior                                                                            |
-| --------------------- | ----------------------------------------------------------------------------------- |
-| `memory_only`         | Captured in-process RAM only. No external provider called. Default for development. |
-| `provider_only`       | Sent through the connected integration only. No in-memory copy.                     |
-| `memory_and_provider` | Stored in memory AND sent through the integration.                                  |
+Portal **Settings → Message Dispatch** exposes two controls that map directly to these keys:
 
-Configured via `PATCH /api/v1/workspaces/:wid/settings` (REST — no Portal UI page yet):
+| UI control | Setting key | Values |
+| ---------- | ----------- | ------ |
+| Dispatch mode (radio) | `message_dispatch_mode` | `memory` \| `provider` |
+| Store message content (checkbox) | `store_message_content` | `false` (off) \| `true` (on) |
+
+Configured via `PATCH /api/v1/workspaces/:wid/settings` (Portal **Settings → Message Dispatch**):
 
 ```
 PATCH /api/v1/workspaces/:wid/settings
-{ "message_dispatch_mode": "provider_only" }
+{ "message_dispatch_mode": "provider", "store_message_content": "true" }
 ```
 
+**Request logs**: Every API send appends a row to `message_request_logs` (operational tracing with correlation `request_id`). Payload bodies are stored in a separate table (`message_request_payloads`) to prevent table bloat and enforce independent data privacy/retention policies.
+
 ---
 
 ## Request Flow: Sending a Message
@@ -263,31 +282,31 @@ HTTP Client (your app)
     │
     │ POST /v1/email
     │ Authorization: Bearer <workspace-jwt>
-    │ X-Workspace-Key: myapp
+    │ X-Workspace-Key: <workspace-uuid>
     │ { "to": [...], "subject": "...", "html": "..." }
     ▼
 APIKeyAuthMiddleware
     │ Validates workspace-jwt OR client_id+secret
-    │ Resolves workspace UUID from X-Workspace-Key
+    │ Resolves workspace from X-Workspace-Key (UUID or slug)
     │ Sets workspace_id in request context
     ▼
 GatewayHandler.HandleSendEmail()
     │ Reads workspace_id from context
     ▼
 GatewayService.SendEmail(ctx, workspaceID, email)
-    │ Reads workspace_settings.message_dispatch_mode from DB
+    │ Reads message_dispatch_mode + store_message_content from DB
     │
-    ├── memory_only  → Memory Provider (in-process RAM)
-    │                        │
-    │                        ▼
-    │                  Portal Inbox (SSE + REST)
+    ├── memory  → Memory Provider (in-process RAM)
+    │                  │
+    │                  ▼
+    │            Portal Inbox (SSE + REST)
     │
-    ├── provider_only → reads integrations table for workspace+channel
-    │                  Decrypts AES config
-    │                  Instantiates provider via registry
-    │                  → sends to Mailgun/etc
+    ├── provider → reads integrations table for workspace+channel
+    │             Decrypts AES config
+    │             Instantiates provider via registry
+    │             → sends to Mailgun/etc
     │
-    └── memory_and_provider → both paths above
+    └── store_message_content=true → also persists content via inbox writer
 ```
 
 ### SDK Mode — `gateway.New(config).SendEmail(...)`
@@ -322,7 +341,7 @@ Workspace "myapp"
 ├── Integrations (provider credentials per channel)
 │   ├── email: mailgun { api_key: "...", domain: "..." }
 │   └── sms: (not configured)
-├── Settings { message_dispatch_mode: "provider_only" }
+├── Settings { message_dispatch_mode: "provider", store_message_content: "false" }
 ├── Templates (email HTML templates)
 └── Message Logs (request audit trail)
 ```
@@ -438,19 +457,19 @@ Only create new files in pkg/provider/<name>/
 
 ### 5. Memory Provider & Dispatch Modes
 
-The **memory provider** captures messages in process RAM. It's always available — no external service needed. Combined with `dispatch_mode`, you can:
+The **memory provider** captures messages in process RAM. It's always available — no external service needed. Combined with workspace settings, you can:
 
-- Use `memory_only` for local development (captured messages via inbox REST API / Bruno)
-- Use `provider_only` in production (messages go to real provider)
-- Use `memory_and_provider` to keep a local copy AND send to the real provider
+- Use `message_dispatch_mode=memory` for local development (captured messages via inbox REST API / Bruno)
+- Use `message_dispatch_mode=provider` in production (messages go to the real provider)
+- Set `store_message_content=true` to persist message bodies regardless of routing mode
 
 ### 6. Portal (always on)
 
 The React Portal runs at `portal.ui_port` (default **10104**) when the server starts.
 
-**Portal UI today:** sign in, list workspaces, manage **integrations**, view message logs, send test messages.
+**Portal UI:** sign in, manage workspaces, view request logs, browse the **email** captured inbox, manage **email templates**, configure **integrations** and **settings** (general, API keys, message dispatch).
 
-**REST only (no UI pages yet):** workspace create, API keys, templates, members, settings, memory inbox browser.
+**API-only:** team member management, SMS/push/chat captured-message browsers, internal inbox ingest.
 
 ---
 
@@ -459,9 +478,9 @@ The React Portal runs at `portal.ui_port` (default **10104**) when the server st
 To enable robust trace tracking across all layers, the gateway employs an end-to-end correlation ID pipeline:
 
 1. **Correlation Generation**: Echo's `RequestID` middleware generates a unique request UUID for every incoming HTTP request, placing it in the `X-Request-ID` header.
-2. **Context Propagation**: A custom correlation middleware extracts this request ID and injects it into the standard Go `context.Context` (accessible via `logger.GetRequestID(ctx)`).
-3. **Structured slog Hooking**: An application-wide custom `ContextHandler` intercepts all standard `slog.InfoContext` / `slog.ErrorContext` calls. It transparently extracts the `request_id`, `workspace_id`, `api_key_id`, `channel`, and `provider` attributes from the context and automatically appends them to printed log records without requiring manual logging boilerplate.
-4. **Audit Trail Tracking**: The presentation-layer `SendHelper` automatically populates the `request_id` column on the `message_request_logs` PostgreSQL table, linking individual requests directly to database audit trails.
+2. **Context Propagation**: Router middleware copies the request ID into `context.Context` via `logger.WithRequestID`. API key auth also calls `logger.WithWorkspace` so `workspace_id` and `api_key_id` appear on all `/v1/*` logs. Send handlers add `channel` and `provider`.
+3. **Structured slog**: go-pkg `ContextExtractors` append correlation fields to every `slog.*Context` record (`request_id`, `workspace_id`, `api_key_id`, `channel`, `provider`).
+4. **Audit Trail**: `SendHelper` persists `request_id` on every row in `message_request_logs`, linking HTTP requests to the operational audit trail.
 
 ---
 
diff --git a/docs/backend/code-conventions.md b/docs/backend/code-conventions.md
index f11b9796..e247f6bc 100644
--- a/docs/backend/code-conventions.md
+++ b/docs/backend/code-conventions.md
@@ -17,7 +17,8 @@ internal/           # Private application code (HTTP server mode)
 │   ├── logger/     # Structured logging
 │   └── repository/ # Postgres repositories
 └── presentation/   # HTTP layer
-    ├── handler/    # Request handlers
+    ├── dto/          # Request/response shapes + domain→JSON mappers (never in handler/)
+    ├── handler/    # Request handlers (thin: bind DTO → service → DTO)
     └── middleware/ # Auth, JWT, inbox API key
 
 pkg/                # Public packages (embedded SDK + shared contracts)
@@ -212,3 +213,53 @@ import (
 ```
 
 Use `goimports -local github.com/weprodev/wpd-message-gateway` to auto-format.
+
+## HTTP DTOs (presentation layer)
+
+**Never** define request/response structs in `handler/*.go`. HTTP JSON shapes belong in **`internal/presentation/dto/`** — one file per resource (e.g. `api_key.go`, `integration.go`).
+
+| Do | Don't |
+| -- | ----- |
+| `dto.CreateAPIKeyRequest` in handler bind | `type createAPIKeyBody struct` in handler |
+| `dto.IntegrationFromDomain(intg)` | `integrationToJSON` helper in handler |
+| Exported PascalCase names (`LoginRequest`) | Unexported `*Body` suffix types in handler |
+| Pass `domain.*` to services/repositories | Pass `dto.*` to services or repositories |
+
+### Data flow (DTOs stop at the handler boundary)
+
+Repositories and port interfaces speak **domain only** — never presentation DTOs.
+
+```
+Inbound:  JSON → handler.Bind(dto.Request) → req.ToDomain() → domain.* → Service → Port → Repository
+Outbound: Repository → domain.* → Service → handler → dto.XFromDomain(domain.*) → JSON
+Partial:  JSON → dto.PatchRequest → req.ToPatch() → service.*Patch → Service (load domain, apply, save)
+```
+
+| Layer | Types it uses | Maps how |
+| ----- | ------------- | -------- |
+| **Handler** | `dto.*` | Bind JSON; call `ToDomain` / `ToPatch`; call `XFromDomain` before `c.JSON` |
+| **Service** | `domain.*`, `service.*Patch` | Business rules; orchestrates ports |
+| **Port / Repository** | `domain.*` | Postgres adapters scan rows ↔ domain structs |
+| **Infrastructure** | `domain.*` | No `json` tags required; no import of `presentation/dto` |
+
+**Never send DTOs to a repository.** If a handler has a `dto.CreateTemplateRequest`, call `body.ToDomain(wid)` first, then pass the resulting `*domain.Template` to `PortalService.CreateTemplate`, which passes it to the template repository port. The repository interface looks like:
+
+```go
+Create(ctx context.Context, t *domain.Template) error  // port — domain only
+```
+
+Gateway `/v1/*` handlers may bind **`pkg/contracts`** types directly — those are the public SDK message API, not portal DTOs.
+
+### Mapping convention (idiomatic Go)
+
+| Direction | Style | Example |
+| --------- | ----- | ------- |
+| Domain → response DTO | Package func `{Type}FromDomain` | `dto.APIKeyPublicFromDomain(k)` |
+| Request DTO → domain (create/upsert) | Value-receiver method `ToDomain()` | `body.ToDomain(wid)` |
+| Request DTO → partial update | Value-receiver method `ToPatch()` | `body.ToPatch()` → `service.WorkspacePatch` |
+
+Use **`{Type}FromDomain`** package functions for outbound mapping (not methods on a zero-value receiver). Use **`ToDomain()`** on request DTOs when the result is a **`domain.*`** entity for persistence. Use **`ToPatch()`** when the result is a **service patch command** (service loads domain, applies fields, saves via repository).
+
+**Not infrastructure:** DTOs are presentation concerns (JSON field names, omitempty). `internal/infrastructure/` maps DB rows to **domain**, not HTTP.
+
+New or changed portal endpoints: add/update types in `dto/` and colocate mapper tests (`dto/*_test.go`) when mapping logic is non-trivial.
diff --git a/docs/backend/e2e-testing.md b/docs/backend/e2e-testing.md
index b7a8b7bf..d8c149c7 100644
--- a/docs/backend/e2e-testing.md
+++ b/docs/backend/e2e-testing.md
@@ -17,7 +17,7 @@ Use the Message Gateway to capture and verify all messages your app sends during
 ## Architecture
 
 ```
-Your App                 Gateway (memory_only)        Test
+Your App                 Gateway (memory dispatch)        Test
    │                          │                        │
    │  POST /v1/email ─────────▶│ captured in RAM        │
    │  POST /v1/email ─────────▶│ captured in RAM        │
@@ -39,7 +39,7 @@ The inbox is protected. Every request to `/api/v1/workspaces/:wid/inbox/*` must
 2. **Workspace membership** — user must be a member of the workspace
 3. **Workspace API key** — `X-Api-Client-Id` + `X-Api-Client-Secret` matching the workspace
 
-The **send** endpoint (`POST /v1/*`) uses API key + `X-Workspace-Key` (slug, not UUID).  
+The **send** endpoint (`POST /v1/*`) uses API key + `X-Workspace-Key` (workspace UUID preferred; slug also accepted).  
 The **inbox** endpoint uses the workspace **UUID** in the URL path.
 
 ---
@@ -104,7 +104,7 @@ KEY_JSON=$(curl -sS -X POST "$BASE/workspaces/$WORKSPACE_ID/api-keys" \
 API_CLIENT_ID=$(echo "$KEY_JSON"   | jq -r .client_id)
 API_CLIENT_SECRET=$(echo "$KEY_JSON" | jq -r .client_secret)
 
-# 4) Dispatch mode defaults to memory_only — nothing to configure
+# 4) Dispatch defaults to memory — nothing to configure
 echo "PORTAL_JWT=$PORTAL_JWT"           >> $GITHUB_ENV
 echo "WORKSPACE_ID=$WORKSPACE_ID"      >> $GITHUB_ENV
 echo "WORKSPACE_UK=$UK"                >> $GITHUB_ENV
@@ -303,7 +303,7 @@ func TestSignupEmail(t *testing.T) {
 ```bash
 curl -X POST http://localhost:10101/v1/email \
   -u "client_id:client_secret" \
-  -H "X-Workspace-Key: your_workspace_unique_key" \
+  -H "X-Workspace-Key: <workspace-uuid>" \
   -H "Content-Type: application/json" \
   -d '{"to":["user@example.com"],"subject":"Hello","html":"<p>World</p>"}'
 ```
diff --git a/docs/backend/portal-inbox.md b/docs/backend/portal-inbox.md
index fb2beef0..61bd14d2 100644
--- a/docs/backend/portal-inbox.md
+++ b/docs/backend/portal-inbox.md
@@ -9,24 +9,27 @@ The Portal is the web UI and REST surface for the WPD Message Gateway when runni
 ### Portal UI (http://localhost:10104)
 
 | Feature | Description |
-|---------|-------------|
+| ------- | ------------- |
 | **Authentication** | Register and sign in (email + password → JWT) |
-| **Workspaces** | List workspaces you belong to; open a workspace dashboard |
+| **Workspaces** | List, create, and join workspaces |
+| **Message logs** | Outbound send request audit trail (Overview + per-channel tabs) |
+| **Email inbox** | Browse captured outbound emails with live SSE updates |
+| **Email templates** | Create and manage reusable email layouts |
 | **Integrations** | Connect, activate, deactivate, or remove messaging providers |
-| **Message logs** | Outbound send **request audit trail** (not memory inbox capture) |
-| **Send test** | Send a test message per channel from the dashboard |
+| **Settings** | General workspace settings, API keys, message dispatch mode |
+| **Get started** | Curl examples for sending via the public gateway API |
 
-No Portal pages yet for: workspace create, API keys, templates, members, settings, or memory inbox browsing.
+Team member management is a settings placeholder. SMS, push, and chat show **request logs** in the UI; captured-message browsing for those channels is API-only.
 
 ### REST API (server)
 
 | Feature | Portal UI | Description |
-|---------|:---------:|-------------|
-| **Inbox capture** | | Messages stored in RAM (`memory_only` / `memory_and_provider`) — [Inbox API](#inbox-api-reference) |
+| ------- | :-------: | ----------- |
+| **Inbox capture** | Email ✓ | Messages captured when `message_dispatch_mode=memory` or `store_message_content=true` — [Inbox API](#inbox-api-reference) |
 | **Internal ingest** | | Automation writes to inbox (requires Portal auth) |
-| **Workspace provisioning** | | Create workspace, API keys, settings — curl/Bruno/CI only; see [E2E bootstrap](./e2e-testing.md) |
+| **Workspace API** | Partial | Create/join workspaces and manage keys in the UI; additional endpoints in [usage](./usage.md) |
 
-Provider credentials are stored in PostgreSQL (encrypted at rest) and managed via the Portal **Integrations** page. Dispatch mode is REST-only (`PATCH /api/v1/workspaces/:wid/settings`).
+Provider credentials are stored in PostgreSQL (encrypted at rest) and managed on the Portal **Integrations** page. Dispatch settings are configured in **Settings → Message Dispatch** or via REST.
 
 ---
 
@@ -44,12 +47,12 @@ Register (email + password), then sign in.
 
 ## Message Inbox (Memory Capture)
 
-When a workspace's **dispatch mode** is `memory_only` or `memory_and_provider`, outbound messages are captured in-process RAM and displayed in the Portal inbox.
+When a workspace uses `message_dispatch_mode=memory`, outbound messages are captured in-process RAM and displayed in the Portal inbox.
 
 ```
 Your App
    │
-   │  POST /v1/email  (workspace: memory_only)
+   │  POST /v1/email  (workspace: memory dispatch)
    ▼
 Memory Provider
    └──────────────────▶ Portal Inbox (REST + SSE)
@@ -67,26 +70,29 @@ Memory Provider
 
 ---
 
-## Dispatch Modes
+## Dispatch & Inbox Capture
 
-Each workspace controls how its outbound messages are handled:
+Each workspace controls routing and inbox capture with two settings:
 
-| `message_dispatch_mode` | Behavior |
-|------------------------|----------|
-| `memory_only` | Captured in RAM only, **no** external provider called. **Default.** |
-| `provider_only` | Sent through the connected integration, **no** memory copy. |
-| `memory_and_provider` | Stored in memory **and** sent through the integration. |
+| Setting | Values | Role |
+|---------|--------|------|
+| `message_dispatch_mode` | `memory` (default) \| `provider` | Routing target |
+| `store_message_content` | `false` (default) \| `true` | Capture message body in portal inbox when enabled |
 
-Set via REST (no Portal UI page yet):
+Portal **Settings → Message Dispatch**: radio **Memory** / **Provider**, plus a checkbox for **Store message content in inbox** (see [usage](./usage.md)).
+
+Set via Portal **Settings → Message Dispatch** or REST:
 
 ```bash
 PATCH /api/v1/workspaces/:wid/settings
 Content-Type: application/json
 Authorization: Bearer <portal-jwt>
 
-{ "message_dispatch_mode": "provider_only" }
+{ "message_dispatch_mode": "provider", "store_message_content": "false" }
 ```
 
+Request logs (`message_request_logs`) are always written for operational tracing.
+
 ---
 
 ## Authentication (Inbox & API)
@@ -186,8 +192,8 @@ portal:
   ui_port: 10104     # React dev server (Portal UI)
 ```
 
-> **Provider credentials** (Mailgun API keys, etc.) are **not** in this file.  
-> They are stored AES-encrypted in PostgreSQL and configured via the **Portal REST API** (no Portal UI page yet).
+> **Provider credentials** (Mailgun API keys, etc.) are **not** in this file.
+> Configure them on the Portal **Integrations** page or via the integrations REST API. Values are stored AES-encrypted in PostgreSQL.
 
 ---
 
diff --git a/docs/backend/usage.md b/docs/backend/usage.md
index c17c0ae9..06b68b6e 100644
--- a/docs/backend/usage.md
+++ b/docs/backend/usage.md
@@ -10,7 +10,7 @@
 │  go get .../wpd-message-gateway  │  git clone → make start          │
 │  gateway.New(config)             │  POST /v1/email (HTTP)           │
 │  Config lives in your code       │  Config lives in PostgreSQL      │
-│  No DB required                  │  React Portal UI (partial)       │
+│  No DB required                  │  React Portal UI                 │
 └──────────────────────────────────┴──────────────────────────────────┘
 ```
 
@@ -141,22 +141,28 @@ Open **http://localhost:10104** — the Portal UI.
 
 ### First time setup (Portal UI)
 
-The Portal UI currently supports:
+The Portal UI supports:
 
 1. **Register** and **sign in** (email + password)
-2. **Workspaces** — list workspaces you belong to and open one
+2. **Workspaces** — list, create, and join workspaces
 3. **Integrations** — connect, activate, deactivate, or remove messaging providers
 4. **Message logs** — audit trail of gateway send requests (Overview + channel tabs)
-5. **Send test** — send a test message through the gateway for the workspace
+5. **Email inbox** — browse captured outbound emails (memory dispatch or `store_message_content`)
+6. **Email templates** — create and manage reusable email layouts
+7. **Settings** — general workspace settings, API keys, and message dispatch mode
+
+Use the **Get started** dialog on the logs pages for curl examples. Send traffic through the public gateway API (`POST /v1/email`, `POST /v1/sms`, etc.) with a workspace API key.
 
 For local dev with PostgreSQL, run migrations then apply seeds in order (see `database/init-db.sh`): `001_seed_permissions.sql`, `002_seed_providers.sql`, `003_seed_mailgun_config.sql`, and `004_demo_workspace.sql` (optional demo data: `demo@weprodev.com` / `secret`).
 
 ### Sending via HTTP
 
+`X-Workspace-Key` accepts the workspace **UUID** (recommended — copy from Settings or the Get started dialog) or the workspace slug.
+
 ```bash
 curl -X POST http://localhost:10101/v1/email \
   -u "wk_abc123:your-secret" \
-  -H "X-Workspace-Key: myapp" \
+  -H "X-Workspace-Key: 550e8400-e29b-41d4-a716-446655440000" \
   -H "Content-Type: application/json" \
   -d '{
     "to": ["user@example.com"],
@@ -170,7 +176,7 @@ Or with Bearer token:
 ```bash
 curl -X POST http://localhost:10101/v1/email \
   -H "Authorization: Bearer wk_abc123:your-secret" \
-  -H "X-Workspace-Key: myapp" \
+  -H "X-Workspace-Key: 550e8400-e29b-41d4-a716-446655440000" \
   -H "Content-Type: application/json" \
   -d '{"to": ["user@example.com"], "subject": "Hello", "html": "<h1>World</h1>"}'
 ```
@@ -183,7 +189,7 @@ import requests
 response = requests.post(
     "http://localhost:10101/v1/email",
     auth=("wk_abc123", "your-secret"),
-    headers={"X-Workspace-Key": "myapp"},
+    headers={"X-Workspace-Key": "550e8400-e29b-41d4-a716-446655440000"},
     json={
         "to": ["user@example.com"],
         "subject": "Hello from Python",
@@ -200,7 +206,7 @@ const response = await fetch("http://localhost:10101/v1/email", {
   method: "POST",
   headers: {
     "Authorization": "Basic " + btoa("wk_abc123:your-secret"),
-    "X-Workspace-Key": "myapp",
+    "X-Workspace-Key": "550e8400-e29b-41d4-a716-446655440000",
     "Content-Type": "application/json",
   },
   body: JSON.stringify({
@@ -240,10 +246,10 @@ curl -H "Authorization: Bearer <jwt>" http://localhost:10101/api/v1/workspaces
 Use your **workspace API key** credentials:
 ```bash
 # Basic auth
-curl -u "wk_abc123:secret" -H "X-Workspace-Key: myapp" ...
+curl -u "wk_abc123:secret" -H "X-Workspace-Key: <workspace-uuid>" ...
 
 # Bearer (colon-separated)
-curl -H "Authorization: Bearer wk_abc123:secret" -H "X-Workspace-Key: myapp" ...
+curl -H "Authorization: Bearer wk_abc123:secret" -H "X-Workspace-Key: <workspace-uuid>" ...
 ```
 
 ---
@@ -320,7 +326,7 @@ result, err := gw.SendChat(ctx, &contracts.ChatMessage{
 
 ### Portal REST API (JWT auth)
 
-Routes registered in `internal/presentation/router.go`. **Portal UI pages exist only for auth, workspace list, message logs, and send test** — other management routes are REST-only until UI is built.
+Routes registered in `internal/presentation/router.go`. **Portal UI pages exist for auth, workspace list, message logs, email inbox, integrations, and settings** — other management routes are REST-only until UI is built.
 
 #### Auth
 
@@ -337,11 +343,8 @@ Routes registered in `internal/presentation/router.go`. **Portal UI pages exist
 |--------|----------|:---------:|-------------|
 | GET | `/api/v1/workspaces` | ✓ | List workspaces for the logged-in user |
 | GET | `/api/v1/workspaces/:wid/logs` | ✓ | Message request logs (optionally filter by `channel`) |
-| POST | `/api/v1/workspaces/:wid/send-test/:channel` | ✓ | Send test via gateway (`email` / `sms` / `push` / `chat`) |
-
-#### Workspace provisioning & management (REST only — no Portal UI)
 
-Used by Bruno, curl, and CI bootstrap. Not documented endpoint-by-endpoint here; see `internal/presentation/router.go` and [E2E testing](./e2e-testing.md) for create workspace, API keys, settings, integrations, templates, and members.
+Additional workspace endpoints (create, API keys, settings, templates, members, inbox) are implemented in `internal/presentation/router.go` and covered in [Portal inbox](./portal-inbox.md) and [E2E testing](./e2e-testing.md).
 
 ### Workspace access (portal JWT routes & RBAC)
 
@@ -349,7 +352,7 @@ Workspace-scoped routes require a valid portal JWT and are governed by a Role-Ba
 
 Roles and permissions are defined in [permission.go](../../internal/core/domain/permission.go):
 - **admin**: Full read/write access. The creator of a workspace is automatically assigned this role (as `admin` in both members repository and `gogate`).
-- **member**: Read-only access to workspaces, members, API keys, logs, integrations, templates, settings, and invitations, plus the ability to send test messages (`send.test`).
+- **member**: Read-only access to workspaces, members, API keys, logs, integrations, templates, settings, and invitations, plus inbox mutations (`inbox.write`).
 
 To bootstrap roles and permissions, make sure you run the database seeds:
 1. Run `database/seeds/001_seed_permissions.sql` to populate roles (`admin`, `member`), default permissions, and role-to-permission mappings.
@@ -364,9 +367,9 @@ The HTTP server uses two distinct authorization approaches by design:
 - **Inbox SSE API (`/api/v1/workspaces/:wid/inbox/...`)**: Restricts access using JWT tokens combined with a direct database workspace membership check (`RequireWorkspaceMember`) and the workspace API key (`RequireWorkspaceAPIKey`). This decoupled model allows client-side SDKs, SSE event streaming, and automation runners to interact with the simulated inbox without requiring full portal RBAC configuration.
 
 
-### Inbox API (captured messages — REST / Bruno, not Portal UI)
+### Inbox API
 
-The Portal UI shows **request logs** (`/logs`), not the memory **inbox** (`/inbox/*`). Inbox capture, SSE, and internal ingest are documented in [Portal inbox](./portal-inbox.md).
+Captured messages are available through the Portal **Email** page (UI + SSE) and the REST inbox endpoints documented in [Portal inbox](./portal-inbox.md). SMS, push, and chat channels expose request **logs** in the UI; captured-message browsing for those channels is API-only today.
 
 ---
 
@@ -386,8 +389,8 @@ portal:
   ui_port: 10104
 ```
 
-> **Note:** Provider credentials (Mailgun API keys, etc.) are **NOT** in YAML files.
-> They are configured via the Portal REST API and stored encrypted in PostgreSQL.
+> **Note:** Provider credentials (Mailgun API keys, etc.) are **not** in YAML files.
+> Configure them on the Portal **Integrations** page or via `POST /api/v1/workspaces/:wid/integrations`. Values are stored encrypted in PostgreSQL.
 
 ### Environment Variables (Server)
 
@@ -410,27 +413,29 @@ MESSAGE_CONFIG_ENCRYPTION_KEY=your-32-byte-key-here
 
 ---
 
-## Message Dispatch Modes
+## Message Dispatch & Content Storage
 
-Control how messages are handled per workspace. Default is `memory_only`.
+Control how messages are routed and whether bodies are captured in the portal inbox.
 
-Set via REST (no Portal UI page yet):
+Defaults: `message_dispatch_mode=memory`, `store_message_content=false`.
+
+Invalid values for dispatch settings return **400 Bad Request** on PATCH.
+
+Set via Portal **Settings → Message Dispatch** or REST:
 
 ```bash
 PATCH /api/v1/workspaces/:wid/settings
 Authorization: Bearer <portal-jwt>
 Content-Type: application/json
 
-{ "message_dispatch_mode": "provider_only" }
+{ "message_dispatch_mode": "provider", "store_message_content": "true" }
 ```
 
-See [Portal inbox](./portal-inbox.md) for mode behavior.
+Portal UI: select **Memory** or **Provider**, then check **Store message content in inbox** on or off.
+
+See [Portal inbox](./portal-inbox.md) for routing behavior.
 
-| Mode | Behavior | Use Case |
-|------|----------|----------|
-| `memory_only` | In-process RAM only, **not sent** | Development, testing |
-| `provider_only` | Sent to real provider, no local copy | Production |
-| `memory_and_provider` | Both — local copy + real send | Staging, debugging |
+Every send also creates a `message_request_logs` row for operational tracing (correlation via `request_id`).
 
 ---
 
@@ -445,11 +450,11 @@ Using a Mailgun Sandbox Domain:
 
 ### Provider Not Sending
 
-Check workspace `message_dispatch_mode` via `GET /api/v1/workspaces/:wid/settings`. If it is `memory_only`, messages are captured locally — not sent to the provider.
+Check workspace settings via `GET /api/v1/workspaces/:wid/settings`. If `message_dispatch_mode` is `memory`, messages are captured locally — not sent to the provider.
 
 ### API Key Rejected
 
-- Ensure `X-Workspace-Key` matches the workspace's `unique_key` (slug, not UUID)
+- Ensure `X-Workspace-Key` matches the workspace UUID or slug
 - Verify the API key is active (`GET /api/v1/workspaces/:wid/api-keys` with portal JWT)
 - Check `client_id` and `client_secret` — secret is shown once at creation
 
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 8c463035..3ce708e2 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -8,6 +8,7 @@
       "name": "frontend",
       "version": "0.0.0",
       "dependencies": {
+        "@radix-ui/react-checkbox": "^1.3.6",
         "@radix-ui/react-dialog": "^1.1.15",
         "@radix-ui/react-separator": "^1.1.8",
         "@radix-ui/react-slot": "^1.2.4",
@@ -398,9 +399,9 @@
       }
     },
     "node_modules/@csstools/color-helpers": {
-      "version": "6.0.2",
-      "resolved": "https://registry.npmjs.org/@csstools/color-helpers/-/color-helpers-6.0.2.tgz",
-      "integrity": "sha512-LMGQLS9EuADloEFkcTBR3BwV/CGHV7zyDxVRtVDTwdI2Ca4it0CCVTT9wCkxSgokjE5Ho41hEPgb8OEUwoXr6Q==",
+      "version": "6.1.0",
+      "resolved": "https://registry.npmjs.org/@csstools/color-helpers/-/color-helpers-6.1.0.tgz",
+      "integrity": "sha512-064IFJdjTfUqnjpCVpMOdbr8FLQBhinbZj6yRv2An2E41O/pLEXqfFRWqGq/SxlE5PEUYTlvWsG2r8MswAVvkg==",
       "dev": true,
       "funding": [
         {
@@ -442,9 +443,9 @@
       }
     },
     "node_modules/@csstools/css-color-parser": {
-      "version": "4.1.8",
-      "resolved": "https://registry.npmjs.org/@csstools/css-color-parser/-/css-color-parser-4.1.8.tgz",
-      "integrity": "sha512-3chWb7PRLijpJpPIKkDxdu6IBeO5MrFACND57On0j8OPpc0wZibcGc3xAHrSEbOx/KDRyMHoIxGn0w1PhXMYHw==",
+      "version": "4.1.9",
+      "resolved": "https://registry.npmjs.org/@csstools/css-color-parser/-/css-color-parser-4.1.9.tgz",
+      "integrity": "sha512-paQcIaOO53Rk5+YrBaBjm/SgrV4INImjo2BT1DtQRYr+XeTRbeAYlS+jxXp9drqvKmtFnWRJKIalDLhZZDu42A==",
       "dev": true,
       "funding": [
         {
@@ -458,7 +459,7 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "@csstools/color-helpers": "^6.0.2",
+        "@csstools/color-helpers": "^6.1.0",
         "@csstools/css-calc": "^3.2.1"
       },
       "engines": {
@@ -493,9 +494,9 @@
       }
     },
     "node_modules/@csstools/css-syntax-patches-for-csstree": {
-      "version": "1.1.5",
-      "resolved": "https://registry.npmjs.org/@csstools/css-syntax-patches-for-csstree/-/css-syntax-patches-for-csstree-1.1.5.tgz",
-      "integrity": "sha512-oNjBvzLq2GPZtJphCjLqXow/cHySHSgtxvKZb7OqSZ/xHgw6NWNhfad+6AB9cLeVm6eA9d/qMll3JdEHjy6M+A==",
+      "version": "1.1.6",
+      "resolved": "https://registry.npmjs.org/@csstools/css-syntax-patches-for-csstree/-/css-syntax-patches-for-csstree-1.1.6.tgz",
+      "integrity": "sha512-TcJCWFbXLPpJYq6z7bfOyjWYJDiDg2/I4gyUC9pqPNqHFRIey0EB0q0L5cSnQDfWJg8Jd6VadakxdIez/3zkqQ==",
       "dev": true,
       "funding": [
         {
@@ -1314,14 +1315,14 @@
       }
     },
     "node_modules/@napi-rs/wasm-runtime": {
-      "version": "1.1.5",
-      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.1.5.tgz",
-      "integrity": "sha512-AWPoBRJ9tsnVhor4sjO7rkni+7p+2IAEFj6cx06UgP10jkQHqay/36uRV/bFkgrh18D9vb4cr8Q0Pthskgzy+Q==",
+      "version": "1.1.6",
+      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.1.6.tgz",
+      "integrity": "sha512-ZLv/JdUfkvOy9eCnnBaGfiO+XimbjebAeO+MRQqD/B+FR1tnRN0tpKSJHRbE8sFfS6aqsXZ67TQjfwfsxULVbg==",
       "dev": true,
       "license": "MIT",
       "optional": true,
       "dependencies": {
-        "@tybys/wasm-util": "^0.10.2"
+        "@tybys/wasm-util": "^0.10.3"
       },
       "funding": {
         "type": "github",
@@ -1709,9 +1710,9 @@
       }
     },
     "node_modules/@oxc-resolver/binding-android-arm-eabi": {
-      "version": "11.21.3",
-      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-android-arm-eabi/-/binding-android-arm-eabi-11.21.3.tgz",
-      "integrity": "sha512-eNU11A2WNizh04v3uyaJCootrHIaS0B9aHYXvAvVnPNk4xYSjMUjHnhQ6dewPN2MRYDskV85d1N0Aw0WNWhcyg==",
+      "version": "11.23.0",
+      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-android-arm-eabi/-/binding-android-arm-eabi-11.23.0.tgz",
+      "integrity": "sha512-8IJyWRLVAyhTfe9/TIEbQqSQnl5rUqYJrUOS6Dkr+Mq9FGHMxDGeiEmwkBqCvDP5KckpPh/GYSgbag66O6JsCw==",
       "cpu": [
         "arm"
       ],
@@ -1723,9 +1724,9 @@
       ]
     },
     "node_modules/@oxc-resolver/binding-android-arm64": {
-      "version": "11.21.3",
-      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-android-arm64/-/binding-android-arm64-11.21.3.tgz",
-      "integrity": "sha512-8Q+ZjTLvn2dIcWsrmhdrEihm7q+ag/k+mkry7Z+t0QbbHaVxXQfvH9AewyVMh/WrpEKhQ3DDgx9fYbqeCpeOEw==",
+      "version": "11.23.0",
+      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-android-arm64/-/binding-android-arm64-11.23.0.tgz",
+      "integrity": "sha512-pprVojnNhHxupwTT2gdeUlkxll6XEvWWBk3oVicOSNVWQC99OBnDhMQDoirqnzrE1bScQSMS2JgPpqdlrhz/Fg==",
       "cpu": [
         "arm64"
       ],
@@ -1737,9 +1738,9 @@
       ]
     },
     "node_modules/@oxc-resolver/binding-darwin-arm64": {
-      "version": "11.21.3",
-      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-darwin-arm64/-/binding-darwin-arm64-11.21.3.tgz",
-      "integrity": "sha512-wkh0qKZGHXVUDxFw3oA1TXnU2BDYY/r775oJflGeIr8uDPPoN2pk8gijQIzYRT6hoql/lg3+Tx/SaTn9e2/aGg==",
+      "version": "11.23.0",
+      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-darwin-arm64/-/binding-darwin-arm64-11.23.0.tgz",
+      "integrity": "sha512-mbIrWIMAJeytyee36OyUP5XH92TP7FaKaQ2m5AjokKy7STgjrhRt7SMXqpqLjhGm6Xn721Xmsg6H3Rtd9YQETw==",
       "cpu": [
         "arm64"
       ],
@@ -1751,9 +1752,9 @@
       ]
     },
     "node_modules/@oxc-resolver/binding-darwin-x64": {
-      "version": "11.21.3",
-      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-darwin-x64/-/binding-darwin-x64-11.21.3.tgz",
-      "integrity": "sha512-HbNc23FAQYbuyDV2vBWMez4u4mrsm5RAkniGZAWqr6lYZ3N4beeqIb776jzwRl8qL2zRhHVXpUj97X0QgogVzg==",
+      "version": "11.23.0",
+      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-darwin-x64/-/binding-darwin-x64-11.23.0.tgz",
+      "integrity": "sha512-UnIphmZ1LazUCr9DXWaKYWtKDefPMbgLsywaoYxRqVCNHhq4MM6d2q1Nz1i9Vzxt5i+cE2nRUYpAUHr/lijNYA==",
       "cpu": [
         "x64"
       ],
@@ -1765,9 +1766,9 @@
       ]
     },
     "node_modules/@oxc-resolver/binding-freebsd-x64": {
-      "version": "11.21.3",
-      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-freebsd-x64/-/binding-freebsd-x64-11.21.3.tgz",
-      "integrity": "sha512-K6xNsTUPEUdfrn0+kbMq5nOUB5w1C5pavPQngt4TM2FpN91lP0PBe2srSpamb4d69O7h86oAi/qWX/kZNRSjkw==",
+      "version": "11.23.0",
+      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-freebsd-x64/-/binding-freebsd-x64-11.23.0.tgz",
+      "integrity": "sha512-aaZ/cSEYFkSxgS2hOrobT6RQcsWNviOX8dW6CEkVx2/UYkAf9MeHbjl3W0usWV53rVV//ndBdn2nb1y7jsu4lw==",
       "cpu": [
         "x64"
       ],
@@ -1779,9 +1780,9 @@
       ]
     },
     "node_modules/@oxc-resolver/binding-linux-arm-gnueabihf": {
-      "version": "11.21.3",
-      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-11.21.3.tgz",
-      "integrity": "sha512-VcFmOpcpWX1zoEy8M58tR2M9YxM+Z9RuQhqAx5q0CTmrruaP7Gveejg75hzd/5sg5nk9G3aLALEa3hE2FsmmTQ==",
+      "version": "11.23.0",
+      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-11.23.0.tgz",
+      "integrity": "sha512-IoJLvO5SjLSVMaq83BNTrPCb1FppvoJc1IhZ5CoUVl3PykUBku7D+LK1j0GSurhJcIc6zfjghsvaZNpq5ev6Mg==",
       "cpu": [
         "arm"
       ],
@@ -1793,9 +1794,9 @@
       ]
     },
     "node_modules/@oxc-resolver/binding-linux-arm-musleabihf": {
-      "version": "11.21.3",
-      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-linux-arm-musleabihf/-/binding-linux-arm-musleabihf-11.21.3.tgz",
-      "integrity": "sha512-quVoxFLBy43hWaQbbDtQNRwAX5vX76mv7n64icAtQcJ3eNgVeblqmkupF/hAneNthdqSlnd1sTjb3aQSaDPaCQ==",
+      "version": "11.23.0",
+      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-linux-arm-musleabihf/-/binding-linux-arm-musleabihf-11.23.0.tgz",
+      "integrity": "sha512-vskFpwg44T/LFsfjSCnVZ5ygcuqzPC1yUzVEiKa8BgHAQz0+QLQQW3EGWLPVi8EXFghzjR4EtgPBtOhCjU4jdw==",
       "cpu": [
         "arm"
       ],
@@ -1807,9 +1808,9 @@
       ]
     },
     "node_modules/@oxc-resolver/binding-linux-arm64-gnu": {
-      "version": "11.21.3",
-      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-11.21.3.tgz",
-      "integrity": "sha512-X0AqNZgcD07Q4V3RDK18/vYOj/HQT/FnmEFGYS2jTWqY7JO13ryE3TEs3eAIgUJhBnNkpEaiXqz3VK8M7qQhWQ==",
+      "version": "11.23.0",
+      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-11.23.0.tgz",
+      "integrity": "sha512-//TcHVhrChyw5RYtgts6WO7KcWq9387c1Z5Zvhqpk/ktAbyaRYgBZrpSY1GDCFq50ASt6B6jhh+JxB1rB45IAg==",
       "cpu": [
         "arm64"
       ],
@@ -1824,9 +1825,9 @@
       ]
     },
     "node_modules/@oxc-resolver/binding-linux-arm64-musl": {
-      "version": "11.21.3",
-      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-linux-arm64-musl/-/binding-linux-arm64-musl-11.21.3.tgz",
-      "integrity": "sha512-YkaQnaKYdbuaXvRt5Qd0GpbihzVnyfR6z1SpYfIUC6RTu4NF7lDKPjVkYb+jRI2gedVO2rVpN35Y6akG6ud4Lw==",
+      "version": "11.23.0",
+      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-linux-arm64-musl/-/binding-linux-arm64-musl-11.23.0.tgz",
+      "integrity": "sha512-ZFqlwiTf7CXLLSGyAR9tYiO33LiaeIEXW+xm42d8mnUGpDgPltyrCGYtQezyMMEXvjhOgCz1X+i7sbDTJEx+bg==",
       "cpu": [
         "arm64"
       ],
@@ -1841,9 +1842,9 @@
       ]
     },
     "node_modules/@oxc-resolver/binding-linux-ppc64-gnu": {
-      "version": "11.21.3",
-      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-11.21.3.tgz",
-      "integrity": "sha512-gB9HwhrPiFqUzDeEq+y/CgAijz1YdI6BnXz5GaH2Pa9cWdutchlkGFAiAuGb/PjVQpiK6NFKzFuztxrweoit7A==",
+      "version": "11.23.0",
+      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-11.23.0.tgz",
+      "integrity": "sha512-oZ5LeN5+H1R19dRjTAxKrxQguH+AsemHcnthEfFxf4OjmBSty2doHLeSmMunKy3zpTHJQ3lh3Af+dNS+W6dYeA==",
       "cpu": [
         "ppc64"
       ],
@@ -1858,9 +1859,9 @@
       ]
     },
     "node_modules/@oxc-resolver/binding-linux-riscv64-gnu": {
-      "version": "11.21.3",
-      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-linux-riscv64-gnu/-/binding-linux-riscv64-gnu-11.21.3.tgz",
-      "integrity": "sha512-zjDWBlYk8QGv0H8dsPUWqkfjYIIjG2TvspGkzXL0eImbgxtZorA/klKeHyolevoT3Kvbi+1iMr9Lhrh7jf54Og==",
+      "version": "11.23.0",
+      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-linux-riscv64-gnu/-/binding-linux-riscv64-gnu-11.23.0.tgz",
+      "integrity": "sha512-O4ciFDyX5ebQd0qkb1bjAIg8IEfiLT03GbSeylwlwlUMK9KwBWaALwrxSbc0Msaz4U6iPj+T9eRXpD5mxBfmvA==",
       "cpu": [
         "riscv64"
       ],
@@ -1875,9 +1876,9 @@
       ]
     },
     "node_modules/@oxc-resolver/binding-linux-riscv64-musl": {
-      "version": "11.21.3",
-      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-linux-riscv64-musl/-/binding-linux-riscv64-musl-11.21.3.tgz",
-      "integrity": "sha512-4UfsQvacV388y1zpXL7C1x1FNYaV52JtuNRiuzrfQA2z1z6ElVrsidkGsrvQ5EgeSq1Pj7kaKqrgGkvFuxJ/tw==",
+      "version": "11.23.0",
+      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-linux-riscv64-musl/-/binding-linux-riscv64-musl-11.23.0.tgz",
+      "integrity": "sha512-P3o8Y9kISYjcxadmbO+94ThRwLhwGuDAbA7dcdd4+YLpfeF+mmobz8fXf4NmSdfSqjyRSkceJDBRZha9NVYkiQ==",
       "cpu": [
         "riscv64"
       ],
@@ -1892,9 +1893,9 @@
       ]
     },
     "node_modules/@oxc-resolver/binding-linux-s390x-gnu": {
-      "version": "11.21.3",
-      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-11.21.3.tgz",
-      "integrity": "sha512-b5uH+HKH0MP5mNBYaK75SKsJbw52URqrx2LavYdq6wb0l3ExAG5niYRP9DWUNHdKilpaBVM2bXk9HNWrH3ew7Q==",
+      "version": "11.23.0",
+      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-11.23.0.tgz",
+      "integrity": "sha512-oj03m1E3RmTFczKhcKJDzHaEDKJnPIsDcQFVxBJsSdXGSuIPdt5TvcM332FfMQgzI6yDJqyl4InrnFfXrmUTKQ==",
       "cpu": [
         "s390x"
       ],
@@ -1909,9 +1910,9 @@
       ]
     },
     "node_modules/@oxc-resolver/binding-linux-x64-gnu": {
-      "version": "11.21.3",
-      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-linux-x64-gnu/-/binding-linux-x64-gnu-11.21.3.tgz",
-      "integrity": "sha512-PjYlmilBpNRh2ntXNYAK3Am5w/nPfEpnU/96iNx7CI8EzAn12J4JRiec63wHJTH31nLoCNxBg/829pN+3CfG3Q==",
+      "version": "11.23.0",
+      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-linux-x64-gnu/-/binding-linux-x64-gnu-11.23.0.tgz",
+      "integrity": "sha512-BqJxbSC8FdP7mSuSpRePTGHm0hXWV+dfz//f7SjsteZncLaBgWTBmi/OZNv7sX6CyG/Pt/eJkPorP+DkMOhMwQ==",
       "cpu": [
         "x64"
       ],
@@ -1926,9 +1927,9 @@
       ]
     },
     "node_modules/@oxc-resolver/binding-linux-x64-musl": {
-      "version": "11.21.3",
-      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-linux-x64-musl/-/binding-linux-x64-musl-11.21.3.tgz",
-      "integrity": "sha512-QTBAb7JuHlZ7JUEyM8UiQi2f7m/L4swBhP2TNpYIDc9Wp/wRw1G/8sl6i13aIzQAXH7LKIm294LeOHd0lQR8zA==",
+      "version": "11.23.0",
+      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-linux-x64-musl/-/binding-linux-x64-musl-11.23.0.tgz",
+      "integrity": "sha512-utmw+VmUrW4K8LI5/6jhg4aGYKJHOIjQ9syYOOA6pF3w7haKu4r4enTe2U0C04/HbUvkq/Zif43xFsKW1Pnq9w==",
       "cpu": [
         "x64"
       ],
@@ -1943,9 +1944,9 @@
       ]
     },
     "node_modules/@oxc-resolver/binding-openharmony-arm64": {
-      "version": "11.21.3",
-      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-openharmony-arm64/-/binding-openharmony-arm64-11.21.3.tgz",
-      "integrity": "sha512-4j1DFwjwv36ec9kds0jU/ucQ5Ha4ERO/H95BxR5JFf0kqUUAJ1kwII7XhTc1vZrkdJkvLGC9Q2MbpObpum8RBg==",
+      "version": "11.23.0",
+      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-openharmony-arm64/-/binding-openharmony-arm64-11.23.0.tgz",
+      "integrity": "sha512-V6lbRrthHa4TbvsLjPtg+EkXT1tRY+s4I8rYLXUfiHlZzGx3sLv1EH9CEOOevjvUYHLsbe/gqCIc73XnQfPb9A==",
       "cpu": [
         "arm64"
       ],
@@ -1957,9 +1958,9 @@
       ]
     },
     "node_modules/@oxc-resolver/binding-wasm32-wasi": {
-      "version": "11.21.3",
-      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-wasm32-wasi/-/binding-wasm32-wasi-11.21.3.tgz",
-      "integrity": "sha512-i8oluoel5kru/j1WNrjmQSiA3GQ7wvIYVR1IwIoZtKogAhya2iub+ZKIeSIkcJOrnzQ18Tzl/F+kL3fYOxZLvA==",
+      "version": "11.23.0",
+      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-wasm32-wasi/-/binding-wasm32-wasi-11.23.0.tgz",
+      "integrity": "sha512-gRoOxQPdnAmIAjxcuQNBxfihvx+wjTaQM/9/eP12xwnGNawOG/+Zz9RHN4WNSxT45b5CrscK4NB8aPh+oZQXAQ==",
       "cpu": [
         "wasm32"
       ],
@@ -1967,18 +1968,18 @@
       "license": "MIT",
       "optional": true,
       "dependencies": {
-        "@emnapi/core": "1.11.0",
-        "@emnapi/runtime": "1.11.0",
-        "@napi-rs/wasm-runtime": "^1.1.5"
+        "@emnapi/core": "1.11.1",
+        "@emnapi/runtime": "1.11.1",
+        "@napi-rs/wasm-runtime": "^1.1.6"
       },
       "engines": {
         "node": ">=14.0.0"
       }
     },
     "node_modules/@oxc-resolver/binding-wasm32-wasi/node_modules/@emnapi/core": {
-      "version": "1.11.0",
-      "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.11.0.tgz",
-      "integrity": "sha512-l9Oo58x0HOP5znGzVhYW9U3e5wVuA4LAZU2AGezTmkhO1CgQRFDhDg4nneHsu/t3WniXg9QrG2nIXL/ZS8ln8Q==",
+      "version": "1.11.1",
+      "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.11.1.tgz",
+      "integrity": "sha512-RSvbQmHzdKzNsLYa/wHrbc3KN4sYLKAdPZxqiM2HATqv/SBk2/ENSHpvXGaLOMcsAyz0poEGqkmmKYG3OWiJEQ==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -1988,9 +1989,9 @@
       }
     },
     "node_modules/@oxc-resolver/binding-wasm32-wasi/node_modules/@emnapi/runtime": {
-      "version": "1.11.0",
-      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.11.0.tgz",
-      "integrity": "sha512-55coeOFKHv1ywEcUXJtWU5f+Jr/W5tZDvZig8DLKSwUN1JpROQ4rk/SNOQiFWmaR/VKF4zuFyW1B8JduOSv6Pg==",
+      "version": "1.11.1",
+      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.11.1.tgz",
+      "integrity": "sha512-vgj7R3y3Wgx24IQaGPA/R6YFXLHVMOZ0uVEyIQPaWs+rd1AzfEMXlAC22FYwO1XkKR6NPsq7mUandH8oIRdZFw==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -2010,9 +2011,9 @@
       }
     },
     "node_modules/@oxc-resolver/binding-win32-arm64-msvc": {
-      "version": "11.21.3",
-      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-11.21.3.tgz",
-      "integrity": "sha512-M/8dw8dD6aOs+NlPJax401CZB9I7Aut84isQLgALGGwke4Afvw+/7yYhZb94yXf6t2sPLhQLmSmtSV+2FhsOWg==",
+      "version": "11.23.0",
+      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-11.23.0.tgz",
+      "integrity": "sha512-CgTGMYsJVe1eUiCdJTpGw21svXw79ITsemN1h0hcNkiswasDbN5MoibSLY+gRMWP5syfEz5iffrjZnwEP8xeUA==",
       "cpu": [
         "arm64"
       ],
@@ -2024,9 +2025,9 @@
       ]
     },
     "node_modules/@oxc-resolver/binding-win32-x64-msvc": {
-      "version": "11.21.3",
-      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-win32-x64-msvc/-/binding-win32-x64-msvc-11.21.3.tgz",
-      "integrity": "sha512-H7BCt/VnS9hnmMp42eGhZ99izSCRvlnWwy/N71K1/J8QoExwY4262Z8QiEkMDtduRJrztayDxETTckmUuAVL9Q==",
+      "version": "11.23.0",
+      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-win32-x64-msvc/-/binding-win32-x64-msvc-11.23.0.tgz",
+      "integrity": "sha512-gUGJpr+Rn6zMxm5juApV0K3U845i8t47o8k+rbO0BHbi4PoJIfSPeQmrE2dgohQm2g5k6iviNFyXCGqvmaYUpw==",
       "cpu": [
         "x64"
       ],
@@ -2043,15 +2044,45 @@
       "integrity": "sha512-7AdCK9PQyiljKoBDbN8OuctCbd/esdwZPQ8RtOE3SsyQtUpiPb+ND75q0jEhC1m1ecBI0MFNeLJvwIh9iKHRcQ==",
       "license": "MIT"
     },
+    "node_modules/@radix-ui/react-checkbox": {
+      "version": "1.3.6",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-checkbox/-/react-checkbox-1.3.6.tgz",
+      "integrity": "sha512-eUEUoGMDpfkgHWSE97ZZaUJtzR1M7EKnNIpD1Q16+8JR9NWghcaqMulx9PuCQ720w0UclfYn6FEbCdd5Hx087g==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/primitive": "1.1.4",
+        "@radix-ui/react-compose-refs": "1.1.3",
+        "@radix-ui/react-context": "1.1.4",
+        "@radix-ui/react-presence": "1.1.6",
+        "@radix-ui/react-primitive": "2.1.7",
+        "@radix-ui/react-use-controllable-state": "1.2.3",
+        "@radix-ui/react-use-previous": "1.1.2",
+        "@radix-ui/react-use-size": "1.1.2"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
     "node_modules/@radix-ui/react-collection": {
-      "version": "1.1.10",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-collection/-/react-collection-1.1.10.tgz",
-      "integrity": "sha512-IVVz4EvBcKjrzKgof714qDnz/SzQAkLA2Emh5edlHbgcE6fNd3Un6CJLlaYcnm8N4JmAtzQgse4dOKxcD2yc9g==",
+      "version": "1.1.11",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-collection/-/react-collection-1.1.11.tgz",
+      "integrity": "sha512-djW9+zeg137KQdlPtmE8xnaD+K2rcXXMWFrSg0hsmYZ6HRbdTA7tDHFgpaW9+huWVEu0RCabL+985T4TA0BE7g==",
       "license": "MIT",
       "dependencies": {
         "@radix-ui/react-compose-refs": "1.1.3",
         "@radix-ui/react-context": "1.1.4",
-        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-primitive": "2.1.7",
         "@radix-ui/react-slot": "1.3.0"
       },
       "peerDependencies": {
@@ -2100,21 +2131,21 @@
       }
     },
     "node_modules/@radix-ui/react-dialog": {
-      "version": "1.1.17",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-dialog/-/react-dialog-1.1.17.tgz",
-      "integrity": "sha512-TDTYmpdq8dI2+Xgvgj9AJ8Ghqq+Eph/TRVEdaFQPDItIY+6QSkU7MJMeevw1568Yw/2Ijz8BTphPSP2XejKphw==",
+      "version": "1.1.18",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-dialog/-/react-dialog-1.1.18.tgz",
+      "integrity": "sha512-apa28mldjMgORmE6g/w3sCcA0Y9UAVeeDVoozN4i7kOw12mLl9RBchfzK3Nn6qxOWjrZhK1Lfy7f07kyzxtnBw==",
       "license": "MIT",
       "dependencies": {
         "@radix-ui/primitive": "1.1.4",
         "@radix-ui/react-compose-refs": "1.1.3",
         "@radix-ui/react-context": "1.1.4",
-        "@radix-ui/react-dismissable-layer": "1.1.13",
+        "@radix-ui/react-dismissable-layer": "1.1.14",
         "@radix-ui/react-focus-guards": "1.1.4",
-        "@radix-ui/react-focus-scope": "1.1.10",
+        "@radix-ui/react-focus-scope": "1.1.11",
         "@radix-ui/react-id": "1.1.2",
-        "@radix-ui/react-portal": "1.1.12",
+        "@radix-ui/react-portal": "1.1.13",
         "@radix-ui/react-presence": "1.1.6",
-        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-primitive": "2.1.7",
         "@radix-ui/react-slot": "1.3.0",
         "@radix-ui/react-use-controllable-state": "1.2.3",
         "aria-hidden": "^1.2.4",
@@ -2151,16 +2182,16 @@
       }
     },
     "node_modules/@radix-ui/react-dismissable-layer": {
-      "version": "1.1.13",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-dismissable-layer/-/react-dismissable-layer-1.1.13.tgz",
-      "integrity": "sha512-2v+zNAWWe0ySxgC0D0yeXMPQ23xZVgXZTerTz+JKlmdRj6gfTqmCcR29jb6d290DezXPGgruHWDX/vYUebtErg==",
+      "version": "1.1.14",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-dismissable-layer/-/react-dismissable-layer-1.1.14.tgz",
+      "integrity": "sha512-4lUhWTWAjbDIqFrAPWJ3WqBOpO5YchVZ88X3nh6H9Lu5AFi5nCUeTPj3D8FSDmabmFeRe9ME0BDA4MwKTha5GQ==",
       "license": "MIT",
       "dependencies": {
         "@radix-ui/primitive": "1.1.4",
         "@radix-ui/react-compose-refs": "1.1.3",
-        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-primitive": "2.1.7",
         "@radix-ui/react-use-callback-ref": "1.1.2",
-        "@radix-ui/react-use-escape-keydown": "1.1.2"
+        "@radix-ui/react-use-effect-event": "0.0.3"
       },
       "peerDependencies": {
         "@types/react": "*",
@@ -2193,13 +2224,13 @@
       }
     },
     "node_modules/@radix-ui/react-focus-scope": {
-      "version": "1.1.10",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-focus-scope/-/react-focus-scope-1.1.10.tgz",
-      "integrity": "sha512-Fas/lXQqhVvqwAb64s5RFeHiHYElZ6SUQbZaNd6EkfhP/Al7wTIQ9WIR4QVX475tlu5yFCEdDcJH6/UwsZjMWw==",
+      "version": "1.1.11",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-focus-scope/-/react-focus-scope-1.1.11.tgz",
+      "integrity": "sha512-Mn88Vg2whaRocGJNOH+DKFqYm6ySFPQaiwHNxZPyjn99B52KAEJWWY9NP83+nWdk2HM3rdov+STu9AG471Rt9w==",
       "license": "MIT",
       "dependencies": {
         "@radix-ui/react-compose-refs": "1.1.3",
-        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-primitive": "2.1.7",
         "@radix-ui/react-use-callback-ref": "1.1.2"
       },
       "peerDependencies": {
@@ -2236,12 +2267,12 @@
       }
     },
     "node_modules/@radix-ui/react-portal": {
-      "version": "1.1.12",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-portal/-/react-portal-1.1.12.tgz",
-      "integrity": "sha512-m309havGzsjLHHaIX50G5PlvRs3xkgPCsGk/5PTvYm8D5q33yG0J7w/712PTOhid7NTaFETtnSXjngHQavvhVw==",
+      "version": "1.1.13",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-portal/-/react-portal-1.1.13.tgz",
+      "integrity": "sha512-z3oXfmaHLJTF1wktbjgD6cn9jiEbq3WSondB10LIuIt2m2Ym4iJlrW04/euMwENDdWDdE7z+OuY7Qyp1YpRSwA==",
       "license": "MIT",
       "dependencies": {
-        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-primitive": "2.1.7",
         "@radix-ui/react-use-layout-effect": "1.1.2"
       },
       "peerDependencies": {
@@ -2283,9 +2314,9 @@
       }
     },
     "node_modules/@radix-ui/react-primitive": {
-      "version": "2.1.6",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-primitive/-/react-primitive-2.1.6.tgz",
-      "integrity": "sha512-wetd0QI77DbvrPpTAvH1SqOxsYF2wZe5TNxqwOd5Ty4XDpV3dpV0s8K/1MGMJBeY5o7lg8ub5VIt1Ub+yVen6g==",
+      "version": "2.1.7",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-primitive/-/react-primitive-2.1.7.tgz",
+      "integrity": "sha512-bC3NiwsprbxKjuon9l7X6BUTw7FPVzEYaL92MPEY5SCd/9hUTPXVFtVwRix7778wtRsVao+zE062gL79FZleeQ==",
       "license": "MIT",
       "dependencies": {
         "@radix-ui/react-slot": "1.3.0"
@@ -2306,18 +2337,18 @@
       }
     },
     "node_modules/@radix-ui/react-roving-focus": {
-      "version": "1.1.13",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-roving-focus/-/react-roving-focus-1.1.13.tgz",
-      "integrity": "sha512-9gkwneI0guf8JDmrFxPjJF6Ozzgioyw+/lonYNCwefS9ZHA05er0BVHiXr+LbWGHxUfczvMY6G1oiZZi1VzjRw==",
+      "version": "1.1.14",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-roving-focus/-/react-roving-focus-1.1.14.tgz",
+      "integrity": "sha512-8Qcnx9447tx/aCBgw6Jenfqg4Skq+vqab9mCBmuGNipIS5YXvL275wbKEu7+ICYHIlAPgCduUMJH1XOYewKF6Q==",
       "license": "MIT",
       "dependencies": {
         "@radix-ui/primitive": "1.1.4",
-        "@radix-ui/react-collection": "1.1.10",
+        "@radix-ui/react-collection": "1.1.11",
         "@radix-ui/react-compose-refs": "1.1.3",
         "@radix-ui/react-context": "1.1.4",
         "@radix-ui/react-direction": "1.1.2",
         "@radix-ui/react-id": "1.1.2",
-        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-primitive": "2.1.7",
         "@radix-ui/react-use-callback-ref": "1.1.2",
         "@radix-ui/react-use-controllable-state": "1.2.3"
       },
@@ -2337,12 +2368,12 @@
       }
     },
     "node_modules/@radix-ui/react-separator": {
-      "version": "1.1.10",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-separator/-/react-separator-1.1.10.tgz",
-      "integrity": "sha512-Y6K6jLQCVfCnTL2MEtGxDLffkhNfEfHsEg3Wa8JU+IWdn3EWbLXd3OuOfQRN7p/W/cUce1WyTk3QeuAoDBzN9g==",
+      "version": "1.1.11",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-separator/-/react-separator-1.1.11.tgz",
+      "integrity": "sha512-jRhe86+8PF7VZ1u14eOWVOuh2BuAhALg/FT1VcMC4OHedMTRUazDnDlKTt+yxo5cRNKHMfmvZ4sSQtWDeMV4CQ==",
       "license": "MIT",
       "dependencies": {
-        "@radix-ui/react-primitive": "2.1.6"
+        "@radix-ui/react-primitive": "2.1.7"
       },
       "peerDependencies": {
         "@types/react": "*",
@@ -2378,9 +2409,9 @@
       }
     },
     "node_modules/@radix-ui/react-tabs": {
-      "version": "1.1.15",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-tabs/-/react-tabs-1.1.15.tgz",
-      "integrity": "sha512-kxc9gI6/HfcU4nfMMVS3AmQK414kbU1IE6UCJmMmxjhO3cRPXOyYnmvyKD+ODt7q56nRq9l7Wovi6uaGwKgMlg==",
+      "version": "1.1.16",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-tabs/-/react-tabs-1.1.16.tgz",
+      "integrity": "sha512-v3Ab2l7z6U7tRB4xA0IyKdq0OsqaO1o9ZjsIEoKKnSZ/l96mZz8aCTX0NCXw+YVHJXr8Km4d+Mn6/Q8YjXa+gw==",
       "license": "MIT",
       "dependencies": {
         "@radix-ui/primitive": "1.1.4",
@@ -2388,8 +2419,8 @@
         "@radix-ui/react-direction": "1.1.2",
         "@radix-ui/react-id": "1.1.2",
         "@radix-ui/react-presence": "1.1.6",
-        "@radix-ui/react-primitive": "2.1.6",
-        "@radix-ui/react-roving-focus": "1.1.13",
+        "@radix-ui/react-primitive": "2.1.7",
+        "@radix-ui/react-roving-focus": "1.1.14",
         "@radix-ui/react-use-controllable-state": "1.2.3"
       },
       "peerDependencies": {
@@ -2459,14 +2490,26 @@
         }
       }
     },
-    "node_modules/@radix-ui/react-use-escape-keydown": {
+    "node_modules/@radix-ui/react-use-layout-effect": {
       "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-use-escape-keydown/-/react-use-escape-keydown-1.1.2.tgz",
-      "integrity": "sha512-2uVLvLjgO7NZCWw01/FdqRwmA42J0BcjPMUCA+koFEOAb+zjqIP7SiFz/7zWPrKnVmSqr76Omq2ALyCuX4dhLw==",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-use-layout-effect/-/react-use-layout-effect-1.1.2.tgz",
+      "integrity": "sha512-jrBWOxZITuGcnjRCM2t2U5ZPkCLxD+Ym6DjfssS5haTj2iiak/DOb64JeN6OdLfLgptb6/e2kKR+ZuTrGoZTPA==",
       "license": "MIT",
-      "dependencies": {
-        "@radix-ui/react-use-callback-ref": "1.1.2"
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
       },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-use-previous": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-use-previous/-/react-use-previous-1.1.2.tgz",
+      "integrity": "sha512-IGBQPtRFdhN6MQ8dbegVmBq1LVZluya3F1jWY+puIcQC3MHctRwTDSBWCkL/3ZcnMJLTMJ++Z+ktmvg0F89iCw==",
+      "license": "MIT",
       "peerDependencies": {
         "@types/react": "*",
         "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
@@ -2477,11 +2520,14 @@
         }
       }
     },
-    "node_modules/@radix-ui/react-use-layout-effect": {
+    "node_modules/@radix-ui/react-use-size": {
       "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-use-layout-effect/-/react-use-layout-effect-1.1.2.tgz",
-      "integrity": "sha512-jrBWOxZITuGcnjRCM2t2U5ZPkCLxD+Ym6DjfssS5haTj2iiak/DOb64JeN6OdLfLgptb6/e2kKR+ZuTrGoZTPA==",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-use-size/-/react-use-size-1.1.2.tgz",
+      "integrity": "sha512-giWQp+4mxjBPt4KZ0MmyuykFNWfbDxKt4x+fPkRYmgRFJSbCZFzUglvMb/Kjn38tm10YP4ufiQZDx3zna4LU6w==",
       "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-use-layout-effect": "1.1.2"
+      },
       "peerDependencies": {
         "@types/react": "*",
         "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
@@ -2493,9 +2539,9 @@
       }
     },
     "node_modules/@rolldown/binding-android-arm64": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.0.3.tgz",
-      "integrity": "sha512-454rs7jHngixp/NMxd5srYD57OnzSlZ/eFTETjORQHLwJG1lRtmNOJcBerZlfu4GjKqeq8aCCIQrMdHyhI51Hw==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.1.4.tgz",
+      "integrity": "sha512-EZLpf/8y7GXkkra90ML47kzik/GMP3EMcE9bPyHmRfxLC6z9+aW5A8poCsoxjrT5GfEcNAAvWwUHjvP1pUQkfw==",
       "cpu": [
         "arm64"
       ],
@@ -2510,9 +2556,9 @@
       }
     },
     "node_modules/@rolldown/binding-darwin-arm64": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.0.3.tgz",
-      "integrity": "sha512-PcAhP+ynjURNyy8SKGl5DQP94aGuB/7JrXJb/t7P+hanXvQVMWzUvRRhBAcg/lNRadBhoUPqSoP4xw5tR/KBEA==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.1.4.tgz",
+      "integrity": "sha512-aUi+HBvmYb7j8krl1+qJgkG8C17fO79gk3c+jPw4S8glRFc1DTija9S3EyaTSQUm5GJXYKDAsugBEhFHH2vYiQ==",
       "cpu": [
         "arm64"
       ],
@@ -2527,9 +2573,9 @@
       }
     },
     "node_modules/@rolldown/binding-darwin-x64": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.0.3.tgz",
-      "integrity": "sha512-9YpfeUvSE2RS7wysJ81uOZkXJz7f7Q55H2Gvp3VEw/EsahqDtrphrZ0EwDLK5vvKOzaCrBsjF8JmnMLcUt78Gg==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.1.4.tgz",
+      "integrity": "sha512-F7hHC3gwY11+vByKPRWqwGbeXWVgKmL+pTGCinaEhdihzBV2aQ0fvZOch9cXYUOKuKKq429HeYXOqQLc7wFCEg==",
       "cpu": [
         "x64"
       ],
@@ -2544,9 +2590,9 @@
       }
     },
     "node_modules/@rolldown/binding-freebsd-x64": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.0.3.tgz",
-      "integrity": "sha512-yB1IlAsSNHncV6SCTL27/MVGR5htvQsoGxIv5KMGXALp+Ll1wYsn+x98M9MW7qa+NdSbvrrY7ANI4wLJ0n1e6g==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.1.4.tgz",
+      "integrity": "sha512-sI5yw+7s92SK6odiEhD5lKCBlWcpjHS5qyqpVQbZAJ0fIzEUXrmbl3DH2ybR3PZogulNJF+COLtmA8hUfvkCCQ==",
       "cpu": [
         "x64"
       ],
@@ -2561,9 +2607,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-arm-gnueabihf": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.0.3.tgz",
-      "integrity": "sha512-Yi30IVAAfLUCy2MseFjbB1jAMDl1VMCAas5StnYp8da9+CKvMd2H2cbEjWcw5NPaPqzvYkVIaF1nNUG+b7u/sw==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.1.4.tgz",
+      "integrity": "sha512-mCi0OKgEieFircrtVYmQAFGszRtMnZ6fpZAXrxanXAu7lqZcsK1E1RAaZNG0uKAnxox3B1f4EyQNnoyMfN1vAA==",
       "cpu": [
         "arm"
       ],
@@ -2578,9 +2624,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-arm64-gnu": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.0.3.tgz",
-      "integrity": "sha512-jsO7R8To+AdlYgUmN5sHSCZbfhtMBkO0WUx8iORQnPcMMdgr7qM2DQmMwgabs3GhNztdmoKkMKQFHD6DTMCIQw==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.1.4.tgz",
+      "integrity": "sha512-B9Ial3Kv5sh0SHnB1g/QWcUQCEvCF6QKGAl4zXypYj65mVI+B4AhFBwPtSN7pDrJeIx8Z7zdy4ntx+wQABom7w==",
       "cpu": [
         "arm64"
       ],
@@ -2598,9 +2644,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-arm64-musl": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.0.3.tgz",
-      "integrity": "sha512-VWkUHwWriDciit80wleYwKILoR/KMvxh/IdwS/paX+ZgpuRpCrKLUdadJbc0NpBEiyhpYawsJ73j9aCvOH+f7Q==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.1.4.tgz",
+      "integrity": "sha512-lZVym0PuHE1KZ22gmFTC15lAkrg9iTszR617oYRB/iPY1A56ywoJzVKOJBKaot5RiikCObmur6pogpse3gRcng==",
       "cpu": [
         "arm64"
       ],
@@ -2618,9 +2664,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-ppc64-gnu": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.0.3.tgz",
-      "integrity": "sha512-5f1laC0SlIR0yDbFCd8acUhvJIag6N3zC5P7oUPN6wX0aOma+uKJ0wBDH5aq7I1PVI2ttTlhJwzwRIBnLiSGEg==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.1.4.tgz",
+      "integrity": "sha512-t2DNiLJWNTbnEHyUzTumldML6ET4/g16467LZoDDJ3tSxGvguL5/NyC2lCsNKuyRycg9XeDQF5SSv+TNOhQEXg==",
       "cpu": [
         "ppc64"
       ],
@@ -2638,9 +2684,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-s390x-gnu": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.0.3.tgz",
-      "integrity": "sha512-Iq4ko0r4XsgbrF/LunNgHtAGLRRVE2kXonAXQ/MV0mC6jQpMOhW1SvtZja2EhC/kd05++bP78dsqBeIQyYJ6Yg==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.1.4.tgz",
+      "integrity": "sha512-0WIRnL1Uw4BvTZRLQt+PVgo6ZKTJadlC2btP+/EOXv2f/DWbY0rEgl+y834mIVwP1FkTlWVTrGGJXf12lru7EQ==",
       "cpu": [
         "s390x"
       ],
@@ -2658,9 +2704,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-x64-gnu": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.0.3.tgz",
-      "integrity": "sha512-B8m6tD5+/N5FeNQFbKlLA/2yVq9ycQP1SeedyEYYKWBNR3ZQbkvIUcNnDNM03lO1l5F2roiiFJGgvoLLyZXtSg==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.1.4.tgz",
+      "integrity": "sha512-JWtGshGfX+oENAKonoNkqEJX+7hC8yfhi9GUyPX1VX4mdh1y5r+ZiJLR5XzAB0aoP6s/PcILsGjKq8O0mm24bw==",
       "cpu": [
         "x64"
       ],
@@ -2678,9 +2724,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-x64-musl": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.0.3.tgz",
-      "integrity": "sha512-pSdpdUJHkuCxun9LE7jvgUB9qsRgaiyNNCX7m/AvHTcq67AiT/Yhoxvw5zPfhrM8k/BfP8ce/hMOpthKDpEUow==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.1.4.tgz",
+      "integrity": "sha512-rT6yQcxUuXs4CnbofqwHRRV0iem349rLMYpTjkgQGLjrY4ado/eDzwPZPTCgTOlF6Nkp8NEv70yLMTn6qkWxsQ==",
       "cpu": [
         "x64"
       ],
@@ -2698,9 +2744,9 @@
       }
     },
     "node_modules/@rolldown/binding-openharmony-arm64": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.0.3.tgz",
-      "integrity": "sha512-OXXS3RKJgX2uLwM+gYyuH5omcH8fL1LJs96pZGgtetVCahON57+d4SJHzTgZiOjxgGkSnpXpOsWuPDGAKAigEg==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.1.4.tgz",
+      "integrity": "sha512-KXMGoboq5cyaCQjDA4GLuRiOwBQ0EyFnJoVViLeZ45/3rFItRODEr+NdsBcVpll40hhNArlm/speWGRvj08LzA==",
       "cpu": [
         "arm64"
       ],
@@ -2715,9 +2761,9 @@
       }
     },
     "node_modules/@rolldown/binding-wasm32-wasi": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-wasm32-wasi/-/binding-wasm32-wasi-1.0.3.tgz",
-      "integrity": "sha512-JTtb8BWFynicNSoPrehsCzBtOKjZ6jhMiPFEmOiuXg1Fl8dn2KHQob+GuPSGR0dryQa1PQJbzjF3dqO/whhjLg==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-wasm32-wasi/-/binding-wasm32-wasi-1.1.4.tgz",
+      "integrity": "sha512-5K83rb36oJiY7BCyE9zLZtGcPV4g5wvq+xwdO0XPIwDVZI8cyB/AUjkNXGb92/rnmezEkjMOpgY61rtwjQtFwg==",
       "cpu": [
         "wasm32"
       ],
@@ -2725,30 +2771,41 @@
       "license": "MIT",
       "optional": true,
       "dependencies": {
-        "@emnapi/core": "1.10.0",
-        "@emnapi/runtime": "1.10.0",
-        "@napi-rs/wasm-runtime": "^1.1.4"
+        "@emnapi/core": "1.11.1",
+        "@emnapi/runtime": "1.11.1",
+        "@napi-rs/wasm-runtime": "^1.1.6"
       },
       "engines": {
         "node": "^20.19.0 || >=22.12.0"
       }
     },
     "node_modules/@rolldown/binding-wasm32-wasi/node_modules/@emnapi/core": {
-      "version": "1.10.0",
-      "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.10.0.tgz",
-      "integrity": "sha512-yq6OkJ4p82CAfPl0u9mQebQHKPJkY7WrIuk205cTYnYe+k2Z8YBh11FrbRG/H6ihirqcacOgl2BIO8oyMQLeXw==",
+      "version": "1.11.1",
+      "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.11.1.tgz",
+      "integrity": "sha512-RSvbQmHzdKzNsLYa/wHrbc3KN4sYLKAdPZxqiM2HATqv/SBk2/ENSHpvXGaLOMcsAyz0poEGqkmmKYG3OWiJEQ==",
       "dev": true,
       "license": "MIT",
       "optional": true,
       "dependencies": {
-        "@emnapi/wasi-threads": "1.2.1",
+        "@emnapi/wasi-threads": "1.2.2",
         "tslib": "^2.4.0"
       }
     },
     "node_modules/@rolldown/binding-wasm32-wasi/node_modules/@emnapi/runtime": {
-      "version": "1.10.0",
-      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.10.0.tgz",
-      "integrity": "sha512-ewvYlk86xUoGI0zQRNq/mC+16R1QeDlKQy21Ki3oSYXNgLb45GV1P6A0M+/s6nyCuNDqe5VpaY84BzXGwVbwFA==",
+      "version": "1.11.1",
+      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.11.1.tgz",
+      "integrity": "sha512-vgj7R3y3Wgx24IQaGPA/R6YFXLHVMOZ0uVEyIQPaWs+rd1AzfEMXlAC22FYwO1XkKR6NPsq7mUandH8oIRdZFw==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@rolldown/binding-wasm32-wasi/node_modules/@emnapi/wasi-threads": {
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/@emnapi/wasi-threads/-/wasi-threads-1.2.2.tgz",
+      "integrity": "sha512-c95qOXkHdydNKhscBTebqEC1CVAZpyqOfVfBzQ1qgzyl3gfeldUjIggDbIZgDKsHLgnsM+igH7TJ/eAasaVuMA==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -2757,9 +2814,9 @@
       }
     },
     "node_modules/@rolldown/binding-win32-arm64-msvc": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.0.3.tgz",
-      "integrity": "sha512-gEdFFEN70A/jxb2svrWsN3aDL7OUtmvlOy+6fa2jxG8K0wQ1ZbdeLGnidov6Yu5/733dI5ySfzFlQ/cb0bSz1g==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.1.4.tgz",
+      "integrity": "sha512-PnWBtw3TV5KOg69HQQDR0mnQuyCmSGR2pAB4DC1rPF808fgKeTUMj2EOEyKATpgiuxuR5APQmiDO7PDgEjTFSA==",
       "cpu": [
         "arm64"
       ],
@@ -2774,9 +2831,9 @@
       }
     },
     "node_modules/@rolldown/binding-win32-x64-msvc": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.0.3.tgz",
-      "integrity": "sha512-eXB7CHuaQdqmJcc3koCNtNPmT/bj2gc999kUFgBxG8Ac0NdgXc4rkCHhqrgrhN3zddvvvrgzj1e90SuSfmyIXA==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.1.4.tgz",
+      "integrity": "sha512-M1lpniBePobTfsa7Ks9a199e1akxsXn+GYBUKsEzv3YFzOm1HJAMNwKI3qr0Zq+mxwx9gOZoTdP1yXRYsZUocQ==",
       "cpu": [
         "x64"
       ],
@@ -2945,14 +3002,13 @@
       "license": "MIT"
     },
     "node_modules/@storybook/icons": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/@storybook/icons/-/icons-2.0.2.tgz",
-      "integrity": "sha512-KZBCpXsshAIjczYNXR/rlxEtCUX/eAbpFNwKi8bcOomrLA4t/SyPz5RF+lVPO2oZBUE4sAkt43mfJUevQDSEEw==",
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/@storybook/icons/-/icons-2.1.0.tgz",
+      "integrity": "sha512-Fxh9vYpX9bQqFeHRiY8h2ApeRGDzRSMLwJwNZ/AIRqnyOKHxRKL+yFe+ctEkVJmuptRE9u1Hrn8ZZNHyfDKKNg==",
       "dev": true,
       "license": "MIT",
       "peerDependencies": {
-        "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
-        "react-dom": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0"
+        "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0"
       }
     },
     "node_modules/@storybook/react": {
@@ -3046,15 +3102,15 @@
       }
     },
     "node_modules/@swc/core": {
-      "version": "1.15.41",
-      "resolved": "https://registry.npmjs.org/@swc/core/-/core-1.15.41.tgz",
-      "integrity": "sha512-03nQq/082QRJJiOvp3FGbgxTGyyxMxohPTjhk/W9bD2J0tk4ukITI7goOhOO2WbaHn/lsPmo/zf8+DIXhwpgYQ==",
+      "version": "1.15.43",
+      "resolved": "https://registry.npmjs.org/@swc/core/-/core-1.15.43.tgz",
+      "integrity": "sha512-1CuKjFkPxIgGdeHVuNbkxmBxkcbdc08u0aiI43pFq6yY1tTVKmXT9hFEooyyKs/sJ3xf1GPHyEwTtk9Xl8dvQw==",
       "dev": true,
       "hasInstallScript": true,
       "license": "Apache-2.0",
       "dependencies": {
         "@swc/counter": "^0.1.3",
-        "@swc/types": "^0.1.26"
+        "@swc/types": "^0.1.27"
       },
       "engines": {
         "node": ">=10"
@@ -3064,18 +3120,18 @@
         "url": "https://opencollective.com/swc"
       },
       "optionalDependencies": {
-        "@swc/core-darwin-arm64": "1.15.41",
-        "@swc/core-darwin-x64": "1.15.41",
-        "@swc/core-linux-arm-gnueabihf": "1.15.41",
-        "@swc/core-linux-arm64-gnu": "1.15.41",
-        "@swc/core-linux-arm64-musl": "1.15.41",
-        "@swc/core-linux-ppc64-gnu": "1.15.41",
-        "@swc/core-linux-s390x-gnu": "1.15.41",
-        "@swc/core-linux-x64-gnu": "1.15.41",
-        "@swc/core-linux-x64-musl": "1.15.41",
-        "@swc/core-win32-arm64-msvc": "1.15.41",
-        "@swc/core-win32-ia32-msvc": "1.15.41",
-        "@swc/core-win32-x64-msvc": "1.15.41"
+        "@swc/core-darwin-arm64": "1.15.43",
+        "@swc/core-darwin-x64": "1.15.43",
+        "@swc/core-linux-arm-gnueabihf": "1.15.43",
+        "@swc/core-linux-arm64-gnu": "1.15.43",
+        "@swc/core-linux-arm64-musl": "1.15.43",
+        "@swc/core-linux-ppc64-gnu": "1.15.43",
+        "@swc/core-linux-s390x-gnu": "1.15.43",
+        "@swc/core-linux-x64-gnu": "1.15.43",
+        "@swc/core-linux-x64-musl": "1.15.43",
+        "@swc/core-win32-arm64-msvc": "1.15.43",
+        "@swc/core-win32-ia32-msvc": "1.15.43",
+        "@swc/core-win32-x64-msvc": "1.15.43"
       },
       "peerDependencies": {
         "@swc/helpers": ">=0.5.17"
@@ -3087,9 +3143,9 @@
       }
     },
     "node_modules/@swc/core-darwin-arm64": {
-      "version": "1.15.41",
-      "resolved": "https://registry.npmjs.org/@swc/core-darwin-arm64/-/core-darwin-arm64-1.15.41.tgz",
-      "integrity": "sha512-kREh6J5paQFvP3i7f/4FbqRNOJREutVFVOkder4GVyCBQ39YmER55cW/y1NNjwrchzFqgYswFn0mMDCqbqKzrw==",
+      "version": "1.15.43",
+      "resolved": "https://registry.npmjs.org/@swc/core-darwin-arm64/-/core-darwin-arm64-1.15.43.tgz",
+      "integrity": "sha512-v1aVuvXdo/BHxJzco9V2xpHrvwWmhfS8t6gziY5wJxd+Z2h8AeJRnAwPD8itCDaGXVBwJ/CaKfxEzTkG0Va0OA==",
       "cpu": [
         "arm64"
       ],
@@ -3104,9 +3160,9 @@
       }
     },
     "node_modules/@swc/core-darwin-x64": {
-      "version": "1.15.41",
-      "resolved": "https://registry.npmjs.org/@swc/core-darwin-x64/-/core-darwin-x64-1.15.41.tgz",
-      "integrity": "sha512-N8B56ESFazZAWZyIkecADSPCwlLEinW7QLMEeotCpv4J7VXwfH+OLkmRL8o96UZ+1355fwHxDTS6/wK7yucvkA==",
+      "version": "1.15.43",
+      "resolved": "https://registry.npmjs.org/@swc/core-darwin-x64/-/core-darwin-x64-1.15.43.tgz",
+      "integrity": "sha512-lp3d4Lamc8dt5huYdGLSR+9hLxmfr1jb0l+4XXG2zPqZwYWRN9R0U2qYoTrggiU2RWW0oV9VbWM3kBnqIc2kdQ==",
       "cpu": [
         "x64"
       ],
@@ -3121,9 +3177,9 @@
       }
     },
     "node_modules/@swc/core-linux-arm-gnueabihf": {
-      "version": "1.15.41",
-      "resolved": "https://registry.npmjs.org/@swc/core-linux-arm-gnueabihf/-/core-linux-arm-gnueabihf-1.15.41.tgz",
-      "integrity": "sha512-6XrId2fyle0mS5xxON8rU84mPd2Cq1kDJRj+4BnQKTd7u+2kSA6Ww+JkOP0iTNqOqt9OXhPOEAjBHAuonWcdCg==",
+      "version": "1.15.43",
+      "resolved": "https://registry.npmjs.org/@swc/core-linux-arm-gnueabihf/-/core-linux-arm-gnueabihf-1.15.43.tgz",
+      "integrity": "sha512-JWTQQELtsG5GgphDrr/XqqmM2pDN3cZqbMS0Mrg+iTiXL3F74sn/S2IyYE/5u4h2KLkTf9qQ7dXyxsbx7YzkeA==",
       "cpu": [
         "arm"
       ],
@@ -3138,9 +3194,9 @@
       }
     },
     "node_modules/@swc/core-linux-arm64-gnu": {
-      "version": "1.15.41",
-      "resolved": "https://registry.npmjs.org/@swc/core-linux-arm64-gnu/-/core-linux-arm64-gnu-1.15.41.tgz",
-      "integrity": "sha512-ynLIarxlkVnqHn1D0fKOVht6mNU5ks6lrH+MY3kkS+XFaGGgDxFZVjWKJlkYTKm3RCvBTfA8Ng5fLufXheMRKQ==",
+      "version": "1.15.43",
+      "resolved": "https://registry.npmjs.org/@swc/core-linux-arm64-gnu/-/core-linux-arm64-gnu-1.15.43.tgz",
+      "integrity": "sha512-B4otJRdPWIsmiSBf0uG7Z/+vMWmkufjz5MmYxubwKuZazDW14Zd3symga1N62QR4RT+kEFeHEgsXfZGyn/w0hw==",
       "cpu": [
         "arm64"
       ],
@@ -3158,9 +3214,9 @@
       }
     },
     "node_modules/@swc/core-linux-arm64-musl": {
-      "version": "1.15.41",
-      "resolved": "https://registry.npmjs.org/@swc/core-linux-arm64-musl/-/core-linux-arm64-musl-1.15.41.tgz",
-      "integrity": "sha512-dXu/5vd4gh8symyhRF+4G7gOPkjmb4pONhh7sl+6GSiW0LOKZlfu5kXmyFbTz9smOT7jgr002qY9b1nujjXt2A==",
+      "version": "1.15.43",
+      "resolved": "https://registry.npmjs.org/@swc/core-linux-arm64-musl/-/core-linux-arm64-musl-1.15.43.tgz",
+      "integrity": "sha512-6zB6OnpViBxYy4tgY3v2i6AZY9fwkcHZ032UOwtwUuW1d19sdT07qF0kZe6/3UR1tUaK6jjg2rmVcUIBCEYVjQ==",
       "cpu": [
         "arm64"
       ],
@@ -3178,9 +3234,9 @@
       }
     },
     "node_modules/@swc/core-linux-ppc64-gnu": {
-      "version": "1.15.41",
-      "resolved": "https://registry.npmjs.org/@swc/core-linux-ppc64-gnu/-/core-linux-ppc64-gnu-1.15.41.tgz",
-      "integrity": "sha512-XGO6zVPXoPE0gf/XnI4jBbafNT13AYgoh6ns0JCSdOetI/kqVf0vhpz7NuNgAzZrMVCsmieqjPoTwViDgh4mOQ==",
+      "version": "1.15.43",
+      "resolved": "https://registry.npmjs.org/@swc/core-linux-ppc64-gnu/-/core-linux-ppc64-gnu-1.15.43.tgz",
+      "integrity": "sha512-coxE1ZWdB3uSDVNoEtYNrRi/1epvckZx9cTJ8ICUxTMTxGk+yvQ/Twacp3ruZSaMPGCriUjP86C37VhaT6nyRg==",
       "cpu": [
         "ppc64"
       ],
@@ -3198,9 +3254,9 @@
       }
     },
     "node_modules/@swc/core-linux-s390x-gnu": {
-      "version": "1.15.41",
-      "resolved": "https://registry.npmjs.org/@swc/core-linux-s390x-gnu/-/core-linux-s390x-gnu-1.15.41.tgz",
-      "integrity": "sha512-0WUglRwyZtW+iMi7J3iFdrCxreZZIKf4egTwEQfIYRsqFax69A0OrFj+NIoFSE03xBT/IFRrg+S8K6f9Ky+4hA==",
+      "version": "1.15.43",
+      "resolved": "https://registry.npmjs.org/@swc/core-linux-s390x-gnu/-/core-linux-s390x-gnu-1.15.43.tgz",
+      "integrity": "sha512-lXfLhs+LpBsD5inuYx+YDH5WsPPBQ95KPUiy8P5wq9ob9xKDZFqwNfU2QW6bGO8NqRO/H9JQomTSt5Yyh+FGfA==",
       "cpu": [
         "s390x"
       ],
@@ -3218,9 +3274,9 @@
       }
     },
     "node_modules/@swc/core-linux-x64-gnu": {
-      "version": "1.15.41",
-      "resolved": "https://registry.npmjs.org/@swc/core-linux-x64-gnu/-/core-linux-x64-gnu-1.15.41.tgz",
-      "integrity": "sha512-VxkuQK59c0tHm6uJZCUrS3cyA2JhGGfdU6e41SZz0x/JS+4Sm7C1mIc97In14vkZJopEt7yXA2TouCqZDSygEA==",
+      "version": "1.15.43",
+      "resolved": "https://registry.npmjs.org/@swc/core-linux-x64-gnu/-/core-linux-x64-gnu-1.15.43.tgz",
+      "integrity": "sha512-07XnKwTmKy8TGOZG3D9fRnLWGynxPjwQnZLVmBFbo6F+7vHYzBIOuwXEhemrChBWb6yDNZsVCcMWCPX6FDD2xg==",
       "cpu": [
         "x64"
       ],
@@ -3238,9 +3294,9 @@
       }
     },
     "node_modules/@swc/core-linux-x64-musl": {
-      "version": "1.15.41",
-      "resolved": "https://registry.npmjs.org/@swc/core-linux-x64-musl/-/core-linux-x64-musl-1.15.41.tgz",
-      "integrity": "sha512-/0qXIu1ZxggLuovLb22vFfKHq2AA4n6Whw5UwmVCHk4pkw7KWnPIQpMCEqUMPsNkFJig7PPp/TSYFu8ZEb2rtQ==",
+      "version": "1.15.43",
+      "resolved": "https://registry.npmjs.org/@swc/core-linux-x64-musl/-/core-linux-x64-musl-1.15.43.tgz",
+      "integrity": "sha512-TJc+bsSIaBh+hZvZ5GRtW/K1bw66TJ9vsUwvVIsZdiWxU5ObLwZvfcnZ3UpgVfMnFibRes9uriJrQNBHEEogRQ==",
       "cpu": [
         "x64"
       ],
@@ -3258,9 +3314,9 @@
       }
     },
     "node_modules/@swc/core-win32-arm64-msvc": {
-      "version": "1.15.41",
-      "resolved": "https://registry.npmjs.org/@swc/core-win32-arm64-msvc/-/core-win32-arm64-msvc-1.15.41.tgz",
-      "integrity": "sha512-Y481sMNZM6rECh9VO4+y26N1lWEDAyxnBZskUf37fl90uHE946VHfmiVQWT0uMFOhyJJFovGTRuF4W82dwewUg==",
+      "version": "1.15.43",
+      "resolved": "https://registry.npmjs.org/@swc/core-win32-arm64-msvc/-/core-win32-arm64-msvc-1.15.43.tgz",
+      "integrity": "sha512-jfd7s2/bUQYkOHLs+LWQNKZdmDa8+sufKLllhpWAhVQ2GDCwsHe3vR/j+OSiItZNtkzFuaawa3+SAKz9y5gYfw==",
       "cpu": [
         "arm64"
       ],
@@ -3275,9 +3331,9 @@
       }
     },
     "node_modules/@swc/core-win32-ia32-msvc": {
-      "version": "1.15.41",
-      "resolved": "https://registry.npmjs.org/@swc/core-win32-ia32-msvc/-/core-win32-ia32-msvc-1.15.41.tgz",
-      "integrity": "sha512-BAchBD5qeUzy3hiPSLJtaaoSm4blCLyYffOF1bGE4ETcV+OisqjUAwDQMJj++4bTpvMCDzwC+Bj3PmQyBCtscw==",
+      "version": "1.15.43",
+      "resolved": "https://registry.npmjs.org/@swc/core-win32-ia32-msvc/-/core-win32-ia32-msvc-1.15.43.tgz",
+      "integrity": "sha512-rLAE8JvucqEW1ZGohxPQrQWPBQeJG4+ypKbWfdlU/qmKScvCkxf9/Jxnzki1dkUQCQ7P5Enp13RlvqOlvx/32g==",
       "cpu": [
         "ia32"
       ],
@@ -3292,9 +3348,9 @@
       }
     },
     "node_modules/@swc/core-win32-x64-msvc": {
-      "version": "1.15.41",
-      "resolved": "https://registry.npmjs.org/@swc/core-win32-x64-msvc/-/core-win32-x64-msvc-1.15.41.tgz",
-      "integrity": "sha512-WOkA+fJ/ViVBQDsSV9JC52NACTe5PhlurA6viASDZGb7HR3KS01ZG7RZ+Bg6SVQFIoq3gSbTsskQVe6EbHFAYw==",
+      "version": "1.15.43",
+      "resolved": "https://registry.npmjs.org/@swc/core-win32-x64-msvc/-/core-win32-x64-msvc-1.15.43.tgz",
+      "integrity": "sha512-h8MLDHZcfIukwQWj03rIJZx1I0E81AYj2X7J/nGErG4nz+QAv6G1Z+peotvinL3lqpbo32tLYSMFo32/ySzxKg==",
       "cpu": [
         "x64"
       ],
@@ -3326,9 +3382,9 @@
       }
     },
     "node_modules/@tailwindcss/node": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/node/-/node-4.3.1.tgz",
-      "integrity": "sha512-6NDaqRoAMSXD1mr/RXu0HBvNE9a2n5tHPsxu9XHLws8o4Twes5rBM2205SUUiJ9goAtadrN6xTGX0UDEwp/N4A==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/node/-/node-4.3.2.tgz",
+      "integrity": "sha512-yWP/sqEcBLaD8JuA6zNwxoYKr75qxTioYwlRwekj5Jr/I5GXnoJfjetH/psLUIv74cYTH2lBUEzBkinthoYcBg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3338,37 +3394,37 @@
         "lightningcss": "1.32.0",
         "magic-string": "^0.30.21",
         "source-map-js": "^1.2.1",
-        "tailwindcss": "4.3.1"
+        "tailwindcss": "4.3.2"
       }
     },
     "node_modules/@tailwindcss/oxide": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide/-/oxide-4.3.1.tgz",
-      "integrity": "sha512-yVPyo8RNkabVr3O2EhHEE0Rewu7YKzc1DhIqfL46LKveFrmu9XbDazNOJY7/GRuvw1h6u3utWnR29H/p5JPlgA==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide/-/oxide-4.3.2.tgz",
+      "integrity": "sha512-z8ZgnzX8gdNoWLBLqBPoh/sjnxkwvf9ZuWjnO0l0yIzbLa5/9S+eC5QxGZKRobVHIC3/1BoMWjHblqWjcgFgag==",
       "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">= 20"
       },
       "optionalDependencies": {
-        "@tailwindcss/oxide-android-arm64": "4.3.1",
-        "@tailwindcss/oxide-darwin-arm64": "4.3.1",
-        "@tailwindcss/oxide-darwin-x64": "4.3.1",
-        "@tailwindcss/oxide-freebsd-x64": "4.3.1",
-        "@tailwindcss/oxide-linux-arm-gnueabihf": "4.3.1",
-        "@tailwindcss/oxide-linux-arm64-gnu": "4.3.1",
-        "@tailwindcss/oxide-linux-arm64-musl": "4.3.1",
-        "@tailwindcss/oxide-linux-x64-gnu": "4.3.1",
-        "@tailwindcss/oxide-linux-x64-musl": "4.3.1",
-        "@tailwindcss/oxide-wasm32-wasi": "4.3.1",
-        "@tailwindcss/oxide-win32-arm64-msvc": "4.3.1",
-        "@tailwindcss/oxide-win32-x64-msvc": "4.3.1"
+        "@tailwindcss/oxide-android-arm64": "4.3.2",
+        "@tailwindcss/oxide-darwin-arm64": "4.3.2",
+        "@tailwindcss/oxide-darwin-x64": "4.3.2",
+        "@tailwindcss/oxide-freebsd-x64": "4.3.2",
+        "@tailwindcss/oxide-linux-arm-gnueabihf": "4.3.2",
+        "@tailwindcss/oxide-linux-arm64-gnu": "4.3.2",
+        "@tailwindcss/oxide-linux-arm64-musl": "4.3.2",
+        "@tailwindcss/oxide-linux-x64-gnu": "4.3.2",
+        "@tailwindcss/oxide-linux-x64-musl": "4.3.2",
+        "@tailwindcss/oxide-wasm32-wasi": "4.3.2",
+        "@tailwindcss/oxide-win32-arm64-msvc": "4.3.2",
+        "@tailwindcss/oxide-win32-x64-msvc": "4.3.2"
       }
     },
     "node_modules/@tailwindcss/oxide-android-arm64": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-android-arm64/-/oxide-android-arm64-4.3.1.tgz",
-      "integrity": "sha512-SVlyf61g374l5cHyg8x9kf5xmLcOaxvOTsbsqDnSsDJaKOEFZ7GCvi84VAVGpxojYOs1+3K6M0UjXfqPU8vmOQ==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-android-arm64/-/oxide-android-arm64-4.3.2.tgz",
+      "integrity": "sha512-WHxqIuHpvZ5VtdX6GTl1Ik/Vp2YuN42Et+0CdeaVd/frQ9jAvGmvR8vLT+jk3e8/Q3x8kECB9+R17pgpp2BulA==",
       "cpu": [
         "arm64"
       ],
@@ -3383,9 +3439,9 @@
       }
     },
     "node_modules/@tailwindcss/oxide-darwin-arm64": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-darwin-arm64/-/oxide-darwin-arm64-4.3.1.tgz",
-      "integrity": "sha512-hVnWLwv+e/l7c4WKyVtHVrIPvYdqWHjRB3MDIqARynzFtnQg85kmQEFCbV9Ja0VVx4xXTIiDWY60Y7iz/iNoDA==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-darwin-arm64/-/oxide-darwin-arm64-4.3.2.tgz",
+      "integrity": "sha512-GZypeUY/IDJW3877KeM+O67vbXr3MBnbtEL4aYhNErv/JWZhye2vGSWWG9tB6iiqR2MqRNkY8IOUy4NdSZV26w==",
       "cpu": [
         "arm64"
       ],
@@ -3400,9 +3456,9 @@
       }
     },
     "node_modules/@tailwindcss/oxide-darwin-x64": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-darwin-x64/-/oxide-darwin-x64-4.3.1.tgz",
-      "integrity": "sha512-Cf7abu0WVgbhU7ANgPUnSAvm7nCvMweusHb8FnaHlLfv/Caq4GYaEZg7ZImzzmjx4lIAfuS8q+eLIS7A7IzxIg==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-darwin-x64/-/oxide-darwin-x64-4.3.2.tgz",
+      "integrity": "sha512-UIIzmefR6KO1sDU7MzRqAxC8iBpft/VhkGjTjnhoS6k7Z3rQ9wEgA1ODSiyH/tcSYssulNm4Ci3hOeK1jH7ccQ==",
       "cpu": [
         "x64"
       ],
@@ -3417,9 +3473,9 @@
       }
     },
     "node_modules/@tailwindcss/oxide-freebsd-x64": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-freebsd-x64/-/oxide-freebsd-x64-4.3.1.tgz",
-      "integrity": "sha512-ZZqzX2Y+GXtXXfqSfpJhDm60OoZfvLHLCgm+J7NVqgHHJjG/m9ugZI77RwTsVd4fnBJuCFP6Ae6kTJb71UdS8g==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-freebsd-x64/-/oxide-freebsd-x64-4.3.2.tgz",
+      "integrity": "sha512-GN+uAmcI6DNspnCDwtOAZrTz6oukJnp337qZvxqCGLd3BHBzJpO0ZbTLRvJNdztOeAmTzewewGIMPb0tk2R4WA==",
       "cpu": [
         "x64"
       ],
@@ -3434,9 +3490,9 @@
       }
     },
     "node_modules/@tailwindcss/oxide-linux-arm-gnueabihf": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm-gnueabihf/-/oxide-linux-arm-gnueabihf-4.3.1.tgz",
-      "integrity": "sha512-/Ah/xik0LaMYfv9DZ0S/t4pBlBNYOcqtRwusjgovHkvT8ixueWCLyJjsaF5kQIckjb4IT8Q6K6p/iPmZMixYgg==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm-gnueabihf/-/oxide-linux-arm-gnueabihf-4.3.2.tgz",
+      "integrity": "sha512-4ABn7qSbdHRwTiDiuWNegCyb5+2FJ4vKIKc3DmKrvAFw7MU1Lm11dIkTPwUaFdTzc7IsOpDbqBrlh0x6y36U/w==",
       "cpu": [
         "arm"
       ],
@@ -3451,9 +3507,9 @@
       }
     },
     "node_modules/@tailwindcss/oxide-linux-arm64-gnu": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm64-gnu/-/oxide-linux-arm64-gnu-4.3.1.tgz",
-      "integrity": "sha512-gqdFoVJlw444GvpnheZLHmvTzSxI/cOUUh2KSNejQjTcYkW062SVD+En0rUgD+QV91bz1XGIGtt1HJd48xUGbQ==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm64-gnu/-/oxide-linux-arm64-gnu-4.3.2.tgz",
+      "integrity": "sha512-wDgEIGwoM8w8pufh9LVt1PahDgNdKXrLC2qfAnV3vAmococ9RWbxeAw4pxPttd/TsJfwjyLf90Dg1y9y8I6Emw==",
       "cpu": [
         "arm64"
       ],
@@ -3471,9 +3527,9 @@
       }
     },
     "node_modules/@tailwindcss/oxide-linux-arm64-musl": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm64-musl/-/oxide-linux-arm64-musl-4.3.1.tgz",
-      "integrity": "sha512-Bwv9KwOvE0VKa86xPFif9b9c3Y1NxOV1P0gLti/IYaWEsQYZXDlxfGEtA8mdDZ7SG3wyNXAWYT5SIn3giL57oA==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm64-musl/-/oxide-linux-arm64-musl-4.3.2.tgz",
+      "integrity": "sha512-J5Nuk0uZQIiMTJj3LEx4sAA9tMFUoXQZFv1J6An+QGYe53HKRJuFDi0rpq/tuouCZeAbOBY3kQ6g8qeD4TUjtA==",
       "cpu": [
         "arm64"
       ],
@@ -3491,9 +3547,9 @@
       }
     },
     "node_modules/@tailwindcss/oxide-linux-x64-gnu": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-x64-gnu/-/oxide-linux-x64-gnu-4.3.1.tgz",
-      "integrity": "sha512-Ymi8O8T15HYQdOUWUtTI6ldN0neHP85FC+Qz32xTcZ7iJXtem/x8ITev0o1e9e5rkqj4lONZfTRLvkmin1+tKg==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-x64-gnu/-/oxide-linux-x64-gnu-4.3.2.tgz",
+      "integrity": "sha512-kqCZpSKOBEJO4mz7OqWoofBZeXTAwaVGPj0ErAj7CojmhKpWVWVOnrt9dE8odoIraZq4oj3ausM37kXi+Tow8w==",
       "cpu": [
         "x64"
       ],
@@ -3511,9 +3567,9 @@
       }
     },
     "node_modules/@tailwindcss/oxide-linux-x64-musl": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-x64-musl/-/oxide-linux-x64-musl-4.3.1.tgz",
-      "integrity": "sha512-M+P/91qJ6uILLw4k2G93GMDRAXj61SMvFQYt39AqvUqYgExXpLL5aepfns7sj4HiAQeolirQF9E0lzRvdf4zPQ==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-x64-musl/-/oxide-linux-x64-musl-4.3.2.tgz",
+      "integrity": "sha512-cixpqbh2toJDmkuCRI68nXA8ZxNmdK9Y+9v5h3MC3ZQKy/0BO8AWzlkWyRM7JAFSGBlfig4YVTPsK6MVgqz1uw==",
       "cpu": [
         "x64"
       ],
@@ -3531,9 +3587,9 @@
       }
     },
     "node_modules/@tailwindcss/oxide-wasm32-wasi": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-wasm32-wasi/-/oxide-wasm32-wasi-4.3.1.tgz",
-      "integrity": "sha512-zsM8uOeqvVGHsAXsJxsT28ttosFahLJKCLOTUBqRAtKnVgGSRitds9T432QiT8b77Yga7JIBkulIRRlJPtYhRA==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-wasm32-wasi/-/oxide-wasm32-wasi-4.3.2.tgz",
+      "integrity": "sha512-4ec2Z/LOmRsAgU23CS4xeJfcJlmRg94A/XrbGRCF1gyU/zdDfRLYDVsS+ynSZCmGNxQ1jQriQOKMQeQxBA3Isw==",
       "bundleDependencies": [
         "@napi-rs/wasm-runtime",
         "@emnapi/core",
@@ -3549,9 +3605,9 @@
       "license": "MIT",
       "optional": true,
       "dependencies": {
-        "@emnapi/core": "^1.10.0",
-        "@emnapi/runtime": "^1.10.0",
-        "@emnapi/wasi-threads": "^1.2.1",
+        "@emnapi/core": "^1.11.1",
+        "@emnapi/runtime": "^1.11.1",
+        "@emnapi/wasi-threads": "^1.2.2",
         "@napi-rs/wasm-runtime": "^1.1.4",
         "@tybys/wasm-util": "^0.10.2",
         "tslib": "^2.8.1"
@@ -3561,9 +3617,9 @@
       }
     },
     "node_modules/@tailwindcss/oxide-win32-arm64-msvc": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-arm64-msvc/-/oxide-win32-arm64-msvc-4.3.1.tgz",
-      "integrity": "sha512-aiNvSq9BsVk8V513lDKlrCFAgf8qBMPZTpgEhInL+NwQqs97mYmupVMrPrgBBSL8Pv/0zXu9MrMF9rMun1ZeNg==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-arm64-msvc/-/oxide-win32-arm64-msvc-4.3.2.tgz",
+      "integrity": "sha512-Zyr/M0+XcYZu3bZrUytc7TXvrk0ftWfl8gN2MwekNDzhqhKRUucMPSeOzM0o0wH5AWOU49BsKRrfKxI2atCPMQ==",
       "cpu": [
         "arm64"
       ],
@@ -3578,9 +3634,9 @@
       }
     },
     "node_modules/@tailwindcss/oxide-win32-x64-msvc": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-x64-msvc/-/oxide-win32-x64-msvc-4.3.1.tgz",
-      "integrity": "sha512-xDEyu1rg290472FEGaKHnzyDyh5QH+AlWvsU5hMoMtPpzmKlRI0jaYKCgSHDYtaQWZOYbMaduSyCwFwY4n1HmA==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-x64-msvc/-/oxide-win32-x64-msvc-4.3.2.tgz",
+      "integrity": "sha512-QI9BO7KlNZsp2GuO0jwAAj5jCDABOKXRkCk2XuKTSaNEFSdfzqswYVTtCHBNKHLsqyjFyFkqlDiwkNbTYSssMQ==",
       "cpu": [
         "x64"
       ],
@@ -3595,23 +3651,23 @@
       }
     },
     "node_modules/@tailwindcss/postcss": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/postcss/-/postcss-4.3.1.tgz",
-      "integrity": "sha512-dNJuNbdEJT/SWRuXTYP1WSamelsz3ztkUsdtWQPjrexysrTpaEPM40P/71knXiXLYEojqPOEGitVLLpPMS5T6A==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/postcss/-/postcss-4.3.2.tgz",
+      "integrity": "sha512-rjVWYCa7Ngbi5AarT6k8TkxUG3Wl1QKzHdIZVsjZSzf36Jmo2IKZt/NHRAwly8oDkbBOH0YTu+CHuf9jPxMc+g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@alloc/quick-lru": "^5.2.0",
-        "@tailwindcss/node": "4.3.1",
-        "@tailwindcss/oxide": "4.3.1",
-        "postcss": "8.5.15",
-        "tailwindcss": "4.3.1"
+        "@tailwindcss/node": "4.3.2",
+        "@tailwindcss/oxide": "4.3.2",
+        "postcss": "^8.5.15",
+        "tailwindcss": "4.3.2"
       }
     },
     "node_modules/@tanstack/query-core": {
-      "version": "5.101.0",
-      "resolved": "https://registry.npmjs.org/@tanstack/query-core/-/query-core-5.101.0.tgz",
-      "integrity": "sha512-cQetA74EB+seWySv1TTKr828TnP0u39m6LykwDXIo84SNortpDkp30TMEjkqtYCNP9c40uT/iwl6MLiufEt0Ow==",
+      "version": "5.101.2",
+      "resolved": "https://registry.npmjs.org/@tanstack/query-core/-/query-core-5.101.2.tgz",
+      "integrity": "sha512-hH5MLoJhF7KaIGd7q3xTXGXvslI+GYlM1Z/35aSHHWaCJWB7XvTSHYuV3eM7tw+aE0mT/xMro4M4Q9rCGHT0lw==",
       "license": "MIT",
       "funding": {
         "type": "github",
@@ -3619,12 +3675,12 @@
       }
     },
     "node_modules/@tanstack/react-query": {
-      "version": "5.101.0",
-      "resolved": "https://registry.npmjs.org/@tanstack/react-query/-/react-query-5.101.0.tgz",
-      "integrity": "sha512-rLlJXSpkqfizLWgkR5+eLeIk0MvTx/meEIR7LRjxic+qxiQP8zVjq7BqQkiCMNLQBlLfuOLqqr6KO5GtrDlmSg==",
+      "version": "5.101.2",
+      "resolved": "https://registry.npmjs.org/@tanstack/react-query/-/react-query-5.101.2.tgz",
+      "integrity": "sha512-seDkr6kzGzX1okaaTtZPtgA688CDPlXUz1C6xSg0ESqn04Vuc8tlrYms1s3de+znBqhPVxFRfpAfUf+6XvfPWg==",
       "license": "MIT",
       "dependencies": {
-        "@tanstack/query-core": "5.101.0"
+        "@tanstack/query-core": "5.101.2"
       },
       "funding": {
         "type": "github",
@@ -3724,9 +3780,9 @@
       }
     },
     "node_modules/@tybys/wasm-util": {
-      "version": "0.10.2",
-      "resolved": "https://registry.npmjs.org/@tybys/wasm-util/-/wasm-util-0.10.2.tgz",
-      "integrity": "sha512-RoBvJ2X0wuKlWFIjrwffGw1IqZHKQqzIchKaadZZfnNpsAYp2mM0h36JtPCjNDAHGgYez/15uMBpfGwchhiMgg==",
+      "version": "0.10.3",
+      "resolved": "https://registry.npmjs.org/@tybys/wasm-util/-/wasm-util-0.10.3.tgz",
+      "integrity": "sha512-F3fo1MYrRJYL3zER0OUOmkutjr1Vp23m7OsSgp7nq4SP6OqX6C/56XFIPAl5bt3zaBRjmW7SGz3u/6LwFpYcOg==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -3877,17 +3933,17 @@
       "license": "MIT"
     },
     "node_modules/@typescript-eslint/eslint-plugin": {
-      "version": "8.61.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.61.1.tgz",
-      "integrity": "sha512-ZPlVl3PB3et/59Ne0fv/sci6ZXz4T4Hp4nTJ56i/Y0gR89ARb+KphojTq6j+56E5PIezmOIOOWyY+aWQFd+IkQ==",
+      "version": "8.62.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.62.1.tgz",
+      "integrity": "sha512-4EQM77WgVNxj7OkL/5b/D/xZsw00G577+UriYTC7JF5opcF3T2AuoeY7ueLaZgSVjSgCS6yOAJB5bRGLPSJUzA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@eslint-community/regexpp": "^4.12.2",
-        "@typescript-eslint/scope-manager": "8.61.1",
-        "@typescript-eslint/type-utils": "8.61.1",
-        "@typescript-eslint/utils": "8.61.1",
-        "@typescript-eslint/visitor-keys": "8.61.1",
+        "@typescript-eslint/scope-manager": "8.62.1",
+        "@typescript-eslint/type-utils": "8.62.1",
+        "@typescript-eslint/utils": "8.62.1",
+        "@typescript-eslint/visitor-keys": "8.62.1",
         "ignore": "^7.0.5",
         "natural-compare": "^1.4.0",
         "ts-api-utils": "^2.5.0"
@@ -3900,7 +3956,7 @@
         "url": "https://opencollective.com/typescript-eslint"
       },
       "peerDependencies": {
-        "@typescript-eslint/parser": "^8.61.1",
+        "@typescript-eslint/parser": "^8.62.1",
         "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
         "typescript": ">=4.8.4 <6.1.0"
       }
@@ -3916,16 +3972,16 @@
       }
     },
     "node_modules/@typescript-eslint/parser": {
-      "version": "8.61.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.61.1.tgz",
-      "integrity": "sha512-PJ5vePq5/ognBbrIcoC5+SHO5dfpeLPzP9FpLkzWrguoYQEeeSjlJpVwOpo1JRSTEi7dRcwNy4h4dzV70PqHcg==",
+      "version": "8.62.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.62.1.tgz",
+      "integrity": "sha512-sPhE4iHuJDSvoAiec+Ro8JyXw8f0ql13HFR82P99nCm9GwTEKG0KYLvDe6REk8BCXuit6vJAv/Yxg5ABaNS2rA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/scope-manager": "8.61.1",
-        "@typescript-eslint/types": "8.61.1",
-        "@typescript-eslint/typescript-estree": "8.61.1",
-        "@typescript-eslint/visitor-keys": "8.61.1",
+        "@typescript-eslint/scope-manager": "8.62.1",
+        "@typescript-eslint/types": "8.62.1",
+        "@typescript-eslint/typescript-estree": "8.62.1",
+        "@typescript-eslint/visitor-keys": "8.62.1",
         "debug": "^4.4.3"
       },
       "engines": {
@@ -3941,14 +3997,14 @@
       }
     },
     "node_modules/@typescript-eslint/project-service": {
-      "version": "8.61.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.61.1.tgz",
-      "integrity": "sha512-PrC4JYGmR241lYnfhmKGTXkFqv8+ymbTFgSAY0fVXpY82/QkMw5TZPl+vGzuDDU2QYJk9fIDOBTntF+yDv9LEA==",
+      "version": "8.62.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.62.1.tgz",
+      "integrity": "sha512-yQ3RgY5RkSBpsNS1Bx/JQEcA24FOSdfGktoyprAr5u18390UQdtVcfnEv4nIrIshNnavlVyZBKxQwT1fIAE6cg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/tsconfig-utils": "^8.61.1",
-        "@typescript-eslint/types": "^8.61.1",
+        "@typescript-eslint/tsconfig-utils": "^8.62.1",
+        "@typescript-eslint/types": "^8.62.1",
         "debug": "^4.4.3"
       },
       "engines": {
@@ -3963,14 +4019,14 @@
       }
     },
     "node_modules/@typescript-eslint/scope-manager": {
-      "version": "8.61.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.61.1.tgz",
-      "integrity": "sha512-L2bdIeoQS8FlKAvONAr20w6OcLXeB+qiDKbAooS9A0Ben+iSIkBef0FxqwKWYqt5sa0i4KJtxVyVmhMylKzF5w==",
+      "version": "8.62.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.62.1.tgz",
+      "integrity": "sha512-r4d249KbQ1SFdpeStvob8Ih6aPPIzfqllPVOtvhve6ZcpuVcYo5/7zUWckKpHE7StASX4kTKZTLf0WQm/wPkcg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.61.1",
-        "@typescript-eslint/visitor-keys": "8.61.1"
+        "@typescript-eslint/types": "8.62.1",
+        "@typescript-eslint/visitor-keys": "8.62.1"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -3981,9 +4037,9 @@
       }
     },
     "node_modules/@typescript-eslint/tsconfig-utils": {
-      "version": "8.61.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.61.1.tgz",
-      "integrity": "sha512-UN/H4di+OO7EWx2ovME+8t31YO+KVnK0RRKEHR3kOt21/Ay8BOq3M1OMvWs5vNiqcFCYGYoxK3MXPZzmMUE+yg==",
+      "version": "8.62.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.62.1.tgz",
+      "integrity": "sha512-xadytJqX9vJVQ2fdQjkcIVigwaOJNWkpjdLt6cEQ+xPnrI1fkp+/jZE/I97k9KUjqtpd25i0HeyZf3T6dutv2g==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -3998,15 +4054,15 @@
       }
     },
     "node_modules/@typescript-eslint/type-utils": {
-      "version": "8.61.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.61.1.tgz",
-      "integrity": "sha512-GYRicKmVK0C4fsKgaACaknOUAq9Oa2kwsjnpFhFcS/5p4Ht5IP9OVLbgIgcK4SRk92nVHFluurg1lumD9dBcLw==",
+      "version": "8.62.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.62.1.tgz",
+      "integrity": "sha512-aXM5xlqXiTxPibXB93cLAURfT3rlizf7uMXISCXy66Isr/9hISJx3yDsKl0L7lKa51b8JpFuNKby0/O0pEm9jg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.61.1",
-        "@typescript-eslint/typescript-estree": "8.61.1",
-        "@typescript-eslint/utils": "8.61.1",
+        "@typescript-eslint/types": "8.62.1",
+        "@typescript-eslint/typescript-estree": "8.62.1",
+        "@typescript-eslint/utils": "8.62.1",
         "debug": "^4.4.3",
         "ts-api-utils": "^2.5.0"
       },
@@ -4023,9 +4079,9 @@
       }
     },
     "node_modules/@typescript-eslint/types": {
-      "version": "8.61.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.61.1.tgz",
-      "integrity": "sha512-G+CRlPqLv7Bz1IZVs03x5K59F1veqL0EJUROAdGhKsEq8qOiRiZbI+HUojPq5l0fEGOKModD9br6lObhB8zkoA==",
+      "version": "8.62.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.62.1.tgz",
+      "integrity": "sha512-ooCzJFaf+Hg+uG6fA3NRFGuFjlfNlDhBthbv4ZPU/0elCAFUfnyXUvf/WOpHz/jYwSmvU2GkR2LtyUfy1AxZ1Q==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -4037,16 +4093,16 @@
       }
     },
     "node_modules/@typescript-eslint/typescript-estree": {
-      "version": "8.61.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.61.1.tgz",
-      "integrity": "sha512-u+oQD3BqYWPc8YV9Zab4vaJElJuwOLPRc10Jm1o/qS+6Qwen14HCWwx0Seo4LnSn2wxea2Ik8DxPt2/FHmuhrg==",
+      "version": "8.62.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.62.1.tgz",
+      "integrity": "sha512-xMcW9oP9u7fAMXYs9A65CVmtLQe2r//oXINHfi8HV+oiqhih17sbLdhXr4540YWlgpDKQdY854OL5ZrdCiQsAA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/project-service": "8.61.1",
-        "@typescript-eslint/tsconfig-utils": "8.61.1",
-        "@typescript-eslint/types": "8.61.1",
-        "@typescript-eslint/visitor-keys": "8.61.1",
+        "@typescript-eslint/project-service": "8.62.1",
+        "@typescript-eslint/tsconfig-utils": "8.62.1",
+        "@typescript-eslint/types": "8.62.1",
+        "@typescript-eslint/visitor-keys": "8.62.1",
         "debug": "^4.4.3",
         "minimatch": "^10.2.2",
         "semver": "^7.7.3",
@@ -4078,16 +4134,16 @@
       }
     },
     "node_modules/@typescript-eslint/utils": {
-      "version": "8.61.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.61.1.tgz",
-      "integrity": "sha512-1+P/3Dj6jvtybE1q0HQ6yBt/gq+oKJyLdEv4HdnqasaEXRSYCAsD59mXEVQnM/ULNdQxbX77tdG4jPRjIS6knA==",
+      "version": "8.62.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.62.1.tgz",
+      "integrity": "sha512-sHtbPfuKNZCG+ih8SyjjucqRntSVmp8XgL5u6o9mAhiSn8ds5o/M/XdM0abweme2Tln3szOstOrZ9OXitvPh0g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@eslint-community/eslint-utils": "^4.9.1",
-        "@typescript-eslint/scope-manager": "8.61.1",
-        "@typescript-eslint/types": "8.61.1",
-        "@typescript-eslint/typescript-estree": "8.61.1"
+        "@typescript-eslint/scope-manager": "8.62.1",
+        "@typescript-eslint/types": "8.62.1",
+        "@typescript-eslint/typescript-estree": "8.62.1"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -4102,13 +4158,13 @@
       }
     },
     "node_modules/@typescript-eslint/visitor-keys": {
-      "version": "8.61.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.61.1.tgz",
-      "integrity": "sha512-6fJ9MHWtK14C1DSkiMlHUSOmrVebL7150xZJBlJiL62jjhIA4JmOq6flwBgDxIdBKKdoiZRel+dfPD5MLfny3w==",
+      "version": "8.62.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.62.1.tgz",
+      "integrity": "sha512-4g3BLxfdTMy8iZG0MaBkadnlRrCJ74cQiFbyEVMrkwIoqdyaXXQM22cotDvrl4x28wgIZ9rEJRoM+mmhSJpJ1g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.61.1",
+        "@typescript-eslint/types": "8.62.1",
         "eslint-visitor-keys": "^5.0.0"
       },
       "engines": {
@@ -4120,13 +4176,13 @@
       }
     },
     "node_modules/@vitejs/plugin-react": {
-      "version": "6.0.2",
-      "resolved": "https://registry.npmjs.org/@vitejs/plugin-react/-/plugin-react-6.0.2.tgz",
-      "integrity": "sha512-DlSMqo4WhThw4vB8Mpn0Woe9J+Jfq1geJ61AKW0QEgLzGMNwtIMdxbDUzLxcun8W7NbJO0e2Jg/Nxm3cCSVzzg==",
+      "version": "6.0.3",
+      "resolved": "https://registry.npmjs.org/@vitejs/plugin-react/-/plugin-react-6.0.3.tgz",
+      "integrity": "sha512-vmFvco5/QuC2f9Oj+wTk0+9XeDFkHxSamwZKYc7MxYwKICfvUvlMhqKI0VuICPltGqh1neqBKDvO4kes1ya8vg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@rolldown/pluginutils": "^1.0.0"
+        "@rolldown/pluginutils": "^1.0.1"
       },
       "engines": {
         "node": "^20.19.0 || >=22.12.0"
@@ -4511,9 +4567,9 @@
       "license": "MIT"
     },
     "node_modules/autoprefixer": {
-      "version": "10.5.0",
-      "resolved": "https://registry.npmjs.org/autoprefixer/-/autoprefixer-10.5.0.tgz",
-      "integrity": "sha512-FMhOoZV4+qR6aTUALKX2rEqGG+oyATvwBt9IIzVR5rMa2HRWPkxf+P+PAJLD1I/H5/II+HuZcBJYEFBpq39ong==",
+      "version": "10.5.2",
+      "resolved": "https://registry.npmjs.org/autoprefixer/-/autoprefixer-10.5.2.tgz",
+      "integrity": "sha512-rD5t5DwOjJdmSORcTq64j8MawTC+tbQ+HHqjR4NDumamy/ambn1UJrlKL+KdwujWxMkFjPM3pPHOEA9tl4767Q==",
       "dev": true,
       "funding": [
         {
@@ -4531,8 +4587,8 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "browserslist": "^4.28.2",
-        "caniuse-lite": "^1.0.30001787",
+        "browserslist": "^4.28.4",
+        "caniuse-lite": "^1.0.30001799",
         "fraction.js": "^5.3.4",
         "picocolors": "^1.1.1",
         "postcss-value-parser": "^4.2.0"
@@ -4558,9 +4614,9 @@
       }
     },
     "node_modules/baseline-browser-mapping": {
-      "version": "2.10.38",
-      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.10.38.tgz",
-      "integrity": "sha512-31/02mVB4yuQU6adKk5SlY6m+mxDwUq5KZkyYgnLrrKl7TEm1+3PyDtDBz2kOv/wxZz41GHsvV1A/u6RmiyBvw==",
+      "version": "2.10.42",
+      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.10.42.tgz",
+      "integrity": "sha512-c/jurFrDLyui7o1J86yLkRu4LMsTYcBohveus7/I2Hzdn9KIP2bdJPTue/lR1KH46enoPbD77GKeSYNdyPoD3Q==",
       "dev": true,
       "license": "Apache-2.0",
       "bin": {
@@ -4581,9 +4637,9 @@
       }
     },
     "node_modules/brace-expansion": {
-      "version": "5.0.6",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz",
-      "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==",
+      "version": "5.0.7",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz",
+      "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -4594,9 +4650,9 @@
       }
     },
     "node_modules/browserslist": {
-      "version": "4.28.2",
-      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.2.tgz",
-      "integrity": "sha512-48xSriZYYg+8qXna9kwqjIVzuQxi+KYWp2+5nCYnYKPTr0LvD89Jqk2Or5ogxz0NUMfIjhh2lIUX/LyX9B4oIg==",
+      "version": "4.28.4",
+      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.4.tgz",
+      "integrity": "sha512-MTc8i/x9jBQd1iMw2CFGS+rwMa07eYjLR0CCTLDACl9xhxy+nIs3KeML/biicXtk9JrZ6dnnTatmc7ErPXIxqw==",
       "dev": true,
       "funding": [
         {
@@ -4614,10 +4670,10 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "baseline-browser-mapping": "^2.10.12",
-        "caniuse-lite": "^1.0.30001782",
-        "electron-to-chromium": "^1.5.328",
-        "node-releases": "^2.0.36",
+        "baseline-browser-mapping": "^2.10.38",
+        "caniuse-lite": "^1.0.30001799",
+        "electron-to-chromium": "^1.5.376",
+        "node-releases": "^2.0.48",
         "update-browserslist-db": "^1.2.3"
       },
       "bin": {
@@ -4644,9 +4700,9 @@
       }
     },
     "node_modules/caniuse-lite": {
-      "version": "1.0.30001799",
-      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001799.tgz",
-      "integrity": "sha512-hG1bReV+OUU+MOqK4t/ZWI0tZOyz3rqS9XuhOUz1cIcbwBKjOyJEJuw9ER5JuNyqxNk8u/JUVbGibBOL1yrjFw==",
+      "version": "1.0.30001800",
+      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001800.tgz",
+      "integrity": "sha512-MMHtuAz9Ys840zAY5F4k6fV5GaivZ9sPk+nz0mY+GYVzRBnYkN0mpqkSR92oWRQ19yQWo4HvBV/FnC16AJX8MA==",
       "dev": true,
       "funding": [
         {
@@ -4921,9 +4977,9 @@
       "license": "MIT"
     },
     "node_modules/electron-to-chromium": {
-      "version": "1.5.376",
-      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.376.tgz",
-      "integrity": "sha512-cUVA7/RvbFTEuw/i3obUwDTRIXojaxkResf+ibByPFxjc6XK3VNtcQXV0NSbAlJ0FMjcJGgftVVB4Qo184EXvA==",
+      "version": "1.5.387",
+      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.387.tgz",
+      "integrity": "sha512-TaxwufTFDufvPEoXdhwVrA3UdFWBeWGkYoJ1K8ldF1xe6gKfth6iRNS5lTQ5JPNOHdGQm8PT1QYKUqFLCiUefQ==",
       "dev": true,
       "license": "ISC"
     },
@@ -4975,9 +5031,9 @@
       }
     },
     "node_modules/es-module-lexer": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-2.1.0.tgz",
-      "integrity": "sha512-n27zTYMjYu1aj4MjCWzSP7G9r75utsaoc8m61weK+W8JMBGGQybd43GstCXZ3WNmSFtGT9wi59qQTW6mhTR5LQ==",
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-2.3.0.tgz",
+      "integrity": "sha512-KLdwQm2NvGLDkQDCGvmiQrhkd0JbMzXthwQAUgWjQuQdBLFa3eiBP5arXZyA+f8x+x7OXgud6bq2rxjGtHV2tw==",
       "dev": true,
       "license": "MIT"
     },
@@ -5047,9 +5103,9 @@
       }
     },
     "node_modules/eslint": {
-      "version": "10.5.0",
-      "resolved": "https://registry.npmjs.org/eslint/-/eslint-10.5.0.tgz",
-      "integrity": "sha512-1y+7C+vi12bUK1IpZeaV3gsH9fHLBmPvYmPx42pvT/E9yG0IC8g3PUZZgp0+JLJl7ZDK0flc2gc+Aw9dpCvIsQ==",
+      "version": "10.6.0",
+      "resolved": "https://registry.npmjs.org/eslint/-/eslint-10.6.0.tgz",
+      "integrity": "sha512-6lVbcqSodALYo+4ELD0heG6lFiFxnLMuLkiMi2qV8LMp54N8tE8FT1GMH+ev4Ti00nFjNze2+Su6DsV5OQW3Dg==",
       "dev": true,
       "license": "MIT",
       "workspaces": [
@@ -5267,9 +5323,9 @@
       }
     },
     "node_modules/expect-type": {
-      "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/expect-type/-/expect-type-1.3.0.tgz",
-      "integrity": "sha512-knvyeauYhqjOYvQ66MznSMs83wmHrCycNEN6Ao+2AeYEfxUIkuiVxdEa1qlGEPK+We3n0THiDciYSsCcgW/DoA==",
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/expect-type/-/expect-type-1.4.0.tgz",
+      "integrity": "sha512-KfYbmpRm0VbLjEvVa9yGwCi9GI34xvi7A/HXYWQO65CSD2u3MczUJSuwXKFIxlGsgBQizV9q5J9NHj4VG0n+pA==",
       "dev": true,
       "license": "Apache-2.0",
       "engines": {
@@ -5456,9 +5512,9 @@
       }
     },
     "node_modules/globals": {
-      "version": "17.6.0",
-      "resolved": "https://registry.npmjs.org/globals/-/globals-17.6.0.tgz",
-      "integrity": "sha512-sepffkT8stwnIYbsMBpoCHJuJM5l98FUF2AnE07hfvE0m/qp3R586hw4jF4uadbhvg1ooIdzuu7CsfD2jzCaNA==",
+      "version": "17.7.0",
+      "resolved": "https://registry.npmjs.org/globals/-/globals-17.7.0.tgz",
+      "integrity": "sha512-Czmyns5dUsq4seFBR/Kdydhmo8y9kC79hiSkPn0YcGtNnYWnrgt0vjrSjx9tspoDGWm2CMarffRuLjM4xUz8xg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -6275,9 +6331,9 @@
       "license": "MIT"
     },
     "node_modules/nanoid": {
-      "version": "3.3.13",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.13.tgz",
-      "integrity": "sha512-sPdqC6ByMVVGvF1ynvvMo0/o+oD1VX7DaHhijt1bFgjvBkHBib4t49GoNDhf2NDta4oeUNlaGbSt5K7qjZ955Q==",
+      "version": "3.3.15",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.15.tgz",
+      "integrity": "sha512-y7Wygv/7mEOvxTuEQDB8StXdMRBWf1kR/tlhAzBRUFkB2jfcLOAxO/SHmOO2zgz1pVgK29/kyupn059/bCHdjA==",
       "dev": true,
       "funding": [
         {
@@ -6301,9 +6357,9 @@
       "license": "MIT"
     },
     "node_modules/node-releases": {
-      "version": "2.0.48",
-      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.48.tgz",
-      "integrity": "sha512-1uz8041X6LoI6ZSdZacM9lVY28vuzDlSKitnpbSNK0RfKoIJkX29NBPVEFXhnuSuEOA9Ww0xnPJ+ILWbGAv8DA==",
+      "version": "2.0.50",
+      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.50.tgz",
+      "integrity": "sha512-J6l92tKHX6w8Jy5nO1Vuc01NoIiRGi/d6qBKVxh+IQ8Cr3b6HbVNfKiF8ZpFKufTwpwxMmce2W3iQZ861ZRyTg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -6400,34 +6456,34 @@
       }
     },
     "node_modules/oxc-resolver": {
-      "version": "11.21.3",
-      "resolved": "https://registry.npmjs.org/oxc-resolver/-/oxc-resolver-11.21.3.tgz",
-      "integrity": "sha512-2Mx3fKQz7+xgrBONjsxOgCGtMHOn38/HxMzW1I5efwXB5a4lRN0Vp40gYUJFBWJslcrvwoofTrqoTnLbwTd3pA==",
+      "version": "11.23.0",
+      "resolved": "https://registry.npmjs.org/oxc-resolver/-/oxc-resolver-11.23.0.tgz",
+      "integrity": "sha512-f0+l598CJMOLnYPXsXxttJALH0ljtivdRMKtvHhxRuWa5FYmw5+qODARl8oYjMC/brpzKcrpdORsOBrTqhBZ9A==",
       "dev": true,
       "license": "MIT",
       "funding": {
         "url": "https://github.com/sponsors/Boshen"
       },
       "optionalDependencies": {
-        "@oxc-resolver/binding-android-arm-eabi": "11.21.3",
-        "@oxc-resolver/binding-android-arm64": "11.21.3",
-        "@oxc-resolver/binding-darwin-arm64": "11.21.3",
-        "@oxc-resolver/binding-darwin-x64": "11.21.3",
-        "@oxc-resolver/binding-freebsd-x64": "11.21.3",
-        "@oxc-resolver/binding-linux-arm-gnueabihf": "11.21.3",
-        "@oxc-resolver/binding-linux-arm-musleabihf": "11.21.3",
-        "@oxc-resolver/binding-linux-arm64-gnu": "11.21.3",
-        "@oxc-resolver/binding-linux-arm64-musl": "11.21.3",
-        "@oxc-resolver/binding-linux-ppc64-gnu": "11.21.3",
-        "@oxc-resolver/binding-linux-riscv64-gnu": "11.21.3",
-        "@oxc-resolver/binding-linux-riscv64-musl": "11.21.3",
-        "@oxc-resolver/binding-linux-s390x-gnu": "11.21.3",
-        "@oxc-resolver/binding-linux-x64-gnu": "11.21.3",
-        "@oxc-resolver/binding-linux-x64-musl": "11.21.3",
-        "@oxc-resolver/binding-openharmony-arm64": "11.21.3",
-        "@oxc-resolver/binding-wasm32-wasi": "11.21.3",
-        "@oxc-resolver/binding-win32-arm64-msvc": "11.21.3",
-        "@oxc-resolver/binding-win32-x64-msvc": "11.21.3"
+        "@oxc-resolver/binding-android-arm-eabi": "11.23.0",
+        "@oxc-resolver/binding-android-arm64": "11.23.0",
+        "@oxc-resolver/binding-darwin-arm64": "11.23.0",
+        "@oxc-resolver/binding-darwin-x64": "11.23.0",
+        "@oxc-resolver/binding-freebsd-x64": "11.23.0",
+        "@oxc-resolver/binding-linux-arm-gnueabihf": "11.23.0",
+        "@oxc-resolver/binding-linux-arm-musleabihf": "11.23.0",
+        "@oxc-resolver/binding-linux-arm64-gnu": "11.23.0",
+        "@oxc-resolver/binding-linux-arm64-musl": "11.23.0",
+        "@oxc-resolver/binding-linux-ppc64-gnu": "11.23.0",
+        "@oxc-resolver/binding-linux-riscv64-gnu": "11.23.0",
+        "@oxc-resolver/binding-linux-riscv64-musl": "11.23.0",
+        "@oxc-resolver/binding-linux-s390x-gnu": "11.23.0",
+        "@oxc-resolver/binding-linux-x64-gnu": "11.23.0",
+        "@oxc-resolver/binding-linux-x64-musl": "11.23.0",
+        "@oxc-resolver/binding-openharmony-arm64": "11.23.0",
+        "@oxc-resolver/binding-wasm32-wasi": "11.23.0",
+        "@oxc-resolver/binding-win32-arm64-msvc": "11.23.0",
+        "@oxc-resolver/binding-win32-x64-msvc": "11.23.0"
       }
     },
     "node_modules/p-limit": {
@@ -6554,9 +6610,9 @@
       "license": "ISC"
     },
     "node_modules/picomatch": {
-      "version": "4.0.4",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
-      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
+      "version": "4.0.5",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.5.tgz",
+      "integrity": "sha512-RvwwcruNjI1ncT5xRakeyS9Lf8lcItv34KD+aif+VH9kduAyfYBipGh12274xtenIPZ119/R9BdTBa8gAwSh0A==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -6567,9 +6623,9 @@
       }
     },
     "node_modules/postcss": {
-      "version": "8.5.15",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.15.tgz",
-      "integrity": "sha512-FfR8sjd4em2T6fb3I2MwAJU7HWVMr9zba+enmQeeWFfCbm+UOC/0X4DS8XtpUTMwWMGbjKYP7xjfNekzyGmB3A==",
+      "version": "8.5.16",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.16.tgz",
+      "integrity": "sha512-vuwillviilfKZsg0VGj5R/YwwcHx4SLsIOI/7K6mQkWx+l5cUHTjj5g0AasTBcyXsbfTgrwsUNmVUb5xVwyPwg==",
       "dev": true,
       "funding": [
         {
@@ -6745,9 +6801,9 @@
       }
     },
     "node_modules/react-router": {
-      "version": "7.18.0",
-      "resolved": "https://registry.npmjs.org/react-router/-/react-router-7.18.0.tgz",
-      "integrity": "sha512-pTTGt8J+ji1NOmYnjzT+bAJy/1zD+Jp4ziO6cL7T3ZLvXKtusO7BpFqlRXitqpcPVqllsIXFHRMt+2/k3Xn6HQ==",
+      "version": "7.18.1",
+      "resolved": "https://registry.npmjs.org/react-router/-/react-router-7.18.1.tgz",
+      "integrity": "sha512-GDLgg3i3uM0aeJO3Fm+TCS+sDQ7gu12T6x0qdTEzcwqEfleci7JwugVNIF3U//0FWKnJT7ptG+20B2jfDqnZAg==",
       "license": "MIT",
       "dependencies": {
         "cookie": "^1.0.1",
@@ -6767,12 +6823,12 @@
       }
     },
     "node_modules/react-router-dom": {
-      "version": "7.18.0",
-      "resolved": "https://registry.npmjs.org/react-router-dom/-/react-router-dom-7.18.0.tgz",
-      "integrity": "sha512-Fi0yY6kgtKae/Th2xibdWK0KSdYZ4B53Gyf6wRtomOKWgpNm7H7+DyfDhncdz9FKbpS+1jmDhg3F4WoGJ+yFOA==",
+      "version": "7.18.1",
+      "resolved": "https://registry.npmjs.org/react-router-dom/-/react-router-dom-7.18.1.tgz",
+      "integrity": "sha512-KaZh+X/6UtEp28x51AUYZDMg9NGoz2ja3dNHa+ta/tk40vCzKhQ/RypCWBMLbmDr6//E24Vv5uPsrqXFozdkAg==",
       "license": "MIT",
       "dependencies": {
-        "react-router": "7.18.0"
+        "react-router": "7.18.1"
       },
       "engines": {
         "node": ">=20.0.0"
@@ -6805,9 +6861,9 @@
       }
     },
     "node_modules/recast": {
-      "version": "0.23.11",
-      "resolved": "https://registry.npmjs.org/recast/-/recast-0.23.11.tgz",
-      "integrity": "sha512-YTUo+Flmw4ZXiWfQKGcwwc11KnoRAYgzAE2E7mXKCjSviTKShtxBsN6YUUBB2gtaBzKzeKunxhUwNHQuRryhWA==",
+      "version": "0.23.12",
+      "resolved": "https://registry.npmjs.org/recast/-/recast-0.23.12.tgz",
+      "integrity": "sha512-dEWRjcINDu/F4l2dYx57ugBtD7HV9KXESyxhzw/MqWLeglJrsjJKqACPyUPg+6AF8mIgm+Zi0dZ3ACoIg+QtpA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -6881,13 +6937,13 @@
       }
     },
     "node_modules/rolldown": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.0.3.tgz",
-      "integrity": "sha512-i00lAJ2ks1BYr7rjNjKC7BcqAS7nVfiT3QX1SI5aY+AFHblCmaUf9OE9dbdzDvW6dJxbi2ZCZiy9v3CcwOiX3g==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.1.4.tgz",
+      "integrity": "sha512-IjZYiLxZwpnhwhdBH2ugdTGVSdhCQUmLxLoqyjiL0JxYjyRst+5a0P3xfrTxJ5F638j4Mvvw5FAX5XE6eHpXbA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@oxc-project/types": "=0.133.0",
+        "@oxc-project/types": "=0.138.0",
         "@rolldown/pluginutils": "^1.0.0"
       },
       "bin": {
@@ -6897,27 +6953,27 @@
         "node": "^20.19.0 || >=22.12.0"
       },
       "optionalDependencies": {
-        "@rolldown/binding-android-arm64": "1.0.3",
-        "@rolldown/binding-darwin-arm64": "1.0.3",
-        "@rolldown/binding-darwin-x64": "1.0.3",
-        "@rolldown/binding-freebsd-x64": "1.0.3",
-        "@rolldown/binding-linux-arm-gnueabihf": "1.0.3",
-        "@rolldown/binding-linux-arm64-gnu": "1.0.3",
-        "@rolldown/binding-linux-arm64-musl": "1.0.3",
-        "@rolldown/binding-linux-ppc64-gnu": "1.0.3",
-        "@rolldown/binding-linux-s390x-gnu": "1.0.3",
-        "@rolldown/binding-linux-x64-gnu": "1.0.3",
-        "@rolldown/binding-linux-x64-musl": "1.0.3",
-        "@rolldown/binding-openharmony-arm64": "1.0.3",
-        "@rolldown/binding-wasm32-wasi": "1.0.3",
-        "@rolldown/binding-win32-arm64-msvc": "1.0.3",
-        "@rolldown/binding-win32-x64-msvc": "1.0.3"
+        "@rolldown/binding-android-arm64": "1.1.4",
+        "@rolldown/binding-darwin-arm64": "1.1.4",
+        "@rolldown/binding-darwin-x64": "1.1.4",
+        "@rolldown/binding-freebsd-x64": "1.1.4",
+        "@rolldown/binding-linux-arm-gnueabihf": "1.1.4",
+        "@rolldown/binding-linux-arm64-gnu": "1.1.4",
+        "@rolldown/binding-linux-arm64-musl": "1.1.4",
+        "@rolldown/binding-linux-ppc64-gnu": "1.1.4",
+        "@rolldown/binding-linux-s390x-gnu": "1.1.4",
+        "@rolldown/binding-linux-x64-gnu": "1.1.4",
+        "@rolldown/binding-linux-x64-musl": "1.1.4",
+        "@rolldown/binding-openharmony-arm64": "1.1.4",
+        "@rolldown/binding-wasm32-wasi": "1.1.4",
+        "@rolldown/binding-win32-arm64-msvc": "1.1.4",
+        "@rolldown/binding-win32-x64-msvc": "1.1.4"
       }
     },
     "node_modules/rolldown/node_modules/@oxc-project/types": {
-      "version": "0.133.0",
-      "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.133.0.tgz",
-      "integrity": "sha512-KzkdCd6Uxqnf6l3HOw1xfatAlUURA0g14cvBYFyJ5SaNOQbOUvBr9PKArcPcrNIeRsBdgcUzOGrhKveVpvOIGA==",
+      "version": "0.138.0",
+      "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.138.0.tgz",
+      "integrity": "sha512-1a7ZKmrRTCoN1XMZ4L0PyyqrMnrNlLyPuOkdSX2MZg7IiIGRUyurNhAm73ptDOraoBcIordsIGKNPKUzy3ZmfA==",
       "dev": true,
       "license": "MIT",
       "funding": {
@@ -7163,9 +7219,9 @@
       }
     },
     "node_modules/tailwindcss": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/tailwindcss/-/tailwindcss-4.3.1.tgz",
-      "integrity": "sha512-hk+TB1m+K8CYNrP6rjQaq/Y+4Zylwpa87mLYBKCunwnnQ9p+fHb7kmSfGqyEJoxF/O6CDyABWVFEafNSYKll+Q==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/tailwindcss/-/tailwindcss-4.3.2.tgz",
+      "integrity": "sha512-WtctNNSH8A9jlMIqxzuYumOHU5uGZyRv0Q5svQl+oEPy5w84YpBxdb7MdqyiSPQge5jTJ6zFQLq0PFygdccSBA==",
       "dev": true,
       "license": "MIT"
     },
@@ -7254,22 +7310,22 @@
       }
     },
     "node_modules/tldts": {
-      "version": "7.4.3",
-      "resolved": "https://registry.npmjs.org/tldts/-/tldts-7.4.3.tgz",
-      "integrity": "sha512-A3BDQBeeukYPzB4QdQ1DtdlUmp4x2OCH8n5UVhEWbyANxNep8GavottKzd1xYKFJKjUgMyPT7EzOfnBO55s8Sg==",
+      "version": "7.4.6",
+      "resolved": "https://registry.npmjs.org/tldts/-/tldts-7.4.6.tgz",
+      "integrity": "sha512-rbP0Gyx8b3Ae9yO//CU2wbSnQNoQ66m1nJdSbSHmnwKwzkkz/u8mERYU8T2rmlmy+bJvRNn84yNCW8gYqox44Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "tldts-core": "^7.4.3"
+        "tldts-core": "^7.4.6"
       },
       "bin": {
         "tldts": "bin/cli.js"
       }
     },
     "node_modules/tldts-core": {
-      "version": "7.4.3",
-      "resolved": "https://registry.npmjs.org/tldts-core/-/tldts-core-7.4.3.tgz",
-      "integrity": "sha512-27ep5H9PzdBrNd5OFM/j3WCU8F3kPwM9D0BOaOf7uYfxMJfyr0K5Tjj69Gri+sZlh2WXd5buIm47NuPF29CDiw==",
+      "version": "7.4.6",
+      "resolved": "https://registry.npmjs.org/tldts-core/-/tldts-core-7.4.6.tgz",
+      "integrity": "sha512-TkQNGJIhlEphpHCjKodMTSe23egUZr/g+flI2qkLgiJ/maAzSgXypSLRTNH3nCmqgayEmtcJBiLcfODSAr1xoA==",
       "dev": true,
       "license": "MIT"
     },
@@ -7371,16 +7427,16 @@
       }
     },
     "node_modules/typescript-eslint": {
-      "version": "8.61.1",
-      "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.61.1.tgz",
-      "integrity": "sha512-V7PayAfJokV3pEHgN7/v03D1SpujhRfQtYLbLIiBfDDncdg4PAiRBfoS4cnCANK4jmAPncczi59QO3afiXUlNw==",
+      "version": "8.62.1",
+      "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.62.1.tgz",
+      "integrity": "sha512-vymnnM5g0AKQDSAyfP12nMIBvgwgA42syg74kkuZ4x1VuTzwQKwc5h9rGxeShCjny5o+zWAb6OEoz7XLgrIkIw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/eslint-plugin": "8.61.1",
-        "@typescript-eslint/parser": "8.61.1",
-        "@typescript-eslint/typescript-estree": "8.61.1",
-        "@typescript-eslint/utils": "8.61.1"
+        "@typescript-eslint/eslint-plugin": "8.62.1",
+        "@typescript-eslint/parser": "8.62.1",
+        "@typescript-eslint/typescript-estree": "8.62.1",
+        "@typescript-eslint/utils": "8.62.1"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -7522,16 +7578,16 @@
       }
     },
     "node_modules/vite": {
-      "version": "8.0.16",
-      "resolved": "https://registry.npmjs.org/vite/-/vite-8.0.16.tgz",
-      "integrity": "sha512-h9bXPmJichP5fLmVQo3PyaGSDE2n3aPuomeAlVRm0JLmt4rY6zmPKd59HYI4LNW8oTK7tlTsuC7l/m7awx9Jcw==",
+      "version": "8.1.3",
+      "resolved": "https://registry.npmjs.org/vite/-/vite-8.1.3.tgz",
+      "integrity": "sha512-Ds+gBRbj0lwRO2Y5hwnUBdxSwlAve9LeRyU4sNnAr0ewW0gWF0n5bgXgUzbgZ49MV9BVUAQUFYVcDUcilUExMA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "lightningcss": "^1.32.0",
         "picomatch": "^4.0.4",
-        "postcss": "^8.5.15",
-        "rolldown": "1.0.3",
+        "postcss": "^8.5.16",
+        "rolldown": "~1.1.3",
         "tinyglobby": "^0.2.17"
       },
       "bin": {
@@ -7548,7 +7604,7 @@
       },
       "peerDependencies": {
         "@types/node": "^20.19.0 || >=22.12.0",
-        "@vitejs/devtools": "^0.1.18",
+        "@vitejs/devtools": "^0.3.0",
         "esbuild": "^0.27.0 || ^0.28.0",
         "jiti": ">=1.21.0",
         "less": "^4.0.0",
diff --git a/frontend/package.json b/frontend/package.json
index ceb36e50..25163024 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -16,6 +16,7 @@
     "storybook": "storybook dev -p 6006"
   },
   "dependencies": {
+    "@radix-ui/react-checkbox": "^1.3.6",
     "@radix-ui/react-dialog": "^1.1.15",
     "@radix-ui/react-separator": "^1.1.8",
     "@radix-ui/react-slot": "^1.2.4",
diff --git a/frontend/src/components/ui/checkbox.stories.tsx b/frontend/src/components/ui/checkbox.stories.tsx
new file mode 100644
index 00000000..d537ec87
--- /dev/null
+++ b/frontend/src/components/ui/checkbox.stories.tsx
@@ -0,0 +1,29 @@
+import type { Meta, StoryObj } from "@storybook/react-vite"
+
+import { Checkbox } from "./checkbox"
+
+const meta = {
+  title: "Components/Checkbox",
+  component: Checkbox,
+  tags: ["autodocs"],
+  parameters: { layout: "centered" },
+} satisfies Meta<typeof Checkbox>
+
+export default meta
+type Story = StoryObj<typeof meta>
+
+export const Unchecked: Story = {
+  args: {},
+}
+
+export const Checked: Story = {
+  args: {
+    checked: true,
+  },
+}
+
+export const Disabled: Story = {
+  args: {
+    disabled: true,
+  },
+}
diff --git a/frontend/src/components/ui/checkbox.test.tsx b/frontend/src/components/ui/checkbox.test.tsx
new file mode 100644
index 00000000..08e0f580
--- /dev/null
+++ b/frontend/src/components/ui/checkbox.test.tsx
@@ -0,0 +1,17 @@
+import { render, screen } from "@testing-library/react"
+import userEvent from "@testing-library/user-event"
+import { describe, expect, it, vi } from "vitest"
+
+import { Checkbox } from "./checkbox"
+
+describe("Checkbox", () => {
+  it("renders and toggles checked state", async () => {
+    const user = userEvent.setup()
+    const onCheckedChange = vi.fn()
+
+    render(<Checkbox aria-label="Accept terms" onCheckedChange={onCheckedChange} />)
+
+    await user.click(screen.getByRole("checkbox", { name: /accept terms/i }))
+    expect(onCheckedChange).toHaveBeenCalledWith(true)
+  })
+})
diff --git a/frontend/src/components/ui/checkbox.tsx b/frontend/src/components/ui/checkbox.tsx
new file mode 100644
index 00000000..9b17e647
--- /dev/null
+++ b/frontend/src/components/ui/checkbox.tsx
@@ -0,0 +1,28 @@
+import * as React from "react"
+import * as CheckboxPrimitive from "@radix-ui/react-checkbox"
+
+import { Icon } from "@/components/ui/icon"
+import { cn } from "@/lib/utils"
+
+const Checkbox = React.forwardRef<
+  React.ComponentRef<typeof CheckboxPrimitive.Root>,
+  React.ComponentPropsWithoutRef<typeof CheckboxPrimitive.Root>
+>(({ className, ...props }, ref) => (
+  <CheckboxPrimitive.Root
+    ref={ref}
+    className={cn(
+      "peer h-4 w-4 shrink-0 rounded-sm border border-primary ring-offset-background focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 disabled:cursor-not-allowed disabled:opacity-50 data-[state=checked]:bg-primary data-[state=checked]:text-primary-foreground",
+      className
+    )}
+    {...props}
+  >
+    <CheckboxPrimitive.Indicator
+      className={cn("flex items-center justify-center text-current")}
+    >
+      <Icon name="check" className="h-3.5 w-3.5 text-[14px]" />
+    </CheckboxPrimitive.Indicator>
+  </CheckboxPrimitive.Root>
+))
+Checkbox.displayName = CheckboxPrimitive.Root.displayName
+
+export { Checkbox }
diff --git a/frontend/src/core/api/workspace-api-keys.test.ts b/frontend/src/core/api/workspace-api-keys.test.ts
new file mode 100644
index 00000000..e033d7dd
--- /dev/null
+++ b/frontend/src/core/api/workspace-api-keys.test.ts
@@ -0,0 +1,64 @@
+import { describe, expect, it, vi } from "vitest"
+
+vi.mock("@/core/api/client", () => ({
+  apiFetch: vi.fn(),
+}))
+
+import { apiFetch } from "@/core/api/client"
+
+import {
+  activeWorkspaceApiKeys,
+  fetchWorkspaceApiKeys,
+  type WorkspaceApiKey,
+} from "./workspace-api-keys"
+
+const mockedApiFetch = vi.mocked(apiFetch)
+
+const sampleKeys: WorkspaceApiKey[] = [
+  {
+    id: "key-1",
+    workspace_id: "ws-1",
+    client_id: "client-active",
+    name: "Active key",
+    is_active: true,
+    created_at: "2026-01-01T00:00:00Z",
+  },
+  {
+    id: "key-2",
+    workspace_id: "ws-1",
+    client_id: "client-inactive",
+    name: "Inactive key",
+    is_active: false,
+    created_at: "2026-01-02T00:00:00Z",
+  },
+]
+
+describe("activeWorkspaceApiKeys", () => {
+  it("filters out inactive keys", () => {
+    const result = activeWorkspaceApiKeys(sampleKeys)
+
+    expect(result).toHaveLength(1)
+    expect(result[0]?.name).toBe("Active key")
+    expect(result.every((key) => key.is_active)).toBe(true)
+  })
+})
+
+describe("fetchWorkspaceApiKeys", () => {
+  it("returns keys from the API", async () => {
+    mockedApiFetch.mockResolvedValue({
+      ok: true,
+      json: async () => sampleKeys,
+    } as Response)
+
+    const result = await fetchWorkspaceApiKeys("ws-1")
+
+    expect(mockedApiFetch).toHaveBeenCalledWith("/api/v1/workspaces/ws-1/api-keys")
+    expect(result).toEqual(sampleKeys)
+  })
+
+  it("throws when the API response is not ok", async () => {
+    mockedApiFetch.mockResolvedValue({ ok: false } as Response)
+
+    await expect(fetchWorkspaceApiKeys("ws-1")).rejects.toThrow("Failed to load API keys")
+  })
+})
diff --git a/frontend/src/core/api/workspace-api-keys.ts b/frontend/src/core/api/workspace-api-keys.ts
new file mode 100644
index 00000000..408a33f2
--- /dev/null
+++ b/frontend/src/core/api/workspace-api-keys.ts
@@ -0,0 +1,24 @@
+import { apiFetch } from "@/core/api/client"
+
+export interface WorkspaceApiKey {
+  id: string
+  workspace_id: string
+  client_id: string
+  name: string
+  is_active: boolean
+  last_used_at?: string | null
+  created_at: string
+  expires_at?: string | null
+}
+
+export async function fetchWorkspaceApiKeys(workspaceId: string): Promise<WorkspaceApiKey[]> {
+  const res = await apiFetch(`/api/v1/workspaces/${workspaceId}/api-keys`)
+  if (!res.ok) {
+    throw new Error("Failed to load API keys")
+  }
+  return (await res.json()) as WorkspaceApiKey[]
+}
+
+export function activeWorkspaceApiKeys(keys: WorkspaceApiKey[]): WorkspaceApiKey[] {
+  return keys.filter((key) => key.is_active)
+}
diff --git a/frontend/src/core/router/routes.ts b/frontend/src/core/router/routes.ts
index 1fcea2a5..e03d63a6 100644
--- a/frontend/src/core/router/routes.ts
+++ b/frontend/src/core/router/routes.ts
@@ -7,6 +7,8 @@ export const ROUTES = {
     pattern: "/workspaces/:wid",
     overview: (workspaceId: string) => `/workspaces/${workspaceId}/overview`,
     email: (workspaceId: string) => `/workspaces/${workspaceId}/email`,
+    emailWithMessage: (workspaceId: string, messageId: string) =>
+      `/workspaces/${workspaceId}/email?message=${encodeURIComponent(messageId)}`,
     emailTemplates: (workspaceId: string) => `/workspaces/${workspaceId}/email/templates`,
     sms: (workspaceId: string) => `/workspaces/${workspaceId}/sms`,
     push: (workspaceId: string) => `/workspaces/${workspaceId}/push`,
diff --git a/frontend/src/features/auth/pages/login.page.test.tsx b/frontend/src/features/auth/pages/login.page.test.tsx
new file mode 100644
index 00000000..93725813
--- /dev/null
+++ b/frontend/src/features/auth/pages/login.page.test.tsx
@@ -0,0 +1,44 @@
+import { render, screen } from "@testing-library/react"
+import userEvent from "@testing-library/user-event"
+import { MemoryRouter } from "react-router-dom"
+import { describe, expect, it, vi } from "vitest"
+
+import { signInWithPassword } from "../auth.api"
+import { LoginPage } from "./login.page"
+
+vi.mock("../auth.api", () => ({
+  signInWithPassword: vi.fn(),
+}))
+
+const mockedSignIn = vi.mocked(signInWithPassword)
+
+describe("LoginPage", () => {
+  it("renders sign-in form", () => {
+    render(
+      <MemoryRouter>
+        <LoginPage />
+      </MemoryRouter>,
+    )
+
+    expect(screen.getByRole("heading", { name: /sign in/i })).toBeInTheDocument()
+    expect(screen.getByLabelText(/email address/i)).toBeInTheDocument()
+    expect(screen.getByLabelText(/^password$/i)).toBeInTheDocument()
+  })
+
+  it("shows API error on failed login", async () => {
+    mockedSignIn.mockResolvedValue({ ok: false, message: "Invalid credentials" })
+
+    render(
+      <MemoryRouter>
+        <LoginPage />
+      </MemoryRouter>,
+    )
+
+    const user = userEvent.setup()
+    await user.type(screen.getByLabelText(/email address/i), "user@example.com")
+    await user.type(screen.getByLabelText(/^password$/i), "wrong")
+    await user.click(screen.getByRole("button", { name: /^login$/i }))
+
+    expect(await screen.findByText("Invalid credentials")).toBeInTheDocument()
+  })
+})
diff --git a/frontend/src/features/auth/pages/register.page.test.tsx b/frontend/src/features/auth/pages/register.page.test.tsx
new file mode 100644
index 00000000..24a41ee8
--- /dev/null
+++ b/frontend/src/features/auth/pages/register.page.test.tsx
@@ -0,0 +1,45 @@
+import { render, screen } from "@testing-library/react"
+import userEvent from "@testing-library/user-event"
+import { MemoryRouter } from "react-router-dom"
+import { describe, expect, it, vi } from "vitest"
+
+import { registerAccount } from "../auth.api"
+import { RegisterPage } from "./register.page"
+
+vi.mock("../auth.api", () => ({
+  registerAccount: vi.fn(),
+}))
+
+const mockedRegister = vi.mocked(registerAccount)
+
+describe("RegisterPage", () => {
+  it("renders sign-up form", () => {
+    render(
+      <MemoryRouter>
+        <RegisterPage />
+      </MemoryRouter>,
+    )
+
+    expect(screen.getByRole("heading", { name: /sign up/i })).toBeInTheDocument()
+    expect(screen.getByLabelText(/full name/i)).toBeInTheDocument()
+    expect(screen.getByLabelText(/email address/i)).toBeInTheDocument()
+  })
+
+  it("shows API error on failed registration", async () => {
+    mockedRegister.mockResolvedValue({ ok: false, message: "Email already taken" })
+
+    render(
+      <MemoryRouter>
+        <RegisterPage />
+      </MemoryRouter>,
+    )
+
+    const user = userEvent.setup()
+    await user.type(screen.getByLabelText(/full name/i), "Demo User")
+    await user.type(screen.getByLabelText(/email address/i), "user@example.com")
+    await user.type(screen.getByLabelText(/^password$/i), "secret123456")
+    await user.click(screen.getByRole("button", { name: /sign up/i }))
+
+    expect(await screen.findByText("Email already taken")).toBeInTheDocument()
+  })
+})
diff --git a/frontend/src/features/inbox/components/email-content/email-content.tsx b/frontend/src/features/inbox/components/email-content/email-content.tsx
index d36b9c97..cd91dc97 100644
--- a/frontend/src/features/inbox/components/email-content/email-content.tsx
+++ b/frontend/src/features/inbox/components/email-content/email-content.tsx
@@ -27,8 +27,8 @@ function formatFullTime(dateStr: string) {
 export function EmailContent({ message, onDelete, isDeleting = false }: EmailContentProps) {
   const sender = message.email.from_name
     ? `${message.email.from_name} <${message.email.from}>`
-    : message.email.from || "Unknown Sender"
-  
+    : message.email.from || "Unknown sender"
+
   const recipients = (message.email.to || []).join(", ")
   const formattedDate = formatFullTime(message.created_at)
 
@@ -48,7 +48,7 @@ export function EmailContent({ message, onDelete, isDeleting = false }: EmailCon
             {message.email.subject || "(No Subject)"}
           </h2>
           <p className="text-xs text-text-secondary truncate">
-            {sender} • {formattedDate}
+            To: {recipients || "—"} • {formattedDate}
           </p>
         </div>
 
diff --git a/frontend/src/features/inbox/components/email-item/email-item.test.tsx b/frontend/src/features/inbox/components/email-item/email-item.test.tsx
index a204fab3..17c857d8 100644
--- a/frontend/src/features/inbox/components/email-item/email-item.test.tsx
+++ b/frontend/src/features/inbox/components/email-item/email-item.test.tsx
@@ -21,7 +21,7 @@ const mockEmail = {
 describe("EmailItem Component", () => {
   it("renders correctly with email properties", () => {
     render(<EmailItem message={mockEmail} isSelected={false} onClick={vi.fn()} />)
-    expect(screen.getByText("John Doe")).toBeInTheDocument()
+    expect(screen.getByText("recipient@example.com")).toBeInTheDocument()
     expect(screen.getByText("Test Subject")).toBeInTheDocument()
     expect(screen.getByText("This is the body snippet of the test email.")).toBeInTheDocument()
   })
diff --git a/frontend/src/features/inbox/components/email-item/email-item.tsx b/frontend/src/features/inbox/components/email-item/email-item.tsx
index c3746504..5e995429 100644
--- a/frontend/src/features/inbox/components/email-item/email-item.tsx
+++ b/frontend/src/features/inbox/components/email-item/email-item.tsx
@@ -6,10 +6,15 @@ interface EmailItemProps {
   onClick: () => void
 }
 
-function getSenderInitial(nameOrEmail: string) {
-  if (!nameOrEmail) return "?"
-  const cleaned = nameOrEmail.trim()
-  return cleaned[0].toUpperCase()
+function formatRecipients(to: string[] | undefined) {
+  if (!to || to.length === 0) return "Unknown recipient"
+  return to.join(", ")
+}
+
+function getRecipientInitial(recipient: string) {
+  if (!recipient) return "?"
+  const cleaned = recipient.trim()
+  return cleaned[0]?.toUpperCase() ?? "?"
 }
 
 function formatTime(dateStr: string) {
@@ -26,8 +31,8 @@ function formatTime(dateStr: string) {
 }
 
 export function EmailItem({ message, isSelected, onClick }: EmailItemProps) {
-  const senderName = message.email.from_name || message.email.from || "Unknown Sender"
-  const initial = getSenderInitial(senderName)
+  const recipientLabel = formatRecipients(message.email.to)
+  const initial = getRecipientInitial(message.email.to?.[0] ?? recipientLabel)
   const timestamp = formatTime(message.created_at)
   
   const snippet = message.email.plain_text || message.email.html || message.email.subject || ""
@@ -57,7 +62,7 @@ export function EmailItem({ message, isSelected, onClick }: EmailItemProps) {
             {initial}
           </div>
           <span className="text-sm font-semibold text-foreground truncate">
-            {senderName}
+            {recipientLabel}
           </span>
         </div>
         <span className="text-xs text-text-tertiary shrink-0 font-medium">
diff --git a/frontend/src/features/inbox/components/email-list/email-list.test.tsx b/frontend/src/features/inbox/components/email-list/email-list.test.tsx
index 9b94f21d..29605e05 100644
--- a/frontend/src/features/inbox/components/email-list/email-list.test.tsx
+++ b/frontend/src/features/inbox/components/email-list/email-list.test.tsx
@@ -26,6 +26,6 @@ describe("EmailList Component", () => {
     expect(screen.getByText("Inbox")).toBeInTheDocument()
     expect(screen.getByText("1")).toBeInTheDocument()
     expect(screen.getByPlaceholderText("Search inbox...")).toBeInTheDocument()
-    expect(screen.getByText("John Doe")).toBeInTheDocument()
+    expect(screen.getByText("recipient@example.com")).toBeInTheDocument()
   })
 })
diff --git a/frontend/src/features/inbox/components/email-list/email-list.tsx b/frontend/src/features/inbox/components/email-list/email-list.tsx
index ac3beef4..ab5f297b 100644
--- a/frontend/src/features/inbox/components/email-list/email-list.tsx
+++ b/frontend/src/features/inbox/components/email-list/email-list.tsx
@@ -1,5 +1,6 @@
 import { useState } from "react"
 import type { StoredEmail } from "../../inbox.types"
+import { Button } from "@/components/ui/button"
 import { SearchInput } from "@/components/ui/search-input"
 import { EmailItem } from "../email-item"
 
@@ -7,16 +8,27 @@ interface EmailListProps {
   messages: StoredEmail[]
   selectedMessageId: string | null
   onSelectMessage: (messageId: string) => void
+  hasMore?: boolean
+  isLoadingMore?: boolean
+  onLoadMore?: () => void
 }
 
-export function EmailList({ messages, selectedMessageId, onSelectMessage }: EmailListProps) {
+export function EmailList({
+  messages,
+  selectedMessageId,
+  onSelectMessage,
+  hasMore = false,
+  isLoadingMore = false,
+  onLoadMore,
+}: EmailListProps) {
   const [searchQuery, setSearchQuery] = useState("")
 
   const filtered = messages.filter((msg) => {
     const q = searchQuery.toLowerCase()
     const subject = (msg.email.subject || "").toLowerCase()
+    const recipients = (msg.email.to || []).join(" ").toLowerCase()
     const sender = (msg.email.from_name || msg.email.from || "").toLowerCase()
-    return subject.includes(q) || sender.includes(q)
+    return subject.includes(q) || recipients.includes(q) || sender.includes(q)
   })
 
   return (
@@ -51,6 +63,21 @@ export function EmailList({ messages, selectedMessageId, onSelectMessage }: Emai
             {searchQuery ? "No messages match your search." : "Your inbox is empty."}
           </div>
         )}
+
+        {hasMore && !searchQuery && onLoadMore && (
+          <div className="p-3 border-t border-border">
+            <Button
+              type="button"
+              variant="outline"
+              size="sm"
+              className="w-full"
+              disabled={isLoadingMore}
+              onClick={onLoadMore}
+            >
+              {isLoadingMore ? "Loading..." : "Load more"}
+            </Button>
+          </div>
+        )}
       </div>
     </div>
   )
diff --git a/frontend/src/features/inbox/components/get-started-dialog/get-started-dialog.stories.tsx b/frontend/src/features/inbox/components/get-started-dialog/get-started-dialog.stories.tsx
new file mode 100644
index 00000000..7eb2f39f
--- /dev/null
+++ b/frontend/src/features/inbox/components/get-started-dialog/get-started-dialog.stories.tsx
@@ -0,0 +1,27 @@
+import type { Meta, StoryObj } from "@storybook/react-vite"
+import { MemoryRouter } from "react-router-dom"
+
+import { GetStartedDialog } from "./get-started-dialog"
+
+const meta = {
+  title: "Features/Inbox/GetStartedDialog",
+  component: GetStartedDialog,
+  decorators: [
+    (Story) => (
+      <MemoryRouter initialEntries={["/workspaces/ws-demo/overview"]}>
+        <Story />
+      </MemoryRouter>
+    ),
+  ],
+} satisfies Meta<typeof GetStartedDialog>
+
+export default meta
+type Story = StoryObj<typeof meta>
+
+export const Open: Story = {
+  args: {
+    open: true,
+    onOpenChange: () => undefined,
+    workspaceId: "00000000-0000-0000-0000-000000000001",
+  },
+}
diff --git a/frontend/src/features/inbox/components/get-started-dialog/get-started-dialog.test.tsx b/frontend/src/features/inbox/components/get-started-dialog/get-started-dialog.test.tsx
new file mode 100644
index 00000000..dde552c4
--- /dev/null
+++ b/frontend/src/features/inbox/components/get-started-dialog/get-started-dialog.test.tsx
@@ -0,0 +1,52 @@
+import { render, screen } from "@testing-library/react"
+import { describe, expect, it, vi } from "vitest"
+import { MemoryRouter } from "react-router-dom"
+
+import { GetStartedDialog } from "./get-started-dialog"
+import { useGetStartedContext } from "../../hooks/use-get-started-context.hook"
+
+vi.mock("../../hooks/use-get-started-context.hook", () => ({
+  useGetStartedContext: vi.fn(),
+}))
+
+const mockedUseGetStartedContext = vi.mocked(useGetStartedContext)
+
+describe("GetStartedDialog", () => {
+  it("renders workspace credentials and curl examples", () => {
+    mockedUseGetStartedContext.mockReturnValue({
+      context: {
+        workspaceId: "00000000-0000-0000-0000-000000000001",
+        apiKeys: [{ client_id: "demo-client-id", name: "Demo", is_active: true }],
+      },
+      isLoading: false,
+      error: null,
+    })
+
+    render(
+      <MemoryRouter>
+        <GetStartedDialog open onOpenChange={vi.fn()} workspaceId="00000000-0000-0000-0000-000000000001" />
+      </MemoryRouter>,
+    )
+
+    expect(screen.getByText("Your credentials")).toBeInTheDocument()
+    expect(screen.getByText("demo-client-id")).toBeInTheDocument()
+    expect(screen.getAllByText(/X-Workspace-Key: 00000000-0000-0000-0000-000000000001/).length).toBeGreaterThan(0)
+    expect(screen.getByText(/\/v1\/email/)).toBeInTheDocument()
+  })
+
+  it("shows loading state", () => {
+    mockedUseGetStartedContext.mockReturnValue({
+      context: null,
+      isLoading: true,
+      error: null,
+    })
+
+    render(
+      <MemoryRouter>
+        <GetStartedDialog open onOpenChange={vi.fn()} workspaceId="ws-1" />
+      </MemoryRouter>,
+    )
+
+    expect(screen.getByText(/loading workspace credentials/i)).toBeInTheDocument()
+  })
+})
diff --git a/frontend/src/features/inbox/components/get-started-dialog/get-started-dialog.tsx b/frontend/src/features/inbox/components/get-started-dialog/get-started-dialog.tsx
new file mode 100644
index 00000000..49f3ff72
--- /dev/null
+++ b/frontend/src/features/inbox/components/get-started-dialog/get-started-dialog.tsx
@@ -0,0 +1,134 @@
+import { Link } from "react-router-dom"
+
+import { Button } from "@/components/ui/button"
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+} from "@/components/ui/dialog"
+import { Spinner } from "@/components/ui/spinner"
+import { ROUTES } from "@/core/router/routes"
+import { buildGatewayCurlExamples } from "../../get-started-dialog.utils"
+import { useGetStartedContext } from "../../hooks/use-get-started-context.hook"
+
+interface GetStartedDialogProps {
+  open: boolean
+  onOpenChange: (open: boolean) => void
+  workspaceId?: string
+}
+
+function developerSettingsPath(workspaceId: string) {
+  return `${ROUTES.workspace.settings(workspaceId)}?tab=developer`
+}
+
+export function GetStartedDialog({ open, onOpenChange, workspaceId }: GetStartedDialogProps) {
+  const { context, isLoading, error } = useGetStartedContext(workspaceId, open)
+  const developerPath = workspaceId ? developerSettingsPath(workspaceId) : ROUTES.workspaces
+
+  const primaryKey = context?.apiKeys[0]
+  const examples =
+    context && primaryKey
+      ? buildGatewayCurlExamples(context.workspaceId, primaryKey.client_id)
+      : null
+
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      <DialogContent className="max-h-[85vh] max-w-lg gap-0 overflow-hidden p-0">
+        <DialogHeader className="border-b bg-muted/20 px-5 py-4 text-left">
+          <DialogTitle>Get started</DialogTitle>
+          <DialogDescription>
+            Send test messages with your workspace API key and ID.
+          </DialogDescription>
+        </DialogHeader>
+        <div className="flex flex-col gap-4 overflow-y-auto p-6 text-sm text-foreground">
+          {isLoading ? (
+            <div className="flex items-center gap-2 text-sm text-text-secondary">
+              <Spinner size="sm" />
+              Loading workspace credentials…
+            </div>
+          ) : null}
+
+          {error ? (
+            <p className="rounded-md border border-destructive/30 bg-destructive/10 px-3 py-2 text-xs text-destructive">
+              {error}
+            </p>
+          ) : null}
+
+          {context ? (
+            <div className="rounded-lg border border-border bg-muted/30 p-4">
+              <h3 className="text-xs font-bold uppercase tracking-wide text-text-secondary">
+                Your credentials
+              </h3>
+              <dl className="mt-3 flex flex-col gap-2 text-xs">
+                <div className="flex flex-col gap-0.5 sm:flex-row sm:items-baseline sm:gap-2">
+                  <dt className="shrink-0 font-medium text-text-secondary">Workspace ID</dt>
+                  <dd className="font-mono text-foreground break-all">{context.workspaceId}</dd>
+                </div>
+                <div className="flex flex-col gap-0.5 sm:flex-row sm:items-baseline sm:gap-2">
+                  <dt className="shrink-0 font-medium text-text-secondary">Header</dt>
+                  <dd className="font-mono text-foreground break-all">
+                    X-Workspace-Key: {context.workspaceId}
+                  </dd>
+                </div>
+                {primaryKey ? (
+                  <div className="flex flex-col gap-0.5 sm:flex-row sm:items-baseline sm:gap-2">
+                    <dt className="shrink-0 font-medium text-text-secondary">Client ID</dt>
+                    <dd className="font-mono text-foreground">{primaryKey.client_id}</dd>
+                  </div>
+                ) : (
+                  <p className="text-text-secondary">
+                    No API keys yet. Create one in{" "}
+                    <Link to={developerPath} className="font-semibold text-primary-brand hover:underline">
+                      Settings → Developer
+                    </Link>
+                    .
+                  </p>
+                )}
+                <div className="flex flex-col gap-0.5">
+                  <dt className="font-medium text-text-secondary">Client secret</dt>
+                  <dd className="text-text-secondary">
+                    Shown once when you generate or regenerate a key in{" "}
+                    <Link to={developerPath} className="font-semibold text-primary-brand hover:underline">
+                      Settings → Developer
+                    </Link>
+                    . Replace <span className="font-mono text-foreground">YOUR_CLIENT_SECRET</span> in the
+                    examples below.
+                  </dd>
+                </div>
+              </dl>
+            </div>
+          ) : null}
+
+          {examples ? (
+            <div className="flex flex-col gap-3">
+              <div>
+                <h4 className="mb-1 text-xs font-bold uppercase text-text-secondary">Email</h4>
+                <pre className="overflow-x-auto rounded-md border bg-muted/80 p-2.5 font-mono text-xs whitespace-pre-wrap">
+                  {examples.email}
+                </pre>
+              </div>
+              <div>
+                <h4 className="mb-1 text-xs font-bold uppercase text-text-secondary">SMS</h4>
+                <pre className="overflow-x-auto rounded-md border bg-muted/80 p-2.5 font-mono text-xs whitespace-pre-wrap">
+                  {examples.sms}
+                </pre>
+              </div>
+            </div>
+          ) : null}
+
+          {!isLoading && !context && !error ? (
+            <p className="text-xs text-text-secondary">Open this dialog from a workspace to load credentials.</p>
+          ) : null}
+        </div>
+        <DialogFooter className="border-t bg-muted/20 px-5 py-4">
+          <Button type="button" onClick={() => onOpenChange(false)}>
+            Close
+          </Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  )
+}
diff --git a/frontend/src/features/inbox/components/get-started-dialog/index.ts b/frontend/src/features/inbox/components/get-started-dialog/index.ts
new file mode 100644
index 00000000..989854b9
--- /dev/null
+++ b/frontend/src/features/inbox/components/get-started-dialog/index.ts
@@ -0,0 +1 @@
+export { GetStartedDialog } from "./get-started-dialog"
diff --git a/frontend/src/features/inbox/components/send-test-modal/index.ts b/frontend/src/features/inbox/components/send-test-modal/index.ts
deleted file mode 100644
index cb31fba5..00000000
--- a/frontend/src/features/inbox/components/send-test-modal/index.ts
+++ /dev/null
@@ -1 +0,0 @@
-export * from "./send-test-modal"
diff --git a/frontend/src/features/inbox/components/send-test-modal/send-test-modal.stories.tsx b/frontend/src/features/inbox/components/send-test-modal/send-test-modal.stories.tsx
deleted file mode 100644
index bdee6290..00000000
--- a/frontend/src/features/inbox/components/send-test-modal/send-test-modal.stories.tsx
+++ /dev/null
@@ -1,45 +0,0 @@
-import type { Meta, StoryObj } from "@storybook/react-vite"
-import { useState } from "react"
-
-import { Button } from "@/components/ui/button"
-import { SendTestModal } from "./send-test-modal"
-
-const meta = {
-  title: "Features/Inbox/SendTestModal",
-  component: SendTestModal,
-  tags: ["autodocs"],
-  parameters: { layout: "centered" },
-} satisfies Meta<typeof SendTestModal>
-
-export default meta
-
-type Story = StoryObj<typeof meta>
-
-function SendTestModalDemo() {
-  const [open, setOpen] = useState(true)
-  return (
-    <>
-      <Button type="button" onClick={() => setOpen(true)}>
-        Open send test
-      </Button>
-      <SendTestModal
-        workspaceId="00000000-0000-0000-0000-000000000001"
-        open={open}
-        onOpenChange={setOpen}
-        onSent={() => undefined}
-        initialChannel="email"
-      />
-    </>
-  )
-}
-
-export const EmailChannel: Story = {
-  render: () => <SendTestModalDemo />,
-  args: {
-    workspaceId: "00000000-0000-0000-0000-000000000001",
-    open: true,
-    onOpenChange: () => undefined,
-    onSent: () => undefined,
-    initialChannel: "email",
-  },
-}
diff --git a/frontend/src/features/inbox/components/send-test-modal/send-test-modal.test.tsx b/frontend/src/features/inbox/components/send-test-modal/send-test-modal.test.tsx
deleted file mode 100644
index b563a3bf..00000000
--- a/frontend/src/features/inbox/components/send-test-modal/send-test-modal.test.tsx
+++ /dev/null
@@ -1,23 +0,0 @@
-import { render, screen } from "@testing-library/react"
-import { describe, expect, it, vi } from "vitest"
-
-import { SendTestModal } from "./send-test-modal"
-
-vi.mock("../../inbox.api", () => ({
-  sendTestRequest: vi.fn(),
-}))
-
-describe("SendTestModal Component", () => {
-  it("renders correctly when open", () => {
-    render(
-      <SendTestModal
-        workspaceId="w1"
-        open={true}
-        onOpenChange={vi.fn()}
-        onSent={vi.fn()}
-      />
-    )
-    expect(screen.getByText("Send Test Request")).toBeInTheDocument()
-    expect(screen.getByLabelText("To (comma-separated)")).toBeInTheDocument()
-  })
-})
diff --git a/frontend/src/features/inbox/components/send-test-modal/send-test-modal.tsx b/frontend/src/features/inbox/components/send-test-modal/send-test-modal.tsx
deleted file mode 100644
index 5491f047..00000000
--- a/frontend/src/features/inbox/components/send-test-modal/send-test-modal.tsx
+++ /dev/null
@@ -1,223 +0,0 @@
-import { useState } from "react"
-import { Icon } from "@/components/ui/icon"
-import { Button } from "@/components/ui/button"
-import { Input } from "@/components/ui/input"
-import {
-  Dialog,
-  DialogContent,
-  DialogDescription,
-  DialogFooter,
-  DialogHeader,
-  DialogTitle,
-} from "@/components/ui/dialog"
-import { sendTestRequest } from "../../inbox.api"
-import type { MessageChannel } from "../../inbox.types"
-
-interface SendTestModalProps {
-  workspaceId: string
-  open: boolean
-  onOpenChange: (open: boolean) => void
-  onSent: () => void
-  initialChannel?: MessageChannel
-}
-
-export function SendTestModal({
-  workspaceId,
-  open,
-  onOpenChange,
-  onSent,
-  initialChannel = "email",
-}: SendTestModalProps) {
-  const [channel, setChannel] = useState<MessageChannel>(initialChannel)
-  const [to, setTo] = useState("")
-  const [subject, setSubject] = useState("")
-  const [body, setBody] = useState("")
-  const [html, setHtml] = useState("")
-  const [isLoading, setIsLoading] = useState(false)
-  const [error, setError] = useState<string | null>(null)
-
-  const handleSubmit = async (e: React.FormEvent) => {
-    e.preventDefault()
-    setIsLoading(true)
-    setError(null)
-
-    let payload: Record<string, unknown> = {}
-    if (channel === "email") {
-      payload = {
-        to: to.split(",").map((s) => s.trim()),
-        subject,
-        html,
-      }
-    } else if (channel === "sms") {
-      payload = { to, body }
-    } else if (channel === "push") {
-      payload = { to, title: subject, body }
-    } else if (channel === "chat") {
-      payload = { to, body }
-    }
-
-    const res = await sendTestRequest(workspaceId, channel, payload)
-    setIsLoading(false)
-
-    if (!res.ok) {
-      setError(res.message ?? "Failed to trigger test request")
-    } else {
-      onSent()
-      onOpenChange(false)
-    }
-  }
-
-  const handleChannelChange = (newChannel: "email" | "sms" | "push" | "chat") => {
-    setChannel(newChannel)
-    setError(null)
-    if (newChannel === "email") {
-      setTo("user@example.com")
-      setSubject("Welcome to Message Gateway!")
-    } else if (newChannel === "sms") {
-      setTo("+15551234567")
-      setBody("This is a test SMS message.")
-    } else if (newChannel === "push") {
-      setTo("device-token-12345")
-      setSubject("New Notification")
-      setBody("This is a test push notification.")
-    } else if (newChannel === "chat") {
-      setTo("slack-channel-id")
-      setBody("Hello from the Chat API!")
-    }
-  }
-
-  return (
-    <Dialog open={open} onOpenChange={onOpenChange}>
-      <DialogContent className="max-w-md gap-0 p-0 overflow-hidden">
-        <DialogHeader className="border-b px-5 py-4 bg-muted/20 text-left">
-          <DialogTitle>Send Test Request</DialogTitle>
-          <DialogDescription>Trigger a gateway send for your workspace.</DialogDescription>
-        </DialogHeader>
-
-        <form onSubmit={handleSubmit} className="flex flex-col">
-          <div className="flex flex-col gap-4 p-5 max-h-[70vh] overflow-y-auto">
-            {error && (
-              <div
-                role="alert"
-                className="flex items-center gap-2 rounded-lg border border-destructive/20 bg-destructive/10 p-3 text-xs text-destructive"
-              >
-                <Icon name="error" size="sm" className="shrink-0 text-destructive" />
-                <span>{error}</span>
-              </div>
-            )}
-
-            <div className="flex flex-col gap-1.5">
-              <span className="text-xs font-semibold uppercase text-muted-foreground">Channel</span>
-              <div className="grid grid-cols-4 gap-1 rounded-lg bg-muted p-1">
-                {(["email", "sms", "push", "chat"] as const).map((ch) => (
-                  <button
-                    key={ch}
-                    type="button"
-                    onClick={() => handleChannelChange(ch)}
-                    className={`rounded-md py-1.5 text-xs font-medium capitalize transition-all ${
-                      channel === ch
-                        ? "bg-card text-foreground shadow-xs"
-                        : "text-muted-foreground hover:text-foreground"
-                    }`}
-                  >
-                    {ch}
-                  </button>
-                ))}
-              </div>
-            </div>
-
-            <div className="flex flex-col gap-1.5">
-              <label htmlFor="send-test-to" className="text-xs font-semibold uppercase text-muted-foreground">
-                {channel === "email" ? "To (comma-separated)" : "Recipient (To)"}
-              </label>
-              <Input
-                id="send-test-to"
-                required
-                aria-invalid={error ? true : undefined}
-                placeholder={
-                  channel === "email"
-                    ? "user@example.com, another@example.com"
-                    : channel === "sms"
-                      ? "+15551234567"
-                      : "recipient-id"
-                }
-                value={to}
-                onChange={(e) => setTo(e.target.value)}
-                className="bg-background text-sm"
-              />
-            </div>
-
-            {(channel === "email" || channel === "push") && (
-              <div className="flex flex-col gap-1.5">
-                <label htmlFor="send-test-subject" className="text-xs font-semibold uppercase text-muted-foreground">
-                  {channel === "email" ? "Subject" : "Notification Title"}
-                </label>
-                <Input
-                  id="send-test-subject"
-                  required
-                  placeholder={channel === "email" ? "Subject line" : "Title text"}
-                  value={subject}
-                  onChange={(e) => setSubject(e.target.value)}
-                  className="bg-background text-sm"
-                />
-              </div>
-            )}
-
-            {channel === "email" && (
-              <div className="flex flex-col gap-1.5">
-                <label htmlFor="send-test-html" className="text-xs font-semibold uppercase text-muted-foreground">
-                  HTML Content
-                </label>
-                <textarea
-                  id="send-test-html"
-                  required
-                  rows={4}
-                  placeholder="<h1>HTML...</h1>"
-                  value={html}
-                  onChange={(e) => setHtml(e.target.value)}
-                  className="w-full rounded-lg border border-input bg-background px-3 py-2 font-mono text-sm focus-visible:outline-hidden focus-visible:ring-2 focus-visible:ring-ring"
-                />
-              </div>
-            )}
-
-            {channel !== "email" && (
-              <div className="flex flex-col gap-1.5">
-                <label htmlFor="send-test-body" className="text-xs font-semibold uppercase text-muted-foreground">
-                  Message Body
-                </label>
-                <textarea
-                  id="send-test-body"
-                  required
-                  rows={3}
-                  placeholder="Enter message..."
-                  value={body}
-                  onChange={(e) => setBody(e.target.value)}
-                  className="w-full rounded-lg border border-input bg-background px-3 py-2 text-sm focus-visible:outline-hidden focus-visible:ring-2 focus-visible:ring-ring"
-                />
-              </div>
-            )}
-          </div>
-
-          <DialogFooter className="border-t bg-muted/20 px-5 py-4 sm:justify-end">
-            <Button type="button" variant="outline" onClick={() => onOpenChange(false)} disabled={isLoading}>
-              Cancel
-            </Button>
-            <Button type="submit" disabled={isLoading}>
-              {isLoading ? (
-                <>
-                  <span className="size-3.5 animate-spin rounded-full border-2 border-primary-foreground border-t-transparent" />
-                  Sending...
-                </>
-              ) : (
-                <>
-                  <Icon name="send" size="sm" data-icon="inline-start" />
-                  Send Request
-                </>
-              )}
-            </Button>
-          </DialogFooter>
-        </form>
-      </DialogContent>
-    </Dialog>
-  )
-}
diff --git a/frontend/src/features/inbox/get-started-dialog.utils.test.ts b/frontend/src/features/inbox/get-started-dialog.utils.test.ts
new file mode 100644
index 00000000..50094f74
--- /dev/null
+++ b/frontend/src/features/inbox/get-started-dialog.utils.test.ts
@@ -0,0 +1,17 @@
+import { describe, expect, it } from "vitest"
+
+import { buildGatewayCurlExamples } from "./get-started-dialog.utils"
+
+describe("buildGatewayCurlExamples", () => {
+  it("embeds workspace id and client id in curl commands", () => {
+    const examples = buildGatewayCurlExamples(
+      "00000000-0000-0000-0000-000000000001",
+      "demo-client-id",
+    )
+
+    expect(examples.email).toContain("X-Workspace-Key: 00000000-0000-0000-0000-000000000001")
+    expect(examples.email).toContain('-u "demo-client-id:YOUR_CLIENT_SECRET"')
+    expect(examples.sms).toContain("X-Workspace-Key: 00000000-0000-0000-0000-000000000001")
+    expect(examples.sms).toContain('-u "demo-client-id:YOUR_CLIENT_SECRET"')
+  })
+})
diff --git a/frontend/src/features/inbox/get-started-dialog.utils.ts b/frontend/src/features/inbox/get-started-dialog.utils.ts
new file mode 100644
index 00000000..21c6fe36
--- /dev/null
+++ b/frontend/src/features/inbox/get-started-dialog.utils.ts
@@ -0,0 +1,27 @@
+const GATEWAY_BASE_URL = "http://localhost:10101"
+const SECRET_PLACEHOLDER = "YOUR_CLIENT_SECRET"
+
+export interface GatewayCurlExamples {
+  email: string
+  sms: string
+}
+
+export function buildGatewayCurlExamples(
+  workspaceId: string,
+  clientId: string,
+): GatewayCurlExamples {
+  const auth = `${clientId}:${SECRET_PLACEHOLDER}`
+
+  return {
+    email: `curl -X POST ${GATEWAY_BASE_URL}/v1/email \\
+  -u "${auth}" \\
+  -H "X-Workspace-Key: ${workspaceId}" \\
+  -H "Content-Type: application/json" \\
+  -d '{"to":["user@example.com"],"subject":"Test","html":"<p>Hi</p>"}'`,
+    sms: `curl -X POST ${GATEWAY_BASE_URL}/v1/sms \\
+  -u "${auth}" \\
+  -H "X-Workspace-Key: ${workspaceId}" \\
+  -H "Content-Type: application/json" \\
+  -d '{"to":["+1234567890"],"message":"Hello"}'`,
+  }
+}
diff --git a/frontend/src/features/inbox/get-started.api.ts b/frontend/src/features/inbox/get-started.api.ts
new file mode 100644
index 00000000..936a6da0
--- /dev/null
+++ b/frontend/src/features/inbox/get-started.api.ts
@@ -0,0 +1,27 @@
+import { activeWorkspaceApiKeys, fetchWorkspaceApiKeys } from "@/core/api/workspace-api-keys"
+import type { WorkspaceApiKey } from "@/core/api/workspace-api-keys"
+
+export interface GetStartedContext {
+  workspaceId: string
+  apiKeys: Array<Pick<WorkspaceApiKey, "client_id" | "name" | "is_active">>
+}
+
+export async function fetchGetStartedContext(
+  workspaceId: string,
+): Promise<{ ok: true; context: GetStartedContext } | { ok: false; message?: string }> {
+  try {
+    const apiKeys = activeWorkspaceApiKeys(await fetchWorkspaceApiKeys(workspaceId))
+    return {
+      ok: true,
+      context: {
+        workspaceId,
+        apiKeys,
+      },
+    }
+  } catch (err) {
+    return {
+      ok: false,
+      message: err instanceof Error ? err.message : "Failed to load credentials",
+    }
+  }
+}
diff --git a/frontend/src/features/inbox/hooks/use-get-started-context.hook.ts b/frontend/src/features/inbox/hooks/use-get-started-context.hook.ts
new file mode 100644
index 00000000..fa4aaec1
--- /dev/null
+++ b/frontend/src/features/inbox/hooks/use-get-started-context.hook.ts
@@ -0,0 +1,44 @@
+import { useCallback, useEffect, useState } from "react"
+
+import { fetchGetStartedContext, type GetStartedContext } from "../get-started.api"
+
+export function useGetStartedContext(workspaceId: string | undefined, enabled: boolean) {
+  const [context, setContext] = useState<GetStartedContext | null>(null)
+  const [isLoading, setIsLoading] = useState(false)
+  const [error, setError] = useState<string | null>(null)
+
+  const applyResult = useCallback(
+    (result: Awaited<ReturnType<typeof fetchGetStartedContext>>) => {
+      setIsLoading(false)
+      if (!result.ok) {
+        setContext(null)
+        setError(result.message ?? "Failed to load workspace credentials")
+        return
+      }
+      setError(null)
+      setContext(result.context)
+    },
+    [],
+  )
+
+  useEffect(() => {
+    if (!enabled || !workspaceId) {
+      return
+    }
+
+    let cancelled = false
+    ;(async () => {
+      setIsLoading(true)
+      setError(null)
+      const result = await fetchGetStartedContext(workspaceId)
+      if (cancelled) return
+      applyResult(result)
+    })()
+
+    return () => {
+      cancelled = true
+    }
+  }, [workspaceId, enabled, applyResult])
+
+  return { context, isLoading, error }
+}
diff --git a/frontend/src/features/inbox/hooks/use-inbox-emails.hook.test.ts b/frontend/src/features/inbox/hooks/use-inbox-emails.hook.test.ts
new file mode 100644
index 00000000..5766548b
--- /dev/null
+++ b/frontend/src/features/inbox/hooks/use-inbox-emails.hook.test.ts
@@ -0,0 +1,103 @@
+import { act, renderHook, waitFor } from "@testing-library/react"
+import { describe, expect, it, vi, beforeEach } from "vitest"
+
+import { fetchInboxEmailById, fetchInboxEmails } from "../inbox.api"
+import { useInboxEmails } from "./use-inbox-emails.hook"
+
+vi.mock("../inbox.api", () => ({
+  fetchInboxEmails: vi.fn(),
+  fetchInboxEmailById: vi.fn(),
+}))
+
+const mockedFetchInboxEmails = vi.mocked(fetchInboxEmails)
+const mockedFetchInboxEmailById = vi.mocked(fetchInboxEmailById)
+
+const sampleEmail = {
+  id: "email-1",
+  workspace_id: "ws-1",
+  channel: "email",
+  status: "delivered",
+  created_at: "2026-01-01T00:00:00Z",
+  email: {
+    to: ["a@b.com"],
+    subject: "Hello",
+    html: "<p>hi</p>",
+  },
+}
+
+describe("useInboxEmails", () => {
+  beforeEach(() => {
+    mockedFetchInboxEmailById.mockResolvedValue({ ok: false })
+  })
+
+  it("loads emails for a workspace", async () => {
+    mockedFetchInboxEmails.mockResolvedValue({
+      ok: true,
+      page: { items: [sampleEmail], has_more: false, next_cursor: undefined },
+    })
+
+    const { result } = renderHook(() => useInboxEmails("ws-1"))
+
+    await waitFor(() => {
+      expect(result.current.isLoading).toBe(false)
+    })
+
+    expect(mockedFetchInboxEmails).toHaveBeenCalledWith("ws-1", { limit: 50 })
+    expect(result.current.messages).toHaveLength(1)
+    expect(result.current.selectedMessageId).toBe("email-1")
+    expect(result.current.error).toBeNull()
+  })
+
+  it("surfaces API errors", async () => {
+    mockedFetchInboxEmails.mockResolvedValue({
+      ok: false,
+      message: "inbox unavailable",
+    })
+
+    const { result } = renderHook(() => useInboxEmails("ws-1"))
+
+    await waitFor(() => {
+      expect(result.current.isLoading).toBe(false)
+    })
+
+    expect(result.current.error).toBe("inbox unavailable")
+    expect(result.current.messages).toHaveLength(0)
+  })
+
+  it("appends more emails when loadMore is called", async () => {
+    mockedFetchInboxEmails
+      .mockResolvedValueOnce({
+        ok: true,
+        page: {
+          items: [sampleEmail],
+          has_more: true,
+          next_cursor: "cursor-1",
+        },
+      })
+      .mockResolvedValueOnce({
+        ok: true,
+        page: {
+          items: [{
+            ...sampleEmail,
+            id: "email-2",
+            email: { ...sampleEmail.email, subject: "Second" },
+          }],
+          has_more: false,
+          next_cursor: undefined,
+        },
+      })
+
+    const { result } = renderHook(() => useInboxEmails("ws-1"))
+
+    await waitFor(() => {
+      expect(result.current.hasMore).toBe(true)
+    })
+
+    await act(async () => {
+      await result.current.loadMore()
+    })
+
+    expect(result.current.messages).toHaveLength(2)
+    expect(result.current.hasMore).toBe(false)
+  })
+})
diff --git a/frontend/src/features/inbox/hooks/use-inbox-emails.hook.ts b/frontend/src/features/inbox/hooks/use-inbox-emails.hook.ts
new file mode 100644
index 00000000..62baf64e
--- /dev/null
+++ b/frontend/src/features/inbox/hooks/use-inbox-emails.hook.ts
@@ -0,0 +1,132 @@
+import { useCallback, useEffect, useState } from "react"
+
+import { fetchInboxEmailById, fetchInboxEmails } from "../inbox.api"
+import type { StoredEmail } from "../inbox.types"
+
+const PAGE_SIZE = 50
+
+export function useInboxEmails(workspaceId: string | undefined) {
+  const [messages, setMessages] = useState<StoredEmail[]>([])
+  const [selectedMessageId, setSelectedMessageId] = useState<string | null>(null)
+  const [isLoading, setIsLoading] = useState(true)
+  const [isLoadingMore, setIsLoadingMore] = useState(false)
+  const [error, setError] = useState<string | null>(null)
+  const [nextCursor, setNextCursor] = useState<string | undefined>()
+  const [hasMore, setHasMore] = useState(false)
+
+  const upsertMessage = useCallback((message: StoredEmail) => {
+    setMessages((prev) => {
+      const index = prev.findIndex((m) => m.id === message.id)
+      if (index === -1) return [message, ...prev]
+      const next = [...prev]
+      next[index] = message
+      return next
+    })
+  }, [])
+
+  const applyPage = useCallback((result: Awaited<ReturnType<typeof fetchInboxEmails>>) => {
+    setIsLoading(false)
+    if (!result.ok) {
+      setError(result.message ?? "Failed to load emails")
+      return
+    }
+
+    setError(null)
+    setMessages(result.page.items ?? [])
+    setNextCursor(result.page.next_cursor)
+    setHasMore(result.page.has_more)
+    if ((result.page.items ?? []).length > 0) {
+      setSelectedMessageId((prev) => prev ?? (result.page.items ?? [])[0].id)
+    }
+  }, [])
+
+  useEffect(() => {
+    let cancelled = false
+    ;(async () => {
+      if (!workspaceId) return
+      setIsLoading(true)
+      setError(null)
+      const result = await fetchInboxEmails(workspaceId, { limit: PAGE_SIZE })
+      if (cancelled) return
+      applyPage(result)
+    })()
+
+    return () => {
+      cancelled = true
+    }
+  }, [workspaceId, applyPage])
+
+  useEffect(() => {
+    if (!workspaceId || !selectedMessageId) return
+
+    let cancelled = false
+    void fetchInboxEmailById(workspaceId, selectedMessageId).then((result) => {
+      if (cancelled || !result.ok) return
+      upsertMessage(result.item)
+    })
+
+    return () => {
+      cancelled = true
+    }
+  }, [workspaceId, selectedMessageId, upsertMessage])
+
+  const reload = useCallback(async () => {
+    if (!workspaceId) return
+    setIsLoading(true)
+    setError(null)
+    const result = await fetchInboxEmails(workspaceId, { limit: PAGE_SIZE })
+    applyPage(result)
+  }, [workspaceId, applyPage])
+
+  const loadMore = useCallback(async () => {
+    if (!workspaceId || !nextCursor || isLoadingMore) return
+    setIsLoadingMore(true)
+
+    const result = await fetchInboxEmails(workspaceId, { limit: PAGE_SIZE, cursor: nextCursor })
+    setIsLoadingMore(false)
+    if (!result.ok) {
+      setError(result.message ?? "Failed to load more emails")
+      return
+    }
+
+    setMessages((prev) => [...prev, ...(result.page.items ?? [])])
+    setNextCursor(result.page.next_cursor)
+    setHasMore(result.page.has_more)
+  }, [workspaceId, nextCursor, isLoadingMore])
+
+  const removeMessage = useCallback((messageId: string) => {
+    setMessages((prev) => {
+      const remaining = prev.filter((m) => m.id !== messageId)
+      setSelectedMessageId((current) => {
+        if (current === messageId) {
+          return remaining.length > 0 ? remaining[0].id : null
+        }
+        return current
+      })
+      return remaining
+    })
+  }, [])
+
+  const clearMessages = useCallback(() => {
+    setMessages([])
+    setSelectedMessageId(null)
+    setNextCursor(undefined)
+    setHasMore(false)
+  }, [])
+
+  return {
+    messages,
+    selectedMessageId,
+    setSelectedMessageId,
+    isLoading,
+    isLoadingMore,
+    error,
+    nextCursor,
+    hasMore,
+    reload,
+    loadMore,
+    upsertMessage,
+    removeMessage,
+    clearMessages,
+  }
+}
diff --git a/frontend/src/features/inbox/hooks/use-inbox-key.hook.ts b/frontend/src/features/inbox/hooks/use-inbox-key.hook.ts
deleted file mode 100644
index 24c5ffea..00000000
--- a/frontend/src/features/inbox/hooks/use-inbox-key.hook.ts
+++ /dev/null
@@ -1,121 +0,0 @@
-import { useEffect, useState } from "react"
-import { apiFetch } from "@/core/api/client"
-import type { InboxCredentials } from "../inbox.types"
-
-interface APIKeyItem {
-  id: string
-  workspace_id: string
-  client_id: string
-  name: string
-  is_active: boolean
-}
-
-export function useInboxKey(workspaceId: string | undefined) {
-  const [creds, setCreds] = useState<InboxCredentials | null>(null)
-  const [isLoading, setIsLoading] = useState(() => !!workspaceId)
-  const [error, setError] = useState<string | null>(null)
-
-  useEffect(() => {
-    let cancelled = false
-    if (!workspaceId) {
-      Promise.resolve().then(() => {
-        if (!cancelled) {
-          setCreds(null)
-          setIsLoading(false)
-          setError(null)
-        }
-      })
-      return
-    }
-
-    const cacheKey = `wpd_inbox_creds_${workspaceId}`
-
-    const bootstrap = async () => {
-      await Promise.resolve() // yield to avoid synchronous state update in effect
-      setIsLoading(true)
-      setError(null)
-
-      try {
-        // 1. Check local storage cache
-        const cached = localStorage.getItem(cacheKey)
-        if (cached) {
-          try {
-            const parsed = JSON.parse(cached) as InboxCredentials
-            if (parsed.clientId && parsed.clientSecret) {
-              if (!cancelled) {
-                setCreds(parsed)
-                setIsLoading(false)
-              }
-              return
-            }
-          } catch {
-            localStorage.removeItem(cacheKey)
-          }
-        }
-
-        // 2. Fetch keys list from backend
-        const listRes = await apiFetch(`/api/v1/workspaces/${workspaceId}/api-keys`)
-        if (!listRes.ok) {
-          throw new Error("Failed to retrieve workspace API keys")
-        }
-        const keys = (await listRes.json()) as APIKeyItem[]
-
-        const portalKey = keys.find((k) => k.name === "Portal UI" && k.is_active)
-
-        let finalCreds: InboxCredentials
-
-        if (portalKey) {
-          // Key exists but secret is hidden; regenerate to get new plaintext secret
-          const regenRes = await apiFetch(
-            `/api/v1/workspaces/${workspaceId}/api-keys/${portalKey.id}/regenerate`,
-            { method: "POST" }
-          )
-          if (!regenRes.ok) {
-            throw new Error("Failed to regenerate Portal UI API credentials")
-          }
-          const data = (await regenRes.json()) as { client_secret: string }
-          finalCreds = {
-            clientId: portalKey.client_id,
-            clientSecret: data.client_secret,
-          }
-        } else {
-          // No Portal UI key exists; create one
-          const createRes = await apiFetch(`/api/v1/workspaces/${workspaceId}/api-keys`, {
-            method: "POST",
-            body: JSON.stringify({ name: "Portal UI" }),
-          })
-          if (!createRes.ok) {
-            throw new Error("Failed to auto-provision Portal UI API credentials")
-          }
-          const data = (await createRes.json()) as { client_id: string; client_secret: string }
-          finalCreds = {
-            clientId: data.client_id,
-            clientSecret: data.client_secret,
-          }
-        }
-
-        // 3. Cache and update state
-        localStorage.setItem(cacheKey, JSON.stringify(finalCreds))
-        if (!cancelled) {
-          setCreds(finalCreds)
-        }
-      } catch (err) {
-        if (!cancelled) {
-          setError(err instanceof Error ? err.message : "Authentication error")
-        }
-      } finally {
-        if (!cancelled) {
-          setIsLoading(false)
-        }
-      }
-    }
-
-    void bootstrap()
-
-    return () => {
-      cancelled = true
-    }
-  }, [workspaceId])
-
-  return { creds, isLoading, error }
-}
diff --git a/frontend/src/features/inbox/hooks/use-inbox-logs.hook.ts b/frontend/src/features/inbox/hooks/use-inbox-logs.hook.ts
index 565ad8c0..1d305e0e 100644
--- a/frontend/src/features/inbox/hooks/use-inbox-logs.hook.ts
+++ b/frontend/src/features/inbox/hooks/use-inbox-logs.hook.ts
@@ -16,6 +16,7 @@ export function useInboxLogs(workspaceId: string | undefined, channel?: string)
         setError(res.message ?? "Failed to load request logs")
         return
       }
+      setError(null)
       setLogs(res.items)
       setTotal(res.total)
     },
diff --git a/frontend/src/features/inbox/inbox.api.ts b/frontend/src/features/inbox/inbox.api.ts
index d2d8942c..dec23822 100644
--- a/frontend/src/features/inbox/inbox.api.ts
+++ b/frontend/src/features/inbox/inbox.api.ts
@@ -1,10 +1,13 @@
 import { apiFetch, getToken } from "@/core/api/client"
-import type { EmailTemplate, InboxCredentials, LogRow, StoredEmail } from "./inbox.types"
+import type { EmailTemplate, InboxEmailPage, LogRow, StoredEmail } from "./inbox.types"
+import { parseLogsResponse } from "./logs.schema"
 
-function inboxAuthHeaders(creds: InboxCredentials): HeadersInit {
-  return {
-    "X-Api-Client-Id": creds.clientId,
-    "X-Api-Client-Secret": creds.clientSecret,
+async function parseApiError(res: Response, fallback: string): Promise<string> {
+  try {
+    const err = (await res.json()) as { message?: string; error?: string }
+    return err.message ?? err.error ?? fallback
+  } catch {
+    return fallback
   }
 }
 
@@ -26,67 +29,73 @@ export async function fetchLogs(
   try {
     const res = await apiFetch(`/api/v1/workspaces/${workspaceId}/logs?${query.toString()}`)
     if (!res.ok) {
-      const err = (await res.json().catch(() => ({}))) as { message?: string }
-      return { ok: false, message: err.message ?? "Failed to fetch logs" }
+      return { ok: false, message: await parseApiError(res, "Failed to fetch logs") }
     }
-    const data = (await res.json()) as { items: LogRow[]; total: number }
-    return { ok: true, items: data.items || [], total: data.total || 0 }
+    const parsed = parseLogsResponse(await res.json())
+    if (!parsed.ok) {
+      return { ok: false, message: parsed.message }
+    }
+    return { ok: true, items: parsed.items, total: parsed.total }
   } catch (err) {
     return { ok: false, message: err instanceof Error ? err.message : "Failed to fetch logs" }
   }
 }
 
-export async function sendTestRequest(
+export async function fetchInboxEmails(
   workspaceId: string,
-  channel: "email" | "sms" | "push" | "chat",
-  payload: Record<string, unknown>
-): Promise<{ ok: true; id: string } | { ok: false; message?: string }> {
+  params: { limit?: number; cursor?: string } = {}
+): Promise<{ ok: true; page: InboxEmailPage } | { ok: false; message?: string }> {
   try {
-    const res = await apiFetch(`/api/v1/workspaces/${workspaceId}/send-test/${channel}`, {
-      method: "POST",
-      body: JSON.stringify(payload),
-    })
+    const query = new URLSearchParams()
+    if (params.limit !== undefined) {
+      query.set("limit", String(params.limit))
+    }
+    if (params.cursor) {
+      query.set("cursor", params.cursor)
+    }
+    const qs = query.toString()
+    const path = `/api/v1/workspaces/${workspaceId}/inbox/emails${qs ? `?${qs}` : ""}`
+    const res = await apiFetch(path)
     if (!res.ok) {
-      const err = (await res.json().catch(() => ({}))) as { message?: string }
-      return { ok: false, message: err.message ?? `Failed to send test ${channel}` }
+      return { ok: false, message: await parseApiError(res, "Failed to fetch email inbox messages") }
     }
-    const data = (await res.json()) as { id: string }
-    return { ok: true, id: data.id }
+    const raw = await res.json()
+    const page: InboxEmailPage = Array.isArray(raw)
+      ? { items: raw, has_more: false }
+      : {
+          items: raw.items ?? [],
+          next_cursor: raw.next_cursor,
+          has_more: raw.has_more ?? false,
+        }
+    return { ok: true, page }
   } catch (err) {
-    return { ok: false, message: err instanceof Error ? err.message : `Failed to send test ${channel}` }
+    return { ok: false, message: err instanceof Error ? err.message : "Failed to load emails" }
   }
 }
 
-export async function fetchInboxEmails(
+export async function fetchInboxEmailById(
   workspaceId: string,
-  creds: InboxCredentials
-): Promise<{ ok: true; items: StoredEmail[] } | { ok: false; message?: string }> {
+  messageId: string
+): Promise<{ ok: true; item: StoredEmail } | { ok: false; message?: string }> {
   try {
-    const res = await apiFetch(`/api/v1/workspaces/${workspaceId}/inbox/emails`, {
-      headers: inboxAuthHeaders(creds),
-    })
+    const res = await apiFetch(`/api/v1/workspaces/${workspaceId}/inbox/emails/${messageId}`)
     if (!res.ok) {
-      return { ok: false, message: "Failed to fetch email inbox messages" }
+      return { ok: false, message: "Failed to fetch email" }
     }
-    const data = (await res.json()) as StoredEmail[]
-    const sorted = [...data].sort(
-      (a, b) => new Date(b.created_at).getTime() - new Date(a.created_at).getTime()
-    )
-    return { ok: true, items: sorted }
+    const item = (await res.json()) as StoredEmail
+    return { ok: true, item }
   } catch (err) {
-    return { ok: false, message: err instanceof Error ? err.message : "Failed to load emails" }
+    return { ok: false, message: err instanceof Error ? err.message : "Failed to fetch email" }
   }
 }
 
 export async function deleteInboxEmail(
   workspaceId: string,
-  messageId: string,
-  creds: InboxCredentials
+  messageId: string
 ): Promise<{ ok: true } | { ok: false; message?: string }> {
   try {
     const res = await apiFetch(`/api/v1/workspaces/${workspaceId}/inbox/emails/${messageId}`, {
       method: "DELETE",
-      headers: inboxAuthHeaders(creds),
     })
     if (!res.ok) {
       return { ok: false, message: "Failed to delete email message" }
@@ -97,15 +106,10 @@ export async function deleteInboxEmail(
   }
 }
 
-export function buildInboxEventsUrl(
-  workspaceId: string,
-  creds: InboxCredentials
-): string {
+export function buildInboxEventsUrl(workspaceId: string): string {
   const token = getToken()
   const params = new URLSearchParams({
     access_token: token ?? "",
-    client_id: creds.clientId,
-    client_secret: creds.clientSecret,
   })
   return `/api/v1/workspaces/${workspaceId}/inbox/events?${params.toString()}`
 }
diff --git a/frontend/src/features/inbox/inbox.types.ts b/frontend/src/features/inbox/inbox.types.ts
index 215e3810..c282cf1d 100644
--- a/frontend/src/features/inbox/inbox.types.ts
+++ b/frontend/src/features/inbox/inbox.types.ts
@@ -12,8 +12,10 @@ export type LogRow = {
   request_id?: string
   duration_ms?: number
   error_message?: string
+  inbox_message_id?: string
   created_at: string
   source_name?: string
+  client_id?: string
 }
 
 export interface StoredEmail {
@@ -35,9 +37,10 @@ export interface StoredEmail {
   }
 }
 
-export type InboxCredentials = {
-  clientId: string
-  clientSecret: string
+export type InboxEmailPage = {
+  items: StoredEmail[]
+  next_cursor?: string
+  has_more: boolean
 }
 
 export type EmailTemplate = {
diff --git a/frontend/src/features/inbox/log-display.utils.test.ts b/frontend/src/features/inbox/log-display.utils.test.ts
new file mode 100644
index 00000000..a6c16256
--- /dev/null
+++ b/frontend/src/features/inbox/log-display.utils.test.ts
@@ -0,0 +1,46 @@
+import { describe, expect, it } from "vitest"
+
+import type { LogRow } from "./inbox.types"
+import { hasInboxContent, isEmailInboxLink } from "./log-display.utils"
+
+const baseLog: LogRow = {
+  id: "log-1",
+  workspace_id: "ws-1",
+  channel_type: "email",
+  http_method: "POST",
+  status_code: 200,
+  endpoint: "/v1/email",
+  created_at: "2026-01-01T00:00:00Z",
+}
+
+describe("hasInboxContent", () => {
+  it("returns true when inbox_message_id is present", () => {
+    expect(hasInboxContent({ ...baseLog, inbox_message_id: "msg-1" })).toBe(true)
+  })
+
+  it("returns false when inbox_message_id is missing", () => {
+    expect(hasInboxContent(baseLog)).toBe(false)
+  })
+})
+
+describe("isEmailInboxLink", () => {
+  it("returns true for email logs with inbox content", () => {
+    expect(isEmailInboxLink({ ...baseLog, inbox_message_id: "msg-1" })).toBe(true)
+  })
+
+  it("returns false for non-email channels", () => {
+    expect(isEmailInboxLink({ ...baseLog, channel_type: "sms", inbox_message_id: "msg-1" })).toBe(
+      false,
+    )
+  })
+
+  it("returns false for email logs without inbox content", () => {
+    expect(isEmailInboxLink(baseLog)).toBe(false)
+  })
+
+  it("matches email channel type case-insensitively", () => {
+    expect(isEmailInboxLink({ ...baseLog, channel_type: "EMAIL", inbox_message_id: "msg-1" })).toBe(
+      true,
+    )
+  })
+})
diff --git a/frontend/src/features/inbox/log-display.utils.ts b/frontend/src/features/inbox/log-display.utils.ts
new file mode 100644
index 00000000..43e6947e
--- /dev/null
+++ b/frontend/src/features/inbox/log-display.utils.ts
@@ -0,0 +1,9 @@
+import type { LogRow } from "./inbox.types"
+
+export function hasInboxContent(log: LogRow) {
+  return Boolean(log.inbox_message_id)
+}
+
+export function isEmailInboxLink(log: LogRow) {
+  return log.channel_type.toLowerCase() === "email" && hasInboxContent(log)
+}
diff --git a/frontend/src/features/inbox/logs.schema.ts b/frontend/src/features/inbox/logs.schema.ts
new file mode 100644
index 00000000..e428396a
--- /dev/null
+++ b/frontend/src/features/inbox/logs.schema.ts
@@ -0,0 +1,36 @@
+import { z } from "zod"
+
+import type { LogRow } from "./inbox.types"
+
+const logRowSchema = z.object({
+  id: z.string(),
+  workspace_id: z.string(),
+  api_key_id: z.string().optional(),
+  channel_type: z.string(),
+  http_method: z.string(),
+  status_code: z.number(),
+  endpoint: z.string(),
+  provider_name: z.string().optional(),
+  request_id: z.string().optional(),
+  duration_ms: z.number().optional(),
+  error_message: z.string().optional(),
+  inbox_message_id: z.string().optional(),
+  created_at: z.string(),
+  source_name: z.string().optional(),
+  client_id: z.string().optional(),
+})
+
+const logsResponseSchema = z.object({
+  items: z.array(logRowSchema),
+  total: z.number(),
+})
+
+export function parseLogsResponse(
+  raw: unknown,
+): { ok: true; items: LogRow[]; total: number } | { ok: false; message: string } {
+  const parsed = logsResponseSchema.safeParse(raw)
+  if (!parsed.success) {
+    return { ok: false, message: "Invalid logs response from server" }
+  }
+  return { ok: true, items: parsed.data.items, total: parsed.data.total }
+}
diff --git a/frontend/src/features/inbox/pages/email-inbox.page.test.tsx b/frontend/src/features/inbox/pages/email-inbox.page.test.tsx
new file mode 100644
index 00000000..4ff5d57c
--- /dev/null
+++ b/frontend/src/features/inbox/pages/email-inbox.page.test.tsx
@@ -0,0 +1,103 @@
+import { render, screen } from "@testing-library/react"
+import { MemoryRouter, Route, Routes } from "react-router-dom"
+import { describe, expect, it, vi } from "vitest"
+
+import { useInboxEmails } from "../hooks/use-inbox-emails.hook"
+import { EmailInboxPage } from "./email-inbox.page"
+
+vi.mock("../hooks/use-inbox-emails.hook", () => ({
+  useInboxEmails: vi.fn(),
+}))
+
+const mockedUseInboxEmails = vi.mocked(useInboxEmails)
+
+const sampleEmail = {
+  id: "email-1",
+  workspace_id: "ws-1",
+  channel: "email",
+  status: "delivered",
+  created_at: "2026-01-01T00:00:00Z",
+  email: {
+    to: ["a@b.com"],
+    subject: "Hello",
+    html: "<p>hi</p>",
+  },
+}
+
+function renderPage() {
+  return render(
+    <MemoryRouter initialEntries={["/workspaces/ws-1/inbox/email"]}>
+      <Routes>
+        <Route path="/workspaces/:wid/inbox/email" element={<EmailInboxPage />} />
+      </Routes>
+    </MemoryRouter>,
+  )
+}
+
+describe("EmailInboxPage", () => {
+  it("shows loading state while emails load", () => {
+    mockedUseInboxEmails.mockReturnValue({
+      messages: [],
+      selectedMessageId: null,
+      setSelectedMessageId: vi.fn(),
+      isLoading: true,
+      isLoadingMore: false,
+      error: null,
+      nextCursor: undefined,
+      hasMore: false,
+      reload: vi.fn(),
+      loadMore: vi.fn(),
+      upsertMessage: vi.fn(),
+      removeMessage: vi.fn(),
+      clearMessages: vi.fn(),
+    })
+
+    renderPage()
+
+    expect(screen.getByText(/loading simulated inbox/i)).toBeInTheDocument()
+  })
+
+  it("renders email list when messages are available", () => {
+    mockedUseInboxEmails.mockReturnValue({
+      messages: [sampleEmail],
+      selectedMessageId: "email-1",
+      setSelectedMessageId: vi.fn(),
+      isLoading: false,
+      isLoadingMore: false,
+      error: null,
+      nextCursor: undefined,
+      hasMore: false,
+      reload: vi.fn(),
+      loadMore: vi.fn(),
+      upsertMessage: vi.fn(),
+      removeMessage: vi.fn(),
+      clearMessages: vi.fn(),
+    })
+
+    renderPage()
+
+    expect(screen.getAllByText("Hello").length).toBeGreaterThan(0)
+  })
+
+  it("shows error message when hook reports failure", () => {
+    mockedUseInboxEmails.mockReturnValue({
+      messages: [],
+      selectedMessageId: null,
+      setSelectedMessageId: vi.fn(),
+      isLoading: false,
+      isLoadingMore: false,
+      error: "Failed to load emails",
+      nextCursor: undefined,
+      hasMore: false,
+      reload: vi.fn(),
+      loadMore: vi.fn(),
+      upsertMessage: vi.fn(),
+      removeMessage: vi.fn(),
+      clearMessages: vi.fn(),
+    })
+
+    renderPage()
+
+    expect(screen.getByText("Failed to load emails")).toBeInTheDocument()
+  })
+})
diff --git a/frontend/src/features/inbox/pages/email-inbox.page.tsx b/frontend/src/features/inbox/pages/email-inbox.page.tsx
index b5a9a4f1..2807393c 100644
--- a/frontend/src/features/inbox/pages/email-inbox.page.tsx
+++ b/frontend/src/features/inbox/pages/email-inbox.page.tsx
@@ -1,71 +1,90 @@
-import { useEffect, useState, useCallback } from "react"
-import { useNavigate, useParams } from "react-router-dom"
+import { useEffect, useState } from "react"
+import { useNavigate, useParams, useSearchParams } from "react-router-dom"
 
 import { Button } from "@/components/ui/button"
 import { Icon } from "@/components/ui/icon"
 import { Spinner } from "@/components/ui/spinner"
 import { ROUTES } from "@/core/router/routes"
-import { buildInboxEventsUrl, deleteInboxEmail, fetchInboxEmails } from "../inbox.api"
-import { useInboxKey } from "../hooks/use-inbox-key.hook"
+import {
+  buildInboxEventsUrl,
+  deleteInboxEmail,
+  fetchInboxEmailById,
+} from "../inbox.api"
 import { EmailList } from "../components/email-list"
 import { EmailContent } from "../components/email-content"
-import type { StoredEmail } from "../inbox.types"
+import { useInboxEmails } from "../hooks/use-inbox-emails.hook"
 
 export function EmailInboxPage() {
   const navigate = useNavigate()
   const { wid } = useParams<{ wid: string }>()
-  const { creds, isLoading: credsLoading, error: credsError } = useInboxKey(wid)
-
-  const [messages, setMessages] = useState<StoredEmail[]>([])
-  const [selectedMessageId, setSelectedMessageId] = useState<string | null>(null)
-  const [isLoading, setIsLoading] = useState(true)
+  const [searchParams, setSearchParams] = useSearchParams()
+  const deepLinkMessageId = searchParams.get("message")
   const [isDeleting, setIsDeleting] = useState(false)
-  const [error, setError] = useState<string | null>(null)
-
-  const fetchEmails = useCallback(async () => {
-    if (!wid || !creds) return
-    await Promise.resolve()
-    setError(null)
-
-    const result = await fetchInboxEmails(wid, creds)
-    if (!result.ok) {
-      setError(result.message ?? "Failed to load emails")
-      setIsLoading(false)
-      return
-    }
 
-    setMessages(result.items)
-    if (result.items.length > 0) {
-      setSelectedMessageId((prev) => prev ?? result.items[0].id)
-    }
-    setIsLoading(false)
-  }, [wid, creds])
+  const {
+    messages,
+    selectedMessageId,
+    setSelectedMessageId,
+    isLoading,
+    isLoadingMore,
+    error,
+    hasMore,
+    reload,
+    loadMore,
+    upsertMessage,
+    removeMessage,
+    clearMessages,
+  } = useInboxEmails(wid)
 
   useEffect(() => {
-    if (creds) {
-      Promise.resolve().then(() => {
-        void fetchEmails()
-      })
-    }
-  }, [creds, fetchEmails])
+    if (!deepLinkMessageId) return
+
+    setSelectedMessageId(deepLinkMessageId)
+    setSearchParams((params) => {
+      const next = new URLSearchParams(params)
+      next.delete("message")
+      return next
+    }, { replace: true })
+  }, [deepLinkMessageId, setSearchParams, setSelectedMessageId])
 
   useEffect(() => {
-    if (!wid || !creds) return
+    if (!wid) return
 
-    const sseUrl = buildInboxEventsUrl(wid, creds)
+    const sseUrl = buildInboxEventsUrl(wid)
     let eventSource: EventSource | null = null
     try {
       eventSource = new EventSource(sseUrl)
 
       eventSource.onmessage = (event) => {
         try {
-          const parsed = JSON.parse(event.data) as { type: string }
-          if (
-            parsed.type === "email_received" ||
-            parsed.type === "email_deleted" ||
-            parsed.type === "messages_cleared"
-          ) {
-            void fetchEmails()
+          const parsed = JSON.parse(event.data) as {
+            type: string
+            data?: { id?: string } | string | null
+          }
+
+          if (parsed.type === "email_received") {
+            const id =
+              typeof parsed.data === "object" && parsed.data !== null
+                ? parsed.data.id
+                : undefined
+            if (!id) return
+            void fetchInboxEmailById(wid, id).then((result) => {
+              if (!result.ok) return
+              upsertMessage(result.item)
+              setSelectedMessageId((current) => current ?? id)
+            })
+            return
+          }
+
+          if (parsed.type === "email_deleted") {
+            const id = typeof parsed.data === "string" ? parsed.data : undefined
+            if (!id) return
+            removeMessage(id)
+            return
+          }
+
+          if (parsed.type === "messages_cleared") {
+            clearMessages()
           }
         } catch (err) {
           console.error("Failed to parse SSE event data:", err)
@@ -78,28 +97,19 @@ export function EmailInboxPage() {
     return () => {
       eventSource?.close()
     }
-  }, [wid, creds, fetchEmails])
+  }, [wid, upsertMessage, removeMessage, clearMessages, setSelectedMessageId])
 
   const handleDeleteMessage = async (messageId: string) => {
-    if (!wid || !creds) return
+    if (!wid) return
     setIsDeleting(true)
-    const result = await deleteInboxEmail(wid, messageId, creds)
+    const result = await deleteInboxEmail(wid, messageId)
     if (!result.ok) {
       alert(result.message ?? "Failed to delete email")
       setIsDeleting(false)
       return
     }
 
-    setMessages((prev) => {
-      const remaining = prev.filter((m) => m.id !== messageId)
-      setSelectedMessageId((current) => {
-        if (current === messageId) {
-          return remaining.length > 0 ? remaining[0].id : null
-        }
-        return current
-      })
-      return remaining
-    })
+    removeMessage(messageId)
     setIsDeleting(false)
   }
 
@@ -109,8 +119,8 @@ export function EmailInboxPage() {
     }
   }
 
-  const activeMessage = messages.find((m) => m.id === selectedMessageId) || null
-  const isBootstrapLoading = credsLoading || (isLoading && !!creds)
+  const activeMessage = messages.find((m) => m.id === selectedMessageId) ?? null
+  const showLoading = Boolean(wid) && isLoading
 
   return (
     <div className="flex flex-col gap-6 w-full h-[calc(100vh-160px)] min-h-[500px]">
@@ -120,13 +130,13 @@ export function EmailInboxPage() {
             Email Inbox
           </h1>
           <p className="text-sm text-text-secondary">
-            Read and test outbound emails captured by the memory provider.
+            Outbound emails captured by the gateway for review and testing.
           </p>
         </div>
 
         <div className="flex items-center gap-2.5 shrink-0">
-          <Button type="button" variant="outline" size="sm" onClick={() => void fetchEmails()} disabled={isBootstrapLoading} className="h-10">
-            <Icon name="refresh" size="sm" data-icon="inline-start" className={isBootstrapLoading ? "animate-spin" : undefined} />
+          <Button type="button" variant="outline" size="sm" onClick={() => void reload()} disabled={showLoading} className="h-10">
+            <Icon name="refresh" size="sm" data-icon="inline-start" className={showLoading ? "animate-spin" : undefined} />
             Refresh
           </Button>
           <Button type="button" size="sm" onClick={handleManageTemplates} className="h-10">
@@ -136,20 +146,20 @@ export function EmailInboxPage() {
         </div>
       </div>
 
-      {credsError || error ? (
+      {error ? (
         <div className="flex-1 bg-card border border-border rounded-2xl flex flex-col items-center justify-center p-6 text-center">
           <span className="text-sm font-semibold text-foreground">Could not connect to Simulated Inbox</span>
           <p className="text-xs text-text-secondary max-w-sm mt-1 mb-4">
-            {credsError || error}
+            {error}
           </p>
-          <Button variant="outline" size="sm" onClick={() => void fetchEmails()}>
+          <Button variant="outline" size="sm" onClick={() => void reload()}>
             Try again
           </Button>
         </div>
-      ) : isBootstrapLoading ? (
+      ) : showLoading ? (
         <div className="flex-1 bg-card border border-border rounded-2xl flex flex-col items-center justify-center gap-3">
           <Spinner size="lg" />
-          <span className="text-sm text-text-secondary">Connecting to secure simulated inbox...</span>
+          <span className="text-sm text-text-secondary">Loading simulated inbox...</span>
         </div>
       ) : messages.length === 0 ? (
         <div className="flex-1 bg-card border border-border rounded-2xl flex flex-col items-center justify-center p-8 text-center">
@@ -158,7 +168,7 @@ export function EmailInboxPage() {
           </div>
           <h3 className="mb-1 text-lg font-bold text-foreground">Inbox is empty</h3>
           <p className="max-w-xs text-sm text-text-secondary">
-            Send an email to `/v1/email` using this workspace API key to see it captured here in real-time.
+            POST to `/v1/email` with your API key to see captured messages here in real-time.
           </p>
         </div>
       ) : (
@@ -167,6 +177,9 @@ export function EmailInboxPage() {
             messages={messages}
             selectedMessageId={selectedMessageId}
             onSelectMessage={setSelectedMessageId}
+            hasMore={hasMore}
+            isLoadingMore={isLoadingMore}
+            onLoadMore={() => void loadMore()}
           />
           {activeMessage ? (
             <EmailContent
diff --git a/frontend/src/features/inbox/pages/email-templates.page.test.tsx b/frontend/src/features/inbox/pages/email-templates.page.test.tsx
new file mode 100644
index 00000000..9495fa95
--- /dev/null
+++ b/frontend/src/features/inbox/pages/email-templates.page.test.tsx
@@ -0,0 +1,63 @@
+import { render, screen, waitFor } from "@testing-library/react"
+import { MemoryRouter, Route, Routes } from "react-router-dom"
+import { describe, expect, it, vi } from "vitest"
+
+import { fetchEmailTemplates } from "../inbox.api"
+import { EmailTemplatesPage } from "./email-templates.page"
+
+vi.mock("../inbox.api", () => ({
+  fetchEmailTemplates: vi.fn(),
+  createEmailTemplate: vi.fn(),
+  deleteEmailTemplate: vi.fn(),
+}))
+
+const mockedFetchTemplates = vi.mocked(fetchEmailTemplates)
+
+function renderPage() {
+  return render(
+    <MemoryRouter initialEntries={["/workspaces/ws-1/inbox/templates"]}>
+      <Routes>
+        <Route path="/workspaces/:wid/inbox/templates" element={<EmailTemplatesPage />} />
+      </Routes>
+    </MemoryRouter>,
+  )
+}
+
+describe("EmailTemplatesPage", () => {
+  it("shows loading state", () => {
+    mockedFetchTemplates.mockReturnValue(new Promise(() => {}))
+
+    renderPage()
+
+    expect(screen.getByText(/loading assets/i)).toBeInTheDocument()
+  })
+
+  it("renders template table rows", async () => {
+    mockedFetchTemplates.mockResolvedValue({
+      ok: true,
+      items: [
+        {
+          id: "tpl-1",
+          workspace_id: "ws-1",
+          name: "Welcome",
+          unique_key: "welcome",
+          channel_type: "email",
+          category: "transactional",
+          subject: "Welcome!",
+          content_html: "<p>Hi</p>",
+          is_active: true,
+          is_default: false,
+          created_at: "2026-01-01T00:00:00Z",
+          updated_at: "2026-01-01T00:00:00Z",
+        },
+      ],
+    })
+
+    renderPage()
+
+    await waitFor(() => {
+      expect(screen.getByText("Welcome")).toBeInTheDocument()
+    })
+    expect(screen.getByText("welcome")).toBeInTheDocument()
+  })
+})
diff --git a/frontend/src/features/inbox/pages/overview.page.test.tsx b/frontend/src/features/inbox/pages/overview.page.test.tsx
new file mode 100644
index 00000000..11430139
--- /dev/null
+++ b/frontend/src/features/inbox/pages/overview.page.test.tsx
@@ -0,0 +1,66 @@
+import { render, screen } from "@testing-library/react"
+import { MemoryRouter, Route, Routes } from "react-router-dom"
+import { describe, expect, it, vi } from "vitest"
+
+import { useInboxLogs } from "../hooks/use-inbox-logs.hook"
+import { OverviewPage } from "./overview.page"
+
+vi.mock("../hooks/use-inbox-logs.hook", () => ({
+  useInboxLogs: vi.fn(),
+}))
+
+const mockedUseInboxLogs = vi.mocked(useInboxLogs)
+
+function renderPage() {
+  return render(
+    <MemoryRouter initialEntries={["/workspaces/ws-1/overview"]}>
+      <Routes>
+        <Route path="/workspaces/:wid/overview" element={<OverviewPage />} />
+      </Routes>
+    </MemoryRouter>,
+  )
+}
+
+describe("OverviewPage", () => {
+  it("shows loading state", () => {
+    mockedUseInboxLogs.mockReturnValue({
+      logs: [],
+      total: 0,
+      isLoading: true,
+      error: null,
+      reload: vi.fn(),
+    })
+
+    renderPage()
+
+    expect(screen.getByText(/loading request logs/i)).toBeInTheDocument()
+  })
+
+  it("renders log rows", () => {
+    mockedUseInboxLogs.mockReturnValue({
+      logs: [
+        {
+          id: "log-1",
+          workspace_id: "ws-1",
+          channel_type: "email",
+          http_method: "POST",
+          status_code: 200,
+          endpoint: "/v1/email",
+          provider_name: "memory",
+          created_at: "2026-07-04T10:00:00Z",
+          source_name: "Demo Key",
+          client_id: "client-1",
+        },
+      ],
+      total: 1,
+      isLoading: false,
+      error: null,
+      reload: vi.fn(),
+    })
+
+    renderPage()
+
+    expect(screen.getByText("/v1/email")).toBeInTheDocument()
+    expect(screen.getByText("200")).toBeInTheDocument()
+  })
+})
diff --git a/frontend/src/features/inbox/pages/overview.page.tsx b/frontend/src/features/inbox/pages/overview.page.tsx
index c71508e8..ee14c872 100644
--- a/frontend/src/features/inbox/pages/overview.page.tsx
+++ b/frontend/src/features/inbox/pages/overview.page.tsx
@@ -1,20 +1,14 @@
 import { useState } from "react"
-import { useParams } from "react-router-dom"
+import { useNavigate, useParams } from "react-router-dom"
 
 import { Button } from "@/components/ui/button"
 import { Icon } from "@/components/ui/icon"
 import { SearchInput } from "@/components/ui/search-input"
-import {
-  Dialog,
-  DialogContent,
-  DialogDescription,
-  DialogFooter,
-  DialogHeader,
-  DialogTitle,
-} from "@/components/ui/dialog"
-import { SendTestModal } from "../components/send-test-modal"
+import { ROUTES } from "@/core/router/routes"
+import { GetStartedDialog } from "../components/get-started-dialog"
 import { useInboxLogs } from "../hooks/use-inbox-logs.hook"
 import type { MessageChannel, LogRow } from "../inbox.types"
+import { hasInboxContent, isEmailInboxLink } from "../log-display.utils"
 import { PageHeader } from "@/shared/components/page-header"
 
 interface OverviewPageProps {
@@ -79,24 +73,30 @@ function groupLogsByDate(logs: LogRow[]) {
 }
 
 export function OverviewPage({ channel }: OverviewPageProps) {
+  const navigate = useNavigate()
   const { wid } = useParams<{ wid: string }>()
   const { logs, total, isLoading, error, reload } = useInboxLogs(wid, channel)
-  const [isTestModalOpen, setIsTestModalOpen] = useState(false)
-  const [isDocsOpen, setIsDocsOpen] = useState(false)
+  const [isGetStartedOpen, setIsGetStartedOpen] = useState(false)
   const [searchQuery, setSearchQuery] = useState("")
 
   const filteredLogs = logs.filter((log) => {
     const q = searchQuery.toLowerCase()
     return (
-      log.endpoint.toLowerCase().includes(q) ||
-      log.http_method.toLowerCase().includes(q) ||
-      String(log.status_code).includes(q) ||
-      (log.source_name && log.source_name.toLowerCase().includes(q))
+      (log.endpoint ?? "").toLowerCase().includes(q) ||
+      (log.http_method ?? "").toLowerCase().includes(q) ||
+      String(log.status_code ?? "").includes(q) ||
+      (log.source_name ?? "").toLowerCase().includes(q) ||
+      (log.provider_name ?? "").toLowerCase().includes(q)
     )
   })
 
   const dateGroups = groupLogsByDate(filteredLogs)
 
+  const handleLogClick = (log: LogRow) => {
+    if (!wid || !isEmailInboxLink(log) || !log.inbox_message_id) return
+    navigate(ROUTES.workspace.emailWithMessage(wid, log.inbox_message_id))
+  }
+
   return (
     <div className="flex flex-col gap-6 w-full">
       <div className="flex flex-col gap-4 sm:flex-row sm:items-start sm:justify-between">
@@ -118,9 +118,9 @@ export function OverviewPage({ channel }: OverviewPageProps) {
             Refresh
           </Button>
 
-          <Button type="button" size="sm" onClick={() => setIsTestModalOpen(true)} className="h-10">
-            <Icon name="send" size="sm" data-icon="inline-start" />
-            Send test request
+          <Button type="button" size="sm" onClick={() => setIsGetStartedOpen(true)} className="h-10">
+            <Icon name="code" size="sm" data-icon="inline-start" />
+            Get started
           </Button>
         </div>
       </div>
@@ -129,10 +129,12 @@ export function OverviewPage({ channel }: OverviewPageProps) {
         <div className="grid grid-cols-12 bg-muted/30 px-6 py-3 border-b border-border text-xs font-semibold uppercase tracking-wider text-text-secondary">
           <div className="col-span-2">Time</div>
           <div className="col-span-2">Channel</div>
-          <div className="col-span-3">Source</div>
+          <div className="col-span-2">Source</div>
           <div className="col-span-1">Method</div>
           <div className="col-span-1">Status</div>
-          <div className="col-span-3">Endpoint</div>
+          <div className="col-span-1">Provider</div>
+          <div className="col-span-1">Retained</div>
+          <div className="col-span-2">Endpoint</div>
         </div>
 
         {isLoading && logs.length === 0 ? (
@@ -155,17 +157,12 @@ export function OverviewPage({ channel }: OverviewPageProps) {
             </div>
             <h3 className="mb-1 text-lg font-bold text-foreground">No requests yet</h3>
             <p className="mb-6 max-w-xs text-sm text-text-secondary">
-              Send your first test request to see gateway logs here.
+              Send your first request via the gateway API to see logs here.
             </p>
-            <div className="flex gap-3 justify-center">
-              <Button type="button" onClick={() => setIsTestModalOpen(true)}>
-                <Icon name="send" size="sm" data-icon="inline-start" />
-                Send test request
-              </Button>
-              <Button type="button" variant="outline" onClick={() => setIsDocsOpen(true)}>
-                View API Docs
-              </Button>
-            </div>
+            <Button type="button" onClick={() => setIsGetStartedOpen(true)}>
+              <Icon name="code" size="sm" data-icon="inline-start" />
+              Get started
+            </Button>
           </div>
         ) : filteredLogs.length === 0 ? (
           <div className="flex flex-col items-center justify-center py-20 text-sm text-text-tertiary">
@@ -180,43 +177,72 @@ export function OverviewPage({ channel }: OverviewPageProps) {
                 </div>
 
                 <div className="divide-y divide-border">
-                  {group.logs.map((log) => (
-                    <div
-                      key={log.id}
-                      className="grid grid-cols-12 items-center px-6 py-3.5 text-sm transition-colors hover:bg-muted/10"
-                    >
-                      <div className="col-span-2 font-medium text-text-secondary">
-                        {formatTime(log.created_at)}
-                      </div>
+                  {group.logs.map((log) => {
+                    const clickable = isEmailInboxLink(log)
+                    return (
+                      <div
+                        key={log.id}
+                        role={clickable ? "button" : undefined}
+                        tabIndex={clickable ? 0 : undefined}
+                        onClick={() => handleLogClick(log)}
+                        onKeyDown={(e) => {
+                          if (!clickable) return
+                          if (e.key === "Enter" || e.key === " ") {
+                            e.preventDefault()
+                            handleLogClick(log)
+                          }
+                        }}
+                        className={`grid grid-cols-12 items-center px-6 py-3.5 text-sm transition-colors hover:bg-muted/10 ${
+                          clickable ? "cursor-pointer hover:bg-primary-brand/5" : ""
+                        }`}
+                      >
+                        <div className="col-span-2 font-medium text-text-secondary">
+                          {formatTime(log.created_at)}
+                        </div>
 
-                      <div className="col-span-2 flex items-center gap-2">
-                        <div className="bg-secondary rounded-md size-7 flex items-center justify-center border border-border shrink-0">
-                          <Icon name={getChannelIconName(log.channel_type)} size="sm" className="text-text-secondary" />
+                        <div className="col-span-2 flex items-center gap-2">
+                          <div className="bg-secondary rounded-md size-7 flex items-center justify-center border border-border shrink-0">
+                            <Icon name={getChannelIconName(log.channel_type)} size="sm" className="text-text-secondary" />
+                          </div>
+                          <span className="font-medium capitalize text-foreground">{log.channel_type}</span>
                         </div>
-                        <span className="font-medium capitalize text-foreground">{log.channel_type}</span>
-                      </div>
 
-                      <div className="col-span-3 text-text-secondary truncate pr-4 font-medium" title={log.source_name || "API Request"}>
-                        {log.source_name || "API Request"}
-                      </div>
+                        <div className="col-span-2 text-text-secondary truncate pr-4 font-medium" title={log.source_name || "API Request"}>
+                          {log.source_name || "API Request"}
+                        </div>
 
-                      <div className="col-span-1">
-                        <span className="font-mono text-xs font-bold text-foreground">
-                          {log.http_method || "POST"}
-                        </span>
-                      </div>
+                        <div className="col-span-1">
+                          <span className="font-mono text-xs font-bold text-foreground">
+                            {log.http_method || "POST"}
+                          </span>
+                        </div>
 
-                      <div className="col-span-1">
-                        <span className={`rounded-full px-2.5 py-0.5 text-xs font-mono ${getStatusStyle(log.status_code)}`}>
-                          {log.status_code}
-                        </span>
-                      </div>
+                        <div className="col-span-1">
+                          <span className={`rounded-full px-2.5 py-0.5 text-xs font-mono ${getStatusStyle(log.status_code)}`}>
+                            {log.status_code}
+                          </span>
+                        </div>
 
-                      <div className="col-span-3 truncate font-mono text-xs text-text-tertiary pr-2" title={log.endpoint}>
-                        {log.endpoint || `/v1/${log.channel_type}`}
+                        <div className="col-span-1 truncate text-xs font-medium text-foreground" title={log.provider_name}>
+                          {log.provider_name || "—"}
+                        </div>
+
+                        <div className="col-span-1">
+                          {hasInboxContent(log) ? (
+                            <span className="rounded-full bg-emerald-500/10 px-2 py-0.5 text-xs font-semibold text-emerald-600 dark:text-emerald-400">
+                              Yes
+                            </span>
+                          ) : (
+                            <span className="text-xs text-text-tertiary">No</span>
+                          )}
+                        </div>
+
+                        <div className="col-span-2 truncate font-mono text-xs text-text-tertiary pr-2" title={log.endpoint}>
+                          {log.endpoint || `/v1/${log.channel_type}`}
+                        </div>
                       </div>
-                    </div>
-                  ))}
+                    )
+                  })}
                 </div>
               </div>
             ))}
@@ -233,44 +259,7 @@ export function OverviewPage({ channel }: OverviewPageProps) {
         </div>
       )}
 
-      {wid && (
-        <SendTestModal
-          workspaceId={wid}
-          open={isTestModalOpen}
-          onOpenChange={setIsTestModalOpen}
-          onSent={() => void reload()}
-          initialChannel={channel}
-        />
-      )}
-
-      <Dialog open={isDocsOpen} onOpenChange={setIsDocsOpen}>
-        <DialogContent className="max-h-[85vh] max-w-lg gap-0 overflow-hidden p-0">
-          <DialogHeader className="border-b bg-muted/20 px-5 py-4 text-left">
-            <DialogTitle>API Reference</DialogTitle>
-            <DialogDescription>Integrate Message Gateway into your codebase.</DialogDescription>
-          </DialogHeader>
-          <div className="flex flex-col gap-4 overflow-y-auto p-6 text-sm text-foreground">
-            <p className="text-xs leading-relaxed text-text-secondary">
-              Attach workspace API credentials to each request. See backend usage docs for full reference.
-            </p>
-            <div className="flex flex-col gap-3">
-              <div>
-                <h4 className="mb-1 text-xs font-bold uppercase text-text-secondary">Email</h4>
-                <pre className="rounded-md border bg-muted/80 p-2.5 font-mono text-xs">{`POST /v1/email`}</pre>
-              </div>
-              <div>
-                <h4 className="mb-1 text-xs font-bold uppercase text-text-secondary">SMS</h4>
-                <pre className="rounded-md border bg-muted/80 p-2.5 font-mono text-xs">{`POST /v1/sms`}</pre>
-              </div>
-            </div>
-          </div>
-          <DialogFooter className="border-t bg-muted/20 px-5 py-4">
-            <Button type="button" onClick={() => setIsDocsOpen(false)}>
-              Close
-            </Button>
-          </DialogFooter>
-        </DialogContent>
-      </Dialog>
+      <GetStartedDialog open={isGetStartedOpen} onOpenChange={setIsGetStartedOpen} workspaceId={wid} />
     </div>
   )
 }
diff --git a/frontend/src/features/integrations/components/connect-modal/connect-modal.test.tsx b/frontend/src/features/integrations/components/connect-modal/connect-modal.test.tsx
new file mode 100644
index 00000000..8cce4835
--- /dev/null
+++ b/frontend/src/features/integrations/components/connect-modal/connect-modal.test.tsx
@@ -0,0 +1,68 @@
+import { render, screen, waitFor } from "@testing-library/react"
+import userEvent from "@testing-library/user-event"
+import { describe, expect, it, vi } from "vitest"
+
+import { ConnectModal } from "./connect-modal"
+
+const mailgunProvider = {
+  id: "mailgun",
+  name: "Mailgun",
+  description: "Reliable transactional email sending service.",
+  icon: "📧",
+  category: "email" as const,
+  isAvailable: true,
+  isConnected: false,
+  isDeactivated: false,
+}
+
+const mockFields = [
+  {
+    id: "f1",
+    provider_id: "mailgun",
+    key: "api_key",
+    label: "API Key",
+    description: "Your Mailgun Private API Key",
+    field_type: "password",
+    required: true,
+    default_value: "",
+    sort_order: 1,
+  },
+]
+
+describe("ConnectModal", () => {
+  it("loads config fields and submits connection", async () => {
+    const user = userEvent.setup()
+    const onConnect = vi.fn().mockResolvedValue({ ok: true })
+    const onClose = vi.fn()
+
+    vi.spyOn(globalThis, "fetch").mockResolvedValue({
+      ok: true,
+      status: 200,
+      json: async () => mockFields,
+    } as Response)
+
+    render(
+      <ConnectModal
+        isOpen
+        onClose={onClose}
+        workspaceId="demo-wid"
+        provider={mailgunProvider}
+        onConnect={onConnect}
+      />,
+    )
+
+    expect(screen.getByText(/loading configuration/i)).toBeInTheDocument()
+
+    await waitFor(() => {
+      expect(screen.getByLabelText(/api key/i)).toBeInTheDocument()
+    })
+
+    await user.type(screen.getByLabelText(/api key/i), "secret-key")
+    await user.click(screen.getByRole("button", { name: /^connect$/i }))
+
+    await waitFor(() => {
+      expect(onConnect).toHaveBeenCalledWith(mailgunProvider, { api_key: "secret-key" })
+      expect(onClose).toHaveBeenCalledTimes(1)
+    })
+  })
+})
diff --git a/frontend/src/features/integrations/components/connect-modal/connect-modal.tsx b/frontend/src/features/integrations/components/connect-modal/connect-modal.tsx
index cbeaa395..7170e298 100644
--- a/frontend/src/features/integrations/components/connect-modal/connect-modal.tsx
+++ b/frontend/src/features/integrations/components/connect-modal/connect-modal.tsx
@@ -1,13 +1,13 @@
 import type React from "react"
-import { useEffect, useState } from "react"
+import { useState } from "react"
 
 import { Button } from "@/components/ui/button"
 import { Input } from "@/components/ui/input"
 import { Modal } from "@/components/ui/modal"
 import { Spinner } from "@/components/ui/spinner"
 
-import type { IntegrationViewModel } from "@/features/integrations/hooks/use-integrations.hook"
-import { fetchProviderConfigFields, type ProviderConfigField } from "@/features/integrations/integrations.api"
+import { useProviderConfigFields } from "@/features/integrations/hooks/use-provider-config-fields.hook"
+import type { IntegrationViewModel } from "@/features/integrations/integrations.types"
 import type { IntegrationActionResult } from "@/features/integrations/integrations.types"
 
 interface ConnectModalProps {
@@ -47,40 +47,13 @@ interface ConnectFormProps {
 }
 
 function ConnectForm({ workspaceId, provider, onConnect, onClose }: ConnectFormProps) {
-  const [fields, setFields] = useState<ProviderConfigField[]>([])
-  const [isLoading, setIsLoading] = useState(false)
-  const [error, setError] = useState<string | null>(null)
-  const [formData, setFormData] = useState<Record<string, string>>({})
+  const { fields, formData, isLoading, error, updateField, setError } = useProviderConfigFields(
+    workspaceId,
+    provider.id,
+    true,
+  )
   const [isSubmitting, setIsSubmitting] = useState(false)
 
-  useEffect(() => {
-    const loadFields = async () => {
-      setIsLoading(true)
-      setError(null)
-      try {
-        const result = await fetchProviderConfigFields(workspaceId, provider.id)
-        setFields(result)
-
-        const defaults: Record<string, string> = {}
-        result.forEach((field) => {
-          defaults[field.key] = field.default_value || ""
-        })
-        setFormData(defaults)
-      } catch (err) {
-        setError(err instanceof Error ? err.message : "Failed to load configuration fields")
-        setFields([])
-      } finally {
-        setIsLoading(false)
-      }
-    }
-
-    void loadFields()
-  }, [workspaceId, provider.id])
-
-  function handleInputChange(key: string, value: string) {
-    setFormData((prev) => ({ ...prev, [key]: value }))
-  }
-
   async function handleSubmit(e: React.FormEvent) {
     e.preventDefault()
     setIsSubmitting(true)
@@ -139,7 +112,7 @@ function ConnectForm({ workspaceId, provider, onConnect, onClose }: ConnectFormP
               type={field.field_type === "password" ? "password" : field.field_type === "email" ? "email" : "text"}
               required={field.required}
               value={formData[field.key] || ""}
-              onChange={(e) => handleInputChange(field.key, e.target.value)}
+              onChange={(e) => updateField(field.key, e.target.value)}
               placeholder={field.description || `Enter ${field.label.toLowerCase()}`}
               className="bg-input"
             />
diff --git a/frontend/src/features/integrations/components/disconnect-modal/disconnect-modal.test.tsx b/frontend/src/features/integrations/components/disconnect-modal/disconnect-modal.test.tsx
new file mode 100644
index 00000000..50eb1e48
--- /dev/null
+++ b/frontend/src/features/integrations/components/disconnect-modal/disconnect-modal.test.tsx
@@ -0,0 +1,67 @@
+import { render, screen } from "@testing-library/react"
+import userEvent from "@testing-library/user-event"
+import { describe, expect, it, vi } from "vitest"
+
+import { INTEGRATION_STATUS } from "@/features/integrations/integrations.types"
+import { DisconnectModal } from "./disconnect-modal"
+
+const connectedMailgun = {
+  id: "mailgun",
+  name: "Mailgun",
+  description: "Reliable transactional email sending service.",
+  icon: "📧",
+  category: "email" as const,
+  isAvailable: true,
+  isConnected: true,
+  isDeactivated: false,
+  integration: {
+    id: "intg-1",
+    workspace_id: "demo-wid",
+    channel_type: "email" as const,
+    provider_name: "mailgun",
+    config: { api_key: "hidden" },
+    status: INTEGRATION_STATUS.CONNECTED,
+    is_default: true,
+    created_at: "2026-01-01T00:00:00Z",
+    updated_at: "2026-01-01T00:00:00Z",
+  },
+}
+
+describe("DisconnectModal", () => {
+  it("renders disconnect actions for connected provider", () => {
+    render(
+      <DisconnectModal
+        isOpen
+        provider={connectedMailgun}
+        onClose={vi.fn()}
+        onDeactivate={vi.fn().mockResolvedValue({ ok: true })}
+        onRemove={vi.fn().mockResolvedValue({ ok: true })}
+      />,
+    )
+
+    expect(screen.getByText(/disconnect mailgun/i)).toBeInTheDocument()
+    expect(screen.getByRole("button", { name: /deactivate/i })).toBeInTheDocument()
+    expect(screen.getByRole("button", { name: /remove integration/i })).toBeInTheDocument()
+  })
+
+  it("calls deactivate handler", async () => {
+    const user = userEvent.setup()
+    const onDeactivate = vi.fn().mockResolvedValue({ ok: true })
+    const onClose = vi.fn()
+
+    render(
+      <DisconnectModal
+        isOpen
+        provider={connectedMailgun}
+        onClose={onClose}
+        onDeactivate={onDeactivate}
+        onRemove={vi.fn().mockResolvedValue({ ok: true })}
+      />,
+    )
+
+    await user.click(screen.getByRole("button", { name: /^deactivate$/i }))
+
+    expect(onDeactivate).toHaveBeenCalledWith(connectedMailgun)
+    expect(onClose).toHaveBeenCalledTimes(1)
+  })
+})
diff --git a/frontend/src/features/integrations/components/disconnect-modal/disconnect-modal.tsx b/frontend/src/features/integrations/components/disconnect-modal/disconnect-modal.tsx
index 158ceac6..4f303dd7 100644
--- a/frontend/src/features/integrations/components/disconnect-modal/disconnect-modal.tsx
+++ b/frontend/src/features/integrations/components/disconnect-modal/disconnect-modal.tsx
@@ -7,7 +7,7 @@ import { Modal } from "@/components/ui/modal"
 import { Spinner } from "@/components/ui/spinner"
 
 import { IntegrationProviderIcon } from "@/features/integrations/components/integration-provider-icon"
-import type { IntegrationViewModel } from "@/features/integrations/hooks/use-integrations.hook"
+import type { IntegrationViewModel } from "@/features/integrations/integrations.types"
 import type { IntegrationActionResult } from "@/features/integrations/integrations.types"
 
 type DisconnectAction = "deactivate" | "remove"
diff --git a/frontend/src/features/integrations/components/integration-provider-icon/integration-provider-icon.test.tsx b/frontend/src/features/integrations/components/integration-provider-icon/integration-provider-icon.test.tsx
new file mode 100644
index 00000000..beab79cf
--- /dev/null
+++ b/frontend/src/features/integrations/components/integration-provider-icon/integration-provider-icon.test.tsx
@@ -0,0 +1,16 @@
+import { render, screen } from "@testing-library/react"
+import { describe, expect, it } from "vitest"
+
+import { IntegrationProviderIcon } from "./integration-provider-icon"
+
+describe("IntegrationProviderIcon", () => {
+  it("renders emoji icon", () => {
+    render(<IntegrationProviderIcon icon="📧" name="Mailgun" className="size-12" />)
+    expect(screen.getByText("📧")).toBeInTheDocument()
+  })
+
+  it("renders image icon with alt text", () => {
+    render(<IntegrationProviderIcon icon="/providers/mailgun.svg" name="Mailgun" className="size-12" />)
+    expect(screen.getByRole("img", { name: "Mailgun logo" })).toHaveAttribute("src", "/providers/mailgun.svg")
+  })
+})
diff --git a/frontend/src/features/integrations/components/integration-row/integration-row.stories.tsx b/frontend/src/features/integrations/components/integration-row/integration-row.stories.tsx
new file mode 100644
index 00000000..1e24a175
--- /dev/null
+++ b/frontend/src/features/integrations/components/integration-row/integration-row.stories.tsx
@@ -0,0 +1,78 @@
+import type { Meta, StoryObj } from "@storybook/react-vite"
+
+import type { IntegrationViewModel } from "@/features/integrations/integrations.types"
+import { IntegrationRow } from "./integration-row"
+
+const mailgunProvider: IntegrationViewModel = {
+  id: "mailgun",
+  name: "Mailgun",
+  description: "Reliable transactional email sending service.",
+  icon: "📧",
+  category: "email",
+  isAvailable: true,
+  isConnected: false,
+  isDeactivated: false,
+}
+
+const connectedProvider: IntegrationViewModel = {
+  ...mailgunProvider,
+  isConnected: true,
+}
+
+const deactivatedProvider: IntegrationViewModel = {
+  ...mailgunProvider,
+  isDeactivated: true,
+}
+
+const comingSoonProvider: IntegrationViewModel = {
+  ...mailgunProvider,
+  id: "twilio",
+  name: "Twilio",
+  isAvailable: false,
+  isComingSoon: true,
+}
+
+const meta = {
+  title: "Features/Integrations/IntegrationRow",
+  component: IntegrationRow,
+  parameters: { layout: "padded" },
+} satisfies Meta<typeof IntegrationRow>
+
+export default meta
+type Story = StoryObj<typeof meta>
+
+export const Connect: Story = {
+  args: {
+    provider: mailgunProvider,
+    onConnect: () => undefined,
+    onActivate: () => undefined,
+    onDisconnect: () => undefined,
+  },
+}
+
+export const Connected: Story = {
+  args: {
+    provider: connectedProvider,
+    onConnect: () => undefined,
+    onActivate: () => undefined,
+    onDisconnect: () => undefined,
+  },
+}
+
+export const Deactivated: Story = {
+  args: {
+    provider: deactivatedProvider,
+    onConnect: () => undefined,
+    onActivate: () => undefined,
+    onDisconnect: () => undefined,
+  },
+}
+
+export const ComingSoon: Story = {
+  args: {
+    provider: comingSoonProvider,
+    onConnect: () => undefined,
+    onActivate: () => undefined,
+    onDisconnect: () => undefined,
+  },
+}
diff --git a/frontend/src/features/integrations/components/integration-row/integration-row.test.tsx b/frontend/src/features/integrations/components/integration-row/integration-row.test.tsx
new file mode 100644
index 00000000..1fd13b42
--- /dev/null
+++ b/frontend/src/features/integrations/components/integration-row/integration-row.test.tsx
@@ -0,0 +1,69 @@
+import { render, screen } from "@testing-library/react"
+import userEvent from "@testing-library/user-event"
+import { describe, expect, it, vi } from "vitest"
+
+import type { IntegrationViewModel } from "@/features/integrations/integrations.types"
+import { IntegrationRow } from "./integration-row"
+
+const mailgunProvider: IntegrationViewModel = {
+  id: "mailgun",
+  name: "Mailgun",
+  description: "Reliable transactional email sending service.",
+  icon: "📧",
+  category: "email",
+  isAvailable: true,
+  isConnected: false,
+  isDeactivated: false,
+}
+
+describe("IntegrationRow", () => {
+  it("shows connect action for available providers", async () => {
+    const user = userEvent.setup()
+    const onConnect = vi.fn()
+
+    render(
+      <IntegrationRow
+        provider={mailgunProvider}
+        onConnect={onConnect}
+        onActivate={vi.fn()}
+        onDisconnect={vi.fn()}
+      />,
+    )
+
+    await user.click(screen.getByRole("button", { name: /connect/i }))
+    expect(onConnect).toHaveBeenCalledWith(mailgunProvider)
+  })
+
+  it("shows disconnect action for connected providers", async () => {
+    const user = userEvent.setup()
+    const onDisconnect = vi.fn()
+    const connected = { ...mailgunProvider, isConnected: true }
+
+    render(
+      <IntegrationRow
+        provider={connected}
+        onConnect={vi.fn()}
+        onActivate={vi.fn()}
+        onDisconnect={onDisconnect}
+      />,
+    )
+
+    expect(screen.getByText("Connected")).toBeInTheDocument()
+    await user.click(screen.getByRole("button", { name: /disconnect/i }))
+    expect(onDisconnect).toHaveBeenCalledWith(connected)
+  })
+
+  it("shows coming soon badge for unavailable providers", () => {
+    render(
+      <IntegrationRow
+        provider={{ ...mailgunProvider, isAvailable: false, isComingSoon: true }}
+        onConnect={vi.fn()}
+        onActivate={vi.fn()}
+        onDisconnect={vi.fn()}
+      />,
+    )
+
+    expect(screen.getByText("Coming soon")).toBeInTheDocument()
+    expect(screen.queryByRole("button", { name: /connect/i })).not.toBeInTheDocument()
+  })
+})
diff --git a/frontend/src/features/integrations/components/integration-row/integration-row.tsx b/frontend/src/features/integrations/components/integration-row/integration-row.tsx
index bd047d8c..10ace676 100644
--- a/frontend/src/features/integrations/components/integration-row/integration-row.tsx
+++ b/frontend/src/features/integrations/components/integration-row/integration-row.tsx
@@ -3,7 +3,7 @@ import { Button } from "@/components/ui/button"
 import { cn } from "@/lib/utils"
 
 import { IntegrationProviderIcon } from "@/features/integrations/components/integration-provider-icon"
-import type { IntegrationViewModel } from "@/features/integrations/hooks/use-integrations.hook"
+import type { IntegrationViewModel } from "@/features/integrations/integrations.types"
 
 interface IntegrationRowProps {
   provider: IntegrationViewModel
diff --git a/frontend/src/features/integrations/hooks/use-integrations.hook.ts b/frontend/src/features/integrations/hooks/use-integrations.hook.ts
index d5eeed66..b09dda4b 100644
--- a/frontend/src/features/integrations/hooks/use-integrations.hook.ts
+++ b/frontend/src/features/integrations/hooks/use-integrations.hook.ts
@@ -8,20 +8,10 @@ import {
   type IntegrationActionResult,
   type IntegrationChannel,
   type IntegrationStatus,
+  type IntegrationViewModel,
 } from "@/features/integrations/integrations.types"
 
-export interface IntegrationViewModel {
-  id: string
-  name: string
-  description: string
-  icon: string
-  category: IntegrationChannel
-  isAvailable: boolean
-  isComingSoon?: boolean
-  integration?: Integration
-  isConnected: boolean
-  isDeactivated: boolean
-}
+export type { IntegrationViewModel } from "@/features/integrations/integrations.types"
 
 function mergeCatalogWithIntegrations(providers: BackendProvider[], integrations: Integration[]): IntegrationViewModel[] {
   return providers.map((provider) => {
diff --git a/frontend/src/features/integrations/hooks/use-provider-config-fields.hook.test.ts b/frontend/src/features/integrations/hooks/use-provider-config-fields.hook.test.ts
new file mode 100644
index 00000000..694419f9
--- /dev/null
+++ b/frontend/src/features/integrations/hooks/use-provider-config-fields.hook.test.ts
@@ -0,0 +1,54 @@
+import { renderHook, waitFor } from "@testing-library/react"
+import { beforeEach, describe, expect, it, vi } from "vitest"
+
+vi.mock("@/features/integrations/integrations.api", () => ({
+  fetchProviderConfigFields: vi.fn(),
+}))
+
+import { fetchProviderConfigFields } from "@/features/integrations/integrations.api"
+
+import { useProviderConfigFields } from "./use-provider-config-fields.hook"
+
+const mockedFetchProviderConfigFields = vi.mocked(fetchProviderConfigFields)
+
+const mockFields = [
+  {
+    id: "f1",
+    provider_id: "mailgun",
+    key: "api_key",
+    label: "API Key",
+    description: "Your Mailgun Private API Key",
+    field_type: "password",
+    required: true,
+    default_value: "default-secret",
+    sort_order: 1,
+  },
+]
+
+describe("useProviderConfigFields", () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  it("loads fields and initializes form data when enabled", async () => {
+    mockedFetchProviderConfigFields.mockResolvedValue(mockFields)
+
+    const { result } = renderHook(() => useProviderConfigFields("ws-1", "mailgun", true))
+
+    await waitFor(() => {
+      expect(result.current.isLoading).toBe(false)
+    })
+
+    expect(mockedFetchProviderConfigFields).toHaveBeenCalledWith("ws-1", "mailgun")
+    expect(result.current.fields).toEqual(mockFields)
+    expect(result.current.formData).toEqual({ api_key: "default-secret" })
+    expect(result.current.error).toBeNull()
+  })
+
+  it("does not fetch when disabled or provider id is missing", () => {
+    renderHook(() => useProviderConfigFields("ws-1", undefined, true))
+    renderHook(() => useProviderConfigFields("ws-1", "mailgun", false))
+
+    expect(mockedFetchProviderConfigFields).not.toHaveBeenCalled()
+  })
+})
diff --git a/frontend/src/features/integrations/hooks/use-provider-config-fields.hook.ts b/frontend/src/features/integrations/hooks/use-provider-config-fields.hook.ts
new file mode 100644
index 00000000..dd9060fe
--- /dev/null
+++ b/frontend/src/features/integrations/hooks/use-provider-config-fields.hook.ts
@@ -0,0 +1,57 @@
+import { useEffect, useState } from "react"
+
+import { fetchProviderConfigFields, type ProviderConfigField } from "@/features/integrations/integrations.api"
+
+export function useProviderConfigFields(workspaceId: string, providerId: string | undefined, enabled: boolean) {
+  const [fields, setFields] = useState<ProviderConfigField[]>([])
+  const [formData, setFormData] = useState<Record<string, string>>({})
+  const [isLoading, setIsLoading] = useState(false)
+  const [error, setError] = useState<string | null>(null)
+
+  useEffect(() => {
+    if (!enabled || !providerId) {
+      return
+    }
+
+    let cancelled = false
+
+    ;(async () => {
+      setIsLoading(true)
+      setError(null)
+      try {
+        const result = await fetchProviderConfigFields(workspaceId, providerId)
+        if (cancelled) return
+
+        setFields(result)
+        const defaults: Record<string, string> = {}
+        result.forEach((field) => {
+          defaults[field.key] = field.default_value || ""
+        })
+        setFormData(defaults)
+      } catch (err) {
+        if (cancelled) return
+        setError(err instanceof Error ? err.message : "Failed to load configuration fields")
+        setFields([])
+      } finally {
+        if (!cancelled) setIsLoading(false)
+      }
+    })()
+
+    return () => {
+      cancelled = true
+    }
+  }, [workspaceId, providerId, enabled])
+
+  function updateField(key: string, value: string) {
+    setFormData((prev) => ({ ...prev, [key]: value }))
+  }
+
+  return {
+    fields,
+    formData,
+    isLoading,
+    error,
+    updateField,
+    setError,
+  }
+}
diff --git a/frontend/src/features/integrations/integrations.types.ts b/frontend/src/features/integrations/integrations.types.ts
index c6c89513..5038ad58 100644
--- a/frontend/src/features/integrations/integrations.types.ts
+++ b/frontend/src/features/integrations/integrations.types.ts
@@ -22,3 +22,16 @@ export interface Integration {
   created_at: string
   updated_at: string
 }
+
+export interface IntegrationViewModel {
+  id: string
+  name: string
+  description: string
+  icon: string
+  category: IntegrationChannel
+  isAvailable: boolean
+  isComingSoon?: boolean
+  integration?: Integration
+  isConnected: boolean
+  isDeactivated: boolean
+}
diff --git a/frontend/src/features/integrations/pages/integrations.page.test.tsx b/frontend/src/features/integrations/pages/integrations.page.test.tsx
new file mode 100644
index 00000000..7ad643e9
--- /dev/null
+++ b/frontend/src/features/integrations/pages/integrations.page.test.tsx
@@ -0,0 +1,61 @@
+import { render, screen } from "@testing-library/react"
+import { MemoryRouter, Route, Routes } from "react-router-dom"
+import { describe, expect, it, vi } from "vitest"
+
+import { useIntegrations } from "../hooks/use-integrations.hook"
+import { IntegrationsPage } from "./integrations.page"
+
+vi.mock("../hooks/use-integrations.hook", () => ({
+  useIntegrations: vi.fn(),
+  filterIntegrationsByTab: vi.fn((items: unknown[]) => items),
+  groupByCategory: vi.fn(() => ({})),
+}))
+
+const mockedUseIntegrations = vi.mocked(useIntegrations)
+
+function renderPage() {
+  return render(
+    <MemoryRouter initialEntries={["/workspaces/ws-1/integrations"]}>
+      <Routes>
+        <Route path="/workspaces/:wid/integrations" element={<IntegrationsPage />} />
+      </Routes>
+    </MemoryRouter>,
+  )
+}
+
+describe("IntegrationsPage", () => {
+  it("shows loading state", () => {
+    mockedUseIntegrations.mockReturnValue({
+      items: [],
+      isLoading: true,
+      error: null,
+      reload: vi.fn(),
+      connect: vi.fn(),
+      activate: vi.fn(),
+      deactivate: vi.fn(),
+      removeIntegration: vi.fn(),
+    })
+
+    renderPage()
+
+    expect(screen.getByText(/loading integrations/i)).toBeInTheDocument()
+  })
+
+  it("shows error banner", () => {
+    mockedUseIntegrations.mockReturnValue({
+      items: [],
+      isLoading: false,
+      error: "Failed to load providers",
+      reload: vi.fn(),
+      connect: vi.fn(),
+      activate: vi.fn(),
+      deactivate: vi.fn(),
+      removeIntegration: vi.fn(),
+    })
+
+    renderPage()
+
+    expect(screen.getByText("Failed to load providers")).toBeInTheDocument()
+    expect(screen.getByText("Integrations")).toBeInTheDocument()
+  })
+})
diff --git a/frontend/src/features/integrations/pages/integrations.page.tsx b/frontend/src/features/integrations/pages/integrations.page.tsx
index a9c144d8..b3cfb5b8 100644
--- a/frontend/src/features/integrations/pages/integrations.page.tsx
+++ b/frontend/src/features/integrations/pages/integrations.page.tsx
@@ -14,9 +14,8 @@ import {
   filterIntegrationsByTab,
   groupByCategory,
   useIntegrations,
-  type IntegrationViewModel,
 } from "@/features/integrations/hooks/use-integrations.hook"
-import type { IntegrationActionResult, IntegrationChannel } from "@/features/integrations/integrations.types"
+import type { IntegrationActionResult, IntegrationChannel, IntegrationViewModel } from "@/features/integrations/integrations.types"
 
 const CATEGORY_LABELS: Record<IntegrationChannel, string> = {
   email: "Email",
diff --git a/frontend/src/features/settings/components/api-key-create-dialog/api-key-create-dialog.stories.tsx b/frontend/src/features/settings/components/api-key-create-dialog/api-key-create-dialog.stories.tsx
new file mode 100644
index 00000000..4b695afc
--- /dev/null
+++ b/frontend/src/features/settings/components/api-key-create-dialog/api-key-create-dialog.stories.tsx
@@ -0,0 +1,21 @@
+import type { Meta, StoryObj } from "@storybook/react-vite"
+
+import { ApiKeyCreateDialog } from "./api-key-create-dialog"
+
+const meta = {
+  title: "Features/Settings/ApiKeyCreateDialog",
+  component: ApiKeyCreateDialog,
+} satisfies Meta<typeof ApiKeyCreateDialog>
+
+export default meta
+type Story = StoryObj<typeof meta>
+
+export const Open: Story = {
+  args: {
+    open: true,
+    onClose: () => undefined,
+    onCreate: async () => {
+      await new Promise((resolve) => window.setTimeout(resolve, 500))
+    },
+  },
+}
diff --git a/frontend/src/features/settings/components/api-key-create-dialog/api-key-create-dialog.test.tsx b/frontend/src/features/settings/components/api-key-create-dialog/api-key-create-dialog.test.tsx
new file mode 100644
index 00000000..e94aa024
--- /dev/null
+++ b/frontend/src/features/settings/components/api-key-create-dialog/api-key-create-dialog.test.tsx
@@ -0,0 +1,29 @@
+import { render, screen } from "@testing-library/react"
+import userEvent from "@testing-library/user-event"
+import { describe, expect, it, vi } from "vitest"
+
+import { ApiKeyCreateDialog } from "./api-key-create-dialog"
+
+describe("ApiKeyCreateDialog", () => {
+  it("submits trimmed API key name", async () => {
+    const user = userEvent.setup()
+    const onCreate = vi.fn().mockResolvedValue(undefined)
+
+    render(<ApiKeyCreateDialog open onClose={vi.fn()} onCreate={onCreate} />)
+
+    await user.type(screen.getByLabelText(/api key name/i), "  Production  ")
+    await user.click(screen.getByRole("button", { name: /generate key/i }))
+
+    expect(onCreate).toHaveBeenCalledWith("Production")
+  })
+
+  it("shows validation error when name is empty", async () => {
+    const user = userEvent.setup()
+
+    render(<ApiKeyCreateDialog open onClose={vi.fn()} onCreate={vi.fn()} />)
+
+    await user.click(screen.getByRole("button", { name: /generate key/i }))
+
+    expect(screen.getByText(/api key name is required/i)).toBeInTheDocument()
+  })
+})
diff --git a/frontend/src/features/settings/components/api-key-create-dialog/api-key-create-dialog.tsx b/frontend/src/features/settings/components/api-key-create-dialog/api-key-create-dialog.tsx
new file mode 100644
index 00000000..f419da15
--- /dev/null
+++ b/frontend/src/features/settings/components/api-key-create-dialog/api-key-create-dialog.tsx
@@ -0,0 +1,100 @@
+import { useState } from "react"
+
+import { Button } from "@/components/ui/button"
+import { Input } from "@/components/ui/input"
+import { Modal } from "@/components/ui/modal"
+
+interface ApiKeyCreateDialogProps {
+  open: boolean
+  onClose: () => void
+  onCreate: (name: string) => Promise<void>
+}
+
+export function ApiKeyCreateDialog({ open, onClose, onCreate }: ApiKeyCreateDialogProps) {
+  const [name, setName] = useState("")
+  const [validationError, setValidationError] = useState<string | null>(null)
+  const [submitError, setSubmitError] = useState<string | null>(null)
+  const [isSubmitting, setIsSubmitting] = useState(false)
+
+  function resetForm() {
+    setName("")
+    setValidationError(null)
+    setSubmitError(null)
+    setIsSubmitting(false)
+  }
+
+  function handleClose() {
+    if (isSubmitting) return
+    resetForm()
+    onClose()
+  }
+
+  async function handleSubmit(event: React.FormEvent) {
+    event.preventDefault()
+    const trimmed = name.trim()
+    if (!trimmed) {
+      setValidationError("API key name is required")
+      return
+    }
+
+    setValidationError(null)
+    setSubmitError(null)
+    setIsSubmitting(true)
+    try {
+      await onCreate(trimmed)
+      resetForm()
+      onClose()
+    } catch (err) {
+      setSubmitError(err instanceof Error ? err.message : "Failed to create API key")
+    } finally {
+      setIsSubmitting(false)
+    }
+  }
+
+  return (
+    <Modal isOpen={open} onClose={handleClose} title="Generate API key" preventClose={isSubmitting}>
+      <form onSubmit={handleSubmit} className="flex flex-col gap-4">
+        <p className="text-sm text-text-secondary">
+          Give this key a name so you can identify it later (for example, &quot;Production&quot; or &quot;CI&quot;).
+        </p>
+
+        <div className="flex flex-col gap-2">
+          <label htmlFor="api-key-name" className="text-xs font-semibold uppercase tracking-wide text-text-secondary">
+            API key name
+          </label>
+          <Input
+            id="api-key-name"
+            type="text"
+            value={name}
+            onChange={(event) => {
+              setName(event.target.value)
+              setValidationError(null)
+              setSubmitError(null)
+            }}
+            placeholder="e.g. Production"
+            autoFocus
+            disabled={isSubmitting}
+          />
+          {validationError ? (
+            <p className="text-xs font-medium text-destructive">{validationError}</p>
+          ) : null}
+        </div>
+
+        {submitError ? (
+          <p className="rounded-lg border border-destructive/20 bg-destructive/10 p-3 text-sm text-destructive">
+            {submitError}
+          </p>
+        ) : null}
+
+        <div className="flex flex-col-reverse gap-2 sm:flex-row sm:justify-end">
+          <Button type="button" variant="outline" onClick={handleClose} disabled={isSubmitting}>
+            Cancel
+          </Button>
+          <Button type="submit" disabled={isSubmitting}>
+            {isSubmitting ? "Generating…" : "Generate key"}
+          </Button>
+        </div>
+      </form>
+    </Modal>
+  )
+}
diff --git a/frontend/src/features/settings/components/api-key-create-dialog/index.ts b/frontend/src/features/settings/components/api-key-create-dialog/index.ts
new file mode 100644
index 00000000..a01efaa2
--- /dev/null
+++ b/frontend/src/features/settings/components/api-key-create-dialog/index.ts
@@ -0,0 +1 @@
+export { ApiKeyCreateDialog } from "./api-key-create-dialog"
diff --git a/frontend/src/features/settings/components/api-key-row/api-key-row.stories.tsx b/frontend/src/features/settings/components/api-key-row/api-key-row.stories.tsx
new file mode 100644
index 00000000..7dde6a7d
--- /dev/null
+++ b/frontend/src/features/settings/components/api-key-row/api-key-row.stories.tsx
@@ -0,0 +1,39 @@
+import type { Meta, StoryObj } from "@storybook/react-vite"
+
+import { ApiKeyRow } from "./api-key-row"
+
+const meta = {
+  title: "Features/Settings/ApiKeyRow",
+  component: ApiKeyRow,
+  parameters: { layout: "padded" },
+} satisfies Meta<typeof ApiKeyRow>
+
+export default meta
+type Story = StoryObj<typeof meta>
+
+const sampleKey = {
+  id: "key-1",
+  workspace_id: "00000000-0000-0000-0000-000000000001",
+  client_id: "demo-client-id-abcdefghijklmnop",
+  name: "Production",
+  is_active: true,
+  created_at: "2026-01-01T00:00:00Z",
+  last_used_at: null,
+}
+
+export const Default: Story = {
+  args: {
+    apiKey: sampleKey,
+    onRegenerate: () => undefined,
+    onDelete: () => undefined,
+  },
+}
+
+export const Busy: Story = {
+  args: {
+    apiKey: sampleKey,
+    isBusy: true,
+    onRegenerate: () => undefined,
+    onDelete: () => undefined,
+  },
+}
diff --git a/frontend/src/features/settings/components/api-key-row/api-key-row.test.tsx b/frontend/src/features/settings/components/api-key-row/api-key-row.test.tsx
new file mode 100644
index 00000000..cb8834c3
--- /dev/null
+++ b/frontend/src/features/settings/components/api-key-row/api-key-row.test.tsx
@@ -0,0 +1,40 @@
+import { render, screen } from "@testing-library/react"
+import userEvent from "@testing-library/user-event"
+import { describe, expect, it, vi } from "vitest"
+
+import { ApiKeyRow } from "./api-key-row"
+
+const sampleKey = {
+  id: "key-1",
+  workspace_id: "ws-1",
+  client_id: "demo-client-id-abcdefghijklmnop",
+  name: "Production",
+  is_active: true,
+  created_at: "2026-01-01T00:00:00Z",
+  last_used_at: null,
+}
+
+describe("ApiKeyRow", () => {
+  it("renders key details and action buttons", () => {
+    render(<ApiKeyRow apiKey={sampleKey} onRegenerate={vi.fn()} onDelete={vi.fn()} />)
+
+    expect(screen.getByText("Production")).toBeInTheDocument()
+    expect(screen.getByText(/Last used: Never/i)).toBeInTheDocument()
+    expect(screen.getByRole("button", { name: /regenerate/i })).toBeInTheDocument()
+    expect(screen.getByRole("button", { name: /delete/i })).toBeInTheDocument()
+  })
+
+  it("calls regenerate and delete handlers", async () => {
+    const user = userEvent.setup()
+    const onRegenerate = vi.fn()
+    const onDelete = vi.fn()
+
+    render(<ApiKeyRow apiKey={sampleKey} onRegenerate={onRegenerate} onDelete={onDelete} />)
+
+    await user.click(screen.getByRole("button", { name: /regenerate/i }))
+    await user.click(screen.getByRole("button", { name: /delete/i }))
+
+    expect(onRegenerate).toHaveBeenCalledWith("key-1")
+    expect(onDelete).toHaveBeenCalledWith("key-1")
+  })
+})
diff --git a/frontend/src/features/settings/components/api-key-secret-dialog/api-key-secret-dialog.stories.tsx b/frontend/src/features/settings/components/api-key-secret-dialog/api-key-secret-dialog.stories.tsx
new file mode 100644
index 00000000..658198e7
--- /dev/null
+++ b/frontend/src/features/settings/components/api-key-secret-dialog/api-key-secret-dialog.stories.tsx
@@ -0,0 +1,20 @@
+import type { Meta, StoryObj } from "@storybook/react-vite"
+
+import { ApiKeySecretDialog } from "./api-key-secret-dialog"
+
+const meta = {
+  title: "Features/Settings/ApiKeySecretDialog",
+  component: ApiKeySecretDialog,
+} satisfies Meta<typeof ApiKeySecretDialog>
+
+export default meta
+type Story = StoryObj<typeof meta>
+
+export const Open: Story = {
+  args: {
+    open: true,
+    clientId: "demo-client-id",
+    clientSecret: "ZVtUvv8aDOfM0R2krW3qKpn_EQ_FX-KXFa0lRZVfvpU",
+    onClose: () => undefined,
+  },
+}
diff --git a/frontend/src/features/settings/components/api-key-secret-dialog/api-key-secret-dialog.test.tsx b/frontend/src/features/settings/components/api-key-secret-dialog/api-key-secret-dialog.test.tsx
new file mode 100644
index 00000000..249e500c
--- /dev/null
+++ b/frontend/src/features/settings/components/api-key-secret-dialog/api-key-secret-dialog.test.tsx
@@ -0,0 +1,48 @@
+import { render, screen } from "@testing-library/react"
+import userEvent from "@testing-library/user-event"
+import { describe, expect, it, vi } from "vitest"
+
+import { ApiKeySecretDialog } from "./api-key-secret-dialog"
+
+describe("ApiKeySecretDialog", () => {
+  it("renders client credentials and closes on done", async () => {
+    const user = userEvent.setup()
+    const onClose = vi.fn()
+
+    render(
+      <ApiKeySecretDialog
+        open
+        clientId="demo-client-id"
+        clientSecret="secret-value"
+        onClose={onClose}
+      />,
+    )
+
+    expect(screen.getByDisplayValue("demo-client-id")).toBeInTheDocument()
+    expect(screen.getByDisplayValue("secret-value")).toBeInTheDocument()
+
+    await user.click(screen.getByRole("button", { name: /done/i }))
+    expect(onClose).toHaveBeenCalledTimes(1)
+  })
+
+  it("copies client secret to clipboard", async () => {
+    const user = userEvent.setup()
+    const writeText = vi.fn().mockResolvedValue(undefined)
+    vi.spyOn(navigator.clipboard, "writeText").mockImplementation(writeText)
+
+    render(
+      <ApiKeySecretDialog
+        open
+        clientId="demo-client-id"
+        clientSecret="secret-value"
+        onClose={vi.fn()}
+      />,
+    )
+
+    const copyButtons = screen.getAllByRole("button", { name: /copy/i })
+    await user.click(copyButtons[1])
+
+    expect(writeText).toHaveBeenCalledWith("secret-value")
+    expect(screen.getByRole("button", { name: /copied/i })).toBeInTheDocument()
+  })
+})
diff --git a/frontend/src/features/settings/components/api-key-secret-dialog/api-key-secret-dialog.tsx b/frontend/src/features/settings/components/api-key-secret-dialog/api-key-secret-dialog.tsx
new file mode 100644
index 00000000..f7ed9ce5
--- /dev/null
+++ b/frontend/src/features/settings/components/api-key-secret-dialog/api-key-secret-dialog.tsx
@@ -0,0 +1,98 @@
+import { useState } from "react"
+
+import { Button } from "@/components/ui/button"
+import { Icon } from "@/components/ui/icon"
+import { Input } from "@/components/ui/input"
+import { Modal } from "@/components/ui/modal"
+
+interface ApiKeySecretDialogProps {
+  open: boolean
+  clientId?: string
+  clientSecret: string
+  onClose: () => void
+}
+
+export function ApiKeySecretDialog({
+  open,
+  clientId,
+  clientSecret,
+  onClose,
+}: ApiKeySecretDialogProps) {
+  const [copiedField, setCopiedField] = useState<"clientId" | "clientSecret" | null>(null)
+
+  async function copyValue(value: string, field: "clientId" | "clientSecret") {
+    try {
+      await navigator.clipboard.writeText(value)
+      setCopiedField(field)
+      window.setTimeout(() => setCopiedField((current) => (current === field ? null : current)), 2000)
+    } catch {
+      setCopiedField(null)
+    }
+  }
+
+  return (
+    <Modal isOpen={open} onClose={onClose} title="Save your API credentials">
+      <div className="flex flex-col gap-4">
+        <p className="text-sm text-text-secondary">
+          Copy these values now. The client secret is only shown once and cannot be retrieved later.
+        </p>
+
+        {clientId ? (
+          <div className="flex flex-col gap-2">
+            <label htmlFor="api-key-client-id" className="text-xs font-semibold uppercase tracking-wide text-text-secondary">
+              Client ID
+            </label>
+            <div className="flex gap-2">
+              <Input
+                id="api-key-client-id"
+                readOnly
+                value={clientId}
+                className="font-mono text-sm"
+                onFocus={(event) => event.target.select()}
+              />
+              <Button
+                type="button"
+                variant="outline"
+                size="sm"
+                className="shrink-0"
+                onClick={() => void copyValue(clientId, "clientId")}
+              >
+                <Icon name="content_copy" size="sm" data-icon="inline-start" />
+                {copiedField === "clientId" ? "Copied" : "Copy"}
+              </Button>
+            </div>
+          </div>
+        ) : null}
+
+        <div className="flex flex-col gap-2">
+          <label htmlFor="api-key-client-secret" className="text-xs font-semibold uppercase tracking-wide text-text-secondary">
+            Client secret
+          </label>
+          <div className="flex gap-2">
+            <Input
+              id="api-key-client-secret"
+              readOnly
+              value={clientSecret}
+              className="font-mono text-sm"
+              onFocus={(event) => event.target.select()}
+            />
+            <Button
+              type="button"
+              variant="outline"
+              size="sm"
+              className="shrink-0"
+              onClick={() => void copyValue(clientSecret, "clientSecret")}
+            >
+              <Icon name="content_copy" size="sm" data-icon="inline-start" />
+              {copiedField === "clientSecret" ? "Copied" : "Copy"}
+            </Button>
+          </div>
+        </div>
+
+        <Button type="button" className="w-full" onClick={onClose}>
+          Done
+        </Button>
+      </div>
+    </Modal>
+  )
+}
diff --git a/frontend/src/features/settings/components/api-key-secret-dialog/index.ts b/frontend/src/features/settings/components/api-key-secret-dialog/index.ts
new file mode 100644
index 00000000..0bc35277
--- /dev/null
+++ b/frontend/src/features/settings/components/api-key-secret-dialog/index.ts
@@ -0,0 +1 @@
+export { ApiKeySecretDialog } from "./api-key-secret-dialog"
diff --git a/frontend/src/features/settings/components/radio-option/radio-option.stories.tsx b/frontend/src/features/settings/components/radio-option/radio-option.stories.tsx
new file mode 100644
index 00000000..27bd4a61
--- /dev/null
+++ b/frontend/src/features/settings/components/radio-option/radio-option.stories.tsx
@@ -0,0 +1,50 @@
+import type { Meta, StoryObj } from "@storybook/react-vite"
+import { useState } from "react"
+
+import { RadioOption } from "./radio-option"
+
+const meta = {
+  title: "Features/Settings/RadioOption",
+  component: RadioOption,
+  parameters: { layout: "padded" },
+} satisfies Meta<typeof RadioOption>
+
+export default meta
+type Story = StoryObj<typeof meta>
+
+function RadioOptionDemo() {
+  const [checked, setChecked] = useState(true)
+  return (
+    <RadioOption
+      id="dispatch-memory"
+      name="dispatch-mode"
+      label="Memory"
+      description="Capture messages in memory for development and testing."
+      checked={checked}
+      onChange={() => setChecked((value) => !value)}
+    />
+  )
+}
+
+export const Selected: Story = {
+  render: () => <RadioOptionDemo />,
+  args: {
+    id: "dispatch-memory",
+    name: "dispatch-mode",
+    label: "Memory",
+    description: "Capture messages in memory for development and testing.",
+    checked: true,
+    onChange: () => undefined,
+  },
+}
+
+export const Unselected: Story = {
+  args: {
+    id: "dispatch-provider",
+    name: "dispatch-mode",
+    label: "Provider",
+    description: "Send messages through the connected channel integration.",
+    checked: false,
+    onChange: () => undefined,
+  },
+}
diff --git a/frontend/src/features/settings/components/radio-option/radio-option.test.tsx b/frontend/src/features/settings/components/radio-option/radio-option.test.tsx
new file mode 100644
index 00000000..a1758174
--- /dev/null
+++ b/frontend/src/features/settings/components/radio-option/radio-option.test.tsx
@@ -0,0 +1,43 @@
+import { render, screen } from "@testing-library/react"
+import userEvent from "@testing-library/user-event"
+import { describe, expect, it, vi } from "vitest"
+
+import { RadioOption } from "./radio-option"
+
+describe("RadioOption", () => {
+  it("renders label and description", () => {
+    render(
+      <RadioOption
+        id="dispatch-memory"
+        name="dispatch-mode"
+        label="Memory"
+        description="Capture messages in memory."
+        checked
+        onChange={vi.fn()}
+      />,
+    )
+
+    expect(screen.getByText("Memory")).toBeInTheDocument()
+    expect(screen.getByText("Capture messages in memory.")).toBeInTheDocument()
+    expect(screen.getByRole("radio")).toBeChecked()
+  })
+
+  it("calls onChange when selected", async () => {
+    const user = userEvent.setup()
+    const onChange = vi.fn()
+
+    render(
+      <RadioOption
+        id="dispatch-provider"
+        name="dispatch-mode"
+        label="Provider"
+        description="Send through provider."
+        checked={false}
+        onChange={onChange}
+      />,
+    )
+
+    await user.click(screen.getByRole("radio"))
+    expect(onChange).toHaveBeenCalledTimes(1)
+  })
+})
diff --git a/frontend/src/features/settings/hooks/use-settings.hook.ts b/frontend/src/features/settings/hooks/use-settings.hook.ts
index 3dec6462..b9db1670 100644
--- a/frontend/src/features/settings/hooks/use-settings.hook.ts
+++ b/frontend/src/features/settings/hooks/use-settings.hook.ts
@@ -8,7 +8,9 @@ import {
   patchSettings,
   regenerateApiKey,
 } from "../settings.api"
-import type { ApiKey, RetentionMode, WorkspaceSettings } from "../settings.types"
+import { parseMessageDispatchConfig } from "../message-dispatch-mode"
+import { parseWorkspaceSettings } from "../settings.schema"
+import type { ApiKey, WorkspaceSettings, WorkspaceSettingsPatch } from "../settings.types"
 
 export function useSettings(workspaceId: string) {
   const [settings, setSettings] = useState<WorkspaceSettings>({})
@@ -46,9 +48,10 @@ export function useSettings(workspaceId: string) {
     }
   }, [workspaceId, trigger])
 
-  async function saveSettings(patch: Record<string, string>) {
+  async function saveSettings(patch: WorkspaceSettingsPatch) {
     await patchSettings(workspaceId, patch)
-    setSettings((prev) => ({ ...prev, ...patch }))
+    setSettings((prev) => parseWorkspaceSettings({ ...prev, ...patch }))
+    setError(null)
   }
 
   async function addApiKey(name: string) {
@@ -66,12 +69,12 @@ export function useSettings(workspaceId: string) {
     return regenerateApiKey(workspaceId, keyId)
   }
 
-  const retentionMode = (settings.data_retention as RetentionMode | undefined) ?? "memory"
+  const messageDispatchConfig = parseMessageDispatchConfig(settings.message_dispatch_mode, settings.store_message_content)
 
   return {
     settings,
     apiKeys,
-    retentionMode,
+    messageDispatchConfig,
     isLoading,
     error,
     reload,
diff --git a/frontend/src/features/settings/message-dispatch-mode.test.ts b/frontend/src/features/settings/message-dispatch-mode.test.ts
new file mode 100644
index 00000000..daffd7f0
--- /dev/null
+++ b/frontend/src/features/settings/message-dispatch-mode.test.ts
@@ -0,0 +1,49 @@
+import { describe, expect, it } from "vitest"
+
+import {
+  dispatchConfigsEqual,
+  normalizeDispatchMode,
+  normalizeStoreMessageContent,
+  parseMessageDispatchConfig,
+  toStoreMessageContentSetting,
+} from "./message-dispatch-mode"
+
+describe("parseMessageDispatchConfig", () => {
+  it("maps valid combinations", () => {
+    expect(parseMessageDispatchConfig("memory", "false")).toEqual({ mode: "memory", storeMessageContent: false })
+    expect(parseMessageDispatchConfig("memory", "true")).toEqual({ mode: "memory", storeMessageContent: true })
+    expect(parseMessageDispatchConfig("provider", "false")).toEqual({ mode: "provider", storeMessageContent: false })
+    expect(parseMessageDispatchConfig("provider", "true")).toEqual({ mode: "provider", storeMessageContent: true })
+  })
+
+  it("defaults to memory without inbox capture on missing input", () => {
+    expect(parseMessageDispatchConfig()).toEqual({ mode: "memory", storeMessageContent: false })
+    expect(parseMessageDispatchConfig("unknown", "invalid")).toEqual({ mode: "memory", storeMessageContent: false })
+  })
+})
+
+describe("normalizeDispatchMode", () => {
+  it("is case-insensitive for provider", () => {
+    expect(normalizeDispatchMode("PROVIDER")).toBe("provider")
+  })
+})
+
+describe("normalizeStoreMessageContent", () => {
+  it("treats unknown strings as false", () => {
+    expect(normalizeStoreMessageContent("yes")).toBe(false)
+  })
+})
+
+describe("toStoreMessageContentSetting", () => {
+  it("maps boolean to API string values", () => {
+    expect(toStoreMessageContentSetting(true)).toBe("true")
+    expect(toStoreMessageContentSetting(false)).toBe("false")
+  })
+})
+
+describe("dispatchConfigsEqual", () => {
+  it("compares mode and store flag", () => {
+    expect(dispatchConfigsEqual({ mode: "memory", storeMessageContent: false }, { mode: "memory", storeMessageContent: false })).toBe(true)
+    expect(dispatchConfigsEqual({ mode: "provider", storeMessageContent: true }, { mode: "provider", storeMessageContent: false })).toBe(false)
+  })
+})
diff --git a/frontend/src/features/settings/message-dispatch-mode.ts b/frontend/src/features/settings/message-dispatch-mode.ts
new file mode 100644
index 00000000..2f280ed3
--- /dev/null
+++ b/frontend/src/features/settings/message-dispatch-mode.ts
@@ -0,0 +1,50 @@
+import type {
+  MessageDispatchConfig,
+  MessageDispatchMode,
+  StoreMessageContentSetting,
+} from "./settings.types"
+
+export const DISPATCH_MODES = ["memory", "provider"] as const
+export const STORE_CONTENT_MODES = ["true", "false"] as const
+
+
+export function normalizeDispatchMode(raw?: string): MessageDispatchMode {
+  switch (raw?.trim().toLowerCase()) {
+    case "provider":
+      return "provider"
+    case "memory":
+    default:
+      return "memory"
+  }
+}
+
+export function normalizeStoreMessageContent(raw?: string): boolean {
+  switch (raw?.trim().toLowerCase()) {
+    case "true":
+      return true
+    case "false":
+    default:
+      return false
+  }
+}
+
+export function parseMessageDispatchConfig(
+  modeRaw?: string,
+  storeRaw?: string,
+): MessageDispatchConfig {
+  return {
+    mode: normalizeDispatchMode(modeRaw),
+    storeMessageContent: normalizeStoreMessageContent(storeRaw),
+  }
+}
+
+export function toStoreMessageContentSetting(storeMessageContent: boolean): StoreMessageContentSetting {
+  return storeMessageContent ? "true" : "false"
+}
+
+export function dispatchConfigsEqual(
+  left: MessageDispatchConfig,
+  right: MessageDispatchConfig,
+): boolean {
+  return left.mode === right.mode && left.storeMessageContent === right.storeMessageContent
+}
diff --git a/frontend/src/features/settings/pages/settings.page.test.tsx b/frontend/src/features/settings/pages/settings.page.test.tsx
new file mode 100644
index 00000000..d9b254af
--- /dev/null
+++ b/frontend/src/features/settings/pages/settings.page.test.tsx
@@ -0,0 +1,74 @@
+import { render, screen } from "@testing-library/react"
+import { MemoryRouter, Route, Routes } from "react-router-dom"
+import { describe, expect, it, vi } from "vitest"
+
+import { useSettings } from "../hooks/use-settings.hook"
+import { SettingsPage } from "./settings.page"
+
+vi.mock("../hooks/use-settings.hook", () => ({
+  useSettings: vi.fn(),
+}))
+
+const mockedUseSettings = vi.mocked(useSettings)
+
+const sampleApiKey = {
+  id: "key-1",
+  workspace_id: "w1",
+  client_id: "demo-client-id-abcdefghijklmnop",
+  name: "Production",
+  is_active: true,
+  created_at: "2026-01-01T00:00:00Z",
+  last_used_at: null,
+}
+
+function renderSettingsPage(tab = "developer") {
+  return render(
+    <MemoryRouter initialEntries={[`/workspaces/w1/settings?tab=${tab}`]}>
+      <Routes>
+        <Route path="/workspaces/:wid/settings" element={<SettingsPage />} />
+      </Routes>
+    </MemoryRouter>,
+  )
+}
+
+describe("SettingsPage", () => {
+  it("shows loading state while settings are loading", () => {
+    mockedUseSettings.mockReturnValue({
+      settings: {},
+      apiKeys: [],
+      messageDispatchConfig: { mode: "memory", storeMessageContent: false },
+      isLoading: true,
+      error: null,
+      reload: vi.fn(),
+      saveSettings: vi.fn(),
+      addApiKey: vi.fn(),
+      removeApiKey: vi.fn(),
+      rotateApiKey: vi.fn(),
+    })
+
+    renderSettingsPage()
+
+    expect(screen.getByText(/loading settings/i)).toBeInTheDocument()
+  })
+
+  it("renders API keys tab content from useSettings", () => {
+    mockedUseSettings.mockReturnValue({
+      settings: {},
+      apiKeys: [sampleApiKey],
+      messageDispatchConfig: { mode: "memory", storeMessageContent: false },
+      isLoading: false,
+      error: null,
+      reload: vi.fn(),
+      saveSettings: vi.fn(),
+      addApiKey: vi.fn(),
+      removeApiKey: vi.fn(),
+      rotateApiKey: vi.fn(),
+    })
+
+    renderSettingsPage("developer")
+
+    expect(screen.getByRole("heading", { name: "API Keys" })).toBeInTheDocument()
+    expect(screen.getByText("Production")).toBeInTheDocument()
+    expect(screen.getByRole("button", { name: /generate key/i })).toBeInTheDocument()
+  })
+})
diff --git a/frontend/src/features/settings/pages/settings.page.tsx b/frontend/src/features/settings/pages/settings.page.tsx
index b635d259..6e1f5cba 100644
--- a/frontend/src/features/settings/pages/settings.page.tsx
+++ b/frontend/src/features/settings/pages/settings.page.tsx
@@ -1,22 +1,33 @@
 import * as Tabs from "@radix-ui/react-tabs"
 import { useState } from "react"
-import { useParams } from "react-router-dom"
+import { useParams, useSearchParams } from "react-router-dom"
 
 import { Button } from "@/components/ui/button"
+import { Checkbox } from "@/components/ui/checkbox"
 import { Icon } from "@/components/ui/icon"
 import { Input } from "@/components/ui/input"
 import { Spinner } from "@/components/ui/spinner"
 import { PageHeader } from "@/shared/components/page-header"
 import { cn } from "@/lib/utils"
 
+import { ApiKeyCreateDialog } from "../components/api-key-create-dialog"
 import { ApiKeyRow } from "../components/api-key-row"
+import { ApiKeySecretDialog } from "../components/api-key-secret-dialog"
 import { RadioOption } from "../components/radio-option"
 import { useSettings } from "../hooks/use-settings.hook"
-import type { RetentionMode, SettingsTab, WorkspaceSettings } from "../settings.types"
+import { dispatchConfigsEqual, toStoreMessageContentSetting } from "../message-dispatch-mode"
+import type {
+  MessageDispatchConfig,
+  MessageDispatchMode,
+  SettingsTab,
+  WorkspaceSettings,
+  WorkspaceSettingsPatch,
+} from "../settings.types"
+import { settingsTabFromSearch } from "../settings.types"
 
 interface GeneralSettingsPanelProps {
   settings: WorkspaceSettings
-  onSave: (patch: Record<string, string>) => Promise<void>
+  onSave: (patch: WorkspaceSettingsPatch) => Promise<void>
 }
 
 function GeneralSettingsPanel({ settings, onSave }: GeneralSettingsPanelProps) {
@@ -80,53 +91,103 @@ function GeneralSettingsPanel({ settings, onSave }: GeneralSettingsPanelProps) {
   )
 }
 
-interface RetentionSettingsPanelProps {
-  initialMode: RetentionMode
-  onSave: (patch: Record<string, string>) => Promise<void>
+interface DispatchSettingsPanelProps {
+  initialConfig: MessageDispatchConfig
+  onSave: (patch: WorkspaceSettingsPatch) => Promise<void>
 }
 
-function RetentionSettingsPanel({ initialMode, onSave }: RetentionSettingsPanelProps) {
-  const [retentionMode, setRetentionMode] = useState<RetentionMode>(initialMode)
+function DispatchSettingsPanel({ initialConfig, onSave }: DispatchSettingsPanelProps) {
+  const [mode, setMode] = useState<MessageDispatchMode>(initialConfig.mode)
+  const [storeMessageContent, setStoreMessageContent] = useState(initialConfig.storeMessageContent)
   const [isSaving, setIsSaving] = useState(false)
+  const [saveError, setSaveError] = useState<string | null>(null)
+  const [saveSuccess, setSaveSuccess] = useState(false)
+
+  const currentConfig: MessageDispatchConfig = { mode, storeMessageContent }
+  const isDirty = !dispatchConfigsEqual(currentConfig, initialConfig)
 
   async function handleSave() {
     setIsSaving(true)
+    setSaveError(null)
+    setSaveSuccess(false)
     try {
-      await onSave({ data_retention: retentionMode })
+      await onSave({
+        message_dispatch_mode: mode,
+        store_message_content: toStoreMessageContentSetting(storeMessageContent),
+      })
+      setSaveSuccess(true)
+    } catch (err) {
+      setSaveError(err instanceof Error ? err.message : "Failed to save settings")
     } finally {
       setIsSaving(false)
     }
   }
 
+  function handleModeChange(nextMode: MessageDispatchMode) {
+    setMode(nextMode)
+    setSaveError(null)
+    setSaveSuccess(false)
+  }
+
+  function handleStoreContentChange(checked: boolean) {
+    setStoreMessageContent(checked)
+    setSaveError(null)
+    setSaveSuccess(false)
+  }
+
   return (
-    <div className="flex max-w-xl flex-col gap-4">
-      <RadioOption
-        id="retention-memory"
-        name="retention"
-        label="Memory only"
-        description="Store messages in memory for testing — no persistence."
-        checked={retentionMode === "memory"}
-        onChange={() => setRetentionMode("memory")}
-      />
-      <RadioOption
-        id="retention-both"
-        name="retention"
-        label="Memory + Database"
-        description="Persist messages in the portal inbox and database."
-        checked={retentionMode === "both"}
-        onChange={() => setRetentionMode("both")}
-      />
-      <RadioOption
-        id="retention-providers"
-        name="retention"
-        label="Providers only"
-        description="Send through providers without storing message content."
-        checked={retentionMode === "providers"}
-        onChange={() => setRetentionMode("providers")}
-      />
+    <div className="flex max-w-xl flex-col gap-6">
+      <div className="flex flex-col gap-2">
+        <h2 className="text-sm font-medium text-foreground">Dispatch mode</h2>
+        <p className="text-sm text-text-secondary">Choose where outbound messages are routed.</p>
+        <div className="mt-1 flex flex-col gap-3">
+          <RadioOption
+            id="dispatch-memory"
+            name="dispatch-mode"
+            label="Memory"
+            description="Capture messages in memory for development and testing."
+            checked={mode === "memory"}
+            onChange={() => handleModeChange("memory")}
+          />
+          <RadioOption
+            id="dispatch-provider"
+            name="dispatch-mode"
+            label="Provider"
+            description="Send messages through the connected channel integration."
+            checked={mode === "provider"}
+            onChange={() => handleModeChange("provider")}
+          />
+        </div>
+      </div>
 
-      <Button type="button" onClick={handleSave} disabled={isSaving} className="mt-2 w-fit">
-        {isSaving ? "Saving…" : "Save retention policy"}
+      <div className="flex items-center justify-between gap-4 rounded-lg border border-border p-4">
+        <label htmlFor="store-message-content" className="flex flex-1 cursor-pointer flex-col gap-1">
+          <span className="text-sm font-medium text-foreground">Store message content in inbox</span>
+          <span className="text-sm text-text-secondary">
+            When enabled, message bodies are captured in the portal inbox and shown as Retained in message logs.
+          </span>
+        </label>
+        <Checkbox
+          id="store-message-content"
+          checked={storeMessageContent}
+          onCheckedChange={(checked) => handleStoreContentChange(checked === true)}
+        />
+      </div>
+
+      {saveError ? (
+        <p className="rounded-lg border border-destructive/20 bg-destructive/10 p-3 text-sm text-destructive">
+          {saveError}
+        </p>
+      ) : null}
+
+      {saveSuccess ? (
+        <p className="rounded-lg border border-primary-brand/20 bg-primary-brand/5 p-3 text-sm text-primary-brand">
+          Dispatch settings saved.
+        </p>
+      ) : null}
+
+      <Button type="button" onClick={handleSave} disabled={isSaving || !isDirty} className="w-fit">
+        {isSaving ? "Saving…" : "Save dispatch settings"}
       </Button>
     </div>
   )
@@ -134,22 +195,37 @@ function RetentionSettingsPanel({ initialMode, onSave }: RetentionSettingsPanelP
 
 export function SettingsPage() {
   const { wid = "" } = useParams<{ wid: string }>()
-  const [activeTab, setActiveTab] = useState<SettingsTab>("general")
+  const [searchParams] = useSearchParams()
+  const [activeTab, setActiveTab] = useState<SettingsTab>(() => settingsTabFromSearch(searchParams))
   const [busyKeyId, setBusyKeyId] = useState<string | null>(null)
+  const [createDialogOpen, setCreateDialogOpen] = useState(false)
+  const [revealedSecret, setRevealedSecret] = useState<{
+    clientId?: string
+    clientSecret: string
+  } | null>(null)
 
-  const { settings, apiKeys, retentionMode, isLoading, error, saveSettings, addApiKey, removeApiKey, rotateApiKey } =
+  const { settings, apiKeys, messageDispatchConfig, isLoading, error, saveSettings, addApiKey, removeApiKey, rotateApiKey } =
     useSettings(wid)
 
-  async function handleCreateApiKey() {
-    const name = window.prompt("API key name")
-    if (!name?.trim()) return
-    await addApiKey(name.trim())
+  async function handleCreateApiKey(name: string) {
+    const created = await addApiKey(name)
+    if (created.client_secret) {
+      setRevealedSecret({
+        clientId: created.client_id,
+        clientSecret: created.client_secret,
+      })
+    }
   }
 
   async function handleRegenerate(keyId: string) {
     setBusyKeyId(keyId)
     try {
-      await rotateApiKey(keyId)
+      const result = await rotateApiKey(keyId)
+      const key = apiKeys.find((item) => item.id === keyId)
+      setRevealedSecret({
+        clientId: key?.client_id,
+        clientSecret: result.client_secret,
+      })
     } finally {
       setBusyKeyId(null)
     }
@@ -194,7 +270,7 @@ export function SettingsPage() {
               ["general", "General"],
               ["developer", "Developer"],
               ["team", "Team Management"],
-              ["retention", "Data Retention"],
+              ["dispatch", "Message Dispatch"],
             ] as const
           ).map(([value, label]) => (
             <Tabs.Trigger
@@ -213,6 +289,16 @@ export function SettingsPage() {
 
         <Tabs.Content value="general">
           <GeneralSettingsPanel key={wid} settings={settings} onSave={saveSettings} />
+
+          <section className="mt-4 rounded-lg border border-destructive/30 bg-destructive/5 p-6">
+            <h2 className="text-base font-semibold text-destructive">Danger zone</h2>
+            <p className="mt-1 text-sm text-text-secondary">
+              Permanently delete this workspace and all associated data.
+            </p>
+            <Button type="button" variant="destructive" className="mt-4" disabled>
+              Delete workspace
+            </Button>
+          </section>
         </Tabs.Content>
 
         <Tabs.Content value="developer" className="flex flex-col gap-4">
@@ -223,16 +309,16 @@ export function SettingsPage() {
                 Manage keys used to authenticate gateway requests.
               </p>
             </div>
-            <Button type="button" onClick={handleCreateApiKey}>
+            <Button type="button" onClick={() => setCreateDialogOpen(true)}>
               <Icon name="add" size="sm" />
-              Create key
+              Generate key
             </Button>
           </div>
 
           <div className="overflow-hidden rounded-lg border border-border bg-card">
             {apiKeys.length === 0 ? (
               <p className="px-4 py-8 text-center text-sm text-text-secondary">
-                No API keys yet. Create one to send test requests.
+                No API keys yet. Create one to authenticate gateway requests.
               </p>
             ) : (
               apiKeys.map((key) => (
@@ -256,20 +342,28 @@ export function SettingsPage() {
           </div>
         </Tabs.Content>
 
-        <Tabs.Content value="retention">
-          <RetentionSettingsPanel key={`${wid}-${retentionMode}`} initialMode={retentionMode} onSave={saveSettings} />
+        <Tabs.Content value="dispatch">
+          <DispatchSettingsPanel
+            key={wid}
+            initialConfig={messageDispatchConfig}
+            onSave={saveSettings}
+          />
         </Tabs.Content>
       </Tabs.Root>
 
-      <section className="mt-4 rounded-lg border border-destructive/30 bg-destructive/5 p-6">
-        <h2 className="text-base font-semibold text-destructive">Danger zone</h2>
-        <p className="mt-1 text-sm text-text-secondary">
-          Permanently delete this workspace and all associated data.
-        </p>
-        <Button type="button" variant="destructive" className="mt-4" disabled>
-          Delete workspace
-        </Button>
-      </section>
+      <ApiKeyCreateDialog
+        key={createDialogOpen ? "open" : "closed"}
+        open={createDialogOpen}
+        onClose={() => setCreateDialogOpen(false)}
+        onCreate={handleCreateApiKey}
+      />
+
+      <ApiKeySecretDialog
+        open={revealedSecret !== null}
+        clientId={revealedSecret?.clientId}
+        clientSecret={revealedSecret?.clientSecret ?? ""}
+        onClose={() => setRevealedSecret(null)}
+      />
     </div>
   )
 }
diff --git a/frontend/src/features/settings/settings.api.ts b/frontend/src/features/settings/settings.api.ts
index e008419a..1fcbfb6e 100644
--- a/frontend/src/features/settings/settings.api.ts
+++ b/frontend/src/features/settings/settings.api.ts
@@ -1,35 +1,40 @@
+import { fetchWorkspaceApiKeys } from "@/core/api/workspace-api-keys"
 import { apiFetch } from "@/core/api/client"
 
-import type { ApiKey, WorkspaceSettings } from "./settings.types"
+import { parseWorkspaceSettings } from "./settings.schema"
+import type { ApiKey, WorkspaceSettings, WorkspaceSettingsPatch } from "./settings.types"
+
+async function readApiErrorMessage(res: Response, fallback: string): Promise<string> {
+  try {
+    const body = (await res.json()) as { message?: string }
+    const message = body.message?.trim()
+    return message || fallback
+  } catch {
+    return fallback
+  }
+}
 
 export async function getSettings(workspaceId: string): Promise<WorkspaceSettings> {
   const res = await apiFetch(`/api/v1/workspaces/${workspaceId}/settings`)
   if (!res.ok) {
     throw new Error("Failed to load settings")
   }
-  return (await res.json()) as WorkspaceSettings
+  return parseWorkspaceSettings(await res.json())
 }
 
-export async function patchSettings(
-  workspaceId: string,
-  body: Record<string, string>,
-): Promise<void> {
+export async function patchSettings(workspaceId: string, body: WorkspaceSettingsPatch): Promise<void> {
   const res = await apiFetch(`/api/v1/workspaces/${workspaceId}/settings`, {
     method: "PATCH",
     headers: { "Content-Type": "application/json" },
     body: JSON.stringify(body),
   })
   if (!res.ok) {
-    throw new Error("Failed to save settings")
+    throw new Error(await readApiErrorMessage(res, "Failed to save settings"))
   }
 }
 
 export async function listApiKeys(workspaceId: string): Promise<ApiKey[]> {
-  const res = await apiFetch(`/api/v1/workspaces/${workspaceId}/api-keys`)
-  if (!res.ok) {
-    throw new Error("Failed to load API keys")
-  }
-  return (await res.json()) as ApiKey[]
+  return fetchWorkspaceApiKeys(workspaceId)
 }
 
 export async function createApiKey(
diff --git a/frontend/src/features/settings/settings.schema.test.ts b/frontend/src/features/settings/settings.schema.test.ts
new file mode 100644
index 00000000..3b88e937
--- /dev/null
+++ b/frontend/src/features/settings/settings.schema.test.ts
@@ -0,0 +1,31 @@
+import { describe, expect, it } from "vitest"
+
+import { parseWorkspaceSettings } from "./settings.schema"
+
+describe("parseWorkspaceSettings", () => {
+  it("parses valid workspace settings", () => {
+    const result = parseWorkspaceSettings({
+      owner_email: "owner@example.com",
+      pin_code: "123456",
+      message_dispatch_mode: "provider",
+      store_message_content: "true",
+    })
+
+    expect(result).toEqual({
+      owner_email: "owner@example.com",
+      pin_code: "123456",
+      message_dispatch_mode: "provider",
+      store_message_content: "true",
+    })
+  })
+
+  it("accepts an empty object", () => {
+    expect(parseWorkspaceSettings({})).toEqual({})
+  })
+
+  it("throws when settings contain invalid values", () => {
+    expect(() =>
+      parseWorkspaceSettings({ message_dispatch_mode: "invalid-mode" }),
+    ).toThrow("Invalid settings response from server")
+  })
+})
diff --git a/frontend/src/features/settings/settings.schema.ts b/frontend/src/features/settings/settings.schema.ts
new file mode 100644
index 00000000..8648219c
--- /dev/null
+++ b/frontend/src/features/settings/settings.schema.ts
@@ -0,0 +1,33 @@
+import { z } from "zod"
+
+import { DISPATCH_MODES, STORE_CONTENT_MODES } from "./message-dispatch-mode"
+import type { MessageDispatchMode, StoreMessageContentSetting, WorkspaceSettings } from "./settings.types"
+
+const messageDispatchModeSchema = z.enum(DISPATCH_MODES)
+
+const storeMessageContentSchema = z.enum(STORE_CONTENT_MODES)
+
+export const workspaceSettingsSchema = z.object({
+  owner_email: z.string().optional(),
+  pin_code: z.string().optional(),
+  message_dispatch_mode: messageDispatchModeSchema.optional(),
+  store_message_content: storeMessageContentSchema.optional(),
+})
+
+export function parseWorkspaceSettings(raw: unknown): WorkspaceSettings {
+  const parsed = workspaceSettingsSchema.safeParse(raw)
+  if (!parsed.success) {
+    throw new Error("Invalid settings response from server")
+  }
+  return parsed.data satisfies WorkspaceSettings
+}
+
+export function parseMessageDispatchMode(raw: unknown): MessageDispatchMode {
+  const parsed = messageDispatchModeSchema.safeParse(raw)
+  return parsed.success ? parsed.data : "memory"
+}
+
+export function parseStoreMessageContentSetting(raw: unknown): StoreMessageContentSetting {
+  const parsed = storeMessageContentSchema.safeParse(raw)
+  return parsed.success ? parsed.data : "false"
+}
diff --git a/frontend/src/features/settings/settings.types.ts b/frontend/src/features/settings/settings.types.ts
index 36c905e2..52e8f4e0 100644
--- a/frontend/src/features/settings/settings.types.ts
+++ b/frontend/src/features/settings/settings.types.ts
@@ -1,10 +1,16 @@
+export type MessageDispatchMode = "memory" | "provider"
+
+export type StoreMessageContentSetting = "true" | "false"
+
 export interface WorkspaceSettings {
   owner_email?: string
   pin_code?: string
-  data_retention?: "memory" | "both" | "providers"
-  [key: string]: string | undefined
+  message_dispatch_mode?: MessageDispatchMode
+  store_message_content?: StoreMessageContentSetting
 }
 
+export type WorkspaceSettingsPatch = Partial<Record<keyof WorkspaceSettings, string>>
+
 export interface ApiKey {
   id: string
   workspace_id: string
@@ -16,5 +22,17 @@ export interface ApiKey {
   expires_at?: string | null
 }
 
-export type SettingsTab = "general" | "developer" | "team" | "retention"
-export type RetentionMode = "memory" | "both" | "providers"
+export type SettingsTab = "general" | "developer" | "team" | "dispatch"
+
+export function settingsTabFromSearch(params: URLSearchParams): SettingsTab {
+  const tab = params.get("tab")
+  if (tab === "developer" || tab === "team" || tab === "dispatch" || tab === "general") {
+    return tab
+  }
+  return "general"
+}
+
+export interface MessageDispatchConfig {
+  mode: MessageDispatchMode
+  storeMessageContent: boolean
+}
diff --git a/frontend/src/features/workspaces/layouts/workspace-nav.config.ts b/frontend/src/features/workspaces/layouts/workspace-nav.config.ts
index da4187b0..5f3600b1 100644
--- a/frontend/src/features/workspaces/layouts/workspace-nav.config.ts
+++ b/frontend/src/features/workspaces/layouts/workspace-nav.config.ts
@@ -1,6 +1,9 @@
 import { ROUTES } from "@/core/router/routes"
 
-export type WorkspaceNavSegment = Exclude<keyof typeof ROUTES.workspace, "pattern">
+export type WorkspaceNavSegment = Exclude<
+  keyof typeof ROUTES.workspace,
+  "pattern" | "emailWithMessage"
+>
 
 export function workspaceHref(workspaceId: string, segment: WorkspaceNavSegment) {
   return ROUTES.workspace[segment](workspaceId)
diff --git a/frontend/src/features/workspaces/pages/workspaces.page.test.tsx b/frontend/src/features/workspaces/pages/workspaces.page.test.tsx
new file mode 100644
index 00000000..cffffc63
--- /dev/null
+++ b/frontend/src/features/workspaces/pages/workspaces.page.test.tsx
@@ -0,0 +1,61 @@
+import { render, screen } from "@testing-library/react"
+import { MemoryRouter } from "react-router-dom"
+import { describe, expect, it, vi } from "vitest"
+
+import { useWorkspaces } from "../hooks/use-workspaces.hook"
+import { WorkspacesPage } from "./workspaces.page"
+
+vi.mock("../hooks/use-workspaces.hook", () => ({
+  useWorkspaces: vi.fn(),
+}))
+
+const mockedUseWorkspaces = vi.mocked(useWorkspaces)
+
+describe("WorkspacesPage", () => {
+  it("shows loading spinner while workspaces load", () => {
+    mockedUseWorkspaces.mockReturnValue({
+      workspaces: [],
+      activeWorkspace: null,
+      isLoading: true,
+      error: null,
+      reload: vi.fn(),
+    })
+
+    render(
+      <MemoryRouter>
+        <WorkspacesPage />
+      </MemoryRouter>,
+    )
+
+    expect(screen.getByText(/loading workspaces/i)).toBeInTheDocument()
+  })
+
+  it("renders workspace cards", () => {
+    mockedUseWorkspaces.mockReturnValue({
+      workspaces: [
+        {
+          id: "ws-1",
+          name: "Demo Workspace",
+          slug: "demo",
+          role: "admin",
+          status: "active",
+          visibility: "public",
+          created_at: "2026-01-01T00:00:00Z",
+        },
+      ],
+      activeWorkspace: null,
+      isLoading: false,
+      error: null,
+      reload: vi.fn(),
+    })
+
+    render(
+      <MemoryRouter>
+        <WorkspacesPage />
+      </MemoryRouter>,
+    )
+
+    expect(screen.getByText("Demo Workspace")).toBeInTheDocument()
+    expect(screen.getByPlaceholderText(/search workspaces/i)).toBeInTheDocument()
+  })
+})
diff --git a/frontend/src/shared/components/app-footer/app-footer.stories.tsx b/frontend/src/shared/components/app-footer/app-footer.stories.tsx
new file mode 100644
index 00000000..3f6072ad
--- /dev/null
+++ b/frontend/src/shared/components/app-footer/app-footer.stories.tsx
@@ -0,0 +1,22 @@
+import type { Meta, StoryObj } from "@storybook/react-vite"
+
+import { AppFooter } from "./app-footer"
+
+const meta = {
+  title: "Shared/AppFooter",
+  component: AppFooter,
+  parameters: { layout: "fullscreen" },
+} satisfies Meta<typeof AppFooter>
+
+export default meta
+type Story = StoryObj<typeof meta>
+
+export const Default: Story = {
+  args: {},
+}
+
+export const Dashboard: Story = {
+  args: {
+    variant: "dashboard",
+  },
+}
diff --git a/frontend/src/shared/components/app-footer/app-footer.test.tsx b/frontend/src/shared/components/app-footer/app-footer.test.tsx
new file mode 100644
index 00000000..07d4cc8b
--- /dev/null
+++ b/frontend/src/shared/components/app-footer/app-footer.test.tsx
@@ -0,0 +1,19 @@
+import { render, screen } from "@testing-library/react"
+import { describe, expect, it } from "vitest"
+
+import { AppFooter } from "./app-footer"
+
+describe("AppFooter", () => {
+  it("renders attribution link", () => {
+    render(<AppFooter />)
+
+    const link = screen.getByRole("link", { name: "WeProDev" })
+    expect(link).toHaveAttribute("href", "https://weprodev.com")
+  })
+
+  it("applies dashboard link styling", () => {
+    render(<AppFooter variant="dashboard" />)
+
+    expect(screen.getByRole("link", { name: "WeProDev" })).toHaveClass("text-indigo-400")
+  })
+})
diff --git a/frontend/src/shared/components/app-footer.tsx b/frontend/src/shared/components/app-footer/app-footer.tsx
similarity index 69%
rename from frontend/src/shared/components/app-footer.tsx
rename to frontend/src/shared/components/app-footer/app-footer.tsx
index 565fc16f..923afa9f 100644
--- a/frontend/src/shared/components/app-footer.tsx
+++ b/frontend/src/shared/components/app-footer/app-footer.tsx
@@ -10,13 +10,7 @@ export function AppFooter({ variant = "default" }: AppFooterProps) {
 
   return (
     <footer className="w-full shrink-0 border-t border-divider bg-card">
-      <div
-        className={
-          variant === "dashboard"
-            ? "flex h-16 items-center px-12 py-6"
-            : "flex h-16 items-center justify-between px-12 py-6"
-        }
-      >
+      <div className="flex h-16 items-center justify-between px-12 py-6">
         <p className="text-sm text-text-secondary">
           Developed by{" "}
           <a
@@ -28,9 +22,7 @@ export function AppFooter({ variant = "default" }: AppFooterProps) {
             WeProDev
           </a>
         </p>
-        {variant === "default" ? (
-          <p className="text-sm text-text-tertiary">We develop for grow with growth in mind.</p>
-        ) : null}
+        <p className="text-sm text-text-tertiary">We develop for growth, with growth in mind!</p>
       </div>
     </footer>
   )
diff --git a/frontend/src/shared/components/app-footer/index.ts b/frontend/src/shared/components/app-footer/index.ts
new file mode 100644
index 00000000..5bc775e5
--- /dev/null
+++ b/frontend/src/shared/components/app-footer/index.ts
@@ -0,0 +1 @@
+export { AppFooter } from "./app-footer"
diff --git a/frontend/src/shared/components/app-header/app-header.stories.tsx b/frontend/src/shared/components/app-header/app-header.stories.tsx
new file mode 100644
index 00000000..b80e7aea
--- /dev/null
+++ b/frontend/src/shared/components/app-header/app-header.stories.tsx
@@ -0,0 +1,27 @@
+import type { Meta, StoryObj } from "@storybook/react-vite"
+import { MemoryRouter } from "react-router-dom"
+
+import { ThemeProvider } from "@/shared/context/theme-context"
+import { AppHeader } from "./app-header"
+
+const meta = {
+  title: "Shared/AppHeader",
+  component: AppHeader,
+  parameters: { layout: "fullscreen" },
+  decorators: [
+    (Story) => (
+      <MemoryRouter>
+        <ThemeProvider>
+          <Story />
+        </ThemeProvider>
+      </MemoryRouter>
+    ),
+  ],
+} satisfies Meta<typeof AppHeader>
+
+export default meta
+type Story = StoryObj<typeof meta>
+
+export const Default: Story = {
+  args: {},
+}
diff --git a/frontend/src/shared/components/app-header/app-header.test.tsx b/frontend/src/shared/components/app-header/app-header.test.tsx
new file mode 100644
index 00000000..1de5f2aa
--- /dev/null
+++ b/frontend/src/shared/components/app-header/app-header.test.tsx
@@ -0,0 +1,49 @@
+import { render, screen } from "@testing-library/react"
+import userEvent from "@testing-library/user-event"
+import { describe, expect, it, vi } from "vitest"
+import { MemoryRouter } from "react-router-dom"
+
+import { AppHeader } from "./app-header"
+
+const { navigate, setToken } = vi.hoisted(() => ({
+  navigate: vi.fn(),
+  setToken: vi.fn(),
+}))
+
+vi.mock("react-router-dom", async () => {
+  const actual = await vi.importActual<typeof import("react-router-dom")>("react-router-dom")
+  return {
+    ...actual,
+    useNavigate: () => navigate,
+  }
+})
+
+vi.mock("@/core/api/client", () => ({
+  getToken: vi.fn(() => "portal-jwt"),
+  setToken,
+}))
+
+vi.mock("@/shared/context/theme-context", () => ({
+  useTheme: () => ({
+    theme: "light",
+    toggleTheme: vi.fn(),
+  }),
+}))
+
+describe("AppHeader", () => {
+  it("renders brand and sign out when authenticated", async () => {
+    const user = userEvent.setup()
+
+    render(
+      <MemoryRouter>
+        <AppHeader />
+      </MemoryRouter>,
+    )
+
+    expect(screen.getByText("Message Gateway")).toBeInTheDocument()
+    await user.click(screen.getByRole("button", { name: /sign out/i }))
+
+    expect(setToken).toHaveBeenCalledWith(null)
+    expect(navigate).toHaveBeenCalled()
+  })
+})
diff --git a/frontend/src/shared/components/app-header.tsx b/frontend/src/shared/components/app-header/app-header.tsx
similarity index 93%
rename from frontend/src/shared/components/app-header.tsx
rename to frontend/src/shared/components/app-header/app-header.tsx
index 3714e45d..7095879c 100644
--- a/frontend/src/shared/components/app-header.tsx
+++ b/frontend/src/shared/components/app-header/app-header.tsx
@@ -2,8 +2,8 @@ import { useNavigate } from "react-router-dom"
 import { getToken, setToken } from "@/core/api/client"
 import { ROUTES } from "@/core/router/routes"
 import { Icon } from "@/components/ui/icon"
-import { MessageGatewayLogo } from "./message-gateway-logo"
-import { ThemeToggle } from "./theme-toggle"
+import { MessageGatewayLogo } from "../message-gateway-logo"
+import { ThemeToggle } from "../theme-toggle"
 
 function BrandText() {
   return (
diff --git a/frontend/src/shared/components/app-header/index.ts b/frontend/src/shared/components/app-header/index.ts
new file mode 100644
index 00000000..fa53cb1a
--- /dev/null
+++ b/frontend/src/shared/components/app-header/index.ts
@@ -0,0 +1 @@
+export { AppHeader } from "./app-header"
diff --git a/frontend/src/shared/components/auth-card/auth-card.stories.tsx b/frontend/src/shared/components/auth-card/auth-card.stories.tsx
new file mode 100644
index 00000000..6d1e64d8
--- /dev/null
+++ b/frontend/src/shared/components/auth-card/auth-card.stories.tsx
@@ -0,0 +1,23 @@
+import type { Meta, StoryObj } from "@storybook/react-vite"
+
+import { AuthCard } from "./auth-card"
+
+const meta = {
+  title: "Shared/AuthCard",
+  component: AuthCard,
+  parameters: { layout: "centered" },
+} satisfies Meta<typeof AuthCard>
+
+export default meta
+type Story = StoryObj<typeof meta>
+
+export const Default: Story = {
+  args: {
+    children: (
+      <>
+        <h2 className="text-lg font-semibold text-foreground">Sign in</h2>
+        <p className="mt-2 text-sm text-text-secondary">Use your portal credentials.</p>
+      </>
+    ),
+  },
+}
diff --git a/frontend/src/shared/components/auth-card/auth-card.test.tsx b/frontend/src/shared/components/auth-card/auth-card.test.tsx
new file mode 100644
index 00000000..18b755f1
--- /dev/null
+++ b/frontend/src/shared/components/auth-card/auth-card.test.tsx
@@ -0,0 +1,16 @@
+import { render, screen } from "@testing-library/react"
+import { describe, expect, it } from "vitest"
+
+import { AuthCard } from "./auth-card"
+
+describe("AuthCard", () => {
+  it("renders children inside the card container", () => {
+    render(
+      <AuthCard>
+        <p>Portal login</p>
+      </AuthCard>,
+    )
+
+    expect(screen.getByText("Portal login")).toBeInTheDocument()
+  })
+})
diff --git a/frontend/src/shared/components/auth-card.tsx b/frontend/src/shared/components/auth-card/auth-card.tsx
similarity index 100%
rename from frontend/src/shared/components/auth-card.tsx
rename to frontend/src/shared/components/auth-card/auth-card.tsx
diff --git a/frontend/src/shared/components/auth-card/index.ts b/frontend/src/shared/components/auth-card/index.ts
new file mode 100644
index 00000000..3c0caff1
--- /dev/null
+++ b/frontend/src/shared/components/auth-card/index.ts
@@ -0,0 +1 @@
+export { AuthCard } from "./auth-card"
diff --git a/frontend/src/shared/components/message-gateway-logo/index.ts b/frontend/src/shared/components/message-gateway-logo/index.ts
new file mode 100644
index 00000000..0ff7b3a6
--- /dev/null
+++ b/frontend/src/shared/components/message-gateway-logo/index.ts
@@ -0,0 +1 @@
+export { MessageGatewayLogo } from "./message-gateway-logo"
diff --git a/frontend/src/shared/components/message-gateway-logo/message-gateway-logo.stories.tsx b/frontend/src/shared/components/message-gateway-logo/message-gateway-logo.stories.tsx
new file mode 100644
index 00000000..33753fba
--- /dev/null
+++ b/frontend/src/shared/components/message-gateway-logo/message-gateway-logo.stories.tsx
@@ -0,0 +1,16 @@
+import type { Meta, StoryObj } from "@storybook/react-vite"
+
+import { MessageGatewayLogo } from "./message-gateway-logo"
+
+const meta = {
+  title: "Shared/MessageGatewayLogo",
+  component: MessageGatewayLogo,
+  parameters: { layout: "centered" },
+} satisfies Meta<typeof MessageGatewayLogo>
+
+export default meta
+type Story = StoryObj<typeof meta>
+
+export const Default: Story = {
+  args: {},
+}
diff --git a/frontend/src/shared/components/message-gateway-logo/message-gateway-logo.test.tsx b/frontend/src/shared/components/message-gateway-logo/message-gateway-logo.test.tsx
new file mode 100644
index 00000000..7cd13ae8
--- /dev/null
+++ b/frontend/src/shared/components/message-gateway-logo/message-gateway-logo.test.tsx
@@ -0,0 +1,11 @@
+import { render } from "@testing-library/react"
+import { describe, expect, it } from "vitest"
+
+import { MessageGatewayLogo } from "./message-gateway-logo"
+
+describe("MessageGatewayLogo", () => {
+  it("renders decorative logo markup", () => {
+    const { container } = render(<MessageGatewayLogo />)
+    expect(container.querySelector('[aria-hidden="true"]')).toBeInTheDocument()
+  })
+})
diff --git a/frontend/src/shared/components/message-gateway-logo.tsx b/frontend/src/shared/components/message-gateway-logo/message-gateway-logo.tsx
similarity index 100%
rename from frontend/src/shared/components/message-gateway-logo.tsx
rename to frontend/src/shared/components/message-gateway-logo/message-gateway-logo.tsx
diff --git a/frontend/src/shared/components/page-header/index.ts b/frontend/src/shared/components/page-header/index.ts
new file mode 100644
index 00000000..48f3bfa2
--- /dev/null
+++ b/frontend/src/shared/components/page-header/index.ts
@@ -0,0 +1 @@
+export { PageHeader } from "./page-header"
diff --git a/frontend/src/shared/components/page-header/page-header.stories.tsx b/frontend/src/shared/components/page-header/page-header.stories.tsx
new file mode 100644
index 00000000..713227a4
--- /dev/null
+++ b/frontend/src/shared/components/page-header/page-header.stories.tsx
@@ -0,0 +1,25 @@
+import type { Meta, StoryObj } from "@storybook/react-vite"
+
+import { PageHeader } from "./page-header"
+
+const meta = {
+  title: "Shared/PageHeader",
+  component: PageHeader,
+  parameters: { layout: "padded" },
+} satisfies Meta<typeof PageHeader>
+
+export default meta
+type Story = StoryObj<typeof meta>
+
+export const WithDescription: Story = {
+  args: {
+    title: "Settings",
+    description: "Manage your workspace settings and preferences.",
+  },
+}
+
+export const TitleOnly: Story = {
+  args: {
+    title: "Overview",
+  },
+}
diff --git a/frontend/src/shared/components/page-header/page-header.test.tsx b/frontend/src/shared/components/page-header/page-header.test.tsx
new file mode 100644
index 00000000..0cee8d7d
--- /dev/null
+++ b/frontend/src/shared/components/page-header/page-header.test.tsx
@@ -0,0 +1,13 @@
+import { render, screen } from "@testing-library/react"
+import { describe, expect, it } from "vitest"
+
+import { PageHeader } from "./page-header"
+
+describe("PageHeader", () => {
+  it("renders title and optional description", () => {
+    render(<PageHeader title="Settings" description="Manage workspace settings." />)
+
+    expect(screen.getByRole("heading", { name: "Settings" })).toBeInTheDocument()
+    expect(screen.getByText("Manage workspace settings.")).toBeInTheDocument()
+  })
+})
diff --git a/frontend/src/shared/components/page-header.tsx b/frontend/src/shared/components/page-header/page-header.tsx
similarity index 100%
rename from frontend/src/shared/components/page-header.tsx
rename to frontend/src/shared/components/page-header/page-header.tsx
diff --git a/frontend/src/shared/components/theme-toggle/index.ts b/frontend/src/shared/components/theme-toggle/index.ts
new file mode 100644
index 00000000..28635163
--- /dev/null
+++ b/frontend/src/shared/components/theme-toggle/index.ts
@@ -0,0 +1 @@
+export { ThemeToggle } from "./theme-toggle"
diff --git a/frontend/src/shared/components/theme-toggle/theme-toggle.stories.tsx b/frontend/src/shared/components/theme-toggle/theme-toggle.stories.tsx
new file mode 100644
index 00000000..1b46992c
--- /dev/null
+++ b/frontend/src/shared/components/theme-toggle/theme-toggle.stories.tsx
@@ -0,0 +1,24 @@
+import type { Meta, StoryObj } from "@storybook/react-vite"
+
+import { ThemeProvider } from "@/shared/context/theme-context"
+import { ThemeToggle } from "./theme-toggle"
+
+const meta = {
+  title: "Shared/ThemeToggle",
+  component: ThemeToggle,
+  parameters: { layout: "centered" },
+  decorators: [
+    (Story) => (
+      <ThemeProvider>
+        <Story />
+      </ThemeProvider>
+    ),
+  ],
+} satisfies Meta<typeof ThemeToggle>
+
+export default meta
+type Story = StoryObj<typeof meta>
+
+export const Default: Story = {
+  args: {},
+}
diff --git a/frontend/src/shared/components/theme-toggle/theme-toggle.test.tsx b/frontend/src/shared/components/theme-toggle/theme-toggle.test.tsx
new file mode 100644
index 00000000..c4ad6bd3
--- /dev/null
+++ b/frontend/src/shared/components/theme-toggle/theme-toggle.test.tsx
@@ -0,0 +1,27 @@
+import { render, screen } from "@testing-library/react"
+import userEvent from "@testing-library/user-event"
+import { describe, expect, it, vi } from "vitest"
+
+import { ThemeToggle } from "./theme-toggle"
+
+const { toggleTheme } = vi.hoisted(() => ({
+  toggleTheme: vi.fn(),
+}))
+
+vi.mock("@/shared/context/theme-context", () => ({
+  useTheme: () => ({
+    theme: "light",
+    toggleTheme,
+  }),
+}))
+
+describe("ThemeToggle", () => {
+  it("calls toggleTheme when clicked", async () => {
+    const user = userEvent.setup()
+
+    render(<ThemeToggle />)
+
+    await user.click(screen.getByRole("button", { name: /toggle theme/i }))
+    expect(toggleTheme).toHaveBeenCalledTimes(1)
+  })
+})
diff --git a/frontend/src/shared/components/theme-toggle.tsx b/frontend/src/shared/components/theme-toggle/theme-toggle.tsx
similarity index 100%
rename from frontend/src/shared/components/theme-toggle.tsx
rename to frontend/src/shared/components/theme-toggle/theme-toggle.tsx
diff --git a/frontend/vite.config.ts b/frontend/vite.config.ts
index c05ca2df..434f5fef 100644
--- a/frontend/vite.config.ts
+++ b/frontend/vite.config.ts
@@ -23,5 +23,6 @@ export default defineConfig({
     globals: true,
     environment: "jsdom",
     setupFiles: "./src/test-setup.ts",
+    pool: "forks",
   },
 })
diff --git a/go.mod b/go.mod
index 7308a108..f7370503 100644
--- a/go.mod
+++ b/go.mod
@@ -7,6 +7,7 @@ require (
 	github.com/golang-jwt/jwt/v5 v5.3.1
 	github.com/google/uuid v1.6.0
 	github.com/labstack/echo/v4 v4.15.4
+	github.com/lib/pq v1.12.3
 	github.com/mailgun/mailgun-go/v4 v4.23.0
 	github.com/weprodev/wpd-gogate v1.2.1
 	gopkg.in/yaml.v3 v3.0.1
@@ -20,7 +21,6 @@ require (
 	github.com/go-playground/validator/v10 v10.30.3 // indirect
 	github.com/gorilla/css v1.0.1 // indirect
 	github.com/leodido/go-urn v1.4.0 // indirect
-	github.com/lib/pq v1.12.3 // indirect
 	github.com/microcosm-cc/bluemonday v1.0.27 // indirect
 	golang.org/x/crypto v0.53.0 // indirect
 )
@@ -36,7 +36,7 @@ require (
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/valyala/bytebufferpool v1.0.0 // indirect
 	github.com/valyala/fasttemplate v1.2.2 // indirect
-	github.com/weprodev/go-pkg v1.1.2
+	github.com/weprodev/go-pkg v1.1.3
 	golang.org/x/net v0.56.0 // indirect
 	golang.org/x/sys v0.46.0 // indirect
 	golang.org/x/text v0.38.0 // indirect
diff --git a/go.sum b/go.sum
index 51e3986c..7a5516e2 100644
--- a/go.sum
+++ b/go.sum
@@ -62,8 +62,8 @@ github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6Kllzaw
 github.com/valyala/bytebufferpool v1.0.0/go.mod h1:6bBcMArwyJ5K/AmCkWv1jt77kVWyCJ6HpOuEn7z0Csc=
 github.com/valyala/fasttemplate v1.2.2 h1:lxLXG0uE3Qnshl9QyaK6XJxMXlQZELvChBOCmQD0Loo=
 github.com/valyala/fasttemplate v1.2.2/go.mod h1:KHLXt3tVN2HBp8eijSv/kGJopbvo7S+qRAEEKiv+SiQ=
-github.com/weprodev/go-pkg v1.1.2 h1:hJeur+RdOF2V3J/I4UVgU1MYzvS2yLrv5LwtgSFEVQ0=
-github.com/weprodev/go-pkg v1.1.2/go.mod h1:Ss7+njNjzZfuXmqyxDtdP2UDMPSGKSWhcDwj4Ff5Ku4=
+github.com/weprodev/go-pkg v1.1.3 h1:umSU1kOJHVwhA26ZZ2JTyzE8A1zLCgmhIP3KqwwD2h8=
+github.com/weprodev/go-pkg v1.1.3/go.mod h1:9mI7PkAE/ZiDq16Mw9pc/xL3xmtcSUcbEKe727q2pGc=
 github.com/weprodev/wpd-gogate v1.2.1 h1:ZVXi3BkNuh/tUlcPzJGI+XpuolloD2f7E8RPsnIMHc0=
 github.com/weprodev/wpd-gogate v1.2.1/go.mod h1:Qj0XfD795g1ZW7X9pSaspBujiyhHrBA9ok41YhjrCdA=
 golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto=
diff --git a/internal/app/config.go b/internal/app/config.go
index b0c155ac..89b67ff9 100644
--- a/internal/app/config.go
+++ b/internal/app/config.go
@@ -2,6 +2,7 @@ package app
 
 import (
 	"fmt"
+	"log/slog"
 	"os"
 	"strings"
 
@@ -67,15 +68,51 @@ func (c *Config) DefaultSMSProvider() string   { return c.Providers.Defaults.SMS
 func (c *Config) DefaultPushProvider() string  { return c.Providers.Defaults.Push }
 func (c *Config) DefaultChatProvider() string  { return c.Providers.Defaults.Chat }
 
-// LoadConfig loads configuration from a YAML file.
-func LoadConfig(path string) (*Config, error) {
-	if path == "" {
-		path = "configs/local.yml"
+const defaultServerPort = 10101
+
+// EnvironmentName returns the runtime environment (config file, then APP_ENVIRONMENT, then local).
+func (c *Config) EnvironmentName() string {
+	if c != nil && c.Environment != "" {
+		return c.Environment
+	}
+	if v := os.Getenv("APP_ENVIRONMENT"); v != "" {
+		return v
+	}
+	return "local"
+}
+
+// ListenAddr returns the HTTP listen address for the gateway server.
+func (c *Config) ListenAddr() string {
+	port := defaultServerPort
+	if c != nil && c.Server.Port > 0 {
+		port = c.Server.Port
 	}
+	return fmt.Sprintf(":%d", port)
+}
 
-	data, err := os.ReadFile(path)
+// LogSummary logs a non-secret snapshot of loaded configuration at startup.
+func (c *Config) LogSummary() {
+	if c == nil {
+		return
+	}
+	slog.Info("loaded configuration",
+		"environment", c.EnvironmentName(),
+		"listen_addr", c.ListenAddr(),
+		"email_provider", c.DefaultEmailProvider(),
+		"sms_provider", c.DefaultSMSProvider(),
+		"push_provider", c.DefaultPushProvider(),
+		"chat_provider", c.DefaultChatProvider(),
+	)
+}
+
+// LoadAppConfig loads configuration from YAML, applying env overrides.
+// When configPath is empty, resolves via CONFIG_PATH, container paths, or configs/local.yml.
+func LoadAppConfig(configPath string) (*Config, error) {
+	configPath = resolveConfigPath(configPath)
+
+	data, err := os.ReadFile(configPath)
 	if err != nil {
-		return nil, fmt.Errorf("failed to read config file %s: %w", path, err)
+		return nil, fmt.Errorf("error reading config file %s: %w", configPath, err)
 	}
 
 	cfg := &Config{
@@ -86,7 +123,7 @@ func LoadConfig(path string) (*Config, error) {
 	}
 
 	if err := yaml.Unmarshal(data, cfg); err != nil {
-		return nil, fmt.Errorf("failed to parse config file %s: %w", path, err)
+		return nil, fmt.Errorf("error parsing config file %s: %w", configPath, err)
 	}
 
 	cfg.applyEnvOverrides()
@@ -95,6 +132,38 @@ func LoadConfig(path string) (*Config, error) {
 	return cfg, nil
 }
 
+// resolveConfigPath returns an explicit path or discovers one from env/container defaults.
+func resolveConfigPath(configPath string) string {
+	if configPath != "" {
+		return configPath
+	}
+	if v := os.Getenv("CONFIG_PATH"); v != "" {
+		return v
+	}
+
+	env := os.Getenv("APP_ENVIRONMENT")
+	if env == "" {
+		env = os.Getenv("ENVIRONMENT")
+	}
+	if env == "" {
+		env = "local"
+	}
+
+	for _, candidate := range []string{
+		fmt.Sprintf("/configs/%s.yml", env),
+		"/configs/local.yml",
+		"/configs/config.yml",
+		"configs/local.yml",
+		"configs/local.example.yml",
+	} {
+		if _, err := os.Stat(candidate); err == nil {
+			return candidate
+		}
+	}
+
+	return "configs/local.yml"
+}
+
 // applyEnvOverrides applies environment variable overrides.
 func (c *Config) applyEnvOverrides() {
 	if port := os.Getenv("PORT"); port != "" {
diff --git a/internal/app/config_test.go b/internal/app/config_test.go
new file mode 100644
index 00000000..a1e54590
--- /dev/null
+++ b/internal/app/config_test.go
@@ -0,0 +1,43 @@
+package app
+
+import "testing"
+
+func TestResolveConfigPath(t *testing.T) {
+	t.Setenv("CONFIG_PATH", "")
+
+	if got := resolveConfigPath("configs/custom.yml"); got != "configs/custom.yml" {
+		t.Fatalf("explicit path: got %q", got)
+	}
+
+	t.Setenv("CONFIG_PATH", "configs/from-env.yml")
+	if got := resolveConfigPath(""); got != "configs/from-env.yml" {
+		t.Fatalf("CONFIG_PATH: got %q", got)
+	}
+}
+
+func TestConfig_ListenAddr(t *testing.T) {
+	cfg := &Config{Server: ServerConfig{Port: 8080}}
+	if got := cfg.ListenAddr(); got != ":8080" {
+		t.Fatalf("got %q", got)
+	}
+
+	cfg.Server.Port = 0
+	if got := cfg.ListenAddr(); got != ":10101" {
+		t.Fatalf("default port: got %q", got)
+	}
+}
+
+func TestConfig_EnvironmentName(t *testing.T) {
+	t.Setenv("APP_ENVIRONMENT", "")
+
+	cfg := &Config{Environment: "staging"}
+	if got := cfg.EnvironmentName(); got != "staging" {
+		t.Fatalf("from config: got %q", got)
+	}
+
+	cfg.Environment = ""
+	t.Setenv("APP_ENVIRONMENT", "test")
+	if got := cfg.EnvironmentName(); got != "test" {
+		t.Fatalf("from env: got %q", got)
+	}
+}
diff --git a/internal/app/shutdown.go b/internal/app/shutdown.go
new file mode 100644
index 00000000..8f7a7281
--- /dev/null
+++ b/internal/app/shutdown.go
@@ -0,0 +1,29 @@
+package app
+
+import (
+	"context"
+	"fmt"
+)
+
+// Shutdown stops the HTTP server and closes the database connection pool.
+func (a *Application) Shutdown(ctx context.Context) error {
+	if a == nil {
+		return nil
+	}
+
+	var shutdownErr error
+	if a.Echo != nil {
+		if err := a.Echo.Shutdown(ctx); err != nil {
+			shutdownErr = fmt.Errorf("echo shutdown: %w", err)
+		}
+	}
+	if a.PgClient != nil {
+		if err := a.PgClient.Close(); err != nil {
+			if shutdownErr != nil {
+				return fmt.Errorf("%v; pg close: %w", shutdownErr, err)
+			}
+			return fmt.Errorf("pg close: %w", err)
+		}
+	}
+	return shutdownErr
+}
diff --git a/internal/app/wire.go b/internal/app/wire.go
index f76403c2..da385f32 100644
--- a/internal/app/wire.go
+++ b/internal/app/wire.go
@@ -16,8 +16,10 @@ import (
 
 	gogate "github.com/weprodev/wpd-gogate"
 
+	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
 	"github.com/weprodev/wpd-message-gateway/internal/core/service"
 	"github.com/weprodev/wpd-message-gateway/internal/infrastructure/authgate"
+	"github.com/weprodev/wpd-message-gateway/internal/infrastructure/database"
 	"github.com/weprodev/wpd-message-gateway/internal/infrastructure/inbox"
 	"github.com/weprodev/wpd-message-gateway/internal/infrastructure/repository/postgres"
 	"github.com/weprodev/wpd-message-gateway/internal/presentation"
@@ -61,12 +63,18 @@ func Wire(cfg *Config, sysLogger *pkglogger.Logger) (*Application, error) {
 		return nil, fmt.Errorf("connect to database: %w", err)
 	}
 
+	if err := database.ApplySeeds(startCtx, pgClient.GetDB(startCtx), database.SeedsDir()); err != nil {
+		return nil, fmt.Errorf("apply database seeds: %w", err)
+	}
+
 	// ── RBAC Gate ───────────────────────────────────────────────────────────
-	gateEngine := gogate.NewGate(pgClient.GetDB(startCtx), nil)
+	gateCfg := gogate.DefaultConfig()
+	gateCfg.DefaultGuardName = domain.RBACGuardName
+	gateEngine := gogate.NewGate(pgClient.GetDB(startCtx), &gateCfg)
 	if err := gateEngine.LoadPolicy(startCtx); err != nil {
 		return nil, fmt.Errorf("load RBAC policies: %w", err)
 	}
-	authGate := authgate.NewGoGateAdapter(gateEngine)
+	authGate := authgate.NewGoGateAdapter(gateEngine, pgClient.GetDB(startCtx))
 
 	// ── Encryption service ──────────────────────────────────────────────────
 	encKey := cfg.EncryptionKey
@@ -121,10 +129,22 @@ func Wire(cfg *Config, sysLogger *pkglogger.Logger) (*Application, error) {
 		Gate:         authGate,
 	})
 
-	// ── Memory store & inbox writer ─────────────────────────────────────────
+	// ── Inbox: payload-backed reads, in-memory writes for SSE ───────────────
 	inboxStore := inbox.NewStore()
+	inboxReader := postgres.NewPayloadInboxReader(pgClient, inboxStore)
 	memoryStore := memory.GetStore()
 
+	var publishInboxEvent inbox.PublishFunc
+	inboxWriter := inbox.NewNotifyingWriter(inboxStore, inbox.PublishFunc(func(workspaceID, eventType string, data any) {
+		if publishInboxEvent != nil {
+			publishInboxEvent(workspaceID, eventType, data)
+		}
+	}))
+	portalInboxHandler := handler.NewPortalInboxHandler(inboxReader, inboxWriter)
+	publishInboxEvent = func(workspaceID, eventType string, data any) {
+		portalInboxHandler.PublishInboxEvent(workspaceID, eventType, data)
+	}
+
 	// ── Auth service ──────────────────────────────────────────────────────
 	authService := service.NewAuthService(
 		userRepo,
@@ -137,16 +157,15 @@ func Wire(cfg *Config, sysLogger *pkglogger.Logger) (*Application, error) {
 	)
 
 	// ── Gateway service ─────────────────────────────────────────────────────
-	gatewaySvc := service.NewGatewayService(intgRepo, tmplRepo, settingsRepo, inboxStore, logRepo)
+	gatewaySvc := service.NewGatewayService(intgRepo, tmplRepo, settingsRepo, inboxWriter, logRepo)
 
 	// ── Handlers ─────────────────────────────────────────────────────────────
 	// Portal is always enabled — configuration, templates, and inbox require it.
-	portalHandler := handler.NewPortalHandler(portalSvc, gatewaySvc, logRepo)
+	portalHandler := handler.NewPortalHandler(portalSvc)
 	portalAuthHandler := handler.NewPortalAuthHandler(portalSvc, authService)
 	portalWorkspaceHandler := handler.NewPortalWorkspaceHandler(portalSvc)
 	portalIntegrationHandler := handler.NewPortalIntegrationHandler(portalSvc)
 	portalTemplateHandler := handler.NewPortalTemplateHandler(portalSvc)
-	portalInboxHandler := handler.NewPortalInboxHandler(inboxStore, inboxStore)
 	gatewayHandler := handler.NewGatewayHandler(gatewaySvc)
 
 	// ── Router ──────────────────────────────────────────────────────────────
diff --git a/internal/core/domain/dispatch_mode.go b/internal/core/domain/dispatch_mode.go
index 01c4c627..eb40866d 100644
--- a/internal/core/domain/dispatch_mode.go
+++ b/internal/core/domain/dispatch_mode.go
@@ -1,32 +1,89 @@
 package domain
 
-// Workspace setting key for how outbound messages are handled relative to memory vs providers.
-const SettingKeyMessageDispatchMode = "message_dispatch_mode"
+import (
+	"errors"
+	"fmt"
+	"strings"
+)
+
+var ErrInvalidSettingValue = errors.New("invalid setting value")
+
+const (
+	// SettingKeyMessageDispatchMode controls memory capture vs integration dispatch.
+	SettingKeyMessageDispatchMode = "message_dispatch_mode"
+	// SettingKeyStoreMessageContent controls whether message content is captured in the inbox.
+	SettingKeyStoreMessageContent = "store_message_content"
+)
 
-// MessageDispatchMode controls memory capture vs integration dispatch for each workspace.
-// Provider configs live in DB (integrations); memory is always available as a capture path.
+// MessageDispatchMode represents where the outbound message is routed.
 type MessageDispatchMode string
 
 const (
-	// DispatchProviderOnly sends only through the connected integration; nothing is kept in process memory.
-	DispatchProviderOnly MessageDispatchMode = "provider_only"
-	// DispatchMemoryAndProvider stores in memory and sends through the integration.
-	DispatchMemoryAndProvider MessageDispatchMode = "memory_and_provider"
-	// DispatchMemoryOnly keeps messages in memory only; external providers are not called.
-	DispatchMemoryOnly MessageDispatchMode = "memory_only"
+	// DispatchProvider sends through the connected integration.
+	DispatchProvider MessageDispatchMode = "provider"
+	// DispatchMemory keeps messages in memory only; external providers are not called.
+	DispatchMemory MessageDispatchMode = "memory"
 )
 
-// DefaultMessageDispatchMode is used when workspace_settings has no value (matches portal “safe dev” default).
+// DefaultMessageDispatchMode is used when workspace_settings has no value.
 func DefaultMessageDispatchMode() MessageDispatchMode {
-	return DispatchMemoryOnly
+	return DispatchMemory
 }
 
-// ParseMessageDispatchMode returns the mode if s is valid.
+// ParseMessageDispatchMode returns the mode if s is a valid dispatch mode string.
 func ParseMessageDispatchMode(s string) (MessageDispatchMode, bool) {
-	switch MessageDispatchMode(s) {
-	case DispatchProviderOnly, DispatchMemoryAndProvider, DispatchMemoryOnly:
-		return MessageDispatchMode(s), true
+	switch MessageDispatchMode(strings.TrimSpace(s)) {
+	case DispatchProvider, DispatchMemory:
+		return MessageDispatchMode(strings.TrimSpace(s)), true
 	default:
 		return "", false
 	}
 }
+
+// MessageDispatchConfig holds dispatch routing and inbox content capture settings.
+type MessageDispatchConfig struct {
+	Mode                MessageDispatchMode
+	StoreMessageContent bool
+}
+
+// RoutesViaProvider reports whether outbound traffic should use an integration.
+func (c MessageDispatchConfig) RoutesViaProvider() bool {
+	return c.Mode == DispatchProvider
+}
+
+// ShouldCaptureToInbox reports whether message content should be written to the portal inbox.
+func (c MessageDispatchConfig) ShouldCaptureToInbox() bool {
+	return c.StoreMessageContent
+}
+
+// ResolveMessageDispatchConfig reads canonical workspace setting values.
+func ResolveMessageDispatchConfig(modeVal, storeVal string) MessageDispatchConfig {
+	config := MessageDispatchConfig{
+		Mode:                DefaultMessageDispatchMode(),
+		StoreMessageContent: false,
+	}
+	if mode, ok := ParseMessageDispatchMode(modeVal); ok {
+		config.Mode = mode
+	}
+	if strings.TrimSpace(storeVal) == "true" {
+		config.StoreMessageContent = true
+	}
+	return config
+}
+
+// ValidateWorkspaceSettingValue validates known workspace setting keys.
+func ValidateWorkspaceSettingValue(key, value string) error {
+	switch key {
+	case SettingKeyMessageDispatchMode:
+		if _, ok := ParseMessageDispatchMode(value); !ok {
+			return fmt.Errorf("%w: message_dispatch_mode must be memory or provider", ErrInvalidSettingValue)
+		}
+	case SettingKeyStoreMessageContent:
+		switch strings.TrimSpace(value) {
+		case "true", "false":
+		default:
+			return fmt.Errorf("%w: store_message_content must be true or false", ErrInvalidSettingValue)
+		}
+	}
+	return nil
+}
diff --git a/internal/core/domain/dispatch_mode_test.go b/internal/core/domain/dispatch_mode_test.go
new file mode 100644
index 00000000..0e131fc6
--- /dev/null
+++ b/internal/core/domain/dispatch_mode_test.go
@@ -0,0 +1,110 @@
+package domain
+
+import (
+	"errors"
+	"testing"
+)
+
+func TestDefaultMessageDispatchMode(t *testing.T) {
+	if got := DefaultMessageDispatchMode(); got != DispatchMemory {
+		t.Fatalf("got %q, want %q", got, DispatchMemory)
+	}
+}
+
+func TestParseMessageDispatchMode(t *testing.T) {
+	tests := []struct {
+		value string
+		want  MessageDispatchMode
+		ok    bool
+	}{
+		{"memory", DispatchMemory, true},
+		{"provider", DispatchProvider, true},
+		{" memory ", DispatchMemory, true},
+		{"unknown", "", false},
+		{"", "", false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.value, func(t *testing.T) {
+			got, ok := ParseMessageDispatchMode(tt.value)
+			if ok != tt.ok {
+				t.Fatalf("ok = %v, want %v", ok, tt.ok)
+			}
+			if got != tt.want {
+				t.Fatalf("got %q, want %q", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestResolveMessageDispatchConfig(t *testing.T) {
+	tests := []struct {
+		name     string
+		modeVal  string
+		storeVal string
+		want     MessageDispatchConfig
+	}{
+		{"defaults", "", "", MessageDispatchConfig{Mode: DispatchMemory, StoreMessageContent: false}},
+		{"memory without store", "memory", "false", MessageDispatchConfig{Mode: DispatchMemory, StoreMessageContent: false}},
+		{"provider with store", "provider", "true", MessageDispatchConfig{Mode: DispatchProvider, StoreMessageContent: true}},
+		{"invalid mode uses default", "unknown", "true", MessageDispatchConfig{Mode: DispatchMemory, StoreMessageContent: true}},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := ResolveMessageDispatchConfig(tt.modeVal, tt.storeVal)
+			if got != tt.want {
+				t.Fatalf("got %+v, want %+v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestMessageDispatchConfig_ShouldCaptureToInbox(t *testing.T) {
+	tests := []struct {
+		name   string
+		config MessageDispatchConfig
+		want   bool
+	}{
+		{"memory without store", MessageDispatchConfig{Mode: DispatchMemory, StoreMessageContent: false}, false},
+		{"memory with store", MessageDispatchConfig{Mode: DispatchMemory, StoreMessageContent: true}, true},
+		{"provider without store", MessageDispatchConfig{Mode: DispatchProvider}, false},
+		{"provider with store", MessageDispatchConfig{Mode: DispatchProvider, StoreMessageContent: true}, true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := tt.config.ShouldCaptureToInbox(); got != tt.want {
+				t.Fatalf("ShouldCaptureToInbox() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestValidateWorkspaceSettingValue(t *testing.T) {
+	tests := []struct {
+		key   string
+		value string
+		ok    bool
+	}{
+		{SettingKeyMessageDispatchMode, "memory", true},
+		{SettingKeyMessageDispatchMode, "provider", true},
+		{SettingKeyMessageDispatchMode, "invalid", false},
+		{SettingKeyStoreMessageContent, "true", true},
+		{SettingKeyStoreMessageContent, "false", true},
+		{SettingKeyStoreMessageContent, "yes", false},
+		{"owner_email", "any@example.com", true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.key+"="+tt.value, func(t *testing.T) {
+			err := ValidateWorkspaceSettingValue(tt.key, tt.value)
+			if tt.ok && err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+			if !tt.ok && !errors.Is(err, ErrInvalidSettingValue) {
+				t.Fatalf("expected ErrInvalidSettingValue, got %v", err)
+			}
+		})
+	}
+}
diff --git a/internal/core/domain/integration.go b/internal/core/domain/integration.go
index 2a0cc671..0e1dcc07 100644
--- a/internal/core/domain/integration.go
+++ b/internal/core/domain/integration.go
@@ -1,6 +1,12 @@
 package domain
 
-import "time"
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+)
 
 // Integration lifecycle statuses (integrations.status column).
 const (
@@ -8,6 +14,12 @@ const (
 	IntegrationStatusDisconnected = "disconnected"
 )
 
+// ProviderNameMemory is the in-process capture provider; not valid for provider dispatch mode.
+const ProviderNameMemory = "memory"
+
+// ErrProviderNotReady indicates the workspace integration cannot send via an external provider.
+var ErrProviderNotReady = errors.New("provider not ready")
+
 // Integration holds provider credentials for a workspace channel.
 type Integration struct {
 	ID           string    `json:"id"`
@@ -20,3 +32,23 @@ type Integration struct {
 	CreatedAt    time.Time `json:"created_at"`
 	UpdatedAt    time.Time `json:"updated_at"`
 }
+
+// ValidateProviderIntegration checks that an integration can be used for provider dispatch.
+func ValidateProviderIntegration(intg Integration) error {
+	if intg.ProviderName == ProviderNameMemory {
+		return fmt.Errorf("%w: memory provider is not allowed in provider dispatch mode", ErrProviderNotReady)
+	}
+	if intg.Status != IntegrationStatusConnected {
+		return fmt.Errorf("%w: integration status is %q", ErrProviderNotReady, intg.Status)
+	}
+	if len(strings.TrimSpace(intg.ProviderName)) == 0 {
+		return fmt.Errorf("%w: provider name is empty", ErrProviderNotReady)
+	}
+	if len(strings.TrimSpace(string(intg.Config))) == 0 {
+		return fmt.Errorf("%w: provider config is empty", ErrProviderNotReady)
+	}
+	if !json.Valid(intg.Config) {
+		return fmt.Errorf("%w: provider config is invalid JSON", ErrProviderNotReady)
+	}
+	return nil
+}
diff --git a/internal/core/domain/integration_test.go b/internal/core/domain/integration_test.go
new file mode 100644
index 00000000..dc236815
--- /dev/null
+++ b/internal/core/domain/integration_test.go
@@ -0,0 +1,46 @@
+package domain
+
+import (
+	"errors"
+	"testing"
+)
+
+func TestValidateProviderIntegration(t *testing.T) {
+	valid := Integration{
+		ID:           "int-1",
+		ProviderName: "mailgun",
+		Config:       []byte(`{"api_key":"key"}`),
+		Status:       IntegrationStatusConnected,
+	}
+
+	tests := []struct {
+		name    string
+		intg    Integration
+		wantErr bool
+	}{
+		{"valid integration", valid, false},
+		{"empty integration", Integration{}, true},
+		{"memory provider", Integration{ProviderName: ProviderNameMemory, Config: []byte(`{}`), Status: IntegrationStatusConnected}, true},
+		{"disconnected", Integration{ProviderName: "mailgun", Config: []byte(`{}`), Status: IntegrationStatusDisconnected}, true},
+		{"empty config", Integration{ProviderName: "mailgun", Config: []byte(`   `), Status: IntegrationStatusConnected}, true},
+		{"invalid json", Integration{ProviderName: "mailgun", Config: []byte(`{`), Status: IntegrationStatusConnected}, true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := ValidateProviderIntegration(tt.intg)
+			if tt.wantErr {
+				if err == nil {
+					t.Fatal("expected error")
+				}
+				if !errors.Is(err, ErrProviderNotReady) {
+					t.Fatalf("expected ErrProviderNotReady, got %v", err)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+		})
+	}
+}
diff --git a/internal/core/domain/log_row.go b/internal/core/domain/log_row.go
index eb9d2661..0cf190e3 100644
--- a/internal/core/domain/log_row.go
+++ b/internal/core/domain/log_row.go
@@ -3,6 +3,6 @@ package domain
 // MessageRequestLogWithSource is a log row joined with API key metadata for portal lists.
 type MessageRequestLogWithSource struct {
 	MessageRequestLog
-	SourceName string `json:"source_name"`
-	ClientID   string `json:"client_id,omitempty"`
+	SourceName string
+	ClientID   string
 }
diff --git a/internal/core/domain/message_request_log.go b/internal/core/domain/message_request_log.go
index 81709024..28d7a11f 100644
--- a/internal/core/domain/message_request_log.go
+++ b/internal/core/domain/message_request_log.go
@@ -4,16 +4,20 @@ import "time"
 
 // MessageRequestLog records a gateway API call for monitoring.
 type MessageRequestLog struct {
-	ID           string    `json:"id"`
-	WorkspaceID  string    `json:"workspace_id"`
-	APIKeyID     string    `json:"api_key_id,omitempty"`
-	ChannelType  string    `json:"channel_type"`
-	HTTPMethod   string    `json:"http_method"`
-	StatusCode   int       `json:"status_code"`
-	Endpoint     string    `json:"endpoint"`
-	ProviderName string    `json:"provider_name,omitempty"`
-	RequestID    string    `json:"request_id,omitempty"`
-	DurationMs   int       `json:"duration_ms,omitempty"`
-	ErrorMessage string    `json:"error_message,omitempty"`
-	CreatedAt    time.Time `json:"created_at"`
+	ID             string
+	WorkspaceID    string
+	APIKeyID       string
+	ChannelType    string
+	HTTPMethod     string
+	StatusCode     int
+	Endpoint       string
+	ProviderName   string
+	RequestID      string
+	DurationMs     int
+	ErrorMessage   string
+	InboxMessageID string
+
+	CreatedAt time.Time
+
+	Payload *MessageRequestPayload
 }
diff --git a/internal/core/domain/message_request_payload.go b/internal/core/domain/message_request_payload.go
new file mode 100644
index 00000000..91200ae8
--- /dev/null
+++ b/internal/core/domain/message_request_payload.go
@@ -0,0 +1,12 @@
+package domain
+
+import "time"
+
+// MessageRequestPayload stores the body of a message request separately
+// from the main metadata logs for optimization and privacy control.
+type MessageRequestPayload struct {
+	LogID        string
+	RequestBody  string
+	ResponseBody string
+	CreatedAt    time.Time
+}
diff --git a/internal/core/domain/permission.go b/internal/core/domain/permission.go
index 48e0fb44..0312d12d 100644
--- a/internal/core/domain/permission.go
+++ b/internal/core/domain/permission.go
@@ -6,6 +6,9 @@ const (
 	RoleMember = "member"
 )
 
+// RBACGuardName is the guard_name used for portal roles and permissions in this project.
+const RBACGuardName = "msg_web"
+
 // Permissions in the RBAC system.
 const (
 	// Workspaces
@@ -39,6 +42,6 @@ const (
 	PermissionInvitationsRead  = "invitations.read"
 	PermissionInvitationsWrite = "invitations.write"
 
-	// Testing/Operations
-	PermissionSendTest = "send.test"
+	// Inbox
+	PermissionInboxWrite = "inbox.write"
 )
diff --git a/internal/core/logctx/logctx.go b/internal/core/logctx/logctx.go
new file mode 100644
index 00000000..4ef3afb5
--- /dev/null
+++ b/internal/core/logctx/logctx.go
@@ -0,0 +1,62 @@
+// Package logctx provides request-scoped correlation fields for structured logging.
+// Core and presentation layers use this package — not infrastructure adapters.
+package logctx
+
+import "context"
+
+type contextKey string
+
+const (
+	keyWorkspaceID contextKey = "workspace_id"
+	keyAPIKeyID    contextKey = "api_key_id"
+	keyChannel     contextKey = "channel"
+	keyProvider    contextKey = "provider"
+	keyRequestID   contextKey = "request_id"
+)
+
+func WithRequestID(ctx context.Context, requestID string) context.Context {
+	return context.WithValue(ctx, keyRequestID, requestID)
+}
+
+func GetRequestID(ctx context.Context) string {
+	v, _ := ctx.Value(keyRequestID).(string)
+	return v
+}
+
+func WithWorkspace(ctx context.Context, workspaceID, apiKeyID string) context.Context {
+	ctx = context.WithValue(ctx, keyWorkspaceID, workspaceID)
+	ctx = context.WithValue(ctx, keyAPIKeyID, apiKeyID)
+	return ctx
+}
+
+func WithChannel(ctx context.Context, channel string) context.Context {
+	return context.WithValue(ctx, keyChannel, channel)
+}
+
+func WithProvider(ctx context.Context, provider string) context.Context {
+	return context.WithValue(ctx, keyProvider, provider)
+}
+
+// Attrs extracts gateway correlation fields from ctx for structured log handlers.
+func Attrs(ctx context.Context) []any {
+	if ctx == nil {
+		return nil
+	}
+	attrs := make([]any, 0, 10)
+	if v, _ := ctx.Value(keyWorkspaceID).(string); v != "" {
+		attrs = append(attrs, "workspace_id", v)
+	}
+	if v, _ := ctx.Value(keyAPIKeyID).(string); v != "" {
+		attrs = append(attrs, "api_key_id", v)
+	}
+	if v, _ := ctx.Value(keyChannel).(string); v != "" {
+		attrs = append(attrs, "channel", v)
+	}
+	if v, _ := ctx.Value(keyProvider).(string); v != "" {
+		attrs = append(attrs, "provider", v)
+	}
+	if v, _ := ctx.Value(keyRequestID).(string); v != "" {
+		attrs = append(attrs, "request_id", v)
+	}
+	return attrs
+}
diff --git a/internal/core/logctx/logctx_test.go b/internal/core/logctx/logctx_test.go
new file mode 100644
index 00000000..ed41ee7a
--- /dev/null
+++ b/internal/core/logctx/logctx_test.go
@@ -0,0 +1,41 @@
+package logctx
+
+import (
+	"context"
+	"testing"
+)
+
+func TestWithProvider_addsProviderToAttrs(t *testing.T) {
+	t.Parallel()
+
+	ctx := WithProvider(context.Background(), "mailgun")
+	attrs := Attrs(ctx)
+
+	if len(attrs) != 2 || attrs[0] != "provider" || attrs[1] != "mailgun" {
+		t.Fatalf("Attrs: got %#v", attrs)
+	}
+}
+
+func TestWithWorkspace_addsWorkspaceFields(t *testing.T) {
+	t.Parallel()
+
+	ctx := WithWorkspace(context.Background(), "ws-1", "key-1")
+	attrs := Attrs(ctx)
+
+	if len(attrs) != 4 {
+		t.Fatalf("expected 4 attr entries, got %#v", attrs)
+	}
+}
+
+func TestWithRequestID_roundTrip(t *testing.T) {
+	t.Parallel()
+
+	ctx := WithRequestID(context.Background(), "req-123")
+	if GetRequestID(ctx) != "req-123" {
+		t.Fatalf("GetRequestID: got %q", GetRequestID(ctx))
+	}
+	attrs := Attrs(ctx)
+	if len(attrs) != 2 || attrs[0] != "request_id" || attrs[1] != "req-123" {
+		t.Fatalf("Attrs: got %#v", attrs)
+	}
+}
diff --git a/internal/core/port/inbox.go b/internal/core/port/inbox.go
index 7b67f829..ebf33ee8 100644
--- a/internal/core/port/inbox.go
+++ b/internal/core/port/inbox.go
@@ -39,25 +39,57 @@ type StoredChat struct {
 	Chat        contracts.ChatMessage `json:"chat"`
 }
 
-// InboxReader is the read side of the in-process message capture store.
+// InboxEmailPage is a paginated slice of captured emails (newest first).
+type InboxEmailPage struct {
+	Items      []StoredEmail `json:"items"`
+	NextCursor string        `json:"next_cursor,omitempty"`
+	HasMore    bool          `json:"has_more"`
+}
+
+// InboxSMSPage is a paginated slice of captured SMS messages (newest first).
+type InboxSMSPage struct {
+	Items      []StoredSMS `json:"items"`
+	NextCursor string      `json:"next_cursor,omitempty"`
+	HasMore    bool        `json:"has_more"`
+}
+
+// InboxPushPage is a paginated slice of captured push notifications (newest first).
+type InboxPushPage struct {
+	Items      []StoredPush `json:"items"`
+	NextCursor string       `json:"next_cursor,omitempty"`
+	HasMore    bool         `json:"has_more"`
+}
+
+// InboxChatPage is a paginated slice of captured chat messages (newest first).
+type InboxChatPage struct {
+	Items      []StoredChat `json:"items"`
+	NextCursor string       `json:"next_cursor,omitempty"`
+	HasMore    bool         `json:"has_more"`
+}
+
+// InboxReader is the read side of the message capture store (persisted payloads).
 type InboxReader interface {
 	StatsForWorkspace(workspaceID string) map[string]int
 	EmailsForWorkspace(workspaceID string) []StoredEmail
+	ListEmailsForWorkspace(workspaceID string, limit int, cursor string) InboxEmailPage
 	EmailByIDForWorkspace(id, workspaceID string) (StoredEmail, bool)
 	DeleteEmailByIDForWorkspace(id, workspaceID string) bool
+	ListSMSForWorkspace(workspaceID string, limit int, cursor string) InboxSMSPage
 	SMSForWorkspace(workspaceID string) []StoredSMS
 	SMSByIDForWorkspace(id, workspaceID string) (StoredSMS, bool)
 	DeleteSMSByIDForWorkspace(id, workspaceID string) bool
+	ListPushForWorkspace(workspaceID string, limit int, cursor string) InboxPushPage
 	PushForWorkspace(workspaceID string) []StoredPush
 	PushByIDForWorkspace(id, workspaceID string) (StoredPush, bool)
 	DeletePushByIDForWorkspace(id, workspaceID string) bool
+	ListChatForWorkspace(workspaceID string, limit int, cursor string) InboxChatPage
 	ChatForWorkspace(workspaceID string) []StoredChat
 	ChatByIDForWorkspace(id, workspaceID string) (StoredChat, bool)
 	DeleteChatByIDForWorkspace(id, workspaceID string) bool
 	ClearWorkspace(workspaceID string)
 }
 
-// InboxWriter is the write side of the in-process message capture store.
+// InboxWriter is the write side of the message capture store.
 type InboxWriter interface {
 	WriteEmail(ctx context.Context, workspaceID string, email contracts.Email) (id string, err error)
 	WriteSMS(ctx context.Context, workspaceID string, sms contracts.SMS) (id string, err error)
diff --git a/internal/core/port/portal.go b/internal/core/port/portal.go
index bce329c9..afee1645 100644
--- a/internal/core/port/portal.go
+++ b/internal/core/port/portal.go
@@ -44,4 +44,5 @@ type AuthorizationGate interface {
 	RemoveRole(ctx context.Context, modelType, modelID, teamID, roleName string) error
 	GetRoleNames(ctx context.Context, modelType, modelID, teamID string) ([]string, error)
 	GetAllPermissions(ctx context.Context, modelType, modelID, teamID string) ([]string, error)
+	GetPermissionsForTeams(ctx context.Context, modelType, modelID string, teamIDs []string) (map[string][]string, error)
 }
diff --git a/internal/core/port/repository.go b/internal/core/port/repository.go
index 4396ccf1..4d6a1dd7 100644
--- a/internal/core/port/repository.go
+++ b/internal/core/port/repository.go
@@ -7,7 +7,8 @@ import (
 )
 
 type WorkspaceRepository interface {
-	Create(ctx context.Context, workspace *domain.Workspace) error
+	Create(ctx context.Context, workspace *domain.Workspace, ownerID string) error
+	Delete(ctx context.Context, id string) error
 	GetByID(ctx context.Context, id string) (*domain.Workspace, error)
 	GetBySlug(ctx context.Context, slug string) (*domain.Workspace, error)
 	Update(ctx context.Context, workspace *domain.Workspace) error
diff --git a/internal/core/service/auth_service_test.go b/internal/core/service/auth_service_test.go
new file mode 100644
index 00000000..ac589d4f
--- /dev/null
+++ b/internal/core/service/auth_service_test.go
@@ -0,0 +1,164 @@
+package service
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/weprodev/go-pkg/crypto"
+
+	"github.com/weprodev/wpd-message-gateway/internal/core/authjwt"
+	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
+	"github.com/weprodev/wpd-message-gateway/internal/core/port"
+	"github.com/weprodev/wpd-message-gateway/pkg/contracts"
+)
+
+type failingEmailSender struct{}
+
+func (f *failingEmailSender) Send(context.Context, contracts.Email) (*contracts.SendResult, error) {
+	return nil, errors.New("smtp down")
+}
+
+func (f *failingEmailSender) Name() string { return "failing" }
+
+func TestAuthService_VerifyEmail_success(t *testing.T) {
+	t.Parallel()
+
+	userID := uuid.New()
+	repo := &fakeUserRepo{
+		byID: &domain.User{
+			ID:            userID,
+			Email:         "user@example.com",
+			EmailVerified: false,
+		},
+	}
+	svc := NewAuthService(repo, &fakeEmailSender{}, testJWTSecret, true, time.Hour, time.Hour, "https://portal.example.com")
+
+	token, err := authjwt.Sign(userID.String(), "user@example.com", testJWTSecret, time.Hour)
+	if err != nil {
+		t.Fatalf("Sign: %v", err)
+	}
+
+	if err := svc.VerifyEmail(context.Background(), token); err != nil {
+		t.Fatalf("VerifyEmail: %v", err)
+	}
+	if len(repo.verifiedUserIDs) != 1 || repo.verifiedUserIDs[0] != userID.String() {
+		t.Fatalf("expected SetEmailVerified for %s, got %v", userID, repo.verifiedUserIDs)
+	}
+}
+
+func TestAuthService_VerifyEmail_rejectsAlreadyVerified(t *testing.T) {
+	t.Parallel()
+
+	userID := uuid.New()
+	repo := &fakeUserRepo{
+		byID: &domain.User{ID: userID, Email: "user@example.com", EmailVerified: true},
+	}
+	svc := NewAuthService(repo, &fakeEmailSender{}, testJWTSecret, true, time.Hour, time.Hour, "")
+
+	token, err := authjwt.Sign(userID.String(), "user@example.com", testJWTSecret, time.Hour)
+	if err != nil {
+		t.Fatalf("Sign: %v", err)
+	}
+
+	err = svc.VerifyEmail(context.Background(), token)
+	if err == nil || err.Error() != "email already verified" {
+		t.Fatalf("expected already verified error, got %v", err)
+	}
+}
+
+func TestAuthService_VerifyEmail_rejectsInvalidToken(t *testing.T) {
+	t.Parallel()
+
+	svc := NewAuthService(&fakeUserRepo{}, &fakeEmailSender{}, testJWTSecret, true, time.Hour, time.Hour, "")
+
+	err := svc.VerifyEmail(context.Background(), "not-a-jwt")
+	if err == nil || err.Error() != "invalid or expired verification token" {
+		t.Fatalf("expected invalid token error, got %v", err)
+	}
+}
+
+func TestAuthService_Login_success(t *testing.T) {
+	t.Parallel()
+
+	hash, err := crypto.HashSecret("correct-password")
+	if err != nil {
+		t.Fatalf("HashSecret: %v", err)
+	}
+	userID := uuid.New()
+	repo := &fakeUserRepo{
+		byEmail: &domain.User{
+			ID:            userID,
+			Email:         "user@example.com",
+			PasswordHash:  hash,
+			EmailVerified: true,
+		},
+	}
+	svc := NewAuthService(repo, &fakeEmailSender{}, testJWTSecret, false, time.Hour, time.Hour, "")
+
+	user, token, err := svc.Login(context.Background(), "user@example.com", "correct-password")
+	if err != nil {
+		t.Fatalf("Login: %v", err)
+	}
+	if user.ID != userID || token == "" {
+		t.Fatalf("unexpected login result: user=%+v token=%q", user, token)
+	}
+
+	claims, err := authjwt.Parse(token, testJWTSecret)
+	if err != nil {
+		t.Fatalf("Parse token: %v", err)
+	}
+	if claims.UserID != userID.String() {
+		t.Fatalf("token subject: got %q want %q", claims.UserID, userID)
+	}
+}
+
+func TestAuthService_Login_rejectsUnverifiedEmail(t *testing.T) {
+	t.Parallel()
+
+	repo := &fakeUserRepo{
+		byEmail: &domain.User{
+			ID:            uuid.New(),
+			Email:         "user@example.com",
+			PasswordHash:  "hash",
+			EmailVerified: false,
+		},
+	}
+	svc := NewAuthService(repo, &fakeEmailSender{}, testJWTSecret, true, time.Hour, time.Hour, "")
+
+	_, _, err := svc.Login(context.Background(), "user@example.com", "pw")
+	if err == nil || err.Error() != "email not verified" {
+		t.Fatalf("expected email not verified error, got %v", err)
+	}
+}
+
+func TestAuthService_RegisterUser_sendsVerificationEmail(t *testing.T) {
+	t.Parallel()
+
+	repo := &fakeUserRepo{err: fmt.Errorf("lookup: %w", port.ErrNotFound)}
+	sender := &fakeEmailSender{}
+	svc := NewAuthService(repo, sender, testJWTSecret, true, time.Hour, time.Hour, "https://portal.example.com")
+
+	user, err := svc.RegisterUser(context.Background(), "First", "Last", "new@example.com", "secret123456")
+	if err != nil {
+		t.Fatalf("RegisterUser: %v", err)
+	}
+	if user.EmailVerified {
+		t.Fatal("expected EmailVerified false when verification enabled")
+	}
+}
+
+func TestAuthService_RegisterUser_failsWhenVerificationEmailFails(t *testing.T) {
+	t.Parallel()
+
+	repo := &fakeUserRepo{err: fmt.Errorf("lookup: %w", port.ErrNotFound)}
+	svc := NewAuthService(repo, &failingEmailSender{}, testJWTSecret, true, time.Hour, time.Hour, "https://portal.example.com")
+
+	_, err := svc.RegisterUser(context.Background(), "First", "Last", "new@example.com", "secret123456")
+	if err == nil || err.Error() != "could not send verification email: smtp down" {
+		t.Fatalf("expected verification email failure, got %v", err)
+	}
+}
diff --git a/internal/core/service/email_enrichment.go b/internal/core/service/email_enrichment.go
new file mode 100644
index 00000000..23f2c069
--- /dev/null
+++ b/internal/core/service/email_enrichment.go
@@ -0,0 +1,48 @@
+package service
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"log/slog"
+
+	"github.com/weprodev/wpd-message-gateway/internal/core/port"
+	"github.com/weprodev/wpd-message-gateway/pkg/contracts"
+	"github.com/weprodev/wpd-message-gateway/pkg/registry"
+)
+
+func applyEmailSenderDefaults(email contracts.Email, cfg registry.EmailConfig) contracts.Email {
+	enriched := email
+	if enriched.From == "" && cfg.FromEmail != "" {
+		enriched.From = cfg.FromEmail
+	}
+	if enriched.FromName == "" && cfg.FromName != "" {
+		enriched.FromName = cfg.FromName
+	}
+	return enriched
+}
+
+func (s *GatewayService) enrichEmailFromIntegration(ctx context.Context, workspaceID string, email contracts.Email) contracts.Email {
+	if email.From != "" && email.FromName != "" {
+		return email
+	}
+	if s.integrations == nil {
+		return email
+	}
+
+	intg, err := s.integrations.GetActiveByWorkspaceAndChannel(ctx, workspaceID, channelEmail)
+	if err != nil || intg == nil {
+		if err != nil && !errors.Is(err, port.ErrNotFound) {
+			slog.WarnContext(ctx, "failed to load email integration for sender enrichment", "error", err)
+		}
+		return email
+	}
+
+	var cfg registry.EmailConfig
+	if err := json.Unmarshal(intg.Config, &cfg); err != nil {
+		slog.WarnContext(ctx, "failed to parse email integration config for sender enrichment", "error", err)
+		return email
+	}
+
+	return applyEmailSenderDefaults(email, cfg)
+}
diff --git a/internal/core/service/email_enrichment_test.go b/internal/core/service/email_enrichment_test.go
new file mode 100644
index 00000000..9e92a929
--- /dev/null
+++ b/internal/core/service/email_enrichment_test.go
@@ -0,0 +1,107 @@
+package service
+
+import (
+	"context"
+	"testing"
+
+	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
+	"github.com/weprodev/wpd-message-gateway/pkg/contracts"
+	"github.com/weprodev/wpd-message-gateway/pkg/registry"
+)
+
+func TestApplyEmailSenderDefaults(t *testing.T) {
+	t.Parallel()
+
+	cfg := registry.EmailConfig{
+		FromEmail: "noreply@weprodev.com",
+		FromName:  "WeProDev",
+	}
+
+	t.Run("fills empty from and from_name", func(t *testing.T) {
+		t.Parallel()
+		got := applyEmailSenderDefaults(contracts.Email{To: []string{"user@example.com"}}, cfg)
+		if got.From != "noreply@weprodev.com" {
+			t.Fatalf("From: %q", got.From)
+		}
+		if got.FromName != "WeProDev" {
+			t.Fatalf("FromName: %q", got.FromName)
+		}
+	})
+
+	t.Run("preserves explicit from", func(t *testing.T) {
+		t.Parallel()
+		got := applyEmailSenderDefaults(contracts.Email{
+			From: "custom@example.com",
+			To:   []string{"user@example.com"},
+		}, cfg)
+		if got.From != "custom@example.com" {
+			t.Fatalf("From: %q", got.From)
+		}
+		if got.FromName != "WeProDev" {
+			t.Fatalf("FromName: %q", got.FromName)
+		}
+	})
+
+	t.Run("preserves explicit from_name", func(t *testing.T) {
+		t.Parallel()
+		got := applyEmailSenderDefaults(contracts.Email{
+			FromName: "Custom Name",
+			To:       []string{"user@example.com"},
+		}, cfg)
+		if got.From != "noreply@weprodev.com" {
+			t.Fatalf("From: %q", got.From)
+		}
+		if got.FromName != "Custom Name" {
+			t.Fatalf("FromName: %q", got.FromName)
+		}
+	})
+}
+
+func TestGatewayService_SendEmail_enrichesSenderFromIntegration(t *testing.T) {
+	inbox := &capturingInbox{}
+	intg := &domain.Integration{
+		ID:           "intg-1",
+		ProviderName: "mailgun",
+		Config:       []byte(`{"from_email":"noreply@weprodev.com","from_name":"WeProDev"}`),
+		Status:       "connected",
+	}
+	svc := NewGatewayService(&stubIntegrationRepo{active: intg}, nil, &stubSettingsRepo{values: map[string]string{
+		domain.SettingKeyStoreMessageContent: "true",
+	}}, inbox, nil)
+
+	_, err := svc.SendEmail(t.Context(), "ws-1", contracts.Email{
+		To:      []string{"user@example.com"},
+		Subject: "hi",
+		HTML:    "<p>x</p>",
+	})
+	if err != nil {
+		t.Fatalf("SendEmail: %v", err)
+	}
+	if inbox.lastEmail.From != "noreply@weprodev.com" {
+		t.Fatalf("From: %q", inbox.lastEmail.From)
+	}
+	if inbox.lastEmail.FromName != "WeProDev" {
+		t.Fatalf("FromName: %q", inbox.lastEmail.FromName)
+	}
+}
+
+type capturingInbox struct {
+	lastEmail contracts.Email
+}
+
+func (s *capturingInbox) WriteEmail(_ context.Context, _ string, email contracts.Email) (string, error) {
+	s.lastEmail = email
+	return "inbox-msg-1", nil
+}
+
+func (s *capturingInbox) WriteSMS(context.Context, string, contracts.SMS) (string, error) {
+	return "inbox-sms-1", nil
+}
+
+func (s *capturingInbox) WritePush(context.Context, string, contracts.PushNotification) (string, error) {
+	return "inbox-push-1", nil
+}
+
+func (s *capturingInbox) WriteChat(context.Context, string, contracts.ChatMessage) (string, error) {
+	return "inbox-chat-1", nil
+}
diff --git a/internal/core/service/gateway_dispatch.go b/internal/core/service/gateway_dispatch.go
new file mode 100644
index 00000000..7213e114
--- /dev/null
+++ b/internal/core/service/gateway_dispatch.go
@@ -0,0 +1,143 @@
+package service
+
+import (
+	"context"
+	"log/slog"
+
+	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
+	"github.com/weprodev/wpd-message-gateway/internal/core/logctx"
+	"github.com/weprodev/wpd-message-gateway/pkg/contracts"
+)
+
+type dispatchMeta struct {
+	provResult    *contracts.SendResult
+	inboxResult   *contracts.SendResult
+	integrationID string
+	providerName  string
+}
+
+// routeMessage delivers the outbound message according to dispatch mode.
+// Portal inbox capture is handled separately when store_message_content is enabled.
+func (s *GatewayService) routeMessage(
+	ctx context.Context,
+	workspaceID string,
+	config domain.MessageDispatchConfig,
+	channel string,
+	sendViaProvider func(context.Context, domain.Integration) (*contracts.SendResult, error),
+	meta *dispatchMeta,
+) error {
+	if config.RoutesViaProvider() {
+		return s.routeViaIntegration(ctx, workspaceID, channel, sendViaProvider, meta)
+	}
+	if config.ShouldCaptureToInbox() {
+		return nil
+	}
+	return s.routeViaMemoryProvider(ctx, sendViaProvider, meta)
+}
+
+func (s *GatewayService) routeViaIntegration(
+	ctx context.Context,
+	workspaceID, channel string,
+	sendViaProvider func(context.Context, domain.Integration) (*contracts.SendResult, error),
+	meta *dispatchMeta,
+) error {
+	intg, err := s.requireProviderIntegration(ctx, workspaceID, channel)
+	if err != nil {
+		return err
+	}
+
+	meta.integrationID = intg.ID
+	meta.providerName = intg.ProviderName
+
+	providerCtx := logctx.WithProvider(ctx, meta.providerName)
+	meta.provResult, err = sendViaProvider(providerCtx, intg)
+	if err != nil {
+		slog.WarnContext(providerCtx, "provider dispatch failed", "error", err, "integration_id", meta.integrationID)
+		return err
+	}
+	slog.InfoContext(providerCtx, "message dispatched via provider", "message_id", meta.provResult.ID)
+	return nil
+}
+
+func (s *GatewayService) routeViaMemoryProvider(
+	ctx context.Context,
+	sendViaProvider func(context.Context, domain.Integration) (*contracts.SendResult, error),
+	meta *dispatchMeta,
+) error {
+	intg := memoryDispatchIntegration()
+	providerCtx := logctx.WithProvider(ctx, domain.ProviderNameMemory)
+
+	var err error
+	meta.provResult, err = sendViaProvider(providerCtx, intg)
+	if err != nil {
+		slog.WarnContext(providerCtx, "memory provider dispatch failed", "error", err)
+		return err
+	}
+
+	meta.providerName = domain.ProviderNameMemory
+	slog.InfoContext(providerCtx, "message dispatched via memory provider", "message_id", meta.provResult.ID)
+	return nil
+}
+
+func (s *GatewayService) captureToInboxIfEnabled(
+	ctx context.Context,
+	config domain.MessageDispatchConfig,
+	writeToInbox func() (*contracts.SendResult, error),
+	meta *dispatchMeta,
+) error {
+	if !config.ShouldCaptureToInbox() {
+		return nil
+	}
+
+	result, err := writeToInbox()
+	if err != nil {
+		slog.ErrorContext(ctx, "inbox write failed", "error", err, "dispatch_mode", config.Mode)
+		if config.RoutesViaProvider() {
+			slog.WarnContext(ctx, "inbox capture failed after provider dispatch", "dispatch_mode", config.Mode)
+			return nil
+		}
+		return err
+	}
+
+	meta.inboxResult = result
+	slog.InfoContext(ctx, "message captured in inbox", "message_id", result.ID)
+	return nil
+}
+
+func mergeDispatchResults(meta dispatchMeta) *contracts.SendResult {
+	if meta.provResult == nil {
+		return meta.inboxResult
+	}
+	if meta.inboxResult == nil {
+		return meta.provResult
+	}
+	if meta.provResult.Meta == nil {
+		meta.provResult.Meta = make(map[string]string)
+	}
+	meta.provResult.Meta[contracts.MetaKeyInboxMessageID] = meta.inboxResult.ID
+	return meta.provResult
+}
+
+func attachDispatchMeta(
+	result *contracts.SendResult,
+	config domain.MessageDispatchConfig,
+	channel string,
+	meta dispatchMeta,
+) *contracts.SendResult {
+	if result == nil {
+		result = &contracts.SendResult{}
+	}
+	if result.Meta == nil {
+		result.Meta = make(map[string]string, 5)
+	}
+	contracts.SetDispatchModeMeta(result, string(config.Mode))
+	contracts.SetStoreContentMeta(result, config.StoreMessageContent)
+	result.Meta["channel"] = channel
+	if meta.integrationID != "" {
+		result.Meta["integration_id"] = meta.integrationID
+	}
+	if meta.providerName != "" {
+		result.Meta[contracts.MetaKeyProviderName] = meta.providerName
+	}
+	return result
+}
diff --git a/internal/core/service/gateway_service.go b/internal/core/service/gateway_service.go
index 55c8afc7..a2490cce 100644
--- a/internal/core/service/gateway_service.go
+++ b/internal/core/service/gateway_service.go
@@ -4,12 +4,12 @@ package service
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"log/slog"
 
 	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
 	"github.com/weprodev/wpd-message-gateway/internal/core/port"
-	applogger "github.com/weprodev/wpd-message-gateway/internal/infrastructure/logger"
 	"github.com/weprodev/wpd-message-gateway/pkg/contracts"
 )
 
@@ -18,17 +18,12 @@ const (
 	channelSMS   = "sms"
 	channelPush  = "push"
 	channelChat  = "chat"
-
-	// memoryProviderName is the sentinel name stored in the integrations table
-	// when a workspace uses memory dispatch. Checked here to skip DB lookup.
-	memoryProviderName = "memory"
 )
 
 // GatewayService orchestrates message dispatch for a single workspace.
 //
-// It resolves the workspace dispatch mode from WorkspaceSettingsRepository,
-// then routes the message to the in-process InboxWriter, a real provider
-// fetched via IntegrationRepository, or both — depending on the mode.
+// Dispatch mode (memory vs provider) controls where the message is routed.
+// store_message_content controls portal inbox capture independently of routing.
 //
 // Provider instances are cached per (integrationID, updatedAt) so HTTP clients
 // are reused across requests while auto-invalidating on config changes.
@@ -47,8 +42,8 @@ type GatewayService struct {
 
 // NewGatewayService constructs a GatewayService.
 //
-// inbox is the in-process capture store (implements port.InboxWriter).
-// Pass nil to disable memory capture — memory_only dispatch will then error.
+// inbox is the portal capture store (implements port.InboxWriter).
+// Pass nil to disable inbox capture when store_message_content is enabled.
 func NewGatewayService(
 	integrations port.IntegrationRepository,
 	templates port.TemplateRepository,
@@ -71,11 +66,14 @@ func NewGatewayService(
 
 // SendEmail dispatches an email for workspaceID according to its dispatch mode.
 func (s *GatewayService) SendEmail(ctx context.Context, workspaceID string, email contracts.Email) (*contracts.SendResult, error) {
-	mode := s.resolveDispatchMode(ctx, workspaceID)
-	return s.dispatch(ctx, workspaceID, mode, channelEmail,
+	config, err := s.resolveDispatchConfig(ctx, workspaceID)
+	if err != nil {
+		return nil, err
+	}
+	return s.dispatch(ctx, workspaceID, config, channelEmail,
 		func() (*contracts.SendResult, error) { return s.writeEmailToInbox(ctx, workspaceID, email) },
-		func(sendCtx context.Context, intg *domain.Integration) (*contracts.SendResult, error) {
-			sender, err := resolveEmailSender(s.emailCache, intg)
+		func(sendCtx context.Context, intg domain.Integration) (*contracts.SendResult, error) {
+			sender, err := resolveEmailSender(s.emailCache, &intg)
 			if err != nil {
 				return nil, err
 			}
@@ -86,11 +84,14 @@ func (s *GatewayService) SendEmail(ctx context.Context, workspaceID string, emai
 
 // SendSMS dispatches an SMS for workspaceID according to its dispatch mode.
 func (s *GatewayService) SendSMS(ctx context.Context, workspaceID string, sms contracts.SMS) (*contracts.SendResult, error) {
-	mode := s.resolveDispatchMode(ctx, workspaceID)
-	return s.dispatch(ctx, workspaceID, mode, channelSMS,
+	config, err := s.resolveDispatchConfig(ctx, workspaceID)
+	if err != nil {
+		return nil, err
+	}
+	return s.dispatch(ctx, workspaceID, config, channelSMS,
 		func() (*contracts.SendResult, error) { return s.writeSMSToInbox(ctx, workspaceID, sms) },
-		func(sendCtx context.Context, intg *domain.Integration) (*contracts.SendResult, error) {
-			sender, err := resolveSMSSender(s.smsCache, intg)
+		func(sendCtx context.Context, intg domain.Integration) (*contracts.SendResult, error) {
+			sender, err := resolveSMSSender(s.smsCache, &intg)
 			if err != nil {
 				return nil, err
 			}
@@ -101,11 +102,14 @@ func (s *GatewayService) SendSMS(ctx context.Context, workspaceID string, sms co
 
 // SendPush dispatches a push notification for workspaceID according to its dispatch mode.
 func (s *GatewayService) SendPush(ctx context.Context, workspaceID string, push contracts.PushNotification) (*contracts.SendResult, error) {
-	mode := s.resolveDispatchMode(ctx, workspaceID)
-	return s.dispatch(ctx, workspaceID, mode, channelPush,
+	config, err := s.resolveDispatchConfig(ctx, workspaceID)
+	if err != nil {
+		return nil, err
+	}
+	return s.dispatch(ctx, workspaceID, config, channelPush,
 		func() (*contracts.SendResult, error) { return s.writePushToInbox(ctx, workspaceID, push) },
-		func(sendCtx context.Context, intg *domain.Integration) (*contracts.SendResult, error) {
-			sender, err := resolvePushSender(s.pushCache, intg)
+		func(sendCtx context.Context, intg domain.Integration) (*contracts.SendResult, error) {
+			sender, err := resolvePushSender(s.pushCache, &intg)
 			if err != nil {
 				return nil, err
 			}
@@ -116,11 +120,14 @@ func (s *GatewayService) SendPush(ctx context.Context, workspaceID string, push
 
 // SendChat dispatches a chat message for workspaceID according to its dispatch mode.
 func (s *GatewayService) SendChat(ctx context.Context, workspaceID string, chat contracts.ChatMessage) (*contracts.SendResult, error) {
-	mode := s.resolveDispatchMode(ctx, workspaceID)
-	return s.dispatch(ctx, workspaceID, mode, channelChat,
+	config, err := s.resolveDispatchConfig(ctx, workspaceID)
+	if err != nil {
+		return nil, err
+	}
+	return s.dispatch(ctx, workspaceID, config, channelChat,
 		func() (*contracts.SendResult, error) { return s.writeChatToInbox(ctx, workspaceID, chat) },
-		func(sendCtx context.Context, intg *domain.Integration) (*contracts.SendResult, error) {
-			sender, err := resolveChatSender(s.chatCache, intg)
+		func(sendCtx context.Context, intg domain.Integration) (*contracts.SendResult, error) {
+			sender, err := resolveChatSender(s.chatCache, &intg)
 			if err != nil {
 				return nil, err
 			}
@@ -129,131 +136,106 @@ func (s *GatewayService) SendChat(ctx context.Context, workspaceID string, chat
 	)
 }
 
-// dispatch is the single entry point for all channel dispatch logic.
-// It applies the workspace dispatch mode and calls the appropriate fn(s).
-//
-//   - writeToInbox: captures to in-process RAM (always available)
-//   - sendViaProvider: instantiates provider from DB integration + sends
+// dispatch routes the outbound message, then optionally captures it in the portal inbox.
 func (s *GatewayService) dispatch(
 	ctx context.Context,
 	workspaceID string,
-	mode domain.MessageDispatchMode,
+	config domain.MessageDispatchConfig,
 	channel string,
 	writeToInbox func() (*contracts.SendResult, error),
-	sendViaProvider func(context.Context, *domain.Integration) (*contracts.SendResult, error),
+	sendViaProvider func(context.Context, domain.Integration) (*contracts.SendResult, error),
 ) (*contracts.SendResult, error) {
-	slog.InfoContext(ctx, "dispatching message", "workspace_id", workspaceID, "dispatch_mode", mode, "channel", channel)
-	switch mode {
-	case domain.DispatchMemoryOnly:
-		r, err := writeToInbox()
-		if err != nil {
-			slog.ErrorContext(ctx, "inbox write failed", "error", err, "workspace_id", workspaceID, "channel", channel)
-			return nil, err
-		}
-		attachMeta(r, mode, channel, "", memoryProviderName)
-		slog.InfoContext(ctx, "message dispatched via memory only", "workspace_id", workspaceID, "channel", channel, "message_id", r.ID)
-		return r, nil
-
-	case domain.DispatchProviderOnly:
-		intg, err := s.activeIntegration(ctx, workspaceID, channel)
-		if err != nil {
-			slog.ErrorContext(ctx, "provider lookup failed", "error", err, "workspace_id", workspaceID, "channel", channel)
-			return nil, err
-		}
-		// If the stored integration IS the memory provider, fall through to inbox.
-		if intg.ProviderName == memoryProviderName {
-			r, err := writeToInbox()
-			if err != nil {
-				slog.ErrorContext(ctx, "inbox write failed (fallback)", "error", err, "workspace_id", workspaceID, "channel", channel)
-				return nil, err
-			}
-			attachMeta(r, mode, channel, intg.ID, intg.ProviderName)
-			slog.InfoContext(ctx, "message dispatched via memory fallback", "workspace_id", workspaceID, "channel", channel, "message_id", r.ID)
-			return r, nil
-		}
-		providerCtx := applogger.WithProvider(ctx, intg.ProviderName)
-		r, err := sendViaProvider(providerCtx, intg)
-		if err != nil {
-			slog.ErrorContext(ctx, "provider send failed", "error", err, "workspace_id", workspaceID, "channel", channel, "provider", intg.ProviderName)
-			return nil, err
-		}
-		attachMeta(r, mode, channel, intg.ID, intg.ProviderName)
-		slog.InfoContext(ctx, "message dispatched via provider only", "workspace_id", workspaceID, "channel", channel, "provider", intg.ProviderName, "message_id", r.ID)
-		return r, nil
+	slog.InfoContext(ctx, "dispatching message", "dispatch_mode", config.Mode, "store_content", config.StoreMessageContent)
 
-	case domain.DispatchMemoryAndProvider:
-		intg, err := s.activeIntegration(ctx, workspaceID, channel)
-		if err != nil {
-			slog.ErrorContext(ctx, "provider lookup failed", "error", err, "workspace_id", workspaceID, "channel", channel)
-			return nil, err
-		}
-		// If the integration is already memory, a single write is enough.
-		if intg.ProviderName == memoryProviderName {
-			r, err := writeToInbox()
-			if err != nil {
-				slog.ErrorContext(ctx, "inbox write failed (fallback)", "error", err, "workspace_id", workspaceID, "channel", channel)
-				return nil, err
-			}
-			attachMeta(r, mode, channel, intg.ID, intg.ProviderName)
-			slog.InfoContext(ctx, "message dispatched via memory fallback", "workspace_id", workspaceID, "channel", channel, "message_id", r.ID)
-			return r, nil
-		}
-		// Both paths: capture to inbox first (non-fatal), then send via provider.
-		inboxResult, err := writeToInbox()
-		if err != nil {
-			slog.WarnContext(ctx, "inbox write failed (non-fatal)", "error", err, "workspace_id", workspaceID, "channel", channel)
-		}
-		providerCtx := applogger.WithProvider(ctx, intg.ProviderName)
-		provResult, err := sendViaProvider(providerCtx, intg)
-		if err != nil {
-			slog.ErrorContext(ctx, "provider send failed", "error", err, "workspace_id", workspaceID, "channel", channel, "provider", intg.ProviderName)
-			return nil, err
-		}
-		if inboxResult != nil {
-			if provResult.Meta == nil {
-				provResult.Meta = make(map[string]string)
-			}
-			provResult.Meta["inbox_message_id"] = inboxResult.ID
-		}
-		attachMeta(provResult, mode, channel, intg.ID, intg.ProviderName)
-		slog.InfoContext(ctx, "message dispatched via memory and provider", "workspace_id", workspaceID, "channel", channel, "provider", intg.ProviderName, "message_id", provResult.ID)
-		return provResult, nil
+	meta := dispatchMeta{providerName: domain.ProviderNameMemory}
 
-	default:
-		// Undefined modes fall back to memory_only (safe default).
-		slog.WarnContext(ctx, "unknown dispatch mode, falling back to memory only", "workspace_id", workspaceID, "mode", mode)
-		r, err := writeToInbox()
-		if err != nil {
-			slog.ErrorContext(ctx, "inbox write failed (fallback)", "error", err, "workspace_id", workspaceID, "channel", channel)
-			return nil, err
-		}
-		attachMeta(r, domain.DispatchMemoryOnly, channel, "", memoryProviderName)
-		return r, nil
+	if err := s.routeMessage(ctx, workspaceID, config, channel, sendViaProvider, &meta); err != nil {
+		return attachDispatchMeta(nil, config, channel, meta), err
+	}
+	if err := s.captureToInboxIfEnabled(ctx, config, writeToInbox, &meta); err != nil {
+		return attachDispatchMeta(nil, config, channel, meta), err
 	}
+
+	return attachDispatchMeta(mergeDispatchResults(meta), config, channel, meta), nil
 }
 
-// resolveDispatchMode reads the workspace setting, defaulting gracefully.
-func (s *GatewayService) resolveDispatchMode(ctx context.Context, workspaceID string) domain.MessageDispatchMode {
+// ResolveDispatchConfig reads the workspace setting for outbound dispatch behavior.
+func (s *GatewayService) ResolveDispatchConfig(ctx context.Context, workspaceID string) (domain.MessageDispatchConfig, error) {
+	return s.resolveDispatchConfig(ctx, workspaceID)
+}
+
+// resolveDispatchConfig reads message_dispatch_mode and store_message_content from workspace settings.
+func (s *GatewayService) resolveDispatchConfig(ctx context.Context, workspaceID string) (domain.MessageDispatchConfig, error) {
 	if s.settings == nil {
-		return domain.DefaultMessageDispatchMode()
+		return domain.MessageDispatchConfig{
+			Mode:                domain.DefaultMessageDispatchMode(),
+			StoreMessageContent: false,
+		}, nil
 	}
-	v, err := s.settings.Get(ctx, workspaceID, domain.SettingKeyMessageDispatchMode)
-	if err != nil || v == "" {
-		return domain.DefaultMessageDispatchMode()
+
+	modeVal, err := s.settings.Get(ctx, workspaceID, domain.SettingKeyMessageDispatchMode)
+	if err != nil && !errors.Is(err, port.ErrNotFound) {
+		return domain.MessageDispatchConfig{}, fmt.Errorf("failed to lookup message dispatch mode: %w", err)
 	}
-	if m, ok := domain.ParseMessageDispatchMode(v); ok {
-		return m
+
+	storeVal, err := s.settings.Get(ctx, workspaceID, domain.SettingKeyStoreMessageContent)
+	if err != nil && !errors.Is(err, port.ErrNotFound) {
+		return domain.MessageDispatchConfig{}, fmt.Errorf("failed to lookup store message content setting: %w", err)
 	}
-	return domain.DefaultMessageDispatchMode()
+
+	return domain.ResolveMessageDispatchConfig(modeVal, storeVal), nil
 }
 
-// activeIntegration fetches the active (connected) integration for a workspace+channel.
-func (s *GatewayService) activeIntegration(ctx context.Context, workspaceID, channel string) (*domain.Integration, error) {
+// requireProviderIntegration loads and validates the workspace integration for provider dispatch.
+func (s *GatewayService) requireProviderIntegration(ctx context.Context, workspaceID, channel string) (domain.Integration, error) {
+	if s.integrations == nil {
+		err := fmt.Errorf("integration repository not configured: %w", port.ErrInternal)
+		slog.ErrorContext(ctx, "provider dispatch blocked",
+			"reason", "repository_unavailable",
+			"channel", channel,
+			"error", err,
+		)
+		return domain.Integration{}, err
+	}
+
 	intg, err := s.integrations.GetActiveByWorkspaceAndChannel(ctx, workspaceID, channel)
 	if err != nil {
-		return nil, fmt.Errorf("no active %s integration for workspace %s: %w", channel, workspaceID, err)
+		reason := "lookup_failed"
+		log := slog.ErrorContext
+		if errors.Is(err, port.ErrNotFound) {
+			reason = "no_active_integration"
+			log = slog.WarnContext
+		}
+		log(ctx, "provider dispatch blocked",
+			"reason", reason,
+			"channel", channel,
+			"error", err,
+		)
+		return domain.Integration{}, fmt.Errorf("provider integration for %s channel: %w", channel, err)
+	}
+	if intg == nil {
+		err := fmt.Errorf("provider integration for %s channel: %w", channel, port.ErrNotFound)
+		slog.WarnContext(ctx, "provider dispatch blocked",
+			"reason", "no_active_integration",
+			"channel", channel,
+			"error", err,
+		)
+		return domain.Integration{}, err
 	}
-	return intg, nil
+
+	if err := domain.ValidateProviderIntegration(*intg); err != nil {
+		slog.WarnContext(ctx, "provider dispatch blocked",
+			"reason", "integration_not_ready",
+			"channel", channel,
+			"integration_id", intg.ID,
+			"provider", intg.ProviderName,
+			"status", intg.Status,
+			"error", err,
+		)
+		return domain.Integration{}, err
+	}
+
+	return *intg, nil
 }
 
 // inbox write helpers — each converts a domain error into meaningful context.
@@ -262,11 +244,12 @@ func (s *GatewayService) writeEmailToInbox(ctx context.Context, workspaceID stri
 	if s.inbox == nil {
 		return nil, fmt.Errorf("inbox writer not configured")
 	}
+	email = s.enrichEmailFromIntegration(ctx, workspaceID, email)
 	id, err := s.inbox.WriteEmail(ctx, workspaceID, email)
 	if err != nil {
 		return nil, fmt.Errorf("write email to inbox: %w", err)
 	}
-	return &contracts.SendResult{ID: id, StatusCode: 200, Message: "captured in memory"}, nil
+	return &contracts.SendResult{ID: id, StatusCode: 200, Message: "captured in inbox"}, nil
 }
 
 func (s *GatewayService) writeSMSToInbox(ctx context.Context, workspaceID string, sms contracts.SMS) (*contracts.SendResult, error) {
@@ -277,7 +260,7 @@ func (s *GatewayService) writeSMSToInbox(ctx context.Context, workspaceID string
 	if err != nil {
 		return nil, fmt.Errorf("write SMS to inbox: %w", err)
 	}
-	return &contracts.SendResult{ID: id, StatusCode: 200, Message: "captured in memory"}, nil
+	return &contracts.SendResult{ID: id, StatusCode: 200, Message: "captured in inbox"}, nil
 }
 
 func (s *GatewayService) writePushToInbox(ctx context.Context, workspaceID string, push contracts.PushNotification) (*contracts.SendResult, error) {
@@ -288,7 +271,7 @@ func (s *GatewayService) writePushToInbox(ctx context.Context, workspaceID strin
 	if err != nil {
 		return nil, fmt.Errorf("write push to inbox: %w", err)
 	}
-	return &contracts.SendResult{ID: id, StatusCode: 200, Message: "captured in memory"}, nil
+	return &contracts.SendResult{ID: id, StatusCode: 200, Message: "captured in inbox"}, nil
 }
 
 func (s *GatewayService) writeChatToInbox(ctx context.Context, workspaceID string, chat contracts.ChatMessage) (*contracts.SendResult, error) {
@@ -299,32 +282,13 @@ func (s *GatewayService) writeChatToInbox(ctx context.Context, workspaceID strin
 	if err != nil {
 		return nil, fmt.Errorf("write chat to inbox: %w", err)
 	}
-	return &contracts.SendResult{ID: id, StatusCode: 200, Message: "captured in memory"}, nil
-}
-
-// attachMeta stamps standard dispatch metadata onto a result without allocating
-// if Meta is already populated.
-func attachMeta(r *contracts.SendResult, mode domain.MessageDispatchMode, channel, integrationID, providerName string) {
-	if r == nil {
-		return
-	}
-	if r.Meta == nil {
-		r.Meta = make(map[string]string, 4)
-	}
-	r.Meta["dispatch_mode"] = string(mode)
-	r.Meta["channel"] = channel
-	if integrationID != "" {
-		r.Meta["integration_id"] = integrationID
-	}
-	if providerName != "" {
-		r.Meta["provider_name"] = providerName
-	}
+	return &contracts.SendResult{ID: id, StatusCode: 200, Message: "captured in inbox"}, nil
 }
 
-// RecordLog persists a MessageRequestLog entry. Failures are logged with slog.
-func (s *GatewayService) RecordLog(ctx context.Context, entry *domain.MessageRequestLog) error {
+// RecordLog persists a MessageRequestLog entry. Repository errors are logged at the infra layer.
+func (s *GatewayService) RecordLog(ctx context.Context, entry domain.MessageRequestLog) error {
 	if s.logs == nil || entry.WorkspaceID == "" {
 		return nil
 	}
-	return s.logs.Create(ctx, entry)
+	return s.logs.Create(ctx, &entry)
 }
diff --git a/internal/core/service/gateway_service_channels_test.go b/internal/core/service/gateway_service_channels_test.go
new file mode 100644
index 00000000..fae5f4b1
--- /dev/null
+++ b/internal/core/service/gateway_service_channels_test.go
@@ -0,0 +1,106 @@
+package service
+
+import (
+	"context"
+	"testing"
+
+	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
+	"github.com/weprodev/wpd-message-gateway/pkg/contracts"
+	_ "github.com/weprodev/wpd-message-gateway/pkg/provider/memory"
+)
+
+func TestGatewayService_SendSMS_memoryOnly(t *testing.T) {
+	t.Parallel()
+
+	settings := &stubSettingsRepo{values: map[string]string{
+		domain.SettingKeyStoreMessageContent: "true",
+	}}
+	inbox := &stubInbox{}
+	svc := NewGatewayService(&stubIntegrationRepo{}, nil, settings, inbox, nil)
+
+	res, err := svc.SendSMS(context.Background(), "ws-1", contracts.SMS{
+		To:      []string{"+15550001111"},
+		Message: "hello",
+	})
+	if err != nil {
+		t.Fatalf("SendSMS: %v", err)
+	}
+	if res.ID != "inbox-sms-1" {
+		t.Fatalf("got ID %q", res.ID)
+	}
+	if res.Meta[contracts.MetaKeyDispatchMode] != string(domain.DispatchMemory) {
+		t.Fatalf("dispatch_mode: %v", res.Meta[contracts.MetaKeyDispatchMode])
+	}
+	if res.Meta["channel"] != "sms" {
+		t.Fatalf("channel: %v", res.Meta["channel"])
+	}
+}
+
+func TestGatewayService_SendPush_memoryOnly(t *testing.T) {
+	t.Parallel()
+
+	settings := &stubSettingsRepo{values: map[string]string{
+		domain.SettingKeyStoreMessageContent: "true",
+	}}
+	inbox := &stubInbox{}
+	svc := NewGatewayService(&stubIntegrationRepo{}, nil, settings, inbox, nil)
+
+	res, err := svc.SendPush(context.Background(), "ws-1", contracts.PushNotification{
+		DeviceTokens: []string{"device-token-1"},
+		Title:        "Hi",
+		Body:         "There",
+	})
+	if err != nil {
+		t.Fatalf("SendPush: %v", err)
+	}
+	if res.ID != "inbox-push-1" {
+		t.Fatalf("got ID %q", res.ID)
+	}
+	if res.Meta[contracts.MetaKeyDispatchMode] != string(domain.DispatchMemory) {
+		t.Fatalf("dispatch_mode: %v", res.Meta[contracts.MetaKeyDispatchMode])
+	}
+	if res.Meta["channel"] != "push" {
+		t.Fatalf("channel: %v", res.Meta["channel"])
+	}
+}
+
+func TestGatewayService_SendChat_memoryOnly(t *testing.T) {
+	t.Parallel()
+
+	settings := &stubSettingsRepo{values: map[string]string{
+		domain.SettingKeyStoreMessageContent: "true",
+	}}
+	inbox := &stubInbox{}
+	svc := NewGatewayService(&stubIntegrationRepo{}, nil, settings, inbox, nil)
+
+	res, err := svc.SendChat(context.Background(), "ws-1", contracts.ChatMessage{
+		To:      []string{"user-1"},
+		Message: "ping",
+	})
+	if err != nil {
+		t.Fatalf("SendChat: %v", err)
+	}
+	if res.ID != "inbox-chat-1" {
+		t.Fatalf("got ID %q", res.ID)
+	}
+	if res.Meta[contracts.MetaKeyDispatchMode] != string(domain.DispatchMemory) {
+		t.Fatalf("dispatch_mode: %v", res.Meta[contracts.MetaKeyDispatchMode])
+	}
+	if res.Meta["channel"] != "chat" {
+		t.Fatalf("channel: %v", res.Meta["channel"])
+	}
+}
+
+func TestGatewayService_SendSMS_memoryOnly_inboxNil(t *testing.T) {
+	t.Parallel()
+
+	svc := NewGatewayService(&stubIntegrationRepo{}, nil, nil, nil, nil)
+
+	res, err := svc.SendSMS(context.Background(), "ws-1", contracts.SMS{To: []string{"+1"}, Message: "x"})
+	if err != nil {
+		t.Fatalf("expected memory provider dispatch without inbox, got: %v", err)
+	}
+	if res.ID == "" {
+		t.Fatal("expected provider message id")
+	}
+}
diff --git a/internal/core/service/gateway_service_test.go b/internal/core/service/gateway_service_test.go
index b41bc8a7..77687f6d 100644
--- a/internal/core/service/gateway_service_test.go
+++ b/internal/core/service/gateway_service_test.go
@@ -2,14 +2,32 @@ package service
 
 import (
 	"context"
+	"errors"
 	"testing"
 	"time"
 
 	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
 	"github.com/weprodev/wpd-message-gateway/internal/core/port"
 	"github.com/weprodev/wpd-message-gateway/pkg/contracts"
+	"github.com/weprodev/wpd-message-gateway/pkg/provider/mailgun"
+	_ "github.com/weprodev/wpd-message-gateway/pkg/provider/memory"
+	"github.com/weprodev/wpd-message-gateway/pkg/registry"
 )
 
+type stubMailgunSender struct{}
+
+func (s *stubMailgunSender) Send(ctx context.Context, email contracts.Email) (*contracts.SendResult, error) {
+	return &contracts.SendResult{ID: "mg-1", StatusCode: 200, Message: "sent"}, nil
+}
+
+func (s *stubMailgunSender) Name() string { return mailgun.ProviderName }
+
+func init() {
+	registry.RegisterEmailProvider(mailgun.ProviderName, func(cfg registry.EmailConfig) (contracts.EmailSender, error) {
+		return &stubMailgunSender{}, nil
+	})
+}
+
 type stubSettingsRepo struct {
 	values map[string]string
 }
@@ -92,9 +110,93 @@ func (s *stubInbox) WriteChat(ctx context.Context, workspaceID string, chat cont
 	return "inbox-chat-1", nil
 }
 
+func TestGatewayService_ResolveDispatchConfig_defaults(t *testing.T) {
+	svc := NewGatewayService(nil, nil, &stubSettingsRepo{}, nil, nil)
+
+	config, _ := svc.ResolveDispatchConfig(context.Background(), "ws-1")
+	if config.Mode != domain.DispatchMemory {
+		t.Fatalf("mode: %v", config.Mode)
+	}
+	if config.StoreMessageContent {
+		t.Fatal("expected store_message_content false by default")
+	}
+}
+
+func TestGatewayService_ResolveDispatchConfig_fromSettings(t *testing.T) {
+	settings := &stubSettingsRepo{values: map[string]string{
+		domain.SettingKeyMessageDispatchMode: string(domain.DispatchProvider),
+		domain.SettingKeyStoreMessageContent: "true",
+	}}
+	svc := NewGatewayService(nil, nil, settings, nil, nil)
+
+	config, _ := svc.ResolveDispatchConfig(context.Background(), "ws-1")
+	if config.Mode != domain.DispatchProvider {
+		t.Fatalf("mode: %v", config.Mode)
+	}
+	if !config.StoreMessageContent {
+		t.Fatal("expected store_message_content true")
+	}
+}
+
+func TestGatewayService_SendEmail_memoryWithoutStoreContent(t *testing.T) {
+	inbox := &stubInbox{emailID: "should-not-write"}
+	svc := NewGatewayService(&stubIntegrationRepo{}, nil, &stubSettingsRepo{}, inbox, nil)
+
+	res, err := svc.SendEmail(context.Background(), "ws-1", contracts.Email{
+		To: []string{"a@b.com"}, Subject: "s", HTML: "h",
+	})
+	if err != nil {
+		t.Fatalf("SendEmail: %v", err)
+	}
+	if res.ID == "should-not-write" {
+		t.Fatal("expected memory provider dispatch, not portal inbox capture")
+	}
+	if res.Meta[contracts.MetaKeyStoreContent] != "false" {
+		t.Fatalf("store_content: %v", res.Meta[contracts.MetaKeyStoreContent])
+	}
+	if contracts.InboxMessageIDFromResult(res) != "" {
+		t.Fatalf("unexpected inbox_message_id: %v", contracts.InboxMessageIDFromResult(res))
+	}
+}
+
+func TestGatewayService_SendEmail_memoryWithStoreContent(t *testing.T) {
+	settings := &stubSettingsRepo{values: map[string]string{
+		domain.SettingKeyStoreMessageContent: "true",
+	}}
+	inbox := &stubInbox{emailID: "stored-1"}
+	svc := NewGatewayService(&stubIntegrationRepo{}, nil, settings, inbox, nil)
+
+	res, err := svc.SendEmail(context.Background(), "ws-1", contracts.Email{
+		To: []string{"a@b.com"}, Subject: "s", HTML: "h",
+	})
+	if err != nil {
+		t.Fatalf("SendEmail: %v", err)
+	}
+	if res.ID != "stored-1" {
+		t.Fatalf("got ID %q", res.ID)
+	}
+}
+
+func TestGatewayService_SendEmail_providerMissingIntegration(t *testing.T) {
+	settings := &stubSettingsRepo{values: map[string]string{
+		domain.SettingKeyMessageDispatchMode: string(domain.DispatchProvider),
+	}}
+	svc := NewGatewayService(&stubIntegrationRepo{err: errors.New("not found")}, nil, settings, nil, nil)
+
+	_, err := svc.SendEmail(context.Background(), "ws-1", contracts.Email{
+		To: []string{"a@b.com"}, Subject: "s", HTML: "h",
+	})
+	if err == nil {
+		t.Fatal("expected provider lookup error")
+	}
+}
+
 func TestGatewayService_SendEmail_memoryOnly(t *testing.T) {
 	inbox := &stubInbox{emailID: "mem-1"}
-	svc := NewGatewayService(&stubIntegrationRepo{}, nil, nil, inbox, nil)
+	settings := &stubSettingsRepo{values: map[string]string{
+		domain.SettingKeyStoreMessageContent: "true",
+	}}
+	svc := NewGatewayService(&stubIntegrationRepo{}, nil, settings, inbox, nil)
 
 	res, err := svc.SendEmail(context.Background(), "ws-1", contracts.Email{
 		To:      []string{"a@b.com"},
@@ -107,13 +209,13 @@ func TestGatewayService_SendEmail_memoryOnly(t *testing.T) {
 	if res.ID != "mem-1" {
 		t.Fatalf("got ID %q", res.ID)
 	}
-	if res.Meta["dispatch_mode"] != string(domain.DispatchMemoryOnly) {
-		t.Fatalf("dispatch_mode: %v", res.Meta["dispatch_mode"])
+	if res.Meta[contracts.MetaKeyDispatchMode] != string(domain.DispatchMemory) {
+		t.Fatalf("dispatch_mode: %v", res.Meta[contracts.MetaKeyDispatchMode])
 	}
 	if res.Meta["channel"] != "email" {
 		t.Fatalf("channel: %v", res.Meta["channel"])
 	}
-	if res.Meta["provider_name"] != memoryProviderName {
+	if res.Meta["provider_name"] != domain.ProviderNameMemory {
 		t.Fatalf("provider_name: %v", res.Meta["provider_name"])
 	}
 }
@@ -121,9 +223,12 @@ func TestGatewayService_SendEmail_memoryOnly(t *testing.T) {
 func TestGatewayService_SendEmail_memoryOnly_inboxNil(t *testing.T) {
 	svc := NewGatewayService(&stubIntegrationRepo{}, nil, nil, nil, nil)
 
-	_, err := svc.SendEmail(context.Background(), "ws-1", contracts.Email{To: []string{"a@b.com"}, Subject: "s"})
-	if err == nil {
-		t.Fatal("expected error when inbox is nil")
+	res, err := svc.SendEmail(context.Background(), "ws-1", contracts.Email{To: []string{"a@b.com"}, Subject: "s"})
+	if err != nil {
+		t.Fatalf("expected memory provider dispatch without inbox, got: %v", err)
+	}
+	if res.ID == "" {
+		t.Fatal("expected provider message id")
 	}
 }
 
@@ -133,17 +238,114 @@ func TestGatewayService_SendEmail_providerOnly_memoryIntegration(t *testing.T) {
 		ID:           "int-1",
 		WorkspaceID:  "ws-1",
 		ChannelType:  "email",
-		ProviderName: memoryProviderName,
+		ProviderName: domain.ProviderNameMemory,
 		Config:       []byte(`{}`),
 		Status:       domain.IntegrationStatusConnected,
 		CreatedAt:    ts,
 		UpdatedAt:    ts,
 	}
 	settings := &stubSettingsRepo{values: map[string]string{
-		domain.SettingKeyMessageDispatchMode: string(domain.DispatchProviderOnly),
+		domain.SettingKeyMessageDispatchMode: string(domain.DispatchProvider),
 	}}
-	inbox := &stubInbox{emailID: "cap-1"}
-	svc := NewGatewayService(&stubIntegrationRepo{active: intg}, nil, settings, inbox, nil)
+	svc := NewGatewayService(&stubIntegrationRepo{active: intg}, nil, settings, nil, nil)
+
+	_, err := svc.SendEmail(context.Background(), "ws-1", contracts.Email{
+		To: []string{"a@b.com"}, Subject: "s", HTML: "h",
+	})
+	if err == nil {
+		t.Fatal("expected error when provider mode uses memory integration")
+	}
+	if !errors.Is(err, domain.ErrProviderNotReady) {
+		t.Fatalf("expected ErrProviderNotReady, got %v", err)
+	}
+}
+
+func TestGatewayService_SendEmail_providerOnly_missingIntegration(t *testing.T) {
+	settings := &stubSettingsRepo{values: map[string]string{
+		domain.SettingKeyMessageDispatchMode: string(domain.DispatchProvider),
+	}}
+	svc := NewGatewayService(&stubIntegrationRepo{err: port.ErrNotFound}, nil, settings, nil, nil)
+
+	_, err := svc.SendEmail(context.Background(), "ws-1", contracts.Email{
+		To: []string{"a@b.com"}, Subject: "s", HTML: "h",
+	})
+	if err == nil {
+		t.Fatal("expected error when no active integration")
+	}
+	if !errors.Is(err, port.ErrNotFound) {
+		t.Fatalf("expected ErrNotFound, got %v", err)
+	}
+}
+
+func TestGatewayService_SendEmail_providerOnly_emptyConfig(t *testing.T) {
+	ts := time.Now()
+	intg := &domain.Integration{
+		ID:           "int-1",
+		WorkspaceID:  "ws-1",
+		ChannelType:  "email",
+		ProviderName: mailgun.ProviderName,
+		Config:       []byte(`   `),
+		Status:       domain.IntegrationStatusConnected,
+		CreatedAt:    ts,
+		UpdatedAt:    ts,
+	}
+	settings := &stubSettingsRepo{values: map[string]string{
+		domain.SettingKeyMessageDispatchMode: string(domain.DispatchProvider),
+	}}
+	svc := NewGatewayService(&stubIntegrationRepo{active: intg}, nil, settings, nil, nil)
+
+	_, err := svc.SendEmail(context.Background(), "ws-1", contracts.Email{
+		To: []string{"a@b.com"}, Subject: "s", HTML: "h",
+	})
+	if err == nil {
+		t.Fatal("expected error when provider config is empty")
+	}
+	if !errors.Is(err, domain.ErrProviderNotReady) {
+		t.Fatalf("expected ErrProviderNotReady, got %v", err)
+	}
+}
+
+func TestGatewayService_SendEmail_providerOnly_unknownProvider(t *testing.T) {
+	ts := time.Now()
+	intg := &domain.Integration{
+		ID:           "int-1",
+		WorkspaceID:  "ws-1",
+		ChannelType:  "email",
+		ProviderName: "unknown-provider",
+		Config:       []byte(`{"api_key":"key"}`),
+		Status:       domain.IntegrationStatusConnected,
+		CreatedAt:    ts,
+		UpdatedAt:    ts,
+	}
+	settings := &stubSettingsRepo{values: map[string]string{
+		domain.SettingKeyMessageDispatchMode: string(domain.DispatchProvider),
+	}}
+	svc := NewGatewayService(&stubIntegrationRepo{active: intg}, nil, settings, nil, nil)
+
+	_, err := svc.SendEmail(context.Background(), "ws-1", contracts.Email{
+		To: []string{"a@b.com"}, Subject: "s", HTML: "h",
+	})
+	if err == nil {
+		t.Fatal("expected error when provider factory is not registered")
+	}
+}
+
+func TestGatewayService_SendEmail_providerOnly_mailgunIntegration(t *testing.T) {
+	ts := time.Now()
+	intg := &domain.Integration{
+		ID:           "int-mg",
+		WorkspaceID:  "ws-1",
+		ChannelType:  "email",
+		ProviderName: mailgun.ProviderName,
+		Config:       []byte(`{"api_key":"key","domain":"mg.example.com","from_email":"noreply@mg.example.com"}`),
+		Status:       domain.IntegrationStatusConnected,
+		CreatedAt:    ts,
+		UpdatedAt:    ts,
+	}
+	settings := &stubSettingsRepo{values: map[string]string{
+		domain.SettingKeyMessageDispatchMode: string(domain.DispatchProvider),
+	}}
+	svc := NewGatewayService(&stubIntegrationRepo{active: intg}, nil, settings, nil, nil)
 
 	res, err := svc.SendEmail(context.Background(), "ws-1", contracts.Email{
 		To: []string{"a@b.com"}, Subject: "s", HTML: "h",
@@ -151,13 +353,60 @@ func TestGatewayService_SendEmail_providerOnly_memoryIntegration(t *testing.T) {
 	if err != nil {
 		t.Fatalf("SendEmail: %v", err)
 	}
-	if res.ID != "cap-1" {
+	if res.ID != "mg-1" {
 		t.Fatalf("got ID %q", res.ID)
 	}
-	if res.Meta["dispatch_mode"] != string(domain.DispatchProviderOnly) {
-		t.Fatalf("dispatch_mode: %v", res.Meta["dispatch_mode"])
+	if res.Meta["provider_name"] != mailgun.ProviderName {
+		t.Fatalf("provider_name: %v", res.Meta["provider_name"])
+	}
+}
+
+func TestGatewayService_SendEmail_providerDatabase_mailgunIntegration(t *testing.T) {
+	ts := time.Now()
+	intg := &domain.Integration{
+		ID:           "int-mg",
+		WorkspaceID:  "ws-1",
+		ChannelType:  "email",
+		ProviderName: mailgun.ProviderName,
+		Config:       []byte(`{"api_key":"key","domain":"mg.example.com","from_email":"noreply@mg.example.com"}`),
+		Status:       domain.IntegrationStatusConnected,
+		CreatedAt:    ts,
+		UpdatedAt:    ts,
+	}
+	settings := &stubSettingsRepo{values: map[string]string{
+		domain.SettingKeyMessageDispatchMode: string(domain.DispatchProvider),
+		domain.SettingKeyStoreMessageContent: "true",
+	}}
+	inbox := &stubInbox{emailID: "inbox-1"}
+	svc := NewGatewayService(&stubIntegrationRepo{active: intg}, nil, settings, inbox, nil)
+
+	res, err := svc.SendEmail(context.Background(), "ws-1", contracts.Email{
+		To: []string{"a@b.com"}, Subject: "s", HTML: "h",
+	})
+	if err != nil {
+		t.Fatalf("SendEmail: %v", err)
+	}
+	if res.Meta["provider_name"] != mailgun.ProviderName {
+		t.Fatalf("provider_name: %v", res.Meta["provider_name"])
+	}
+	if res.Meta[contracts.MetaKeyInboxMessageID] != "inbox-1" {
+		t.Fatalf("inbox_message_id: %v", res.Meta[contracts.MetaKeyInboxMessageID])
+	}
+}
+
+func TestGatewayService_dispatch_errorResult_stampsProviderMeta(t *testing.T) {
+	settings := &stubSettingsRepo{values: map[string]string{
+		domain.SettingKeyStoreMessageContent: "true",
+	}}
+	svc := NewGatewayService(nil, nil, settings, nil, nil)
+
+	res, err := svc.SendEmail(context.Background(), "ws-1", contracts.Email{
+		To: []string{"a@b.com"}, Subject: "s", HTML: "h",
+	})
+	if err == nil {
+		t.Fatal("expected inbox error when store content enabled without inbox writer")
 	}
-	if res.Meta["integration_id"] != "int-1" {
-		t.Fatalf("integration_id: %v", res.Meta["integration_id"])
+	if contracts.ProviderNameFromResult(res) != domain.ProviderNameMemory {
+		t.Fatalf("provider_name: %q", contracts.ProviderNameFromResult(res))
 	}
 }
diff --git a/internal/core/service/portal_service.go b/internal/core/service/portal_service.go
index 24403d0e..1d2edbeb 100644
--- a/internal/core/service/portal_service.go
+++ b/internal/core/service/portal_service.go
@@ -132,16 +132,22 @@ func (s *PortalService) CreateWorkspace(ctx context.Context, userID, name, slug,
 		Visibility: "private",
 		IconKey:    strings.TrimSpace(iconKey),
 	}
-	if err := s.workspaces.Create(ctx, w); err != nil {
+	if err := s.workspaces.Create(ctx, w, userID); err != nil {
 		slog.ErrorContext(ctx, "workspace creation failed: database error", "error", err, "user_id", userID)
 		return nil, err
 	}
 	if err := s.members.Add(ctx, w.ID, userID, domain.RoleAdmin); err != nil {
 		slog.ErrorContext(ctx, "workspace creation failed: failed to add member", "error", err, "workspace_id", w.ID, "user_id", userID)
+		if delErr := s.workspaces.Delete(ctx, w.ID); delErr != nil {
+			slog.WarnContext(ctx, "failed to roll back workspace after member add error", "error", delErr, "workspace_id", w.ID)
+		}
 		return nil, err
 	}
 	if err := s.gate.AssignRole(ctx, "users", userID, w.ID, domain.RoleAdmin); err != nil {
 		slog.ErrorContext(ctx, "workspace creation failed: failed to assign role", "error", err, "workspace_id", w.ID, "user_id", userID)
+		if delErr := s.workspaces.Delete(ctx, w.ID); delErr != nil {
+			slog.WarnContext(ctx, "failed to roll back workspace after role assign error", "error", delErr, "workspace_id", w.ID)
+		}
 		return nil, err
 	}
 	slog.InfoContext(ctx, "workspace created successfully", "workspace_id", w.ID, "user_id", userID)
@@ -208,32 +214,39 @@ func (s *PortalService) ListWorkspaces(ctx context.Context, userID string) ([]do
 		return nil, err
 	}
 
+	memberWorkspaceIDs := make([]string, 0, len(workspaces))
 	for i := range workspaces {
 		w := &workspaces[i]
-		// Get role in this workspace
-		role, err := s.members.GetRole(ctx, w.ID, userID)
-		if err != nil {
-			// If not a member, check if it's public
-			if w.Visibility == "public" {
-				w.Role = "viewer"
-				w.Permissions = []string{
-					domain.PermissionWorkspacesRead,
-					domain.PermissionMembersRead,
-					domain.PermissionAPIKeysRead,
-					domain.PermissionLogsRead,
-					domain.PermissionIntegrationsRead,
-					domain.PermissionTemplatesRead,
-					domain.PermissionSettingsRead,
-					domain.PermissionInvitationsRead,
-				}
-			}
+		if w.Role != "" {
+			memberWorkspaceIDs = append(memberWorkspaceIDs, w.ID)
 			continue
 		}
+		if w.Visibility == "public" {
+			w.Role = "viewer"
+			w.Permissions = []string{
+				domain.PermissionWorkspacesRead,
+				domain.PermissionMembersRead,
+				domain.PermissionAPIKeysRead,
+				domain.PermissionLogsRead,
+				domain.PermissionIntegrationsRead,
+				domain.PermissionTemplatesRead,
+				domain.PermissionSettingsRead,
+				domain.PermissionInvitationsRead,
+			}
+		}
+	}
 
-		w.Role = role
-		// Get permissions from gogate
-		perms, err := s.gate.GetAllPermissions(ctx, "users", userID, w.ID)
-		if err == nil {
+	permsByTeam, err := s.gate.GetPermissionsForTeams(ctx, "users", userID, memberWorkspaceIDs)
+	if err != nil {
+		return nil, fmt.Errorf("load workspace permissions: %w", err)
+	}
+
+	for i := range workspaces {
+		w := &workspaces[i]
+		if w.Role == "" {
+			continue
+		}
+		if perms, ok := permsByTeam[w.ID]; ok {
 			w.Permissions = perms
 		}
 	}
@@ -510,14 +523,61 @@ func (s *PortalService) GetSettings(ctx context.Context, workspaceID string) (ma
 }
 
 func (s *PortalService) PatchSettings(ctx context.Context, workspaceID string, kv map[string]string) error {
+	keys := make([]string, 0, len(kv))
+	for k := range kv {
+		keys = append(keys, k)
+	}
+	slog.InfoContext(ctx, "patching workspace settings", "workspace_id", workspaceID, "keys", keys)
+
 	for k, v := range kv {
+		if err := domain.ValidateWorkspaceSettingValue(k, v); err != nil {
+			slog.WarnContext(ctx, "settings patch rejected: invalid value",
+				"workspace_id", workspaceID,
+				"key", k,
+				"error", err,
+			)
+			return fmt.Errorf("%w: %w", port.ErrInvalidInput, err)
+		}
+
+		if k == domain.SettingKeyMessageDispatchMode && v == string(domain.DispatchProvider) {
+			list, err := s.integrations.ListByWorkspace(ctx, workspaceID)
+			if err != nil {
+				return fmt.Errorf("failed to check integrations for provider enablement: %w", err)
+			}
+			hasConnected := false
+			for _, intg := range list {
+				if intg.ProviderName != domain.ProviderNameMemory && intg.Status == domain.IntegrationStatusConnected {
+					hasConnected = true
+					break
+				}
+			}
+			if !hasConnected {
+				return fmt.Errorf("%w: configure a provider in Integrations before switching to provider mode", port.ErrInvalidInput)
+			}
+		}
+
 		if err := s.settings.Set(ctx, workspaceID, k, v); err != nil {
 			return err
 		}
 	}
+
+	slog.InfoContext(ctx, "workspace settings patched successfully", "workspace_id", workspaceID, "keys", keys)
 	return nil
 }
 
+const invitationTTL = 7 * 24 * time.Hour
+
+// NewPendingInvitation builds a workspace invitation with the standard expiry window.
+func (s *PortalService) NewPendingInvitation(workspaceID, email, role string) *domain.Invitation {
+	return &domain.Invitation{
+		WorkspaceID: workspaceID,
+		Email:       email,
+		Role:        role,
+		ExpiresAt:   time.Now().Add(invitationTTL),
+		Status:      "pending",
+	}
+}
+
 // ListInvitations returns all pending invitations for a workspace.
 func (s *PortalService) ListInvitations(ctx context.Context, workspaceID string) ([]domain.Invitation, error) {
 	return s.invites.ListPendingByWorkspace(ctx, workspaceID)
diff --git a/internal/core/service/portal_service_extended_test.go b/internal/core/service/portal_service_extended_test.go
new file mode 100644
index 00000000..2ac0ae7d
--- /dev/null
+++ b/internal/core/service/portal_service_extended_test.go
@@ -0,0 +1,196 @@
+package service
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+
+	"github.com/weprodev/go-pkg/crypto"
+
+	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
+	"github.com/weprodev/wpd-message-gateway/internal/core/port"
+)
+
+type fakeInvitationRepo struct {
+	created *domain.Invitation
+	list    []domain.Invitation
+}
+
+func (f *fakeInvitationRepo) Create(_ context.Context, inv *domain.Invitation) error {
+	f.created = inv
+	inv.ID = "inv-" + uuid.NewString()
+	return nil
+}
+
+func (f *fakeInvitationRepo) ListPendingByWorkspace(_ context.Context, workspaceID string) ([]domain.Invitation, error) {
+	return f.list, nil
+}
+
+type fakeAPIKeyRepo struct {
+	keys    map[string]*domain.APIKey
+	byWS    map[string][]domain.APIKey
+	created *domain.APIKey
+	deleted string
+}
+
+func (f *fakeAPIKeyRepo) Create(_ context.Context, k *domain.APIKey) error {
+	if f.keys == nil {
+		f.keys = make(map[string]*domain.APIKey)
+	}
+	if f.byWS == nil {
+		f.byWS = make(map[string][]domain.APIKey)
+	}
+	k.ID = "key-" + uuid.NewString()
+	f.created = k
+	f.keys[k.ID] = k
+	f.byWS[k.WorkspaceID] = append(f.byWS[k.WorkspaceID], *k)
+	return nil
+}
+
+func (f *fakeAPIKeyRepo) GetByClientID(_ context.Context, clientID string) (*domain.APIKey, error) {
+	for _, k := range f.keys {
+		if k.ClientID == clientID {
+			return k, nil
+		}
+	}
+	return nil, port.ErrNotFound
+}
+
+func (f *fakeAPIKeyRepo) GetByID(_ context.Context, id string) (*domain.APIKey, error) {
+	k, ok := f.keys[id]
+	if !ok {
+		return nil, port.ErrNotFound
+	}
+	return k, nil
+}
+
+func (f *fakeAPIKeyRepo) ListByWorkspace(_ context.Context, workspaceID string) ([]domain.APIKey, error) {
+	return f.byWS[workspaceID], nil
+}
+
+func (f *fakeAPIKeyRepo) Delete(_ context.Context, id string) error {
+	f.deleted = id
+	delete(f.keys, id)
+	return nil
+}
+
+func (f *fakeAPIKeyRepo) UpdateSecret(_ context.Context, id, clientID, secretHash string) error {
+	k, ok := f.keys[id]
+	if !ok {
+		return port.ErrNotFound
+	}
+	k.ClientID = clientID
+	k.ClientSecretHash = secretHash
+	return nil
+}
+
+func (f *fakeAPIKeyRepo) UpdateLastUsedAt(_ context.Context, id string) error {
+	return nil
+}
+
+func TestPortalService_NewPendingInvitation(t *testing.T) {
+	t.Parallel()
+
+	svc := NewPortalService(PortalDeps{})
+	before := time.Now()
+	inv := svc.NewPendingInvitation("ws-1", "user@example.com", domain.RoleMember)
+	after := time.Now()
+
+	if inv.WorkspaceID != "ws-1" || inv.Email != "user@example.com" || inv.Role != domain.RoleMember {
+		t.Fatalf("unexpected invitation fields: %+v", inv)
+	}
+	if inv.Status != "pending" {
+		t.Fatalf("expected pending status, got %q", inv.Status)
+	}
+	wantMin := before.Add(7 * 24 * time.Hour)
+	wantMax := after.Add(7 * 24 * time.Hour)
+	if inv.ExpiresAt.Before(wantMin) || inv.ExpiresAt.After(wantMax) {
+		t.Fatalf("expected ~7-day expiry, got %v (window %v–%v)", inv.ExpiresAt, wantMin, wantMax)
+	}
+}
+
+func TestPortalService_CreateInvitation(t *testing.T) {
+	t.Parallel()
+
+	repo := &fakeInvitationRepo{}
+	svc := NewPortalService(PortalDeps{Invitations: repo})
+	inv := svc.NewPendingInvitation("ws-1", "user@example.com", domain.RoleMember)
+
+	rawToken, err := svc.CreateInvitation(context.Background(), inv)
+	if err != nil {
+		t.Fatalf("CreateInvitation: %v", err)
+	}
+	if rawToken == "" {
+		t.Fatal("expected non-empty token")
+	}
+	if repo.created == nil || repo.created.TokenHash == "" {
+		t.Fatal("expected hashed token persisted")
+	}
+	if rawToken == repo.created.TokenHash {
+		t.Fatal("stored value must be hash, not plaintext token")
+	}
+	sum := sha256.Sum256([]byte(rawToken))
+	if repo.created.TokenHash != hex.EncodeToString(sum[:]) {
+		t.Fatalf("token hash mismatch: got %q", repo.created.TokenHash)
+	}
+}
+
+func TestPortalService_APIKeys(t *testing.T) {
+	t.Parallel()
+
+	ctx := context.Background()
+	repo := &fakeAPIKeyRepo{}
+	svc := NewPortalService(PortalDeps{APIKeys: repo})
+
+	key, secret, err := svc.CreateAPIKey(ctx, "ws-1", "  My Key  ")
+	if err != nil {
+		t.Fatalf("CreateAPIKey: %v", err)
+	}
+	if secret == "" {
+		t.Fatal("expected plaintext secret")
+	}
+	if key.Name != "My Key" {
+		t.Fatalf("expected trimmed name, got %q", key.Name)
+	}
+	if !crypto.CheckSecretHash(secret, repo.created.ClientSecretHash) {
+		t.Fatal("stored hash does not match returned secret")
+	}
+
+	list, err := svc.ListAPIKeys(ctx, "ws-1")
+	if err != nil {
+		t.Fatalf("ListAPIKeys: %v", err)
+	}
+	if len(list) != 1 || list[0].ID != key.ID {
+		t.Fatalf("expected one key in list, got %+v", list)
+	}
+
+	if err := svc.DeleteAPIKey(ctx, "ws-1", key.ID); err != nil {
+		t.Fatalf("DeleteAPIKey: %v", err)
+	}
+	if repo.deleted != key.ID {
+		t.Fatalf("expected delete id %q, got %q", key.ID, repo.deleted)
+	}
+}
+
+func TestPortalService_DeleteAPIKey_rejectsWrongWorkspace(t *testing.T) {
+	t.Parallel()
+
+	repo := &fakeAPIKeyRepo{
+		keys: map[string]*domain.APIKey{
+			"key-1": {ID: "key-1", WorkspaceID: "ws-other"},
+		},
+	}
+	svc := NewPortalService(PortalDeps{APIKeys: repo})
+
+	err := svc.DeleteAPIKey(context.Background(), "ws-1", "key-1")
+	if err == nil || err.Error() != "api key not in workspace" {
+		t.Fatalf("expected workspace mismatch error, got %v", err)
+	}
+	if repo.deleted != "" {
+		t.Fatal("delete should not run for wrong workspace")
+	}
+}
diff --git a/internal/core/service/portal_service_test.go b/internal/core/service/portal_service_test.go
index f7df2f58..e5172fde 100644
--- a/internal/core/service/portal_service_test.go
+++ b/internal/core/service/portal_service_test.go
@@ -17,9 +17,12 @@ import (
 const testJWTSecret = "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
 
 type fakeUserRepo struct {
-	byEmail *domain.User
-	err     error
-	created *domain.User
+	byEmail         *domain.User
+	byID            *domain.User
+	err             error
+	created         *domain.User
+	setVerifiedErr  error
+	verifiedUserIDs []string
 }
 
 func (f *fakeUserRepo) Create(ctx context.Context, u *domain.User) error {
@@ -29,14 +32,24 @@ func (f *fakeUserRepo) Create(ctx context.Context, u *domain.User) error {
 }
 
 func (f *fakeUserRepo) GetByEmail(ctx context.Context, email string) (*domain.User, error) {
-	return f.byEmail, f.err
+	if f.err != nil {
+		return nil, f.err
+	}
+	return f.byEmail, nil
 }
 
 func (f *fakeUserRepo) GetByID(ctx context.Context, id string) (*domain.User, error) {
+	if f.byID != nil && f.byID.ID.String() == id {
+		return f.byID, nil
+	}
 	return nil, port.ErrNotFound
 }
 
 func (f *fakeUserRepo) SetEmailVerified(ctx context.Context, id string) error {
+	if f.setVerifiedErr != nil {
+		return f.setVerifiedErr
+	}
+	f.verifiedUserIDs = append(f.verifiedUserIDs, id)
 	return nil
 }
 
@@ -110,3 +123,99 @@ func TestAuthService_Login_masksInfrastructureErrors(t *testing.T) {
 		t.Fatalf("expected invalid email or password error, got %v", err)
 	}
 }
+
+type fakeSettingsRepo struct {
+	values map[string]string
+}
+
+func (f *fakeSettingsRepo) Get(ctx context.Context, workspaceID, key string) (string, error) {
+	return f.values[key], nil
+}
+
+func (f *fakeSettingsRepo) Set(ctx context.Context, workspaceID, key, value string) error {
+	if f.values == nil {
+		f.values = make(map[string]string)
+	}
+	f.values[key] = value
+	return nil
+}
+
+func (f *fakeSettingsRepo) GetAll(ctx context.Context, workspaceID string) (map[string]string, error) {
+	return f.values, nil
+}
+
+type fakeIntegrationRepo struct {
+	integrations []domain.Integration
+}
+
+func (f *fakeIntegrationRepo) Create(ctx context.Context, intg *domain.Integration) error { return nil }
+func (f *fakeIntegrationRepo) ListByWorkspace(ctx context.Context, workspaceID string) ([]domain.Integration, error) {
+	return f.integrations, nil
+}
+func (f *fakeIntegrationRepo) Upsert(ctx context.Context, intg *domain.Integration) error { return nil }
+func (f *fakeIntegrationRepo) GetByID(ctx context.Context, id string) (*domain.Integration, error) {
+	return nil, port.ErrNotFound
+}
+func (f *fakeIntegrationRepo) Delete(ctx context.Context, id string) error { return nil }
+func (f *fakeIntegrationRepo) ListProviders(ctx context.Context) ([]domain.Provider, error) {
+	return nil, nil
+}
+func (f *fakeIntegrationRepo) GetProviderFields(ctx context.Context, name string) ([]domain.ProviderConfigField, error) {
+	return nil, nil
+}
+func (f *fakeIntegrationRepo) GetActiveByWorkspaceAndChannel(ctx context.Context, workspaceID, channel string) (*domain.Integration, error) {
+	return nil, nil
+}
+
+func TestPortalService_PatchSettings_rejectsInvalidDispatchMode(t *testing.T) {
+	svc := NewPortalService(PortalDeps{Settings: &fakeSettingsRepo{}})
+
+	err := svc.PatchSettings(context.Background(), "ws-1", map[string]string{
+		domain.SettingKeyMessageDispatchMode: "invalid",
+	})
+	if !errors.Is(err, port.ErrInvalidInput) {
+		t.Fatalf("expected ErrInvalidInput, got %v", err)
+	}
+}
+
+func TestPortalService_PatchSettings_rejectsProviderWithoutIntegration(t *testing.T) {
+	repo := &fakeSettingsRepo{}
+	intgRepo := &fakeIntegrationRepo{
+		integrations: []domain.Integration{},
+	}
+	svc := NewPortalService(PortalDeps{
+		Settings:     repo,
+		Integrations: intgRepo,
+	})
+
+	err := svc.PatchSettings(context.Background(), "ws-1", map[string]string{
+		domain.SettingKeyMessageDispatchMode: string(domain.DispatchProvider),
+	})
+	if !errors.Is(err, port.ErrInvalidInput) {
+		t.Fatalf("expected ErrInvalidInput, got %v", err)
+	}
+}
+
+func TestPortalService_PatchSettings_persistsValidDispatchSettings(t *testing.T) {
+	repo := &fakeSettingsRepo{}
+	intgRepo := &fakeIntegrationRepo{
+		integrations: []domain.Integration{
+			{ProviderName: "mailgun", Status: domain.IntegrationStatusConnected},
+		},
+	}
+	svc := NewPortalService(PortalDeps{
+		Settings:     repo,
+		Integrations: intgRepo,
+	})
+
+	err := svc.PatchSettings(context.Background(), "ws-1", map[string]string{
+		domain.SettingKeyMessageDispatchMode: string(domain.DispatchProvider),
+		domain.SettingKeyStoreMessageContent: "true",
+	})
+	if err != nil {
+		t.Fatalf("PatchSettings: %v", err)
+	}
+	if repo.values[domain.SettingKeyMessageDispatchMode] != string(domain.DispatchProvider) {
+		t.Fatalf("mode not saved: %+v", repo.values)
+	}
+}
diff --git a/internal/core/service/provider_cache.go b/internal/core/service/provider_cache.go
index ab8c175a..bb7d5827 100644
--- a/internal/core/service/provider_cache.go
+++ b/internal/core/service/provider_cache.go
@@ -4,12 +4,23 @@ import (
 	"encoding/json"
 	"fmt"
 	"sync"
+	"time"
 
 	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
 	"github.com/weprodev/wpd-message-gateway/pkg/contracts"
 	"github.com/weprodev/wpd-message-gateway/pkg/registry"
 )
 
+// memoryDispatchIntegration is a stable synthetic integration for in-process memory provider dispatch.
+func memoryDispatchIntegration() domain.Integration {
+	return domain.Integration{
+		ID:           domain.ProviderNameMemory,
+		ProviderName: domain.ProviderNameMemory,
+		Config:       []byte(`{}`),
+		UpdatedAt:    time.Unix(0, 0).UTC(),
+	}
+}
+
 // providerCache caches instantiated send providers keyed by integration ID and
 // the update timestamp. The timestamp acts as a natural version: when the
 // integration config changes, its updated_at advances and the old entry is
diff --git a/internal/infrastructure/authgate/gate_adapter.go b/internal/infrastructure/authgate/gate_adapter.go
index 20717186..7b4b98b6 100644
--- a/internal/infrastructure/authgate/gate_adapter.go
+++ b/internal/infrastructure/authgate/gate_adapter.go
@@ -2,7 +2,11 @@ package authgate
 
 import (
 	"context"
+	"sort"
 
+	"github.com/lib/pq"
+
+	"github.com/weprodev/go-pkg/pgsql"
 	gogate "github.com/weprodev/wpd-gogate"
 
 	"github.com/weprodev/wpd-message-gateway/internal/core/port"
@@ -10,10 +14,11 @@ import (
 
 type GoGateAdapter struct {
 	gate *gogate.Gate
+	db   pgsql.DBTX
 }
 
-func NewGoGateAdapter(gate *gogate.Gate) port.AuthorizationGate {
-	return &GoGateAdapter{gate: gate}
+func NewGoGateAdapter(gate *gogate.Gate, db pgsql.DBTX) port.AuthorizationGate {
+	return &GoGateAdapter{gate: gate, db: db}
 }
 
 func (a *GoGateAdapter) AssignRole(ctx context.Context, modelType, modelID, teamID, roleName string) error {
@@ -31,3 +36,67 @@ func (a *GoGateAdapter) GetRoleNames(ctx context.Context, modelType, modelID, te
 func (a *GoGateAdapter) GetAllPermissions(ctx context.Context, modelType, modelID, teamID string) ([]string, error) {
 	return a.gate.Model(modelType, modelID, teamID).GetAllPermissions(ctx)
 }
+
+func (a *GoGateAdapter) GetPermissionsForTeams(
+	ctx context.Context,
+	modelType, modelID string,
+	teamIDs []string,
+) (map[string][]string, error) {
+	if len(teamIDs) == 0 {
+		return map[string][]string{}, nil
+	}
+
+	query := `
+		SELECT team_id::text, permission FROM (
+			SELECT mhr.team_id, p.name AS permission
+			FROM model_has_roles mhr
+			JOIN roles r ON r.id = mhr.role_id
+			JOIN role_has_permissions rhp ON rhp.role_id = r.id
+			JOIN permissions p ON p.id = rhp.permission_id
+			WHERE mhr.model_type = $1 AND mhr.model_id = $2::uuid AND mhr.team_id = ANY($3::uuid[])
+			UNION ALL
+			SELECT mhp.team_id, p.name AS permission
+			FROM model_has_permissions mhp
+			JOIN permissions p ON p.id = mhp.permission_id
+			WHERE mhp.model_type = $1 AND mhp.model_id = $2::uuid AND mhp.team_id = ANY($3::uuid[])
+		) AS combined
+		ORDER BY team_id, permission
+	`
+
+	rows, err := a.db.QueryContext(ctx, query, modelType, modelID, pq.Array(teamIDs))
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close() //nolint:errcheck
+
+	out := make(map[string][]string, len(teamIDs))
+	for rows.Next() {
+		var teamID, permission string
+		if err := rows.Scan(&teamID, &permission); err != nil {
+			return nil, err
+		}
+		out[teamID] = append(out[teamID], permission)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+
+	for teamID, perms := range out {
+		sort.Strings(perms)
+		out[teamID] = dedupeSortedStrings(perms)
+	}
+	return out, nil
+}
+
+func dedupeSortedStrings(values []string) []string {
+	if len(values) == 0 {
+		return values
+	}
+	out := values[:1]
+	for _, v := range values[1:] {
+		if v != out[len(out)-1] {
+			out = append(out, v)
+		}
+	}
+	return out
+}
diff --git a/internal/infrastructure/authgate/gate_adapter_test.go b/internal/infrastructure/authgate/gate_adapter_test.go
new file mode 100644
index 00000000..71bc922f
--- /dev/null
+++ b/internal/infrastructure/authgate/gate_adapter_test.go
@@ -0,0 +1,71 @@
+package authgate
+
+import (
+	"context"
+	"testing"
+
+	"github.com/DATA-DOG/go-sqlmock"
+)
+
+func TestGoGateAdapter_GetPermissionsForTeams_emptyInput(t *testing.T) {
+	t.Parallel()
+
+	db, _, err := sqlmock.New()
+	if err != nil {
+		t.Fatalf("sqlmock.New: %v", err)
+	}
+	t.Cleanup(func() { _ = db.Close() })
+
+	adapter := NewGoGateAdapter(nil, db)
+	out, err := adapter.GetPermissionsForTeams(context.Background(), "User", "user-1", nil)
+	if err != nil {
+		t.Fatalf("GetPermissionsForTeams: %v", err)
+	}
+	if len(out) != 0 {
+		t.Fatalf("expected empty map, got %+v", out)
+	}
+}
+
+func TestGoGateAdapter_GetPermissionsForTeams_dedupesPermissions(t *testing.T) {
+	t.Parallel()
+
+	db, mock, err := sqlmock.New()
+	if err != nil {
+		t.Fatalf("sqlmock.New: %v", err)
+	}
+	t.Cleanup(func() { _ = db.Close() })
+
+	rows := sqlmock.NewRows([]string{"team_id", "permission"}).
+		AddRow("team-1", "logs.read").
+		AddRow("team-1", "logs.read").
+		AddRow("team-1", "settings.write")
+
+	mock.ExpectQuery(`SELECT team_id::text, permission`).
+		WithArgs("User", "user-1", sqlmock.AnyArg()).
+		WillReturnRows(rows)
+
+	adapter := NewGoGateAdapter(nil, db)
+	out, err := adapter.GetPermissionsForTeams(context.Background(), "User", "user-1", []string{"team-1"})
+	if err != nil {
+		t.Fatalf("GetPermissionsForTeams: %v", err)
+	}
+	perms := out["team-1"]
+	if len(perms) != 2 || perms[0] != "logs.read" || perms[1] != "settings.write" {
+		t.Fatalf("unexpected permissions: %+v", perms)
+	}
+}
+
+func TestDedupeSortedStrings(t *testing.T) {
+	t.Parallel()
+
+	got := dedupeSortedStrings([]string{"a", "a", "b", "c", "c"})
+	want := []string{"a", "b", "c"}
+	if len(got) != len(want) {
+		t.Fatalf("got %v want %v", got, want)
+	}
+	for i := range want {
+		if got[i] != want[i] {
+			t.Fatalf("got %v want %v", got, want)
+		}
+	}
+}
diff --git a/internal/infrastructure/database/seeds.go b/internal/infrastructure/database/seeds.go
new file mode 100644
index 00000000..f8e16801
--- /dev/null
+++ b/internal/infrastructure/database/seeds.go
@@ -0,0 +1,51 @@
+package database
+
+import (
+	"context"
+	"database/sql"
+	"fmt"
+	"log/slog"
+	"os"
+	"path/filepath"
+	"sort"
+)
+
+type seedDB interface {
+	ExecContext(ctx context.Context, query string, args ...any) (sql.Result, error)
+}
+
+const defaultSeedsDir = "database/seeds"
+
+// SeedsDir returns the directory of idempotent SQL seed files.
+func SeedsDir() string {
+	if dir := os.Getenv("DATABASE_SEEDS_DIR"); dir != "" {
+		return dir
+	}
+	return defaultSeedsDir
+}
+
+// ApplySeeds runs all *.sql seed files in dir in lexicographic order.
+// Seed scripts must be idempotent (ON CONFLICT DO NOTHING, etc.).
+func ApplySeeds(ctx context.Context, db seedDB, dir string) error {
+	files, err := filepath.Glob(filepath.Join(dir, "*.sql"))
+	if err != nil {
+		return fmt.Errorf("list seed files: %w", err)
+	}
+	if len(files) == 0 {
+		return fmt.Errorf("no seed files in %s", dir)
+	}
+	sort.Strings(files)
+
+	for _, file := range files {
+		name := filepath.Base(file)
+		sqlBytes, err := os.ReadFile(file)
+		if err != nil {
+			return fmt.Errorf("read seed %s: %w", name, err)
+		}
+		slog.InfoContext(ctx, "applying database seed", "file", name)
+		if _, err := db.ExecContext(ctx, string(sqlBytes)); err != nil {
+			return fmt.Errorf("apply seed %s: %w", name, err)
+		}
+	}
+	return nil
+}
diff --git a/internal/infrastructure/database/seeds_test.go b/internal/infrastructure/database/seeds_test.go
new file mode 100644
index 00000000..6057e5ab
--- /dev/null
+++ b/internal/infrastructure/database/seeds_test.go
@@ -0,0 +1,62 @@
+package database
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/DATA-DOG/go-sqlmock"
+)
+
+func TestSeedsDir_default(t *testing.T) {
+	t.Setenv("DATABASE_SEEDS_DIR", "")
+	if got := SeedsDir(); got != defaultSeedsDir {
+		t.Fatalf("SeedsDir() = %q, want %q", got, defaultSeedsDir)
+	}
+}
+
+func TestSeedsDir_override(t *testing.T) {
+	t.Setenv("DATABASE_SEEDS_DIR", "/custom/seeds")
+	if got := SeedsDir(); got != "/custom/seeds" {
+		t.Fatalf("SeedsDir() = %q", got)
+	}
+}
+
+func TestApplySeeds_runsInOrder(t *testing.T) {
+	dir := t.TempDir()
+	for _, name := range []string{"002_second.sql", "001_first.sql"} {
+		if err := os.WriteFile(filepath.Join(dir, name), []byte("SELECT 1;"), 0o600); err != nil {
+			t.Fatalf("write seed: %v", err)
+		}
+	}
+
+	db, mock, err := sqlmock.New()
+	if err != nil {
+		t.Fatalf("sqlmock: %v", err)
+	}
+	defer db.Close()
+
+	mock.ExpectExec("SELECT 1").WillReturnResult(sqlmock.NewResult(0, 0))
+	mock.ExpectExec("SELECT 1").WillReturnResult(sqlmock.NewResult(0, 0))
+
+	if err := ApplySeeds(context.Background(), db, dir); err != nil {
+		t.Fatalf("ApplySeeds: %v", err)
+	}
+	if err := mock.ExpectationsWereMet(); err != nil {
+		t.Fatalf("expectations: %v", err)
+	}
+}
+
+func TestApplySeeds_noFiles(t *testing.T) {
+	db, _, err := sqlmock.New()
+	if err != nil {
+		t.Fatalf("sqlmock: %v", err)
+	}
+	defer db.Close()
+
+	err = ApplySeeds(context.Background(), db, t.TempDir())
+	if err == nil {
+		t.Fatal("expected error for empty seeds dir")
+	}
+}
diff --git a/internal/infrastructure/inbox/notifying_writer.go b/internal/infrastructure/inbox/notifying_writer.go
new file mode 100644
index 00000000..1a3d0702
--- /dev/null
+++ b/internal/infrastructure/inbox/notifying_writer.go
@@ -0,0 +1,66 @@
+package inbox
+
+import (
+	"context"
+
+	"github.com/weprodev/wpd-message-gateway/internal/core/port"
+	"github.com/weprodev/wpd-message-gateway/pkg/contracts"
+)
+
+var _ port.InboxWriter = (*NotifyingWriter)(nil)
+
+// EventPublisher receives inbox change notifications for SSE subscribers.
+type EventPublisher interface {
+	Publish(workspaceID, eventType string, data any)
+}
+
+// PublishFunc adapts a function to EventPublisher.
+type PublishFunc func(workspaceID, eventType string, data any)
+
+func (f PublishFunc) Publish(workspaceID, eventType string, data any) {
+	if f != nil {
+		f(workspaceID, eventType, data)
+	}
+}
+
+// NotifyingWriter wraps an InboxWriter and publishes events after successful writes.
+type NotifyingWriter struct {
+	inner port.InboxWriter
+	pub   EventPublisher
+}
+
+func NewNotifyingWriter(inner port.InboxWriter, pub EventPublisher) *NotifyingWriter {
+	return &NotifyingWriter{inner: inner, pub: pub}
+}
+
+func (w *NotifyingWriter) WriteEmail(ctx context.Context, workspaceID string, email contracts.Email) (string, error) {
+	id, err := w.inner.WriteEmail(ctx, workspaceID, email)
+	if err == nil && w.pub != nil {
+		w.pub.Publish(workspaceID, "email_received", map[string]string{"id": id})
+	}
+	return id, err
+}
+
+func (w *NotifyingWriter) WriteSMS(ctx context.Context, workspaceID string, sms contracts.SMS) (string, error) {
+	id, err := w.inner.WriteSMS(ctx, workspaceID, sms)
+	if err == nil && w.pub != nil {
+		w.pub.Publish(workspaceID, "sms_received", map[string]string{"id": id})
+	}
+	return id, err
+}
+
+func (w *NotifyingWriter) WritePush(ctx context.Context, workspaceID string, push contracts.PushNotification) (string, error) {
+	id, err := w.inner.WritePush(ctx, workspaceID, push)
+	if err == nil && w.pub != nil {
+		w.pub.Publish(workspaceID, "push_received", map[string]string{"id": id})
+	}
+	return id, err
+}
+
+func (w *NotifyingWriter) WriteChat(ctx context.Context, workspaceID string, chat contracts.ChatMessage) (string, error) {
+	id, err := w.inner.WriteChat(ctx, workspaceID, chat)
+	if err == nil && w.pub != nil {
+		w.pub.Publish(workspaceID, "chat_received", map[string]string{"id": id})
+	}
+	return id, err
+}
diff --git a/internal/infrastructure/inbox/store.go b/internal/infrastructure/inbox/store.go
index d569e8b5..3fd0b24f 100644
--- a/internal/infrastructure/inbox/store.go
+++ b/internal/infrastructure/inbox/store.go
@@ -11,31 +11,51 @@ import (
 	"github.com/weprodev/wpd-message-gateway/pkg/contracts"
 )
 
+const (
+	defaultInboxPageSize = 50
+	maxInboxPageSize     = 200
+)
+
 var _ port.InboxReader = (*Store)(nil)
 var _ port.InboxWriter = (*Store)(nil)
 
-// Store implements an in-memory message store that satisfies port.InboxReader and port.InboxWriter.
+// Store implements an in-memory message store indexed by workspace for O(1) bucket lookup.
 type Store struct {
 	mu     sync.RWMutex
-	emails []port.StoredEmail
-	sms    []port.StoredSMS
-	pushes []port.StoredPush
-	chats  []port.StoredChat
+	emails map[string][]port.StoredEmail
+	sms    map[string][]port.StoredSMS
+	pushes map[string][]port.StoredPush
+	chats  map[string][]port.StoredChat
 }
 
 // NewStore creates a new in-memory store.
 func NewStore() *Store {
-	return &Store{}
+	return &Store{
+		emails: make(map[string][]port.StoredEmail),
+		sms:    make(map[string][]port.StoredSMS),
+		pushes: make(map[string][]port.StoredPush),
+		chats:  make(map[string][]port.StoredChat),
+	}
+}
+
+func clampInboxLimit(limit int) int {
+	if limit <= 0 {
+		return defaultInboxPageSize
+	}
+	if limit > maxInboxPageSize {
+		return maxInboxPageSize
+	}
+	return limit
 }
 
 // StatsForWorkspace returns counts for messages belonging to workspace.
 func (s *Store) StatsForWorkspace(workspaceID string) map[string]int {
 	s.mu.RLock()
 	defer s.mu.RUnlock()
-	nEmail := countWorkspace(s.emails, workspaceID)
-	nSMS := countWorkspaceSMS(s.sms, workspaceID)
-	nPush := countWorkspacePush(s.pushes, workspaceID)
-	nChat := countWorkspaceChat(s.chats, workspaceID)
+	nEmail := len(s.emails[workspaceID])
+	nSMS := len(s.sms[workspaceID])
+	nPush := len(s.pushes[workspaceID])
+	nChat := len(s.chats[workspaceID])
 	return map[string]int{
 		"emails": nEmail,
 		"sms":    nSMS,
@@ -45,63 +65,53 @@ func (s *Store) StatsForWorkspace(workspaceID string) map[string]int {
 	}
 }
 
-func countWorkspace(items []port.StoredEmail, workspaceID string) int {
-	n := 0
-	for _, e := range items {
-		if e.WorkspaceID == workspaceID {
-			n++
-		}
-	}
-	return n
+func (s *Store) EmailsForWorkspace(workspaceID string) []port.StoredEmail {
+	page := s.ListEmailsForWorkspace(workspaceID, 0, "")
+	return page.Items
 }
 
-func countWorkspaceSMS(items []port.StoredSMS, workspaceID string) int {
-	n := 0
-	for _, e := range items {
-		if e.WorkspaceID == workspaceID {
-			n++
-		}
-	}
-	return n
-}
+func (s *Store) ListEmailsForWorkspace(workspaceID string, limit int, cursor string) port.InboxEmailPage {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
 
-func countWorkspacePush(items []port.StoredPush, workspaceID string) int {
-	n := 0
-	for _, e := range items {
-		if e.WorkspaceID == workspaceID {
-			n++
+	all := s.emails[workspaceID]
+	limit = clampInboxLimit(limit)
+	start := 0
+	if cursor != "" {
+		for i, item := range all {
+			if item.ID == cursor {
+				start = i + 1
+				break
+			}
 		}
 	}
-	return n
-}
 
-func countWorkspaceChat(items []port.StoredChat, workspaceID string) int {
-	n := 0
-	for _, e := range items {
-		if e.WorkspaceID == workspaceID {
-			n++
-		}
+	end := start + limit
+	hasMore := end < len(all)
+	if end > len(all) {
+		end = len(all)
 	}
-	return n
-}
 
-func (s *Store) EmailsForWorkspace(workspaceID string) []port.StoredEmail {
-	s.mu.RLock()
-	defer s.mu.RUnlock()
-	out := make([]port.StoredEmail, 0)
-	for _, e := range s.emails {
-		if e.WorkspaceID == workspaceID {
-			out = append(out, e)
-		}
+	items := make([]port.StoredEmail, 0, end-start)
+	if start < len(all) {
+		items = append(items, all[start:end]...)
+	}
+	nextCursor := ""
+	if hasMore && len(items) > 0 {
+		nextCursor = items[len(items)-1].ID
+	}
+	return port.InboxEmailPage{
+		Items:      items,
+		NextCursor: nextCursor,
+		HasMore:    hasMore,
 	}
-	return out
 }
 
 func (s *Store) EmailByIDForWorkspace(id, workspaceID string) (port.StoredEmail, bool) {
 	s.mu.RLock()
 	defer s.mu.RUnlock()
-	for _, e := range s.emails {
-		if e.ID == id && e.WorkspaceID == workspaceID {
+	for _, e := range s.emails[workspaceID] {
+		if e.ID == id {
 			return e, true
 		}
 	}
@@ -111,33 +121,65 @@ func (s *Store) EmailByIDForWorkspace(id, workspaceID string) (port.StoredEmail,
 func (s *Store) DeleteEmailByIDForWorkspace(id, workspaceID string) bool {
 	s.mu.Lock()
 	defer s.mu.Unlock()
-	for i, e := range s.emails {
-		if e.ID == id && e.WorkspaceID == workspaceID {
-			s.emails = append(s.emails[:i], s.emails[i+1:]...)
+	items := s.emails[workspaceID]
+	for i, e := range items {
+		if e.ID == id {
+			s.emails[workspaceID] = append(items[:i], items[i+1:]...)
 			return true
 		}
 	}
 	return false
 }
 
+func paginateByID[T any](all []T, limit int, cursor string, idOf func(T) string) (items []T, nextCursor string, hasMore bool) {
+	limit = clampInboxLimit(limit)
+	start := 0
+	if cursor != "" {
+		for i, item := range all {
+			if idOf(item) == cursor {
+				start = i + 1
+				break
+			}
+		}
+	}
+
+	end := start + limit
+	hasMore = end < len(all)
+	if end > len(all) {
+		end = len(all)
+	}
+
+	items = make([]T, 0, end-start)
+	if start < len(all) {
+		items = append(items, all[start:end]...)
+	}
+	if hasMore && len(items) > 0 {
+		nextCursor = idOf(items[len(items)-1])
+	}
+	return items, nextCursor, hasMore
+}
+
 func (s *Store) SMSForWorkspace(workspaceID string) []port.StoredSMS {
+	page := s.ListSMSForWorkspace(workspaceID, 0, "")
+	return page.Items
+}
+
+func (s *Store) ListSMSForWorkspace(workspaceID string, limit int, cursor string) port.InboxSMSPage {
 	s.mu.RLock()
 	defer s.mu.RUnlock()
-	out := make([]port.StoredSMS, 0)
-	for _, e := range s.sms {
-		if e.WorkspaceID == workspaceID {
-			out = append(out, e)
-		}
-	}
-	return out
+
+	items, nextCursor, hasMore := paginateByID(s.sms[workspaceID], limit, cursor, func(item port.StoredSMS) string {
+		return item.ID
+	})
+	return port.InboxSMSPage{Items: items, NextCursor: nextCursor, HasMore: hasMore}
 }
 
 func (s *Store) SMSByIDForWorkspace(id, workspaceID string) (port.StoredSMS, bool) {
 	s.mu.RLock()
 	defer s.mu.RUnlock()
-	for _, e := range s.sms {
-		if e.ID == id && e.WorkspaceID == workspaceID {
-			return e, true
+	for _, item := range s.sms[workspaceID] {
+		if item.ID == id {
+			return item, true
 		}
 	}
 	return port.StoredSMS{}, false
@@ -146,9 +188,10 @@ func (s *Store) SMSByIDForWorkspace(id, workspaceID string) (port.StoredSMS, boo
 func (s *Store) DeleteSMSByIDForWorkspace(id, workspaceID string) bool {
 	s.mu.Lock()
 	defer s.mu.Unlock()
-	for i, e := range s.sms {
-		if e.ID == id && e.WorkspaceID == workspaceID {
-			s.sms = append(s.sms[:i], s.sms[i+1:]...)
+	items := s.sms[workspaceID]
+	for i, e := range items {
+		if e.ID == id {
+			s.sms[workspaceID] = append(items[:i], items[i+1:]...)
 			return true
 		}
 	}
@@ -156,23 +199,26 @@ func (s *Store) DeleteSMSByIDForWorkspace(id, workspaceID string) bool {
 }
 
 func (s *Store) PushForWorkspace(workspaceID string) []port.StoredPush {
+	page := s.ListPushForWorkspace(workspaceID, 0, "")
+	return page.Items
+}
+
+func (s *Store) ListPushForWorkspace(workspaceID string, limit int, cursor string) port.InboxPushPage {
 	s.mu.RLock()
 	defer s.mu.RUnlock()
-	out := make([]port.StoredPush, 0)
-	for _, e := range s.pushes {
-		if e.WorkspaceID == workspaceID {
-			out = append(out, e)
-		}
-	}
-	return out
+
+	items, nextCursor, hasMore := paginateByID(s.pushes[workspaceID], limit, cursor, func(item port.StoredPush) string {
+		return item.ID
+	})
+	return port.InboxPushPage{Items: items, NextCursor: nextCursor, HasMore: hasMore}
 }
 
 func (s *Store) PushByIDForWorkspace(id, workspaceID string) (port.StoredPush, bool) {
 	s.mu.RLock()
 	defer s.mu.RUnlock()
-	for _, e := range s.pushes {
-		if e.ID == id && e.WorkspaceID == workspaceID {
-			return e, true
+	for _, item := range s.pushes[workspaceID] {
+		if item.ID == id {
+			return item, true
 		}
 	}
 	return port.StoredPush{}, false
@@ -181,9 +227,10 @@ func (s *Store) PushByIDForWorkspace(id, workspaceID string) (port.StoredPush, b
 func (s *Store) DeletePushByIDForWorkspace(id, workspaceID string) bool {
 	s.mu.Lock()
 	defer s.mu.Unlock()
-	for i, e := range s.pushes {
-		if e.ID == id && e.WorkspaceID == workspaceID {
-			s.pushes = append(s.pushes[:i], s.pushes[i+1:]...)
+	items := s.pushes[workspaceID]
+	for i, e := range items {
+		if e.ID == id {
+			s.pushes[workspaceID] = append(items[:i], items[i+1:]...)
 			return true
 		}
 	}
@@ -191,23 +238,26 @@ func (s *Store) DeletePushByIDForWorkspace(id, workspaceID string) bool {
 }
 
 func (s *Store) ChatForWorkspace(workspaceID string) []port.StoredChat {
+	page := s.ListChatForWorkspace(workspaceID, 0, "")
+	return page.Items
+}
+
+func (s *Store) ListChatForWorkspace(workspaceID string, limit int, cursor string) port.InboxChatPage {
 	s.mu.RLock()
 	defer s.mu.RUnlock()
-	out := make([]port.StoredChat, 0)
-	for _, e := range s.chats {
-		if e.WorkspaceID == workspaceID {
-			out = append(out, e)
-		}
-	}
-	return out
+
+	items, nextCursor, hasMore := paginateByID(s.chats[workspaceID], limit, cursor, func(item port.StoredChat) string {
+		return item.ID
+	})
+	return port.InboxChatPage{Items: items, NextCursor: nextCursor, HasMore: hasMore}
 }
 
 func (s *Store) ChatByIDForWorkspace(id, workspaceID string) (port.StoredChat, bool) {
 	s.mu.RLock()
 	defer s.mu.RUnlock()
-	for _, e := range s.chats {
-		if e.ID == id && e.WorkspaceID == workspaceID {
-			return e, true
+	for _, item := range s.chats[workspaceID] {
+		if item.ID == id {
+			return item, true
 		}
 	}
 	return port.StoredChat{}, false
@@ -216,9 +266,10 @@ func (s *Store) ChatByIDForWorkspace(id, workspaceID string) (port.StoredChat, b
 func (s *Store) DeleteChatByIDForWorkspace(id, workspaceID string) bool {
 	s.mu.Lock()
 	defer s.mu.Unlock()
-	for i, e := range s.chats {
-		if e.ID == id && e.WorkspaceID == workspaceID {
-			s.chats = append(s.chats[:i], s.chats[i+1:]...)
+	items := s.chats[workspaceID]
+	for i, e := range items {
+		if e.ID == id {
+			s.chats[workspaceID] = append(items[:i], items[i+1:]...)
 			return true
 		}
 	}
@@ -228,62 +279,23 @@ func (s *Store) DeleteChatByIDForWorkspace(id, workspaceID string) bool {
 func (s *Store) ClearWorkspace(workspaceID string) {
 	s.mu.Lock()
 	defer s.mu.Unlock()
-	s.emails = filterKeepOtherWorkspaces(s.emails, workspaceID)
-	s.sms = filterKeepOtherWorkspacesSMS(s.sms, workspaceID)
-	s.pushes = filterKeepOtherWorkspacesPush(s.pushes, workspaceID)
-	s.chats = filterKeepOtherWorkspacesChat(s.chats, workspaceID)
-}
-
-func filterKeepOtherWorkspaces(items []port.StoredEmail, workspaceID string) []port.StoredEmail {
-	out := items[:0]
-	for _, e := range items {
-		if e.WorkspaceID != workspaceID {
-			out = append(out, e)
-		}
-	}
-	return out
-}
-
-func filterKeepOtherWorkspacesSMS(items []port.StoredSMS, workspaceID string) []port.StoredSMS {
-	out := items[:0]
-	for _, e := range items {
-		if e.WorkspaceID != workspaceID {
-			out = append(out, e)
-		}
-	}
-	return out
-}
-
-func filterKeepOtherWorkspacesPush(items []port.StoredPush, workspaceID string) []port.StoredPush {
-	out := items[:0]
-	for _, e := range items {
-		if e.WorkspaceID != workspaceID {
-			out = append(out, e)
-		}
-	}
-	return out
-}
-
-func filterKeepOtherWorkspacesChat(items []port.StoredChat, workspaceID string) []port.StoredChat {
-	out := items[:0]
-	for _, e := range items {
-		if e.WorkspaceID != workspaceID {
-			out = append(out, e)
-		}
-	}
-	return out
+	delete(s.emails, workspaceID)
+	delete(s.sms, workspaceID)
+	delete(s.pushes, workspaceID)
+	delete(s.chats, workspaceID)
 }
 
 func (s *Store) WriteEmail(_ context.Context, workspaceID string, email contracts.Email) (string, error) {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	id := uuid.New().String()
-	s.emails = append(s.emails, port.StoredEmail{
+	item := port.StoredEmail{
 		ID:          id,
 		WorkspaceID: workspaceID,
 		CreatedAt:   time.Now(),
 		Email:       email,
-	})
+	}
+	s.emails[workspaceID] = append([]port.StoredEmail{item}, s.emails[workspaceID]...)
 	return id, nil
 }
 
@@ -291,12 +303,13 @@ func (s *Store) WriteSMS(_ context.Context, workspaceID string, sms contracts.SM
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	id := uuid.New().String()
-	s.sms = append(s.sms, port.StoredSMS{
+	item := port.StoredSMS{
 		ID:          id,
 		WorkspaceID: workspaceID,
 		CreatedAt:   time.Now(),
 		SMS:         sms,
-	})
+	}
+	s.sms[workspaceID] = append([]port.StoredSMS{item}, s.sms[workspaceID]...)
 	return id, nil
 }
 
@@ -304,12 +317,13 @@ func (s *Store) WritePush(_ context.Context, workspaceID string, push contracts.
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	id := uuid.New().String()
-	s.pushes = append(s.pushes, port.StoredPush{
+	item := port.StoredPush{
 		ID:          id,
 		WorkspaceID: workspaceID,
 		CreatedAt:   time.Now(),
 		Push:        push,
-	})
+	}
+	s.pushes[workspaceID] = append([]port.StoredPush{item}, s.pushes[workspaceID]...)
 	return id, nil
 }
 
@@ -317,11 +331,12 @@ func (s *Store) WriteChat(_ context.Context, workspaceID string, chat contracts.
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	id := uuid.New().String()
-	s.chats = append(s.chats, port.StoredChat{
+	item := port.StoredChat{
 		ID:          id,
 		WorkspaceID: workspaceID,
 		CreatedAt:   time.Now(),
 		Chat:        chat,
-	})
+	}
+	s.chats[workspaceID] = append([]port.StoredChat{item}, s.chats[workspaceID]...)
 	return id, nil
 }
diff --git a/internal/infrastructure/inbox/store_pagination_test.go b/internal/infrastructure/inbox/store_pagination_test.go
new file mode 100644
index 00000000..c3c19008
--- /dev/null
+++ b/internal/infrastructure/inbox/store_pagination_test.go
@@ -0,0 +1,85 @@
+package inbox
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"github.com/weprodev/wpd-message-gateway/pkg/contracts"
+)
+
+func TestStore_ListSMSForWorkspace_pagination(t *testing.T) {
+	t.Parallel()
+
+	ctx := context.Background()
+	store := NewStore()
+	workspaceID := "ws-paginate"
+
+	var ids []string
+	for i := 0; i < 5; i++ {
+		id, err := store.WriteSMS(ctx, workspaceID, contracts.SMS{
+			To:      []string{"+15550001111"},
+			Message: fmt.Sprintf("msg-%d", i),
+		})
+		if err != nil {
+			t.Fatalf("WriteSMS %d: %v", i, err)
+		}
+		ids = append(ids, id)
+	}
+
+	// Newest first: ids[4], ids[3], ids[2], ids[1], ids[0]
+	page1 := store.ListSMSForWorkspace(workspaceID, 2, "")
+	if len(page1.Items) != 2 {
+		t.Fatalf("page1 len = %d, want 2", len(page1.Items))
+	}
+	if page1.Items[0].ID != ids[4] || page1.Items[1].ID != ids[3] {
+		t.Fatalf("page1 order = [%s, %s], want [%s, %s]", page1.Items[0].ID, page1.Items[1].ID, ids[4], ids[3])
+	}
+	if !page1.HasMore || page1.NextCursor != ids[3] {
+		t.Fatalf("page1 cursor/hasMore = (%q, %v), want (%q, true)", page1.NextCursor, page1.HasMore, ids[3])
+	}
+
+	page2 := store.ListSMSForWorkspace(workspaceID, 2, page1.NextCursor)
+	if len(page2.Items) != 2 {
+		t.Fatalf("page2 len = %d, want 2", len(page2.Items))
+	}
+	if page2.Items[0].ID != ids[2] || page2.Items[1].ID != ids[1] {
+		t.Fatalf("page2 order = [%s, %s], want [%s, %s]", page2.Items[0].ID, page2.Items[1].ID, ids[2], ids[1])
+	}
+	if !page2.HasMore || page2.NextCursor != ids[1] {
+		t.Fatalf("page2 cursor/hasMore = (%q, %v), want (%q, true)", page2.NextCursor, page2.HasMore, ids[1])
+	}
+
+	page3 := store.ListSMSForWorkspace(workspaceID, 2, page2.NextCursor)
+	if len(page3.Items) != 1 {
+		t.Fatalf("page3 len = %d, want 1", len(page3.Items))
+	}
+	if page3.Items[0].ID != ids[0] {
+		t.Fatalf("page3 item = %s, want %s", page3.Items[0].ID, ids[0])
+	}
+	if page3.HasMore || page3.NextCursor != "" {
+		t.Fatalf("page3 should be last page, got cursor=%q hasMore=%v", page3.NextCursor, page3.HasMore)
+	}
+}
+
+func TestStore_ListSMSForWorkspace_defaultLimit(t *testing.T) {
+	t.Parallel()
+
+	ctx := context.Background()
+	store := NewStore()
+	workspaceID := "ws-default-limit"
+
+	for i := 0; i < defaultInboxPageSize+1; i++ {
+		if _, err := store.WriteSMS(ctx, workspaceID, contracts.SMS{To: []string{"+1"}, Message: "x"}); err != nil {
+			t.Fatalf("WriteSMS: %v", err)
+		}
+	}
+
+	page := store.ListSMSForWorkspace(workspaceID, 0, "")
+	if len(page.Items) != defaultInboxPageSize {
+		t.Fatalf("default page size = %d, want %d", len(page.Items), defaultInboxPageSize)
+	}
+	if !page.HasMore {
+		t.Fatal("expected hasMore with default limit")
+	}
+}
diff --git a/internal/infrastructure/logger/logger.go b/internal/infrastructure/logger/logger.go
index 9e5996db..549c3ec7 100644
--- a/internal/infrastructure/logger/logger.go
+++ b/internal/infrastructure/logger/logger.go
@@ -23,30 +23,10 @@ import (
 	"log/slog"
 
 	pkglogger "github.com/weprodev/go-pkg/logger"
-)
-
-// contextKey is an unexported type for keys stored in context.Context.
-type contextKey string
 
-const (
-	keyWorkspaceID contextKey = "workspace_id"
-	keyAPIKeyID    contextKey = "api_key_id"
-	keyChannel     contextKey = "channel"
-	keyProvider    contextKey = "provider"
-	keyRequestID   contextKey = "request_id"
+	"github.com/weprodev/wpd-message-gateway/internal/core/logctx"
 )
 
-// WithRequestID returns a context enriched with request_id (correlation ID).
-func WithRequestID(ctx context.Context, requestID string) context.Context {
-	return context.WithValue(ctx, keyRequestID, requestID)
-}
-
-// GetRequestID retrieves the request_id from context.
-func GetRequestID(ctx context.Context) string {
-	v, _ := ctx.Value(keyRequestID).(string)
-	return v
-}
-
 // ContextHandler extracts request context fields and appends them to slog.Record.
 type ContextHandler struct {
 	next slog.Handler
@@ -66,7 +46,7 @@ func (h *ContextHandler) Handle(ctx context.Context, r slog.Record) error {
 		return h.next.Handle(ctx, r)
 	}
 
-	attrs := Attrs(ctx)
+	attrs := logctx.Attrs(ctx)
 	for i := 0; i < len(attrs); i += 2 {
 		key, ok := attrs[i].(string)
 		if ok {
@@ -99,7 +79,7 @@ func New(env string, extraHandlers ...slog.Handler) (*pkglogger.Logger, error) {
 
 	extractors := []pkglogger.ContextExtractor{
 		func(ctx context.Context) []any {
-			return Attrs(ctx)
+			return logctx.Attrs(ctx)
 		},
 	}
 
@@ -114,55 +94,40 @@ func New(env string, extraHandlers ...slog.Handler) (*pkglogger.Logger, error) {
 		return nil, err
 	}
 
-	// Wrap handler with ContextHandler to automatically capture request details
-	wrappedLogger := slog.New(NewContextHandler(log.Handler()))
-
-	// All slog.X() calls throughout the process now use this logger.
-	slog.SetDefault(wrappedLogger)
-	log.Logger = wrappedLogger
+	// ContextExtractors append correlation fields; avoid also wrapping ContextHandler (duplicate attrs).
+	slog.SetDefault(log.Logger)
 
 	return log, nil
 }
 
+// WithRequestID returns a context enriched with request_id (correlation ID).
+func WithRequestID(ctx context.Context, requestID string) context.Context {
+	return logctx.WithRequestID(ctx, requestID)
+}
+
+// GetRequestID retrieves the request_id from context.
+func GetRequestID(ctx context.Context) string {
+	return logctx.GetRequestID(ctx)
+}
+
 // WithWorkspace returns a context enriched with workspace and api-key identifiers.
-// Pass this context into handler calls so structured log records carry these fields.
 func WithWorkspace(ctx context.Context, workspaceID, apiKeyID string) context.Context {
-	ctx = context.WithValue(ctx, keyWorkspaceID, workspaceID)
-	ctx = context.WithValue(ctx, keyAPIKeyID, apiKeyID)
-	return ctx
+	return logctx.WithWorkspace(ctx, workspaceID, apiKeyID)
 }
 
 // WithChannel enriches a context with the active message channel (email/sms/push/chat).
 func WithChannel(ctx context.Context, channel string) context.Context {
-	return context.WithValue(ctx, keyChannel, channel)
+	return logctx.WithChannel(ctx, channel)
 }
 
 // WithProvider enriches a context with the resolved provider name.
 func WithProvider(ctx context.Context, provider string) context.Context {
-	return context.WithValue(ctx, keyProvider, provider)
+	return logctx.WithProvider(ctx, provider)
 }
 
-// Attrs extracts all gateway-specific attributes from ctx into slog key-value pairs.
-// Note: Handlers wrapping standard slog logging now use ContextHandler to extract
-// these fields automatically; Attrs remains for manual or backwards-compatible usage.
+// Attrs extracts gateway correlation fields from ctx for go-pkg ContextExtractors.
 func Attrs(ctx context.Context) []any {
-	attrs := make([]any, 0, 10)
-	if v, _ := ctx.Value(keyWorkspaceID).(string); v != "" {
-		attrs = append(attrs, "workspace_id", v)
-	}
-	if v, _ := ctx.Value(keyAPIKeyID).(string); v != "" {
-		attrs = append(attrs, "api_key_id", v)
-	}
-	if v, _ := ctx.Value(keyChannel).(string); v != "" {
-		attrs = append(attrs, "channel", v)
-	}
-	if v, _ := ctx.Value(keyProvider).(string); v != "" {
-		attrs = append(attrs, "provider", v)
-	}
-	if v, _ := ctx.Value(keyRequestID).(string); v != "" {
-		attrs = append(attrs, "request_id", v)
-	}
-	return attrs
+	return logctx.Attrs(ctx)
 }
 
 func isLocalEnv(env string) bool {
diff --git a/internal/infrastructure/repository/postgres/api_key_repository.go b/internal/infrastructure/repository/postgres/api_key_repository.go
index 9508f175..2c141fa4 100644
--- a/internal/infrastructure/repository/postgres/api_key_repository.go
+++ b/internal/infrastructure/repository/postgres/api_key_repository.go
@@ -68,8 +68,12 @@ func (r *APIKeyRepository) GetByClientID(ctx context.Context, clientID string) (
 }
 
 func (r *APIKeyRepository) UpdateLastUsedAt(ctx context.Context, id string) error {
+	// Throttle writes: inbox/SSE can hit this on every request.
 	_, err := r.client.GetDB(ctx).ExecContext(ctx,
-		`UPDATE api_keys SET last_used_at = NOW() WHERE id = $1`,
+		`UPDATE api_keys
+		 SET last_used_at = NOW()
+		 WHERE id = $1
+		   AND (last_used_at IS NULL OR last_used_at < NOW() - INTERVAL '5 minutes')`,
 		id,
 	)
 	if err != nil {
diff --git a/internal/infrastructure/repository/postgres/api_key_repository_test.go b/internal/infrastructure/repository/postgres/api_key_repository_test.go
new file mode 100644
index 00000000..7e76e6dd
--- /dev/null
+++ b/internal/infrastructure/repository/postgres/api_key_repository_test.go
@@ -0,0 +1,72 @@
+package postgres
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"testing"
+	"time"
+
+	"github.com/DATA-DOG/go-sqlmock"
+
+	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
+	"github.com/weprodev/wpd-message-gateway/internal/core/port"
+)
+
+func TestAPIKeyRepository_Create(t *testing.T) {
+	t.Parallel()
+
+	client, mock, _ := newMockPgClient(t)
+	repo := NewAPIKeyRepository(client)
+	createdAt := time.Date(2026, 7, 4, 10, 0, 0, 0, time.UTC)
+
+	mock.ExpectQuery(`INSERT INTO api_keys`).
+		WithArgs("ws-1", "client-1", "hash", "Demo", true, nil).
+		WillReturnRows(sqlmock.NewRows([]string{"id", "created_at"}).AddRow("key-1", createdAt))
+
+	key := &domain.APIKey{
+		WorkspaceID:      "ws-1",
+		ClientID:         "client-1",
+		ClientSecretHash: "hash",
+		Name:             "Demo",
+		IsActive:         true,
+	}
+	if err := repo.Create(context.Background(), key); err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+	if key.ID != "key-1" || !key.CreatedAt.Equal(createdAt) {
+		t.Fatalf("unexpected key after create: %+v", key)
+	}
+}
+
+func TestAPIKeyRepository_GetByClientID_notFound(t *testing.T) {
+	t.Parallel()
+
+	client, mock, _ := newMockPgClient(t)
+	repo := NewAPIKeyRepository(client)
+
+	mock.ExpectQuery(`SELECT id, workspace_id`).
+		WithArgs("missing").
+		WillReturnError(sql.ErrNoRows)
+
+	_, err := repo.GetByClientID(context.Background(), "missing")
+	if err == nil || !errors.Is(err, port.ErrNotFound) {
+		t.Fatalf("expected ErrNotFound, got %v", err)
+	}
+}
+
+func TestAPIKeyRepository_Delete_notFound(t *testing.T) {
+	t.Parallel()
+
+	client, mock, _ := newMockPgClient(t)
+	repo := NewAPIKeyRepository(client)
+
+	mock.ExpectExec(`DELETE FROM api_keys WHERE id = \$1`).
+		WithArgs("key-missing").
+		WillReturnResult(sqlmock.NewResult(0, 0))
+
+	err := repo.Delete(context.Background(), "key-missing")
+	if err == nil || !errors.Is(err, port.ErrNotFound) {
+		t.Fatalf("expected ErrNotFound, got %v", err)
+	}
+}
diff --git a/internal/infrastructure/repository/postgres/db_errors.go b/internal/infrastructure/repository/postgres/db_errors.go
new file mode 100644
index 00000000..d8501d87
--- /dev/null
+++ b/internal/infrastructure/repository/postgres/db_errors.go
@@ -0,0 +1,21 @@
+package postgres
+
+import (
+	"errors"
+	"fmt"
+
+	"github.com/lib/pq"
+
+	"github.com/weprodev/wpd-message-gateway/internal/core/port"
+)
+
+func mapDBError(err error) error {
+	if err == nil {
+		return nil
+	}
+	var pqErr *pq.Error
+	if errors.As(err, &pqErr) && pqErr.Code == "23505" {
+		return fmt.Errorf("%w: %s", port.ErrConflict, pqErr.Constraint)
+	}
+	return err
+}
diff --git a/internal/infrastructure/repository/postgres/invitation_repository.go b/internal/infrastructure/repository/postgres/invitation_repository.go
index 2ea12098..a446d9ac 100644
--- a/internal/infrastructure/repository/postgres/invitation_repository.go
+++ b/internal/infrastructure/repository/postgres/invitation_repository.go
@@ -19,13 +19,18 @@ func NewInvitationRepository(client *pgsql.PgClient) port.InvitationRepository {
 }
 
 func (r *InvitationRepository) Create(ctx context.Context, inv *domain.Invitation) error {
+	roleID, err := lookupRoleIDByName(ctx, r.client.GetDB(ctx), inv.Role)
+	if err != nil {
+		return err
+	}
+
 	query := `
-		INSERT INTO invitations (workspace_id, email, role, token_hash, expires_at, status)
+		INSERT INTO invitations (workspace_id, email, role_id, token_hash, expires_at, status)
 		VALUES ($1, $2, $3, $4, $5, $6)
 		RETURNING id, created_at
 	`
-	err := r.client.GetDB(ctx).QueryRowContext(ctx, query,
-		inv.WorkspaceID, inv.Email, inv.Role, inv.TokenHash, inv.ExpiresAt, inv.Status,
+	err = r.client.GetDB(ctx).QueryRowContext(ctx, query,
+		inv.WorkspaceID, inv.Email, roleID, inv.TokenHash, inv.ExpiresAt, inv.Status,
 	).Scan(&inv.ID, &inv.CreatedAt)
 	if err != nil {
 		slog.ErrorContext(ctx, "database error: failed to create invitation", "error", err, "workspace_id", inv.WorkspaceID, "email", inv.Email, "role", inv.Role)
@@ -35,10 +40,11 @@ func (r *InvitationRepository) Create(ctx context.Context, inv *domain.Invitatio
 
 func (r *InvitationRepository) ListPendingByWorkspace(ctx context.Context, workspaceID string) ([]domain.Invitation, error) {
 	rows, err := r.client.GetDB(ctx).QueryContext(ctx, `
-		SELECT id, workspace_id, email, role, token_hash, expires_at, status, created_at
-		FROM invitations
-		WHERE workspace_id = $1 AND status = 'pending' AND expires_at > NOW()
-		ORDER BY created_at DESC
+		SELECT i.id, i.workspace_id, i.email, r.name, i.token_hash, i.expires_at, i.status, i.created_at
+		FROM invitations i
+		INNER JOIN roles r ON r.id = i.role_id
+		WHERE i.workspace_id = $1 AND i.status = 'pending' AND i.expires_at > NOW()
+		ORDER BY i.created_at DESC
 	`, workspaceID)
 	if err != nil {
 		slog.ErrorContext(ctx, "database error: failed to list pending invitations", "error", err, "workspace_id", workspaceID)
diff --git a/internal/infrastructure/repository/postgres/invitation_repository_test.go b/internal/infrastructure/repository/postgres/invitation_repository_test.go
new file mode 100644
index 00000000..0500a870
--- /dev/null
+++ b/internal/infrastructure/repository/postgres/invitation_repository_test.go
@@ -0,0 +1,67 @@
+package postgres
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/DATA-DOG/go-sqlmock"
+
+	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
+)
+
+func TestInvitationRepository_Create(t *testing.T) {
+	t.Parallel()
+
+	client, mock, _ := newMockPgClient(t)
+	repo := NewInvitationRepository(client)
+	createdAt := time.Date(2026, 7, 4, 12, 0, 0, 0, time.UTC)
+	expiresAt := createdAt.Add(7 * 24 * time.Hour)
+
+	mock.ExpectQuery(`SELECT id FROM roles WHERE name`).
+		WithArgs("member", domain.RBACGuardName).
+		WillReturnRows(sqlmock.NewRows([]string{"id"}).AddRow("role-member-id"))
+	mock.ExpectQuery(`INSERT INTO invitations`).
+		WithArgs("ws-1", "invitee@example.com", "role-member-id", "hash", expiresAt, "pending").
+		WillReturnRows(sqlmock.NewRows([]string{"id", "created_at"}).AddRow("inv-1", createdAt))
+
+	inv := &domain.Invitation{
+		WorkspaceID: "ws-1",
+		Email:       "invitee@example.com",
+		Role:        domain.RoleMember,
+		TokenHash:   "hash",
+		ExpiresAt:   expiresAt,
+		Status:      "pending",
+	}
+	if err := repo.Create(context.Background(), inv); err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+	if inv.ID != "inv-1" || !inv.CreatedAt.Equal(createdAt) {
+		t.Fatalf("unexpected invitation after create: %+v", inv)
+	}
+}
+
+func TestInvitationRepository_ListPendingByWorkspace(t *testing.T) {
+	t.Parallel()
+
+	client, mock, _ := newMockPgClient(t)
+	repo := NewInvitationRepository(client)
+	createdAt := time.Date(2026, 7, 4, 12, 0, 0, 0, time.UTC)
+	expiresAt := createdAt.Add(24 * time.Hour)
+
+	rows := sqlmock.NewRows([]string{
+		"id", "workspace_id", "email", "name", "token_hash", "expires_at", "status", "created_at",
+	}).AddRow("inv-1", "ws-1", "a@b.com", "member", "hash", expiresAt, "pending", createdAt)
+
+	mock.ExpectQuery(`FROM invitations i`).
+		WithArgs("ws-1").
+		WillReturnRows(rows)
+
+	list, err := repo.ListPendingByWorkspace(context.Background(), "ws-1")
+	if err != nil {
+		t.Fatalf("ListPendingByWorkspace: %v", err)
+	}
+	if len(list) != 1 || list[0].Email != "a@b.com" || list[0].Role != domain.RoleMember {
+		t.Fatalf("unexpected list: %+v", list)
+	}
+}
diff --git a/internal/infrastructure/repository/postgres/limitoffset.go b/internal/infrastructure/repository/postgres/limitoffset.go
new file mode 100644
index 00000000..497ba1a7
--- /dev/null
+++ b/internal/infrastructure/repository/postgres/limitoffset.go
@@ -0,0 +1,29 @@
+package postgres
+
+import "fmt"
+
+const (
+	defaultListLimit = 50
+	maxListLimit     = 500
+)
+
+// clampLimitOffset bounds list query pagination inputs.
+func clampLimitOffset(limit, offset int) (int, int) {
+	if limit <= 0 {
+		limit = defaultListLimit
+	}
+	if limit > maxListLimit {
+		limit = maxListLimit
+	}
+	if offset < 0 {
+		offset = 0
+	}
+	return limit, offset
+}
+
+// limitOffsetSQL returns a safe LIMIT/OFFSET clause for Postgres list queries.
+// Values are clamped in Go — not passed as query parameters (driver limitation).
+func limitOffsetSQL(limit, offset int) string {
+	limit, offset = clampLimitOffset(limit, offset)
+	return fmt.Sprintf("LIMIT %d OFFSET %d", limit, offset)
+}
diff --git a/internal/infrastructure/repository/postgres/limitoffset_test.go b/internal/infrastructure/repository/postgres/limitoffset_test.go
new file mode 100644
index 00000000..30e37904
--- /dev/null
+++ b/internal/infrastructure/repository/postgres/limitoffset_test.go
@@ -0,0 +1,33 @@
+package postgres
+
+import "testing"
+
+func TestClampLimitOffset(t *testing.T) {
+	tests := []struct {
+		name       string
+		limit      int
+		offset     int
+		wantLimit  int
+		wantOffset int
+	}{
+		{"defaults", 0, 0, defaultListLimit, 0},
+		{"caps max", 1000, 0, maxListLimit, 0},
+		{"negative offset", 10, -5, 10, 0},
+		{"valid", 25, 50, 25, 50},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			gotLimit, gotOffset := clampLimitOffset(tt.limit, tt.offset)
+			if gotLimit != tt.wantLimit || gotOffset != tt.wantOffset {
+				t.Fatalf("got (%d,%d), want (%d,%d)", gotLimit, gotOffset, tt.wantLimit, tt.wantOffset)
+			}
+		})
+	}
+}
+
+func TestLimitOffsetSQL(t *testing.T) {
+	if got := limitOffsetSQL(25, 10); got != "LIMIT 25 OFFSET 10" {
+		t.Fatalf("got %q", got)
+	}
+}
diff --git a/internal/infrastructure/repository/postgres/message_request_log_repository.go b/internal/infrastructure/repository/postgres/message_request_log_repository.go
index f29a46cd..35cf2f1f 100644
--- a/internal/infrastructure/repository/postgres/message_request_log_repository.go
+++ b/internal/infrastructure/repository/postgres/message_request_log_repository.go
@@ -21,52 +21,88 @@ func NewMessageRequestLogRepository(client *pgsql.PgClient) port.MessageRequestL
 }
 
 func (r *MessageRequestLogRepository) Create(ctx context.Context, log *domain.MessageRequestLog) error {
-	query := `
-		INSERT INTO message_request_logs (workspace_id, api_key_id, channel_type, http_method, status_code, endpoint, provider_name, request_id, duration_ms, error_message)
-		VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)
+	const query = `
+		INSERT INTO message_request_logs (
+			workspace_id, api_key_id, channel_type, http_method, status_code, endpoint,
+			provider_name, request_id, duration_ms, error_message, inbox_message_id
+		)
+		VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)
 		RETURNING id, created_at
 	`
-	var apiKeyID interface{}
-	if log.APIKeyID != "" {
-		apiKeyID = log.APIKeyID
-	}
-	var reqID interface{}
-	if log.RequestID != "" {
-		reqID = log.RequestID
-	}
-	var dur interface{}
-	if log.DurationMs > 0 {
-		dur = log.DurationMs
-	}
-	var errMsg interface{}
-	if log.ErrorMessage != "" {
-		errMsg = log.ErrorMessage
-	}
-	var provider interface{}
-	if log.ProviderName != "" {
-		provider = log.ProviderName
-	}
+
 	err := r.client.GetDB(ctx).QueryRowContext(ctx, query,
-		log.WorkspaceID, apiKeyID, log.ChannelType, log.HTTPMethod, log.StatusCode, log.Endpoint,
-		provider, reqID, dur, errMsg,
+		log.WorkspaceID,
+		nullIfEmpty(log.APIKeyID),
+		log.ChannelType,
+		log.HTTPMethod,
+		log.StatusCode,
+		log.Endpoint,
+		nullIfEmpty(log.ProviderName),
+		nullIfEmpty(log.RequestID),
+		nullIfNonPositive(log.DurationMs),
+		nullIfEmpty(log.ErrorMessage),
+		nullIfEmpty(log.InboxMessageID),
 	).Scan(&log.ID, &log.CreatedAt)
 	if err != nil {
-		slog.ErrorContext(ctx, "database error: failed to create message request log", "error", err, "workspace_id", log.WorkspaceID, "endpoint", log.Endpoint)
+		slog.ErrorContext(ctx, "database error: failed to create message request log", "error", err, "endpoint", log.Endpoint)
+		return err
+	}
+
+	if log.Payload != nil {
+		if err := r.insertPayload(ctx, log); err != nil {
+			// Metadata logs must persist even when optional payload storage fails.
+			slog.WarnContext(ctx, "message request payload not stored", "error", err, "log_id", log.ID)
+		}
 	}
-	return err
+
+	return nil
 }
 
-func (r *MessageRequestLogRepository) ListWithSource(ctx context.Context, q port.MessageLogQuery) ([]domain.MessageRequestLogWithSource, int, error) {
-	if q.Limit <= 0 {
-		q.Limit = 50
+func (r *MessageRequestLogRepository) insertPayload(ctx context.Context, log *domain.MessageRequestLog) error {
+	log.Payload.LogID = log.ID
+	payloadQuery := `
+		INSERT INTO message_request_payloads (log_id, request_body, response_body)
+		VALUES ($1, $2, $3)
+		RETURNING created_at
+	`
+	err := r.client.GetDB(ctx).QueryRowContext(ctx, payloadQuery,
+		log.Payload.LogID, log.Payload.RequestBody, log.Payload.ResponseBody,
+	).Scan(&log.Payload.CreatedAt)
+	if err != nil {
+		return fmt.Errorf("insert message request payload: %w", err)
 	}
-	if q.Limit > 500 {
-		q.Limit = 500
+	return nil
+}
+
+func scanMessageRequestLogWithSource(
+	scanner interface{ Scan(dest ...any) error },
+) (domain.MessageRequestLogWithSource, error) {
+	var row domain.MessageRequestLogWithSource
+	var apiKeyID, reqID, errMsg, prov, inboxID sql.NullString
+	var dur sql.NullInt64
+
+	err := scanner.Scan(
+		&row.ID, &row.WorkspaceID, &apiKeyID, &row.ChannelType, &row.HTTPMethod, &row.StatusCode, &row.Endpoint,
+		&prov, &reqID, &dur, &errMsg, &inboxID, &row.CreatedAt,
+		&row.SourceName, &row.ClientID,
+	)
+	if err != nil {
+		return row, err
 	}
-	if q.Offset < 0 {
-		q.Offset = 0
+
+	row.APIKeyID = optionalStringFromNull(apiKeyID)
+	row.ProviderName = optionalStringFromNull(prov)
+	row.RequestID = optionalStringFromNull(reqID)
+	row.ErrorMessage = optionalStringFromNull(errMsg)
+	row.InboxMessageID = optionalStringFromNull(inboxID)
+	if dur.Valid {
+		row.DurationMs = int(dur.Int64)
 	}
 
+	return row, nil
+}
+
+func (r *MessageRequestLogRepository) ListWithSource(ctx context.Context, q port.MessageLogQuery) ([]domain.MessageRequestLogWithSource, int, error) {
 	db := r.client.GetDB(ctx)
 	args := []any{q.WorkspaceID}
 	where := "l.workspace_id = $1"
@@ -86,68 +122,43 @@ func (r *MessageRequestLogRepository) ListWithSource(ctx context.Context, q port
 		args = append(args, *q.To)
 	}
 
-	countQuery := "SELECT COUNT(*) FROM message_request_logs l WHERE " + where
+	limit, offset := clampLimitOffset(q.Limit, q.Offset)
+
+	countQuery := fmt.Sprintf(`SELECT COUNT(*) FROM message_request_logs l WHERE %s`, where)
 	var total int
 	if err := db.QueryRowContext(ctx, countQuery, args...).Scan(&total); err != nil {
-		slog.ErrorContext(ctx, "database error: failed to count message request logs", "error", err, "workspace_id", q.WorkspaceID)
+		slog.ErrorContext(ctx, "database error: failed to count message request logs", "error", err)
 		return nil, 0, err
 	}
 
-	// LIMIT and OFFSET come from bounded Go int values clamped above — not from user input.
-	// database/sql does not support parameterised LIMIT/OFFSET in standard Postgres; using
-	// fmt.Sprintf with validated integers is the correct approach here.
 	listQuery := fmt.Sprintf(`
 		SELECT l.id, l.workspace_id, l.api_key_id, l.channel_type, l.http_method, l.status_code, l.endpoint,
-			l.provider_name, l.request_id, l.duration_ms, l.error_message, l.created_at,
+			l.provider_name, l.request_id, l.duration_ms, l.error_message, l.inbox_message_id, l.created_at,
 			COALESCE(k.name, ''), COALESCE(k.client_id, '')
 		FROM message_request_logs l
 		LEFT JOIN api_keys k ON k.id = l.api_key_id
 		WHERE %s
 		ORDER BY l.created_at DESC
-		LIMIT %d OFFSET %d`, where, q.Limit, q.Offset)
+		LIMIT %d OFFSET %d`, where, limit, offset)
 
 	rows, err := db.QueryContext(ctx, listQuery, args...)
 	if err != nil {
-		slog.ErrorContext(ctx, "database error: failed to query message request logs", "error", err, "workspace_id", q.WorkspaceID)
+		slog.ErrorContext(ctx, "database error: failed to query message request logs", "error", err)
 		return nil, 0, err
 	}
 	defer rows.Close() //nolint:errcheck
 
 	var out []domain.MessageRequestLogWithSource
 	for rows.Next() {
-		var row domain.MessageRequestLogWithSource
-		var apiKeyID sql.NullString
-		var reqID sql.NullString
-		var dur sql.NullInt64
-		var errMsg sql.NullString
-		var prov sql.NullString
-		if err := rows.Scan(
-			&row.ID, &row.WorkspaceID, &apiKeyID, &row.ChannelType, &row.HTTPMethod, &row.StatusCode, &row.Endpoint,
-			&prov, &reqID, &dur, &errMsg, &row.CreatedAt,
-			&row.SourceName, &row.ClientID,
-		); err != nil {
-			slog.ErrorContext(ctx, "database error: failed to scan message request log", "error", err, "workspace_id", q.WorkspaceID)
+		row, err := scanMessageRequestLogWithSource(rows)
+		if err != nil {
+			slog.ErrorContext(ctx, "database error: failed to scan message request log", "error", err)
 			return nil, 0, err
 		}
-		if apiKeyID.Valid {
-			row.APIKeyID = apiKeyID.String
-		}
-		if prov.Valid {
-			row.ProviderName = prov.String
-		}
-		if reqID.Valid {
-			row.RequestID = reqID.String
-		}
-		if dur.Valid {
-			row.DurationMs = int(dur.Int64)
-		}
-		if errMsg.Valid {
-			row.ErrorMessage = errMsg.String
-		}
 		out = append(out, row)
 	}
 	if err := rows.Err(); err != nil {
-		slog.ErrorContext(ctx, "database error: rows iteration failed for message request logs", "error", err, "workspace_id", q.WorkspaceID)
+		slog.ErrorContext(ctx, "database error: rows iteration failed for message request logs", "error", err)
 		return nil, 0, err
 	}
 	return out, total, nil
diff --git a/internal/infrastructure/repository/postgres/message_request_log_repository_test.go b/internal/infrastructure/repository/postgres/message_request_log_repository_test.go
new file mode 100644
index 00000000..443b8a04
--- /dev/null
+++ b/internal/infrastructure/repository/postgres/message_request_log_repository_test.go
@@ -0,0 +1,108 @@
+package postgres
+
+import (
+	"database/sql"
+	"testing"
+	"time"
+
+	"github.com/DATA-DOG/go-sqlmock"
+)
+
+func TestScanMessageRequestLogWithSource_nullInboxMessageID(t *testing.T) {
+	t.Parallel()
+
+	db, mock, err := sqlmock.New()
+	if err != nil {
+		t.Fatalf("sqlmock.New: %v", err)
+	}
+	t.Cleanup(func() { _ = db.Close() })
+
+	createdAt := time.Date(2026, 7, 4, 9, 0, 0, 0, time.UTC)
+	rows := sqlmock.NewRows([]string{
+		"id", "workspace_id", "api_key_id", "channel_type", "http_method", "status_code", "endpoint",
+		"provider_name", "request_id", "duration_ms", "error_message", "inbox_message_id", "created_at",
+		"source_name", "client_id",
+	}).AddRow(
+		"log-1", "ws-1", nil, "email", "POST", 200, "/v1/email",
+		"memory", nil, 12, nil, nil, createdAt,
+		"Demo Key", "demo-client",
+	)
+
+	mock.ExpectQuery("SELECT").WillReturnRows(rows)
+
+	resultRows, err := db.Query("SELECT")
+	if err != nil {
+		t.Fatalf("Query: %v", err)
+	}
+	t.Cleanup(func() { _ = resultRows.Close() })
+
+	if !resultRows.Next() {
+		t.Fatal("expected one row")
+	}
+
+	row, err := scanMessageRequestLogWithSource(resultRows)
+	if err != nil {
+		t.Fatalf("scanMessageRequestLogWithSource: %v", err)
+	}
+
+	if row.InboxMessageID != "" {
+		t.Fatalf("InboxMessageID: got %q, want empty for SQL NULL", row.InboxMessageID)
+	}
+	if row.ProviderName != "memory" {
+		t.Fatalf("ProviderName: got %q", row.ProviderName)
+	}
+}
+
+func TestScanMessageRequestLogWithSource_withInboxMessageID(t *testing.T) {
+	t.Parallel()
+
+	db, mock, err := sqlmock.New()
+	if err != nil {
+		t.Fatalf("sqlmock.New: %v", err)
+	}
+	t.Cleanup(func() { _ = db.Close() })
+
+	createdAt := time.Date(2026, 7, 4, 9, 0, 0, 0, time.UTC)
+	inboxID := "inbox-msg-99"
+	rows := sqlmock.NewRows([]string{
+		"id", "workspace_id", "api_key_id", "channel_type", "http_method", "status_code", "endpoint",
+		"provider_name", "request_id", "duration_ms", "error_message", "inbox_message_id", "created_at",
+		"source_name", "client_id",
+	}).AddRow(
+		"log-2", "ws-1", nil, "email", "POST", 200, "/v1/email",
+		"memory", nil, 12, nil, inboxID, createdAt,
+		"Demo Key", "demo-client",
+	)
+
+	mock.ExpectQuery("SELECT").WillReturnRows(rows)
+
+	resultRows, err := db.Query("SELECT")
+	if err != nil {
+		t.Fatalf("Query: %v", err)
+	}
+	t.Cleanup(func() { _ = resultRows.Close() })
+
+	if !resultRows.Next() {
+		t.Fatal("expected one row")
+	}
+
+	row, err := scanMessageRequestLogWithSource(resultRows)
+	if err != nil {
+		t.Fatalf("scanMessageRequestLogWithSource: %v", err)
+	}
+
+	if row.InboxMessageID != inboxID {
+		t.Fatalf("InboxMessageID: got %q, want %q", row.InboxMessageID, inboxID)
+	}
+}
+
+func TestOptionalStringFromNull(t *testing.T) {
+	t.Parallel()
+
+	if got := optionalStringFromNull(sql.NullString{}); got != "" {
+		t.Fatalf("NULL: got %q", got)
+	}
+	if got := optionalStringFromNull(sql.NullString{String: "x", Valid: true}); got != "x" {
+		t.Fatalf("valid: got %q", got)
+	}
+}
diff --git a/internal/infrastructure/repository/postgres/payload_inbox_reader.go b/internal/infrastructure/repository/postgres/payload_inbox_reader.go
new file mode 100644
index 00000000..23d74427
--- /dev/null
+++ b/internal/infrastructure/repository/postgres/payload_inbox_reader.go
@@ -0,0 +1,513 @@
+package postgres
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"log/slog"
+	"time"
+
+	"github.com/weprodev/go-pkg/pgsql"
+
+	"github.com/weprodev/wpd-message-gateway/internal/core/port"
+	"github.com/weprodev/wpd-message-gateway/pkg/contracts"
+)
+
+const (
+	payloadInboxChannelEmail = "email"
+	payloadInboxChannelSMS   = "sms"
+	payloadInboxChannelPush  = "push"
+	payloadInboxChannelChat  = "chat"
+
+	payloadInboxDefaultPageSize = 50
+	payloadInboxMaxPageSize     = 200
+)
+
+var (
+	_ port.InboxReader = (*PayloadInboxReader)(nil)
+
+	channelStatKeys = map[string]string{
+		payloadInboxChannelEmail: "emails",
+		payloadInboxChannelSMS:   "sms",
+		payloadInboxChannelPush:  "push",
+		payloadInboxChannelChat:  "chat",
+	}
+)
+
+// PayloadInboxReader serves inbox reads from persisted message_request_payloads.
+// An optional fallback reader covers the brief window before request logs are written.
+type PayloadInboxReader struct {
+	client   *pgsql.PgClient
+	fallback port.InboxReader
+}
+
+func NewPayloadInboxReader(client *pgsql.PgClient, fallback port.InboxReader) *PayloadInboxReader {
+	return &PayloadInboxReader{client: client, fallback: fallback}
+}
+
+type payloadInboxRow struct {
+	logID          string
+	workspaceID    string
+	inboxMessageID sql.NullString
+	createdAt      time.Time
+	requestBody    string
+}
+
+func (row payloadInboxRow) messageID() string {
+	if row.inboxMessageID.Valid && row.inboxMessageID.String != "" {
+		return row.inboxMessageID.String
+	}
+	return row.logID
+}
+
+func clampPayloadInboxLimit(limit int) int {
+	if limit <= 0 {
+		return payloadInboxDefaultPageSize
+	}
+	if limit > payloadInboxMaxPageSize {
+		return payloadInboxMaxPageSize
+	}
+	return limit
+}
+
+func unmarshalPayload[T any](requestBody string) (T, error) {
+	var payload T
+	if err := json.Unmarshal([]byte(requestBody), &payload); err != nil {
+		return payload, err
+	}
+	return payload, nil
+}
+
+func listStoredMessages[T any](
+	r *PayloadInboxReader,
+	workspaceID, channel string,
+	limit int,
+	cursor string,
+	parse func(payloadInboxRow) (T, error),
+	idOf func(T) string,
+) ([]T, string, bool) {
+	rows, hasMore := r.queryPayloadRows(workspaceID, channel, limit, cursor)
+	items := make([]T, 0, len(rows))
+	for _, row := range rows {
+		item, err := parse(row)
+		if err != nil {
+			slog.Warn("inbox payload unreadable", "error", err, "log_id", row.logID, "channel", channel)
+			continue
+		}
+		items = append(items, item)
+	}
+
+	nextCursor := ""
+	if hasMore && len(items) > 0 {
+		nextCursor = idOf(items[len(items)-1])
+	}
+	return items, nextCursor, hasMore
+}
+
+func getStoredMessage[T any](primary, fallback func() (T, bool)) (T, bool) {
+	if item, ok := primary(); ok {
+		return item, true
+	}
+	return fallback()
+}
+
+func deleteStoredMessage(primary, fallback func() bool) bool {
+	return primary() || fallback()
+}
+
+func (r *PayloadInboxReader) StatsForWorkspace(workspaceID string) map[string]int {
+	ctx := context.Background()
+	const query = `
+		SELECT l.channel_type, COUNT(*)
+		FROM message_request_logs l
+		INNER JOIN message_request_payloads p ON p.log_id = l.id
+		WHERE l.workspace_id = $1
+		GROUP BY l.channel_type
+	`
+
+	rows, err := r.client.GetDB(ctx).QueryContext(ctx, query, workspaceID)
+	if err != nil {
+		slog.ErrorContext(ctx, "database error: failed to count inbox payloads", "error", err, "workspace_id", workspaceID)
+		return emptyInboxStats()
+	}
+	defer rows.Close() //nolint:errcheck
+
+	counts := emptyInboxStats()
+	for rows.Next() {
+		var channel string
+		var count int
+		if err := rows.Scan(&channel, &count); err != nil {
+			continue
+		}
+		if key, ok := channelStatKeys[channel]; ok {
+			counts[key] = count
+		}
+	}
+	counts["total"] = counts["emails"] + counts["sms"] + counts["push"] + counts["chat"]
+	return counts
+}
+
+func emptyInboxStats() map[string]int {
+	return map[string]int{"emails": 0, "sms": 0, "push": 0, "chat": 0, "total": 0}
+}
+
+func (r *PayloadInboxReader) EmailsForWorkspace(workspaceID string) []port.StoredEmail {
+	return r.ListEmailsForWorkspace(workspaceID, 0, "").Items
+}
+
+func (r *PayloadInboxReader) ListEmailsForWorkspace(workspaceID string, limit int, cursor string) port.InboxEmailPage {
+	items, nextCursor, hasMore := listStoredMessages(
+		r, workspaceID, payloadInboxChannelEmail, limit, cursor, parseStoredEmail,
+		func(item port.StoredEmail) string { return item.ID },
+	)
+	return port.InboxEmailPage{Items: items, NextCursor: nextCursor, HasMore: hasMore}
+}
+
+func (r *PayloadInboxReader) EmailByIDForWorkspace(id, workspaceID string) (port.StoredEmail, bool) {
+	return getStoredMessage(
+		func() (port.StoredEmail, bool) { return r.storedEmailByMessageID(workspaceID, id) },
+		func() (port.StoredEmail, bool) {
+			if r.fallback == nil {
+				return port.StoredEmail{}, false
+			}
+			return r.fallback.EmailByIDForWorkspace(id, workspaceID)
+		},
+	)
+}
+
+func (r *PayloadInboxReader) DeleteEmailByIDForWorkspace(id, workspaceID string) bool {
+	return deleteStoredMessage(
+		func() bool { return r.deletePayloadByMessageID(workspaceID, payloadInboxChannelEmail, id) },
+		func() bool {
+			if r.fallback == nil {
+				return false
+			}
+			return r.fallback.DeleteEmailByIDForWorkspace(id, workspaceID)
+		},
+	)
+}
+
+func (r *PayloadInboxReader) SMSForWorkspace(workspaceID string) []port.StoredSMS {
+	return r.ListSMSForWorkspace(workspaceID, 0, "").Items
+}
+
+func (r *PayloadInboxReader) ListSMSForWorkspace(workspaceID string, limit int, cursor string) port.InboxSMSPage {
+	items, nextCursor, hasMore := listStoredMessages(
+		r, workspaceID, payloadInboxChannelSMS, limit, cursor, parseStoredSMS,
+		func(item port.StoredSMS) string { return item.ID },
+	)
+	return port.InboxSMSPage{Items: items, NextCursor: nextCursor, HasMore: hasMore}
+}
+
+func (r *PayloadInboxReader) SMSByIDForWorkspace(id, workspaceID string) (port.StoredSMS, bool) {
+	return getStoredMessage(
+		func() (port.StoredSMS, bool) { return r.storedSMSByMessageID(workspaceID, id) },
+		func() (port.StoredSMS, bool) {
+			if r.fallback == nil {
+				return port.StoredSMS{}, false
+			}
+			return r.fallback.SMSByIDForWorkspace(id, workspaceID)
+		},
+	)
+}
+
+func (r *PayloadInboxReader) DeleteSMSByIDForWorkspace(id, workspaceID string) bool {
+	return deleteStoredMessage(
+		func() bool { return r.deletePayloadByMessageID(workspaceID, payloadInboxChannelSMS, id) },
+		func() bool {
+			if r.fallback == nil {
+				return false
+			}
+			return r.fallback.DeleteSMSByIDForWorkspace(id, workspaceID)
+		},
+	)
+}
+
+func (r *PayloadInboxReader) PushForWorkspace(workspaceID string) []port.StoredPush {
+	return r.ListPushForWorkspace(workspaceID, 0, "").Items
+}
+
+func (r *PayloadInboxReader) ListPushForWorkspace(workspaceID string, limit int, cursor string) port.InboxPushPage {
+	items, nextCursor, hasMore := listStoredMessages(
+		r, workspaceID, payloadInboxChannelPush, limit, cursor, parseStoredPush,
+		func(item port.StoredPush) string { return item.ID },
+	)
+	return port.InboxPushPage{Items: items, NextCursor: nextCursor, HasMore: hasMore}
+}
+
+func (r *PayloadInboxReader) PushByIDForWorkspace(id, workspaceID string) (port.StoredPush, bool) {
+	return getStoredMessage(
+		func() (port.StoredPush, bool) { return r.storedPushByMessageID(workspaceID, id) },
+		func() (port.StoredPush, bool) {
+			if r.fallback == nil {
+				return port.StoredPush{}, false
+			}
+			return r.fallback.PushByIDForWorkspace(id, workspaceID)
+		},
+	)
+}
+
+func (r *PayloadInboxReader) DeletePushByIDForWorkspace(id, workspaceID string) bool {
+	return deleteStoredMessage(
+		func() bool { return r.deletePayloadByMessageID(workspaceID, payloadInboxChannelPush, id) },
+		func() bool {
+			if r.fallback == nil {
+				return false
+			}
+			return r.fallback.DeletePushByIDForWorkspace(id, workspaceID)
+		},
+	)
+}
+
+func (r *PayloadInboxReader) ChatForWorkspace(workspaceID string) []port.StoredChat {
+	return r.ListChatForWorkspace(workspaceID, 0, "").Items
+}
+
+func (r *PayloadInboxReader) ListChatForWorkspace(workspaceID string, limit int, cursor string) port.InboxChatPage {
+	items, nextCursor, hasMore := listStoredMessages(
+		r, workspaceID, payloadInboxChannelChat, limit, cursor, parseStoredChat,
+		func(item port.StoredChat) string { return item.ID },
+	)
+	return port.InboxChatPage{Items: items, NextCursor: nextCursor, HasMore: hasMore}
+}
+
+func (r *PayloadInboxReader) ChatByIDForWorkspace(id, workspaceID string) (port.StoredChat, bool) {
+	return getStoredMessage(
+		func() (port.StoredChat, bool) { return r.storedChatByMessageID(workspaceID, id) },
+		func() (port.StoredChat, bool) {
+			if r.fallback == nil {
+				return port.StoredChat{}, false
+			}
+			return r.fallback.ChatByIDForWorkspace(id, workspaceID)
+		},
+	)
+}
+
+func (r *PayloadInboxReader) DeleteChatByIDForWorkspace(id, workspaceID string) bool {
+	return deleteStoredMessage(
+		func() bool { return r.deletePayloadByMessageID(workspaceID, payloadInboxChannelChat, id) },
+		func() bool {
+			if r.fallback == nil {
+				return false
+			}
+			return r.fallback.DeleteChatByIDForWorkspace(id, workspaceID)
+		},
+	)
+}
+
+func (r *PayloadInboxReader) ClearWorkspace(workspaceID string) {
+	ctx := context.Background()
+	const query = `
+		DELETE FROM message_request_payloads
+		WHERE log_id IN (
+			SELECT id FROM message_request_logs WHERE workspace_id = $1
+		)
+	`
+	if _, err := r.client.GetDB(ctx).ExecContext(ctx, query, workspaceID); err != nil {
+		slog.ErrorContext(ctx, "database error: failed to clear inbox payloads", "error", err, "workspace_id", workspaceID)
+	}
+	if r.fallback != nil {
+		r.fallback.ClearWorkspace(workspaceID)
+	}
+}
+
+func (r *PayloadInboxReader) storedEmailByMessageID(workspaceID, messageID string) (port.StoredEmail, bool) {
+	return storedMessageByID(r, workspaceID, payloadInboxChannelEmail, messageID, parseStoredEmail)
+}
+
+func (r *PayloadInboxReader) storedSMSByMessageID(workspaceID, messageID string) (port.StoredSMS, bool) {
+	return storedMessageByID(r, workspaceID, payloadInboxChannelSMS, messageID, parseStoredSMS)
+}
+
+func (r *PayloadInboxReader) storedPushByMessageID(workspaceID, messageID string) (port.StoredPush, bool) {
+	return storedMessageByID(r, workspaceID, payloadInboxChannelPush, messageID, parseStoredPush)
+}
+
+func (r *PayloadInboxReader) storedChatByMessageID(workspaceID, messageID string) (port.StoredChat, bool) {
+	return storedMessageByID(r, workspaceID, payloadInboxChannelChat, messageID, parseStoredChat)
+}
+
+func storedMessageByID[T any](
+	r *PayloadInboxReader,
+	workspaceID, channel, messageID string,
+	parse func(payloadInboxRow) (T, error),
+) (T, bool) {
+	var zero T
+	row, ok := r.payloadRowByMessageID(workspaceID, channel, messageID)
+	if !ok {
+		return zero, false
+	}
+	item, err := parse(row)
+	if err != nil {
+		return zero, false
+	}
+	return item, true
+}
+
+func (r *PayloadInboxReader) queryPayloadRows(workspaceID, channel string, limit int, cursor string) ([]payloadInboxRow, bool) {
+	ctx := context.Background()
+	limit = clampPayloadInboxLimit(limit)
+	fetchLimit := limit + 1
+
+	cursorCreatedAt, cursorLogID, hasCursor := r.resolvePayloadCursor(ctx, workspaceID, channel, cursor)
+
+	const baseSelect = `
+		SELECT l.id, l.workspace_id, l.inbox_message_id, l.created_at, p.request_body
+		FROM message_request_logs l
+		INNER JOIN message_request_payloads p ON p.log_id = l.id
+		WHERE l.workspace_id = $1 AND l.channel_type = $2
+	`
+
+	var (
+		rows *sql.Rows
+		err  error
+	)
+	if hasCursor {
+		query := baseSelect + `
+			AND (l.created_at, l.id) < ($3, $4)
+			ORDER BY l.created_at DESC, l.id DESC
+			LIMIT $5
+		`
+		rows, err = r.client.GetDB(ctx).QueryContext(ctx, query, workspaceID, channel, cursorCreatedAt, cursorLogID, fetchLimit)
+	} else {
+		query := baseSelect + `
+			ORDER BY l.created_at DESC, l.id DESC
+			LIMIT $3
+		`
+		rows, err = r.client.GetDB(ctx).QueryContext(ctx, query, workspaceID, channel, fetchLimit)
+	}
+	if err != nil {
+		slog.ErrorContext(ctx, "database error: failed to list inbox payloads", "error", err, "workspace_id", workspaceID, "channel", channel)
+		return nil, false
+	}
+	defer rows.Close() //nolint:errcheck
+
+	var items []payloadInboxRow
+	for rows.Next() {
+		var row payloadInboxRow
+		if err := rows.Scan(&row.logID, &row.workspaceID, &row.inboxMessageID, &row.createdAt, &row.requestBody); err != nil {
+			continue
+		}
+		items = append(items, row)
+	}
+	if err := rows.Err(); err != nil {
+		slog.ErrorContext(ctx, "database error: inbox payload list iteration failed", "error", err)
+		return nil, false
+	}
+
+	hasMore := len(items) > limit
+	if hasMore {
+		items = items[:limit]
+	}
+	return items, hasMore
+}
+
+func (r *PayloadInboxReader) resolvePayloadCursor(ctx context.Context, workspaceID, channel, cursor string) (time.Time, string, bool) {
+	if cursor == "" {
+		return time.Time{}, "", false
+	}
+
+	const query = `
+		SELECT l.created_at, l.id
+		FROM message_request_logs l
+		INNER JOIN message_request_payloads p ON p.log_id = l.id
+		WHERE l.workspace_id = $1 AND l.channel_type = $2
+		  AND (l.inbox_message_id = $3 OR l.id::text = $3)
+	`
+	var createdAt time.Time
+	var logID string
+	err := r.client.GetDB(ctx).QueryRowContext(ctx, query, workspaceID, channel, cursor).Scan(&createdAt, &logID)
+	if errors.Is(err, sql.ErrNoRows) {
+		return time.Time{}, "", false
+	}
+	if err != nil {
+		slog.ErrorContext(ctx, "database error: failed to resolve inbox payload cursor", "error", err, "cursor", cursor)
+		return time.Time{}, "", false
+	}
+	return createdAt, logID, true
+}
+
+func (r *PayloadInboxReader) payloadRowByMessageID(workspaceID, channel, messageID string) (payloadInboxRow, bool) {
+	ctx := context.Background()
+	const query = `
+		SELECT l.id, l.workspace_id, l.inbox_message_id, l.created_at, p.request_body
+		FROM message_request_logs l
+		INNER JOIN message_request_payloads p ON p.log_id = l.id
+		WHERE l.workspace_id = $1 AND l.channel_type = $2
+		  AND (l.inbox_message_id = $3 OR l.id::text = $3)
+	`
+
+	var row payloadInboxRow
+	err := r.client.GetDB(ctx).QueryRowContext(ctx, query, workspaceID, channel, messageID).
+		Scan(&row.logID, &row.workspaceID, &row.inboxMessageID, &row.createdAt, &row.requestBody)
+	if errors.Is(err, sql.ErrNoRows) {
+		return payloadInboxRow{}, false
+	}
+	if err != nil {
+		slog.ErrorContext(ctx, "database error: failed to get inbox payload", "error", err, "message_id", messageID)
+		return payloadInboxRow{}, false
+	}
+	return row, true
+}
+
+func (r *PayloadInboxReader) deletePayloadByMessageID(workspaceID, channel, messageID string) bool {
+	ctx := context.Background()
+	const query = `
+		DELETE FROM message_request_payloads
+		WHERE log_id IN (
+			SELECT l.id
+			FROM message_request_logs l
+			WHERE l.workspace_id = $1 AND l.channel_type = $2
+			  AND (l.inbox_message_id = $3 OR l.id::text = $3)
+		)
+	`
+	res, err := r.client.GetDB(ctx).ExecContext(ctx, query, workspaceID, channel, messageID)
+	if err != nil {
+		slog.ErrorContext(ctx, "database error: failed to delete inbox payload", "error", err, "message_id", messageID)
+		return false
+	}
+	n, err := res.RowsAffected()
+	return err == nil && n > 0
+}
+
+func parseStoredEmail(row payloadInboxRow) (port.StoredEmail, error) {
+	email, err := unmarshalPayload[contracts.Email](row.requestBody)
+	if err != nil {
+		return port.StoredEmail{}, fmt.Errorf("unmarshal email payload: %w", err)
+	}
+	return port.StoredEmail{
+		ID: row.messageID(), WorkspaceID: row.workspaceID, CreatedAt: row.createdAt, Email: email,
+	}, nil
+}
+
+func parseStoredSMS(row payloadInboxRow) (port.StoredSMS, error) {
+	sms, err := unmarshalPayload[contracts.SMS](row.requestBody)
+	if err != nil {
+		return port.StoredSMS{}, fmt.Errorf("unmarshal sms payload: %w", err)
+	}
+	return port.StoredSMS{
+		ID: row.messageID(), WorkspaceID: row.workspaceID, CreatedAt: row.createdAt, SMS: sms,
+	}, nil
+}
+
+func parseStoredPush(row payloadInboxRow) (port.StoredPush, error) {
+	push, err := unmarshalPayload[contracts.PushNotification](row.requestBody)
+	if err != nil {
+		return port.StoredPush{}, fmt.Errorf("unmarshal push payload: %w", err)
+	}
+	return port.StoredPush{
+		ID: row.messageID(), WorkspaceID: row.workspaceID, CreatedAt: row.createdAt, Push: push,
+	}, nil
+}
+
+func parseStoredChat(row payloadInboxRow) (port.StoredChat, error) {
+	chat, err := unmarshalPayload[contracts.ChatMessage](row.requestBody)
+	if err != nil {
+		return port.StoredChat{}, fmt.Errorf("unmarshal chat payload: %w", err)
+	}
+	return port.StoredChat{
+		ID: row.messageID(), WorkspaceID: row.workspaceID, CreatedAt: row.createdAt, Chat: chat,
+	}, nil
+}
diff --git a/internal/infrastructure/repository/postgres/payload_inbox_reader_test.go b/internal/infrastructure/repository/postgres/payload_inbox_reader_test.go
new file mode 100644
index 00000000..79577a0d
--- /dev/null
+++ b/internal/infrastructure/repository/postgres/payload_inbox_reader_test.go
@@ -0,0 +1,94 @@
+package postgres
+
+import (
+	"encoding/json"
+	"regexp"
+	"testing"
+	"time"
+
+	"github.com/DATA-DOG/go-sqlmock"
+
+	"github.com/weprodev/wpd-message-gateway/pkg/contracts"
+)
+
+func TestPayloadInboxReader_ListEmailsForWorkspace(t *testing.T) {
+	t.Parallel()
+
+	client, mock, _ := newMockPgClient(t)
+	repo := NewPayloadInboxReader(client, nil)
+	workspaceID := "ws-1"
+	email := contracts.Email{Subject: "Hello", To: []string{"a@test.com"}, HTML: "<p>Hi</p>"}
+	requestBody, _ := json.Marshal(email)
+	createdAt := time.Now().UTC().Truncate(time.Second)
+
+	mock.ExpectQuery(regexp.QuoteMeta(`
+			SELECT l.id, l.workspace_id, l.inbox_message_id, l.created_at, p.request_body
+			FROM message_request_logs l
+			INNER JOIN message_request_payloads p ON p.log_id = l.id
+			WHERE l.workspace_id = $1 AND l.channel_type = $2
+		`)).
+		WithArgs(workspaceID, payloadInboxChannelEmail, payloadInboxDefaultPageSize+1).
+		WillReturnRows(sqlmock.NewRows([]string{"id", "workspace_id", "inbox_message_id", "created_at", "request_body"}).
+			AddRow("log-1", workspaceID, "inbox-1", createdAt, string(requestBody)))
+
+	page := repo.ListEmailsForWorkspace(workspaceID, 0, "")
+	if len(page.Items) != 1 {
+		t.Fatalf("items len = %d, want 1", len(page.Items))
+	}
+	if page.Items[0].ID != "inbox-1" {
+		t.Fatalf("id = %q, want inbox-1", page.Items[0].ID)
+	}
+	if page.Items[0].Email.Subject != "Hello" {
+		t.Fatalf("subject = %q", page.Items[0].Email.Subject)
+	}
+
+	if err := mock.ExpectationsWereMet(); err != nil {
+		t.Fatalf("expectations: %v", err)
+	}
+}
+
+func TestPayloadInboxReader_DeleteEmailByIDForWorkspace(t *testing.T) {
+	t.Parallel()
+
+	client, mock, _ := newMockPgClient(t)
+	repo := NewPayloadInboxReader(client, nil)
+
+	mock.ExpectExec(regexp.QuoteMeta(`
+		DELETE FROM message_request_payloads
+		WHERE log_id IN (
+			SELECT l.id
+			FROM message_request_logs l
+			WHERE l.workspace_id = $1 AND l.channel_type = $2
+			  AND (l.inbox_message_id = $3 OR l.id::text = $3)
+		)
+	`)).
+		WithArgs("ws-1", payloadInboxChannelEmail, "inbox-1").
+		WillReturnResult(sqlmock.NewResult(0, 1))
+
+	if !repo.DeleteEmailByIDForWorkspace("inbox-1", "ws-1") {
+		t.Fatal("expected delete success")
+	}
+}
+
+func TestPayloadInboxReader_StatsForWorkspace(t *testing.T) {
+	t.Parallel()
+
+	client, mock, _ := newMockPgClient(t)
+	repo := NewPayloadInboxReader(client, nil)
+
+	mock.ExpectQuery(regexp.QuoteMeta(`
+		SELECT l.channel_type, COUNT(*)
+		FROM message_request_logs l
+		INNER JOIN message_request_payloads p ON p.log_id = l.id
+		WHERE l.workspace_id = $1
+		GROUP BY l.channel_type
+	`)).
+		WithArgs("ws-1").
+		WillReturnRows(sqlmock.NewRows([]string{"channel_type", "count"}).
+			AddRow(payloadInboxChannelEmail, 3))
+
+	stats := repo.StatsForWorkspace("ws-1")
+	if stats["emails"] != 3 || stats["total"] != 3 {
+		t.Fatalf("stats = %v", stats)
+	}
+}
diff --git a/internal/infrastructure/repository/postgres/role_lookup.go b/internal/infrastructure/repository/postgres/role_lookup.go
new file mode 100644
index 00000000..68ae2cee
--- /dev/null
+++ b/internal/infrastructure/repository/postgres/role_lookup.go
@@ -0,0 +1,26 @@
+package postgres
+
+import (
+	"context"
+	"database/sql"
+	"fmt"
+	"log/slog"
+
+	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
+)
+
+type queryRower interface {
+	QueryRowContext(ctx context.Context, query string, args ...any) *sql.Row
+}
+
+func lookupRoleIDByName(ctx context.Context, db queryRower, roleName string) (string, error) {
+	var roleID string
+	err := db.QueryRowContext(ctx, `
+		SELECT id FROM roles WHERE name = $1 AND guard_name = $2
+	`, roleName, domain.RBACGuardName).Scan(&roleID)
+	if err != nil {
+		slog.ErrorContext(ctx, "database error: lookup role failed", "error", err, "role", roleName)
+		return "", fmt.Errorf("wpd-message-gateway: lookup role %q: %w", roleName, err)
+	}
+	return roleID, nil
+}
diff --git a/internal/infrastructure/repository/postgres/role_lookup_test.go b/internal/infrastructure/repository/postgres/role_lookup_test.go
new file mode 100644
index 00000000..38d6a199
--- /dev/null
+++ b/internal/infrastructure/repository/postgres/role_lookup_test.go
@@ -0,0 +1,32 @@
+package postgres
+
+import (
+	"context"
+	"testing"
+
+	"github.com/DATA-DOG/go-sqlmock"
+
+	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
+)
+
+func TestLookupRoleIDByName(t *testing.T) {
+	t.Parallel()
+
+	db, mock, err := sqlmock.New()
+	if err != nil {
+		t.Fatalf("sqlmock.New: %v", err)
+	}
+	t.Cleanup(func() { _ = db.Close() })
+
+	mock.ExpectQuery(`SELECT id FROM roles WHERE name = \$1 AND guard_name = \$2`).
+		WithArgs("admin", domain.RBACGuardName).
+		WillReturnRows(sqlmock.NewRows([]string{"id"}).AddRow("role-admin-id"))
+
+	roleID, err := lookupRoleIDByName(context.Background(), db, "admin")
+	if err != nil {
+		t.Fatalf("lookupRoleIDByName: %v", err)
+	}
+	if roleID != "role-admin-id" {
+		t.Fatalf("roleID: got %q", roleID)
+	}
+}
diff --git a/internal/infrastructure/repository/postgres/scan_helpers.go b/internal/infrastructure/repository/postgres/scan_helpers.go
new file mode 100644
index 00000000..8c6e2918
--- /dev/null
+++ b/internal/infrastructure/repository/postgres/scan_helpers.go
@@ -0,0 +1,26 @@
+package postgres
+
+import "database/sql"
+
+func optionalStringFromNull(v sql.NullString) string {
+	if v.Valid {
+		return v.String
+	}
+	return ""
+}
+
+// nullIfEmpty maps empty strings to SQL NULL on write.
+func nullIfEmpty(s string) any {
+	if s == "" {
+		return nil
+	}
+	return s
+}
+
+// nullIfNonPositive maps zero or negative integers to SQL NULL on write.
+func nullIfNonPositive(n int) any {
+	if n <= 0 {
+		return nil
+	}
+	return n
+}
diff --git a/internal/infrastructure/repository/postgres/scan_helpers_test.go b/internal/infrastructure/repository/postgres/scan_helpers_test.go
new file mode 100644
index 00000000..6727cbc8
--- /dev/null
+++ b/internal/infrastructure/repository/postgres/scan_helpers_test.go
@@ -0,0 +1,28 @@
+package postgres
+
+import "testing"
+
+func TestNullIfEmpty(t *testing.T) {
+	t.Parallel()
+
+	if got := nullIfEmpty(""); got != nil {
+		t.Fatalf("empty: got %v, want nil", got)
+	}
+	if got := nullIfEmpty("x"); got != "x" {
+		t.Fatalf("non-empty: got %v", got)
+	}
+}
+
+func TestNullIfNonPositive(t *testing.T) {
+	t.Parallel()
+
+	if got := nullIfNonPositive(0); got != nil {
+		t.Fatalf("zero: got %v, want nil", got)
+	}
+	if got := nullIfNonPositive(-1); got != nil {
+		t.Fatalf("negative: got %v, want nil", got)
+	}
+	if got := nullIfNonPositive(42); got != 42 {
+		t.Fatalf("positive: got %v", got)
+	}
+}
diff --git a/internal/infrastructure/repository/postgres/sqlmock_client_test.go b/internal/infrastructure/repository/postgres/sqlmock_client_test.go
new file mode 100644
index 00000000..70b8d46d
--- /dev/null
+++ b/internal/infrastructure/repository/postgres/sqlmock_client_test.go
@@ -0,0 +1,21 @@
+package postgres
+
+import (
+	"database/sql"
+	"testing"
+
+	"github.com/DATA-DOG/go-sqlmock"
+	"github.com/weprodev/go-pkg/pgsql"
+)
+
+func newMockPgClient(t *testing.T) (*pgsql.PgClient, sqlmock.Sqlmock, *sql.DB) {
+	t.Helper()
+
+	db, mock, err := sqlmock.New()
+	if err != nil {
+		t.Fatalf("sqlmock.New: %v", err)
+	}
+	t.Cleanup(func() { _ = db.Close() })
+
+	return &pgsql.PgClient{DB: db}, mock, db
+}
diff --git a/internal/infrastructure/repository/postgres/template_repository.go b/internal/infrastructure/repository/postgres/template_repository.go
index 3dc221b0..666b5b05 100644
--- a/internal/infrastructure/repository/postgres/template_repository.go
+++ b/internal/infrastructure/repository/postgres/template_repository.go
@@ -38,13 +38,6 @@ func (r *TemplateRepository) Create(ctx context.Context, template *domain.Templa
 	return nil
 }
 
-func nullIfEmpty(s string) interface{} {
-	if s == "" {
-		return nil
-	}
-	return s
-}
-
 func (r *TemplateRepository) GetByWorkspaceAndKey(ctx context.Context, workspaceID, uniqueKey string) (*domain.Template, error) {
 	query := `
 		SELECT id, workspace_id, name, unique_key, channel_type, category, subject, content, is_active, is_default, created_at, updated_at
diff --git a/internal/infrastructure/repository/postgres/template_repository_test.go b/internal/infrastructure/repository/postgres/template_repository_test.go
new file mode 100644
index 00000000..8c10e04e
--- /dev/null
+++ b/internal/infrastructure/repository/postgres/template_repository_test.go
@@ -0,0 +1,73 @@
+package postgres
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"testing"
+	"time"
+
+	"github.com/DATA-DOG/go-sqlmock"
+
+	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
+	"github.com/weprodev/wpd-message-gateway/internal/core/port"
+)
+
+func TestTemplateRepository_Create(t *testing.T) {
+	t.Parallel()
+
+	client, mock, _ := newMockPgClient(t)
+	repo := NewTemplateRepository(client)
+	now := time.Date(2026, 7, 4, 12, 0, 0, 0, time.UTC)
+
+	mock.ExpectQuery(`INSERT INTO templates`).
+		WithArgs("ws-1", "Welcome", "welcome", "email", nil, nil, "<p>hi</p>", true, false).
+		WillReturnRows(sqlmock.NewRows([]string{"id", "created_at", "updated_at"}).AddRow("tpl-1", now, now))
+
+	tpl := &domain.Template{
+		WorkspaceID: "ws-1",
+		Name:        "Welcome",
+		UniqueKey:   "welcome",
+		ChannelType: "email",
+		ContentHTML: "<p>hi</p>",
+		IsActive:    true,
+	}
+	if err := repo.Create(context.Background(), tpl); err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+	if tpl.ID != "tpl-1" {
+		t.Fatalf("unexpected template: %+v", tpl)
+	}
+}
+
+func TestTemplateRepository_GetByWorkspaceAndKey_notFound(t *testing.T) {
+	t.Parallel()
+
+	client, mock, _ := newMockPgClient(t)
+	repo := NewTemplateRepository(client)
+
+	mock.ExpectQuery(`FROM templates`).
+		WithArgs("ws-1", "missing").
+		WillReturnError(sql.ErrNoRows)
+
+	_, err := repo.GetByWorkspaceAndKey(context.Background(), "ws-1", "missing")
+	if err == nil || !errors.Is(err, port.ErrNotFound) {
+		t.Fatalf("expected ErrNotFound, got %v", err)
+	}
+}
+
+func TestTemplateRepository_Delete_notFound(t *testing.T) {
+	t.Parallel()
+
+	client, mock, _ := newMockPgClient(t)
+	repo := NewTemplateRepository(client)
+
+	mock.ExpectExec(`DELETE FROM templates WHERE id`).
+		WithArgs("tpl-missing").
+		WillReturnResult(sqlmock.NewResult(0, 0))
+
+	err := repo.Delete(context.Background(), "tpl-missing")
+	if err == nil || !errors.Is(err, port.ErrNotFound) {
+		t.Fatalf("expected ErrNotFound, got %v", err)
+	}
+}
diff --git a/internal/infrastructure/repository/postgres/workspace_member_repository.go b/internal/infrastructure/repository/postgres/workspace_member_repository.go
index 326a7746..b08b604f 100644
--- a/internal/infrastructure/repository/postgres/workspace_member_repository.go
+++ b/internal/infrastructure/repository/postgres/workspace_member_repository.go
@@ -22,12 +22,9 @@ func NewWorkspaceMemberRepository(client *pgsql.PgClient) port.WorkspaceMemberRe
 }
 
 func (r *WorkspaceMemberRepository) Add(ctx context.Context, workspaceID, userID, role string) error {
-	// Look up role ID from the roles table by name
-	var roleID string
-	err := r.client.GetDB(ctx).QueryRowContext(ctx, `SELECT id FROM roles WHERE name = $1`, role).Scan(&roleID)
+	roleID, err := lookupRoleIDByName(ctx, r.client.GetDB(ctx), role)
 	if err != nil {
-		slog.ErrorContext(ctx, "database error: lookup role failed", "error", err, "role", role)
-		return fmt.Errorf("wpd-message-gateway: lookup role %q: %w", role, err)
+		return err
 	}
 
 	_, err = r.client.GetDB(ctx).ExecContext(ctx, `
@@ -76,7 +73,8 @@ func (r *WorkspaceMemberRepository) GetRole(ctx context.Context, workspaceID, us
 
 func (r *WorkspaceMemberRepository) ListMembers(ctx context.Context, workspaceID string) ([]domain.WorkspaceMember, error) {
 	rows, err := r.client.GetDB(ctx).QueryContext(ctx, `
-		SELECT wm.workspace_id, wm.user_id, r.name, wm.joined_at, u.email, COALESCE(u.display_name, '')
+		SELECT wm.workspace_id, wm.user_id, r.name, wm.joined_at, u.email,
+			COALESCE(NULLIF(TRIM(u.first_name || ' ' || u.last_name), ''), u.email)
 		FROM workspace_members wm
 		JOIN roles r ON r.id = wm.role_id
 		INNER JOIN users u ON u.id = wm.user_id
diff --git a/internal/infrastructure/repository/postgres/workspace_member_repository_test.go b/internal/infrastructure/repository/postgres/workspace_member_repository_test.go
new file mode 100644
index 00000000..8d473ea5
--- /dev/null
+++ b/internal/infrastructure/repository/postgres/workspace_member_repository_test.go
@@ -0,0 +1,72 @@
+package postgres
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"testing"
+	"time"
+
+	"github.com/DATA-DOG/go-sqlmock"
+
+	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
+	"github.com/weprodev/wpd-message-gateway/internal/core/port"
+)
+
+func TestWorkspaceMemberRepository_Add(t *testing.T) {
+	t.Parallel()
+
+	client, mock, _ := newMockPgClient(t)
+	repo := NewWorkspaceMemberRepository(client)
+
+	mock.ExpectQuery(`SELECT id FROM roles WHERE name`).
+		WithArgs("admin", domain.RBACGuardName).
+		WillReturnRows(sqlmock.NewRows([]string{"id"}).AddRow("role-admin-id"))
+	mock.ExpectExec(`INSERT INTO workspace_members`).
+		WithArgs("ws-1", "user-1", "role-admin-id").
+		WillReturnResult(sqlmock.NewResult(1, 1))
+
+	if err := repo.Add(context.Background(), "ws-1", "user-1", domain.RoleAdmin); err != nil {
+		t.Fatalf("Add: %v", err)
+	}
+}
+
+func TestWorkspaceMemberRepository_GetRole_notFound(t *testing.T) {
+	t.Parallel()
+
+	client, mock, _ := newMockPgClient(t)
+	repo := NewWorkspaceMemberRepository(client)
+
+	mock.ExpectQuery(`FROM workspace_members wm`).
+		WithArgs("ws-1", "user-missing").
+		WillReturnError(sql.ErrNoRows)
+
+	_, err := repo.GetRole(context.Background(), "ws-1", "user-missing")
+	if err == nil || !errors.Is(err, port.ErrNotFound) {
+		t.Fatalf("expected ErrNotFound, got %v", err)
+	}
+}
+
+func TestWorkspaceMemberRepository_ListMembers(t *testing.T) {
+	t.Parallel()
+
+	client, mock, _ := newMockPgClient(t)
+	repo := NewWorkspaceMemberRepository(client)
+	joinedAt := time.Date(2026, 7, 4, 12, 0, 0, 0, time.UTC)
+
+	rows := sqlmock.NewRows([]string{
+		"workspace_id", "user_id", "name", "joined_at", "email", "display_name",
+	}).AddRow("ws-1", "user-1", "admin", joinedAt, "owner@example.com", "Owner User")
+
+	mock.ExpectQuery(`FROM workspace_members wm`).
+		WithArgs("ws-1").
+		WillReturnRows(rows)
+
+	members, err := repo.ListMembers(context.Background(), "ws-1")
+	if err != nil {
+		t.Fatalf("ListMembers: %v", err)
+	}
+	if len(members) != 1 || members[0].Role != domain.RoleAdmin || members[0].DisplayName != "Owner User" {
+		t.Fatalf("unexpected members: %+v", members)
+	}
+}
diff --git a/internal/infrastructure/repository/postgres/workspace_repository.go b/internal/infrastructure/repository/postgres/workspace_repository.go
index c91a7d68..795dc75b 100644
--- a/internal/infrastructure/repository/postgres/workspace_repository.go
+++ b/internal/infrastructure/repository/postgres/workspace_repository.go
@@ -40,10 +40,10 @@ func scanWorkspace(scanner interface {
 	return w, nil
 }
 
-func (r *WorkspaceRepository) Create(ctx context.Context, workspace *domain.Workspace) error {
+func (r *WorkspaceRepository) Create(ctx context.Context, workspace *domain.Workspace, ownerID string) error {
 	query := `
 		INSERT INTO workspaces (name, slug, owner_id, status, is_private, hashed_pin_code, icon_key)
-		VALUES ($1, $2, (SELECT id FROM users WHERE email = $3), $4, $5 = 'private', $6, $7)
+		VALUES ($1, $2, $3, $4, $5 = 'private', $6, $7)
 		RETURNING id, created_at, updated_at
 	`
 	var hashedPin, icon interface{}
@@ -54,10 +54,19 @@ func (r *WorkspaceRepository) Create(ctx context.Context, workspace *domain.Work
 		icon = workspace.IconKey
 	}
 	err := r.client.GetDB(ctx).QueryRowContext(ctx, query,
-		workspace.Name, workspace.Slug, workspace.AdminEmail, workspace.Status, workspace.Visibility, hashedPin, icon,
+		workspace.Name, workspace.Slug, ownerID, workspace.Status, workspace.Visibility, hashedPin, icon,
 	).Scan(&workspace.ID, &workspace.CreatedAt, &workspace.UpdatedAt)
 	if err != nil {
 		slog.ErrorContext(ctx, "database error: failed to create workspace", "error", err, "name", workspace.Name, "slug", workspace.Slug)
+		return mapDBError(err)
+	}
+	return nil
+}
+
+func (r *WorkspaceRepository) Delete(ctx context.Context, id string) error {
+	_, err := r.client.GetDB(ctx).ExecContext(ctx, `DELETE FROM workspaces WHERE id = $1`, id)
+	if err != nil {
+		slog.ErrorContext(ctx, "database error: failed to delete workspace", "error", err, "id", id)
 	}
 	return err
 }
@@ -138,13 +147,15 @@ func (r *WorkspaceRepository) SetStatus(ctx context.Context, id, status string)
 
 func (r *WorkspaceRepository) ListForUser(ctx context.Context, userID string) ([]domain.Workspace, error) {
 	query := `
-		SELECT DISTINCT w.id, w.name, w.slug, u.email, w.status,
+		SELECT w.id, w.name, w.slug, u.email, w.status,
 		       CASE WHEN w.is_private THEN 'private' ELSE 'public' END,
-		       w.hashed_pin_code, w.icon_key, w.created_at, w.updated_at
+		       w.hashed_pin_code, w.icon_key, w.created_at, w.updated_at,
+		       COALESCE(r.name, '')
 		FROM workspaces w
 		INNER JOIN users u ON u.id = w.owner_id
-		LEFT JOIN workspace_members wm ON wm.workspace_id = w.id
-		WHERE (wm.user_id = $1 OR w.is_private = false) AND w.status = 'active'
+		LEFT JOIN workspace_members wm ON wm.workspace_id = w.id AND wm.user_id = $1
+		LEFT JOIN roles r ON r.id = wm.role_id
+		WHERE (wm.user_id IS NOT NULL OR w.is_private = false) AND w.status = 'active'
 		ORDER BY w.name ASC
 	`
 	rows, err := r.client.GetDB(ctx).QueryContext(ctx, query, userID)
@@ -156,7 +167,7 @@ func (r *WorkspaceRepository) ListForUser(ctx context.Context, userID string) ([
 
 	out := []domain.Workspace{}
 	for rows.Next() {
-		w, err := scanWorkspace(rows)
+		w, err := scanWorkspaceWithRole(rows)
 		if err != nil {
 			slog.ErrorContext(ctx, "database error: failed to scan workspace in list", "error", err, "user_id", userID)
 			return nil, err
@@ -169,3 +180,26 @@ func (r *WorkspaceRepository) ListForUser(ctx context.Context, userID string) ([
 	}
 	return out, nil
 }
+
+func scanWorkspaceWithRole(scanner interface {
+	Scan(dest ...any) error
+}) (domain.Workspace, error) {
+	var w domain.Workspace
+	var hashedPin, iconKey sql.NullString
+	var role sql.NullString
+	err := scanner.Scan(&w.ID, &w.Name, &w.Slug, &w.AdminEmail, &w.Status, &w.Visibility,
+		&hashedPin, &iconKey, &w.CreatedAt, &w.UpdatedAt, &role)
+	if err != nil {
+		return w, err
+	}
+	if hashedPin.Valid {
+		w.HashedPin = hashedPin.String
+	}
+	if iconKey.Valid {
+		w.IconKey = iconKey.String
+	}
+	if role.Valid {
+		w.Role = role.String
+	}
+	return w, nil
+}
diff --git a/internal/infrastructure/repository/postgres/workspace_repository_test.go b/internal/infrastructure/repository/postgres/workspace_repository_test.go
new file mode 100644
index 00000000..3f355a1c
--- /dev/null
+++ b/internal/infrastructure/repository/postgres/workspace_repository_test.go
@@ -0,0 +1,67 @@
+package postgres
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"testing"
+	"time"
+
+	"github.com/DATA-DOG/go-sqlmock"
+
+	"github.com/weprodev/wpd-message-gateway/internal/core/port"
+)
+
+func TestWorkspaceRepository_GetByID(t *testing.T) {
+	t.Parallel()
+
+	client, mock, _ := newMockPgClient(t)
+	repo := NewWorkspaceRepository(client)
+	now := time.Date(2026, 7, 4, 12, 0, 0, 0, time.UTC)
+
+	mock.ExpectQuery(`FROM workspaces w`).
+		WithArgs("ws-1").
+		WillReturnRows(sqlmock.NewRows([]string{
+			"id", "name", "slug", "email", "status", "visibility", "hashed_pin_code", "icon_key", "created_at", "updated_at",
+		}).AddRow("ws-1", "Demo", "demo", "owner@example.com", "active", "public", nil, nil, now, now))
+
+	ws, err := repo.GetByID(context.Background(), "ws-1")
+	if err != nil {
+		t.Fatalf("GetByID: %v", err)
+	}
+	if ws.Name != "Demo" || ws.Slug != "demo" || ws.AdminEmail != "owner@example.com" {
+		t.Fatalf("unexpected workspace: %+v", ws)
+	}
+}
+
+func TestWorkspaceRepository_GetByID_notFound(t *testing.T) {
+	t.Parallel()
+
+	client, mock, _ := newMockPgClient(t)
+	repo := NewWorkspaceRepository(client)
+
+	mock.ExpectQuery(`FROM workspaces w`).
+		WithArgs("missing").
+		WillReturnError(sql.ErrNoRows)
+
+	_, err := repo.GetByID(context.Background(), "missing")
+	if err == nil || !errors.Is(err, port.ErrNotFound) {
+		t.Fatalf("expected ErrNotFound, got %v", err)
+	}
+}
+
+func TestWorkspaceRepository_GetBySlug_notFound(t *testing.T) {
+	t.Parallel()
+
+	client, mock, _ := newMockPgClient(t)
+	repo := NewWorkspaceRepository(client)
+
+	mock.ExpectQuery(`FROM workspaces w`).
+		WithArgs("missing-slug").
+		WillReturnError(sql.ErrNoRows)
+
+	_, err := repo.GetBySlug(context.Background(), "missing-slug")
+	if err == nil || !errors.Is(err, port.ErrNotFound) {
+		t.Fatalf("expected ErrNotFound, got %v", err)
+	}
+}
diff --git a/internal/presentation/dto/api_key.go b/internal/presentation/dto/api_key.go
new file mode 100644
index 00000000..18afa401
--- /dev/null
+++ b/internal/presentation/dto/api_key.go
@@ -0,0 +1,62 @@
+package dto
+
+import (
+	"time"
+
+	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
+)
+
+// APIKeyPublic is the portal-safe API key representation (no secret hash).
+type APIKeyPublic struct {
+	ID          string     `json:"id"`
+	WorkspaceID string     `json:"workspace_id"`
+	ClientID    string     `json:"client_id"`
+	Name        string     `json:"name"`
+	IsActive    bool       `json:"is_active"`
+	LastUsedAt  *time.Time `json:"last_used_at,omitempty"`
+	CreatedAt   time.Time  `json:"created_at"`
+	ExpiresAt   *time.Time `json:"expires_at,omitempty"`
+}
+
+// APIKeyPublicFromDomain maps a domain API key to its portal response shape.
+func APIKeyPublicFromDomain(k domain.APIKey) APIKeyPublic {
+	return APIKeyPublic{
+		ID:          k.ID,
+		WorkspaceID: k.WorkspaceID,
+		ClientID:    k.ClientID,
+		Name:        k.Name,
+		IsActive:    k.IsActive,
+		LastUsedAt:  k.LastUsedAt,
+		CreatedAt:   k.CreatedAt,
+		ExpiresAt:   k.ExpiresAt,
+	}
+}
+
+// CreateAPIKeyRequest is the JSON body for POST /api/v1/workspaces/:wid/api-keys.
+type CreateAPIKeyRequest struct {
+	Name string `json:"name"`
+}
+
+// CreateAPIKeyResponse is returned once when a new API key secret is issued.
+type CreateAPIKeyResponse struct {
+	APIKeyPublic
+	ClientSecret string `json:"client_secret"`
+}
+
+// CreateAPIKeyResponseFromDomain maps a newly created domain API key and one-time secret.
+func CreateAPIKeyResponseFromDomain(k domain.APIKey, secret string) CreateAPIKeyResponse {
+	return CreateAPIKeyResponse{
+		APIKeyPublic: APIKeyPublicFromDomain(k),
+		ClientSecret: secret,
+	}
+}
+
+// RegenerateAPIKeyResponse is returned when an API key secret is re-issued.
+type RegenerateAPIKeyResponse struct {
+	ClientSecret string `json:"client_secret"`
+}
+
+// RegenerateAPIKeyResponseFromDomain maps a re-issued secret to the portal response.
+func RegenerateAPIKeyResponseFromDomain(secret string) RegenerateAPIKeyResponse {
+	return RegenerateAPIKeyResponse{ClientSecret: secret}
+}
diff --git a/internal/presentation/dto/auth.go b/internal/presentation/dto/auth.go
new file mode 100644
index 00000000..294e00ec
--- /dev/null
+++ b/internal/presentation/dto/auth.go
@@ -0,0 +1,119 @@
+package dto
+
+import (
+	"time"
+
+	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
+)
+
+// RegisterRequest is the JSON body for POST /api/v1/auth/register.
+type RegisterRequest struct {
+	FirstName string `json:"first_name"`
+	LastName  string `json:"last_name"`
+	Email     string `json:"email"`
+	Password  string `json:"password"`
+}
+
+// LoginRequest is the JSON body for POST /api/v1/auth/login.
+type LoginRequest struct {
+	Email    string `json:"email"`
+	Password string `json:"password"`
+}
+
+// User is the portal-safe account shape (no password hash).
+type User struct {
+	ID            string    `json:"id"`
+	FirstName     string    `json:"first_name"`
+	LastName      string    `json:"last_name"`
+	Email         string    `json:"email"`
+	EmailVerified bool      `json:"email_verified"`
+	CreatedAt     time.Time `json:"created_at"`
+	UpdatedAt     time.Time `json:"updated_at"`
+}
+
+// UserFromDomain maps a domain user to the portal response shape.
+func UserFromDomain(u *domain.User) User {
+	if u == nil {
+		return User{}
+	}
+	return User{
+		ID:            u.ID.String(),
+		FirstName:     u.FirstName,
+		LastName:      u.LastName,
+		Email:         u.Email,
+		EmailVerified: u.EmailVerified,
+		CreatedAt:     u.CreatedAt,
+		UpdatedAt:     u.UpdatedAt,
+	}
+}
+
+// UserWorkspace is a workspace as returned on login and /auth/me (no PIN hash).
+type UserWorkspace struct {
+	ID          string    `json:"id"`
+	Name        string    `json:"name"`
+	Slug        string    `json:"slug"`
+	AdminEmail  string    `json:"admin_email"`
+	Status      string    `json:"status"`
+	Visibility  string    `json:"visibility"`
+	IconKey     string    `json:"icon_key,omitempty"`
+	CreatedAt   time.Time `json:"created_at"`
+	UpdatedAt   time.Time `json:"updated_at"`
+	Role        string    `json:"role,omitempty"`
+	Permissions []string  `json:"permissions,omitempty"`
+}
+
+// UserWorkspaceFromDomain maps a domain workspace (with access metadata) to the portal shape.
+func UserWorkspaceFromDomain(w domain.Workspace) UserWorkspace {
+	return UserWorkspace{
+		ID:          w.ID,
+		Name:        w.Name,
+		Slug:        w.Slug,
+		AdminEmail:  w.AdminEmail,
+		Status:      w.Status,
+		Visibility:  w.Visibility,
+		IconKey:     w.IconKey,
+		CreatedAt:   w.CreatedAt,
+		UpdatedAt:   w.UpdatedAt,
+		Role:        w.Role,
+		Permissions: w.Permissions,
+	}
+}
+
+func userWorkspacesFromDomain(workspaces []domain.Workspace) []UserWorkspace {
+	out := make([]UserWorkspace, 0, len(workspaces))
+	for _, w := range workspaces {
+		out = append(out, UserWorkspaceFromDomain(w))
+	}
+	return out
+}
+
+// LoginResponse is returned after successful authentication.
+type LoginResponse struct {
+	Token      string          `json:"token"`
+	User       User            `json:"user"`
+	Workspaces []UserWorkspace `json:"workspaces"`
+}
+
+// LoginResponseFromDomain maps auth results to the login response.
+func LoginResponseFromDomain(token string, user *domain.User, workspaces []domain.Workspace) LoginResponse {
+	return LoginResponse{
+		Token:      token,
+		User:       UserFromDomain(user),
+		Workspaces: userWorkspacesFromDomain(workspaces),
+	}
+}
+
+// UserProfileResponse is returned by GET /api/v1/auth/me.
+// User fields are embedded so JSON matches the flat portal contract (id, first_name, …, workspaces).
+type UserProfileResponse struct {
+	User
+	Workspaces []UserWorkspace `json:"workspaces"`
+}
+
+// UserProfileResponseFromDomain maps the current user and workspaces to the profile response.
+func UserProfileResponseFromDomain(user *domain.User, workspaces []domain.Workspace) UserProfileResponse {
+	return UserProfileResponse{
+		User:       UserFromDomain(user),
+		Workspaces: userWorkspacesFromDomain(workspaces),
+	}
+}
diff --git a/internal/presentation/dto/auth_test.go b/internal/presentation/dto/auth_test.go
new file mode 100644
index 00000000..cfef4c4f
--- /dev/null
+++ b/internal/presentation/dto/auth_test.go
@@ -0,0 +1,54 @@
+package dto
+
+import (
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+
+	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
+)
+
+func TestUserFromDomain(t *testing.T) {
+	t.Parallel()
+
+	uid := uuid.MustParse("11111111-1111-1111-1111-111111111111")
+	now := time.Date(2026, 7, 4, 10, 0, 0, 0, time.UTC)
+	got := UserFromDomain(&domain.User{
+		ID:            uid,
+		FirstName:     "Ada",
+		LastName:      "Lovelace",
+		Email:         "ada@example.com",
+		PasswordHash:  "must-not-leak",
+		EmailVerified: true,
+		CreatedAt:     now,
+		UpdatedAt:     now,
+	})
+
+	if got.ID != uid.String() || got.Email != "ada@example.com" {
+		t.Fatalf("unexpected user mapping: %+v", got)
+	}
+}
+
+func TestUserProfileResponseFromDomain(t *testing.T) {
+	t.Parallel()
+
+	uid := uuid.MustParse("11111111-1111-1111-1111-111111111111")
+	resp := UserProfileResponseFromDomain(&domain.User{
+		ID:        uid,
+		FirstName: "Ada",
+		Email:     "ada@example.com",
+	}, []domain.Workspace{{
+		ID:   "ws-1",
+		Name: "Demo",
+		Slug: "demo",
+		Role: "owner",
+	}})
+
+	if resp.ID != uid.String() || resp.FirstName != "Ada" {
+		t.Fatalf("embedded user fields not promoted: %+v", resp)
+	}
+	if len(resp.Workspaces) != 1 || resp.Workspaces[0].Role != "owner" {
+		t.Fatalf("unexpected workspaces: %+v", resp.Workspaces)
+	}
+}
diff --git a/internal/presentation/dto/integration.go b/internal/presentation/dto/integration.go
new file mode 100644
index 00000000..0eb8201d
--- /dev/null
+++ b/internal/presentation/dto/integration.go
@@ -0,0 +1,77 @@
+package dto
+
+import (
+	"encoding/json"
+	"fmt"
+	"time"
+
+	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
+)
+
+// UpsertIntegrationRequest is the JSON body for PUT /api/v1/workspaces/:wid/integrations.
+type UpsertIntegrationRequest struct {
+	ChannelType  string          `json:"channel_type"`
+	ProviderName string          `json:"provider_name"`
+	Config       json.RawMessage `json:"config"`
+	Status       string          `json:"status"`
+	IsDefault    bool            `json:"is_default"`
+}
+
+// ToDomain maps the request to a domain integration for upsert (passed to service → repository).
+func (r UpsertIntegrationRequest) ToDomain(workspaceID string) (*domain.Integration, error) {
+	cfg, err := normalizeIntegrationConfig(r.Config)
+	if err != nil {
+		return nil, fmt.Errorf("integration config: %w", err)
+	}
+	status := r.Status
+	if status == "" {
+		status = domain.IntegrationStatusConnected
+	}
+	return &domain.Integration{
+		WorkspaceID:  workspaceID,
+		ChannelType:  r.ChannelType,
+		ProviderName: r.ProviderName,
+		Config:       cfg,
+		Status:       status,
+		IsDefault:    r.IsDefault,
+	}, nil
+}
+
+// Integration is the portal response shape for workspace integrations.
+type Integration struct {
+	ID           string          `json:"id"`
+	WorkspaceID  string          `json:"workspace_id"`
+	ChannelType  string          `json:"channel_type"`
+	ProviderName string          `json:"provider_name"`
+	Config       json.RawMessage `json:"config"`
+	Status       string          `json:"status"`
+	IsDefault    bool            `json:"is_default"`
+	CreatedAt    time.Time       `json:"created_at"`
+	UpdatedAt    time.Time       `json:"updated_at"`
+}
+
+// IntegrationFromDomain maps a domain integration to its portal response shape.
+func IntegrationFromDomain(intg domain.Integration) Integration {
+	return Integration{
+		ID:           intg.ID,
+		WorkspaceID:  intg.WorkspaceID,
+		ChannelType:  intg.ChannelType,
+		ProviderName: intg.ProviderName,
+		Config:       json.RawMessage(intg.Config),
+		Status:       intg.Status,
+		IsDefault:    intg.IsDefault,
+		CreatedAt:    intg.CreatedAt,
+		UpdatedAt:    intg.UpdatedAt,
+	}
+}
+
+func normalizeIntegrationConfig(b []byte) ([]byte, error) {
+	if len(b) == 0 {
+		return []byte("{}"), nil
+	}
+	var v any
+	if err := json.Unmarshal(b, &v); err != nil {
+		return nil, err
+	}
+	return json.Marshal(v)
+}
diff --git a/internal/presentation/dto/integration_test.go b/internal/presentation/dto/integration_test.go
new file mode 100644
index 00000000..7be0c4b2
--- /dev/null
+++ b/internal/presentation/dto/integration_test.go
@@ -0,0 +1,60 @@
+package dto
+
+import (
+	"encoding/json"
+	"testing"
+	"time"
+
+	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
+)
+
+func TestIntegrationFromDomain(t *testing.T) {
+	now := time.Now().UTC().Truncate(time.Second)
+	intg := domain.Integration{
+		ID:           "intg-1",
+		WorkspaceID:  "ws-1",
+		ChannelType:  "email",
+		ProviderName: "mailgun",
+		Config:       []byte(`{"api_key":"secret"}`),
+		Status:       domain.IntegrationStatusConnected,
+		IsDefault:    true,
+		CreatedAt:    now,
+		UpdatedAt:    now,
+	}
+
+	got := IntegrationFromDomain(intg)
+	if got.ID != intg.ID || got.WorkspaceID != intg.WorkspaceID {
+		t.Fatalf("unexpected ids: %+v", got)
+	}
+	if string(got.Config) != string(intg.Config) {
+		t.Fatalf("config = %s, want %s", got.Config, intg.Config)
+	}
+
+	var cfg map[string]string
+	if err := json.Unmarshal(got.Config, &cfg); err != nil {
+		t.Fatalf("config not valid JSON: %v", err)
+	}
+	if cfg["api_key"] != "secret" {
+		t.Errorf("api_key = %q, want secret", cfg["api_key"])
+	}
+}
+
+func TestUpsertIntegrationRequestToDomain(t *testing.T) {
+	req := UpsertIntegrationRequest{
+		ChannelType:  "email",
+		ProviderName: "mailgun",
+		Config:       json.RawMessage(`{"api_key":"secret"}`),
+		IsDefault:    true,
+	}
+
+	got, err := req.ToDomain("ws-1")
+	if err != nil {
+		t.Fatalf("ToDomain() error = %v", err)
+	}
+	if got.WorkspaceID != "ws-1" || got.ProviderName != "mailgun" {
+		t.Fatalf("unexpected domain mapping: %+v", got)
+	}
+	if got.Status != domain.IntegrationStatusConnected {
+		t.Errorf("status = %q, want connected", got.Status)
+	}
+}
diff --git a/internal/presentation/dto/message_request_log.go b/internal/presentation/dto/message_request_log.go
new file mode 100644
index 00000000..64125ebb
--- /dev/null
+++ b/internal/presentation/dto/message_request_log.go
@@ -0,0 +1,62 @@
+package dto
+
+import (
+	"time"
+
+	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
+)
+
+// MessageRequestLog is the portal list shape for gateway request logs.
+type MessageRequestLog struct {
+	ID             string    `json:"id"`
+	WorkspaceID    string    `json:"workspace_id"`
+	APIKeyID       string    `json:"api_key_id,omitempty"`
+	ChannelType    string    `json:"channel_type"`
+	HTTPMethod     string    `json:"http_method"`
+	StatusCode     int       `json:"status_code"`
+	Endpoint       string    `json:"endpoint"`
+	ProviderName   string    `json:"provider_name,omitempty"`
+	RequestID      string    `json:"request_id,omitempty"`
+	DurationMs     int       `json:"duration_ms,omitempty"`
+	ErrorMessage   string    `json:"error_message,omitempty"`
+	InboxMessageID string    `json:"inbox_message_id,omitempty"`
+	CreatedAt      time.Time `json:"created_at"`
+	SourceName     string    `json:"source_name"`
+	ClientID       string    `json:"client_id,omitempty"`
+}
+
+// MessageRequestLogFromDomain maps a domain log row (with API key source metadata) to the portal DTO.
+func MessageRequestLogFromDomain(l domain.MessageRequestLogWithSource) MessageRequestLog {
+	return MessageRequestLog{
+		ID:             l.ID,
+		WorkspaceID:    l.WorkspaceID,
+		APIKeyID:       l.APIKeyID,
+		ChannelType:    l.ChannelType,
+		HTTPMethod:     l.HTTPMethod,
+		StatusCode:     l.StatusCode,
+		Endpoint:       l.Endpoint,
+		ProviderName:   l.ProviderName,
+		RequestID:      l.RequestID,
+		DurationMs:     l.DurationMs,
+		ErrorMessage:   l.ErrorMessage,
+		InboxMessageID: l.InboxMessageID,
+		CreatedAt:      l.CreatedAt,
+		SourceName:     l.SourceName,
+		ClientID:       l.ClientID,
+	}
+}
+
+// MessageRequestLogList is the paginated logs API response.
+type MessageRequestLogList struct {
+	Items []MessageRequestLog `json:"items"`
+	Total int                 `json:"total"`
+}
+
+// MessageRequestLogListFromDomain maps domain log rows and total count to the paginated response.
+func MessageRequestLogListFromDomain(rows []domain.MessageRequestLogWithSource, total int) MessageRequestLogList {
+	items := make([]MessageRequestLog, 0, len(rows))
+	for _, r := range rows {
+		items = append(items, MessageRequestLogFromDomain(r))
+	}
+	return MessageRequestLogList{Items: items, Total: total}
+}
diff --git a/internal/presentation/dto/message_request_log_test.go b/internal/presentation/dto/message_request_log_test.go
new file mode 100644
index 00000000..717977b4
--- /dev/null
+++ b/internal/presentation/dto/message_request_log_test.go
@@ -0,0 +1,39 @@
+package dto
+
+import (
+	"testing"
+	"time"
+
+	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
+)
+
+func TestMessageRequestLogFromDomain(t *testing.T) {
+	t.Parallel()
+
+	createdAt := time.Date(2026, 7, 4, 10, 0, 0, 0, time.UTC)
+	row := domain.MessageRequestLogWithSource{
+		MessageRequestLog: domain.MessageRequestLog{
+			ID:             "log-1",
+			WorkspaceID:    "ws-1",
+			ChannelType:    "email",
+			HTTPMethod:     "POST",
+			StatusCode:     200,
+			Endpoint:       "/v1/email",
+			ProviderName:   "memory",
+			InboxMessageID: "inbox-1",
+			CreatedAt:      createdAt,
+		},
+		SourceName: "Demo Key",
+		ClientID:   "demo-client",
+	}
+
+	got := MessageRequestLogFromDomain(row)
+	if got.ID != "log-1" || got.InboxMessageID != "inbox-1" || got.SourceName != "Demo Key" {
+		t.Fatalf("unexpected mapping: %+v", got)
+	}
+
+	list := MessageRequestLogListFromDomain([]domain.MessageRequestLogWithSource{row}, 1)
+	if len(list.Items) != 1 || list.Total != 1 {
+		t.Fatalf("unexpected list mapping: %+v", list)
+	}
+}
diff --git a/internal/presentation/dto/settings.go b/internal/presentation/dto/settings.go
new file mode 100644
index 00000000..985138c9
--- /dev/null
+++ b/internal/presentation/dto/settings.go
@@ -0,0 +1,4 @@
+package dto
+
+// PatchSettingsRequest is the JSON body for PATCH /api/v1/workspaces/:wid/settings.
+type PatchSettingsRequest map[string]string
diff --git a/internal/presentation/dto/template.go b/internal/presentation/dto/template.go
new file mode 100644
index 00000000..962a2ad8
--- /dev/null
+++ b/internal/presentation/dto/template.go
@@ -0,0 +1,76 @@
+package dto
+
+import (
+	"github.com/weprodev/go-pkg/sanitizer"
+
+	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
+	"github.com/weprodev/wpd-message-gateway/internal/core/service"
+)
+
+// CreateTemplateRequest is the JSON body for POST /api/v1/workspaces/:wid/templates.
+type CreateTemplateRequest struct {
+	Name        string `json:"name"`
+	UniqueKey   string `json:"unique_key"`
+	ChannelType string `json:"channel_type"`
+	Category    string `json:"category"`
+	Subject     string `json:"subject"`
+	ContentHTML string `json:"content_html"`
+	IsActive    *bool  `json:"is_active"`
+	IsDefault   *bool  `json:"is_default"`
+}
+
+// ToDomain maps the request to a domain template ready for create.
+func (r CreateTemplateRequest) ToDomain(workspaceID string) *domain.Template {
+	t := &domain.Template{
+		WorkspaceID: workspaceID,
+		Name:        r.Name,
+		UniqueKey:   r.UniqueKey,
+		ChannelType: r.ChannelType,
+		Category:    r.Category,
+		Subject:     r.Subject,
+		ContentHTML: sanitizer.SanitizeHTML(r.ContentHTML),
+		IsActive:    true,
+		IsDefault:   false,
+	}
+	if r.IsActive != nil {
+		t.IsActive = *r.IsActive
+	}
+	if r.IsDefault != nil {
+		t.IsDefault = *r.IsDefault
+	}
+	if t.ChannelType == "" {
+		t.ChannelType = "email"
+	}
+	return t
+}
+
+// PatchTemplateRequest is the JSON body for PATCH /api/v1/workspaces/:wid/templates/:tid.
+type PatchTemplateRequest struct {
+	Name        *string `json:"name"`
+	UniqueKey   *string `json:"unique_key"`
+	ChannelType *string `json:"channel_type"`
+	Category    *string `json:"category"`
+	Subject     *string `json:"subject"`
+	ContentHTML *string `json:"content_html"`
+	IsActive    *bool   `json:"is_active"`
+	IsDefault   *bool   `json:"is_default"`
+}
+
+// ToPatch maps the request to the service patch command (service loads domain, applies, saves via repository).
+func (r PatchTemplateRequest) ToPatch() service.TemplatePatch {
+	patch := service.TemplatePatch{
+		Name:        r.Name,
+		UniqueKey:   r.UniqueKey,
+		ChannelType: r.ChannelType,
+		Category:    r.Category,
+		Subject:     r.Subject,
+		ContentHTML: r.ContentHTML,
+		IsActive:    r.IsActive,
+		IsDefault:   r.IsDefault,
+	}
+	if r.ContentHTML != nil {
+		clean := sanitizer.SanitizeHTML(*r.ContentHTML)
+		patch.ContentHTML = &clean
+	}
+	return patch
+}
diff --git a/internal/presentation/dto/workspace.go b/internal/presentation/dto/workspace.go
new file mode 100644
index 00000000..28c365b9
--- /dev/null
+++ b/internal/presentation/dto/workspace.go
@@ -0,0 +1,63 @@
+package dto
+
+import (
+	"time"
+
+	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
+	"github.com/weprodev/wpd-message-gateway/internal/core/service"
+)
+
+// CreateWorkspaceRequest is the JSON body for POST /api/v1/workspaces.
+type CreateWorkspaceRequest struct {
+	Name    string `json:"name"`
+	Slug    string `json:"slug"`
+	IconKey string `json:"icon_key"`
+}
+
+// JoinWorkspaceRequest is the JSON body for POST /api/v1/workspaces/join.
+type JoinWorkspaceRequest struct {
+	Slug string `json:"slug"`
+	PIN  string `json:"pin"`
+}
+
+// PatchWorkspaceRequest is the JSON body for PATCH /api/v1/workspaces/:wid.
+type PatchWorkspaceRequest struct {
+	Name       *string `json:"name"`
+	Visibility *string `json:"visibility"`
+	IconKey    *string `json:"icon_key"`
+}
+
+// ToPatch maps the request to the service patch command (service loads domain, applies, saves via repository).
+func (r PatchWorkspaceRequest) ToPatch() service.WorkspacePatch {
+	return service.WorkspacePatch{
+		Name:       r.Name,
+		Visibility: r.Visibility,
+		IconKey:    r.IconKey,
+	}
+}
+
+// CreateInvitationRequest is the JSON body for POST /api/v1/workspaces/:wid/invitations.
+type CreateInvitationRequest struct {
+	Email string `json:"email"`
+	Role  string `json:"role"`
+}
+
+// CreateInvitationResponse is returned once when an invitation is created.
+type CreateInvitationResponse struct {
+	ID        string    `json:"id"`
+	Email     string    `json:"email"`
+	Role      string    `json:"role"`
+	ExpiresAt time.Time `json:"expires_at"`
+	Token     string    `json:"token"`
+}
+
+// CreateInvitationResponseFromDomain maps a persisted invitation and one-time token.
+func CreateInvitationResponseFromDomain(inv domain.Invitation, token string) CreateInvitationResponse {
+	return CreateInvitationResponse{
+		ID:        inv.ID,
+		Email:     inv.Email,
+		Role:      inv.Role,
+		ExpiresAt: inv.ExpiresAt,
+		Token:     token,
+	}
+}
diff --git a/internal/presentation/handler/portal_auth_handler.go b/internal/presentation/handler/portal_auth_handler.go
index 56159877..dc3b8cd5 100644
--- a/internal/presentation/handler/portal_auth_handler.go
+++ b/internal/presentation/handler/portal_auth_handler.go
@@ -10,6 +10,7 @@ import (
 	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
 	"github.com/weprodev/wpd-message-gateway/internal/core/port"
 	"github.com/weprodev/wpd-message-gateway/internal/core/service"
+	"github.com/weprodev/wpd-message-gateway/internal/presentation/dto"
 	customMiddleware "github.com/weprodev/wpd-message-gateway/internal/presentation/middleware"
 )
 
@@ -22,31 +23,8 @@ func NewPortalAuthHandler(svc *service.PortalService, authSvc *service.AuthServi
 	return &PortalAuthHandler{svc: svc, authSvc: authSvc}
 }
 
-type registerBody struct {
-	FirstName string `json:"first_name"`
-	LastName  string `json:"last_name"`
-	Email     string `json:"email"`
-	Password  string `json:"password"`
-}
-
-type loginBody struct {
-	Email    string `json:"email"`
-	Password string `json:"password"`
-}
-
-type tokenResponse struct {
-	Token      string             `json:"token"`
-	User       *domain.User       `json:"user"`
-	Workspaces []domain.Workspace `json:"workspaces"`
-}
-
-type userProfileResponse struct {
-	*domain.User
-	Workspaces []domain.Workspace `json:"workspaces"`
-}
-
 func (h *PortalAuthHandler) Register(c echo.Context) error {
-	var body registerBody
+	var body dto.RegisterRequest
 	if err := c.Bind(&body); err != nil {
 		slog.ErrorContext(c.Request().Context(), "failed to bind register body", "error", err)
 		return echo.NewHTTPError(http.StatusBadRequest, "invalid JSON")
@@ -74,7 +52,7 @@ func (h *PortalAuthHandler) VerifyEmail(c echo.Context) error {
 }
 
 func (h *PortalAuthHandler) Login(c echo.Context) error {
-	var body loginBody
+	var body dto.LoginRequest
 	if err := c.Bind(&body); err != nil {
 		slog.ErrorContext(c.Request().Context(), "failed to bind login body", "error", err)
 		return echo.NewHTTPError(http.StatusBadRequest, "invalid JSON")
@@ -92,7 +70,7 @@ func (h *PortalAuthHandler) Login(c echo.Context) error {
 		workspaces = []domain.Workspace{}
 	}
 
-	return c.JSON(http.StatusOK, tokenResponse{Token: token, User: u, Workspaces: workspaces})
+	return c.JSON(http.StatusOK, dto.LoginResponseFromDomain(token, u, workspaces))
 }
 
 func (h *PortalAuthHandler) Me(c echo.Context) error {
@@ -112,5 +90,5 @@ func (h *PortalAuthHandler) Me(c echo.Context) error {
 		workspaces = []domain.Workspace{}
 	}
 
-	return c.JSON(http.StatusOK, userProfileResponse{User: u, Workspaces: workspaces})
+	return c.JSON(http.StatusOK, dto.UserProfileResponseFromDomain(u, workspaces))
 }
diff --git a/internal/presentation/handler/portal_auth_handler_test.go b/internal/presentation/handler/portal_auth_handler_test.go
new file mode 100644
index 00000000..5fc0ad06
--- /dev/null
+++ b/internal/presentation/handler/portal_auth_handler_test.go
@@ -0,0 +1,94 @@
+package handler
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/labstack/echo/v4"
+
+	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
+	"github.com/weprodev/wpd-message-gateway/internal/core/port"
+	"github.com/weprodev/wpd-message-gateway/internal/core/service"
+	"github.com/weprodev/wpd-message-gateway/pkg/contracts"
+)
+
+const handlerTestJWTSecret = "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+
+type authFakeUserRepo struct {
+	byEmail *domain.User
+	err     error
+}
+
+func (f *authFakeUserRepo) Create(context.Context, *domain.User) error { return nil }
+
+func (f *authFakeUserRepo) GetByEmail(_ context.Context, email string) (*domain.User, error) {
+	return f.byEmail, f.err
+}
+
+func (f *authFakeUserRepo) GetByID(context.Context, string) (*domain.User, error) {
+	return nil, port.ErrNotFound
+}
+
+func (f *authFakeUserRepo) SetEmailVerified(context.Context, string) error { return nil }
+
+type authFakeEmailSender struct{}
+
+func (authFakeEmailSender) Send(context.Context, contracts.Email) (*contracts.SendResult, error) {
+	return &contracts.SendResult{ID: "test-id"}, nil
+}
+
+func (authFakeEmailSender) Name() string { return "fake" }
+
+func newPortalAuthHandlerForTest(userRepo *authFakeUserRepo) *PortalAuthHandler {
+	authSvc := service.NewAuthService(userRepo, authFakeEmailSender{}, handlerTestJWTSecret, false, time.Hour, time.Hour, "")
+	portalSvc := service.NewPortalService(service.PortalDeps{})
+	return NewPortalAuthHandler(portalSvc, authSvc)
+}
+
+func TestPortalAuthHandler_Register_rejectsInvalidJSON(t *testing.T) {
+	t.Parallel()
+	e := echo.New()
+	h := newPortalAuthHandlerForTest(&authFakeUserRepo{})
+
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/auth/register", strings.NewReader("{not-json"))
+	req.Header.Set(echo.HeaderContentType, echo.MIMEApplicationJSON)
+	rec := httptest.NewRecorder()
+	c := e.NewContext(req, rec)
+
+	err := h.Register(c)
+	if err == nil {
+		t.Fatal("expected error")
+	}
+	var httpErr *echo.HTTPError
+	if !errors.As(err, &httpErr) || httpErr.Code != http.StatusBadRequest {
+		t.Fatalf("expected 400 invalid JSON, got %v", err)
+	}
+}
+
+func TestPortalAuthHandler_Login_returns401OnBadCredentials(t *testing.T) {
+	t.Parallel()
+	e := echo.New()
+	repo := &authFakeUserRepo{err: fmt.Errorf("lookup: %w", port.ErrNotFound)}
+	h := newPortalAuthHandlerForTest(repo)
+
+	body := `{"email":"nobody@example.com","password":"wrong-password"}`
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/auth/login", strings.NewReader(body))
+	req.Header.Set(echo.HeaderContentType, echo.MIMEApplicationJSON)
+	rec := httptest.NewRecorder()
+	c := e.NewContext(req, rec)
+
+	err := h.Login(c)
+	if err == nil {
+		t.Fatal("expected error")
+	}
+	var httpErr *echo.HTTPError
+	if !errors.As(err, &httpErr) || httpErr.Code != http.StatusUnauthorized {
+		t.Fatalf("expected 401, got %v", err)
+	}
+}
diff --git a/internal/presentation/handler/portal_handler.go b/internal/presentation/handler/portal_handler.go
index a64dabf7..4b68f429 100644
--- a/internal/presentation/handler/portal_handler.go
+++ b/internal/presentation/handler/portal_handler.go
@@ -5,34 +5,21 @@ import (
 	"log/slog"
 	"net/http"
 	"strconv"
-	"time"
 
 	"github.com/labstack/echo/v4"
 
-	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
 	"github.com/weprodev/wpd-message-gateway/internal/core/port"
 	"github.com/weprodev/wpd-message-gateway/internal/core/service"
+	"github.com/weprodev/wpd-message-gateway/internal/presentation/dto"
 )
 
 // PortalHandler exposes REST endpoints for the web portal (JWT, not API keys).
 type PortalHandler struct {
-	svc     *service.PortalService
-	gateway *service.GatewayService
-	logs    port.MessageRequestLogRepository
-	helper  *SendHelper
+	svc *service.PortalService
 }
 
-func NewPortalHandler(
-	svc *service.PortalService,
-	gateway *service.GatewayService,
-	logs port.MessageRequestLogRepository,
-) *PortalHandler {
-	return &PortalHandler{
-		svc:     svc,
-		gateway: gateway,
-		logs:    logs,
-		helper:  NewSendHelper(gateway),
-	}
+func NewPortalHandler(svc *service.PortalService) *PortalHandler {
+	return &PortalHandler{svc: svc}
 }
 
 // safeHTTPError returns an HTTPError with a sanitised message.
@@ -54,28 +41,6 @@ func safeHTTPError(err error, fallbackStatus int, fallbackMessage string) *echo.
 	return echo.NewHTTPError(fallbackStatus, fallbackMessage)
 }
 
-type apiKeyPublic struct {
-	ID          string     `json:"id"`
-	WorkspaceID string     `json:"workspace_id"`
-	ClientID    string     `json:"client_id"`
-	Name        string     `json:"name"`
-	IsActive    bool       `json:"is_active"`
-	LastUsedAt  *time.Time `json:"last_used_at,omitempty"`
-	CreatedAt   time.Time  `json:"created_at"`
-	ExpiresAt   *time.Time `json:"expires_at,omitempty"`
-}
-
-type createAPIKeyBody struct {
-	Name string `json:"name"`
-}
-
-func toAPIKeyPublic(k domain.APIKey) apiKeyPublic {
-	return apiKeyPublic{
-		ID: k.ID, WorkspaceID: k.WorkspaceID, ClientID: k.ClientID, Name: k.Name,
-		IsActive: k.IsActive, LastUsedAt: k.LastUsedAt, CreatedAt: k.CreatedAt, ExpiresAt: k.ExpiresAt,
-	}
-}
-
 func (h *PortalHandler) ListAPIKeys(c echo.Context) error {
 	wid := c.Param("wid")
 	keys, err := h.svc.ListAPIKeys(c.Request().Context(), wid)
@@ -83,16 +48,16 @@ func (h *PortalHandler) ListAPIKeys(c echo.Context) error {
 		slog.ErrorContext(c.Request().Context(), "failed to list api keys", "error", err)
 		return safeHTTPError(err, http.StatusInternalServerError, "failed to list api keys")
 	}
-	out := make([]apiKeyPublic, 0, len(keys))
+	out := make([]dto.APIKeyPublic, 0, len(keys))
 	for _, k := range keys {
-		out = append(out, toAPIKeyPublic(k))
+		out = append(out, dto.APIKeyPublicFromDomain(k))
 	}
 	return c.JSON(http.StatusOK, out)
 }
 
 func (h *PortalHandler) CreateAPIKey(c echo.Context) error {
 	wid := c.Param("wid")
-	var body createAPIKeyBody
+	var body dto.CreateAPIKeyRequest
 	if err := c.Bind(&body); err != nil {
 		slog.ErrorContext(c.Request().Context(), "failed to bind api key body", "error", err, "workspace_id", wid)
 		return echo.NewHTTPError(http.StatusBadRequest, "invalid JSON")
@@ -105,13 +70,7 @@ func (h *PortalHandler) CreateAPIKey(c echo.Context) error {
 		slog.ErrorContext(c.Request().Context(), "failed to create api key", "error", err, "workspace_id", wid, "name", body.Name)
 		return safeHTTPError(err, http.StatusBadRequest, "failed to create api key")
 	}
-	pub := toAPIKeyPublic(*k)
-	return c.JSON(http.StatusCreated, map[string]any{
-		"id": pub.ID, "workspace_id": pub.WorkspaceID, "client_id": pub.ClientID,
-		"name": pub.Name, "is_active": pub.IsActive, "last_used_at": pub.LastUsedAt,
-		"created_at": pub.CreatedAt, "expires_at": pub.ExpiresAt,
-		"client_secret": secret,
-	})
+	return c.JSON(http.StatusCreated, dto.CreateAPIKeyResponseFromDomain(*k, secret))
 }
 
 func (h *PortalHandler) DeleteAPIKey(c echo.Context) error {
@@ -132,7 +91,7 @@ func (h *PortalHandler) RegenerateAPIKey(c echo.Context) error {
 		slog.ErrorContext(c.Request().Context(), "failed to regenerate api key", "error", err, "workspace_id", wid, "api_key_id", keyID)
 		return safeHTTPError(err, http.StatusBadRequest, "failed to regenerate api key")
 	}
-	return c.JSON(http.StatusOK, map[string]string{"client_secret": secret})
+	return c.JSON(http.StatusOK, dto.RegenerateAPIKeyResponseFromDomain(secret))
 }
 
 func (h *PortalHandler) ListLogs(c echo.Context) error {
@@ -156,7 +115,7 @@ func (h *PortalHandler) ListLogs(c echo.Context) error {
 		slog.ErrorContext(c.Request().Context(), "failed to list logs", "error", err)
 		return safeHTTPError(err, http.StatusInternalServerError, "failed to list logs")
 	}
-	return c.JSON(http.StatusOK, map[string]any{"items": rows, "total": total})
+	return c.JSON(http.StatusOK, dto.MessageRequestLogListFromDomain(rows, total))
 }
 
 func (h *PortalHandler) GetSettings(c echo.Context) error {
@@ -171,13 +130,15 @@ func (h *PortalHandler) GetSettings(c echo.Context) error {
 
 func (h *PortalHandler) PatchSettings(c echo.Context) error {
 	wid := c.Param("wid")
-	var body map[string]string
+	var body dto.PatchSettingsRequest
 	if err := c.Bind(&body); err != nil {
 		slog.ErrorContext(c.Request().Context(), "failed to bind settings body", "error", err, "workspace_id", wid)
 		return echo.NewHTTPError(http.StatusBadRequest, "invalid JSON")
 	}
 	if err := h.svc.PatchSettings(c.Request().Context(), wid, body); err != nil {
-		slog.ErrorContext(c.Request().Context(), "failed to patch settings", "error", err, "workspace_id", wid)
+		if !errors.Is(err, port.ErrInvalidInput) {
+			slog.ErrorContext(c.Request().Context(), "failed to patch settings", "error", err, "workspace_id", wid)
+		}
 		return safeHTTPError(err, http.StatusBadRequest, "failed to patch settings")
 	}
 	return c.NoContent(http.StatusNoContent)
diff --git a/internal/presentation/handler/portal_handler_test.go b/internal/presentation/handler/portal_handler_test.go
new file mode 100644
index 00000000..48d06826
--- /dev/null
+++ b/internal/presentation/handler/portal_handler_test.go
@@ -0,0 +1,224 @@
+package handler
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/labstack/echo/v4"
+
+	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
+	"github.com/weprodev/wpd-message-gateway/internal/core/port"
+	"github.com/weprodev/wpd-message-gateway/internal/core/service"
+)
+
+type handlerFakeAPIKeyRepo struct {
+	keys    map[string]*domain.APIKey
+	byWS    map[string][]domain.APIKey
+	created *domain.APIKey
+	deleted string
+}
+
+func (f *handlerFakeAPIKeyRepo) Create(_ context.Context, k *domain.APIKey) error {
+	if f.keys == nil {
+		f.keys = make(map[string]*domain.APIKey)
+	}
+	if f.byWS == nil {
+		f.byWS = make(map[string][]domain.APIKey)
+	}
+	k.ID = "key-" + uuid.NewString()
+	f.created = k
+	f.keys[k.ID] = k
+	f.byWS[k.WorkspaceID] = append(f.byWS[k.WorkspaceID], *k)
+	return nil
+}
+
+func (f *handlerFakeAPIKeyRepo) GetByClientID(context.Context, string) (*domain.APIKey, error) {
+	return nil, port.ErrNotFound
+}
+
+func (f *handlerFakeAPIKeyRepo) GetByID(_ context.Context, id string) (*domain.APIKey, error) {
+	k, ok := f.keys[id]
+	if !ok {
+		return nil, port.ErrNotFound
+	}
+	return k, nil
+}
+
+func (f *handlerFakeAPIKeyRepo) ListByWorkspace(_ context.Context, workspaceID string) ([]domain.APIKey, error) {
+	return f.byWS[workspaceID], nil
+}
+
+func (f *handlerFakeAPIKeyRepo) Delete(_ context.Context, id string) error {
+	f.deleted = id
+	delete(f.keys, id)
+	return nil
+}
+
+func (f *handlerFakeAPIKeyRepo) UpdateSecret(context.Context, string, string, string) error {
+	return nil
+}
+
+func (f *handlerFakeAPIKeyRepo) UpdateLastUsedAt(context.Context, string) error {
+	return nil
+}
+
+type handlerFakeSettingsRepo struct {
+	values map[string]string
+}
+
+func (f *handlerFakeSettingsRepo) Get(_ context.Context, _, key string) (string, error) {
+	if f.values == nil {
+		return "", nil
+	}
+	return f.values[key], nil
+}
+
+func (f *handlerFakeSettingsRepo) Set(_ context.Context, _, key, value string) error {
+	if f.values == nil {
+		f.values = make(map[string]string)
+	}
+	f.values[key] = value
+	return nil
+}
+
+func (f *handlerFakeSettingsRepo) GetAll(_ context.Context, _ string) (map[string]string, error) {
+	return f.values, nil
+}
+
+func TestPortalHandler_CreateAPIKey(t *testing.T) {
+	t.Parallel()
+	e := echo.New()
+
+	repo := &handlerFakeAPIKeyRepo{}
+	svc := service.NewPortalService(service.PortalDeps{APIKeys: repo})
+	h := NewPortalHandler(svc)
+
+	body := `{"name":"Portal Key"}`
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/workspaces/ws-1/api-keys", strings.NewReader(body))
+	req.Header.Set(echo.HeaderContentType, echo.MIMEApplicationJSON)
+	rec := httptest.NewRecorder()
+	c := e.NewContext(req, rec)
+	c.SetParamNames("wid")
+	c.SetParamValues("ws-1")
+
+	if err := h.CreateAPIKey(c); err != nil {
+		t.Fatalf("CreateAPIKey: %v", err)
+	}
+	if rec.Code != http.StatusCreated {
+		t.Fatalf("expected 201, got %d body=%s", rec.Code, rec.Body.String())
+	}
+
+	var res map[string]any
+	if err := json.Unmarshal(rec.Body.Bytes(), &res); err != nil {
+		t.Fatalf("decode response: %v", err)
+	}
+	if res["name"] != "Portal Key" {
+		t.Fatalf("unexpected response: %+v", res)
+	}
+	secret, _ := res["client_secret"].(string)
+	if secret == "" {
+		t.Fatal("expected client_secret in response")
+	}
+}
+
+func TestPortalHandler_CreateAPIKey_rejectsMissingName(t *testing.T) {
+	t.Parallel()
+	e := echo.New()
+
+	h := NewPortalHandler(service.NewPortalService(service.PortalDeps{}))
+
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/workspaces/ws-1/api-keys", strings.NewReader(`{}`))
+	req.Header.Set(echo.HeaderContentType, echo.MIMEApplicationJSON)
+	rec := httptest.NewRecorder()
+	c := e.NewContext(req, rec)
+	c.SetParamNames("wid")
+	c.SetParamValues("ws-1")
+
+	err := h.CreateAPIKey(c)
+	if err == nil {
+		t.Fatal("expected validation error")
+	}
+	httpErr, ok := err.(*echo.HTTPError)
+	if !ok || httpErr.Code != http.StatusBadRequest {
+		t.Fatalf("expected 400, got %v", err)
+	}
+}
+
+func TestPortalHandler_ListAPIKeys(t *testing.T) {
+	t.Parallel()
+	e := echo.New()
+
+	ts := time.Now()
+	repo := &handlerFakeAPIKeyRepo{
+		byWS: map[string][]domain.APIKey{
+			"ws-1": {{
+				ID:          "key-1",
+				WorkspaceID: "ws-1",
+				ClientID:    "client-1",
+				Name:        "Demo",
+				IsActive:    true,
+				CreatedAt:   ts,
+			}},
+		},
+	}
+	svc := service.NewPortalService(service.PortalDeps{APIKeys: repo})
+	h := NewPortalHandler(svc)
+
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/workspaces/ws-1/api-keys", nil)
+	rec := httptest.NewRecorder()
+	c := e.NewContext(req, rec)
+	c.SetParamNames("wid")
+	c.SetParamValues("ws-1")
+
+	if err := h.ListAPIKeys(c); err != nil {
+		t.Fatalf("ListAPIKeys: %v", err)
+	}
+	if rec.Code != http.StatusOK {
+		t.Fatalf("expected 200, got %d", rec.Code)
+	}
+
+	var keys []map[string]any
+	if err := json.Unmarshal(rec.Body.Bytes(), &keys); err != nil {
+		t.Fatalf("decode response: %v", err)
+	}
+	if len(keys) != 1 || keys[0]["name"] != "Demo" {
+		t.Fatalf("unexpected keys: %+v", keys)
+	}
+}
+
+func TestPortalHandler_GetSettings(t *testing.T) {
+	t.Parallel()
+	e := echo.New()
+
+	settings := &handlerFakeSettingsRepo{
+		values: map[string]string{
+			domain.SettingKeyMessageDispatchMode: string(domain.DispatchMemory),
+		},
+	}
+	svc := service.NewPortalService(service.PortalDeps{Settings: settings})
+	h := NewPortalHandler(svc)
+
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/workspaces/ws-1/settings", nil)
+	rec := httptest.NewRecorder()
+	c := e.NewContext(req, rec)
+	c.SetParamNames("wid")
+	c.SetParamValues("ws-1")
+
+	if err := h.GetSettings(c); err != nil {
+		t.Fatalf("GetSettings: %v", err)
+	}
+
+	var res map[string]string
+	if err := json.Unmarshal(rec.Body.Bytes(), &res); err != nil {
+		t.Fatalf("decode response: %v", err)
+	}
+	if res[domain.SettingKeyMessageDispatchMode] != string(domain.DispatchMemory) {
+		t.Fatalf("unexpected settings: %+v", res)
+	}
+}
diff --git a/internal/presentation/handler/portal_inbox_handler.go b/internal/presentation/handler/portal_inbox_handler.go
index 121fdce2..26ed252e 100644
--- a/internal/presentation/handler/portal_inbox_handler.go
+++ b/internal/presentation/handler/portal_inbox_handler.go
@@ -7,6 +7,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"net/http"
+	"strconv"
 	"sync"
 
 	"github.com/labstack/echo/v4"
@@ -16,7 +17,7 @@ import (
 )
 
 // PortalInboxHandler serves REST + SSE for the workspace-scoped message inbox (memory provider preview).
-// Routes require JWT + workspace membership + workspace API key (see middleware).
+// Routes require JWT + workspace membership (see middleware).
 type PortalInboxHandler struct {
 	reader      port.InboxReader
 	writer      port.InboxWriter
@@ -41,7 +42,10 @@ func (h *PortalInboxHandler) HandleStats(c echo.Context) error {
 }
 
 func (h *PortalInboxHandler) HandleGetEmails(c echo.Context) error {
-	return c.JSON(http.StatusOK, h.reader.EmailsForWorkspace(workspaceIDParam(c)))
+	limit, _ := strconv.Atoi(c.QueryParam("limit"))
+	cursor := c.QueryParam("cursor")
+	page := h.reader.ListEmailsForWorkspace(workspaceIDParam(c), limit, cursor)
+	return c.JSON(http.StatusOK, page)
 }
 
 func (h *PortalInboxHandler) HandleGetEmailByID(c echo.Context) error {
@@ -63,7 +67,10 @@ func (h *PortalInboxHandler) HandleDeleteEmailByID(c echo.Context) error {
 }
 
 func (h *PortalInboxHandler) HandleGetSMS(c echo.Context) error {
-	return c.JSON(http.StatusOK, h.reader.SMSForWorkspace(workspaceIDParam(c)))
+	limit, _ := strconv.Atoi(c.QueryParam("limit"))
+	cursor := c.QueryParam("cursor")
+	page := h.reader.ListSMSForWorkspace(workspaceIDParam(c), limit, cursor)
+	return c.JSON(http.StatusOK, page)
 }
 
 func (h *PortalInboxHandler) HandleGetSMSByID(c echo.Context) error {
@@ -85,7 +92,10 @@ func (h *PortalInboxHandler) HandleDeleteSMSByID(c echo.Context) error {
 }
 
 func (h *PortalInboxHandler) HandleGetPush(c echo.Context) error {
-	return c.JSON(http.StatusOK, h.reader.PushForWorkspace(workspaceIDParam(c)))
+	limit, _ := strconv.Atoi(c.QueryParam("limit"))
+	cursor := c.QueryParam("cursor")
+	page := h.reader.ListPushForWorkspace(workspaceIDParam(c), limit, cursor)
+	return c.JSON(http.StatusOK, page)
 }
 
 func (h *PortalInboxHandler) HandleGetPushByID(c echo.Context) error {
@@ -107,7 +117,10 @@ func (h *PortalInboxHandler) HandleDeletePushByID(c echo.Context) error {
 }
 
 func (h *PortalInboxHandler) HandleGetChat(c echo.Context) error {
-	return c.JSON(http.StatusOK, h.reader.ChatForWorkspace(workspaceIDParam(c)))
+	limit, _ := strconv.Atoi(c.QueryParam("limit"))
+	cursor := c.QueryParam("cursor")
+	page := h.reader.ListChatForWorkspace(workspaceIDParam(c), limit, cursor)
+	return c.JSON(http.StatusOK, page)
 }
 
 func (h *PortalInboxHandler) HandleGetChatByID(c echo.Context) error {
@@ -146,7 +159,6 @@ func (h *PortalInboxHandler) HandleIngestEmail(c echo.Context) error {
 		return c.JSON(http.StatusInternalServerError, map[string]string{"error": "failed to store email"})
 	}
 
-	h.broadcast(w, "email_received", map[string]string{"id": id})
 	return c.JSON(http.StatusCreated, map[string]string{"id": id})
 }
 
@@ -161,7 +173,6 @@ func (h *PortalInboxHandler) HandleIngestSMS(c echo.Context) error {
 		return c.JSON(http.StatusInternalServerError, map[string]string{"error": "failed to store sms"})
 	}
 
-	h.broadcast(workspaceIDParam(c), "sms_received", map[string]string{"id": id})
 	return c.JSON(http.StatusCreated, map[string]string{"id": id})
 }
 
@@ -176,7 +187,6 @@ func (h *PortalInboxHandler) HandleIngestPush(c echo.Context) error {
 		return c.JSON(http.StatusInternalServerError, map[string]string{"error": "failed to store push"})
 	}
 
-	h.broadcast(workspaceIDParam(c), "push_received", map[string]string{"id": id})
 	return c.JSON(http.StatusCreated, map[string]string{"id": id})
 }
 
@@ -191,10 +201,14 @@ func (h *PortalInboxHandler) HandleIngestChat(c echo.Context) error {
 		return c.JSON(http.StatusInternalServerError, map[string]string{"error": "failed to store chat"})
 	}
 
-	h.broadcast(workspaceIDParam(c), "chat_received", map[string]string{"id": id})
 	return c.JSON(http.StatusCreated, map[string]string{"id": id})
 }
 
+// PublishInboxEvent notifies SSE subscribers of an inbox change.
+func (h *PortalInboxHandler) PublishInboxEvent(workspaceID, eventType string, data any) {
+	h.broadcast(workspaceID, eventType, data)
+}
+
 // HandleSSE streams Server-Sent Events for the workspace inbox (one connection per workspace).
 func (h *PortalInboxHandler) HandleSSE(c echo.Context) error {
 	w := workspaceIDParam(c)
diff --git a/internal/presentation/handler/portal_inbox_handler_test.go b/internal/presentation/handler/portal_inbox_handler_test.go
new file mode 100644
index 00000000..b3ddcaf1
--- /dev/null
+++ b/internal/presentation/handler/portal_inbox_handler_test.go
@@ -0,0 +1,147 @@
+package handler
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/labstack/echo/v4"
+
+	"github.com/weprodev/wpd-message-gateway/internal/infrastructure/inbox"
+	"github.com/weprodev/wpd-message-gateway/pkg/contracts"
+)
+
+func TestPortalInboxHandler_HandleGetEmails(t *testing.T) {
+	t.Parallel()
+	e := echo.New()
+
+	store := inbox.NewStore()
+	ctx := context.Background()
+	id, err := store.WriteEmail(ctx, "ws-1", contracts.Email{
+		To:      []string{"a@b.com"},
+		Subject: "Hello",
+		HTML:    "<p>hi</p>",
+	})
+	if err != nil {
+		t.Fatalf("WriteEmail: %v", err)
+	}
+
+	h := NewPortalInboxHandler(store, store)
+
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/workspaces/ws-1/inbox/emails?limit=10", nil)
+	rec := httptest.NewRecorder()
+	c := e.NewContext(req, rec)
+	c.SetParamNames("wid")
+	c.SetParamValues("ws-1")
+
+	if err := h.HandleGetEmails(c); err != nil {
+		t.Fatalf("HandleGetEmails: %v", err)
+	}
+	if rec.Code != http.StatusOK {
+		t.Fatalf("expected 200, got %d", rec.Code)
+	}
+
+	var page struct {
+		Items []struct {
+			ID string `json:"id"`
+		} `json:"items"`
+	}
+	if err := json.Unmarshal(rec.Body.Bytes(), &page); err != nil {
+		t.Fatalf("decode response: %v", err)
+	}
+	if len(page.Items) != 1 || page.Items[0].ID != id {
+		t.Fatalf("unexpected page: %+v", page)
+	}
+}
+
+func TestPortalInboxHandler_HandleGetSMS(t *testing.T) {
+	t.Parallel()
+	e := echo.New()
+
+	store := inbox.NewStore()
+	ctx := context.Background()
+	id, err := store.WriteSMS(ctx, "ws-1", contracts.SMS{
+		To:      []string{"+15550001111"},
+		Message: "ping",
+	})
+	if err != nil {
+		t.Fatalf("WriteSMS: %v", err)
+	}
+
+	h := NewPortalInboxHandler(store, store)
+
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/workspaces/ws-1/inbox/sms?limit=10", nil)
+	rec := httptest.NewRecorder()
+	c := e.NewContext(req, rec)
+	c.SetParamNames("wid")
+	c.SetParamValues("ws-1")
+
+	if err := h.HandleGetSMS(c); err != nil {
+		t.Fatalf("HandleGetSMS: %v", err)
+	}
+
+	var page struct {
+		Items []struct {
+			ID string `json:"id"`
+		} `json:"items"`
+	}
+	if err := json.Unmarshal(rec.Body.Bytes(), &page); err != nil {
+		t.Fatalf("decode response: %v", err)
+	}
+	if len(page.Items) != 1 || page.Items[0].ID != id {
+		t.Fatalf("unexpected page: %+v", page)
+	}
+}
+
+func TestPortalInboxHandler_HandleGetEmailByID_notFound(t *testing.T) {
+	t.Parallel()
+	e := echo.New()
+
+	h := NewPortalInboxHandler(inbox.NewStore(), inbox.NewStore())
+
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/workspaces/ws-1/inbox/emails/missing", nil)
+	rec := httptest.NewRecorder()
+	c := e.NewContext(req, rec)
+	c.SetParamNames("wid", "id")
+	c.SetParamValues("ws-1", "missing")
+
+	if err := h.HandleGetEmailByID(c); err != nil {
+		t.Fatalf("HandleGetEmailByID: %v", err)
+	}
+	if rec.Code != http.StatusNotFound {
+		t.Fatalf("expected 404, got %d", rec.Code)
+	}
+}
+
+func TestPortalInboxHandler_HandleStats(t *testing.T) {
+	t.Parallel()
+	e := echo.New()
+
+	store := inbox.NewStore()
+	ctx := context.Background()
+	if _, err := store.WriteEmail(ctx, "ws-1", contracts.Email{To: []string{"a@b.com"}, Subject: "s"}); err != nil {
+		t.Fatalf("WriteEmail: %v", err)
+	}
+
+	h := NewPortalInboxHandler(store, store)
+
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/workspaces/ws-1/inbox/stats", nil)
+	rec := httptest.NewRecorder()
+	c := e.NewContext(req, rec)
+	c.SetParamNames("wid")
+	c.SetParamValues("ws-1")
+
+	if err := h.HandleStats(c); err != nil {
+		t.Fatalf("HandleStats: %v", err)
+	}
+
+	var stats map[string]int
+	if err := json.Unmarshal(rec.Body.Bytes(), &stats); err != nil {
+		t.Fatalf("decode response: %v", err)
+	}
+	if stats["emails"] < 1 {
+		t.Fatalf("expected at least one email in stats, got %+v", stats)
+	}
+}
diff --git a/internal/presentation/handler/portal_integration_handler.go b/internal/presentation/handler/portal_integration_handler.go
index 692eaa04..5565a989 100644
--- a/internal/presentation/handler/portal_integration_handler.go
+++ b/internal/presentation/handler/portal_integration_handler.go
@@ -1,14 +1,13 @@
 package handler
 
 import (
-	"encoding/json"
 	"log/slog"
 	"net/http"
 
 	"github.com/labstack/echo/v4"
 
-	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
 	"github.com/weprodev/wpd-message-gateway/internal/core/service"
+	"github.com/weprodev/wpd-message-gateway/internal/presentation/dto"
 )
 
 type PortalIntegrationHandler struct {
@@ -19,28 +18,6 @@ func NewPortalIntegrationHandler(svc *service.PortalService) *PortalIntegrationH
 	return &PortalIntegrationHandler{svc: svc}
 }
 
-type integrationBody struct {
-	ChannelType  string          `json:"channel_type"`
-	ProviderName string          `json:"provider_name"`
-	Config       json.RawMessage `json:"config"`
-	Status       string          `json:"status"`
-	IsDefault    bool            `json:"is_default"`
-}
-
-func integrationToJSON(intg domain.Integration) map[string]any {
-	return map[string]any{
-		"id":            intg.ID,
-		"workspace_id":  intg.WorkspaceID,
-		"channel_type":  intg.ChannelType,
-		"provider_name": intg.ProviderName,
-		"config":        json.RawMessage(intg.Config),
-		"status":        intg.Status,
-		"is_default":    intg.IsDefault,
-		"created_at":    intg.CreatedAt,
-		"updated_at":    intg.UpdatedAt,
-	}
-}
-
 func (h *PortalIntegrationHandler) ListIntegrations(c echo.Context) error {
 	wid := c.Param("wid")
 	list, err := h.svc.ListIntegrations(c.Request().Context(), wid)
@@ -48,42 +25,30 @@ func (h *PortalIntegrationHandler) ListIntegrations(c echo.Context) error {
 		slog.ErrorContext(c.Request().Context(), "failed to list integrations", "error", err)
 		return safeHTTPError(err, http.StatusInternalServerError, "failed to list integrations")
 	}
-	out := make([]map[string]any, 0, len(list))
+	out := make([]dto.Integration, 0, len(list))
 	for _, intg := range list {
-		out = append(out, integrationToJSON(intg))
+		out = append(out, dto.IntegrationFromDomain(intg))
 	}
 	return c.JSON(http.StatusOK, out)
 }
 
 func (h *PortalIntegrationHandler) UpsertIntegration(c echo.Context) error {
 	wid := c.Param("wid")
-	var body integrationBody
+	var body dto.UpsertIntegrationRequest
 	if err := c.Bind(&body); err != nil {
 		slog.ErrorContext(c.Request().Context(), "failed to bind integration body", "error", err, "workspace_id", wid)
 		return echo.NewHTTPError(http.StatusBadRequest, "invalid JSON")
 	}
-	cfg, err := service.IntegrationConfigJSON(body.Config)
+	intg, err := body.ToDomain(wid)
 	if err != nil {
 		slog.ErrorContext(c.Request().Context(), "failed to parse integration config JSON", "error", err, "workspace_id", wid, "provider_name", body.ProviderName)
 		return echo.NewHTTPError(http.StatusBadRequest, "invalid config JSON")
 	}
-	status := body.Status
-	if status == "" {
-		status = domain.IntegrationStatusConnected
-	}
-	intg := &domain.Integration{
-		WorkspaceID:  wid,
-		ChannelType:  body.ChannelType,
-		ProviderName: body.ProviderName,
-		Config:       cfg,
-		Status:       status,
-		IsDefault:    body.IsDefault,
-	}
 	if err := h.svc.UpsertIntegration(c.Request().Context(), intg); err != nil {
 		slog.ErrorContext(c.Request().Context(), "failed to upsert integration", "error", err, "workspace_id", wid, "provider_name", body.ProviderName)
 		return safeHTTPError(err, http.StatusBadRequest, "failed to upsert integration")
 	}
-	return c.JSON(http.StatusOK, integrationToJSON(*intg))
+	return c.JSON(http.StatusOK, dto.IntegrationFromDomain(*intg))
 }
 
 func (h *PortalIntegrationHandler) DeleteIntegration(c echo.Context) error {
diff --git a/internal/presentation/handler/portal_send.go b/internal/presentation/handler/portal_send.go
deleted file mode 100644
index 6bf71712..00000000
--- a/internal/presentation/handler/portal_send.go
+++ /dev/null
@@ -1,46 +0,0 @@
-package handler
-
-import (
-	"context"
-	"net/http"
-
-	"github.com/labstack/echo/v4"
-
-	"github.com/weprodev/wpd-message-gateway/pkg/contracts"
-)
-
-// SendTest dispatches a test message through the gateway for the workspace (portal JWT auth).
-func (h *PortalHandler) SendTest(c echo.Context) error {
-	if h.gateway == nil || h.helper == nil {
-		return echo.NewHTTPError(http.StatusServiceUnavailable, "send test unavailable")
-	}
-
-	wid := c.Param("wid")
-	channel := c.Param("channel")
-	endpoint := "/api/v1/workspaces/" + wid + "/send-test/" + channel
-
-	switch channel {
-	case "email":
-		var req contracts.Email
-		return h.helper.DispatchAndLog(c, channel, wid, "", endpoint, &req, func(sendCtx context.Context) (*contracts.SendResult, error) {
-			return h.gateway.SendEmail(sendCtx, wid, req)
-		})
-	case "sms":
-		var req contracts.SMS
-		return h.helper.DispatchAndLog(c, channel, wid, "", endpoint, &req, func(sendCtx context.Context) (*contracts.SendResult, error) {
-			return h.gateway.SendSMS(sendCtx, wid, req)
-		})
-	case "push":
-		var req contracts.PushNotification
-		return h.helper.DispatchAndLog(c, channel, wid, "", endpoint, &req, func(sendCtx context.Context) (*contracts.SendResult, error) {
-			return h.gateway.SendPush(sendCtx, wid, req)
-		})
-	case "chat":
-		var req contracts.ChatMessage
-		return h.helper.DispatchAndLog(c, channel, wid, "", endpoint, &req, func(sendCtx context.Context) (*contracts.SendResult, error) {
-			return h.gateway.SendChat(sendCtx, wid, req)
-		})
-	default:
-		return echo.NewHTTPError(http.StatusBadRequest, "unsupported channel")
-	}
-}
diff --git a/internal/presentation/handler/portal_template_handler.go b/internal/presentation/handler/portal_template_handler.go
index 9f32fe35..ed259b2c 100644
--- a/internal/presentation/handler/portal_template_handler.go
+++ b/internal/presentation/handler/portal_template_handler.go
@@ -5,10 +5,9 @@ import (
 	"net/http"
 
 	"github.com/labstack/echo/v4"
-	"github.com/weprodev/go-pkg/sanitizer"
 
-	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
 	"github.com/weprodev/wpd-message-gateway/internal/core/service"
+	"github.com/weprodev/wpd-message-gateway/internal/presentation/dto"
 )
 
 type PortalTemplateHandler struct {
@@ -19,28 +18,6 @@ func NewPortalTemplateHandler(svc *service.PortalService) *PortalTemplateHandler
 	return &PortalTemplateHandler{svc: svc}
 }
 
-type templateBody struct {
-	Name        string `json:"name"`
-	UniqueKey   string `json:"unique_key"`
-	ChannelType string `json:"channel_type"`
-	Category    string `json:"category"`
-	Subject     string `json:"subject"`
-	ContentHTML string `json:"content_html"`
-	IsActive    *bool  `json:"is_active"`
-	IsDefault   *bool  `json:"is_default"`
-}
-
-type patchTemplateBody struct {
-	Name        *string `json:"name"`
-	UniqueKey   *string `json:"unique_key"`
-	ChannelType *string `json:"channel_type"`
-	Category    *string `json:"category"`
-	Subject     *string `json:"subject"`
-	ContentHTML *string `json:"content_html"`
-	IsActive    *bool   `json:"is_active"`
-	IsDefault   *bool   `json:"is_default"`
-}
-
 func (h *PortalTemplateHandler) ListTemplates(c echo.Context) error {
 	wid := c.Param("wid")
 	list, err := h.svc.ListTemplates(c.Request().Context(), wid)
@@ -53,31 +30,12 @@ func (h *PortalTemplateHandler) ListTemplates(c echo.Context) error {
 
 func (h *PortalTemplateHandler) CreateTemplate(c echo.Context) error {
 	wid := c.Param("wid")
-	var body templateBody
+	var body dto.CreateTemplateRequest
 	if err := c.Bind(&body); err != nil {
 		slog.ErrorContext(c.Request().Context(), "failed to bind template create body", "error", err, "workspace_id", wid)
 		return echo.NewHTTPError(http.StatusBadRequest, "invalid JSON")
 	}
-	t := &domain.Template{
-		WorkspaceID: wid,
-		Name:        body.Name,
-		UniqueKey:   body.UniqueKey,
-		ChannelType: body.ChannelType,
-		Category:    body.Category,
-		Subject:     body.Subject,
-		ContentHTML: sanitizer.SanitizeHTML(body.ContentHTML),
-		IsActive:    true,
-		IsDefault:   false,
-	}
-	if body.IsActive != nil {
-		t.IsActive = *body.IsActive
-	}
-	if body.IsDefault != nil {
-		t.IsDefault = *body.IsDefault
-	}
-	if t.ChannelType == "" {
-		t.ChannelType = "email"
-	}
+	t := body.ToDomain(wid)
 	if err := h.svc.CreateTemplate(c.Request().Context(), t); err != nil {
 		slog.ErrorContext(c.Request().Context(), "failed to create template", "error", err, "workspace_id", wid, "unique_key", body.UniqueKey)
 		return safeHTTPError(err, http.StatusBadRequest, "failed to create template")
@@ -88,21 +46,12 @@ func (h *PortalTemplateHandler) CreateTemplate(c echo.Context) error {
 func (h *PortalTemplateHandler) PatchTemplate(c echo.Context) error {
 	wid := c.Param("wid")
 	tid := c.Param("tid")
-	var body patchTemplateBody
+	var body dto.PatchTemplateRequest
 	if err := c.Bind(&body); err != nil {
 		slog.ErrorContext(c.Request().Context(), "failed to bind template patch body", "error", err, "workspace_id", wid, "template_id", tid)
 		return echo.NewHTTPError(http.StatusBadRequest, "invalid JSON")
 	}
-	patch := service.TemplatePatch{
-		Name: body.Name, UniqueKey: body.UniqueKey, ChannelType: body.ChannelType,
-		Category: body.Category, Subject: body.Subject, ContentHTML: body.ContentHTML,
-		IsActive: body.IsActive, IsDefault: body.IsDefault,
-	}
-	if body.ContentHTML != nil {
-		clean := sanitizer.SanitizeHTML(*body.ContentHTML)
-		patch.ContentHTML = &clean
-	}
-	if err := h.svc.PatchTemplate(c.Request().Context(), wid, tid, patch); err != nil {
+	if err := h.svc.PatchTemplate(c.Request().Context(), wid, tid, body.ToPatch()); err != nil {
 		slog.ErrorContext(c.Request().Context(), "failed to patch template", "error", err, "workspace_id", wid, "template_id", tid)
 		return safeHTTPError(err, http.StatusBadRequest, "failed to patch template")
 	}
diff --git a/internal/presentation/handler/portal_workspace_handler.go b/internal/presentation/handler/portal_workspace_handler.go
index 096b8053..8e83f5e9 100644
--- a/internal/presentation/handler/portal_workspace_handler.go
+++ b/internal/presentation/handler/portal_workspace_handler.go
@@ -1,14 +1,15 @@
 package handler
 
 import (
+	"errors"
 	"log/slog"
 	"net/http"
-	"time"
 
 	"github.com/labstack/echo/v4"
 
-	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
+	"github.com/weprodev/wpd-message-gateway/internal/core/port"
 	"github.com/weprodev/wpd-message-gateway/internal/core/service"
+	"github.com/weprodev/wpd-message-gateway/internal/presentation/dto"
 	customMiddleware "github.com/weprodev/wpd-message-gateway/internal/presentation/middleware"
 )
 
@@ -20,28 +21,6 @@ func NewPortalWorkspaceHandler(svc *service.PortalService) *PortalWorkspaceHandl
 	return &PortalWorkspaceHandler{svc: svc}
 }
 
-type createWorkspaceBody struct {
-	Name    string `json:"name"`
-	Slug    string `json:"slug"`
-	IconKey string `json:"icon_key"`
-}
-
-type joinBody struct {
-	Slug string `json:"slug"`
-	PIN  string `json:"pin"`
-}
-
-type patchWorkspaceBody struct {
-	Name       *string `json:"name"`
-	Visibility *string `json:"visibility"`
-	IconKey    *string `json:"icon_key"`
-}
-
-type invitationBody struct {
-	Email string `json:"email"`
-	Role  string `json:"role"`
-}
-
 func (h *PortalWorkspaceHandler) ListWorkspaces(c echo.Context) error {
 	uid := customMiddleware.GetPortalUserID(c.Request().Context())
 	list, err := h.svc.ListWorkspaces(c.Request().Context(), uid)
@@ -54,7 +33,7 @@ func (h *PortalWorkspaceHandler) ListWorkspaces(c echo.Context) error {
 
 func (h *PortalWorkspaceHandler) CreateWorkspace(c echo.Context) error {
 	uid := customMiddleware.GetPortalUserID(c.Request().Context())
-	var body createWorkspaceBody
+	var body dto.CreateWorkspaceRequest
 	if err := c.Bind(&body); err != nil {
 		slog.ErrorContext(c.Request().Context(), "failed to bind workspace create body", "error", err, "user_id", uid)
 		return echo.NewHTTPError(http.StatusBadRequest, "invalid JSON")
@@ -62,6 +41,9 @@ func (h *PortalWorkspaceHandler) CreateWorkspace(c echo.Context) error {
 	w, err := h.svc.CreateWorkspace(c.Request().Context(), uid, body.Name, body.Slug, body.IconKey)
 	if err != nil {
 		slog.ErrorContext(c.Request().Context(), "failed to create workspace", "error", err, "user_id", uid, "name", body.Name)
+		if errors.Is(err, port.ErrConflict) {
+			return echo.NewHTTPError(http.StatusConflict, "workspace slug already exists")
+		}
 		return safeHTTPError(err, http.StatusBadRequest, "failed to create workspace")
 	}
 	return c.JSON(http.StatusCreated, w)
@@ -69,7 +51,7 @@ func (h *PortalWorkspaceHandler) CreateWorkspace(c echo.Context) error {
 
 func (h *PortalWorkspaceHandler) JoinWorkspace(c echo.Context) error {
 	uid := customMiddleware.GetPortalUserID(c.Request().Context())
-	var body joinBody
+	var body dto.JoinWorkspaceRequest
 	if err := c.Bind(&body); err != nil {
 		slog.ErrorContext(c.Request().Context(), "failed to bind workspace join body", "error", err, "user_id", uid)
 		return echo.NewHTTPError(http.StatusBadRequest, "invalid JSON")
@@ -93,14 +75,12 @@ func (h *PortalWorkspaceHandler) GetWorkspace(c echo.Context) error {
 
 func (h *PortalWorkspaceHandler) PatchWorkspace(c echo.Context) error {
 	wid := c.Param("wid")
-	var body patchWorkspaceBody
+	var body dto.PatchWorkspaceRequest
 	if err := c.Bind(&body); err != nil {
 		slog.ErrorContext(c.Request().Context(), "failed to bind workspace patch body", "error", err, "workspace_id", wid)
 		return echo.NewHTTPError(http.StatusBadRequest, "invalid JSON")
 	}
-	if err := h.svc.PatchWorkspace(c.Request().Context(), wid, service.WorkspacePatch{
-		Name: body.Name, Visibility: body.Visibility, IconKey: body.IconKey,
-	}); err != nil {
+	if err := h.svc.PatchWorkspace(c.Request().Context(), wid, body.ToPatch()); err != nil {
 		slog.ErrorContext(c.Request().Context(), "failed to patch workspace", "error", err, "workspace_id", wid)
 		return safeHTTPError(err, http.StatusBadRequest, "failed to patch workspace")
 	}
@@ -144,7 +124,7 @@ func (h *PortalWorkspaceHandler) ListInvitations(c echo.Context) error {
 
 func (h *PortalWorkspaceHandler) CreateInvitation(c echo.Context) error {
 	wid := c.Param("wid")
-	var body invitationBody
+	var body dto.CreateInvitationRequest
 	if err := c.Bind(&body); err != nil {
 		slog.ErrorContext(c.Request().Context(), "failed to bind invitation body", "error", err, "workspace_id", wid)
 		return echo.NewHTTPError(http.StatusBadRequest, "invalid JSON")
@@ -152,23 +132,11 @@ func (h *PortalWorkspaceHandler) CreateInvitation(c echo.Context) error {
 	if body.Email == "" || body.Role == "" {
 		return echo.NewHTTPError(http.StatusBadRequest, "email and role required")
 	}
-	inv := &domain.Invitation{
-		WorkspaceID: wid,
-		Email:       body.Email,
-		Role:        body.Role,
-		ExpiresAt:   time.Now().Add(7 * 24 * time.Hour),
-		Status:      "pending",
-	}
+	inv := h.svc.NewPendingInvitation(wid, body.Email, body.Role)
 	rawToken, err := h.svc.CreateInvitation(c.Request().Context(), inv)
 	if err != nil {
 		slog.ErrorContext(c.Request().Context(), "failed to create invitation", "error", err, "workspace_id", wid, "email", body.Email)
 		return safeHTTPError(err, http.StatusBadRequest, "failed to create invitation")
 	}
-	return c.JSON(http.StatusCreated, map[string]any{
-		"id":         inv.ID,
-		"email":      inv.Email,
-		"role":       inv.Role,
-		"expires_at": inv.ExpiresAt,
-		"token":      rawToken,
-	})
+	return c.JSON(http.StatusCreated, dto.CreateInvitationResponseFromDomain(*inv, rawToken))
 }
diff --git a/internal/presentation/handler/portal_workspace_handler_test.go b/internal/presentation/handler/portal_workspace_handler_test.go
new file mode 100644
index 00000000..582af488
--- /dev/null
+++ b/internal/presentation/handler/portal_workspace_handler_test.go
@@ -0,0 +1,96 @@
+package handler
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/google/uuid"
+	"github.com/labstack/echo/v4"
+
+	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
+	"github.com/weprodev/wpd-message-gateway/internal/core/service"
+)
+
+type fakeInvitationRepository struct {
+	created *domain.Invitation
+}
+
+func (f *fakeInvitationRepository) Create(_ context.Context, inv *domain.Invitation) error {
+	f.created = inv
+	inv.ID = "inv-" + uuid.NewString()
+	return nil
+}
+
+func (f *fakeInvitationRepository) ListPendingByWorkspace(context.Context, string) ([]domain.Invitation, error) {
+	return nil, nil
+}
+
+func TestPortalWorkspaceHandler_CreateInvitation(t *testing.T) {
+	t.Parallel()
+	e := echo.New()
+
+	repo := &fakeInvitationRepository{}
+	svc := service.NewPortalService(service.PortalDeps{Invitations: repo})
+	h := NewPortalWorkspaceHandler(svc)
+
+	body := `{"email":"invitee@example.com","role":"member"}`
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/workspaces/ws-1/invitations", strings.NewReader(body))
+	req.Header.Set(echo.HeaderContentType, echo.MIMEApplicationJSON)
+	rec := httptest.NewRecorder()
+	c := e.NewContext(req, rec)
+	c.SetParamNames("wid")
+	c.SetParamValues("ws-1")
+
+	if err := h.CreateInvitation(c); err != nil {
+		t.Fatalf("CreateInvitation: %v", err)
+	}
+	if rec.Code != http.StatusCreated {
+		t.Fatalf("expected 201, got %d body=%s", rec.Code, rec.Body.String())
+	}
+
+	var res map[string]any
+	if err := json.Unmarshal(rec.Body.Bytes(), &res); err != nil {
+		t.Fatalf("decode response: %v", err)
+	}
+	if res["email"] != "invitee@example.com" || res["role"] != "member" {
+		t.Fatalf("unexpected response: %+v", res)
+	}
+	token, _ := res["token"].(string)
+	if token == "" {
+		t.Fatal("expected token in response")
+	}
+	if repo.created == nil || repo.created.TokenHash == "" {
+		t.Fatal("expected invitation persisted with token hash")
+	}
+	if repo.created.Email != "invitee@example.com" || repo.created.Status != "pending" {
+		t.Fatalf("unexpected persisted invitation: %+v", repo.created)
+	}
+}
+
+func TestPortalWorkspaceHandler_CreateInvitation_rejectsInvalidJSON(t *testing.T) {
+	t.Parallel()
+	e := echo.New()
+
+	h := NewPortalWorkspaceHandler(service.NewPortalService(service.PortalDeps{}))
+
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/workspaces/ws-1/invitations", strings.NewReader("{bad"))
+	req.Header.Set(echo.HeaderContentType, echo.MIMEApplicationJSON)
+	rec := httptest.NewRecorder()
+	c := e.NewContext(req, rec)
+	c.SetParamNames("wid")
+	c.SetParamValues("ws-1")
+
+	err := h.CreateInvitation(c)
+	if err == nil {
+		t.Fatal("expected error")
+	}
+	var httpErr *echo.HTTPError
+	if !errors.As(err, &httpErr) || httpErr.Code != http.StatusBadRequest {
+		t.Fatalf("expected 400, got %v", err)
+	}
+}
diff --git a/internal/presentation/handler/send_helper.go b/internal/presentation/handler/send_helper.go
index 265fe833..c441466a 100644
--- a/internal/presentation/handler/send_helper.go
+++ b/internal/presentation/handler/send_helper.go
@@ -10,8 +10,8 @@ import (
 	"github.com/labstack/echo/v4"
 
 	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
+	"github.com/weprodev/wpd-message-gateway/internal/core/logctx"
 	"github.com/weprodev/wpd-message-gateway/internal/core/service"
-	"github.com/weprodev/wpd-message-gateway/internal/infrastructure/logger"
 	"github.com/weprodev/wpd-message-gateway/pkg/contracts"
 )
 
@@ -38,53 +38,56 @@ func (sh *SendHelper) DispatchAndLog(
 	start := time.Now()
 	ctx := c.Request().Context()
 
-	// Enrich context with gateway-domain attributes for logger
-	ctx = logger.WithWorkspace(ctx, workspaceID, apiKeyID)
-	ctx = logger.WithChannel(ctx, channel)
+	ctx = logctx.WithWorkspace(ctx, workspaceID, apiKeyID)
+	ctx = logctx.WithChannel(ctx, channel)
 
 	if workspaceID == "" {
-		sh.RecordLog(ctx, workspaceID, apiKeyID, channel, c.Request().Method,
-			http.StatusUnauthorized, endpoint, start, "missing workspace context", "")
+		slog.WarnContext(ctx, "send rejected: missing workspace context", "endpoint", endpoint)
 		return c.JSON(http.StatusUnauthorized, map[string]string{"error": "missing workspace context"})
 	}
 
 	if err := json.NewDecoder(c.Request().Body).Decode(dst); err != nil {
-		sh.RecordLog(ctx, workspaceID, apiKeyID, channel, c.Request().Method,
-			http.StatusBadRequest, endpoint, start, "invalid JSON body", "")
+		slog.WarnContext(ctx, "send rejected: invalid JSON body", "endpoint", endpoint, "error", err)
+		sh.recordLog(ctx, workspaceID, apiKeyID, channel, c.Request().Method,
+			http.StatusBadRequest, endpoint, start, "invalid JSON body", "", nil, nil)
 		return c.JSON(http.StatusBadRequest, map[string]string{"error": "invalid JSON body"})
 	}
 
+	slog.InfoContext(ctx, "send dispatch starting", "endpoint", endpoint)
+
 	result, err := send(ctx)
+	providerName := contracts.ProviderNameFromResult(result)
+	if providerName != "" {
+		ctx = logctx.WithProvider(ctx, providerName)
+	}
+
 	if err != nil {
-		// Log the full error internally; never echo infrastructure details to the caller.
-		slog.ErrorContext(ctx, "send failed", "error", err)
-		sh.RecordLog(ctx, workspaceID, apiKeyID, channel, c.Request().Method,
-			http.StatusInternalServerError, endpoint, start, err.Error(), providerFromMeta(result))
+		slog.ErrorContext(ctx, "send failed", "error", err, "endpoint", endpoint, "duration_ms", time.Since(start).Milliseconds())
+		sh.recordLog(ctx, workspaceID, apiKeyID, channel, c.Request().Method,
+			http.StatusInternalServerError, endpoint, start, err.Error(), providerName, dst, result)
 		return c.JSON(http.StatusInternalServerError, map[string]string{"error": "send failed"})
 	}
 
-	if provider := providerFromMeta(result); provider != "" {
-		ctx = logger.WithProvider(ctx, provider)
-	}
-	slog.InfoContext(ctx, "send ok", "duration_ms", time.Since(start).Milliseconds())
-	sh.RecordLog(ctx, workspaceID, apiKeyID, channel, c.Request().Method,
-		http.StatusOK, endpoint, start, "", providerFromMeta(result))
+	slog.InfoContext(ctx, "send ok", "endpoint", endpoint, "duration_ms", time.Since(start).Milliseconds())
+	sh.recordLog(ctx, workspaceID, apiKeyID, channel, c.Request().Method,
+		http.StatusOK, endpoint, start, "", providerName, dst, result)
 	return c.JSON(http.StatusOK, result)
 }
 
-// RecordLog persists a MessageRequestLog entry. Failures are logged with slog.
-func (sh *SendHelper) RecordLog(
+func (sh *SendHelper) recordLog(
 	ctx context.Context,
 	workspaceID, apiKeyID, channelType, method string,
 	statusCode int,
 	endpoint string,
 	start time.Time,
 	errMsg, providerName string,
+	reqBody any,
+	result *contracts.SendResult,
 ) {
 	if sh.svc == nil || workspaceID == "" {
 		return
 	}
-	entry := &domain.MessageRequestLog{
+	entry := domain.MessageRequestLog{
 		WorkspaceID:  workspaceID,
 		APIKeyID:     apiKeyID,
 		ChannelType:  channelType,
@@ -92,18 +95,37 @@ func (sh *SendHelper) RecordLog(
 		StatusCode:   statusCode,
 		Endpoint:     endpoint,
 		ProviderName: providerName,
-		RequestID:    logger.GetRequestID(ctx),
+		RequestID:    logctx.GetRequestID(ctx),
 		DurationMs:   int(time.Since(start).Milliseconds()),
 		ErrorMessage: errMsg,
 	}
-	if err := sh.svc.RecordLog(ctx, entry); err != nil {
-		slog.ErrorContext(ctx, "message_request_log insert failed", "error", err)
+	if statusCode == http.StatusOK {
+		entry.InboxMessageID = contracts.InboxMessageIDFromResult(result)
+	}
+
+	if contracts.StoreContentFromResult(result) {
+		var requestBody, responseBody string
+		if reqBody != nil {
+			if b, err := json.Marshal(reqBody); err != nil {
+				slog.WarnContext(ctx, "failed to marshal request body for log payload", "error", err, "endpoint", endpoint)
+			} else {
+				requestBody = string(b)
+			}
+		}
+		if b, err := json.Marshal(result); err != nil {
+			slog.WarnContext(ctx, "failed to marshal response body for log payload", "error", err, "endpoint", endpoint)
+		} else {
+			responseBody = string(b)
+		}
+		if requestBody != "" || responseBody != "" {
+			entry.Payload = &domain.MessageRequestPayload{
+				RequestBody:  requestBody,
+				ResponseBody: responseBody,
+			}
+		}
 	}
-}
 
-func providerFromMeta(r *contracts.SendResult) string {
-	if r == nil || r.Meta == nil {
-		return ""
+	if err := sh.svc.RecordLog(ctx, entry); err != nil {
+		slog.WarnContext(ctx, "failed to persist message request log", "error", err, "endpoint", endpoint)
 	}
-	return r.Meta["provider_name"]
 }
diff --git a/internal/presentation/handler/send_helper_test.go b/internal/presentation/handler/send_helper_test.go
index 945680d3..ae7a4987 100644
--- a/internal/presentation/handler/send_helper_test.go
+++ b/internal/presentation/handler/send_helper_test.go
@@ -11,9 +11,9 @@ import (
 	"github.com/labstack/echo/v4"
 
 	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
+	"github.com/weprodev/wpd-message-gateway/internal/core/logctx"
 	"github.com/weprodev/wpd-message-gateway/internal/core/port"
 	"github.com/weprodev/wpd-message-gateway/internal/core/service"
-	"github.com/weprodev/wpd-message-gateway/internal/infrastructure/logger"
 	"github.com/weprodev/wpd-message-gateway/pkg/contracts"
 )
 
@@ -41,7 +41,7 @@ func TestSendHelper_DispatchAndLog(t *testing.T) {
 
 		// Set request ID in context
 		ctx := req.Context()
-		ctx = logger.WithRequestID(ctx, "req-xyz")
+		ctx = logctx.WithRequestID(ctx, "req-xyz")
 		c.SetRequest(req.WithContext(ctx))
 
 		repo := &mockLogRepo{}
@@ -88,26 +88,199 @@ func TestSendHelper_DispatchAndLog(t *testing.T) {
 		}
 	})
 
-	t.Run("repository error logged without failing dispatch", func(t *testing.T) {
+	t.Run("successful dispatch stores inbox message id when content retained", func(t *testing.T) {
 		req := httptest.NewRequest(http.MethodPost, "/v1/email", strings.NewReader(`{"to":["test@example.com"]}`))
 		rec := httptest.NewRecorder()
 		c := e.NewContext(req, rec)
 
-		repo := &mockLogRepo{createErr: errors.New("db error")}
+		repo := &mockLogRepo{}
+		svc := service.NewGatewayService(nil, nil, nil, nil, repo)
+		helper := NewSendHelper(svc)
+
+		var dst contracts.Email
+		err := helper.DispatchAndLog(c, "email", "ws-123", "key-456", "/v1/email", &dst, func(ctx context.Context) (*contracts.SendResult, error) {
+			return &contracts.SendResult{
+				ID: "inbox-msg-1",
+				Meta: map[string]string{
+					contracts.MetaKeyProviderName: "memory",
+					contracts.MetaKeyDispatchMode: contracts.DispatchModeMemory,
+					contracts.MetaKeyStoreContent: "true",
+				},
+			}, nil
+		})
+
+		if err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+		if len(repo.entries) != 1 {
+			t.Fatalf("expected 1 log entry, got %d", len(repo.entries))
+		}
+		if repo.entries[0].InboxMessageID != "inbox-msg-1" {
+			t.Errorf("expected inbox message id inbox-msg-1, got %s", repo.entries[0].InboxMessageID)
+		}
+	})
+
+	t.Run("provider dispatch with inbox capture stores inbox_message_id from meta", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodPost, "/v1/email", strings.NewReader(`{"to":["test@example.com"]}`))
+		rec := httptest.NewRecorder()
+		c := e.NewContext(req, rec)
+
+		repo := &mockLogRepo{}
+		svc := service.NewGatewayService(nil, nil, nil, nil, repo)
+		helper := NewSendHelper(svc)
+
+		var dst contracts.Email
+		err := helper.DispatchAndLog(c, "email", "ws-123", "key-456", "/v1/email", &dst, func(ctx context.Context) (*contracts.SendResult, error) {
+			return &contracts.SendResult{
+				ID: "provider-msg-1",
+				Meta: map[string]string{
+					contracts.MetaKeyProviderName:   "mailgun",
+					contracts.MetaKeyDispatchMode:   contracts.DispatchModeProvider,
+					contracts.MetaKeyInboxMessageID: "inbox-msg-2",
+				},
+			}, nil
+		})
+
+		if err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+		if repo.entries[0].InboxMessageID != "inbox-msg-2" {
+			t.Errorf("expected inbox message id inbox-msg-2, got %s", repo.entries[0].InboxMessageID)
+		}
+	})
+
+	t.Run("store_content persists request and response payloads", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodPost, "/v1/email", strings.NewReader(`{"to":["test@example.com"],"subject":"hi"}`))
+		rec := httptest.NewRecorder()
+		c := e.NewContext(req, rec)
+
+		repo := &mockLogRepo{}
 		svc := service.NewGatewayService(nil, nil, nil, nil, repo)
 		helper := NewSendHelper(svc)
 
 		var dst contracts.Email
 		err := helper.DispatchAndLog(c, "email", "ws-123", "key-456", "/v1/email", &dst, func(ctx context.Context) (*contracts.SendResult, error) {
+			r := &contracts.SendResult{ID: "msg-111", StatusCode: 200, Message: "sent"}
+			contracts.SetStoreContentMeta(r, true)
+			r.Meta[contracts.MetaKeyProviderName] = "mailgun"
+			return r, nil
+		})
+
+		if err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+		if len(repo.entries) != 1 {
+			t.Fatalf("expected 1 log entry, got %d", len(repo.entries))
+		}
+
+		log := repo.entries[0]
+		if log.Payload == nil {
+			t.Fatal("expected payload on log entry")
+		}
+		if !strings.Contains(log.Payload.RequestBody, "test@example.com") {
+			t.Errorf("request body missing recipient: %q", log.Payload.RequestBody)
+		}
+		if !strings.Contains(log.Payload.ResponseBody, "msg-111") {
+			t.Errorf("response body missing message id: %q", log.Payload.ResponseBody)
+		}
+	})
+
+	t.Run("store_content off skips payload", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodPost, "/v1/email", strings.NewReader(`{"to":["test@example.com"]}`))
+		rec := httptest.NewRecorder()
+		c := e.NewContext(req, rec)
+
+		repo := &mockLogRepo{}
+		svc := service.NewGatewayService(nil, nil, nil, nil, repo)
+		helper := NewSendHelper(svc)
+
+		var dst contracts.Email
+		err := helper.DispatchAndLog(c, "email", "ws-123", "key-456", "/v1/email", &dst, func(ctx context.Context) (*contracts.SendResult, error) {
+			r := &contracts.SendResult{ID: "msg-111"}
+			contracts.SetStoreContentMeta(r, false)
+			return r, nil
+		})
+
+		if err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+		if len(repo.entries) != 1 {
+			t.Fatalf("expected 1 log entry, got %d", len(repo.entries))
+		}
+		if repo.entries[0].Payload != nil {
+			t.Fatalf("expected no payload when store_content is false, got %+v", repo.entries[0].Payload)
+		}
+	})
+
+	t.Run("missing workspace returns unauthorized", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodPost, "/v1/email", strings.NewReader(`{"to":["test@example.com"]}`))
+		rec := httptest.NewRecorder()
+		c := e.NewContext(req, rec)
+
+		repo := &mockLogRepo{}
+		svc := service.NewGatewayService(nil, nil, nil, nil, repo)
+		helper := NewSendHelper(svc)
+
+		var dst contracts.Email
+		err := helper.DispatchAndLog(c, "email", "", "key-456", "/v1/email", &dst, func(ctx context.Context) (*contracts.SendResult, error) {
 			return &contracts.SendResult{ID: "msg-111"}, nil
 		})
 
 		if err != nil {
 			t.Fatalf("unexpected error: %v", err)
 		}
+		if rec.Code != http.StatusUnauthorized {
+			t.Errorf("expected status 401, got %d", rec.Code)
+		}
+		if len(repo.entries) != 0 {
+			t.Fatalf("expected no log entry without workspace, got %d", len(repo.entries))
+		}
+	})
 
-		if rec.Code != http.StatusOK {
-			t.Errorf("expected status OK, got %d", rec.Code)
+	t.Run("invalid JSON returns bad request", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodPost, "/v1/email", strings.NewReader(`{invalid`))
+		rec := httptest.NewRecorder()
+		c := e.NewContext(req, rec)
+
+		repo := &mockLogRepo{}
+		svc := service.NewGatewayService(nil, nil, nil, nil, repo)
+		helper := NewSendHelper(svc)
+
+		var dst contracts.Email
+		err := helper.DispatchAndLog(c, "email", "ws-123", "key-456", "/v1/email", &dst, func(ctx context.Context) (*contracts.SendResult, error) {
+			return &contracts.SendResult{ID: "msg-111"}, nil
+		})
+
+		if err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+		if rec.Code != http.StatusBadRequest {
+			t.Errorf("expected status 400, got %d", rec.Code)
+		}
+	})
+
+	t.Run("send failure returns 500 and logs error", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodPost, "/v1/email", strings.NewReader(`{"to":["test@example.com"]}`))
+		rec := httptest.NewRecorder()
+		c := e.NewContext(req, rec)
+
+		repo := &mockLogRepo{}
+		svc := service.NewGatewayService(nil, nil, nil, nil, repo)
+		helper := NewSendHelper(svc)
+
+		var dst contracts.Email
+		err := helper.DispatchAndLog(c, "email", "ws-123", "key-456", "/v1/email", &dst, func(ctx context.Context) (*contracts.SendResult, error) {
+			return nil, errors.New("dispatch failed")
+		})
+
+		if err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+		if rec.Code != http.StatusInternalServerError {
+			t.Errorf("expected status 500, got %d", rec.Code)
+		}
+		if len(repo.entries) != 1 || repo.entries[0].StatusCode != http.StatusInternalServerError {
+			t.Fatalf("expected error log entry, got %+v", repo.entries)
 		}
 	})
 }
diff --git a/internal/presentation/middleware/auth.go b/internal/presentation/middleware/auth.go
index bf9ddc0c..80c57f28 100644
--- a/internal/presentation/middleware/auth.go
+++ b/internal/presentation/middleware/auth.go
@@ -6,10 +6,13 @@ import (
 	"net/http"
 	"strings"
 
+	"github.com/google/uuid"
 	"github.com/labstack/echo/v4"
 
 	"github.com/weprodev/go-pkg/crypto"
 
+	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
+	"github.com/weprodev/wpd-message-gateway/internal/core/logctx"
 	"github.com/weprodev/wpd-message-gateway/internal/core/port"
 )
 
@@ -22,10 +25,17 @@ const (
 	APIKeyIDKey contextKey = "api_key_id"
 	// APIKeyNameKey is the context key for the API key display name (product/service label).
 	APIKeyNameKey contextKey = "api_key_name"
-	// HeaderWorkspaceKey is the HTTP header carrying the workspace slug.
+	// HeaderWorkspaceKey is the HTTP header carrying the workspace ID or slug.
 	HeaderWorkspaceKey = "X-Workspace-Key"
 )
 
+func resolveWorkspaceByKey(ctx context.Context, repo port.WorkspaceRepository, key string) (*domain.Workspace, error) {
+	if _, err := uuid.Parse(key); err == nil {
+		return repo.GetByID(ctx, key)
+	}
+	return repo.GetBySlug(ctx, key)
+}
+
 // APIKeyAuthMiddleware validates client credentials, optional workspace binding via X-Workspace-Key,
 // and records last_used_at on the API key.
 func APIKeyAuthMiddleware(apiKeyRepo port.APIKeyRepository, workspaceRepo port.WorkspaceRepository) echo.MiddlewareFunc {
@@ -63,9 +73,9 @@ func APIKeyAuthMiddleware(apiKeyRepo port.APIKeyRepository, workspaceRepo port.W
 			wsKey := strings.TrimSpace(c.Request().Header.Get(HeaderWorkspaceKey))
 			if wsKey == "" {
 				slog.WarnContext(c.Request().Context(), "API key auth failed: missing workspace key header", "client_id", clientID)
-				return echo.NewHTTPError(http.StatusBadRequest, "Missing "+HeaderWorkspaceKey+" (workspace slug)")
+				return echo.NewHTTPError(http.StatusBadRequest, "Missing "+HeaderWorkspaceKey+" (workspace id or slug)")
 			}
-			ws, werr := workspaceRepo.GetBySlug(c.Request().Context(), wsKey)
+			ws, werr := resolveWorkspaceByKey(c.Request().Context(), workspaceRepo, wsKey)
 			if werr != nil || ws == nil {
 				slog.WarnContext(c.Request().Context(), "API key auth failed: unknown workspace key", "client_id", clientID, "workspace_key", wsKey)
 				return echo.NewHTTPError(http.StatusForbidden, "Unknown workspace key")
@@ -76,14 +86,14 @@ func APIKeyAuthMiddleware(apiKeyRepo port.APIKeyRepository, workspaceRepo port.W
 			}
 
 			if err := apiKeyRepo.UpdateLastUsedAt(c.Request().Context(), apiKey.ID); err != nil {
-				// Non-fatal: continue request
-				_ = err
+				slog.WarnContext(c.Request().Context(), "failed to update API key last_used_at", "error", err, "api_key_id", apiKey.ID)
 			}
 
 			ctx := c.Request().Context()
 			ctx = context.WithValue(ctx, WorkspaceIDKey, apiKey.WorkspaceID)
 			ctx = context.WithValue(ctx, APIKeyIDKey, apiKey.ID)
 			ctx = context.WithValue(ctx, APIKeyNameKey, apiKey.Name)
+			ctx = logctx.WithWorkspace(ctx, apiKey.WorkspaceID, apiKey.ID)
 			c.SetRequest(c.Request().WithContext(ctx))
 			return next(c)
 		}
diff --git a/internal/presentation/middleware/auth_test.go b/internal/presentation/middleware/auth_test.go
new file mode 100644
index 00000000..908931f9
--- /dev/null
+++ b/internal/presentation/middleware/auth_test.go
@@ -0,0 +1,77 @@
+package middleware
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
+	"github.com/weprodev/wpd-message-gateway/internal/core/port"
+)
+
+type stubWorkspaceRepo struct {
+	byID   map[string]*domain.Workspace
+	bySlug map[string]*domain.Workspace
+}
+
+func (s *stubWorkspaceRepo) Create(context.Context, *domain.Workspace, string) error { return nil }
+func (s *stubWorkspaceRepo) Delete(context.Context, string) error                    { return nil }
+func (s *stubWorkspaceRepo) Update(context.Context, *domain.Workspace) error         { return nil }
+func (s *stubWorkspaceRepo) SetStatus(context.Context, string, string) error         { return nil }
+func (s *stubWorkspaceRepo) ListForUser(context.Context, string) ([]domain.Workspace, error) {
+	return nil, nil
+}
+
+func (s *stubWorkspaceRepo) GetByID(_ context.Context, id string) (*domain.Workspace, error) {
+	ws, ok := s.byID[id]
+	if !ok {
+		return nil, port.ErrNotFound
+	}
+	return ws, nil
+}
+
+func (s *stubWorkspaceRepo) GetBySlug(_ context.Context, slug string) (*domain.Workspace, error) {
+	ws, ok := s.bySlug[slug]
+	if !ok {
+		return nil, port.ErrNotFound
+	}
+	return ws, nil
+}
+
+func TestResolveWorkspaceByKey(t *testing.T) {
+	repo := &stubWorkspaceRepo{
+		byID: map[string]*domain.Workspace{
+			"00000000-0000-0000-0000-000000000001": {ID: "00000000-0000-0000-0000-000000000001", Slug: "demo"},
+		},
+		bySlug: map[string]*domain.Workspace{
+			"demo": {ID: "00000000-0000-0000-0000-000000000001", Slug: "demo"},
+		},
+	}
+
+	t.Run("resolves workspace id", func(t *testing.T) {
+		ws, err := resolveWorkspaceByKey(context.Background(), repo, "00000000-0000-0000-0000-000000000001")
+		if err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+		if ws.ID != "00000000-0000-0000-0000-000000000001" {
+			t.Fatalf("got id %q", ws.ID)
+		}
+	})
+
+	t.Run("resolves workspace slug", func(t *testing.T) {
+		ws, err := resolveWorkspaceByKey(context.Background(), repo, "demo")
+		if err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+		if ws.Slug != "demo" {
+			t.Fatalf("got slug %q", ws.Slug)
+		}
+	})
+
+	t.Run("unknown key returns not found", func(t *testing.T) {
+		_, err := resolveWorkspaceByKey(context.Background(), repo, "missing")
+		if !errors.Is(err, port.ErrNotFound) {
+			t.Fatalf("expected ErrNotFound, got %v", err)
+		}
+	})
+}
diff --git a/internal/presentation/middleware/rbac_test.go b/internal/presentation/middleware/rbac_test.go
index 2f3b012e..e4ea9ce8 100644
--- a/internal/presentation/middleware/rbac_test.go
+++ b/internal/presentation/middleware/rbac_test.go
@@ -30,7 +30,9 @@ func TestRequirePermission(t *testing.T) {
 	}
 	defer db.Close() //nolint:errcheck
 
-	gate := gogate.NewGate(db, nil)
+	gateCfg := gogate.DefaultConfig()
+	gateCfg.DefaultGuardName = domain.RBACGuardName
+	gate := gogate.NewGate(db, &gateCfg)
 
 	// Build echo instance
 	e := echo.New()
@@ -48,7 +50,7 @@ func TestRequirePermission(t *testing.T) {
 
 		// Mock the check query inside Gate.Check
 		mock.ExpectQuery(`SELECT 'role' AS type, r.name AS value FROM model_has_roles mhr JOIN roles r ON r.id = mhr.role_id WHERE mhr.model_type = \$1 AND mhr.model_id = \$2 AND mhr.team_id = \$5 AND r.guard_name = \$3 UNION ALL SELECT 'permission' AS type, p.name AS value FROM model_has_permissions mhp JOIN permissions p ON p.id = mhp.permission_id WHERE mhp.model_type = \$1 AND mhp.model_id = \$2 AND mhp.team_id = \$5 AND p.name = \$4 AND p.guard_name = \$3`).
-			WithArgs("users", "user-123", "web", domain.PermissionWorkspacesRead, "ws-1").
+			WithArgs("users", "user-123", "msg_web", domain.PermissionWorkspacesRead, "ws-1").
 			WillReturnRows(sqlmock.NewRows([]string{"type", "value"}).AddRow("permission", domain.PermissionWorkspacesRead))
 
 		wsRepo := &mockWorkspaceRepository{
@@ -89,7 +91,7 @@ func TestRequirePermission(t *testing.T) {
 		c.SetRequest(req.WithContext(ctx))
 
 		mock.ExpectQuery(`SELECT 'role' AS type, r.name AS value FROM model_has_roles mhr JOIN roles r ON r.id = mhr.role_id WHERE mhr.model_type = \$1 AND mhr.model_id = \$2 AND mhr.team_id = \$5 AND r.guard_name = \$3 UNION ALL SELECT 'permission' AS type, p.name AS value FROM model_has_permissions mhp JOIN permissions p ON p.id = mhp.permission_id WHERE mhp.model_type = \$1 AND mhp.model_id = \$2 AND mhp.team_id = \$5 AND p.name = \$4 AND p.guard_name = \$3`).
-			WithArgs("users", "user-123", "web", domain.PermissionWorkspacesWrite, "ws-1").
+			WithArgs("users", "user-123", "msg_web", domain.PermissionWorkspacesWrite, "ws-1").
 			WillReturnRows(sqlmock.NewRows([]string{"type", "value"})) // no rows matched
 
 		wsRepo := &mockWorkspaceRepository{
diff --git a/internal/presentation/router.go b/internal/presentation/router.go
index c1c9246b..f7fabe5a 100644
--- a/internal/presentation/router.go
+++ b/internal/presentation/router.go
@@ -2,13 +2,14 @@ package presentation
 
 import (
 	"log/slog"
+	"net/http"
 
 	"github.com/labstack/echo/v4"
 	echomiddleware "github.com/labstack/echo/v4/middleware"
 
 	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
+	"github.com/weprodev/wpd-message-gateway/internal/core/logctx"
 	"github.com/weprodev/wpd-message-gateway/internal/core/port"
-	applogger "github.com/weprodev/wpd-message-gateway/internal/infrastructure/logger"
 	"github.com/weprodev/wpd-message-gateway/internal/presentation/handler"
 	customMiddleware "github.com/weprodev/wpd-message-gateway/internal/presentation/middleware"
 
@@ -68,29 +69,33 @@ func NewRouter(
 	}
 }
 
-// Setup configures Echo with all routes.
-func (rt *Router) Setup() *echo.Echo {
-	e := echo.New()
-	e.HideBanner = true
-	e.HTTPErrorHandler = pkgapi.NewEchoErrorHandler(rt.logger.Logger).EchoHandler
-	e.Validator = pkgvalidator.NewValidator()
-
-	e.Use(echomiddleware.Recover())
-	e.Use(echomiddleware.RequestID())
-	e.Use(func(next echo.HandlerFunc) echo.HandlerFunc {
+// enrichRequestIDContext copies Echo's X-Request-ID into the request context for slog correlation.
+func enrichRequestIDContext() echo.MiddlewareFunc {
+	return func(next echo.HandlerFunc) echo.HandlerFunc {
 		return func(c echo.Context) error {
 			reqID := c.Response().Header().Get(echo.HeaderXRequestID)
 			if reqID == "" {
 				reqID = c.Request().Header.Get(echo.HeaderXRequestID)
 			}
 			if reqID != "" {
-				ctx := c.Request().Context()
-				ctx = applogger.WithRequestID(ctx, reqID)
+				ctx := logctx.WithRequestID(c.Request().Context(), reqID)
 				c.SetRequest(c.Request().WithContext(ctx))
 			}
 			return next(c)
 		}
-	})
+	}
+}
+
+// Setup configures Echo with all routes.
+func (rt *Router) Setup() *echo.Echo {
+	e := echo.New()
+	e.HideBanner = true
+	e.HTTPErrorHandler = pkgapi.NewEchoErrorHandler(rt.logger.Logger).EchoHandler
+	e.Validator = pkgvalidator.NewValidator()
+
+	e.Use(echomiddleware.Recover())
+	e.Use(echomiddleware.RequestID())
+	e.Use(enrichRequestIDContext())
 	e.Use(echomiddleware.RequestLoggerWithConfig(echomiddleware.RequestLoggerConfig{
 		LogStatus:   true,
 		LogURI:      true,
@@ -108,6 +113,10 @@ func (rt *Router) Setup() *echo.Echo {
 			return nil
 		},
 	}))
+	e.GET("/health", func(c echo.Context) error {
+		return c.JSON(http.StatusOK, map[string]string{"status": "ok"})
+	})
+
 	e.Use(echomiddleware.CORSWithConfig(echomiddleware.CORSConfig{
 		AllowOrigins: []string{"*"},
 		AllowMethods: []string{echo.GET, echo.POST, echo.PUT, echo.PATCH, echo.DELETE, echo.OPTIONS},
@@ -176,34 +185,32 @@ func (rt *Router) Setup() *echo.Echo {
 
 	protected.GET("/workspaces/:wid/invitations", pw.ListInvitations, customMiddleware.RequirePermission(rt.gate, rt.workspaceRepo, domain.PermissionInvitationsRead))
 	protected.POST("/workspaces/:wid/invitations", pw.CreateInvitation, customMiddleware.RequirePermission(rt.gate, rt.workspaceRepo, domain.PermissionInvitationsWrite))
-	protected.POST("/workspaces/:wid/send-test/:channel", ph.SendTest, customMiddleware.RequirePermission(rt.gate, rt.workspaceRepo, domain.PermissionSendTest))
 
-	// Inbox API — always enabled (portal is always on).
+	// Inbox API — JWT + logs.read (same access model as message logs overview).
 	if rt.memberRepo != nil {
 		inbox := rt.portalInboxHandler
 		inboxGroup := api.Group("/workspaces/:wid/inbox")
 		inboxGroup.Use(customMiddleware.PortalJWTBearerOrQuery(rt.jwtSecret))
-		inboxGroup.Use(customMiddleware.RequireWorkspaceMember(rt.memberRepo))
-		inboxGroup.Use(customMiddleware.RequireWorkspaceAPIKey(rt.apiKeyRepo))
+		inboxGroup.Use(customMiddleware.RequirePermission(rt.gate, rt.workspaceRepo, domain.PermissionLogsRead))
 		inboxGroup.GET("/stats", inbox.HandleStats)
 		inboxGroup.GET("/emails", inbox.HandleGetEmails)
 		inboxGroup.GET("/emails/:id", inbox.HandleGetEmailByID)
-		inboxGroup.DELETE("/emails/:id", inbox.HandleDeleteEmailByID)
 		inboxGroup.GET("/sms", inbox.HandleGetSMS)
 		inboxGroup.GET("/sms/:id", inbox.HandleGetSMSByID)
-		inboxGroup.DELETE("/sms/:id", inbox.HandleDeleteSMSByID)
 		inboxGroup.GET("/push", inbox.HandleGetPush)
 		inboxGroup.GET("/push/:id", inbox.HandleGetPushByID)
-		inboxGroup.DELETE("/push/:id", inbox.HandleDeletePushByID)
 		inboxGroup.GET("/chat", inbox.HandleGetChat)
 		inboxGroup.GET("/chat/:id", inbox.HandleGetChatByID)
-		inboxGroup.DELETE("/chat/:id", inbox.HandleDeleteChatByID)
-		inboxGroup.DELETE("/messages", inbox.HandleClearAll)
 		inboxGroup.GET("/events", inbox.HandleSSE)
+		inboxGroup.DELETE("/emails/:id", inbox.HandleDeleteEmailByID, customMiddleware.RequirePermission(rt.gate, rt.workspaceRepo, domain.PermissionInboxWrite))
+		inboxGroup.DELETE("/sms/:id", inbox.HandleDeleteSMSByID, customMiddleware.RequirePermission(rt.gate, rt.workspaceRepo, domain.PermissionInboxWrite))
+		inboxGroup.DELETE("/push/:id", inbox.HandleDeletePushByID, customMiddleware.RequirePermission(rt.gate, rt.workspaceRepo, domain.PermissionInboxWrite))
+		inboxGroup.DELETE("/chat/:id", inbox.HandleDeleteChatByID, customMiddleware.RequirePermission(rt.gate, rt.workspaceRepo, domain.PermissionInboxWrite))
+		inboxGroup.DELETE("/messages", inbox.HandleClearAll, customMiddleware.RequirePermission(rt.gate, rt.workspaceRepo, domain.PermissionInboxWrite))
 
 		internal := api.Group("/workspaces/:wid/internal")
 		internal.Use(customMiddleware.PortalJWTBearerOrQuery(rt.jwtSecret))
-		internal.Use(customMiddleware.RequireWorkspaceMember(rt.memberRepo))
+		internal.Use(customMiddleware.RequirePermission(rt.gate, rt.workspaceRepo, domain.PermissionInboxWrite))
 		internal.POST("/email", inbox.HandleIngestEmail)
 		internal.POST("/sms", inbox.HandleIngestSMS)
 		internal.POST("/push", inbox.HandleIngestPush)
diff --git a/internal/presentation/router_test.go b/internal/presentation/router_test.go
new file mode 100644
index 00000000..b6718817
--- /dev/null
+++ b/internal/presentation/router_test.go
@@ -0,0 +1,59 @@
+package presentation
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/labstack/echo/v4"
+	echomiddleware "github.com/labstack/echo/v4/middleware"
+
+	"github.com/weprodev/wpd-message-gateway/internal/core/logctx"
+)
+
+func TestEnrichRequestIDContext_fromEchoMiddleware(t *testing.T) {
+	t.Parallel()
+
+	e := echo.New()
+	e.Use(echomiddleware.RequestID())
+	e.Use(enrichRequestIDContext())
+	e.GET("/", func(c echo.Context) error {
+		if logctx.GetRequestID(c.Request().Context()) == "" {
+			t.Fatal("expected request_id in context")
+		}
+		return c.NoContent(http.StatusNoContent)
+	})
+
+	req := httptest.NewRequest(http.MethodGet, "/", nil)
+	rec := httptest.NewRecorder()
+	e.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusNoContent {
+		t.Fatalf("status: got %d", rec.Code)
+	}
+	if rec.Header().Get(echo.HeaderXRequestID) == "" {
+		t.Fatal("expected X-Request-ID response header")
+	}
+}
+
+func TestEnrichRequestIDContext_honorsInboundHeader(t *testing.T) {
+	t.Parallel()
+
+	e := echo.New()
+	e.Use(enrichRequestIDContext())
+	e.GET("/", func(c echo.Context) error {
+		if got := logctx.GetRequestID(c.Request().Context()); got != "req-inbound" {
+			t.Fatalf("request_id: got %q want req-inbound", got)
+		}
+		return c.NoContent(http.StatusNoContent)
+	})
+
+	req := httptest.NewRequest(http.MethodGet, "/", nil)
+	req.Header.Set(echo.HeaderXRequestID, "req-inbound")
+	rec := httptest.NewRecorder()
+	e.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusNoContent {
+		t.Fatalf("status: got %d", rec.Code)
+	}
+}
diff --git a/pkg/README.md b/pkg/README.md
index 67904a96..d9f4acd4 100644
--- a/pkg/README.md
+++ b/pkg/README.md
@@ -1,110 +1,114 @@
-# WPD Message Gateway SDK
+# WPD Message Gateway SDK (`pkg/`)
 
-The `pkg` directory contains the core SDK for the WPD Message Gateway. It is fully independent from the portal and backend infrastructure, providing a clean, decoupled interface for 3rd party clients and external systems to integrate with multiple messaging providers (Email, SMS, Push, Chat).
+The `pkg/` tree is the **embedded Go SDK** — fully independent from `internal/`, PostgreSQL, and the HTTP portal. Third-party apps import it to send email, SMS, push, and chat through provider plugins without running the gateway server.
 
-## Architecture & Concepts
+**Iron rule:** `pkg/*` must **never** import `internal/*`. Enforced by `pkg/import_boundary_test.go`.
 
-The SDK adheres to clean architecture, Domain-Driven Design (DDD), and SOLID principles:
+## Packages
 
-- **`contracts/`**: Contains the pure domain interfaces (`EmailSender`, `SMSSender`, etc.) and data models (`Email`, `SMS`, `SendResult`). This acts as the universal language across all providers.
-- **`provider/`**: Contains the concrete implementations of those contracts for specific services (e.g., `mailgun`). It also includes a `memory` provider for mocking, testing, and gateway interception.
-- **`registry/`**: A central factory registry that allows dynamic registration and instantiation of providers based on arbitrary configuration maps.
-- **`gateway/`**: Exposes generic client definitions for REST integrations if needed.
+| Package | Role |
+| ------- | ---- |
+| `contracts/` | Channel message types and sender interfaces (`EmailSender`, `SMSSender`, …) |
+| `registry/` | Provider factory registry (register + resolve by name) |
+| `provider/*` | Concrete providers (`mailgun`, `memory`, …) |
+| `gateway/` | High-level `gateway.New(Config)` facade for in-process use |
 
-## How to Use as a Client
-
-Any external system or 3rd party application can import this package to seamlessly send messages through any supported provider without worrying about the underlying HTTP clients or vendor SDKs.
-
-### 1. Direct Provider Usage
-
-If you know exactly which provider you want to use, you can instantiate it directly using the contract interface:
+## Mode 1 — Embedded SDK (no server, no DB)
 
 ```go
-package main
-
 import (
-	"context"
-	"log"
+    "context"
 
-	"github.com/weprodev/wpd-message-gateway/pkg/contracts"
-	"github.com/weprodev/wpd-message-gateway/pkg/provider/mailgun"
+    "github.com/weprodev/wpd-message-gateway/pkg/contracts"
+    "github.com/weprodev/wpd-message-gateway/pkg/gateway"
+    _ "github.com/weprodev/wpd-message-gateway/pkg/provider/memory" // registers "memory"
 )
 
 func main() {
-	// 1. Configure the specific provider
-	sender, err := mailgun.New(mailgun.Config{
-		Domain:    "your-domain.com",
-		APIKey:    "your-api-key",
-		FromEmail: "no-reply@your-domain.com",
-	})
-	if err != nil {
-		log.Fatal(err)
-	}
-
-	// 2. Build the standard contract message
-	email := &contracts.Email{
-		To:      []string{"user@example.com"},
-		Subject: "Welcome to WPD",
-		HTML:    "<h1>Hello World</h1>",
-		From:    "no-reply@your-domain.com",
-	}
-
-	// 3. Send using the unified interface
-	result, err := sender.Send(context.Background(), email)
-	if err != nil {
-		log.Fatal(err)
-	}
-	
-	log.Printf("Sent! ID: %s", result.ID)
+    gw, err := gateway.New(gateway.Config{
+        DefaultEmailProvider: "memory",
+        EmailProviders: map[string]gateway.EmailConfig{
+            "memory": {},
+        },
+    })
+    if err != nil {
+        panic(err)
+    }
+
+    result, err := gw.SendEmail(context.Background(), &contracts.Email{
+        To:      []string{"user@example.com"},
+        Subject: "Hello",
+        HTML:    "<p>Hi</p>",
+    })
+    if err != nil {
+        panic(err)
+    }
+    _ = result.ID
 }
 ```
 
-### 2. Dynamic Provider Resolution (Registry)
+Import only the providers you need via blank import, or use `pkg/gateway` which bundles common providers through `gateway/imports.go`.
 
-For systems that store configurations dynamically (e.g., in a database), you can use the Registry. This allows you to swap providers at runtime without changing your code:
+## Mode 2 — Dynamic resolution via registry
 
-```go
-package main
+For config loaded from your own store (not this repo's PostgreSQL):
 
+```go
 import (
-	"context"
-	"log"
+    "encoding/json"
 
-	"github.com/weprodev/wpd-message-gateway/pkg/contracts"
-	"github.com/weprodev/wpd-message-gateway/pkg/registry"
-	_ "github.com/weprodev/wpd-message-gateway/pkg/provider/mailgun" // Import for side-effects (registration)
+    "github.com/weprodev/wpd-message-gateway/pkg/registry"
+    _ "github.com/weprodev/wpd-message-gateway/pkg/provider/mailgun"
 )
 
 func main() {
-	// Configuration loaded from your DB or Environment
-	config := map[string]interface{}{
-		"domain":  "your-domain.com",
-		"api_key": "your-api-key",
-	}
-
-	// Instantiate the provider dynamically by name
-	sender, err := registry.BuildEmailSender("mailgun", config)
-	if err != nil {
-		log.Fatal(err)
-	}
-
-	email := &contracts.Email{
-		To:      []string{"user@example.com"},
-		Subject: "Dynamic Send",
-		HTML:    "<p>Works perfectly.</p>",
-		From:    "no-reply@your-domain.com",
-	}
-
-	result, err := sender.Send(context.Background(), email)
-	if err != nil {
-		log.Fatal(err)
-	}
+    raw := map[string]any{
+        "api_key":    "key-xxx",
+        "domain":     "mg.example.com",
+        "from_email": "noreply@example.com",
+    }
+    b, _ := json.Marshal(raw)
+
+    factory, err := registry.GetEmailFactory("mailgun")
+    if err != nil {
+        panic(err)
+    }
+
+    var cfg registry.EmailConfig
+    if err := json.Unmarshal(b, &cfg); err != nil {
+        panic(err)
+    }
+
+    sender, err := factory(cfg)
+    if err != nil {
+        panic(err)
+    }
+    _ = sender
 }
 ```
 
-## Creating a New Provider
+## Direct provider usage
+
+```go
+import (
+    "github.com/weprodev/wpd-message-gateway/pkg/contracts"
+    "github.com/weprodev/wpd-message-gateway/pkg/provider/mailgun"
+)
+
+sender, err := mailgun.New(mailgun.Config{
+    Domain:    "mg.example.com",
+    APIKey:    "key-xxx",
+    FromEmail: "noreply@example.com",
+})
+```
+
+## Adding a provider
+
+1. Create `pkg/provider/<name>/`
+2. Implement the relevant `contracts.*Sender` interface
+3. Register in `init()` via `registry.RegisterEmailProvider` (or SMS/push/chat)
+4. Add tests colocated in the provider package
+
+## Relationship to HTTP server
 
-To add a new provider (e.g., Twilio for SMS):
-1. Create a new folder in `pkg/provider/twilio`.
-2. Implement the relevant contract (`contracts.SMSSender`).
-3. Add a builder function and register it via `registry.RegisterSMSBuilder("twilio", builderFn)` in an `init()` block.
+The HTTP server (`cmd/server`, `internal/`) uses the **same** `pkg/contracts` and `pkg/registry` but loads integration config from PostgreSQL. Portal UI and `/v1/*` routes are **not** part of `pkg/`.
diff --git a/pkg/contracts/message.go b/pkg/contracts/message.go
index b4d1f020..e20ea0c6 100644
--- a/pkg/contracts/message.go
+++ b/pkg/contracts/message.go
@@ -8,6 +8,20 @@ type Attachment struct {
 	URL         string `json:"url,omitempty"`
 }
 
+const (
+	MetaKeyProviderName   = "provider_name"
+	MetaKeyStoreContent   = "store_content"
+	MetaKeyInboxMessageID = "inbox_message_id"
+	MetaKeyDispatchMode   = "dispatch_mode"
+
+	// Dispatch mode values mirror domain.MessageDispatchMode
+	DispatchModeMemory   = "memory"
+	DispatchModeProvider = "provider"
+
+	metaStoreContentTrue  = "true"
+	metaStoreContentFalse = "false"
+)
+
 // SendResult represents the result of sending a message.
 type SendResult struct {
 	ID         string            `json:"id"`
@@ -15,3 +29,67 @@ type SendResult struct {
 	Message    string            `json:"message"`
 	Meta       map[string]string `json:"meta,omitempty"`
 }
+
+// ProviderNameFromResult returns provider_name from dispatch metadata when present.
+func ProviderNameFromResult(r *SendResult) string {
+	if r == nil || r.Meta == nil {
+		return ""
+	}
+	return r.Meta[MetaKeyProviderName]
+}
+
+// DispatchModeFromResult returns dispatch_mode from metadata when present.
+func DispatchModeFromResult(r *SendResult) string {
+	if r == nil || r.Meta == nil {
+		return ""
+	}
+	return r.Meta[MetaKeyDispatchMode]
+}
+
+// StoreContentFromResult reports whether dispatch metadata requests persisting request/response bodies.
+func StoreContentFromResult(r *SendResult) bool {
+	if r == nil || r.Meta == nil {
+		return false
+	}
+	return r.Meta[MetaKeyStoreContent] == metaStoreContentTrue
+}
+
+// InboxMessageIDFromResult returns the inbox message ID when dispatch captured content in the portal inbox.
+//
+// Provider dispatch stores the inbox UUID in MetaKeyInboxMessageID; SendResult.ID is the provider ID.
+// Memory dispatch with store_message_content stores the inbox UUID in SendResult.ID.
+func InboxMessageIDFromResult(r *SendResult) string {
+	if r == nil || r.Meta == nil {
+		return ""
+	}
+	if id := r.Meta[MetaKeyInboxMessageID]; id != "" {
+		return id
+	}
+	if !StoreContentFromResult(r) {
+		return ""
+	}
+	if r.Meta[MetaKeyDispatchMode] == DispatchModeMemory && r.ID != "" {
+		return r.ID
+	}
+	return ""
+}
+
+// SetStoreContentMeta stamps store_content on r.Meta for downstream logging.
+func SetStoreContentMeta(r *SendResult, storeContent bool) {
+	if r.Meta == nil {
+		r.Meta = make(map[string]string)
+	}
+	if storeContent {
+		r.Meta[MetaKeyStoreContent] = metaStoreContentTrue
+	} else {
+		r.Meta[MetaKeyStoreContent] = metaStoreContentFalse
+	}
+}
+
+// SetDispatchModeMeta stamps dispatch_mode on r.Meta.
+func SetDispatchModeMeta(r *SendResult, mode string) {
+	if r.Meta == nil {
+		r.Meta = make(map[string]string)
+	}
+	r.Meta[MetaKeyDispatchMode] = mode
+}
diff --git a/pkg/contracts/message_test.go b/pkg/contracts/message_test.go
new file mode 100644
index 00000000..9da8a79c
--- /dev/null
+++ b/pkg/contracts/message_test.go
@@ -0,0 +1,138 @@
+package contracts
+
+import "testing"
+
+func TestStoreContentFromResult(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name string
+		r    *SendResult
+		want bool
+	}{
+		{"nil result", nil, false},
+		{"nil meta", &SendResult{ID: "1"}, false},
+		{"false", &SendResult{Meta: map[string]string{MetaKeyStoreContent: metaStoreContentFalse}}, false},
+		{"true", &SendResult{Meta: map[string]string{MetaKeyStoreContent: metaStoreContentTrue}}, true},
+		{"missing key", &SendResult{Meta: map[string]string{}}, false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			if got := StoreContentFromResult(tt.r); got != tt.want {
+				t.Fatalf("StoreContentFromResult() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestDispatchModeFromResult(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name string
+		r    *SendResult
+		want string
+	}{
+		{"nil result", nil, ""},
+		{"memory", &SendResult{Meta: map[string]string{MetaKeyDispatchMode: DispatchModeMemory}}, DispatchModeMemory},
+		{"provider", &SendResult{Meta: map[string]string{MetaKeyDispatchMode: DispatchModeProvider}}, DispatchModeProvider},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			if got := DispatchModeFromResult(tt.r); got != tt.want {
+				t.Fatalf("DispatchModeFromResult() = %q, want %q", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestInboxMessageIDFromResult(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name string
+		r    *SendResult
+		want string
+	}{
+		{"nil result", nil, ""},
+		{"provider without inbox", &SendResult{ID: "prov-1", Meta: map[string]string{MetaKeyDispatchMode: DispatchModeProvider}}, ""},
+		{"memory mode retained", &SendResult{
+			ID: "inbox-1",
+			Meta: map[string]string{
+				MetaKeyDispatchMode: DispatchModeMemory,
+				MetaKeyStoreContent: metaStoreContentTrue,
+			},
+		}, "inbox-1"},
+		{"memory mode not retained", &SendResult{
+			ID: "mem-1",
+			Meta: map[string]string{
+				MetaKeyDispatchMode: DispatchModeMemory,
+				MetaKeyStoreContent: metaStoreContentFalse,
+			},
+		}, ""},
+		{"provider with inbox meta", &SendResult{
+			ID: "prov-1",
+			Meta: map[string]string{
+				MetaKeyDispatchMode:   DispatchModeProvider,
+				MetaKeyInboxMessageID: "inbox-2",
+			},
+		}, "inbox-2"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			if got := InboxMessageIDFromResult(tt.r); got != tt.want {
+				t.Fatalf("InboxMessageIDFromResult() = %q, want %q", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestSetStoreContentMeta(t *testing.T) {
+	t.Parallel()
+
+	t.Run("true", func(t *testing.T) {
+		t.Parallel()
+		r := &SendResult{}
+		SetStoreContentMeta(r, true)
+		if r.Meta[MetaKeyStoreContent] != metaStoreContentTrue {
+			t.Fatalf("meta: %q", r.Meta[MetaKeyStoreContent])
+		}
+	})
+
+	t.Run("false", func(t *testing.T) {
+		t.Parallel()
+		r := &SendResult{Meta: map[string]string{"other": "x"}}
+		SetStoreContentMeta(r, false)
+		if r.Meta[MetaKeyStoreContent] != metaStoreContentFalse {
+			t.Fatalf("meta: %q", r.Meta[MetaKeyStoreContent])
+		}
+		if r.Meta["other"] != "x" {
+			t.Fatalf("unexpected meta overwrite")
+		}
+	})
+}
+
+func TestSetDispatchModeMeta(t *testing.T) {
+	t.Parallel()
+
+	r := &SendResult{}
+	SetDispatchModeMeta(r, DispatchModeProvider)
+	if got := DispatchModeFromResult(r); got != DispatchModeProvider {
+		t.Fatalf("dispatch_mode: %q", got)
+	}
+}
+
+func TestDispatchModeValuesMatchDomain(t *testing.T) {
+	t.Parallel()
+
+	// Document the cross-package contract without importing internal/domain.
+	if DispatchModeMemory != "memory" || DispatchModeProvider != "provider" {
+		t.Fatal("dispatch mode constants must stay aligned with domain.MessageDispatchMode")
+	}
+}
diff --git a/pkg/import_boundary_test.go b/pkg/import_boundary_test.go
new file mode 100644
index 00000000..b5aa2158
--- /dev/null
+++ b/pkg/import_boundary_test.go
@@ -0,0 +1,45 @@
+package pkg_test
+
+import (
+	"go/parser"
+	"go/token"
+	"io/fs"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestPkgDoesNotImportInternal(t *testing.T) {
+	t.Parallel()
+
+	const forbidden = "github.com/weprodev/wpd-message-gateway/internal/"
+	fset := token.NewFileSet()
+
+	err := filepath.WalkDir(".", func(path string, d fs.DirEntry, walkErr error) error {
+		if walkErr != nil {
+			return walkErr
+		}
+		if d.IsDir() {
+			return nil
+		}
+		if !strings.HasSuffix(path, ".go") || strings.HasSuffix(path, "_test.go") {
+			return nil
+		}
+
+		file, err := parser.ParseFile(fset, path, nil, parser.ImportsOnly)
+		if err != nil {
+			return err
+		}
+
+		for _, imp := range file.Imports {
+			importPath := strings.Trim(imp.Path.Value, `"`)
+			if strings.HasPrefix(importPath, forbidden) {
+				t.Errorf("%s imports forbidden package %s", path, importPath)
+			}
+		}
+		return nil
+	})
+	if err != nil {
+		t.Fatalf("walk pkg: %v", err)
+	}
+}
diff --git a/pkg/provider/mailgun/mailgun_test.go b/pkg/provider/mailgun/mailgun_test.go
new file mode 100644
index 00000000..7088fac7
--- /dev/null
+++ b/pkg/provider/mailgun/mailgun_test.go
@@ -0,0 +1,123 @@
+package mailgun
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/weprodev/wpd-message-gateway/pkg/contracts"
+)
+
+func TestNew_validationErrors(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name    string
+		cfg     Config
+		wantErr string
+	}{
+		{
+			name:    "missing api key",
+			cfg:     Config{Domain: "mg.example.com"},
+			wantErr: "API key is required",
+		},
+		{
+			name:    "missing domain",
+			cfg:     Config{APIKey: "key-123"},
+			wantErr: "domain is required",
+		},
+	}
+
+	for _, tt := range tests {
+		tt := tt
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			_, err := New(tt.cfg)
+			if err == nil {
+				t.Fatal("expected error")
+			}
+			if !strings.Contains(err.Error(), tt.wantErr) {
+				t.Fatalf("expected %q in error, got %v", tt.wantErr, err)
+			}
+		})
+	}
+}
+
+func TestNew_success(t *testing.T) {
+	t.Parallel()
+
+	p, err := New(Config{APIKey: "key-123", Domain: "mg.example.com", FromEmail: "noreply@mg.example.com"})
+	if err != nil {
+		t.Fatalf("New: %v", err)
+	}
+	if p.fromAddress != "noreply@mg.example.com" {
+		t.Fatalf("expected from address on provider, got %q", p.fromAddress)
+	}
+}
+
+func TestProvider_buildFromAddress(t *testing.T) {
+	t.Parallel()
+
+	defaultProvider := &Provider{
+		fromAddress: "noreply@mg.example.com",
+		fromName:    "Acme",
+	}
+
+	tests := []struct {
+		name     string
+		provider *Provider
+		email    contracts.Email
+		want     string
+	}{
+		{
+			name:     "email overrides defaults",
+			provider: defaultProvider,
+			email:    contracts.Email{From: "custom@example.com", FromName: "Custom"},
+			want:     "Custom <custom@example.com>",
+		},
+		{
+			name:     "uses provider defaults",
+			provider: defaultProvider,
+			email:    contracts.Email{},
+			want:     "Acme <noreply@mg.example.com>",
+		},
+		{
+			name:     "email from with default name",
+			provider: defaultProvider,
+			email:    contracts.Email{From: "only@example.com"},
+			want:     "Acme <only@example.com>",
+		},
+		{
+			name:     "address only when no name",
+			provider: &Provider{fromAddress: "noreply@mg.example.com"},
+			email:    contracts.Email{From: "plain@example.com"},
+			want:     "plain@example.com",
+		},
+		{
+			name:     "empty when no address available",
+			provider: &Provider{fromName: "Name Only"},
+			email:    contracts.Email{},
+			want:     "",
+		},
+	}
+
+	for _, tt := range tests {
+		tt := tt
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			got := tt.provider.buildFromAddress(tt.email)
+			if got != tt.want {
+				t.Fatalf("buildFromAddress() = %q, want %q", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestProvider_Send_rejectsMissingFrom(t *testing.T) {
+	t.Parallel()
+
+	p := &Provider{}
+	_, err := p.Send(t.Context(), contracts.Email{To: []string{"a@b.com"}})
+	if err == nil || err.Error() != "no from address specified" {
+		t.Fatalf("expected missing from error, got %v", err)
+	}
+}
diff --git a/tests/bruno/Portal/00_Auth/Login.bru b/tests/bruno/Portal/00_Auth/Login.bru
index feb7c255..03ece0ac 100644
--- a/tests/bruno/Portal/00_Auth/Login.bru
+++ b/tests/bruno/Portal/00_Auth/Login.bru
@@ -23,5 +23,5 @@ tests {
     expect(res.body.token).to.be.a("string");
   });
 
-  bru.setEnvVar("portalJwt", res.body.token);
+  bru.setVar("portalJwt", res.body.token);
 }
diff --git a/tests/bruno/Portal/00_Auth/Register.bru b/tests/bruno/Portal/00_Auth/Register.bru
index f3b6b7cf..f9d05fae 100644
--- a/tests/bruno/Portal/00_Auth/Register.bru
+++ b/tests/bruno/Portal/00_Auth/Register.bru
@@ -14,7 +14,7 @@ body:json {
   {
     "first_name": "Test",
     "last_name": "User",
-    "email": "newuser@example.com",
+    "email": "bruno-{{$timestamp}}@example.com",
     "password": "password123"
   }
 }
@@ -23,6 +23,6 @@ tests {
   test("should register user successfully", function() {
     expect(res.status).to.equal(201);
     expect(res.body.id).to.be.a("string");
-    expect(res.body.email).to.equal("newuser@example.com");
+    expect(res.body.email).to.match(/^bruno-\d+@example\.com$/);
   });
 }
diff --git a/tests/bruno/Portal/Chat/List Chat.bru b/tests/bruno/Portal/Chat/List Chat.bru
index 83361af0..3a988d9d 100644
--- a/tests/bruno/Portal/Chat/List Chat.bru	
+++ b/tests/bruno/Portal/Chat/List Chat.bru	
@@ -22,13 +22,15 @@ tests {
     expect(res.status).to.equal(200);
   });
 
-  test("should return array", function() {
-    expect(res.body).to.be.an("array");
+  test("should return paginated page", function() {
+    expect(res.body).to.be.an("object");
+    expect(res.body.items).to.be.an("array");
+    expect(res.body).to.have.property("has_more");
   });
 
   test("should have chat with required fields", function() {
-    if (res.body.length > 0) {
-      const chat = res.body[0];
+    if (res.body.items.length > 0) {
+      const chat = res.body.items[0];
       expect(chat).to.have.property("id");
       expect(chat).to.have.property("chat");
       expect(chat).to.have.property("created_at");
diff --git a/tests/bruno/Portal/Email/List Emails.bru b/tests/bruno/Portal/Email/List Emails.bru
index ea09c26e..7c6230d5 100644
--- a/tests/bruno/Portal/Email/List Emails.bru	
+++ b/tests/bruno/Portal/Email/List Emails.bru	
@@ -12,23 +12,22 @@ get {
 
 headers {
   Authorization: Bearer {{portalJwt}}
-  X-Api-Client-Id: {{apiClientId}}
-  X-Api-Client-Secret: {{apiSecret}}
 }
 
-
 tests {
   test("should return 200", function() {
     expect(res.status).to.equal(200);
   });
 
-  test("should return array", function() {
-    expect(res.body).to.be.an("array");
+  test("should return paginated page", function() {
+    expect(res.body).to.be.an("object");
+    expect(res.body.items).to.be.an("array");
+    expect(res.body).to.have.property("has_more");
   });
 
   test("should have email with required fields", function() {
-    if (res.body.length > 0) {
-      const email = res.body[0];
+    if (res.body.items.length > 0) {
+      const email = res.body.items[0];
       expect(email).to.have.property("id");
       expect(email).to.have.property("email");
       expect(email).to.have.property("created_at");
diff --git a/tests/bruno/Portal/Push/List Push.bru b/tests/bruno/Portal/Push/List Push.bru
index cbc9f171..038fff84 100644
--- a/tests/bruno/Portal/Push/List Push.bru	
+++ b/tests/bruno/Portal/Push/List Push.bru	
@@ -22,13 +22,15 @@ tests {
     expect(res.status).to.equal(200);
   });
 
-  test("should return array", function() {
-    expect(res.body).to.be.an("array");
+  test("should return paginated page", function() {
+    expect(res.body).to.be.an("object");
+    expect(res.body.items).to.be.an("array");
+    expect(res.body).to.have.property("has_more");
   });
 
   test("should have push with required fields", function() {
-    if (res.body.length > 0) {
-      const push = res.body[0];
+    if (res.body.items.length > 0) {
+      const push = res.body.items[0];
       expect(push).to.have.property("id");
       expect(push).to.have.property("push");
       expect(push).to.have.property("created_at");
diff --git a/tests/bruno/Portal/SMS/List SMS.bru b/tests/bruno/Portal/SMS/List SMS.bru
index 119059fa..1aa9e4a9 100644
--- a/tests/bruno/Portal/SMS/List SMS.bru	
+++ b/tests/bruno/Portal/SMS/List SMS.bru	
@@ -22,13 +22,15 @@ tests {
     expect(res.status).to.equal(200);
   });
 
-  test("should return array", function() {
-    expect(res.body).to.be.an("array");
+  test("should return paginated page", function() {
+    expect(res.body).to.be.an("object");
+    expect(res.body.items).to.be.an("array");
+    expect(res.body).to.have.property("has_more");
   });
 
   test("should have SMS with required fields", function() {
-    if (res.body.length > 0) {
-      const sms = res.body[0];
+    if (res.body.items.length > 0) {
+      const sms = res.body.items[0];
       expect(sms).to.have.property("id");
       expect(sms).to.have.property("sms");
       expect(sms).to.have.property("created_at");
diff --git a/tests/bruno/Portal/Workspaces/Create Workspace.bru b/tests/bruno/Portal/Workspaces/Create Workspace.bru
index 00cc30f6..75019fa9 100644
--- a/tests/bruno/Portal/Workspaces/Create Workspace.bru	
+++ b/tests/bruno/Portal/Workspaces/Create Workspace.bru	
@@ -17,7 +17,7 @@ auth:bearer {
 body:json {
   {
     "name": "New Test Workspace",
-    "slug": "new-test-workspace",
+    "slug": "bruno-ws-{{$timestamp}}",
     "icon_key": "package"
   }
 }