From d8ce8d16f8a31b1cdfabcb33faabdf4c20a5f7d3 Mon Sep 17 00:00:00 2001
From: MichaelAndish <maikel1370@gmail.com>
Date: Thu, 2 Jul 2026 23:10:49 +0200
Subject: [PATCH 01/20] WPD-33-feat: refactored message dispatch and added data
 retention modes

---
 cmd/server/init.go                            |   40 +
 cmd/server/main.go                            |   89 +-
 docs/backend/architecture.md                  |   70 +-
 docs/backend/e2e-testing.md                   |    4 +-
 docs/backend/portal-inbox.md                  |   32 +-
 docs/backend/usage.md                         |   24 +-
 frontend/package-lock.json                    | 1054 +++++++++--------
 frontend/package.json                         |    1 +
 frontend/src/components/ui/checkbox.tsx       |   28 +
 .../settings/hooks/use-settings.hook.ts       |   12 +-
 .../settings/message-dispatch-mode.test.ts    |   49 +
 .../settings/message-dispatch-mode.ts         |   50 +
 .../features/settings/pages/settings.page.tsx |  114 +-
 .../src/features/settings/settings.api.ts     |   10 +-
 .../src/features/settings/settings.schema.ts  |   33 +
 .../src/features/settings/settings.types.ts   |   18 +-
 go.mod                                        |    2 +-
 go.sum                                        |    4 +-
 internal/app/config.go                        |   82 +-
 internal/app/config_test.go                   |   43 +
 internal/app/shutdown.go                      |   29 +
 internal/core/domain/dispatch_mode.go         |   89 +-
 internal/core/domain/dispatch_mode_test.go    |  111 ++
 internal/core/domain/integration.go           |   34 +-
 internal/core/domain/integration_test.go      |   46 +
 internal/core/domain/message_request_log.go   |   25 +-
 internal/core/service/gateway_service.go      |  264 +++--
 internal/core/service/gateway_service_test.go |  240 +++-
 internal/core/service/portal_service.go       |   34 +
 internal/core/service/portal_service_test.go  |   96 ++
 internal/infrastructure/logger/logger.go      |   12 +-
 .../repository/postgres/limitoffset.go        |   29 +
 .../repository/postgres/limitoffset_test.go   |   33 +
 .../message_request_log_repository.go         |   25 +-
 .../presentation/handler/portal_handler.go    |    4 +-
 internal/presentation/handler/send_helper.go  |   44 +-
 .../presentation/handler/send_helper_test.go  |   57 +-
 internal/presentation/middleware/auth.go      |    5 +-
 pkg/contracts/message.go                      |    8 +
 39 files changed, 2053 insertions(+), 891 deletions(-)
 create mode 100644 cmd/server/init.go
 create mode 100644 frontend/src/components/ui/checkbox.tsx
 create mode 100644 frontend/src/features/settings/message-dispatch-mode.test.ts
 create mode 100644 frontend/src/features/settings/message-dispatch-mode.ts
 create mode 100644 frontend/src/features/settings/settings.schema.ts
 create mode 100644 internal/app/config_test.go
 create mode 100644 internal/app/shutdown.go
 create mode 100644 internal/core/domain/dispatch_mode_test.go
 create mode 100644 internal/core/domain/integration_test.go
 create mode 100644 internal/infrastructure/repository/postgres/limitoffset.go
 create mode 100644 internal/infrastructure/repository/postgres/limitoffset_test.go

diff --git a/cmd/server/init.go b/cmd/server/init.go
new file mode 100644
index 00000000..6ab1055f
--- /dev/null
+++ b/cmd/server/init.go
@@ -0,0 +1,40 @@
+package main
+
+import (
+	"fmt"
+
+	pkglogger "github.com/weprodev/go-pkg/logger"
+
+	"github.com/weprodev/wpd-message-gateway/internal/app"
+	applogger "github.com/weprodev/wpd-message-gateway/internal/infrastructure/logger"
+)
+
+// defaultConfigPath can be overridden at build time via -ldflags.
+var defaultConfigPath = "configs/local.yml"
+
+func getDefaultConfigPath() string {
+	return defaultConfigPath
+}
+
+func loadAppConfig(configPath string) (*app.Config, error) {
+	return app.LoadAppConfig(configPath)
+}
+
+func validateAppConfig(cfg *app.Config) error {
+	if err := app.ValidateConfig(cfg); err != nil {
+		return fmt.Errorf("configuration error: %w (hint: copy configs/local.example.yml to configs/local.yml)", err)
+	}
+	return nil
+}
+
+func setLogger(cfg *app.Config) (*pkglogger.Logger, error) {
+	return applogger.New(cfg.EnvironmentName())
+}
+
+func wireApplication(cfg *app.Config) (*app.Application, error) {
+	sysLogger, err := setLogger(cfg)
+	if err != nil {
+		return nil, fmt.Errorf("init logger: %w", err)
+	}
+	return app.Wire(cfg, sysLogger)
+}
diff --git a/cmd/server/main.go b/cmd/server/main.go
index 8d76101b..90d4b7be 100644
--- a/cmd/server/main.go
+++ b/cmd/server/main.go
@@ -1,74 +1,69 @@
 package main
 
 import (
+	"context"
+	"flag"
 	"fmt"
 	"log/slog"
+	"net/http"
 	"os"
-
-	"github.com/weprodev/wpd-message-gateway/internal/app"
-	"github.com/weprodev/wpd-message-gateway/internal/infrastructure/logger"
+	"os/signal"
+	"syscall"
+	"time"
 )
 
 func main() {
-	// Initialise the structured logger first so every subsequent slog call is
-	// formatted and levelled correctly. Uses APP_ENVIRONMENT to pick text (local)
-	// vs JSON (production) format.
-	env := os.Getenv("APP_ENVIRONMENT")
-	sysLogger, err := logger.New(env)
-	if err != nil {
-		// Logger not yet up — fall back to bare stderr before exiting.
-		fmt.Fprintf(os.Stderr, "FATAL: init logger: %v\n", err)
+	if err := run(); err != nil {
+		fmt.Fprintf(os.Stderr, "fatal error: %v\n", err)
 		os.Exit(1)
 	}
+}
+
+func run() error {
+	configPath := flag.String("config", getDefaultConfigPath(), "Path to config file")
+	flag.Parse()
 
-	configPath := os.Getenv("CONFIG_PATH")
-	cfg, err := app.LoadConfig(configPath)
+	cfg, err := loadAppConfig(*configPath)
 	if err != nil {
-		slog.Error("failed to load config", "error", err)
-		os.Exit(1)
+		return fmt.Errorf("load config: %w", err)
 	}
 
-	if err := app.ValidateConfig(cfg); err != nil {
-		slog.Error("configuration error",
-			"error", err,
-			"hint", "each message type requires a default provider (e.g. memory, mailgun); "+
-				"copy configs/local.example.yml to configs/local.yml and configure providers",
-		)
-		os.Exit(1)
+	if err := validateAppConfig(cfg); err != nil {
+		return err
 	}
 
-	application, err := app.Wire(cfg, sysLogger)
+	application, err := wireApplication(cfg)
 	if err != nil {
-		slog.Error("failed to initialise application", "error", err)
-		os.Exit(1)
+		return fmt.Errorf("wire application: %w", err)
 	}
 
-	logConfiguration(cfg)
+	ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
+	defer stop()
 
-	port := resolvePort(cfg)
-	slog.Info("gateway server starting", "port", port, "environment", cfg.Environment)
+	cfg.LogSummary()
+	slog.Info("gateway server starting")
 
-	if err := application.Echo.Start(":" + port); err != nil {
-		slog.Error("server stopped", "error", err)
-		os.Exit(1)
+	errCh := make(chan error, 1)
+	go func() {
+		if err := application.Echo.Start(cfg.ListenAddr()); err != nil && err != http.ErrServerClosed {
+			errCh <- err
+		}
+	}()
+
+	select {
+	case err := <-errCh:
+		return fmt.Errorf("server stopped unexpectedly: %w", err)
+	case <-ctx.Done():
+		slog.Info("shutdown signal received")
 	}
-}
 
-func logConfiguration(cfg *app.Config) {
-	slog.Info("loaded configuration",
-		"email_provider", cfg.DefaultEmailProvider(),
-		"sms_provider", cfg.DefaultSMSProvider(),
-		"push_provider", cfg.DefaultPushProvider(),
-		"chat_provider", cfg.DefaultChatProvider(),
-	)
-}
+	shutdownCtx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
 
-func resolvePort(cfg *app.Config) string {
-	if port := os.Getenv("PORT"); port != "" {
-		return port
-	}
-	if cfg.Server.Port != 0 {
-		return fmt.Sprintf("%d", cfg.Server.Port)
+	if err := application.Shutdown(shutdownCtx); err != nil {
+		return fmt.Errorf("graceful shutdown: %w", err)
 	}
-	return "10101"
+
+	slog.Info("server stopped")
+	return nil
 }
diff --git a/docs/backend/architecture.md b/docs/backend/architecture.md
index c473262b..5e5e444d 100644
--- a/docs/backend/architecture.md
+++ b/docs/backend/architecture.md
@@ -138,7 +138,7 @@ gw.SendEmail(ctx, &contracts.Email{
 │  ┌──────────────────────────────────────────────────────────┐   │
 │  │   GatewayService                                         │   │
 │  │   SendEmail() · SendSMS() · SendPush() · SendChat()      │   │
-│  │   Reads dispatch_mode from workspace_settings            │   │
+│  │   Reads message_dispatch_mode from workspace_settings    │   │
 │  │   Reads provider credentials from integrations table     │   │
 │  └──────────────────────────────────────────────────────────┘   │
 │  ┌──────────────────────────────────────────────────────────┐   │
@@ -231,27 +231,35 @@ Provider credentials are stored AES-encrypted in the `integrations` table. Confi
 
 ### Portal UI coverage
 
-The React Portal (`frontend/`) currently implements: auth, workspace list, **integrations**, message **logs**, and **send test**. API keys, templates, members, settings, and memory inbox browsing are REST/Bruno only.
+The React Portal (`frontend/`) implements: auth, workspace list, **integrations**, **settings** (general, API keys, message dispatch), message **logs**, and **send test**. Templates, members, and inbox browsing remain REST/Bruno only.
 
 ---
 
-## Message Dispatch Modes
+## Message Dispatch & Content Storage
 
-Each workspace independently controls how outbound messages are handled:
+Each workspace controls outbound routing and inbox content capture with **two orthogonal settings**:
 
-| Mode                  | Behavior                                                                            |
-| --------------------- | ----------------------------------------------------------------------------------- |
-| `memory_only`         | Captured in-process RAM only. No external provider called. Default for development. |
-| `provider_only`       | Sent through the connected integration only. No in-memory copy.                     |
-| `memory_and_provider` | Stored in memory AND sent through the integration.                                  |
+| Setting | Values | Purpose |
+| ------- | ------ | ------- |
+| `message_dispatch_mode` | `memory` (default) \| `provider` | Where the message is routed |
+| `store_message_content` | `false` (default) \| `true` | Whether message bodies are captured in the portal inbox (in-process) |
 
-Configured via `PATCH /api/v1/workspaces/:wid/settings` (REST — no Portal UI page yet):
+Portal **Settings → Message Dispatch** exposes two controls that map directly to these keys:
+
+| UI control | Setting key | Values |
+| ---------- | ----------- | ------ |
+| Dispatch mode (radio) | `message_dispatch_mode` | `memory` \| `provider` |
+| Store message content (checkbox) | `store_message_content` | `false` (off) \| `true` (on) |
+
+Configured via `PATCH /api/v1/workspaces/:wid/settings` (Portal **Settings → Message Dispatch**):
 
 ```
 PATCH /api/v1/workspaces/:wid/settings
-{ "message_dispatch_mode": "provider_only" }
+{ "message_dispatch_mode": "provider", "store_message_content": "true" }
 ```
 
+**Request logs**: Every API send appends a row to `message_request_logs` (operational tracing with correlation `request_id`).
+
 ---
 
 ## Request Flow: Sending a Message
@@ -275,19 +283,19 @@ GatewayHandler.HandleSendEmail()
     │ Reads workspace_id from context
     ▼
 GatewayService.SendEmail(ctx, workspaceID, email)
-    │ Reads workspace_settings.message_dispatch_mode from DB
+    │ Reads message_dispatch_mode + store_message_content from DB
     │
-    ├── memory_only  → Memory Provider (in-process RAM)
-    │                        │
-    │                        ▼
-    │                  Portal Inbox (SSE + REST)
+    ├── memory  → Memory Provider (in-process RAM)
+    │                  │
+    │                  ▼
+    │            Portal Inbox (SSE + REST)
     │
-    ├── provider_only → reads integrations table for workspace+channel
-    │                  Decrypts AES config
-    │                  Instantiates provider via registry
-    │                  → sends to Mailgun/etc
+    ├── provider → reads integrations table for workspace+channel
+    │             Decrypts AES config
+    │             Instantiates provider via registry
+    │             → sends to Mailgun/etc
     │
-    └── memory_and_provider → both paths above
+    └── store_message_content=true → also persists content via inbox writer
 ```
 
 ### SDK Mode — `gateway.New(config).SendEmail(...)`
@@ -322,7 +330,7 @@ Workspace "myapp"
 ├── Integrations (provider credentials per channel)
 │   ├── email: mailgun { api_key: "...", domain: "..." }
 │   └── sms: (not configured)
-├── Settings { message_dispatch_mode: "provider_only" }
+├── Settings { message_dispatch_mode: "provider", store_message_content: "false" }
 ├── Templates (email HTML templates)
 └── Message Logs (request audit trail)
 ```
@@ -438,19 +446,19 @@ Only create new files in pkg/provider/<name>/
 
 ### 5. Memory Provider & Dispatch Modes
 
-The **memory provider** captures messages in process RAM. It's always available — no external service needed. Combined with `dispatch_mode`, you can:
+The **memory provider** captures messages in process RAM. It's always available — no external service needed. Combined with workspace settings, you can:
 
-- Use `memory_only` for local development (captured messages via inbox REST API / Bruno)
-- Use `provider_only` in production (messages go to real provider)
-- Use `memory_and_provider` to keep a local copy AND send to the real provider
+- Use `message_dispatch_mode=memory` for local development (captured messages via inbox REST API / Bruno)
+- Use `message_dispatch_mode=provider` in production (messages go to the real provider)
+- Set `store_message_content=true` to persist message bodies regardless of routing mode
 
 ### 6. Portal (always on)
 
 The React Portal runs at `portal.ui_port` (default **10104**) when the server starts.
 
-**Portal UI today:** sign in, list workspaces, manage **integrations**, view message logs, send test messages.
+**Portal UI today:** sign in, list workspaces, manage **integrations**, **settings** (general, API keys, message dispatch), view message logs, send test messages.
 
-**REST only (no UI pages yet):** workspace create, API keys, templates, members, settings, memory inbox browser.
+**REST only (no UI pages yet):** workspace create, templates, members, memory inbox browser.
 
 ---
 
@@ -459,9 +467,9 @@ The React Portal runs at `portal.ui_port` (default **10104**) when the server st
 To enable robust trace tracking across all layers, the gateway employs an end-to-end correlation ID pipeline:
 
 1. **Correlation Generation**: Echo's `RequestID` middleware generates a unique request UUID for every incoming HTTP request, placing it in the `X-Request-ID` header.
-2. **Context Propagation**: A custom correlation middleware extracts this request ID and injects it into the standard Go `context.Context` (accessible via `logger.GetRequestID(ctx)`).
-3. **Structured slog Hooking**: An application-wide custom `ContextHandler` intercepts all standard `slog.InfoContext` / `slog.ErrorContext` calls. It transparently extracts the `request_id`, `workspace_id`, `api_key_id`, `channel`, and `provider` attributes from the context and automatically appends them to printed log records without requiring manual logging boilerplate.
-4. **Audit Trail Tracking**: The presentation-layer `SendHelper` automatically populates the `request_id` column on the `message_request_logs` PostgreSQL table, linking individual requests directly to database audit trails.
+2. **Context Propagation**: Router middleware copies the request ID into `context.Context` via `logger.WithRequestID`. API key auth also calls `logger.WithWorkspace` so `workspace_id` and `api_key_id` appear on all `/v1/*` logs. Send handlers add `channel` and `provider`.
+3. **Structured slog**: go-pkg `ContextExtractors` append correlation fields to every `slog.*Context` record (`request_id`, `workspace_id`, `api_key_id`, `channel`, `provider`).
+4. **Audit Trail**: `SendHelper` persists `request_id` on every row in `message_request_logs`, linking HTTP requests to the operational audit trail.
 
 ---
 
diff --git a/docs/backend/e2e-testing.md b/docs/backend/e2e-testing.md
index b7a8b7bf..c0851e95 100644
--- a/docs/backend/e2e-testing.md
+++ b/docs/backend/e2e-testing.md
@@ -17,7 +17,7 @@ Use the Message Gateway to capture and verify all messages your app sends during
 ## Architecture
 
 ```
-Your App                 Gateway (memory_only)        Test
+Your App                 Gateway (memory dispatch)        Test
    │                          │                        │
    │  POST /v1/email ─────────▶│ captured in RAM        │
    │  POST /v1/email ─────────▶│ captured in RAM        │
@@ -104,7 +104,7 @@ KEY_JSON=$(curl -sS -X POST "$BASE/workspaces/$WORKSPACE_ID/api-keys" \
 API_CLIENT_ID=$(echo "$KEY_JSON"   | jq -r .client_id)
 API_CLIENT_SECRET=$(echo "$KEY_JSON" | jq -r .client_secret)
 
-# 4) Dispatch mode defaults to memory_only — nothing to configure
+# 4) Dispatch defaults to memory — nothing to configure
 echo "PORTAL_JWT=$PORTAL_JWT"           >> $GITHUB_ENV
 echo "WORKSPACE_ID=$WORKSPACE_ID"      >> $GITHUB_ENV
 echo "WORKSPACE_UK=$UK"                >> $GITHUB_ENV
diff --git a/docs/backend/portal-inbox.md b/docs/backend/portal-inbox.md
index fb2beef0..d3a03759 100644
--- a/docs/backend/portal-inbox.md
+++ b/docs/backend/portal-inbox.md
@@ -15,18 +15,19 @@ The Portal is the web UI and REST surface for the WPD Message Gateway when runni
 | **Integrations** | Connect, activate, deactivate, or remove messaging providers |
 | **Message logs** | Outbound send **request audit trail** (not memory inbox capture) |
 | **Send test** | Send a test message per channel from the dashboard |
+| **Settings** | General workspace settings, API keys, message dispatch mode |
 
-No Portal pages yet for: workspace create, API keys, templates, members, settings, or memory inbox browsing.
+REST-only (no dedicated UI page yet): workspace create, templates, members, memory inbox browser.
 
 ### REST API (server)
 
 | Feature | Portal UI | Description |
 |---------|:---------:|-------------|
-| **Inbox capture** | | Messages stored in RAM (`memory_only` / `memory_and_provider`) — [Inbox API](#inbox-api-reference) |
+| **Inbox capture** | ✓ | Messages captured when `message_dispatch_mode=memory` or `store_message_content=true` — [Inbox API](#inbox-api-reference) |
 | **Internal ingest** | | Automation writes to inbox (requires Portal auth) |
 | **Workspace provisioning** | | Create workspace, API keys, settings — curl/Bruno/CI only; see [E2E bootstrap](./e2e-testing.md) |
 
-Provider credentials are stored in PostgreSQL (encrypted at rest) and managed via the Portal **Integrations** page. Dispatch mode is REST-only (`PATCH /api/v1/workspaces/:wid/settings`).
+Provider credentials are stored in PostgreSQL (encrypted at rest) and managed via the Portal **Integrations** page. Dispatch settings are configured in **Settings → Message Dispatch** or via REST.
 
 ---
 
@@ -44,12 +45,12 @@ Register (email + password), then sign in.
 
 ## Message Inbox (Memory Capture)
 
-When a workspace's **dispatch mode** is `memory_only` or `memory_and_provider`, outbound messages are captured in-process RAM and displayed in the Portal inbox.
+When a workspace uses `message_dispatch_mode=memory`, outbound messages are captured in-process RAM and displayed in the Portal inbox.
 
 ```
 Your App
    │
-   │  POST /v1/email  (workspace: memory_only)
+   │  POST /v1/email  (workspace: memory dispatch)
    ▼
 Memory Provider
    └──────────────────▶ Portal Inbox (REST + SSE)
@@ -67,26 +68,29 @@ Memory Provider
 
 ---
 
-## Dispatch Modes
+## Dispatch & Inbox Capture
 
-Each workspace controls how its outbound messages are handled:
+Each workspace controls routing and inbox capture with two settings:
 
-| `message_dispatch_mode` | Behavior |
-|------------------------|----------|
-| `memory_only` | Captured in RAM only, **no** external provider called. **Default.** |
-| `provider_only` | Sent through the connected integration, **no** memory copy. |
-| `memory_and_provider` | Stored in memory **and** sent through the integration. |
+| Setting | Values | Role |
+|---------|--------|------|
+| `message_dispatch_mode` | `memory` (default) \| `provider` | Routing target |
+| `store_message_content` | `false` (default) \| `true` | Capture message body in portal inbox when enabled |
 
-Set via REST (no Portal UI page yet):
+Portal **Settings → Message Dispatch**: radio **Memory** / **Provider**, plus a checkbox for **Store message content in inbox** (see [usage](./usage.md)).
+
+Set via Portal **Settings → Message Dispatch** or REST:
 
 ```bash
 PATCH /api/v1/workspaces/:wid/settings
 Content-Type: application/json
 Authorization: Bearer <portal-jwt>
 
-{ "message_dispatch_mode": "provider_only" }
+{ "message_dispatch_mode": "provider", "store_message_content": "false" }
 ```
 
+Request logs (`message_request_logs`) are always written for operational tracing.
+
 ---
 
 ## Authentication (Inbox & API)
diff --git a/docs/backend/usage.md b/docs/backend/usage.md
index c17c0ae9..35698c13 100644
--- a/docs/backend/usage.md
+++ b/docs/backend/usage.md
@@ -410,27 +410,29 @@ MESSAGE_CONFIG_ENCRYPTION_KEY=your-32-byte-key-here
 
 ---
 
-## Message Dispatch Modes
+## Message Dispatch & Content Storage
 
-Control how messages are handled per workspace. Default is `memory_only`.
+Control how messages are routed and whether bodies are captured in the portal inbox.
 
-Set via REST (no Portal UI page yet):
+Defaults: `message_dispatch_mode=memory`, `store_message_content=false`.
+
+Invalid values for dispatch settings return **400 Bad Request** on PATCH.
+
+Set via Portal **Settings → Message Dispatch** or REST:
 
 ```bash
 PATCH /api/v1/workspaces/:wid/settings
 Authorization: Bearer <portal-jwt>
 Content-Type: application/json
 
-{ "message_dispatch_mode": "provider_only" }
+{ "message_dispatch_mode": "provider", "store_message_content": "true" }
 ```
 
-See [Portal inbox](./portal-inbox.md) for mode behavior.
+Portal UI: select **Memory** or **Provider**, then check **Store message content in inbox** on or off.
+
+See [Portal inbox](./portal-inbox.md) for routing behavior.
 
-| Mode | Behavior | Use Case |
-|------|----------|----------|
-| `memory_only` | In-process RAM only, **not sent** | Development, testing |
-| `provider_only` | Sent to real provider, no local copy | Production |
-| `memory_and_provider` | Both — local copy + real send | Staging, debugging |
+Every send also creates a `message_request_logs` row for operational tracing (correlation via `request_id`).
 
 ---
 
@@ -445,7 +447,7 @@ Using a Mailgun Sandbox Domain:
 
 ### Provider Not Sending
 
-Check workspace `message_dispatch_mode` via `GET /api/v1/workspaces/:wid/settings`. If it is `memory_only`, messages are captured locally — not sent to the provider.
+Check workspace settings via `GET /api/v1/workspaces/:wid/settings`. If `message_dispatch_mode` is `memory`, messages are captured locally — not sent to the provider.
 
 ### API Key Rejected
 
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 8c463035..a3c0f3e5 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -8,6 +8,7 @@
       "name": "frontend",
       "version": "0.0.0",
       "dependencies": {
+        "@radix-ui/react-checkbox": "^1.3.6",
         "@radix-ui/react-dialog": "^1.1.15",
         "@radix-ui/react-separator": "^1.1.8",
         "@radix-ui/react-slot": "^1.2.4",
@@ -398,9 +399,9 @@
       }
     },
     "node_modules/@csstools/color-helpers": {
-      "version": "6.0.2",
-      "resolved": "https://registry.npmjs.org/@csstools/color-helpers/-/color-helpers-6.0.2.tgz",
-      "integrity": "sha512-LMGQLS9EuADloEFkcTBR3BwV/CGHV7zyDxVRtVDTwdI2Ca4it0CCVTT9wCkxSgokjE5Ho41hEPgb8OEUwoXr6Q==",
+      "version": "6.1.0",
+      "resolved": "https://registry.npmjs.org/@csstools/color-helpers/-/color-helpers-6.1.0.tgz",
+      "integrity": "sha512-064IFJdjTfUqnjpCVpMOdbr8FLQBhinbZj6yRv2An2E41O/pLEXqfFRWqGq/SxlE5PEUYTlvWsG2r8MswAVvkg==",
       "dev": true,
       "funding": [
         {
@@ -442,9 +443,9 @@
       }
     },
     "node_modules/@csstools/css-color-parser": {
-      "version": "4.1.8",
-      "resolved": "https://registry.npmjs.org/@csstools/css-color-parser/-/css-color-parser-4.1.8.tgz",
-      "integrity": "sha512-3chWb7PRLijpJpPIKkDxdu6IBeO5MrFACND57On0j8OPpc0wZibcGc3xAHrSEbOx/KDRyMHoIxGn0w1PhXMYHw==",
+      "version": "4.1.9",
+      "resolved": "https://registry.npmjs.org/@csstools/css-color-parser/-/css-color-parser-4.1.9.tgz",
+      "integrity": "sha512-paQcIaOO53Rk5+YrBaBjm/SgrV4INImjo2BT1DtQRYr+XeTRbeAYlS+jxXp9drqvKmtFnWRJKIalDLhZZDu42A==",
       "dev": true,
       "funding": [
         {
@@ -458,7 +459,7 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "@csstools/color-helpers": "^6.0.2",
+        "@csstools/color-helpers": "^6.1.0",
         "@csstools/css-calc": "^3.2.1"
       },
       "engines": {
@@ -493,9 +494,9 @@
       }
     },
     "node_modules/@csstools/css-syntax-patches-for-csstree": {
-      "version": "1.1.5",
-      "resolved": "https://registry.npmjs.org/@csstools/css-syntax-patches-for-csstree/-/css-syntax-patches-for-csstree-1.1.5.tgz",
-      "integrity": "sha512-oNjBvzLq2GPZtJphCjLqXow/cHySHSgtxvKZb7OqSZ/xHgw6NWNhfad+6AB9cLeVm6eA9d/qMll3JdEHjy6M+A==",
+      "version": "1.1.6",
+      "resolved": "https://registry.npmjs.org/@csstools/css-syntax-patches-for-csstree/-/css-syntax-patches-for-csstree-1.1.6.tgz",
+      "integrity": "sha512-TcJCWFbXLPpJYq6z7bfOyjWYJDiDg2/I4gyUC9pqPNqHFRIey0EB0q0L5cSnQDfWJg8Jd6VadakxdIez/3zkqQ==",
       "dev": true,
       "funding": [
         {
@@ -1314,14 +1315,14 @@
       }
     },
     "node_modules/@napi-rs/wasm-runtime": {
-      "version": "1.1.5",
-      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.1.5.tgz",
-      "integrity": "sha512-AWPoBRJ9tsnVhor4sjO7rkni+7p+2IAEFj6cx06UgP10jkQHqay/36uRV/bFkgrh18D9vb4cr8Q0Pthskgzy+Q==",
+      "version": "1.1.6",
+      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.1.6.tgz",
+      "integrity": "sha512-ZLv/JdUfkvOy9eCnnBaGfiO+XimbjebAeO+MRQqD/B+FR1tnRN0tpKSJHRbE8sFfS6aqsXZ67TQjfwfsxULVbg==",
       "dev": true,
       "license": "MIT",
       "optional": true,
       "dependencies": {
-        "@tybys/wasm-util": "^0.10.2"
+        "@tybys/wasm-util": "^0.10.3"
       },
       "funding": {
         "type": "github",
@@ -1709,9 +1710,9 @@
       }
     },
     "node_modules/@oxc-resolver/binding-android-arm-eabi": {
-      "version": "11.21.3",
-      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-android-arm-eabi/-/binding-android-arm-eabi-11.21.3.tgz",
-      "integrity": "sha512-eNU11A2WNizh04v3uyaJCootrHIaS0B9aHYXvAvVnPNk4xYSjMUjHnhQ6dewPN2MRYDskV85d1N0Aw0WNWhcyg==",
+      "version": "11.23.0",
+      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-android-arm-eabi/-/binding-android-arm-eabi-11.23.0.tgz",
+      "integrity": "sha512-8IJyWRLVAyhTfe9/TIEbQqSQnl5rUqYJrUOS6Dkr+Mq9FGHMxDGeiEmwkBqCvDP5KckpPh/GYSgbag66O6JsCw==",
       "cpu": [
         "arm"
       ],
@@ -1723,9 +1724,9 @@
       ]
     },
     "node_modules/@oxc-resolver/binding-android-arm64": {
-      "version": "11.21.3",
-      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-android-arm64/-/binding-android-arm64-11.21.3.tgz",
-      "integrity": "sha512-8Q+ZjTLvn2dIcWsrmhdrEihm7q+ag/k+mkry7Z+t0QbbHaVxXQfvH9AewyVMh/WrpEKhQ3DDgx9fYbqeCpeOEw==",
+      "version": "11.23.0",
+      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-android-arm64/-/binding-android-arm64-11.23.0.tgz",
+      "integrity": "sha512-pprVojnNhHxupwTT2gdeUlkxll6XEvWWBk3oVicOSNVWQC99OBnDhMQDoirqnzrE1bScQSMS2JgPpqdlrhz/Fg==",
       "cpu": [
         "arm64"
       ],
@@ -1737,9 +1738,9 @@
       ]
     },
     "node_modules/@oxc-resolver/binding-darwin-arm64": {
-      "version": "11.21.3",
-      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-darwin-arm64/-/binding-darwin-arm64-11.21.3.tgz",
-      "integrity": "sha512-wkh0qKZGHXVUDxFw3oA1TXnU2BDYY/r775oJflGeIr8uDPPoN2pk8gijQIzYRT6hoql/lg3+Tx/SaTn9e2/aGg==",
+      "version": "11.23.0",
+      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-darwin-arm64/-/binding-darwin-arm64-11.23.0.tgz",
+      "integrity": "sha512-mbIrWIMAJeytyee36OyUP5XH92TP7FaKaQ2m5AjokKy7STgjrhRt7SMXqpqLjhGm6Xn721Xmsg6H3Rtd9YQETw==",
       "cpu": [
         "arm64"
       ],
@@ -1751,9 +1752,9 @@
       ]
     },
     "node_modules/@oxc-resolver/binding-darwin-x64": {
-      "version": "11.21.3",
-      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-darwin-x64/-/binding-darwin-x64-11.21.3.tgz",
-      "integrity": "sha512-HbNc23FAQYbuyDV2vBWMez4u4mrsm5RAkniGZAWqr6lYZ3N4beeqIb776jzwRl8qL2zRhHVXpUj97X0QgogVzg==",
+      "version": "11.23.0",
+      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-darwin-x64/-/binding-darwin-x64-11.23.0.tgz",
+      "integrity": "sha512-UnIphmZ1LazUCr9DXWaKYWtKDefPMbgLsywaoYxRqVCNHhq4MM6d2q1Nz1i9Vzxt5i+cE2nRUYpAUHr/lijNYA==",
       "cpu": [
         "x64"
       ],
@@ -1765,9 +1766,9 @@
       ]
     },
     "node_modules/@oxc-resolver/binding-freebsd-x64": {
-      "version": "11.21.3",
-      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-freebsd-x64/-/binding-freebsd-x64-11.21.3.tgz",
-      "integrity": "sha512-K6xNsTUPEUdfrn0+kbMq5nOUB5w1C5pavPQngt4TM2FpN91lP0PBe2srSpamb4d69O7h86oAi/qWX/kZNRSjkw==",
+      "version": "11.23.0",
+      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-freebsd-x64/-/binding-freebsd-x64-11.23.0.tgz",
+      "integrity": "sha512-aaZ/cSEYFkSxgS2hOrobT6RQcsWNviOX8dW6CEkVx2/UYkAf9MeHbjl3W0usWV53rVV//ndBdn2nb1y7jsu4lw==",
       "cpu": [
         "x64"
       ],
@@ -1779,9 +1780,9 @@
       ]
     },
     "node_modules/@oxc-resolver/binding-linux-arm-gnueabihf": {
-      "version": "11.21.3",
-      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-11.21.3.tgz",
-      "integrity": "sha512-VcFmOpcpWX1zoEy8M58tR2M9YxM+Z9RuQhqAx5q0CTmrruaP7Gveejg75hzd/5sg5nk9G3aLALEa3hE2FsmmTQ==",
+      "version": "11.23.0",
+      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-11.23.0.tgz",
+      "integrity": "sha512-IoJLvO5SjLSVMaq83BNTrPCb1FppvoJc1IhZ5CoUVl3PykUBku7D+LK1j0GSurhJcIc6zfjghsvaZNpq5ev6Mg==",
       "cpu": [
         "arm"
       ],
@@ -1793,9 +1794,9 @@
       ]
     },
     "node_modules/@oxc-resolver/binding-linux-arm-musleabihf": {
-      "version": "11.21.3",
-      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-linux-arm-musleabihf/-/binding-linux-arm-musleabihf-11.21.3.tgz",
-      "integrity": "sha512-quVoxFLBy43hWaQbbDtQNRwAX5vX76mv7n64icAtQcJ3eNgVeblqmkupF/hAneNthdqSlnd1sTjb3aQSaDPaCQ==",
+      "version": "11.23.0",
+      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-linux-arm-musleabihf/-/binding-linux-arm-musleabihf-11.23.0.tgz",
+      "integrity": "sha512-vskFpwg44T/LFsfjSCnVZ5ygcuqzPC1yUzVEiKa8BgHAQz0+QLQQW3EGWLPVi8EXFghzjR4EtgPBtOhCjU4jdw==",
       "cpu": [
         "arm"
       ],
@@ -1807,9 +1808,9 @@
       ]
     },
     "node_modules/@oxc-resolver/binding-linux-arm64-gnu": {
-      "version": "11.21.3",
-      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-11.21.3.tgz",
-      "integrity": "sha512-X0AqNZgcD07Q4V3RDK18/vYOj/HQT/FnmEFGYS2jTWqY7JO13ryE3TEs3eAIgUJhBnNkpEaiXqz3VK8M7qQhWQ==",
+      "version": "11.23.0",
+      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-11.23.0.tgz",
+      "integrity": "sha512-//TcHVhrChyw5RYtgts6WO7KcWq9387c1Z5Zvhqpk/ktAbyaRYgBZrpSY1GDCFq50ASt6B6jhh+JxB1rB45IAg==",
       "cpu": [
         "arm64"
       ],
@@ -1824,9 +1825,9 @@
       ]
     },
     "node_modules/@oxc-resolver/binding-linux-arm64-musl": {
-      "version": "11.21.3",
-      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-linux-arm64-musl/-/binding-linux-arm64-musl-11.21.3.tgz",
-      "integrity": "sha512-YkaQnaKYdbuaXvRt5Qd0GpbihzVnyfR6z1SpYfIUC6RTu4NF7lDKPjVkYb+jRI2gedVO2rVpN35Y6akG6ud4Lw==",
+      "version": "11.23.0",
+      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-linux-arm64-musl/-/binding-linux-arm64-musl-11.23.0.tgz",
+      "integrity": "sha512-ZFqlwiTf7CXLLSGyAR9tYiO33LiaeIEXW+xm42d8mnUGpDgPltyrCGYtQezyMMEXvjhOgCz1X+i7sbDTJEx+bg==",
       "cpu": [
         "arm64"
       ],
@@ -1841,9 +1842,9 @@
       ]
     },
     "node_modules/@oxc-resolver/binding-linux-ppc64-gnu": {
-      "version": "11.21.3",
-      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-11.21.3.tgz",
-      "integrity": "sha512-gB9HwhrPiFqUzDeEq+y/CgAijz1YdI6BnXz5GaH2Pa9cWdutchlkGFAiAuGb/PjVQpiK6NFKzFuztxrweoit7A==",
+      "version": "11.23.0",
+      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-11.23.0.tgz",
+      "integrity": "sha512-oZ5LeN5+H1R19dRjTAxKrxQguH+AsemHcnthEfFxf4OjmBSty2doHLeSmMunKy3zpTHJQ3lh3Af+dNS+W6dYeA==",
       "cpu": [
         "ppc64"
       ],
@@ -1858,9 +1859,9 @@
       ]
     },
     "node_modules/@oxc-resolver/binding-linux-riscv64-gnu": {
-      "version": "11.21.3",
-      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-linux-riscv64-gnu/-/binding-linux-riscv64-gnu-11.21.3.tgz",
-      "integrity": "sha512-zjDWBlYk8QGv0H8dsPUWqkfjYIIjG2TvspGkzXL0eImbgxtZorA/klKeHyolevoT3Kvbi+1iMr9Lhrh7jf54Og==",
+      "version": "11.23.0",
+      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-linux-riscv64-gnu/-/binding-linux-riscv64-gnu-11.23.0.tgz",
+      "integrity": "sha512-O4ciFDyX5ebQd0qkb1bjAIg8IEfiLT03GbSeylwlwlUMK9KwBWaALwrxSbc0Msaz4U6iPj+T9eRXpD5mxBfmvA==",
       "cpu": [
         "riscv64"
       ],
@@ -1875,9 +1876,9 @@
       ]
     },
     "node_modules/@oxc-resolver/binding-linux-riscv64-musl": {
-      "version": "11.21.3",
-      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-linux-riscv64-musl/-/binding-linux-riscv64-musl-11.21.3.tgz",
-      "integrity": "sha512-4UfsQvacV388y1zpXL7C1x1FNYaV52JtuNRiuzrfQA2z1z6ElVrsidkGsrvQ5EgeSq1Pj7kaKqrgGkvFuxJ/tw==",
+      "version": "11.23.0",
+      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-linux-riscv64-musl/-/binding-linux-riscv64-musl-11.23.0.tgz",
+      "integrity": "sha512-P3o8Y9kISYjcxadmbO+94ThRwLhwGuDAbA7dcdd4+YLpfeF+mmobz8fXf4NmSdfSqjyRSkceJDBRZha9NVYkiQ==",
       "cpu": [
         "riscv64"
       ],
@@ -1892,9 +1893,9 @@
       ]
     },
     "node_modules/@oxc-resolver/binding-linux-s390x-gnu": {
-      "version": "11.21.3",
-      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-11.21.3.tgz",
-      "integrity": "sha512-b5uH+HKH0MP5mNBYaK75SKsJbw52URqrx2LavYdq6wb0l3ExAG5niYRP9DWUNHdKilpaBVM2bXk9HNWrH3ew7Q==",
+      "version": "11.23.0",
+      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-11.23.0.tgz",
+      "integrity": "sha512-oj03m1E3RmTFczKhcKJDzHaEDKJnPIsDcQFVxBJsSdXGSuIPdt5TvcM332FfMQgzI6yDJqyl4InrnFfXrmUTKQ==",
       "cpu": [
         "s390x"
       ],
@@ -1909,9 +1910,9 @@
       ]
     },
     "node_modules/@oxc-resolver/binding-linux-x64-gnu": {
-      "version": "11.21.3",
-      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-linux-x64-gnu/-/binding-linux-x64-gnu-11.21.3.tgz",
-      "integrity": "sha512-PjYlmilBpNRh2ntXNYAK3Am5w/nPfEpnU/96iNx7CI8EzAn12J4JRiec63wHJTH31nLoCNxBg/829pN+3CfG3Q==",
+      "version": "11.23.0",
+      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-linux-x64-gnu/-/binding-linux-x64-gnu-11.23.0.tgz",
+      "integrity": "sha512-BqJxbSC8FdP7mSuSpRePTGHm0hXWV+dfz//f7SjsteZncLaBgWTBmi/OZNv7sX6CyG/Pt/eJkPorP+DkMOhMwQ==",
       "cpu": [
         "x64"
       ],
@@ -1926,9 +1927,9 @@
       ]
     },
     "node_modules/@oxc-resolver/binding-linux-x64-musl": {
-      "version": "11.21.3",
-      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-linux-x64-musl/-/binding-linux-x64-musl-11.21.3.tgz",
-      "integrity": "sha512-QTBAb7JuHlZ7JUEyM8UiQi2f7m/L4swBhP2TNpYIDc9Wp/wRw1G/8sl6i13aIzQAXH7LKIm294LeOHd0lQR8zA==",
+      "version": "11.23.0",
+      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-linux-x64-musl/-/binding-linux-x64-musl-11.23.0.tgz",
+      "integrity": "sha512-utmw+VmUrW4K8LI5/6jhg4aGYKJHOIjQ9syYOOA6pF3w7haKu4r4enTe2U0C04/HbUvkq/Zif43xFsKW1Pnq9w==",
       "cpu": [
         "x64"
       ],
@@ -1943,9 +1944,9 @@
       ]
     },
     "node_modules/@oxc-resolver/binding-openharmony-arm64": {
-      "version": "11.21.3",
-      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-openharmony-arm64/-/binding-openharmony-arm64-11.21.3.tgz",
-      "integrity": "sha512-4j1DFwjwv36ec9kds0jU/ucQ5Ha4ERO/H95BxR5JFf0kqUUAJ1kwII7XhTc1vZrkdJkvLGC9Q2MbpObpum8RBg==",
+      "version": "11.23.0",
+      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-openharmony-arm64/-/binding-openharmony-arm64-11.23.0.tgz",
+      "integrity": "sha512-V6lbRrthHa4TbvsLjPtg+EkXT1tRY+s4I8rYLXUfiHlZzGx3sLv1EH9CEOOevjvUYHLsbe/gqCIc73XnQfPb9A==",
       "cpu": [
         "arm64"
       ],
@@ -1957,9 +1958,9 @@
       ]
     },
     "node_modules/@oxc-resolver/binding-wasm32-wasi": {
-      "version": "11.21.3",
-      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-wasm32-wasi/-/binding-wasm32-wasi-11.21.3.tgz",
-      "integrity": "sha512-i8oluoel5kru/j1WNrjmQSiA3GQ7wvIYVR1IwIoZtKogAhya2iub+ZKIeSIkcJOrnzQ18Tzl/F+kL3fYOxZLvA==",
+      "version": "11.23.0",
+      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-wasm32-wasi/-/binding-wasm32-wasi-11.23.0.tgz",
+      "integrity": "sha512-gRoOxQPdnAmIAjxcuQNBxfihvx+wjTaQM/9/eP12xwnGNawOG/+Zz9RHN4WNSxT45b5CrscK4NB8aPh+oZQXAQ==",
       "cpu": [
         "wasm32"
       ],
@@ -1967,18 +1968,18 @@
       "license": "MIT",
       "optional": true,
       "dependencies": {
-        "@emnapi/core": "1.11.0",
-        "@emnapi/runtime": "1.11.0",
-        "@napi-rs/wasm-runtime": "^1.1.5"
+        "@emnapi/core": "1.11.1",
+        "@emnapi/runtime": "1.11.1",
+        "@napi-rs/wasm-runtime": "^1.1.6"
       },
       "engines": {
         "node": ">=14.0.0"
       }
     },
     "node_modules/@oxc-resolver/binding-wasm32-wasi/node_modules/@emnapi/core": {
-      "version": "1.11.0",
-      "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.11.0.tgz",
-      "integrity": "sha512-l9Oo58x0HOP5znGzVhYW9U3e5wVuA4LAZU2AGezTmkhO1CgQRFDhDg4nneHsu/t3WniXg9QrG2nIXL/ZS8ln8Q==",
+      "version": "1.11.1",
+      "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.11.1.tgz",
+      "integrity": "sha512-RSvbQmHzdKzNsLYa/wHrbc3KN4sYLKAdPZxqiM2HATqv/SBk2/ENSHpvXGaLOMcsAyz0poEGqkmmKYG3OWiJEQ==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -1988,9 +1989,9 @@
       }
     },
     "node_modules/@oxc-resolver/binding-wasm32-wasi/node_modules/@emnapi/runtime": {
-      "version": "1.11.0",
-      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.11.0.tgz",
-      "integrity": "sha512-55coeOFKHv1ywEcUXJtWU5f+Jr/W5tZDvZig8DLKSwUN1JpROQ4rk/SNOQiFWmaR/VKF4zuFyW1B8JduOSv6Pg==",
+      "version": "1.11.1",
+      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.11.1.tgz",
+      "integrity": "sha512-vgj7R3y3Wgx24IQaGPA/R6YFXLHVMOZ0uVEyIQPaWs+rd1AzfEMXlAC22FYwO1XkKR6NPsq7mUandH8oIRdZFw==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -2010,9 +2011,9 @@
       }
     },
     "node_modules/@oxc-resolver/binding-win32-arm64-msvc": {
-      "version": "11.21.3",
-      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-11.21.3.tgz",
-      "integrity": "sha512-M/8dw8dD6aOs+NlPJax401CZB9I7Aut84isQLgALGGwke4Afvw+/7yYhZb94yXf6t2sPLhQLmSmtSV+2FhsOWg==",
+      "version": "11.23.0",
+      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-11.23.0.tgz",
+      "integrity": "sha512-CgTGMYsJVe1eUiCdJTpGw21svXw79ITsemN1h0hcNkiswasDbN5MoibSLY+gRMWP5syfEz5iffrjZnwEP8xeUA==",
       "cpu": [
         "arm64"
       ],
@@ -2024,9 +2025,9 @@
       ]
     },
     "node_modules/@oxc-resolver/binding-win32-x64-msvc": {
-      "version": "11.21.3",
-      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-win32-x64-msvc/-/binding-win32-x64-msvc-11.21.3.tgz",
-      "integrity": "sha512-H7BCt/VnS9hnmMp42eGhZ99izSCRvlnWwy/N71K1/J8QoExwY4262Z8QiEkMDtduRJrztayDxETTckmUuAVL9Q==",
+      "version": "11.23.0",
+      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-win32-x64-msvc/-/binding-win32-x64-msvc-11.23.0.tgz",
+      "integrity": "sha512-gUGJpr+Rn6zMxm5juApV0K3U845i8t47o8k+rbO0BHbi4PoJIfSPeQmrE2dgohQm2g5k6iviNFyXCGqvmaYUpw==",
       "cpu": [
         "x64"
       ],
@@ -2043,15 +2044,45 @@
       "integrity": "sha512-7AdCK9PQyiljKoBDbN8OuctCbd/esdwZPQ8RtOE3SsyQtUpiPb+ND75q0jEhC1m1ecBI0MFNeLJvwIh9iKHRcQ==",
       "license": "MIT"
     },
+    "node_modules/@radix-ui/react-checkbox": {
+      "version": "1.3.6",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-checkbox/-/react-checkbox-1.3.6.tgz",
+      "integrity": "sha512-eUEUoGMDpfkgHWSE97ZZaUJtzR1M7EKnNIpD1Q16+8JR9NWghcaqMulx9PuCQ720w0UclfYn6FEbCdd5Hx087g==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/primitive": "1.1.4",
+        "@radix-ui/react-compose-refs": "1.1.3",
+        "@radix-ui/react-context": "1.1.4",
+        "@radix-ui/react-presence": "1.1.6",
+        "@radix-ui/react-primitive": "2.1.7",
+        "@radix-ui/react-use-controllable-state": "1.2.3",
+        "@radix-ui/react-use-previous": "1.1.2",
+        "@radix-ui/react-use-size": "1.1.2"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
     "node_modules/@radix-ui/react-collection": {
-      "version": "1.1.10",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-collection/-/react-collection-1.1.10.tgz",
-      "integrity": "sha512-IVVz4EvBcKjrzKgof714qDnz/SzQAkLA2Emh5edlHbgcE6fNd3Un6CJLlaYcnm8N4JmAtzQgse4dOKxcD2yc9g==",
+      "version": "1.1.11",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-collection/-/react-collection-1.1.11.tgz",
+      "integrity": "sha512-djW9+zeg137KQdlPtmE8xnaD+K2rcXXMWFrSg0hsmYZ6HRbdTA7tDHFgpaW9+huWVEu0RCabL+985T4TA0BE7g==",
       "license": "MIT",
       "dependencies": {
         "@radix-ui/react-compose-refs": "1.1.3",
         "@radix-ui/react-context": "1.1.4",
-        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-primitive": "2.1.7",
         "@radix-ui/react-slot": "1.3.0"
       },
       "peerDependencies": {
@@ -2100,21 +2131,21 @@
       }
     },
     "node_modules/@radix-ui/react-dialog": {
-      "version": "1.1.17",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-dialog/-/react-dialog-1.1.17.tgz",
-      "integrity": "sha512-TDTYmpdq8dI2+Xgvgj9AJ8Ghqq+Eph/TRVEdaFQPDItIY+6QSkU7MJMeevw1568Yw/2Ijz8BTphPSP2XejKphw==",
+      "version": "1.1.18",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-dialog/-/react-dialog-1.1.18.tgz",
+      "integrity": "sha512-apa28mldjMgORmE6g/w3sCcA0Y9UAVeeDVoozN4i7kOw12mLl9RBchfzK3Nn6qxOWjrZhK1Lfy7f07kyzxtnBw==",
       "license": "MIT",
       "dependencies": {
         "@radix-ui/primitive": "1.1.4",
         "@radix-ui/react-compose-refs": "1.1.3",
         "@radix-ui/react-context": "1.1.4",
-        "@radix-ui/react-dismissable-layer": "1.1.13",
+        "@radix-ui/react-dismissable-layer": "1.1.14",
         "@radix-ui/react-focus-guards": "1.1.4",
-        "@radix-ui/react-focus-scope": "1.1.10",
+        "@radix-ui/react-focus-scope": "1.1.11",
         "@radix-ui/react-id": "1.1.2",
-        "@radix-ui/react-portal": "1.1.12",
+        "@radix-ui/react-portal": "1.1.13",
         "@radix-ui/react-presence": "1.1.6",
-        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-primitive": "2.1.7",
         "@radix-ui/react-slot": "1.3.0",
         "@radix-ui/react-use-controllable-state": "1.2.3",
         "aria-hidden": "^1.2.4",
@@ -2151,16 +2182,16 @@
       }
     },
     "node_modules/@radix-ui/react-dismissable-layer": {
-      "version": "1.1.13",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-dismissable-layer/-/react-dismissable-layer-1.1.13.tgz",
-      "integrity": "sha512-2v+zNAWWe0ySxgC0D0yeXMPQ23xZVgXZTerTz+JKlmdRj6gfTqmCcR29jb6d290DezXPGgruHWDX/vYUebtErg==",
+      "version": "1.1.14",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-dismissable-layer/-/react-dismissable-layer-1.1.14.tgz",
+      "integrity": "sha512-4lUhWTWAjbDIqFrAPWJ3WqBOpO5YchVZ88X3nh6H9Lu5AFi5nCUeTPj3D8FSDmabmFeRe9ME0BDA4MwKTha5GQ==",
       "license": "MIT",
       "dependencies": {
         "@radix-ui/primitive": "1.1.4",
         "@radix-ui/react-compose-refs": "1.1.3",
-        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-primitive": "2.1.7",
         "@radix-ui/react-use-callback-ref": "1.1.2",
-        "@radix-ui/react-use-escape-keydown": "1.1.2"
+        "@radix-ui/react-use-effect-event": "0.0.3"
       },
       "peerDependencies": {
         "@types/react": "*",
@@ -2193,13 +2224,13 @@
       }
     },
     "node_modules/@radix-ui/react-focus-scope": {
-      "version": "1.1.10",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-focus-scope/-/react-focus-scope-1.1.10.tgz",
-      "integrity": "sha512-Fas/lXQqhVvqwAb64s5RFeHiHYElZ6SUQbZaNd6EkfhP/Al7wTIQ9WIR4QVX475tlu5yFCEdDcJH6/UwsZjMWw==",
+      "version": "1.1.11",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-focus-scope/-/react-focus-scope-1.1.11.tgz",
+      "integrity": "sha512-Mn88Vg2whaRocGJNOH+DKFqYm6ySFPQaiwHNxZPyjn99B52KAEJWWY9NP83+nWdk2HM3rdov+STu9AG471Rt9w==",
       "license": "MIT",
       "dependencies": {
         "@radix-ui/react-compose-refs": "1.1.3",
-        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-primitive": "2.1.7",
         "@radix-ui/react-use-callback-ref": "1.1.2"
       },
       "peerDependencies": {
@@ -2236,12 +2267,12 @@
       }
     },
     "node_modules/@radix-ui/react-portal": {
-      "version": "1.1.12",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-portal/-/react-portal-1.1.12.tgz",
-      "integrity": "sha512-m309havGzsjLHHaIX50G5PlvRs3xkgPCsGk/5PTvYm8D5q33yG0J7w/712PTOhid7NTaFETtnSXjngHQavvhVw==",
+      "version": "1.1.13",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-portal/-/react-portal-1.1.13.tgz",
+      "integrity": "sha512-z3oXfmaHLJTF1wktbjgD6cn9jiEbq3WSondB10LIuIt2m2Ym4iJlrW04/euMwENDdWDdE7z+OuY7Qyp1YpRSwA==",
       "license": "MIT",
       "dependencies": {
-        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-primitive": "2.1.7",
         "@radix-ui/react-use-layout-effect": "1.1.2"
       },
       "peerDependencies": {
@@ -2283,9 +2314,9 @@
       }
     },
     "node_modules/@radix-ui/react-primitive": {
-      "version": "2.1.6",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-primitive/-/react-primitive-2.1.6.tgz",
-      "integrity": "sha512-wetd0QI77DbvrPpTAvH1SqOxsYF2wZe5TNxqwOd5Ty4XDpV3dpV0s8K/1MGMJBeY5o7lg8ub5VIt1Ub+yVen6g==",
+      "version": "2.1.7",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-primitive/-/react-primitive-2.1.7.tgz",
+      "integrity": "sha512-bC3NiwsprbxKjuon9l7X6BUTw7FPVzEYaL92MPEY5SCd/9hUTPXVFtVwRix7778wtRsVao+zE062gL79FZleeQ==",
       "license": "MIT",
       "dependencies": {
         "@radix-ui/react-slot": "1.3.0"
@@ -2306,18 +2337,18 @@
       }
     },
     "node_modules/@radix-ui/react-roving-focus": {
-      "version": "1.1.13",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-roving-focus/-/react-roving-focus-1.1.13.tgz",
-      "integrity": "sha512-9gkwneI0guf8JDmrFxPjJF6Ozzgioyw+/lonYNCwefS9ZHA05er0BVHiXr+LbWGHxUfczvMY6G1oiZZi1VzjRw==",
+      "version": "1.1.14",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-roving-focus/-/react-roving-focus-1.1.14.tgz",
+      "integrity": "sha512-8Qcnx9447tx/aCBgw6Jenfqg4Skq+vqab9mCBmuGNipIS5YXvL275wbKEu7+ICYHIlAPgCduUMJH1XOYewKF6Q==",
       "license": "MIT",
       "dependencies": {
         "@radix-ui/primitive": "1.1.4",
-        "@radix-ui/react-collection": "1.1.10",
+        "@radix-ui/react-collection": "1.1.11",
         "@radix-ui/react-compose-refs": "1.1.3",
         "@radix-ui/react-context": "1.1.4",
         "@radix-ui/react-direction": "1.1.2",
         "@radix-ui/react-id": "1.1.2",
-        "@radix-ui/react-primitive": "2.1.6",
+        "@radix-ui/react-primitive": "2.1.7",
         "@radix-ui/react-use-callback-ref": "1.1.2",
         "@radix-ui/react-use-controllable-state": "1.2.3"
       },
@@ -2337,12 +2368,12 @@
       }
     },
     "node_modules/@radix-ui/react-separator": {
-      "version": "1.1.10",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-separator/-/react-separator-1.1.10.tgz",
-      "integrity": "sha512-Y6K6jLQCVfCnTL2MEtGxDLffkhNfEfHsEg3Wa8JU+IWdn3EWbLXd3OuOfQRN7p/W/cUce1WyTk3QeuAoDBzN9g==",
+      "version": "1.1.11",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-separator/-/react-separator-1.1.11.tgz",
+      "integrity": "sha512-jRhe86+8PF7VZ1u14eOWVOuh2BuAhALg/FT1VcMC4OHedMTRUazDnDlKTt+yxo5cRNKHMfmvZ4sSQtWDeMV4CQ==",
       "license": "MIT",
       "dependencies": {
-        "@radix-ui/react-primitive": "2.1.6"
+        "@radix-ui/react-primitive": "2.1.7"
       },
       "peerDependencies": {
         "@types/react": "*",
@@ -2378,9 +2409,9 @@
       }
     },
     "node_modules/@radix-ui/react-tabs": {
-      "version": "1.1.15",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-tabs/-/react-tabs-1.1.15.tgz",
-      "integrity": "sha512-kxc9gI6/HfcU4nfMMVS3AmQK414kbU1IE6UCJmMmxjhO3cRPXOyYnmvyKD+ODt7q56nRq9l7Wovi6uaGwKgMlg==",
+      "version": "1.1.16",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-tabs/-/react-tabs-1.1.16.tgz",
+      "integrity": "sha512-v3Ab2l7z6U7tRB4xA0IyKdq0OsqaO1o9ZjsIEoKKnSZ/l96mZz8aCTX0NCXw+YVHJXr8Km4d+Mn6/Q8YjXa+gw==",
       "license": "MIT",
       "dependencies": {
         "@radix-ui/primitive": "1.1.4",
@@ -2388,8 +2419,8 @@
         "@radix-ui/react-direction": "1.1.2",
         "@radix-ui/react-id": "1.1.2",
         "@radix-ui/react-presence": "1.1.6",
-        "@radix-ui/react-primitive": "2.1.6",
-        "@radix-ui/react-roving-focus": "1.1.13",
+        "@radix-ui/react-primitive": "2.1.7",
+        "@radix-ui/react-roving-focus": "1.1.14",
         "@radix-ui/react-use-controllable-state": "1.2.3"
       },
       "peerDependencies": {
@@ -2459,14 +2490,26 @@
         }
       }
     },
-    "node_modules/@radix-ui/react-use-escape-keydown": {
+    "node_modules/@radix-ui/react-use-layout-effect": {
       "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-use-escape-keydown/-/react-use-escape-keydown-1.1.2.tgz",
-      "integrity": "sha512-2uVLvLjgO7NZCWw01/FdqRwmA42J0BcjPMUCA+koFEOAb+zjqIP7SiFz/7zWPrKnVmSqr76Omq2ALyCuX4dhLw==",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-use-layout-effect/-/react-use-layout-effect-1.1.2.tgz",
+      "integrity": "sha512-jrBWOxZITuGcnjRCM2t2U5ZPkCLxD+Ym6DjfssS5haTj2iiak/DOb64JeN6OdLfLgptb6/e2kKR+ZuTrGoZTPA==",
       "license": "MIT",
-      "dependencies": {
-        "@radix-ui/react-use-callback-ref": "1.1.2"
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
       },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-use-previous": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-use-previous/-/react-use-previous-1.1.2.tgz",
+      "integrity": "sha512-IGBQPtRFdhN6MQ8dbegVmBq1LVZluya3F1jWY+puIcQC3MHctRwTDSBWCkL/3ZcnMJLTMJ++Z+ktmvg0F89iCw==",
+      "license": "MIT",
       "peerDependencies": {
         "@types/react": "*",
         "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
@@ -2477,11 +2520,14 @@
         }
       }
     },
-    "node_modules/@radix-ui/react-use-layout-effect": {
+    "node_modules/@radix-ui/react-use-size": {
       "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-use-layout-effect/-/react-use-layout-effect-1.1.2.tgz",
-      "integrity": "sha512-jrBWOxZITuGcnjRCM2t2U5ZPkCLxD+Ym6DjfssS5haTj2iiak/DOb64JeN6OdLfLgptb6/e2kKR+ZuTrGoZTPA==",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-use-size/-/react-use-size-1.1.2.tgz",
+      "integrity": "sha512-giWQp+4mxjBPt4KZ0MmyuykFNWfbDxKt4x+fPkRYmgRFJSbCZFzUglvMb/Kjn38tm10YP4ufiQZDx3zna4LU6w==",
       "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-use-layout-effect": "1.1.2"
+      },
       "peerDependencies": {
         "@types/react": "*",
         "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
@@ -2493,9 +2539,9 @@
       }
     },
     "node_modules/@rolldown/binding-android-arm64": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.0.3.tgz",
-      "integrity": "sha512-454rs7jHngixp/NMxd5srYD57OnzSlZ/eFTETjORQHLwJG1lRtmNOJcBerZlfu4GjKqeq8aCCIQrMdHyhI51Hw==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.1.4.tgz",
+      "integrity": "sha512-EZLpf/8y7GXkkra90ML47kzik/GMP3EMcE9bPyHmRfxLC6z9+aW5A8poCsoxjrT5GfEcNAAvWwUHjvP1pUQkfw==",
       "cpu": [
         "arm64"
       ],
@@ -2510,9 +2556,9 @@
       }
     },
     "node_modules/@rolldown/binding-darwin-arm64": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.0.3.tgz",
-      "integrity": "sha512-PcAhP+ynjURNyy8SKGl5DQP94aGuB/7JrXJb/t7P+hanXvQVMWzUvRRhBAcg/lNRadBhoUPqSoP4xw5tR/KBEA==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.1.4.tgz",
+      "integrity": "sha512-aUi+HBvmYb7j8krl1+qJgkG8C17fO79gk3c+jPw4S8glRFc1DTija9S3EyaTSQUm5GJXYKDAsugBEhFHH2vYiQ==",
       "cpu": [
         "arm64"
       ],
@@ -2527,9 +2573,9 @@
       }
     },
     "node_modules/@rolldown/binding-darwin-x64": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.0.3.tgz",
-      "integrity": "sha512-9YpfeUvSE2RS7wysJ81uOZkXJz7f7Q55H2Gvp3VEw/EsahqDtrphrZ0EwDLK5vvKOzaCrBsjF8JmnMLcUt78Gg==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.1.4.tgz",
+      "integrity": "sha512-F7hHC3gwY11+vByKPRWqwGbeXWVgKmL+pTGCinaEhdihzBV2aQ0fvZOch9cXYUOKuKKq429HeYXOqQLc7wFCEg==",
       "cpu": [
         "x64"
       ],
@@ -2544,9 +2590,9 @@
       }
     },
     "node_modules/@rolldown/binding-freebsd-x64": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.0.3.tgz",
-      "integrity": "sha512-yB1IlAsSNHncV6SCTL27/MVGR5htvQsoGxIv5KMGXALp+Ll1wYsn+x98M9MW7qa+NdSbvrrY7ANI4wLJ0n1e6g==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.1.4.tgz",
+      "integrity": "sha512-sI5yw+7s92SK6odiEhD5lKCBlWcpjHS5qyqpVQbZAJ0fIzEUXrmbl3DH2ybR3PZogulNJF+COLtmA8hUfvkCCQ==",
       "cpu": [
         "x64"
       ],
@@ -2561,9 +2607,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-arm-gnueabihf": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.0.3.tgz",
-      "integrity": "sha512-Yi30IVAAfLUCy2MseFjbB1jAMDl1VMCAas5StnYp8da9+CKvMd2H2cbEjWcw5NPaPqzvYkVIaF1nNUG+b7u/sw==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.1.4.tgz",
+      "integrity": "sha512-mCi0OKgEieFircrtVYmQAFGszRtMnZ6fpZAXrxanXAu7lqZcsK1E1RAaZNG0uKAnxox3B1f4EyQNnoyMfN1vAA==",
       "cpu": [
         "arm"
       ],
@@ -2578,9 +2624,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-arm64-gnu": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.0.3.tgz",
-      "integrity": "sha512-jsO7R8To+AdlYgUmN5sHSCZbfhtMBkO0WUx8iORQnPcMMdgr7qM2DQmMwgabs3GhNztdmoKkMKQFHD6DTMCIQw==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.1.4.tgz",
+      "integrity": "sha512-B9Ial3Kv5sh0SHnB1g/QWcUQCEvCF6QKGAl4zXypYj65mVI+B4AhFBwPtSN7pDrJeIx8Z7zdy4ntx+wQABom7w==",
       "cpu": [
         "arm64"
       ],
@@ -2598,9 +2644,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-arm64-musl": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.0.3.tgz",
-      "integrity": "sha512-VWkUHwWriDciit80wleYwKILoR/KMvxh/IdwS/paX+ZgpuRpCrKLUdadJbc0NpBEiyhpYawsJ73j9aCvOH+f7Q==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.1.4.tgz",
+      "integrity": "sha512-lZVym0PuHE1KZ22gmFTC15lAkrg9iTszR617oYRB/iPY1A56ywoJzVKOJBKaot5RiikCObmur6pogpse3gRcng==",
       "cpu": [
         "arm64"
       ],
@@ -2618,9 +2664,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-ppc64-gnu": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.0.3.tgz",
-      "integrity": "sha512-5f1laC0SlIR0yDbFCd8acUhvJIag6N3zC5P7oUPN6wX0aOma+uKJ0wBDH5aq7I1PVI2ttTlhJwzwRIBnLiSGEg==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.1.4.tgz",
+      "integrity": "sha512-t2DNiLJWNTbnEHyUzTumldML6ET4/g16467LZoDDJ3tSxGvguL5/NyC2lCsNKuyRycg9XeDQF5SSv+TNOhQEXg==",
       "cpu": [
         "ppc64"
       ],
@@ -2638,9 +2684,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-s390x-gnu": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.0.3.tgz",
-      "integrity": "sha512-Iq4ko0r4XsgbrF/LunNgHtAGLRRVE2kXonAXQ/MV0mC6jQpMOhW1SvtZja2EhC/kd05++bP78dsqBeIQyYJ6Yg==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.1.4.tgz",
+      "integrity": "sha512-0WIRnL1Uw4BvTZRLQt+PVgo6ZKTJadlC2btP+/EOXv2f/DWbY0rEgl+y834mIVwP1FkTlWVTrGGJXf12lru7EQ==",
       "cpu": [
         "s390x"
       ],
@@ -2658,9 +2704,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-x64-gnu": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.0.3.tgz",
-      "integrity": "sha512-B8m6tD5+/N5FeNQFbKlLA/2yVq9ycQP1SeedyEYYKWBNR3ZQbkvIUcNnDNM03lO1l5F2roiiFJGgvoLLyZXtSg==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.1.4.tgz",
+      "integrity": "sha512-JWtGshGfX+oENAKonoNkqEJX+7hC8yfhi9GUyPX1VX4mdh1y5r+ZiJLR5XzAB0aoP6s/PcILsGjKq8O0mm24bw==",
       "cpu": [
         "x64"
       ],
@@ -2678,9 +2724,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-x64-musl": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.0.3.tgz",
-      "integrity": "sha512-pSdpdUJHkuCxun9LE7jvgUB9qsRgaiyNNCX7m/AvHTcq67AiT/Yhoxvw5zPfhrM8k/BfP8ce/hMOpthKDpEUow==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.1.4.tgz",
+      "integrity": "sha512-rT6yQcxUuXs4CnbofqwHRRV0iem349rLMYpTjkgQGLjrY4ado/eDzwPZPTCgTOlF6Nkp8NEv70yLMTn6qkWxsQ==",
       "cpu": [
         "x64"
       ],
@@ -2698,9 +2744,9 @@
       }
     },
     "node_modules/@rolldown/binding-openharmony-arm64": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.0.3.tgz",
-      "integrity": "sha512-OXXS3RKJgX2uLwM+gYyuH5omcH8fL1LJs96pZGgtetVCahON57+d4SJHzTgZiOjxgGkSnpXpOsWuPDGAKAigEg==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.1.4.tgz",
+      "integrity": "sha512-KXMGoboq5cyaCQjDA4GLuRiOwBQ0EyFnJoVViLeZ45/3rFItRODEr+NdsBcVpll40hhNArlm/speWGRvj08LzA==",
       "cpu": [
         "arm64"
       ],
@@ -2715,9 +2761,9 @@
       }
     },
     "node_modules/@rolldown/binding-wasm32-wasi": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-wasm32-wasi/-/binding-wasm32-wasi-1.0.3.tgz",
-      "integrity": "sha512-JTtb8BWFynicNSoPrehsCzBtOKjZ6jhMiPFEmOiuXg1Fl8dn2KHQob+GuPSGR0dryQa1PQJbzjF3dqO/whhjLg==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-wasm32-wasi/-/binding-wasm32-wasi-1.1.4.tgz",
+      "integrity": "sha512-5K83rb36oJiY7BCyE9zLZtGcPV4g5wvq+xwdO0XPIwDVZI8cyB/AUjkNXGb92/rnmezEkjMOpgY61rtwjQtFwg==",
       "cpu": [
         "wasm32"
       ],
@@ -2725,30 +2771,41 @@
       "license": "MIT",
       "optional": true,
       "dependencies": {
-        "@emnapi/core": "1.10.0",
-        "@emnapi/runtime": "1.10.0",
-        "@napi-rs/wasm-runtime": "^1.1.4"
+        "@emnapi/core": "1.11.1",
+        "@emnapi/runtime": "1.11.1",
+        "@napi-rs/wasm-runtime": "^1.1.6"
       },
       "engines": {
         "node": "^20.19.0 || >=22.12.0"
       }
     },
     "node_modules/@rolldown/binding-wasm32-wasi/node_modules/@emnapi/core": {
-      "version": "1.10.0",
-      "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.10.0.tgz",
-      "integrity": "sha512-yq6OkJ4p82CAfPl0u9mQebQHKPJkY7WrIuk205cTYnYe+k2Z8YBh11FrbRG/H6ihirqcacOgl2BIO8oyMQLeXw==",
+      "version": "1.11.1",
+      "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.11.1.tgz",
+      "integrity": "sha512-RSvbQmHzdKzNsLYa/wHrbc3KN4sYLKAdPZxqiM2HATqv/SBk2/ENSHpvXGaLOMcsAyz0poEGqkmmKYG3OWiJEQ==",
       "dev": true,
       "license": "MIT",
       "optional": true,
       "dependencies": {
-        "@emnapi/wasi-threads": "1.2.1",
+        "@emnapi/wasi-threads": "1.2.2",
         "tslib": "^2.4.0"
       }
     },
     "node_modules/@rolldown/binding-wasm32-wasi/node_modules/@emnapi/runtime": {
-      "version": "1.10.0",
-      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.10.0.tgz",
-      "integrity": "sha512-ewvYlk86xUoGI0zQRNq/mC+16R1QeDlKQy21Ki3oSYXNgLb45GV1P6A0M+/s6nyCuNDqe5VpaY84BzXGwVbwFA==",
+      "version": "1.11.1",
+      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.11.1.tgz",
+      "integrity": "sha512-vgj7R3y3Wgx24IQaGPA/R6YFXLHVMOZ0uVEyIQPaWs+rd1AzfEMXlAC22FYwO1XkKR6NPsq7mUandH8oIRdZFw==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@rolldown/binding-wasm32-wasi/node_modules/@emnapi/wasi-threads": {
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/@emnapi/wasi-threads/-/wasi-threads-1.2.2.tgz",
+      "integrity": "sha512-c95qOXkHdydNKhscBTebqEC1CVAZpyqOfVfBzQ1qgzyl3gfeldUjIggDbIZgDKsHLgnsM+igH7TJ/eAasaVuMA==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -2757,9 +2814,9 @@
       }
     },
     "node_modules/@rolldown/binding-win32-arm64-msvc": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.0.3.tgz",
-      "integrity": "sha512-gEdFFEN70A/jxb2svrWsN3aDL7OUtmvlOy+6fa2jxG8K0wQ1ZbdeLGnidov6Yu5/733dI5ySfzFlQ/cb0bSz1g==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.1.4.tgz",
+      "integrity": "sha512-PnWBtw3TV5KOg69HQQDR0mnQuyCmSGR2pAB4DC1rPF808fgKeTUMj2EOEyKATpgiuxuR5APQmiDO7PDgEjTFSA==",
       "cpu": [
         "arm64"
       ],
@@ -2774,9 +2831,9 @@
       }
     },
     "node_modules/@rolldown/binding-win32-x64-msvc": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.0.3.tgz",
-      "integrity": "sha512-eXB7CHuaQdqmJcc3koCNtNPmT/bj2gc999kUFgBxG8Ac0NdgXc4rkCHhqrgrhN3zddvvvrgzj1e90SuSfmyIXA==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.1.4.tgz",
+      "integrity": "sha512-M1lpniBePobTfsa7Ks9a199e1akxsXn+GYBUKsEzv3YFzOm1HJAMNwKI3qr0Zq+mxwx9gOZoTdP1yXRYsZUocQ==",
       "cpu": [
         "x64"
       ],
@@ -2945,14 +3002,13 @@
       "license": "MIT"
     },
     "node_modules/@storybook/icons": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/@storybook/icons/-/icons-2.0.2.tgz",
-      "integrity": "sha512-KZBCpXsshAIjczYNXR/rlxEtCUX/eAbpFNwKi8bcOomrLA4t/SyPz5RF+lVPO2oZBUE4sAkt43mfJUevQDSEEw==",
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/@storybook/icons/-/icons-2.1.0.tgz",
+      "integrity": "sha512-Fxh9vYpX9bQqFeHRiY8h2ApeRGDzRSMLwJwNZ/AIRqnyOKHxRKL+yFe+ctEkVJmuptRE9u1Hrn8ZZNHyfDKKNg==",
       "dev": true,
       "license": "MIT",
       "peerDependencies": {
-        "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
-        "react-dom": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0"
+        "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0"
       }
     },
     "node_modules/@storybook/react": {
@@ -3046,15 +3102,15 @@
       }
     },
     "node_modules/@swc/core": {
-      "version": "1.15.41",
-      "resolved": "https://registry.npmjs.org/@swc/core/-/core-1.15.41.tgz",
-      "integrity": "sha512-03nQq/082QRJJiOvp3FGbgxTGyyxMxohPTjhk/W9bD2J0tk4ukITI7goOhOO2WbaHn/lsPmo/zf8+DIXhwpgYQ==",
+      "version": "1.15.43",
+      "resolved": "https://registry.npmjs.org/@swc/core/-/core-1.15.43.tgz",
+      "integrity": "sha512-1CuKjFkPxIgGdeHVuNbkxmBxkcbdc08u0aiI43pFq6yY1tTVKmXT9hFEooyyKs/sJ3xf1GPHyEwTtk9Xl8dvQw==",
       "dev": true,
       "hasInstallScript": true,
       "license": "Apache-2.0",
       "dependencies": {
         "@swc/counter": "^0.1.3",
-        "@swc/types": "^0.1.26"
+        "@swc/types": "^0.1.27"
       },
       "engines": {
         "node": ">=10"
@@ -3064,18 +3120,18 @@
         "url": "https://opencollective.com/swc"
       },
       "optionalDependencies": {
-        "@swc/core-darwin-arm64": "1.15.41",
-        "@swc/core-darwin-x64": "1.15.41",
-        "@swc/core-linux-arm-gnueabihf": "1.15.41",
-        "@swc/core-linux-arm64-gnu": "1.15.41",
-        "@swc/core-linux-arm64-musl": "1.15.41",
-        "@swc/core-linux-ppc64-gnu": "1.15.41",
-        "@swc/core-linux-s390x-gnu": "1.15.41",
-        "@swc/core-linux-x64-gnu": "1.15.41",
-        "@swc/core-linux-x64-musl": "1.15.41",
-        "@swc/core-win32-arm64-msvc": "1.15.41",
-        "@swc/core-win32-ia32-msvc": "1.15.41",
-        "@swc/core-win32-x64-msvc": "1.15.41"
+        "@swc/core-darwin-arm64": "1.15.43",
+        "@swc/core-darwin-x64": "1.15.43",
+        "@swc/core-linux-arm-gnueabihf": "1.15.43",
+        "@swc/core-linux-arm64-gnu": "1.15.43",
+        "@swc/core-linux-arm64-musl": "1.15.43",
+        "@swc/core-linux-ppc64-gnu": "1.15.43",
+        "@swc/core-linux-s390x-gnu": "1.15.43",
+        "@swc/core-linux-x64-gnu": "1.15.43",
+        "@swc/core-linux-x64-musl": "1.15.43",
+        "@swc/core-win32-arm64-msvc": "1.15.43",
+        "@swc/core-win32-ia32-msvc": "1.15.43",
+        "@swc/core-win32-x64-msvc": "1.15.43"
       },
       "peerDependencies": {
         "@swc/helpers": ">=0.5.17"
@@ -3087,9 +3143,9 @@
       }
     },
     "node_modules/@swc/core-darwin-arm64": {
-      "version": "1.15.41",
-      "resolved": "https://registry.npmjs.org/@swc/core-darwin-arm64/-/core-darwin-arm64-1.15.41.tgz",
-      "integrity": "sha512-kREh6J5paQFvP3i7f/4FbqRNOJREutVFVOkder4GVyCBQ39YmER55cW/y1NNjwrchzFqgYswFn0mMDCqbqKzrw==",
+      "version": "1.15.43",
+      "resolved": "https://registry.npmjs.org/@swc/core-darwin-arm64/-/core-darwin-arm64-1.15.43.tgz",
+      "integrity": "sha512-v1aVuvXdo/BHxJzco9V2xpHrvwWmhfS8t6gziY5wJxd+Z2h8AeJRnAwPD8itCDaGXVBwJ/CaKfxEzTkG0Va0OA==",
       "cpu": [
         "arm64"
       ],
@@ -3104,9 +3160,9 @@
       }
     },
     "node_modules/@swc/core-darwin-x64": {
-      "version": "1.15.41",
-      "resolved": "https://registry.npmjs.org/@swc/core-darwin-x64/-/core-darwin-x64-1.15.41.tgz",
-      "integrity": "sha512-N8B56ESFazZAWZyIkecADSPCwlLEinW7QLMEeotCpv4J7VXwfH+OLkmRL8o96UZ+1355fwHxDTS6/wK7yucvkA==",
+      "version": "1.15.43",
+      "resolved": "https://registry.npmjs.org/@swc/core-darwin-x64/-/core-darwin-x64-1.15.43.tgz",
+      "integrity": "sha512-lp3d4Lamc8dt5huYdGLSR+9hLxmfr1jb0l+4XXG2zPqZwYWRN9R0U2qYoTrggiU2RWW0oV9VbWM3kBnqIc2kdQ==",
       "cpu": [
         "x64"
       ],
@@ -3121,9 +3177,9 @@
       }
     },
     "node_modules/@swc/core-linux-arm-gnueabihf": {
-      "version": "1.15.41",
-      "resolved": "https://registry.npmjs.org/@swc/core-linux-arm-gnueabihf/-/core-linux-arm-gnueabihf-1.15.41.tgz",
-      "integrity": "sha512-6XrId2fyle0mS5xxON8rU84mPd2Cq1kDJRj+4BnQKTd7u+2kSA6Ww+JkOP0iTNqOqt9OXhPOEAjBHAuonWcdCg==",
+      "version": "1.15.43",
+      "resolved": "https://registry.npmjs.org/@swc/core-linux-arm-gnueabihf/-/core-linux-arm-gnueabihf-1.15.43.tgz",
+      "integrity": "sha512-JWTQQELtsG5GgphDrr/XqqmM2pDN3cZqbMS0Mrg+iTiXL3F74sn/S2IyYE/5u4h2KLkTf9qQ7dXyxsbx7YzkeA==",
       "cpu": [
         "arm"
       ],
@@ -3138,9 +3194,9 @@
       }
     },
     "node_modules/@swc/core-linux-arm64-gnu": {
-      "version": "1.15.41",
-      "resolved": "https://registry.npmjs.org/@swc/core-linux-arm64-gnu/-/core-linux-arm64-gnu-1.15.41.tgz",
-      "integrity": "sha512-ynLIarxlkVnqHn1D0fKOVht6mNU5ks6lrH+MY3kkS+XFaGGgDxFZVjWKJlkYTKm3RCvBTfA8Ng5fLufXheMRKQ==",
+      "version": "1.15.43",
+      "resolved": "https://registry.npmjs.org/@swc/core-linux-arm64-gnu/-/core-linux-arm64-gnu-1.15.43.tgz",
+      "integrity": "sha512-B4otJRdPWIsmiSBf0uG7Z/+vMWmkufjz5MmYxubwKuZazDW14Zd3symga1N62QR4RT+kEFeHEgsXfZGyn/w0hw==",
       "cpu": [
         "arm64"
       ],
@@ -3158,9 +3214,9 @@
       }
     },
     "node_modules/@swc/core-linux-arm64-musl": {
-      "version": "1.15.41",
-      "resolved": "https://registry.npmjs.org/@swc/core-linux-arm64-musl/-/core-linux-arm64-musl-1.15.41.tgz",
-      "integrity": "sha512-dXu/5vd4gh8symyhRF+4G7gOPkjmb4pONhh7sl+6GSiW0LOKZlfu5kXmyFbTz9smOT7jgr002qY9b1nujjXt2A==",
+      "version": "1.15.43",
+      "resolved": "https://registry.npmjs.org/@swc/core-linux-arm64-musl/-/core-linux-arm64-musl-1.15.43.tgz",
+      "integrity": "sha512-6zB6OnpViBxYy4tgY3v2i6AZY9fwkcHZ032UOwtwUuW1d19sdT07qF0kZe6/3UR1tUaK6jjg2rmVcUIBCEYVjQ==",
       "cpu": [
         "arm64"
       ],
@@ -3178,9 +3234,9 @@
       }
     },
     "node_modules/@swc/core-linux-ppc64-gnu": {
-      "version": "1.15.41",
-      "resolved": "https://registry.npmjs.org/@swc/core-linux-ppc64-gnu/-/core-linux-ppc64-gnu-1.15.41.tgz",
-      "integrity": "sha512-XGO6zVPXoPE0gf/XnI4jBbafNT13AYgoh6ns0JCSdOetI/kqVf0vhpz7NuNgAzZrMVCsmieqjPoTwViDgh4mOQ==",
+      "version": "1.15.43",
+      "resolved": "https://registry.npmjs.org/@swc/core-linux-ppc64-gnu/-/core-linux-ppc64-gnu-1.15.43.tgz",
+      "integrity": "sha512-coxE1ZWdB3uSDVNoEtYNrRi/1epvckZx9cTJ8ICUxTMTxGk+yvQ/Twacp3ruZSaMPGCriUjP86C37VhaT6nyRg==",
       "cpu": [
         "ppc64"
       ],
@@ -3198,9 +3254,9 @@
       }
     },
     "node_modules/@swc/core-linux-s390x-gnu": {
-      "version": "1.15.41",
-      "resolved": "https://registry.npmjs.org/@swc/core-linux-s390x-gnu/-/core-linux-s390x-gnu-1.15.41.tgz",
-      "integrity": "sha512-0WUglRwyZtW+iMi7J3iFdrCxreZZIKf4egTwEQfIYRsqFax69A0OrFj+NIoFSE03xBT/IFRrg+S8K6f9Ky+4hA==",
+      "version": "1.15.43",
+      "resolved": "https://registry.npmjs.org/@swc/core-linux-s390x-gnu/-/core-linux-s390x-gnu-1.15.43.tgz",
+      "integrity": "sha512-lXfLhs+LpBsD5inuYx+YDH5WsPPBQ95KPUiy8P5wq9ob9xKDZFqwNfU2QW6bGO8NqRO/H9JQomTSt5Yyh+FGfA==",
       "cpu": [
         "s390x"
       ],
@@ -3218,9 +3274,9 @@
       }
     },
     "node_modules/@swc/core-linux-x64-gnu": {
-      "version": "1.15.41",
-      "resolved": "https://registry.npmjs.org/@swc/core-linux-x64-gnu/-/core-linux-x64-gnu-1.15.41.tgz",
-      "integrity": "sha512-VxkuQK59c0tHm6uJZCUrS3cyA2JhGGfdU6e41SZz0x/JS+4Sm7C1mIc97In14vkZJopEt7yXA2TouCqZDSygEA==",
+      "version": "1.15.43",
+      "resolved": "https://registry.npmjs.org/@swc/core-linux-x64-gnu/-/core-linux-x64-gnu-1.15.43.tgz",
+      "integrity": "sha512-07XnKwTmKy8TGOZG3D9fRnLWGynxPjwQnZLVmBFbo6F+7vHYzBIOuwXEhemrChBWb6yDNZsVCcMWCPX6FDD2xg==",
       "cpu": [
         "x64"
       ],
@@ -3238,9 +3294,9 @@
       }
     },
     "node_modules/@swc/core-linux-x64-musl": {
-      "version": "1.15.41",
-      "resolved": "https://registry.npmjs.org/@swc/core-linux-x64-musl/-/core-linux-x64-musl-1.15.41.tgz",
-      "integrity": "sha512-/0qXIu1ZxggLuovLb22vFfKHq2AA4n6Whw5UwmVCHk4pkw7KWnPIQpMCEqUMPsNkFJig7PPp/TSYFu8ZEb2rtQ==",
+      "version": "1.15.43",
+      "resolved": "https://registry.npmjs.org/@swc/core-linux-x64-musl/-/core-linux-x64-musl-1.15.43.tgz",
+      "integrity": "sha512-TJc+bsSIaBh+hZvZ5GRtW/K1bw66TJ9vsUwvVIsZdiWxU5ObLwZvfcnZ3UpgVfMnFibRes9uriJrQNBHEEogRQ==",
       "cpu": [
         "x64"
       ],
@@ -3258,9 +3314,9 @@
       }
     },
     "node_modules/@swc/core-win32-arm64-msvc": {
-      "version": "1.15.41",
-      "resolved": "https://registry.npmjs.org/@swc/core-win32-arm64-msvc/-/core-win32-arm64-msvc-1.15.41.tgz",
-      "integrity": "sha512-Y481sMNZM6rECh9VO4+y26N1lWEDAyxnBZskUf37fl90uHE946VHfmiVQWT0uMFOhyJJFovGTRuF4W82dwewUg==",
+      "version": "1.15.43",
+      "resolved": "https://registry.npmjs.org/@swc/core-win32-arm64-msvc/-/core-win32-arm64-msvc-1.15.43.tgz",
+      "integrity": "sha512-jfd7s2/bUQYkOHLs+LWQNKZdmDa8+sufKLllhpWAhVQ2GDCwsHe3vR/j+OSiItZNtkzFuaawa3+SAKz9y5gYfw==",
       "cpu": [
         "arm64"
       ],
@@ -3275,9 +3331,9 @@
       }
     },
     "node_modules/@swc/core-win32-ia32-msvc": {
-      "version": "1.15.41",
-      "resolved": "https://registry.npmjs.org/@swc/core-win32-ia32-msvc/-/core-win32-ia32-msvc-1.15.41.tgz",
-      "integrity": "sha512-BAchBD5qeUzy3hiPSLJtaaoSm4blCLyYffOF1bGE4ETcV+OisqjUAwDQMJj++4bTpvMCDzwC+Bj3PmQyBCtscw==",
+      "version": "1.15.43",
+      "resolved": "https://registry.npmjs.org/@swc/core-win32-ia32-msvc/-/core-win32-ia32-msvc-1.15.43.tgz",
+      "integrity": "sha512-rLAE8JvucqEW1ZGohxPQrQWPBQeJG4+ypKbWfdlU/qmKScvCkxf9/Jxnzki1dkUQCQ7P5Enp13RlvqOlvx/32g==",
       "cpu": [
         "ia32"
       ],
@@ -3292,9 +3348,9 @@
       }
     },
     "node_modules/@swc/core-win32-x64-msvc": {
-      "version": "1.15.41",
-      "resolved": "https://registry.npmjs.org/@swc/core-win32-x64-msvc/-/core-win32-x64-msvc-1.15.41.tgz",
-      "integrity": "sha512-WOkA+fJ/ViVBQDsSV9JC52NACTe5PhlurA6viASDZGb7HR3KS01ZG7RZ+Bg6SVQFIoq3gSbTsskQVe6EbHFAYw==",
+      "version": "1.15.43",
+      "resolved": "https://registry.npmjs.org/@swc/core-win32-x64-msvc/-/core-win32-x64-msvc-1.15.43.tgz",
+      "integrity": "sha512-h8MLDHZcfIukwQWj03rIJZx1I0E81AYj2X7J/nGErG4nz+QAv6G1Z+peotvinL3lqpbo32tLYSMFo32/ySzxKg==",
       "cpu": [
         "x64"
       ],
@@ -3326,9 +3382,9 @@
       }
     },
     "node_modules/@tailwindcss/node": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/node/-/node-4.3.1.tgz",
-      "integrity": "sha512-6NDaqRoAMSXD1mr/RXu0HBvNE9a2n5tHPsxu9XHLws8o4Twes5rBM2205SUUiJ9goAtadrN6xTGX0UDEwp/N4A==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/node/-/node-4.3.2.tgz",
+      "integrity": "sha512-yWP/sqEcBLaD8JuA6zNwxoYKr75qxTioYwlRwekj5Jr/I5GXnoJfjetH/psLUIv74cYTH2lBUEzBkinthoYcBg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3338,37 +3394,37 @@
         "lightningcss": "1.32.0",
         "magic-string": "^0.30.21",
         "source-map-js": "^1.2.1",
-        "tailwindcss": "4.3.1"
+        "tailwindcss": "4.3.2"
       }
     },
     "node_modules/@tailwindcss/oxide": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide/-/oxide-4.3.1.tgz",
-      "integrity": "sha512-yVPyo8RNkabVr3O2EhHEE0Rewu7YKzc1DhIqfL46LKveFrmu9XbDazNOJY7/GRuvw1h6u3utWnR29H/p5JPlgA==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide/-/oxide-4.3.2.tgz",
+      "integrity": "sha512-z8ZgnzX8gdNoWLBLqBPoh/sjnxkwvf9ZuWjnO0l0yIzbLa5/9S+eC5QxGZKRobVHIC3/1BoMWjHblqWjcgFgag==",
       "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">= 20"
       },
       "optionalDependencies": {
-        "@tailwindcss/oxide-android-arm64": "4.3.1",
-        "@tailwindcss/oxide-darwin-arm64": "4.3.1",
-        "@tailwindcss/oxide-darwin-x64": "4.3.1",
-        "@tailwindcss/oxide-freebsd-x64": "4.3.1",
-        "@tailwindcss/oxide-linux-arm-gnueabihf": "4.3.1",
-        "@tailwindcss/oxide-linux-arm64-gnu": "4.3.1",
-        "@tailwindcss/oxide-linux-arm64-musl": "4.3.1",
-        "@tailwindcss/oxide-linux-x64-gnu": "4.3.1",
-        "@tailwindcss/oxide-linux-x64-musl": "4.3.1",
-        "@tailwindcss/oxide-wasm32-wasi": "4.3.1",
-        "@tailwindcss/oxide-win32-arm64-msvc": "4.3.1",
-        "@tailwindcss/oxide-win32-x64-msvc": "4.3.1"
+        "@tailwindcss/oxide-android-arm64": "4.3.2",
+        "@tailwindcss/oxide-darwin-arm64": "4.3.2",
+        "@tailwindcss/oxide-darwin-x64": "4.3.2",
+        "@tailwindcss/oxide-freebsd-x64": "4.3.2",
+        "@tailwindcss/oxide-linux-arm-gnueabihf": "4.3.2",
+        "@tailwindcss/oxide-linux-arm64-gnu": "4.3.2",
+        "@tailwindcss/oxide-linux-arm64-musl": "4.3.2",
+        "@tailwindcss/oxide-linux-x64-gnu": "4.3.2",
+        "@tailwindcss/oxide-linux-x64-musl": "4.3.2",
+        "@tailwindcss/oxide-wasm32-wasi": "4.3.2",
+        "@tailwindcss/oxide-win32-arm64-msvc": "4.3.2",
+        "@tailwindcss/oxide-win32-x64-msvc": "4.3.2"
       }
     },
     "node_modules/@tailwindcss/oxide-android-arm64": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-android-arm64/-/oxide-android-arm64-4.3.1.tgz",
-      "integrity": "sha512-SVlyf61g374l5cHyg8x9kf5xmLcOaxvOTsbsqDnSsDJaKOEFZ7GCvi84VAVGpxojYOs1+3K6M0UjXfqPU8vmOQ==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-android-arm64/-/oxide-android-arm64-4.3.2.tgz",
+      "integrity": "sha512-WHxqIuHpvZ5VtdX6GTl1Ik/Vp2YuN42Et+0CdeaVd/frQ9jAvGmvR8vLT+jk3e8/Q3x8kECB9+R17pgpp2BulA==",
       "cpu": [
         "arm64"
       ],
@@ -3383,9 +3439,9 @@
       }
     },
     "node_modules/@tailwindcss/oxide-darwin-arm64": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-darwin-arm64/-/oxide-darwin-arm64-4.3.1.tgz",
-      "integrity": "sha512-hVnWLwv+e/l7c4WKyVtHVrIPvYdqWHjRB3MDIqARynzFtnQg85kmQEFCbV9Ja0VVx4xXTIiDWY60Y7iz/iNoDA==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-darwin-arm64/-/oxide-darwin-arm64-4.3.2.tgz",
+      "integrity": "sha512-GZypeUY/IDJW3877KeM+O67vbXr3MBnbtEL4aYhNErv/JWZhye2vGSWWG9tB6iiqR2MqRNkY8IOUy4NdSZV26w==",
       "cpu": [
         "arm64"
       ],
@@ -3400,9 +3456,9 @@
       }
     },
     "node_modules/@tailwindcss/oxide-darwin-x64": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-darwin-x64/-/oxide-darwin-x64-4.3.1.tgz",
-      "integrity": "sha512-Cf7abu0WVgbhU7ANgPUnSAvm7nCvMweusHb8FnaHlLfv/Caq4GYaEZg7ZImzzmjx4lIAfuS8q+eLIS7A7IzxIg==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-darwin-x64/-/oxide-darwin-x64-4.3.2.tgz",
+      "integrity": "sha512-UIIzmefR6KO1sDU7MzRqAxC8iBpft/VhkGjTjnhoS6k7Z3rQ9wEgA1ODSiyH/tcSYssulNm4Ci3hOeK1jH7ccQ==",
       "cpu": [
         "x64"
       ],
@@ -3417,9 +3473,9 @@
       }
     },
     "node_modules/@tailwindcss/oxide-freebsd-x64": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-freebsd-x64/-/oxide-freebsd-x64-4.3.1.tgz",
-      "integrity": "sha512-ZZqzX2Y+GXtXXfqSfpJhDm60OoZfvLHLCgm+J7NVqgHHJjG/m9ugZI77RwTsVd4fnBJuCFP6Ae6kTJb71UdS8g==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-freebsd-x64/-/oxide-freebsd-x64-4.3.2.tgz",
+      "integrity": "sha512-GN+uAmcI6DNspnCDwtOAZrTz6oukJnp337qZvxqCGLd3BHBzJpO0ZbTLRvJNdztOeAmTzewewGIMPb0tk2R4WA==",
       "cpu": [
         "x64"
       ],
@@ -3434,9 +3490,9 @@
       }
     },
     "node_modules/@tailwindcss/oxide-linux-arm-gnueabihf": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm-gnueabihf/-/oxide-linux-arm-gnueabihf-4.3.1.tgz",
-      "integrity": "sha512-/Ah/xik0LaMYfv9DZ0S/t4pBlBNYOcqtRwusjgovHkvT8ixueWCLyJjsaF5kQIckjb4IT8Q6K6p/iPmZMixYgg==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm-gnueabihf/-/oxide-linux-arm-gnueabihf-4.3.2.tgz",
+      "integrity": "sha512-4ABn7qSbdHRwTiDiuWNegCyb5+2FJ4vKIKc3DmKrvAFw7MU1Lm11dIkTPwUaFdTzc7IsOpDbqBrlh0x6y36U/w==",
       "cpu": [
         "arm"
       ],
@@ -3451,9 +3507,9 @@
       }
     },
     "node_modules/@tailwindcss/oxide-linux-arm64-gnu": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm64-gnu/-/oxide-linux-arm64-gnu-4.3.1.tgz",
-      "integrity": "sha512-gqdFoVJlw444GvpnheZLHmvTzSxI/cOUUh2KSNejQjTcYkW062SVD+En0rUgD+QV91bz1XGIGtt1HJd48xUGbQ==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm64-gnu/-/oxide-linux-arm64-gnu-4.3.2.tgz",
+      "integrity": "sha512-wDgEIGwoM8w8pufh9LVt1PahDgNdKXrLC2qfAnV3vAmococ9RWbxeAw4pxPttd/TsJfwjyLf90Dg1y9y8I6Emw==",
       "cpu": [
         "arm64"
       ],
@@ -3471,9 +3527,9 @@
       }
     },
     "node_modules/@tailwindcss/oxide-linux-arm64-musl": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm64-musl/-/oxide-linux-arm64-musl-4.3.1.tgz",
-      "integrity": "sha512-Bwv9KwOvE0VKa86xPFif9b9c3Y1NxOV1P0gLti/IYaWEsQYZXDlxfGEtA8mdDZ7SG3wyNXAWYT5SIn3giL57oA==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm64-musl/-/oxide-linux-arm64-musl-4.3.2.tgz",
+      "integrity": "sha512-J5Nuk0uZQIiMTJj3LEx4sAA9tMFUoXQZFv1J6An+QGYe53HKRJuFDi0rpq/tuouCZeAbOBY3kQ6g8qeD4TUjtA==",
       "cpu": [
         "arm64"
       ],
@@ -3491,9 +3547,9 @@
       }
     },
     "node_modules/@tailwindcss/oxide-linux-x64-gnu": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-x64-gnu/-/oxide-linux-x64-gnu-4.3.1.tgz",
-      "integrity": "sha512-Ymi8O8T15HYQdOUWUtTI6ldN0neHP85FC+Qz32xTcZ7iJXtem/x8ITev0o1e9e5rkqj4lONZfTRLvkmin1+tKg==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-x64-gnu/-/oxide-linux-x64-gnu-4.3.2.tgz",
+      "integrity": "sha512-kqCZpSKOBEJO4mz7OqWoofBZeXTAwaVGPj0ErAj7CojmhKpWVWVOnrt9dE8odoIraZq4oj3ausM37kXi+Tow8w==",
       "cpu": [
         "x64"
       ],
@@ -3511,9 +3567,9 @@
       }
     },
     "node_modules/@tailwindcss/oxide-linux-x64-musl": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-x64-musl/-/oxide-linux-x64-musl-4.3.1.tgz",
-      "integrity": "sha512-M+P/91qJ6uILLw4k2G93GMDRAXj61SMvFQYt39AqvUqYgExXpLL5aepfns7sj4HiAQeolirQF9E0lzRvdf4zPQ==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-x64-musl/-/oxide-linux-x64-musl-4.3.2.tgz",
+      "integrity": "sha512-cixpqbh2toJDmkuCRI68nXA8ZxNmdK9Y+9v5h3MC3ZQKy/0BO8AWzlkWyRM7JAFSGBlfig4YVTPsK6MVgqz1uw==",
       "cpu": [
         "x64"
       ],
@@ -3531,9 +3587,9 @@
       }
     },
     "node_modules/@tailwindcss/oxide-wasm32-wasi": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-wasm32-wasi/-/oxide-wasm32-wasi-4.3.1.tgz",
-      "integrity": "sha512-zsM8uOeqvVGHsAXsJxsT28ttosFahLJKCLOTUBqRAtKnVgGSRitds9T432QiT8b77Yga7JIBkulIRRlJPtYhRA==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-wasm32-wasi/-/oxide-wasm32-wasi-4.3.2.tgz",
+      "integrity": "sha512-4ec2Z/LOmRsAgU23CS4xeJfcJlmRg94A/XrbGRCF1gyU/zdDfRLYDVsS+ynSZCmGNxQ1jQriQOKMQeQxBA3Isw==",
       "bundleDependencies": [
         "@napi-rs/wasm-runtime",
         "@emnapi/core",
@@ -3549,9 +3605,9 @@
       "license": "MIT",
       "optional": true,
       "dependencies": {
-        "@emnapi/core": "^1.10.0",
-        "@emnapi/runtime": "^1.10.0",
-        "@emnapi/wasi-threads": "^1.2.1",
+        "@emnapi/core": "^1.11.1",
+        "@emnapi/runtime": "^1.11.1",
+        "@emnapi/wasi-threads": "^1.2.2",
         "@napi-rs/wasm-runtime": "^1.1.4",
         "@tybys/wasm-util": "^0.10.2",
         "tslib": "^2.8.1"
@@ -3561,9 +3617,9 @@
       }
     },
     "node_modules/@tailwindcss/oxide-win32-arm64-msvc": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-arm64-msvc/-/oxide-win32-arm64-msvc-4.3.1.tgz",
-      "integrity": "sha512-aiNvSq9BsVk8V513lDKlrCFAgf8qBMPZTpgEhInL+NwQqs97mYmupVMrPrgBBSL8Pv/0zXu9MrMF9rMun1ZeNg==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-arm64-msvc/-/oxide-win32-arm64-msvc-4.3.2.tgz",
+      "integrity": "sha512-Zyr/M0+XcYZu3bZrUytc7TXvrk0ftWfl8gN2MwekNDzhqhKRUucMPSeOzM0o0wH5AWOU49BsKRrfKxI2atCPMQ==",
       "cpu": [
         "arm64"
       ],
@@ -3578,9 +3634,9 @@
       }
     },
     "node_modules/@tailwindcss/oxide-win32-x64-msvc": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-x64-msvc/-/oxide-win32-x64-msvc-4.3.1.tgz",
-      "integrity": "sha512-xDEyu1rg290472FEGaKHnzyDyh5QH+AlWvsU5hMoMtPpzmKlRI0jaYKCgSHDYtaQWZOYbMaduSyCwFwY4n1HmA==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-x64-msvc/-/oxide-win32-x64-msvc-4.3.2.tgz",
+      "integrity": "sha512-QI9BO7KlNZsp2GuO0jwAAj5jCDABOKXRkCk2XuKTSaNEFSdfzqswYVTtCHBNKHLsqyjFyFkqlDiwkNbTYSssMQ==",
       "cpu": [
         "x64"
       ],
@@ -3595,23 +3651,23 @@
       }
     },
     "node_modules/@tailwindcss/postcss": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/postcss/-/postcss-4.3.1.tgz",
-      "integrity": "sha512-dNJuNbdEJT/SWRuXTYP1WSamelsz3ztkUsdtWQPjrexysrTpaEPM40P/71knXiXLYEojqPOEGitVLLpPMS5T6A==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/postcss/-/postcss-4.3.2.tgz",
+      "integrity": "sha512-rjVWYCa7Ngbi5AarT6k8TkxUG3Wl1QKzHdIZVsjZSzf36Jmo2IKZt/NHRAwly8oDkbBOH0YTu+CHuf9jPxMc+g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@alloc/quick-lru": "^5.2.0",
-        "@tailwindcss/node": "4.3.1",
-        "@tailwindcss/oxide": "4.3.1",
-        "postcss": "8.5.15",
-        "tailwindcss": "4.3.1"
+        "@tailwindcss/node": "4.3.2",
+        "@tailwindcss/oxide": "4.3.2",
+        "postcss": "^8.5.15",
+        "tailwindcss": "4.3.2"
       }
     },
     "node_modules/@tanstack/query-core": {
-      "version": "5.101.0",
-      "resolved": "https://registry.npmjs.org/@tanstack/query-core/-/query-core-5.101.0.tgz",
-      "integrity": "sha512-cQetA74EB+seWySv1TTKr828TnP0u39m6LykwDXIo84SNortpDkp30TMEjkqtYCNP9c40uT/iwl6MLiufEt0Ow==",
+      "version": "5.101.2",
+      "resolved": "https://registry.npmjs.org/@tanstack/query-core/-/query-core-5.101.2.tgz",
+      "integrity": "sha512-hH5MLoJhF7KaIGd7q3xTXGXvslI+GYlM1Z/35aSHHWaCJWB7XvTSHYuV3eM7tw+aE0mT/xMro4M4Q9rCGHT0lw==",
       "license": "MIT",
       "funding": {
         "type": "github",
@@ -3619,12 +3675,12 @@
       }
     },
     "node_modules/@tanstack/react-query": {
-      "version": "5.101.0",
-      "resolved": "https://registry.npmjs.org/@tanstack/react-query/-/react-query-5.101.0.tgz",
-      "integrity": "sha512-rLlJXSpkqfizLWgkR5+eLeIk0MvTx/meEIR7LRjxic+qxiQP8zVjq7BqQkiCMNLQBlLfuOLqqr6KO5GtrDlmSg==",
+      "version": "5.101.2",
+      "resolved": "https://registry.npmjs.org/@tanstack/react-query/-/react-query-5.101.2.tgz",
+      "integrity": "sha512-seDkr6kzGzX1okaaTtZPtgA688CDPlXUz1C6xSg0ESqn04Vuc8tlrYms1s3de+znBqhPVxFRfpAfUf+6XvfPWg==",
       "license": "MIT",
       "dependencies": {
-        "@tanstack/query-core": "5.101.0"
+        "@tanstack/query-core": "5.101.2"
       },
       "funding": {
         "type": "github",
@@ -3724,9 +3780,9 @@
       }
     },
     "node_modules/@tybys/wasm-util": {
-      "version": "0.10.2",
-      "resolved": "https://registry.npmjs.org/@tybys/wasm-util/-/wasm-util-0.10.2.tgz",
-      "integrity": "sha512-RoBvJ2X0wuKlWFIjrwffGw1IqZHKQqzIchKaadZZfnNpsAYp2mM0h36JtPCjNDAHGgYez/15uMBpfGwchhiMgg==",
+      "version": "0.10.3",
+      "resolved": "https://registry.npmjs.org/@tybys/wasm-util/-/wasm-util-0.10.3.tgz",
+      "integrity": "sha512-F3fo1MYrRJYL3zER0OUOmkutjr1Vp23m7OsSgp7nq4SP6OqX6C/56XFIPAl5bt3zaBRjmW7SGz3u/6LwFpYcOg==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -3877,17 +3933,17 @@
       "license": "MIT"
     },
     "node_modules/@typescript-eslint/eslint-plugin": {
-      "version": "8.61.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.61.1.tgz",
-      "integrity": "sha512-ZPlVl3PB3et/59Ne0fv/sci6ZXz4T4Hp4nTJ56i/Y0gR89ARb+KphojTq6j+56E5PIezmOIOOWyY+aWQFd+IkQ==",
+      "version": "8.62.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.62.1.tgz",
+      "integrity": "sha512-4EQM77WgVNxj7OkL/5b/D/xZsw00G577+UriYTC7JF5opcF3T2AuoeY7ueLaZgSVjSgCS6yOAJB5bRGLPSJUzA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@eslint-community/regexpp": "^4.12.2",
-        "@typescript-eslint/scope-manager": "8.61.1",
-        "@typescript-eslint/type-utils": "8.61.1",
-        "@typescript-eslint/utils": "8.61.1",
-        "@typescript-eslint/visitor-keys": "8.61.1",
+        "@typescript-eslint/scope-manager": "8.62.1",
+        "@typescript-eslint/type-utils": "8.62.1",
+        "@typescript-eslint/utils": "8.62.1",
+        "@typescript-eslint/visitor-keys": "8.62.1",
         "ignore": "^7.0.5",
         "natural-compare": "^1.4.0",
         "ts-api-utils": "^2.5.0"
@@ -3900,7 +3956,7 @@
         "url": "https://opencollective.com/typescript-eslint"
       },
       "peerDependencies": {
-        "@typescript-eslint/parser": "^8.61.1",
+        "@typescript-eslint/parser": "^8.62.1",
         "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
         "typescript": ">=4.8.4 <6.1.0"
       }
@@ -3916,16 +3972,16 @@
       }
     },
     "node_modules/@typescript-eslint/parser": {
-      "version": "8.61.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.61.1.tgz",
-      "integrity": "sha512-PJ5vePq5/ognBbrIcoC5+SHO5dfpeLPzP9FpLkzWrguoYQEeeSjlJpVwOpo1JRSTEi7dRcwNy4h4dzV70PqHcg==",
+      "version": "8.62.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.62.1.tgz",
+      "integrity": "sha512-sPhE4iHuJDSvoAiec+Ro8JyXw8f0ql13HFR82P99nCm9GwTEKG0KYLvDe6REk8BCXuit6vJAv/Yxg5ABaNS2rA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/scope-manager": "8.61.1",
-        "@typescript-eslint/types": "8.61.1",
-        "@typescript-eslint/typescript-estree": "8.61.1",
-        "@typescript-eslint/visitor-keys": "8.61.1",
+        "@typescript-eslint/scope-manager": "8.62.1",
+        "@typescript-eslint/types": "8.62.1",
+        "@typescript-eslint/typescript-estree": "8.62.1",
+        "@typescript-eslint/visitor-keys": "8.62.1",
         "debug": "^4.4.3"
       },
       "engines": {
@@ -3941,14 +3997,14 @@
       }
     },
     "node_modules/@typescript-eslint/project-service": {
-      "version": "8.61.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.61.1.tgz",
-      "integrity": "sha512-PrC4JYGmR241lYnfhmKGTXkFqv8+ymbTFgSAY0fVXpY82/QkMw5TZPl+vGzuDDU2QYJk9fIDOBTntF+yDv9LEA==",
+      "version": "8.62.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.62.1.tgz",
+      "integrity": "sha512-yQ3RgY5RkSBpsNS1Bx/JQEcA24FOSdfGktoyprAr5u18390UQdtVcfnEv4nIrIshNnavlVyZBKxQwT1fIAE6cg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/tsconfig-utils": "^8.61.1",
-        "@typescript-eslint/types": "^8.61.1",
+        "@typescript-eslint/tsconfig-utils": "^8.62.1",
+        "@typescript-eslint/types": "^8.62.1",
         "debug": "^4.4.3"
       },
       "engines": {
@@ -3963,14 +4019,14 @@
       }
     },
     "node_modules/@typescript-eslint/scope-manager": {
-      "version": "8.61.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.61.1.tgz",
-      "integrity": "sha512-L2bdIeoQS8FlKAvONAr20w6OcLXeB+qiDKbAooS9A0Ben+iSIkBef0FxqwKWYqt5sa0i4KJtxVyVmhMylKzF5w==",
+      "version": "8.62.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.62.1.tgz",
+      "integrity": "sha512-r4d249KbQ1SFdpeStvob8Ih6aPPIzfqllPVOtvhve6ZcpuVcYo5/7zUWckKpHE7StASX4kTKZTLf0WQm/wPkcg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.61.1",
-        "@typescript-eslint/visitor-keys": "8.61.1"
+        "@typescript-eslint/types": "8.62.1",
+        "@typescript-eslint/visitor-keys": "8.62.1"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -3981,9 +4037,9 @@
       }
     },
     "node_modules/@typescript-eslint/tsconfig-utils": {
-      "version": "8.61.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.61.1.tgz",
-      "integrity": "sha512-UN/H4di+OO7EWx2ovME+8t31YO+KVnK0RRKEHR3kOt21/Ay8BOq3M1OMvWs5vNiqcFCYGYoxK3MXPZzmMUE+yg==",
+      "version": "8.62.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.62.1.tgz",
+      "integrity": "sha512-xadytJqX9vJVQ2fdQjkcIVigwaOJNWkpjdLt6cEQ+xPnrI1fkp+/jZE/I97k9KUjqtpd25i0HeyZf3T6dutv2g==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -3998,15 +4054,15 @@
       }
     },
     "node_modules/@typescript-eslint/type-utils": {
-      "version": "8.61.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.61.1.tgz",
-      "integrity": "sha512-GYRicKmVK0C4fsKgaACaknOUAq9Oa2kwsjnpFhFcS/5p4Ht5IP9OVLbgIgcK4SRk92nVHFluurg1lumD9dBcLw==",
+      "version": "8.62.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.62.1.tgz",
+      "integrity": "sha512-aXM5xlqXiTxPibXB93cLAURfT3rlizf7uMXISCXy66Isr/9hISJx3yDsKl0L7lKa51b8JpFuNKby0/O0pEm9jg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.61.1",
-        "@typescript-eslint/typescript-estree": "8.61.1",
-        "@typescript-eslint/utils": "8.61.1",
+        "@typescript-eslint/types": "8.62.1",
+        "@typescript-eslint/typescript-estree": "8.62.1",
+        "@typescript-eslint/utils": "8.62.1",
         "debug": "^4.4.3",
         "ts-api-utils": "^2.5.0"
       },
@@ -4023,9 +4079,9 @@
       }
     },
     "node_modules/@typescript-eslint/types": {
-      "version": "8.61.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.61.1.tgz",
-      "integrity": "sha512-G+CRlPqLv7Bz1IZVs03x5K59F1veqL0EJUROAdGhKsEq8qOiRiZbI+HUojPq5l0fEGOKModD9br6lObhB8zkoA==",
+      "version": "8.62.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.62.1.tgz",
+      "integrity": "sha512-ooCzJFaf+Hg+uG6fA3NRFGuFjlfNlDhBthbv4ZPU/0elCAFUfnyXUvf/WOpHz/jYwSmvU2GkR2LtyUfy1AxZ1Q==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -4037,16 +4093,16 @@
       }
     },
     "node_modules/@typescript-eslint/typescript-estree": {
-      "version": "8.61.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.61.1.tgz",
-      "integrity": "sha512-u+oQD3BqYWPc8YV9Zab4vaJElJuwOLPRc10Jm1o/qS+6Qwen14HCWwx0Seo4LnSn2wxea2Ik8DxPt2/FHmuhrg==",
+      "version": "8.62.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.62.1.tgz",
+      "integrity": "sha512-xMcW9oP9u7fAMXYs9A65CVmtLQe2r//oXINHfi8HV+oiqhih17sbLdhXr4540YWlgpDKQdY854OL5ZrdCiQsAA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/project-service": "8.61.1",
-        "@typescript-eslint/tsconfig-utils": "8.61.1",
-        "@typescript-eslint/types": "8.61.1",
-        "@typescript-eslint/visitor-keys": "8.61.1",
+        "@typescript-eslint/project-service": "8.62.1",
+        "@typescript-eslint/tsconfig-utils": "8.62.1",
+        "@typescript-eslint/types": "8.62.1",
+        "@typescript-eslint/visitor-keys": "8.62.1",
         "debug": "^4.4.3",
         "minimatch": "^10.2.2",
         "semver": "^7.7.3",
@@ -4078,16 +4134,16 @@
       }
     },
     "node_modules/@typescript-eslint/utils": {
-      "version": "8.61.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.61.1.tgz",
-      "integrity": "sha512-1+P/3Dj6jvtybE1q0HQ6yBt/gq+oKJyLdEv4HdnqasaEXRSYCAsD59mXEVQnM/ULNdQxbX77tdG4jPRjIS6knA==",
+      "version": "8.62.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.62.1.tgz",
+      "integrity": "sha512-sHtbPfuKNZCG+ih8SyjjucqRntSVmp8XgL5u6o9mAhiSn8ds5o/M/XdM0abweme2Tln3szOstOrZ9OXitvPh0g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@eslint-community/eslint-utils": "^4.9.1",
-        "@typescript-eslint/scope-manager": "8.61.1",
-        "@typescript-eslint/types": "8.61.1",
-        "@typescript-eslint/typescript-estree": "8.61.1"
+        "@typescript-eslint/scope-manager": "8.62.1",
+        "@typescript-eslint/types": "8.62.1",
+        "@typescript-eslint/typescript-estree": "8.62.1"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -4102,13 +4158,13 @@
       }
     },
     "node_modules/@typescript-eslint/visitor-keys": {
-      "version": "8.61.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.61.1.tgz",
-      "integrity": "sha512-6fJ9MHWtK14C1DSkiMlHUSOmrVebL7150xZJBlJiL62jjhIA4JmOq6flwBgDxIdBKKdoiZRel+dfPD5MLfny3w==",
+      "version": "8.62.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.62.1.tgz",
+      "integrity": "sha512-4g3BLxfdTMy8iZG0MaBkadnlRrCJ74cQiFbyEVMrkwIoqdyaXXQM22cotDvrl4x28wgIZ9rEJRoM+mmhSJpJ1g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.61.1",
+        "@typescript-eslint/types": "8.62.1",
         "eslint-visitor-keys": "^5.0.0"
       },
       "engines": {
@@ -4120,13 +4176,13 @@
       }
     },
     "node_modules/@vitejs/plugin-react": {
-      "version": "6.0.2",
-      "resolved": "https://registry.npmjs.org/@vitejs/plugin-react/-/plugin-react-6.0.2.tgz",
-      "integrity": "sha512-DlSMqo4WhThw4vB8Mpn0Woe9J+Jfq1geJ61AKW0QEgLzGMNwtIMdxbDUzLxcun8W7NbJO0e2Jg/Nxm3cCSVzzg==",
+      "version": "6.0.3",
+      "resolved": "https://registry.npmjs.org/@vitejs/plugin-react/-/plugin-react-6.0.3.tgz",
+      "integrity": "sha512-vmFvco5/QuC2f9Oj+wTk0+9XeDFkHxSamwZKYc7MxYwKICfvUvlMhqKI0VuICPltGqh1neqBKDvO4kes1ya8vg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@rolldown/pluginutils": "^1.0.0"
+        "@rolldown/pluginutils": "^1.0.1"
       },
       "engines": {
         "node": "^20.19.0 || >=22.12.0"
@@ -4511,9 +4567,9 @@
       "license": "MIT"
     },
     "node_modules/autoprefixer": {
-      "version": "10.5.0",
-      "resolved": "https://registry.npmjs.org/autoprefixer/-/autoprefixer-10.5.0.tgz",
-      "integrity": "sha512-FMhOoZV4+qR6aTUALKX2rEqGG+oyATvwBt9IIzVR5rMa2HRWPkxf+P+PAJLD1I/H5/II+HuZcBJYEFBpq39ong==",
+      "version": "10.5.2",
+      "resolved": "https://registry.npmjs.org/autoprefixer/-/autoprefixer-10.5.2.tgz",
+      "integrity": "sha512-rD5t5DwOjJdmSORcTq64j8MawTC+tbQ+HHqjR4NDumamy/ambn1UJrlKL+KdwujWxMkFjPM3pPHOEA9tl4767Q==",
       "dev": true,
       "funding": [
         {
@@ -4531,8 +4587,8 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "browserslist": "^4.28.2",
-        "caniuse-lite": "^1.0.30001787",
+        "browserslist": "^4.28.4",
+        "caniuse-lite": "^1.0.30001799",
         "fraction.js": "^5.3.4",
         "picocolors": "^1.1.1",
         "postcss-value-parser": "^4.2.0"
@@ -4558,9 +4614,9 @@
       }
     },
     "node_modules/baseline-browser-mapping": {
-      "version": "2.10.38",
-      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.10.38.tgz",
-      "integrity": "sha512-31/02mVB4yuQU6adKk5SlY6m+mxDwUq5KZkyYgnLrrKl7TEm1+3PyDtDBz2kOv/wxZz41GHsvV1A/u6RmiyBvw==",
+      "version": "2.10.41",
+      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.10.41.tgz",
+      "integrity": "sha512-WwS7MHhqGHHlaVsqRZnhvCEMS0owDX+SxRlve7JkuH7My1Ara3ZriTmCQupPfYjxMZ8I/tgxtJYr2t7taHaH4A==",
       "dev": true,
       "license": "Apache-2.0",
       "bin": {
@@ -4581,9 +4637,9 @@
       }
     },
     "node_modules/brace-expansion": {
-      "version": "5.0.6",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz",
-      "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==",
+      "version": "5.0.7",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz",
+      "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -4594,9 +4650,9 @@
       }
     },
     "node_modules/browserslist": {
-      "version": "4.28.2",
-      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.2.tgz",
-      "integrity": "sha512-48xSriZYYg+8qXna9kwqjIVzuQxi+KYWp2+5nCYnYKPTr0LvD89Jqk2Or5ogxz0NUMfIjhh2lIUX/LyX9B4oIg==",
+      "version": "4.28.4",
+      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.4.tgz",
+      "integrity": "sha512-MTc8i/x9jBQd1iMw2CFGS+rwMa07eYjLR0CCTLDACl9xhxy+nIs3KeML/biicXtk9JrZ6dnnTatmc7ErPXIxqw==",
       "dev": true,
       "funding": [
         {
@@ -4614,10 +4670,10 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "baseline-browser-mapping": "^2.10.12",
-        "caniuse-lite": "^1.0.30001782",
-        "electron-to-chromium": "^1.5.328",
-        "node-releases": "^2.0.36",
+        "baseline-browser-mapping": "^2.10.38",
+        "caniuse-lite": "^1.0.30001799",
+        "electron-to-chromium": "^1.5.376",
+        "node-releases": "^2.0.48",
         "update-browserslist-db": "^1.2.3"
       },
       "bin": {
@@ -4644,9 +4700,9 @@
       }
     },
     "node_modules/caniuse-lite": {
-      "version": "1.0.30001799",
-      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001799.tgz",
-      "integrity": "sha512-hG1bReV+OUU+MOqK4t/ZWI0tZOyz3rqS9XuhOUz1cIcbwBKjOyJEJuw9ER5JuNyqxNk8u/JUVbGibBOL1yrjFw==",
+      "version": "1.0.30001800",
+      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001800.tgz",
+      "integrity": "sha512-MMHtuAz9Ys840zAY5F4k6fV5GaivZ9sPk+nz0mY+GYVzRBnYkN0mpqkSR92oWRQ19yQWo4HvBV/FnC16AJX8MA==",
       "dev": true,
       "funding": [
         {
@@ -4921,9 +4977,9 @@
       "license": "MIT"
     },
     "node_modules/electron-to-chromium": {
-      "version": "1.5.376",
-      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.376.tgz",
-      "integrity": "sha512-cUVA7/RvbFTEuw/i3obUwDTRIXojaxkResf+ibByPFxjc6XK3VNtcQXV0NSbAlJ0FMjcJGgftVVB4Qo184EXvA==",
+      "version": "1.5.384",
+      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.384.tgz",
+      "integrity": "sha512-g6KAKY1vkYsADvSPWvdJsuYT0ixdcu6lUtD9P/wJKGBEDlZVXh2AX42j1mPqqaQPDluWjara9ziQ7xqAeXCt5A==",
       "dev": true,
       "license": "ISC"
     },
@@ -4975,9 +5031,9 @@
       }
     },
     "node_modules/es-module-lexer": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-2.1.0.tgz",
-      "integrity": "sha512-n27zTYMjYu1aj4MjCWzSP7G9r75utsaoc8m61weK+W8JMBGGQybd43GstCXZ3WNmSFtGT9wi59qQTW6mhTR5LQ==",
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-2.3.0.tgz",
+      "integrity": "sha512-KLdwQm2NvGLDkQDCGvmiQrhkd0JbMzXthwQAUgWjQuQdBLFa3eiBP5arXZyA+f8x+x7OXgud6bq2rxjGtHV2tw==",
       "dev": true,
       "license": "MIT"
     },
@@ -5047,9 +5103,9 @@
       }
     },
     "node_modules/eslint": {
-      "version": "10.5.0",
-      "resolved": "https://registry.npmjs.org/eslint/-/eslint-10.5.0.tgz",
-      "integrity": "sha512-1y+7C+vi12bUK1IpZeaV3gsH9fHLBmPvYmPx42pvT/E9yG0IC8g3PUZZgp0+JLJl7ZDK0flc2gc+Aw9dpCvIsQ==",
+      "version": "10.6.0",
+      "resolved": "https://registry.npmjs.org/eslint/-/eslint-10.6.0.tgz",
+      "integrity": "sha512-6lVbcqSodALYo+4ELD0heG6lFiFxnLMuLkiMi2qV8LMp54N8tE8FT1GMH+ev4Ti00nFjNze2+Su6DsV5OQW3Dg==",
       "dev": true,
       "license": "MIT",
       "workspaces": [
@@ -5267,9 +5323,9 @@
       }
     },
     "node_modules/expect-type": {
-      "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/expect-type/-/expect-type-1.3.0.tgz",
-      "integrity": "sha512-knvyeauYhqjOYvQ66MznSMs83wmHrCycNEN6Ao+2AeYEfxUIkuiVxdEa1qlGEPK+We3n0THiDciYSsCcgW/DoA==",
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/expect-type/-/expect-type-1.4.0.tgz",
+      "integrity": "sha512-KfYbmpRm0VbLjEvVa9yGwCi9GI34xvi7A/HXYWQO65CSD2u3MczUJSuwXKFIxlGsgBQizV9q5J9NHj4VG0n+pA==",
       "dev": true,
       "license": "Apache-2.0",
       "engines": {
@@ -5456,9 +5512,9 @@
       }
     },
     "node_modules/globals": {
-      "version": "17.6.0",
-      "resolved": "https://registry.npmjs.org/globals/-/globals-17.6.0.tgz",
-      "integrity": "sha512-sepffkT8stwnIYbsMBpoCHJuJM5l98FUF2AnE07hfvE0m/qp3R586hw4jF4uadbhvg1ooIdzuu7CsfD2jzCaNA==",
+      "version": "17.7.0",
+      "resolved": "https://registry.npmjs.org/globals/-/globals-17.7.0.tgz",
+      "integrity": "sha512-Czmyns5dUsq4seFBR/Kdydhmo8y9kC79hiSkPn0YcGtNnYWnrgt0vjrSjx9tspoDGWm2CMarffRuLjM4xUz8xg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -6275,9 +6331,9 @@
       "license": "MIT"
     },
     "node_modules/nanoid": {
-      "version": "3.3.13",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.13.tgz",
-      "integrity": "sha512-sPdqC6ByMVVGvF1ynvvMo0/o+oD1VX7DaHhijt1bFgjvBkHBib4t49GoNDhf2NDta4oeUNlaGbSt5K7qjZ955Q==",
+      "version": "3.3.15",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.15.tgz",
+      "integrity": "sha512-y7Wygv/7mEOvxTuEQDB8StXdMRBWf1kR/tlhAzBRUFkB2jfcLOAxO/SHmOO2zgz1pVgK29/kyupn059/bCHdjA==",
       "dev": true,
       "funding": [
         {
@@ -6301,9 +6357,9 @@
       "license": "MIT"
     },
     "node_modules/node-releases": {
-      "version": "2.0.48",
-      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.48.tgz",
-      "integrity": "sha512-1uz8041X6LoI6ZSdZacM9lVY28vuzDlSKitnpbSNK0RfKoIJkX29NBPVEFXhnuSuEOA9Ww0xnPJ+ILWbGAv8DA==",
+      "version": "2.0.50",
+      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.50.tgz",
+      "integrity": "sha512-J6l92tKHX6w8Jy5nO1Vuc01NoIiRGi/d6qBKVxh+IQ8Cr3b6HbVNfKiF8ZpFKufTwpwxMmce2W3iQZ861ZRyTg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -6400,34 +6456,34 @@
       }
     },
     "node_modules/oxc-resolver": {
-      "version": "11.21.3",
-      "resolved": "https://registry.npmjs.org/oxc-resolver/-/oxc-resolver-11.21.3.tgz",
-      "integrity": "sha512-2Mx3fKQz7+xgrBONjsxOgCGtMHOn38/HxMzW1I5efwXB5a4lRN0Vp40gYUJFBWJslcrvwoofTrqoTnLbwTd3pA==",
+      "version": "11.23.0",
+      "resolved": "https://registry.npmjs.org/oxc-resolver/-/oxc-resolver-11.23.0.tgz",
+      "integrity": "sha512-f0+l598CJMOLnYPXsXxttJALH0ljtivdRMKtvHhxRuWa5FYmw5+qODARl8oYjMC/brpzKcrpdORsOBrTqhBZ9A==",
       "dev": true,
       "license": "MIT",
       "funding": {
         "url": "https://github.com/sponsors/Boshen"
       },
       "optionalDependencies": {
-        "@oxc-resolver/binding-android-arm-eabi": "11.21.3",
-        "@oxc-resolver/binding-android-arm64": "11.21.3",
-        "@oxc-resolver/binding-darwin-arm64": "11.21.3",
-        "@oxc-resolver/binding-darwin-x64": "11.21.3",
-        "@oxc-resolver/binding-freebsd-x64": "11.21.3",
-        "@oxc-resolver/binding-linux-arm-gnueabihf": "11.21.3",
-        "@oxc-resolver/binding-linux-arm-musleabihf": "11.21.3",
-        "@oxc-resolver/binding-linux-arm64-gnu": "11.21.3",
-        "@oxc-resolver/binding-linux-arm64-musl": "11.21.3",
-        "@oxc-resolver/binding-linux-ppc64-gnu": "11.21.3",
-        "@oxc-resolver/binding-linux-riscv64-gnu": "11.21.3",
-        "@oxc-resolver/binding-linux-riscv64-musl": "11.21.3",
-        "@oxc-resolver/binding-linux-s390x-gnu": "11.21.3",
-        "@oxc-resolver/binding-linux-x64-gnu": "11.21.3",
-        "@oxc-resolver/binding-linux-x64-musl": "11.21.3",
-        "@oxc-resolver/binding-openharmony-arm64": "11.21.3",
-        "@oxc-resolver/binding-wasm32-wasi": "11.21.3",
-        "@oxc-resolver/binding-win32-arm64-msvc": "11.21.3",
-        "@oxc-resolver/binding-win32-x64-msvc": "11.21.3"
+        "@oxc-resolver/binding-android-arm-eabi": "11.23.0",
+        "@oxc-resolver/binding-android-arm64": "11.23.0",
+        "@oxc-resolver/binding-darwin-arm64": "11.23.0",
+        "@oxc-resolver/binding-darwin-x64": "11.23.0",
+        "@oxc-resolver/binding-freebsd-x64": "11.23.0",
+        "@oxc-resolver/binding-linux-arm-gnueabihf": "11.23.0",
+        "@oxc-resolver/binding-linux-arm-musleabihf": "11.23.0",
+        "@oxc-resolver/binding-linux-arm64-gnu": "11.23.0",
+        "@oxc-resolver/binding-linux-arm64-musl": "11.23.0",
+        "@oxc-resolver/binding-linux-ppc64-gnu": "11.23.0",
+        "@oxc-resolver/binding-linux-riscv64-gnu": "11.23.0",
+        "@oxc-resolver/binding-linux-riscv64-musl": "11.23.0",
+        "@oxc-resolver/binding-linux-s390x-gnu": "11.23.0",
+        "@oxc-resolver/binding-linux-x64-gnu": "11.23.0",
+        "@oxc-resolver/binding-linux-x64-musl": "11.23.0",
+        "@oxc-resolver/binding-openharmony-arm64": "11.23.0",
+        "@oxc-resolver/binding-wasm32-wasi": "11.23.0",
+        "@oxc-resolver/binding-win32-arm64-msvc": "11.23.0",
+        "@oxc-resolver/binding-win32-x64-msvc": "11.23.0"
       }
     },
     "node_modules/p-limit": {
@@ -6554,9 +6610,9 @@
       "license": "ISC"
     },
     "node_modules/picomatch": {
-      "version": "4.0.4",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
-      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
+      "version": "4.0.5",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.5.tgz",
+      "integrity": "sha512-RvwwcruNjI1ncT5xRakeyS9Lf8lcItv34KD+aif+VH9kduAyfYBipGh12274xtenIPZ119/R9BdTBa8gAwSh0A==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -6567,9 +6623,9 @@
       }
     },
     "node_modules/postcss": {
-      "version": "8.5.15",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.15.tgz",
-      "integrity": "sha512-FfR8sjd4em2T6fb3I2MwAJU7HWVMr9zba+enmQeeWFfCbm+UOC/0X4DS8XtpUTMwWMGbjKYP7xjfNekzyGmB3A==",
+      "version": "8.5.16",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.16.tgz",
+      "integrity": "sha512-vuwillviilfKZsg0VGj5R/YwwcHx4SLsIOI/7K6mQkWx+l5cUHTjj5g0AasTBcyXsbfTgrwsUNmVUb5xVwyPwg==",
       "dev": true,
       "funding": [
         {
@@ -6745,9 +6801,9 @@
       }
     },
     "node_modules/react-router": {
-      "version": "7.18.0",
-      "resolved": "https://registry.npmjs.org/react-router/-/react-router-7.18.0.tgz",
-      "integrity": "sha512-pTTGt8J+ji1NOmYnjzT+bAJy/1zD+Jp4ziO6cL7T3ZLvXKtusO7BpFqlRXitqpcPVqllsIXFHRMt+2/k3Xn6HQ==",
+      "version": "7.18.1",
+      "resolved": "https://registry.npmjs.org/react-router/-/react-router-7.18.1.tgz",
+      "integrity": "sha512-GDLgg3i3uM0aeJO3Fm+TCS+sDQ7gu12T6x0qdTEzcwqEfleci7JwugVNIF3U//0FWKnJT7ptG+20B2jfDqnZAg==",
       "license": "MIT",
       "dependencies": {
         "cookie": "^1.0.1",
@@ -6767,12 +6823,12 @@
       }
     },
     "node_modules/react-router-dom": {
-      "version": "7.18.0",
-      "resolved": "https://registry.npmjs.org/react-router-dom/-/react-router-dom-7.18.0.tgz",
-      "integrity": "sha512-Fi0yY6kgtKae/Th2xibdWK0KSdYZ4B53Gyf6wRtomOKWgpNm7H7+DyfDhncdz9FKbpS+1jmDhg3F4WoGJ+yFOA==",
+      "version": "7.18.1",
+      "resolved": "https://registry.npmjs.org/react-router-dom/-/react-router-dom-7.18.1.tgz",
+      "integrity": "sha512-KaZh+X/6UtEp28x51AUYZDMg9NGoz2ja3dNHa+ta/tk40vCzKhQ/RypCWBMLbmDr6//E24Vv5uPsrqXFozdkAg==",
       "license": "MIT",
       "dependencies": {
-        "react-router": "7.18.0"
+        "react-router": "7.18.1"
       },
       "engines": {
         "node": ">=20.0.0"
@@ -6805,9 +6861,9 @@
       }
     },
     "node_modules/recast": {
-      "version": "0.23.11",
-      "resolved": "https://registry.npmjs.org/recast/-/recast-0.23.11.tgz",
-      "integrity": "sha512-YTUo+Flmw4ZXiWfQKGcwwc11KnoRAYgzAE2E7mXKCjSviTKShtxBsN6YUUBB2gtaBzKzeKunxhUwNHQuRryhWA==",
+      "version": "0.23.12",
+      "resolved": "https://registry.npmjs.org/recast/-/recast-0.23.12.tgz",
+      "integrity": "sha512-dEWRjcINDu/F4l2dYx57ugBtD7HV9KXESyxhzw/MqWLeglJrsjJKqACPyUPg+6AF8mIgm+Zi0dZ3ACoIg+QtpA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -6881,13 +6937,13 @@
       }
     },
     "node_modules/rolldown": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.0.3.tgz",
-      "integrity": "sha512-i00lAJ2ks1BYr7rjNjKC7BcqAS7nVfiT3QX1SI5aY+AFHblCmaUf9OE9dbdzDvW6dJxbi2ZCZiy9v3CcwOiX3g==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.1.4.tgz",
+      "integrity": "sha512-IjZYiLxZwpnhwhdBH2ugdTGVSdhCQUmLxLoqyjiL0JxYjyRst+5a0P3xfrTxJ5F638j4Mvvw5FAX5XE6eHpXbA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@oxc-project/types": "=0.133.0",
+        "@oxc-project/types": "=0.138.0",
         "@rolldown/pluginutils": "^1.0.0"
       },
       "bin": {
@@ -6897,27 +6953,27 @@
         "node": "^20.19.0 || >=22.12.0"
       },
       "optionalDependencies": {
-        "@rolldown/binding-android-arm64": "1.0.3",
-        "@rolldown/binding-darwin-arm64": "1.0.3",
-        "@rolldown/binding-darwin-x64": "1.0.3",
-        "@rolldown/binding-freebsd-x64": "1.0.3",
-        "@rolldown/binding-linux-arm-gnueabihf": "1.0.3",
-        "@rolldown/binding-linux-arm64-gnu": "1.0.3",
-        "@rolldown/binding-linux-arm64-musl": "1.0.3",
-        "@rolldown/binding-linux-ppc64-gnu": "1.0.3",
-        "@rolldown/binding-linux-s390x-gnu": "1.0.3",
-        "@rolldown/binding-linux-x64-gnu": "1.0.3",
-        "@rolldown/binding-linux-x64-musl": "1.0.3",
-        "@rolldown/binding-openharmony-arm64": "1.0.3",
-        "@rolldown/binding-wasm32-wasi": "1.0.3",
-        "@rolldown/binding-win32-arm64-msvc": "1.0.3",
-        "@rolldown/binding-win32-x64-msvc": "1.0.3"
+        "@rolldown/binding-android-arm64": "1.1.4",
+        "@rolldown/binding-darwin-arm64": "1.1.4",
+        "@rolldown/binding-darwin-x64": "1.1.4",
+        "@rolldown/binding-freebsd-x64": "1.1.4",
+        "@rolldown/binding-linux-arm-gnueabihf": "1.1.4",
+        "@rolldown/binding-linux-arm64-gnu": "1.1.4",
+        "@rolldown/binding-linux-arm64-musl": "1.1.4",
+        "@rolldown/binding-linux-ppc64-gnu": "1.1.4",
+        "@rolldown/binding-linux-s390x-gnu": "1.1.4",
+        "@rolldown/binding-linux-x64-gnu": "1.1.4",
+        "@rolldown/binding-linux-x64-musl": "1.1.4",
+        "@rolldown/binding-openharmony-arm64": "1.1.4",
+        "@rolldown/binding-wasm32-wasi": "1.1.4",
+        "@rolldown/binding-win32-arm64-msvc": "1.1.4",
+        "@rolldown/binding-win32-x64-msvc": "1.1.4"
       }
     },
     "node_modules/rolldown/node_modules/@oxc-project/types": {
-      "version": "0.133.0",
-      "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.133.0.tgz",
-      "integrity": "sha512-KzkdCd6Uxqnf6l3HOw1xfatAlUURA0g14cvBYFyJ5SaNOQbOUvBr9PKArcPcrNIeRsBdgcUzOGrhKveVpvOIGA==",
+      "version": "0.138.0",
+      "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.138.0.tgz",
+      "integrity": "sha512-1a7ZKmrRTCoN1XMZ4L0PyyqrMnrNlLyPuOkdSX2MZg7IiIGRUyurNhAm73ptDOraoBcIordsIGKNPKUzy3ZmfA==",
       "dev": true,
       "license": "MIT",
       "funding": {
@@ -7163,9 +7219,9 @@
       }
     },
     "node_modules/tailwindcss": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/tailwindcss/-/tailwindcss-4.3.1.tgz",
-      "integrity": "sha512-hk+TB1m+K8CYNrP6rjQaq/Y+4Zylwpa87mLYBKCunwnnQ9p+fHb7kmSfGqyEJoxF/O6CDyABWVFEafNSYKll+Q==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/tailwindcss/-/tailwindcss-4.3.2.tgz",
+      "integrity": "sha512-WtctNNSH8A9jlMIqxzuYumOHU5uGZyRv0Q5svQl+oEPy5w84YpBxdb7MdqyiSPQge5jTJ6zFQLq0PFygdccSBA==",
       "dev": true,
       "license": "MIT"
     },
@@ -7254,22 +7310,22 @@
       }
     },
     "node_modules/tldts": {
-      "version": "7.4.3",
-      "resolved": "https://registry.npmjs.org/tldts/-/tldts-7.4.3.tgz",
-      "integrity": "sha512-A3BDQBeeukYPzB4QdQ1DtdlUmp4x2OCH8n5UVhEWbyANxNep8GavottKzd1xYKFJKjUgMyPT7EzOfnBO55s8Sg==",
+      "version": "7.4.6",
+      "resolved": "https://registry.npmjs.org/tldts/-/tldts-7.4.6.tgz",
+      "integrity": "sha512-rbP0Gyx8b3Ae9yO//CU2wbSnQNoQ66m1nJdSbSHmnwKwzkkz/u8mERYU8T2rmlmy+bJvRNn84yNCW8gYqox44Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "tldts-core": "^7.4.3"
+        "tldts-core": "^7.4.6"
       },
       "bin": {
         "tldts": "bin/cli.js"
       }
     },
     "node_modules/tldts-core": {
-      "version": "7.4.3",
-      "resolved": "https://registry.npmjs.org/tldts-core/-/tldts-core-7.4.3.tgz",
-      "integrity": "sha512-27ep5H9PzdBrNd5OFM/j3WCU8F3kPwM9D0BOaOf7uYfxMJfyr0K5Tjj69Gri+sZlh2WXd5buIm47NuPF29CDiw==",
+      "version": "7.4.6",
+      "resolved": "https://registry.npmjs.org/tldts-core/-/tldts-core-7.4.6.tgz",
+      "integrity": "sha512-TkQNGJIhlEphpHCjKodMTSe23egUZr/g+flI2qkLgiJ/maAzSgXypSLRTNH3nCmqgayEmtcJBiLcfODSAr1xoA==",
       "dev": true,
       "license": "MIT"
     },
@@ -7371,16 +7427,16 @@
       }
     },
     "node_modules/typescript-eslint": {
-      "version": "8.61.1",
-      "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.61.1.tgz",
-      "integrity": "sha512-V7PayAfJokV3pEHgN7/v03D1SpujhRfQtYLbLIiBfDDncdg4PAiRBfoS4cnCANK4jmAPncczi59QO3afiXUlNw==",
+      "version": "8.62.1",
+      "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.62.1.tgz",
+      "integrity": "sha512-vymnnM5g0AKQDSAyfP12nMIBvgwgA42syg74kkuZ4x1VuTzwQKwc5h9rGxeShCjny5o+zWAb6OEoz7XLgrIkIw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/eslint-plugin": "8.61.1",
-        "@typescript-eslint/parser": "8.61.1",
-        "@typescript-eslint/typescript-estree": "8.61.1",
-        "@typescript-eslint/utils": "8.61.1"
+        "@typescript-eslint/eslint-plugin": "8.62.1",
+        "@typescript-eslint/parser": "8.62.1",
+        "@typescript-eslint/typescript-estree": "8.62.1",
+        "@typescript-eslint/utils": "8.62.1"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -7522,16 +7578,16 @@
       }
     },
     "node_modules/vite": {
-      "version": "8.0.16",
-      "resolved": "https://registry.npmjs.org/vite/-/vite-8.0.16.tgz",
-      "integrity": "sha512-h9bXPmJichP5fLmVQo3PyaGSDE2n3aPuomeAlVRm0JLmt4rY6zmPKd59HYI4LNW8oTK7tlTsuC7l/m7awx9Jcw==",
+      "version": "8.1.3",
+      "resolved": "https://registry.npmjs.org/vite/-/vite-8.1.3.tgz",
+      "integrity": "sha512-Ds+gBRbj0lwRO2Y5hwnUBdxSwlAve9LeRyU4sNnAr0ewW0gWF0n5bgXgUzbgZ49MV9BVUAQUFYVcDUcilUExMA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "lightningcss": "^1.32.0",
         "picomatch": "^4.0.4",
-        "postcss": "^8.5.15",
-        "rolldown": "1.0.3",
+        "postcss": "^8.5.16",
+        "rolldown": "~1.1.3",
         "tinyglobby": "^0.2.17"
       },
       "bin": {
@@ -7548,7 +7604,7 @@
       },
       "peerDependencies": {
         "@types/node": "^20.19.0 || >=22.12.0",
-        "@vitejs/devtools": "^0.1.18",
+        "@vitejs/devtools": "^0.3.0",
         "esbuild": "^0.27.0 || ^0.28.0",
         "jiti": ">=1.21.0",
         "less": "^4.0.0",
diff --git a/frontend/package.json b/frontend/package.json
index ceb36e50..25163024 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -16,6 +16,7 @@
     "storybook": "storybook dev -p 6006"
   },
   "dependencies": {
+    "@radix-ui/react-checkbox": "^1.3.6",
     "@radix-ui/react-dialog": "^1.1.15",
     "@radix-ui/react-separator": "^1.1.8",
     "@radix-ui/react-slot": "^1.2.4",
diff --git a/frontend/src/components/ui/checkbox.tsx b/frontend/src/components/ui/checkbox.tsx
new file mode 100644
index 00000000..1eae53bf
--- /dev/null
+++ b/frontend/src/components/ui/checkbox.tsx
@@ -0,0 +1,28 @@
+import * as React from "react"
+import * as CheckboxPrimitive from "@radix-ui/react-checkbox"
+
+import { Icon } from "@/components/ui/icon"
+import { cn } from "@/lib/utils"
+
+const Checkbox = React.forwardRef<
+  React.ElementRef<typeof CheckboxPrimitive.Root>,
+  React.ComponentPropsWithoutRef<typeof CheckboxPrimitive.Root>
+>(({ className, ...props }, ref) => (
+  <CheckboxPrimitive.Root
+    ref={ref}
+    className={cn(
+      "grid place-content-center peer h-4 w-4 shrink-0 rounded-sm border border-primary shadow focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:cursor-not-allowed disabled:opacity-50 data-[state=checked]:bg-primary data-[state=checked]:text-primary-foreground",
+      className
+    )}
+    {...props}
+  >
+    <CheckboxPrimitive.Indicator
+      className={cn("grid place-content-center text-current")}
+    >
+      <Icon name="check" className="h-4 w-4" />
+    </CheckboxPrimitive.Indicator>
+  </CheckboxPrimitive.Root>
+))
+Checkbox.displayName = CheckboxPrimitive.Root.displayName
+
+export { Checkbox }
diff --git a/frontend/src/features/settings/hooks/use-settings.hook.ts b/frontend/src/features/settings/hooks/use-settings.hook.ts
index 3dec6462..137140c5 100644
--- a/frontend/src/features/settings/hooks/use-settings.hook.ts
+++ b/frontend/src/features/settings/hooks/use-settings.hook.ts
@@ -8,7 +8,9 @@ import {
   patchSettings,
   regenerateApiKey,
 } from "../settings.api"
-import type { ApiKey, RetentionMode, WorkspaceSettings } from "../settings.types"
+import { parseMessageDispatchConfig } from "../message-dispatch-mode"
+import { parseWorkspaceSettings } from "../settings.schema"
+import type { ApiKey, WorkspaceSettings, WorkspaceSettingsPatch } from "../settings.types"
 
 export function useSettings(workspaceId: string) {
   const [settings, setSettings] = useState<WorkspaceSettings>({})
@@ -46,9 +48,9 @@ export function useSettings(workspaceId: string) {
     }
   }, [workspaceId, trigger])
 
-  async function saveSettings(patch: Record<string, string>) {
+  async function saveSettings(patch: WorkspaceSettingsPatch) {
     await patchSettings(workspaceId, patch)
-    setSettings((prev) => ({ ...prev, ...patch }))
+    setSettings((prev) => parseWorkspaceSettings({ ...prev, ...patch }))
   }
 
   async function addApiKey(name: string) {
@@ -66,12 +68,12 @@ export function useSettings(workspaceId: string) {
     return regenerateApiKey(workspaceId, keyId)
   }
 
-  const retentionMode = (settings.data_retention as RetentionMode | undefined) ?? "memory"
+  const messageDispatchConfig = parseMessageDispatchConfig(settings.message_dispatch_mode, settings.store_message_content)
 
   return {
     settings,
     apiKeys,
-    retentionMode,
+    messageDispatchConfig,
     isLoading,
     error,
     reload,
diff --git a/frontend/src/features/settings/message-dispatch-mode.test.ts b/frontend/src/features/settings/message-dispatch-mode.test.ts
new file mode 100644
index 00000000..daffd7f0
--- /dev/null
+++ b/frontend/src/features/settings/message-dispatch-mode.test.ts
@@ -0,0 +1,49 @@
+import { describe, expect, it } from "vitest"
+
+import {
+  dispatchConfigsEqual,
+  normalizeDispatchMode,
+  normalizeStoreMessageContent,
+  parseMessageDispatchConfig,
+  toStoreMessageContentSetting,
+} from "./message-dispatch-mode"
+
+describe("parseMessageDispatchConfig", () => {
+  it("maps valid combinations", () => {
+    expect(parseMessageDispatchConfig("memory", "false")).toEqual({ mode: "memory", storeMessageContent: false })
+    expect(parseMessageDispatchConfig("memory", "true")).toEqual({ mode: "memory", storeMessageContent: true })
+    expect(parseMessageDispatchConfig("provider", "false")).toEqual({ mode: "provider", storeMessageContent: false })
+    expect(parseMessageDispatchConfig("provider", "true")).toEqual({ mode: "provider", storeMessageContent: true })
+  })
+
+  it("defaults to memory without inbox capture on missing input", () => {
+    expect(parseMessageDispatchConfig()).toEqual({ mode: "memory", storeMessageContent: false })
+    expect(parseMessageDispatchConfig("unknown", "invalid")).toEqual({ mode: "memory", storeMessageContent: false })
+  })
+})
+
+describe("normalizeDispatchMode", () => {
+  it("is case-insensitive for provider", () => {
+    expect(normalizeDispatchMode("PROVIDER")).toBe("provider")
+  })
+})
+
+describe("normalizeStoreMessageContent", () => {
+  it("treats unknown strings as false", () => {
+    expect(normalizeStoreMessageContent("yes")).toBe(false)
+  })
+})
+
+describe("toStoreMessageContentSetting", () => {
+  it("maps boolean to API string values", () => {
+    expect(toStoreMessageContentSetting(true)).toBe("true")
+    expect(toStoreMessageContentSetting(false)).toBe("false")
+  })
+})
+
+describe("dispatchConfigsEqual", () => {
+  it("compares mode and store flag", () => {
+    expect(dispatchConfigsEqual({ mode: "memory", storeMessageContent: false }, { mode: "memory", storeMessageContent: false })).toBe(true)
+    expect(dispatchConfigsEqual({ mode: "provider", storeMessageContent: true }, { mode: "provider", storeMessageContent: false })).toBe(false)
+  })
+})
diff --git a/frontend/src/features/settings/message-dispatch-mode.ts b/frontend/src/features/settings/message-dispatch-mode.ts
new file mode 100644
index 00000000..2f280ed3
--- /dev/null
+++ b/frontend/src/features/settings/message-dispatch-mode.ts
@@ -0,0 +1,50 @@
+import type {
+  MessageDispatchConfig,
+  MessageDispatchMode,
+  StoreMessageContentSetting,
+} from "./settings.types"
+
+export const DISPATCH_MODES = ["memory", "provider"] as const
+export const STORE_CONTENT_MODES = ["true", "false"] as const
+
+
+export function normalizeDispatchMode(raw?: string): MessageDispatchMode {
+  switch (raw?.trim().toLowerCase()) {
+    case "provider":
+      return "provider"
+    case "memory":
+    default:
+      return "memory"
+  }
+}
+
+export function normalizeStoreMessageContent(raw?: string): boolean {
+  switch (raw?.trim().toLowerCase()) {
+    case "true":
+      return true
+    case "false":
+    default:
+      return false
+  }
+}
+
+export function parseMessageDispatchConfig(
+  modeRaw?: string,
+  storeRaw?: string,
+): MessageDispatchConfig {
+  return {
+    mode: normalizeDispatchMode(modeRaw),
+    storeMessageContent: normalizeStoreMessageContent(storeRaw),
+  }
+}
+
+export function toStoreMessageContentSetting(storeMessageContent: boolean): StoreMessageContentSetting {
+  return storeMessageContent ? "true" : "false"
+}
+
+export function dispatchConfigsEqual(
+  left: MessageDispatchConfig,
+  right: MessageDispatchConfig,
+): boolean {
+  return left.mode === right.mode && left.storeMessageContent === right.storeMessageContent
+}
diff --git a/frontend/src/features/settings/pages/settings.page.tsx b/frontend/src/features/settings/pages/settings.page.tsx
index b635d259..1f0e1feb 100644
--- a/frontend/src/features/settings/pages/settings.page.tsx
+++ b/frontend/src/features/settings/pages/settings.page.tsx
@@ -3,6 +3,7 @@ import { useState } from "react"
 import { useParams } from "react-router-dom"
 
 import { Button } from "@/components/ui/button"
+import { Checkbox } from "@/components/ui/checkbox"
 import { Icon } from "@/components/ui/icon"
 import { Input } from "@/components/ui/input"
 import { Spinner } from "@/components/ui/spinner"
@@ -12,11 +13,18 @@ import { cn } from "@/lib/utils"
 import { ApiKeyRow } from "../components/api-key-row"
 import { RadioOption } from "../components/radio-option"
 import { useSettings } from "../hooks/use-settings.hook"
-import type { RetentionMode, SettingsTab, WorkspaceSettings } from "../settings.types"
+import { dispatchConfigsEqual, toStoreMessageContentSetting } from "../message-dispatch-mode"
+import type {
+  MessageDispatchConfig,
+  MessageDispatchMode,
+  SettingsTab,
+  WorkspaceSettings,
+  WorkspaceSettingsPatch,
+} from "../settings.types"
 
 interface GeneralSettingsPanelProps {
   settings: WorkspaceSettings
-  onSave: (patch: Record<string, string>) => Promise<void>
+  onSave: (patch: WorkspaceSettingsPatch) => Promise<void>
 }
 
 function GeneralSettingsPanel({ settings, onSave }: GeneralSettingsPanelProps) {
@@ -80,53 +88,75 @@ function GeneralSettingsPanel({ settings, onSave }: GeneralSettingsPanelProps) {
   )
 }
 
-interface RetentionSettingsPanelProps {
-  initialMode: RetentionMode
-  onSave: (patch: Record<string, string>) => Promise<void>
+interface DispatchSettingsPanelProps {
+  initialConfig: MessageDispatchConfig
+  onSave: (patch: WorkspaceSettingsPatch) => Promise<void>
 }
 
-function RetentionSettingsPanel({ initialMode, onSave }: RetentionSettingsPanelProps) {
-  const [retentionMode, setRetentionMode] = useState<RetentionMode>(initialMode)
+function DispatchSettingsPanel({ initialConfig, onSave }: DispatchSettingsPanelProps) {
+  const [mode, setMode] = useState<MessageDispatchMode>(initialConfig.mode)
+  const [storeMessageContent, setStoreMessageContent] = useState(initialConfig.storeMessageContent)
   const [isSaving, setIsSaving] = useState(false)
 
+  const currentConfig: MessageDispatchConfig = { mode, storeMessageContent }
+  const isDirty = !dispatchConfigsEqual(currentConfig, initialConfig)
+
   async function handleSave() {
     setIsSaving(true)
     try {
-      await onSave({ data_retention: retentionMode })
+      await onSave({
+        message_dispatch_mode: mode,
+        store_message_content: toStoreMessageContentSetting(storeMessageContent),
+      })
     } finally {
       setIsSaving(false)
     }
   }
 
   return (
-    <div className="flex max-w-xl flex-col gap-4">
-      <RadioOption
-        id="retention-memory"
-        name="retention"
-        label="Memory only"
-        description="Store messages in memory for testing — no persistence."
-        checked={retentionMode === "memory"}
-        onChange={() => setRetentionMode("memory")}
-      />
-      <RadioOption
-        id="retention-both"
-        name="retention"
-        label="Memory + Database"
-        description="Persist messages in the portal inbox and database."
-        checked={retentionMode === "both"}
-        onChange={() => setRetentionMode("both")}
-      />
-      <RadioOption
-        id="retention-providers"
-        name="retention"
-        label="Providers only"
-        description="Send through providers without storing message content."
-        checked={retentionMode === "providers"}
-        onChange={() => setRetentionMode("providers")}
-      />
+    <div className="flex max-w-xl flex-col gap-6">
+      <div className="flex flex-col gap-2">
+        <h2 className="text-sm font-medium text-foreground">Dispatch mode</h2>
+        <p className="text-sm text-text-secondary">Choose where outbound messages are routed.</p>
+        <div className="mt-1 flex flex-col gap-3">
+          <RadioOption
+            id="dispatch-memory"
+            name="dispatch-mode"
+            label="Memory"
+            description="Capture messages in memory for development and testing."
+            checked={mode === "memory"}
+            onChange={() => setMode("memory")}
+          />
+          <RadioOption
+            id="dispatch-provider"
+            name="dispatch-mode"
+            label="Provider"
+            description="Send messages through the connected channel integration."
+            checked={mode === "provider"}
+            onChange={() => setMode("provider")}
+          />
+        </div>
+      </div>
 
-      <Button type="button" onClick={handleSave} disabled={isSaving} className="mt-2 w-fit">
-        {isSaving ? "Saving…" : "Save retention policy"}
+      <div className="flex items-center justify-between gap-4 rounded-lg border border-border p-4">
+        <label htmlFor="store-message-content" className={cn("flex flex-1 cursor-pointer flex-col gap-1", mode === "memory" && "opacity-50 cursor-not-allowed")}>
+          <span className="text-sm font-medium text-foreground">Store message content in inbox</span>
+          <span className="text-sm text-text-secondary">
+            {mode === "memory" 
+              ? "Message bodies are always captured in Memory mode." 
+              : "When enabled, message bodies are captured in the portal inbox for review."}
+          </span>
+        </label>
+        <Checkbox
+          id="store-message-content"
+          checked={mode === "memory" ? true : storeMessageContent}
+          onCheckedChange={(checked) => setStoreMessageContent(checked === true)}
+          disabled={mode === "memory"}
+        />
+      </div>
+
+      <Button type="button" onClick={handleSave} disabled={isSaving || !isDirty} className="w-fit">
+        {isSaving ? "Saving…" : "Save dispatch settings"}
       </Button>
     </div>
   )
@@ -137,7 +167,7 @@ export function SettingsPage() {
   const [activeTab, setActiveTab] = useState<SettingsTab>("general")
   const [busyKeyId, setBusyKeyId] = useState<string | null>(null)
 
-  const { settings, apiKeys, retentionMode, isLoading, error, saveSettings, addApiKey, removeApiKey, rotateApiKey } =
+  const { settings, apiKeys, messageDispatchConfig, isLoading, error, saveSettings, addApiKey, removeApiKey, rotateApiKey } =
     useSettings(wid)
 
   async function handleCreateApiKey() {
@@ -194,7 +224,7 @@ export function SettingsPage() {
               ["general", "General"],
               ["developer", "Developer"],
               ["team", "Team Management"],
-              ["retention", "Data Retention"],
+              ["dispatch", "Message Dispatch"],
             ] as const
           ).map(([value, label]) => (
             <Tabs.Trigger
@@ -225,7 +255,7 @@ export function SettingsPage() {
             </div>
             <Button type="button" onClick={handleCreateApiKey}>
               <Icon name="add" size="sm" />
-              Create key
+              Generate key
             </Button>
           </div>
 
@@ -256,8 +286,12 @@ export function SettingsPage() {
           </div>
         </Tabs.Content>
 
-        <Tabs.Content value="retention">
-          <RetentionSettingsPanel key={`${wid}-${retentionMode}`} initialMode={retentionMode} onSave={saveSettings} />
+        <Tabs.Content value="dispatch">
+          <DispatchSettingsPanel
+            key={`${wid}-${messageDispatchConfig.mode}-${messageDispatchConfig.storeMessageContent}`}
+            initialConfig={messageDispatchConfig}
+            onSave={saveSettings}
+          />
         </Tabs.Content>
       </Tabs.Root>
 
diff --git a/frontend/src/features/settings/settings.api.ts b/frontend/src/features/settings/settings.api.ts
index e008419a..79b003bb 100644
--- a/frontend/src/features/settings/settings.api.ts
+++ b/frontend/src/features/settings/settings.api.ts
@@ -1,19 +1,17 @@
 import { apiFetch } from "@/core/api/client"
 
-import type { ApiKey, WorkspaceSettings } from "./settings.types"
+import { parseWorkspaceSettings } from "./settings.schema"
+import type { ApiKey, WorkspaceSettings, WorkspaceSettingsPatch } from "./settings.types"
 
 export async function getSettings(workspaceId: string): Promise<WorkspaceSettings> {
   const res = await apiFetch(`/api/v1/workspaces/${workspaceId}/settings`)
   if (!res.ok) {
     throw new Error("Failed to load settings")
   }
-  return (await res.json()) as WorkspaceSettings
+  return parseWorkspaceSettings(await res.json())
 }
 
-export async function patchSettings(
-  workspaceId: string,
-  body: Record<string, string>,
-): Promise<void> {
+export async function patchSettings(workspaceId: string, body: WorkspaceSettingsPatch): Promise<void> {
   const res = await apiFetch(`/api/v1/workspaces/${workspaceId}/settings`, {
     method: "PATCH",
     headers: { "Content-Type": "application/json" },
diff --git a/frontend/src/features/settings/settings.schema.ts b/frontend/src/features/settings/settings.schema.ts
new file mode 100644
index 00000000..8648219c
--- /dev/null
+++ b/frontend/src/features/settings/settings.schema.ts
@@ -0,0 +1,33 @@
+import { z } from "zod"
+
+import { DISPATCH_MODES, STORE_CONTENT_MODES } from "./message-dispatch-mode"
+import type { MessageDispatchMode, StoreMessageContentSetting, WorkspaceSettings } from "./settings.types"
+
+const messageDispatchModeSchema = z.enum(DISPATCH_MODES)
+
+const storeMessageContentSchema = z.enum(STORE_CONTENT_MODES)
+
+export const workspaceSettingsSchema = z.object({
+  owner_email: z.string().optional(),
+  pin_code: z.string().optional(),
+  message_dispatch_mode: messageDispatchModeSchema.optional(),
+  store_message_content: storeMessageContentSchema.optional(),
+})
+
+export function parseWorkspaceSettings(raw: unknown): WorkspaceSettings {
+  const parsed = workspaceSettingsSchema.safeParse(raw)
+  if (!parsed.success) {
+    throw new Error("Invalid settings response from server")
+  }
+  return parsed.data satisfies WorkspaceSettings
+}
+
+export function parseMessageDispatchMode(raw: unknown): MessageDispatchMode {
+  const parsed = messageDispatchModeSchema.safeParse(raw)
+  return parsed.success ? parsed.data : "memory"
+}
+
+export function parseStoreMessageContentSetting(raw: unknown): StoreMessageContentSetting {
+  const parsed = storeMessageContentSchema.safeParse(raw)
+  return parsed.success ? parsed.data : "false"
+}
diff --git a/frontend/src/features/settings/settings.types.ts b/frontend/src/features/settings/settings.types.ts
index 36c905e2..a03bbbf6 100644
--- a/frontend/src/features/settings/settings.types.ts
+++ b/frontend/src/features/settings/settings.types.ts
@@ -1,10 +1,16 @@
+export type MessageDispatchMode = "memory" | "provider"
+
+export type StoreMessageContentSetting = "true" | "false"
+
 export interface WorkspaceSettings {
   owner_email?: string
   pin_code?: string
-  data_retention?: "memory" | "both" | "providers"
-  [key: string]: string | undefined
+  message_dispatch_mode?: MessageDispatchMode
+  store_message_content?: StoreMessageContentSetting
 }
 
+export type WorkspaceSettingsPatch = Partial<Record<keyof WorkspaceSettings, string>>
+
 export interface ApiKey {
   id: string
   workspace_id: string
@@ -16,5 +22,9 @@ export interface ApiKey {
   expires_at?: string | null
 }
 
-export type SettingsTab = "general" | "developer" | "team" | "retention"
-export type RetentionMode = "memory" | "both" | "providers"
+export type SettingsTab = "general" | "developer" | "team" | "dispatch"
+
+export interface MessageDispatchConfig {
+  mode: MessageDispatchMode
+  storeMessageContent: boolean
+}
diff --git a/go.mod b/go.mod
index 7308a108..7a71afa8 100644
--- a/go.mod
+++ b/go.mod
@@ -36,7 +36,7 @@ require (
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/valyala/bytebufferpool v1.0.0 // indirect
 	github.com/valyala/fasttemplate v1.2.2 // indirect
-	github.com/weprodev/go-pkg v1.1.2
+	github.com/weprodev/go-pkg v1.1.3
 	golang.org/x/net v0.56.0 // indirect
 	golang.org/x/sys v0.46.0 // indirect
 	golang.org/x/text v0.38.0 // indirect
diff --git a/go.sum b/go.sum
index 51e3986c..7a5516e2 100644
--- a/go.sum
+++ b/go.sum
@@ -62,8 +62,8 @@ github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6Kllzaw
 github.com/valyala/bytebufferpool v1.0.0/go.mod h1:6bBcMArwyJ5K/AmCkWv1jt77kVWyCJ6HpOuEn7z0Csc=
 github.com/valyala/fasttemplate v1.2.2 h1:lxLXG0uE3Qnshl9QyaK6XJxMXlQZELvChBOCmQD0Loo=
 github.com/valyala/fasttemplate v1.2.2/go.mod h1:KHLXt3tVN2HBp8eijSv/kGJopbvo7S+qRAEEKiv+SiQ=
-github.com/weprodev/go-pkg v1.1.2 h1:hJeur+RdOF2V3J/I4UVgU1MYzvS2yLrv5LwtgSFEVQ0=
-github.com/weprodev/go-pkg v1.1.2/go.mod h1:Ss7+njNjzZfuXmqyxDtdP2UDMPSGKSWhcDwj4Ff5Ku4=
+github.com/weprodev/go-pkg v1.1.3 h1:umSU1kOJHVwhA26ZZ2JTyzE8A1zLCgmhIP3KqwwD2h8=
+github.com/weprodev/go-pkg v1.1.3/go.mod h1:9mI7PkAE/ZiDq16Mw9pc/xL3xmtcSUcbEKe727q2pGc=
 github.com/weprodev/wpd-gogate v1.2.1 h1:ZVXi3BkNuh/tUlcPzJGI+XpuolloD2f7E8RPsnIMHc0=
 github.com/weprodev/wpd-gogate v1.2.1/go.mod h1:Qj0XfD795g1ZW7X9pSaspBujiyhHrBA9ok41YhjrCdA=
 golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto=
diff --git a/internal/app/config.go b/internal/app/config.go
index b0c155ac..513651a1 100644
--- a/internal/app/config.go
+++ b/internal/app/config.go
@@ -2,6 +2,7 @@ package app
 
 import (
 	"fmt"
+	"log/slog"
 	"os"
 	"strings"
 
@@ -67,15 +68,51 @@ func (c *Config) DefaultSMSProvider() string   { return c.Providers.Defaults.SMS
 func (c *Config) DefaultPushProvider() string  { return c.Providers.Defaults.Push }
 func (c *Config) DefaultChatProvider() string  { return c.Providers.Defaults.Chat }
 
-// LoadConfig loads configuration from a YAML file.
-func LoadConfig(path string) (*Config, error) {
-	if path == "" {
-		path = "configs/local.yml"
+const defaultServerPort = 10101
+
+// EnvironmentName returns the runtime environment (config file, then APP_ENVIRONMENT, then local).
+func (c *Config) EnvironmentName() string {
+	if c != nil && c.Environment != "" {
+		return c.Environment
+	}
+	if v := os.Getenv("APP_ENVIRONMENT"); v != "" {
+		return v
+	}
+	return "local"
+}
+
+// ListenAddr returns the HTTP listen address for the gateway server.
+func (c *Config) ListenAddr() string {
+	port := defaultServerPort
+	if c != nil && c.Server.Port > 0 {
+		port = c.Server.Port
 	}
+	return fmt.Sprintf(":%d", port)
+}
 
-	data, err := os.ReadFile(path)
+// LogSummary logs a non-secret snapshot of loaded configuration at startup.
+func (c *Config) LogSummary() {
+	if c == nil {
+		return
+	}
+	slog.Info("loaded configuration",
+		"environment", c.EnvironmentName(),
+		"listen_addr", c.ListenAddr(),
+		"email_provider", c.DefaultEmailProvider(),
+		"sms_provider", c.DefaultSMSProvider(),
+		"push_provider", c.DefaultPushProvider(),
+		"chat_provider", c.DefaultChatProvider(),
+	)
+}
+
+// LoadAppConfig loads configuration from YAML, applying env overrides.
+// When configPath is empty, resolves via CONFIG_PATH, container paths, or configs/local.yml.
+func LoadAppConfig(configPath string) (*Config, error) {
+	configPath = resolveConfigPath(configPath)
+
+	data, err := os.ReadFile(configPath)
 	if err != nil {
-		return nil, fmt.Errorf("failed to read config file %s: %w", path, err)
+		return nil, fmt.Errorf("error reading config file %s: %w", configPath, err)
 	}
 
 	cfg := &Config{
@@ -86,7 +123,7 @@ func LoadConfig(path string) (*Config, error) {
 	}
 
 	if err := yaml.Unmarshal(data, cfg); err != nil {
-		return nil, fmt.Errorf("failed to parse config file %s: %w", path, err)
+		return nil, fmt.Errorf("error parsing config file %s: %w", configPath, err)
 	}
 
 	cfg.applyEnvOverrides()
@@ -95,6 +132,37 @@ func LoadConfig(path string) (*Config, error) {
 	return cfg, nil
 }
 
+// resolveConfigPath returns an explicit path or discovers one from env/container defaults.
+func resolveConfigPath(configPath string) string {
+	if configPath != "" {
+		return configPath
+	}
+	if v := os.Getenv("CONFIG_PATH"); v != "" {
+		return v
+	}
+
+	env := os.Getenv("APP_ENVIRONMENT")
+	if env == "" {
+		env = os.Getenv("ENVIRONMENT")
+	}
+	if env == "" {
+		env = "local"
+	}
+
+	for _, candidate := range []string{
+		fmt.Sprintf("/configs/%s.yml", env),
+		"/configs/local.yml",
+		"/configs/config.yml",
+		"configs/local.yml",
+	} {
+		if _, err := os.Stat(candidate); err == nil {
+			return candidate
+		}
+	}
+
+	return "configs/local.yml"
+}
+
 // applyEnvOverrides applies environment variable overrides.
 func (c *Config) applyEnvOverrides() {
 	if port := os.Getenv("PORT"); port != "" {
diff --git a/internal/app/config_test.go b/internal/app/config_test.go
new file mode 100644
index 00000000..a1e54590
--- /dev/null
+++ b/internal/app/config_test.go
@@ -0,0 +1,43 @@
+package app
+
+import "testing"
+
+func TestResolveConfigPath(t *testing.T) {
+	t.Setenv("CONFIG_PATH", "")
+
+	if got := resolveConfigPath("configs/custom.yml"); got != "configs/custom.yml" {
+		t.Fatalf("explicit path: got %q", got)
+	}
+
+	t.Setenv("CONFIG_PATH", "configs/from-env.yml")
+	if got := resolveConfigPath(""); got != "configs/from-env.yml" {
+		t.Fatalf("CONFIG_PATH: got %q", got)
+	}
+}
+
+func TestConfig_ListenAddr(t *testing.T) {
+	cfg := &Config{Server: ServerConfig{Port: 8080}}
+	if got := cfg.ListenAddr(); got != ":8080" {
+		t.Fatalf("got %q", got)
+	}
+
+	cfg.Server.Port = 0
+	if got := cfg.ListenAddr(); got != ":10101" {
+		t.Fatalf("default port: got %q", got)
+	}
+}
+
+func TestConfig_EnvironmentName(t *testing.T) {
+	t.Setenv("APP_ENVIRONMENT", "")
+
+	cfg := &Config{Environment: "staging"}
+	if got := cfg.EnvironmentName(); got != "staging" {
+		t.Fatalf("from config: got %q", got)
+	}
+
+	cfg.Environment = ""
+	t.Setenv("APP_ENVIRONMENT", "test")
+	if got := cfg.EnvironmentName(); got != "test" {
+		t.Fatalf("from env: got %q", got)
+	}
+}
diff --git a/internal/app/shutdown.go b/internal/app/shutdown.go
new file mode 100644
index 00000000..8f7a7281
--- /dev/null
+++ b/internal/app/shutdown.go
@@ -0,0 +1,29 @@
+package app
+
+import (
+	"context"
+	"fmt"
+)
+
+// Shutdown stops the HTTP server and closes the database connection pool.
+func (a *Application) Shutdown(ctx context.Context) error {
+	if a == nil {
+		return nil
+	}
+
+	var shutdownErr error
+	if a.Echo != nil {
+		if err := a.Echo.Shutdown(ctx); err != nil {
+			shutdownErr = fmt.Errorf("echo shutdown: %w", err)
+		}
+	}
+	if a.PgClient != nil {
+		if err := a.PgClient.Close(); err != nil {
+			if shutdownErr != nil {
+				return fmt.Errorf("%v; pg close: %w", shutdownErr, err)
+			}
+			return fmt.Errorf("pg close: %w", err)
+		}
+	}
+	return shutdownErr
+}
diff --git a/internal/core/domain/dispatch_mode.go b/internal/core/domain/dispatch_mode.go
index 01c4c627..7287c82c 100644
--- a/internal/core/domain/dispatch_mode.go
+++ b/internal/core/domain/dispatch_mode.go
@@ -1,32 +1,89 @@
 package domain
 
-// Workspace setting key for how outbound messages are handled relative to memory vs providers.
-const SettingKeyMessageDispatchMode = "message_dispatch_mode"
+import (
+	"errors"
+	"fmt"
+	"strings"
+)
+
+var ErrInvalidSettingValue = errors.New("invalid setting value")
+
+const (
+	// SettingKeyMessageDispatchMode controls memory capture vs integration dispatch.
+	SettingKeyMessageDispatchMode = "message_dispatch_mode"
+	// SettingKeyStoreMessageContent controls whether message content is captured in the inbox.
+	SettingKeyStoreMessageContent = "store_message_content"
+)
 
-// MessageDispatchMode controls memory capture vs integration dispatch for each workspace.
-// Provider configs live in DB (integrations); memory is always available as a capture path.
+// MessageDispatchMode represents where the outbound message is routed.
 type MessageDispatchMode string
 
 const (
-	// DispatchProviderOnly sends only through the connected integration; nothing is kept in process memory.
-	DispatchProviderOnly MessageDispatchMode = "provider_only"
-	// DispatchMemoryAndProvider stores in memory and sends through the integration.
-	DispatchMemoryAndProvider MessageDispatchMode = "memory_and_provider"
-	// DispatchMemoryOnly keeps messages in memory only; external providers are not called.
-	DispatchMemoryOnly MessageDispatchMode = "memory_only"
+	// DispatchProvider sends through the connected integration.
+	DispatchProvider MessageDispatchMode = "provider"
+	// DispatchMemory keeps messages in memory only; external providers are not called.
+	DispatchMemory MessageDispatchMode = "memory"
 )
 
-// DefaultMessageDispatchMode is used when workspace_settings has no value (matches portal “safe dev” default).
+// DefaultMessageDispatchMode is used when workspace_settings has no value.
 func DefaultMessageDispatchMode() MessageDispatchMode {
-	return DispatchMemoryOnly
+	return DispatchMemory
 }
 
-// ParseMessageDispatchMode returns the mode if s is valid.
+// ParseMessageDispatchMode returns the mode if s is a valid dispatch mode string.
 func ParseMessageDispatchMode(s string) (MessageDispatchMode, bool) {
-	switch MessageDispatchMode(s) {
-	case DispatchProviderOnly, DispatchMemoryAndProvider, DispatchMemoryOnly:
-		return MessageDispatchMode(s), true
+	switch MessageDispatchMode(strings.TrimSpace(s)) {
+	case DispatchProvider, DispatchMemory:
+		return MessageDispatchMode(strings.TrimSpace(s)), true
 	default:
 		return "", false
 	}
 }
+
+// MessageDispatchConfig holds dispatch routing and inbox content capture settings.
+type MessageDispatchConfig struct {
+	Mode                MessageDispatchMode
+	StoreMessageContent bool
+}
+
+// RoutesViaProvider reports whether outbound traffic should use an integration.
+func (c MessageDispatchConfig) RoutesViaProvider() bool {
+	return c.Mode == DispatchProvider
+}
+
+// ShouldCaptureToInbox reports whether message content should be written to the inbox writer.
+func (c MessageDispatchConfig) ShouldCaptureToInbox(effectiveMode MessageDispatchMode) bool {
+	return c.StoreMessageContent || effectiveMode == DispatchMemory
+}
+
+// ResolveMessageDispatchConfig reads canonical workspace setting values.
+func ResolveMessageDispatchConfig(modeVal, storeVal string) MessageDispatchConfig {
+	config := MessageDispatchConfig{
+		Mode:                DefaultMessageDispatchMode(),
+		StoreMessageContent: false,
+	}
+	if mode, ok := ParseMessageDispatchMode(modeVal); ok {
+		config.Mode = mode
+	}
+	if strings.TrimSpace(storeVal) == "true" {
+		config.StoreMessageContent = true
+	}
+	return config
+}
+
+// ValidateWorkspaceSettingValue validates known workspace setting keys.
+func ValidateWorkspaceSettingValue(key, value string) error {
+	switch key {
+	case SettingKeyMessageDispatchMode:
+		if _, ok := ParseMessageDispatchMode(value); !ok {
+			return fmt.Errorf("%w: message_dispatch_mode must be memory or provider", ErrInvalidSettingValue)
+		}
+	case SettingKeyStoreMessageContent:
+		switch strings.TrimSpace(value) {
+		case "true", "false":
+		default:
+			return fmt.Errorf("%w: store_message_content must be true or false", ErrInvalidSettingValue)
+		}
+	}
+	return nil
+}
diff --git a/internal/core/domain/dispatch_mode_test.go b/internal/core/domain/dispatch_mode_test.go
new file mode 100644
index 00000000..3e0e8723
--- /dev/null
+++ b/internal/core/domain/dispatch_mode_test.go
@@ -0,0 +1,111 @@
+package domain
+
+import (
+	"errors"
+	"testing"
+)
+
+func TestDefaultMessageDispatchMode(t *testing.T) {
+	if got := DefaultMessageDispatchMode(); got != DispatchMemory {
+		t.Fatalf("got %q, want %q", got, DispatchMemory)
+	}
+}
+
+func TestParseMessageDispatchMode(t *testing.T) {
+	tests := []struct {
+		value string
+		want  MessageDispatchMode
+		ok    bool
+	}{
+		{"memory", DispatchMemory, true},
+		{"provider", DispatchProvider, true},
+		{" memory ", DispatchMemory, true},
+		{"unknown", "", false},
+		{"", "", false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.value, func(t *testing.T) {
+			got, ok := ParseMessageDispatchMode(tt.value)
+			if ok != tt.ok {
+				t.Fatalf("ok = %v, want %v", ok, tt.ok)
+			}
+			if got != tt.want {
+				t.Fatalf("got %q, want %q", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestResolveMessageDispatchConfig(t *testing.T) {
+	tests := []struct {
+		name     string
+		modeVal  string
+		storeVal string
+		want     MessageDispatchConfig
+	}{
+		{"defaults", "", "", MessageDispatchConfig{Mode: DispatchMemory, StoreMessageContent: false}},
+		{"memory without store", "memory", "false", MessageDispatchConfig{Mode: DispatchMemory, StoreMessageContent: false}},
+		{"provider with store", "provider", "true", MessageDispatchConfig{Mode: DispatchProvider, StoreMessageContent: true}},
+		{"invalid mode uses default", "unknown", "true", MessageDispatchConfig{Mode: DispatchMemory, StoreMessageContent: true}},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := ResolveMessageDispatchConfig(tt.modeVal, tt.storeVal)
+			if got != tt.want {
+				t.Fatalf("got %+v, want %+v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestMessageDispatchConfig_ShouldCaptureToInbox(t *testing.T) {
+	tests := []struct {
+		name          string
+		config        MessageDispatchConfig
+		effectiveMode MessageDispatchMode
+		want          bool
+	}{
+		{"memory always captures", MessageDispatchConfig{Mode: DispatchMemory}, DispatchMemory, true},
+		{"provider without store", MessageDispatchConfig{Mode: DispatchProvider}, DispatchProvider, false},
+		{"provider with store", MessageDispatchConfig{Mode: DispatchProvider, StoreMessageContent: true}, DispatchProvider, true},
+		{"provider fallback to memory", MessageDispatchConfig{Mode: DispatchProvider}, DispatchMemory, true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := tt.config.ShouldCaptureToInbox(tt.effectiveMode); got != tt.want {
+				t.Fatalf("ShouldCaptureToInbox() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestValidateWorkspaceSettingValue(t *testing.T) {
+	tests := []struct {
+		key   string
+		value string
+		ok    bool
+	}{
+		{SettingKeyMessageDispatchMode, "memory", true},
+		{SettingKeyMessageDispatchMode, "provider", true},
+		{SettingKeyMessageDispatchMode, "invalid", false},
+		{SettingKeyStoreMessageContent, "true", true},
+		{SettingKeyStoreMessageContent, "false", true},
+		{SettingKeyStoreMessageContent, "yes", false},
+		{"owner_email", "any@example.com", true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.key+"="+tt.value, func(t *testing.T) {
+			err := ValidateWorkspaceSettingValue(tt.key, tt.value)
+			if tt.ok && err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+			if !tt.ok && !errors.Is(err, ErrInvalidSettingValue) {
+				t.Fatalf("expected ErrInvalidSettingValue, got %v", err)
+			}
+		})
+	}
+}
diff --git a/internal/core/domain/integration.go b/internal/core/domain/integration.go
index 2a0cc671..0e1dcc07 100644
--- a/internal/core/domain/integration.go
+++ b/internal/core/domain/integration.go
@@ -1,6 +1,12 @@
 package domain
 
-import "time"
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+)
 
 // Integration lifecycle statuses (integrations.status column).
 const (
@@ -8,6 +14,12 @@ const (
 	IntegrationStatusDisconnected = "disconnected"
 )
 
+// ProviderNameMemory is the in-process capture provider; not valid for provider dispatch mode.
+const ProviderNameMemory = "memory"
+
+// ErrProviderNotReady indicates the workspace integration cannot send via an external provider.
+var ErrProviderNotReady = errors.New("provider not ready")
+
 // Integration holds provider credentials for a workspace channel.
 type Integration struct {
 	ID           string    `json:"id"`
@@ -20,3 +32,23 @@ type Integration struct {
 	CreatedAt    time.Time `json:"created_at"`
 	UpdatedAt    time.Time `json:"updated_at"`
 }
+
+// ValidateProviderIntegration checks that an integration can be used for provider dispatch.
+func ValidateProviderIntegration(intg Integration) error {
+	if intg.ProviderName == ProviderNameMemory {
+		return fmt.Errorf("%w: memory provider is not allowed in provider dispatch mode", ErrProviderNotReady)
+	}
+	if intg.Status != IntegrationStatusConnected {
+		return fmt.Errorf("%w: integration status is %q", ErrProviderNotReady, intg.Status)
+	}
+	if len(strings.TrimSpace(intg.ProviderName)) == 0 {
+		return fmt.Errorf("%w: provider name is empty", ErrProviderNotReady)
+	}
+	if len(strings.TrimSpace(string(intg.Config))) == 0 {
+		return fmt.Errorf("%w: provider config is empty", ErrProviderNotReady)
+	}
+	if !json.Valid(intg.Config) {
+		return fmt.Errorf("%w: provider config is invalid JSON", ErrProviderNotReady)
+	}
+	return nil
+}
diff --git a/internal/core/domain/integration_test.go b/internal/core/domain/integration_test.go
new file mode 100644
index 00000000..dc236815
--- /dev/null
+++ b/internal/core/domain/integration_test.go
@@ -0,0 +1,46 @@
+package domain
+
+import (
+	"errors"
+	"testing"
+)
+
+func TestValidateProviderIntegration(t *testing.T) {
+	valid := Integration{
+		ID:           "int-1",
+		ProviderName: "mailgun",
+		Config:       []byte(`{"api_key":"key"}`),
+		Status:       IntegrationStatusConnected,
+	}
+
+	tests := []struct {
+		name    string
+		intg    Integration
+		wantErr bool
+	}{
+		{"valid integration", valid, false},
+		{"empty integration", Integration{}, true},
+		{"memory provider", Integration{ProviderName: ProviderNameMemory, Config: []byte(`{}`), Status: IntegrationStatusConnected}, true},
+		{"disconnected", Integration{ProviderName: "mailgun", Config: []byte(`{}`), Status: IntegrationStatusDisconnected}, true},
+		{"empty config", Integration{ProviderName: "mailgun", Config: []byte(`   `), Status: IntegrationStatusConnected}, true},
+		{"invalid json", Integration{ProviderName: "mailgun", Config: []byte(`{`), Status: IntegrationStatusConnected}, true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := ValidateProviderIntegration(tt.intg)
+			if tt.wantErr {
+				if err == nil {
+					t.Fatal("expected error")
+				}
+				if !errors.Is(err, ErrProviderNotReady) {
+					t.Fatalf("expected ErrProviderNotReady, got %v", err)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+		})
+	}
+}
diff --git a/internal/core/domain/message_request_log.go b/internal/core/domain/message_request_log.go
index 81709024..c156ba9f 100644
--- a/internal/core/domain/message_request_log.go
+++ b/internal/core/domain/message_request_log.go
@@ -4,16 +4,17 @@ import "time"
 
 // MessageRequestLog records a gateway API call for monitoring.
 type MessageRequestLog struct {
-	ID           string    `json:"id"`
-	WorkspaceID  string    `json:"workspace_id"`
-	APIKeyID     string    `json:"api_key_id,omitempty"`
-	ChannelType  string    `json:"channel_type"`
-	HTTPMethod   string    `json:"http_method"`
-	StatusCode   int       `json:"status_code"`
-	Endpoint     string    `json:"endpoint"`
-	ProviderName string    `json:"provider_name,omitempty"`
-	RequestID    string    `json:"request_id,omitempty"`
-	DurationMs   int       `json:"duration_ms,omitempty"`
-	ErrorMessage string    `json:"error_message,omitempty"`
-	CreatedAt    time.Time `json:"created_at"`
+	ID           string `json:"id"`
+	WorkspaceID  string `json:"workspace_id"`
+	APIKeyID     string `json:"api_key_id,omitempty"`
+	ChannelType  string `json:"channel_type"`
+	HTTPMethod   string `json:"http_method"`
+	StatusCode   int    `json:"status_code"`
+	Endpoint     string `json:"endpoint"`
+	ProviderName string `json:"provider_name,omitempty"`
+	RequestID    string `json:"request_id,omitempty"`
+	DurationMs   int    `json:"duration_ms,omitempty"`
+	ErrorMessage string `json:"error_message,omitempty"`
+
+	CreatedAt time.Time `json:"created_at"`
 }
diff --git a/internal/core/service/gateway_service.go b/internal/core/service/gateway_service.go
index 55c8afc7..670ae56b 100644
--- a/internal/core/service/gateway_service.go
+++ b/internal/core/service/gateway_service.go
@@ -4,6 +4,7 @@ package service
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"log/slog"
 
@@ -18,10 +19,6 @@ const (
 	channelSMS   = "sms"
 	channelPush  = "push"
 	channelChat  = "chat"
-
-	// memoryProviderName is the sentinel name stored in the integrations table
-	// when a workspace uses memory dispatch. Checked here to skip DB lookup.
-	memoryProviderName = "memory"
 )
 
 // GatewayService orchestrates message dispatch for a single workspace.
@@ -48,7 +45,7 @@ type GatewayService struct {
 // NewGatewayService constructs a GatewayService.
 //
 // inbox is the in-process capture store (implements port.InboxWriter).
-// Pass nil to disable memory capture — memory_only dispatch will then error.
+// Pass nil to disable memory capture — memory dispatch will then error when inbox is required.
 func NewGatewayService(
 	integrations port.IntegrationRepository,
 	templates port.TemplateRepository,
@@ -71,11 +68,14 @@ func NewGatewayService(
 
 // SendEmail dispatches an email for workspaceID according to its dispatch mode.
 func (s *GatewayService) SendEmail(ctx context.Context, workspaceID string, email contracts.Email) (*contracts.SendResult, error) {
-	mode := s.resolveDispatchMode(ctx, workspaceID)
-	return s.dispatch(ctx, workspaceID, mode, channelEmail,
+	config, err := s.resolveDispatchConfig(ctx, workspaceID)
+	if err != nil {
+		return nil, err
+	}
+	return s.dispatch(ctx, workspaceID, config, channelEmail,
 		func() (*contracts.SendResult, error) { return s.writeEmailToInbox(ctx, workspaceID, email) },
-		func(sendCtx context.Context, intg *domain.Integration) (*contracts.SendResult, error) {
-			sender, err := resolveEmailSender(s.emailCache, intg)
+		func(sendCtx context.Context, intg domain.Integration) (*contracts.SendResult, error) {
+			sender, err := resolveEmailSender(s.emailCache, &intg)
 			if err != nil {
 				return nil, err
 			}
@@ -86,11 +86,14 @@ func (s *GatewayService) SendEmail(ctx context.Context, workspaceID string, emai
 
 // SendSMS dispatches an SMS for workspaceID according to its dispatch mode.
 func (s *GatewayService) SendSMS(ctx context.Context, workspaceID string, sms contracts.SMS) (*contracts.SendResult, error) {
-	mode := s.resolveDispatchMode(ctx, workspaceID)
-	return s.dispatch(ctx, workspaceID, mode, channelSMS,
+	config, err := s.resolveDispatchConfig(ctx, workspaceID)
+	if err != nil {
+		return nil, err
+	}
+	return s.dispatch(ctx, workspaceID, config, channelSMS,
 		func() (*contracts.SendResult, error) { return s.writeSMSToInbox(ctx, workspaceID, sms) },
-		func(sendCtx context.Context, intg *domain.Integration) (*contracts.SendResult, error) {
-			sender, err := resolveSMSSender(s.smsCache, intg)
+		func(sendCtx context.Context, intg domain.Integration) (*contracts.SendResult, error) {
+			sender, err := resolveSMSSender(s.smsCache, &intg)
 			if err != nil {
 				return nil, err
 			}
@@ -101,11 +104,14 @@ func (s *GatewayService) SendSMS(ctx context.Context, workspaceID string, sms co
 
 // SendPush dispatches a push notification for workspaceID according to its dispatch mode.
 func (s *GatewayService) SendPush(ctx context.Context, workspaceID string, push contracts.PushNotification) (*contracts.SendResult, error) {
-	mode := s.resolveDispatchMode(ctx, workspaceID)
-	return s.dispatch(ctx, workspaceID, mode, channelPush,
+	config, err := s.resolveDispatchConfig(ctx, workspaceID)
+	if err != nil {
+		return nil, err
+	}
+	return s.dispatch(ctx, workspaceID, config, channelPush,
 		func() (*contracts.SendResult, error) { return s.writePushToInbox(ctx, workspaceID, push) },
-		func(sendCtx context.Context, intg *domain.Integration) (*contracts.SendResult, error) {
-			sender, err := resolvePushSender(s.pushCache, intg)
+		func(sendCtx context.Context, intg domain.Integration) (*contracts.SendResult, error) {
+			sender, err := resolvePushSender(s.pushCache, &intg)
 			if err != nil {
 				return nil, err
 			}
@@ -116,11 +122,14 @@ func (s *GatewayService) SendPush(ctx context.Context, workspaceID string, push
 
 // SendChat dispatches a chat message for workspaceID according to its dispatch mode.
 func (s *GatewayService) SendChat(ctx context.Context, workspaceID string, chat contracts.ChatMessage) (*contracts.SendResult, error) {
-	mode := s.resolveDispatchMode(ctx, workspaceID)
-	return s.dispatch(ctx, workspaceID, mode, channelChat,
+	config, err := s.resolveDispatchConfig(ctx, workspaceID)
+	if err != nil {
+		return nil, err
+	}
+	return s.dispatch(ctx, workspaceID, config, channelChat,
 		func() (*contracts.SendResult, error) { return s.writeChatToInbox(ctx, workspaceID, chat) },
-		func(sendCtx context.Context, intg *domain.Integration) (*contracts.SendResult, error) {
-			sender, err := resolveChatSender(s.chatCache, intg)
+		func(sendCtx context.Context, intg domain.Integration) (*contracts.SendResult, error) {
+			sender, err := resolveChatSender(s.chatCache, &intg)
 			if err != nil {
 				return nil, err
 			}
@@ -133,126 +142,135 @@ func (s *GatewayService) SendChat(ctx context.Context, workspaceID string, chat
 // It applies the workspace dispatch mode and calls the appropriate fn(s).
 //
 //   - writeToInbox: captures to in-process RAM (always available)
-//   - sendViaProvider: instantiates provider from DB integration + sends
+//   - sendViaProvider: resolves provider from integration and sends
 func (s *GatewayService) dispatch(
 	ctx context.Context,
 	workspaceID string,
-	mode domain.MessageDispatchMode,
+	config domain.MessageDispatchConfig,
 	channel string,
 	writeToInbox func() (*contracts.SendResult, error),
-	sendViaProvider func(context.Context, *domain.Integration) (*contracts.SendResult, error),
+	sendViaProvider func(context.Context, domain.Integration) (*contracts.SendResult, error),
 ) (*contracts.SendResult, error) {
-	slog.InfoContext(ctx, "dispatching message", "workspace_id", workspaceID, "dispatch_mode", mode, "channel", channel)
-	switch mode {
-	case domain.DispatchMemoryOnly:
-		r, err := writeToInbox()
-		if err != nil {
-			slog.ErrorContext(ctx, "inbox write failed", "error", err, "workspace_id", workspaceID, "channel", channel)
-			return nil, err
-		}
-		attachMeta(r, mode, channel, "", memoryProviderName)
-		slog.InfoContext(ctx, "message dispatched via memory only", "workspace_id", workspaceID, "channel", channel, "message_id", r.ID)
-		return r, nil
+	slog.InfoContext(ctx, "dispatching message", "dispatch_mode", config.Mode, "store_content", config.StoreMessageContent)
 
-	case domain.DispatchProviderOnly:
-		intg, err := s.activeIntegration(ctx, workspaceID, channel)
-		if err != nil {
-			slog.ErrorContext(ctx, "provider lookup failed", "error", err, "workspace_id", workspaceID, "channel", channel)
-			return nil, err
-		}
-		// If the stored integration IS the memory provider, fall through to inbox.
-		if intg.ProviderName == memoryProviderName {
-			r, err := writeToInbox()
-			if err != nil {
-				slog.ErrorContext(ctx, "inbox write failed (fallback)", "error", err, "workspace_id", workspaceID, "channel", channel)
-				return nil, err
-			}
-			attachMeta(r, mode, channel, intg.ID, intg.ProviderName)
-			slog.InfoContext(ctx, "message dispatched via memory fallback", "workspace_id", workspaceID, "channel", channel, "message_id", r.ID)
-			return r, nil
-		}
-		providerCtx := applogger.WithProvider(ctx, intg.ProviderName)
-		r, err := sendViaProvider(providerCtx, intg)
-		if err != nil {
-			slog.ErrorContext(ctx, "provider send failed", "error", err, "workspace_id", workspaceID, "channel", channel, "provider", intg.ProviderName)
-			return nil, err
-		}
-		attachMeta(r, mode, channel, intg.ID, intg.ProviderName)
-		slog.InfoContext(ctx, "message dispatched via provider only", "workspace_id", workspaceID, "channel", channel, "provider", intg.ProviderName, "message_id", r.ID)
-		return r, nil
+	var inboxResult *contracts.SendResult
+	var provResult *contracts.SendResult
+	var err error
+	var integrationID, providerName string
+	effectiveMode := config.Mode
+	providerName = domain.ProviderNameMemory
 
-	case domain.DispatchMemoryAndProvider:
-		intg, err := s.activeIntegration(ctx, workspaceID, channel)
-		if err != nil {
-			slog.ErrorContext(ctx, "provider lookup failed", "error", err, "workspace_id", workspaceID, "channel", channel)
-			return nil, err
-		}
-		// If the integration is already memory, a single write is enough.
-		if intg.ProviderName == memoryProviderName {
-			r, err := writeToInbox()
-			if err != nil {
-				slog.ErrorContext(ctx, "inbox write failed (fallback)", "error", err, "workspace_id", workspaceID, "channel", channel)
-				return nil, err
-			}
-			attachMeta(r, mode, channel, intg.ID, intg.ProviderName)
-			slog.InfoContext(ctx, "message dispatched via memory fallback", "workspace_id", workspaceID, "channel", channel, "message_id", r.ID)
-			return r, nil
+	if config.RoutesViaProvider() {
+		intg, errLookup := s.requireProviderIntegration(ctx, workspaceID, channel)
+		if errLookup != nil {
+			return attachMeta(nil, effectiveMode, channel, integrationID, providerName), errLookup
 		}
-		// Both paths: capture to inbox first (non-fatal), then send via provider.
-		inboxResult, err := writeToInbox()
+
+		integrationID = intg.ID
+		providerName = intg.ProviderName
+
+		providerCtx := applogger.WithProvider(ctx, providerName)
+		provResult, err = sendViaProvider(providerCtx, *intg)
 		if err != nil {
-			slog.WarnContext(ctx, "inbox write failed (non-fatal)", "error", err, "workspace_id", workspaceID, "channel", channel)
+			slog.WarnContext(providerCtx, "provider dispatch failed", "error", err, "integration_id", integrationID)
+			return attachMeta(nil, effectiveMode, channel, integrationID, providerName), err
 		}
-		providerCtx := applogger.WithProvider(ctx, intg.ProviderName)
-		provResult, err := sendViaProvider(providerCtx, intg)
+		slog.InfoContext(providerCtx, "message dispatched via provider", "message_id", provResult.ID)
+	}
+
+	if config.ShouldCaptureToInbox(effectiveMode) {
+		inboxResult, err = writeToInbox()
 		if err != nil {
-			slog.ErrorContext(ctx, "provider send failed", "error", err, "workspace_id", workspaceID, "channel", channel, "provider", intg.ProviderName)
-			return nil, err
-		}
-		if inboxResult != nil {
-			if provResult.Meta == nil {
-				provResult.Meta = make(map[string]string)
+			slog.ErrorContext(ctx, "inbox write failed", "error", err, "dispatch_mode", effectiveMode, "store_content", config.StoreMessageContent)
+			if effectiveMode == domain.DispatchMemory {
+				return attachMeta(nil, effectiveMode, channel, integrationID, providerName), err
 			}
-			provResult.Meta["inbox_message_id"] = inboxResult.ID
+			slog.WarnContext(ctx, "inbox capture failed after provider dispatch", "dispatch_mode", effectiveMode)
+		} else {
+			slog.InfoContext(ctx, "message captured in inbox", "message_id", inboxResult.ID, "store_content", config.StoreMessageContent)
 		}
-		attachMeta(provResult, mode, channel, intg.ID, intg.ProviderName)
-		slog.InfoContext(ctx, "message dispatched via memory and provider", "workspace_id", workspaceID, "channel", channel, "provider", intg.ProviderName, "message_id", provResult.ID)
-		return provResult, nil
-
-	default:
-		// Undefined modes fall back to memory_only (safe default).
-		slog.WarnContext(ctx, "unknown dispatch mode, falling back to memory only", "workspace_id", workspaceID, "mode", mode)
-		r, err := writeToInbox()
-		if err != nil {
-			slog.ErrorContext(ctx, "inbox write failed (fallback)", "error", err, "workspace_id", workspaceID, "channel", channel)
-			return nil, err
+	}
+
+	finalResult := provResult
+	if finalResult == nil {
+		finalResult = inboxResult
+	} else if inboxResult != nil {
+		if finalResult.Meta == nil {
+			finalResult.Meta = make(map[string]string)
 		}
-		attachMeta(r, domain.DispatchMemoryOnly, channel, "", memoryProviderName)
-		return r, nil
+		finalResult.Meta["inbox_message_id"] = inboxResult.ID
 	}
+
+	return attachMeta(finalResult, effectiveMode, channel, integrationID, providerName), nil
 }
 
-// resolveDispatchMode reads the workspace setting, defaulting gracefully.
-func (s *GatewayService) resolveDispatchMode(ctx context.Context, workspaceID string) domain.MessageDispatchMode {
+// ResolveDispatchConfig reads the workspace setting for outbound dispatch behavior.
+func (s *GatewayService) ResolveDispatchConfig(ctx context.Context, workspaceID string) (domain.MessageDispatchConfig, error) {
+	return s.resolveDispatchConfig(ctx, workspaceID)
+}
+
+// resolveDispatchConfig reads message_dispatch_mode and store_message_content from workspace settings.
+func (s *GatewayService) resolveDispatchConfig(ctx context.Context, workspaceID string) (domain.MessageDispatchConfig, error) {
 	if s.settings == nil {
-		return domain.DefaultMessageDispatchMode()
+		return domain.MessageDispatchConfig{
+			Mode:                domain.DefaultMessageDispatchMode(),
+			StoreMessageContent: false,
+		}, nil
 	}
-	v, err := s.settings.Get(ctx, workspaceID, domain.SettingKeyMessageDispatchMode)
-	if err != nil || v == "" {
-		return domain.DefaultMessageDispatchMode()
+
+	modeVal, err := s.settings.Get(ctx, workspaceID, domain.SettingKeyMessageDispatchMode)
+	if err != nil && !errors.Is(err, port.ErrNotFound) {
+		return domain.MessageDispatchConfig{}, fmt.Errorf("failed to lookup message dispatch mode: %w", err)
 	}
-	if m, ok := domain.ParseMessageDispatchMode(v); ok {
-		return m
+
+	storeVal, err := s.settings.Get(ctx, workspaceID, domain.SettingKeyStoreMessageContent)
+	if err != nil && !errors.Is(err, port.ErrNotFound) {
+		return domain.MessageDispatchConfig{}, fmt.Errorf("failed to lookup store message content setting: %w", err)
 	}
-	return domain.DefaultMessageDispatchMode()
+
+	return domain.ResolveMessageDispatchConfig(modeVal, storeVal), nil
 }
 
-// activeIntegration fetches the active (connected) integration for a workspace+channel.
-func (s *GatewayService) activeIntegration(ctx context.Context, workspaceID, channel string) (*domain.Integration, error) {
+// requireProviderIntegration loads and validates the workspace integration for provider dispatch.
+func (s *GatewayService) requireProviderIntegration(ctx context.Context, workspaceID, channel string) (*domain.Integration, error) {
+	if s.integrations == nil {
+		err := fmt.Errorf("integration repository not configured: %w", port.ErrInternal)
+		slog.ErrorContext(ctx, "provider dispatch blocked",
+			"reason", "repository_unavailable",
+			"channel", channel,
+			"error", err,
+		)
+		return nil, err
+	}
+
 	intg, err := s.integrations.GetActiveByWorkspaceAndChannel(ctx, workspaceID, channel)
 	if err != nil {
-		return nil, fmt.Errorf("no active %s integration for workspace %s: %w", channel, workspaceID, err)
+		reason := "lookup_failed"
+		log := slog.ErrorContext
+		if errors.Is(err, port.ErrNotFound) {
+			reason = "no_active_integration"
+			log = slog.WarnContext
+		}
+		log(ctx, "provider dispatch blocked",
+			"reason", reason,
+			"channel", channel,
+			"error", err,
+		)
+		return nil, fmt.Errorf("provider integration for %s channel: %w", channel, err)
 	}
+
+	if err := domain.ValidateProviderIntegration(*intg); err != nil {
+		slog.WarnContext(ctx, "provider dispatch blocked",
+			"reason", "integration_not_ready",
+			"channel", channel,
+			"integration_id", intg.ID,
+			"provider", intg.ProviderName,
+			"status", intg.Status,
+			"error", err,
+		)
+		return nil, err
+	}
+
 	return intg, nil
 }
 
@@ -302,16 +320,17 @@ func (s *GatewayService) writeChatToInbox(ctx context.Context, workspaceID strin
 	return &contracts.SendResult{ID: id, StatusCode: 200, Message: "captured in memory"}, nil
 }
 
-// attachMeta stamps standard dispatch metadata onto a result without allocating
-// if Meta is already populated.
-func attachMeta(r *contracts.SendResult, mode domain.MessageDispatchMode, channel, integrationID, providerName string) {
+// attachMeta stamps standard dispatch metadata onto r. When r is nil (error paths
+// with no provider payload), it allocates a minimal SendResult so callers can
+// still read provider_name via contracts.ProviderNameFromResult.
+func attachMeta(r *contracts.SendResult, effectiveMode domain.MessageDispatchMode, channel, integrationID, providerName string) *contracts.SendResult {
 	if r == nil {
-		return
+		r = &contracts.SendResult{}
 	}
 	if r.Meta == nil {
 		r.Meta = make(map[string]string, 4)
 	}
-	r.Meta["dispatch_mode"] = string(mode)
+	r.Meta["dispatch_mode"] = string(effectiveMode)
 	r.Meta["channel"] = channel
 	if integrationID != "" {
 		r.Meta["integration_id"] = integrationID
@@ -319,12 +338,13 @@ func attachMeta(r *contracts.SendResult, mode domain.MessageDispatchMode, channe
 	if providerName != "" {
 		r.Meta["provider_name"] = providerName
 	}
+	return r
 }
 
-// RecordLog persists a MessageRequestLog entry. Failures are logged with slog.
-func (s *GatewayService) RecordLog(ctx context.Context, entry *domain.MessageRequestLog) error {
+// RecordLog persists a MessageRequestLog entry. Repository errors are logged at the infra layer.
+func (s *GatewayService) RecordLog(ctx context.Context, entry domain.MessageRequestLog) error {
 	if s.logs == nil || entry.WorkspaceID == "" {
 		return nil
 	}
-	return s.logs.Create(ctx, entry)
+	return s.logs.Create(ctx, &entry)
 }
diff --git a/internal/core/service/gateway_service_test.go b/internal/core/service/gateway_service_test.go
index b41bc8a7..24dac19e 100644
--- a/internal/core/service/gateway_service_test.go
+++ b/internal/core/service/gateway_service_test.go
@@ -2,14 +2,31 @@ package service
 
 import (
 	"context"
+	"errors"
 	"testing"
 	"time"
 
 	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
 	"github.com/weprodev/wpd-message-gateway/internal/core/port"
 	"github.com/weprodev/wpd-message-gateway/pkg/contracts"
+	"github.com/weprodev/wpd-message-gateway/pkg/provider/mailgun"
+	"github.com/weprodev/wpd-message-gateway/pkg/registry"
 )
 
+type stubMailgunSender struct{}
+
+func (s *stubMailgunSender) Send(ctx context.Context, email contracts.Email) (*contracts.SendResult, error) {
+	return &contracts.SendResult{ID: "mg-1", StatusCode: 200, Message: "sent"}, nil
+}
+
+func (s *stubMailgunSender) Name() string { return mailgun.ProviderName }
+
+func init() {
+	registry.RegisterEmailProvider(mailgun.ProviderName, func(cfg registry.EmailConfig) (contracts.EmailSender, error) {
+		return &stubMailgunSender{}, nil
+	})
+}
+
 type stubSettingsRepo struct {
 	values map[string]string
 }
@@ -92,6 +109,66 @@ func (s *stubInbox) WriteChat(ctx context.Context, workspaceID string, chat cont
 	return "inbox-chat-1", nil
 }
 
+func TestGatewayService_ResolveDispatchConfig_defaults(t *testing.T) {
+	svc := NewGatewayService(nil, nil, &stubSettingsRepo{}, nil, nil)
+
+	config, _ := svc.ResolveDispatchConfig(context.Background(), "ws-1")
+	if config.Mode != domain.DispatchMemory {
+		t.Fatalf("mode: %v", config.Mode)
+	}
+	if config.StoreMessageContent {
+		t.Fatal("expected store_message_content false by default")
+	}
+}
+
+func TestGatewayService_ResolveDispatchConfig_fromSettings(t *testing.T) {
+	settings := &stubSettingsRepo{values: map[string]string{
+		domain.SettingKeyMessageDispatchMode: string(domain.DispatchProvider),
+		domain.SettingKeyStoreMessageContent: "true",
+	}}
+	svc := NewGatewayService(nil, nil, settings, nil, nil)
+
+	config, _ := svc.ResolveDispatchConfig(context.Background(), "ws-1")
+	if config.Mode != domain.DispatchProvider {
+		t.Fatalf("mode: %v", config.Mode)
+	}
+	if !config.StoreMessageContent {
+		t.Fatal("expected store_message_content true")
+	}
+}
+
+func TestGatewayService_SendEmail_memoryWithStoreContent(t *testing.T) {
+	settings := &stubSettingsRepo{values: map[string]string{
+		domain.SettingKeyStoreMessageContent: "true",
+	}}
+	inbox := &stubInbox{emailID: "stored-1"}
+	svc := NewGatewayService(&stubIntegrationRepo{}, nil, settings, inbox, nil)
+
+	res, err := svc.SendEmail(context.Background(), "ws-1", contracts.Email{
+		To: []string{"a@b.com"}, Subject: "s", HTML: "h",
+	})
+	if err != nil {
+		t.Fatalf("SendEmail: %v", err)
+	}
+	if res.ID != "stored-1" {
+		t.Fatalf("got ID %q", res.ID)
+	}
+}
+
+func TestGatewayService_SendEmail_providerMissingIntegration(t *testing.T) {
+	settings := &stubSettingsRepo{values: map[string]string{
+		domain.SettingKeyMessageDispatchMode: string(domain.DispatchProvider),
+	}}
+	svc := NewGatewayService(&stubIntegrationRepo{err: errors.New("not found")}, nil, settings, nil, nil)
+
+	_, err := svc.SendEmail(context.Background(), "ws-1", contracts.Email{
+		To: []string{"a@b.com"}, Subject: "s", HTML: "h",
+	})
+	if err == nil {
+		t.Fatal("expected provider lookup error")
+	}
+}
+
 func TestGatewayService_SendEmail_memoryOnly(t *testing.T) {
 	inbox := &stubInbox{emailID: "mem-1"}
 	svc := NewGatewayService(&stubIntegrationRepo{}, nil, nil, inbox, nil)
@@ -107,13 +184,13 @@ func TestGatewayService_SendEmail_memoryOnly(t *testing.T) {
 	if res.ID != "mem-1" {
 		t.Fatalf("got ID %q", res.ID)
 	}
-	if res.Meta["dispatch_mode"] != string(domain.DispatchMemoryOnly) {
+	if res.Meta["dispatch_mode"] != string(domain.DispatchMemory) {
 		t.Fatalf("dispatch_mode: %v", res.Meta["dispatch_mode"])
 	}
 	if res.Meta["channel"] != "email" {
 		t.Fatalf("channel: %v", res.Meta["channel"])
 	}
-	if res.Meta["provider_name"] != memoryProviderName {
+	if res.Meta["provider_name"] != domain.ProviderNameMemory {
 		t.Fatalf("provider_name: %v", res.Meta["provider_name"])
 	}
 }
@@ -133,17 +210,114 @@ func TestGatewayService_SendEmail_providerOnly_memoryIntegration(t *testing.T) {
 		ID:           "int-1",
 		WorkspaceID:  "ws-1",
 		ChannelType:  "email",
-		ProviderName: memoryProviderName,
+		ProviderName: domain.ProviderNameMemory,
 		Config:       []byte(`{}`),
 		Status:       domain.IntegrationStatusConnected,
 		CreatedAt:    ts,
 		UpdatedAt:    ts,
 	}
 	settings := &stubSettingsRepo{values: map[string]string{
-		domain.SettingKeyMessageDispatchMode: string(domain.DispatchProviderOnly),
+		domain.SettingKeyMessageDispatchMode: string(domain.DispatchProvider),
 	}}
-	inbox := &stubInbox{emailID: "cap-1"}
-	svc := NewGatewayService(&stubIntegrationRepo{active: intg}, nil, settings, inbox, nil)
+	svc := NewGatewayService(&stubIntegrationRepo{active: intg}, nil, settings, nil, nil)
+
+	_, err := svc.SendEmail(context.Background(), "ws-1", contracts.Email{
+		To: []string{"a@b.com"}, Subject: "s", HTML: "h",
+	})
+	if err == nil {
+		t.Fatal("expected error when provider mode uses memory integration")
+	}
+	if !errors.Is(err, domain.ErrProviderNotReady) {
+		t.Fatalf("expected ErrProviderNotReady, got %v", err)
+	}
+}
+
+func TestGatewayService_SendEmail_providerOnly_missingIntegration(t *testing.T) {
+	settings := &stubSettingsRepo{values: map[string]string{
+		domain.SettingKeyMessageDispatchMode: string(domain.DispatchProvider),
+	}}
+	svc := NewGatewayService(&stubIntegrationRepo{err: port.ErrNotFound}, nil, settings, nil, nil)
+
+	_, err := svc.SendEmail(context.Background(), "ws-1", contracts.Email{
+		To: []string{"a@b.com"}, Subject: "s", HTML: "h",
+	})
+	if err == nil {
+		t.Fatal("expected error when no active integration")
+	}
+	if !errors.Is(err, port.ErrNotFound) {
+		t.Fatalf("expected ErrNotFound, got %v", err)
+	}
+}
+
+func TestGatewayService_SendEmail_providerOnly_emptyConfig(t *testing.T) {
+	ts := time.Now()
+	intg := &domain.Integration{
+		ID:           "int-1",
+		WorkspaceID:  "ws-1",
+		ChannelType:  "email",
+		ProviderName: mailgun.ProviderName,
+		Config:       []byte(`   `),
+		Status:       domain.IntegrationStatusConnected,
+		CreatedAt:    ts,
+		UpdatedAt:    ts,
+	}
+	settings := &stubSettingsRepo{values: map[string]string{
+		domain.SettingKeyMessageDispatchMode: string(domain.DispatchProvider),
+	}}
+	svc := NewGatewayService(&stubIntegrationRepo{active: intg}, nil, settings, nil, nil)
+
+	_, err := svc.SendEmail(context.Background(), "ws-1", contracts.Email{
+		To: []string{"a@b.com"}, Subject: "s", HTML: "h",
+	})
+	if err == nil {
+		t.Fatal("expected error when provider config is empty")
+	}
+	if !errors.Is(err, domain.ErrProviderNotReady) {
+		t.Fatalf("expected ErrProviderNotReady, got %v", err)
+	}
+}
+
+func TestGatewayService_SendEmail_providerOnly_unknownProvider(t *testing.T) {
+	ts := time.Now()
+	intg := &domain.Integration{
+		ID:           "int-1",
+		WorkspaceID:  "ws-1",
+		ChannelType:  "email",
+		ProviderName: "unknown-provider",
+		Config:       []byte(`{"api_key":"key"}`),
+		Status:       domain.IntegrationStatusConnected,
+		CreatedAt:    ts,
+		UpdatedAt:    ts,
+	}
+	settings := &stubSettingsRepo{values: map[string]string{
+		domain.SettingKeyMessageDispatchMode: string(domain.DispatchProvider),
+	}}
+	svc := NewGatewayService(&stubIntegrationRepo{active: intg}, nil, settings, nil, nil)
+
+	_, err := svc.SendEmail(context.Background(), "ws-1", contracts.Email{
+		To: []string{"a@b.com"}, Subject: "s", HTML: "h",
+	})
+	if err == nil {
+		t.Fatal("expected error when provider factory is not registered")
+	}
+}
+
+func TestGatewayService_SendEmail_providerOnly_mailgunIntegration(t *testing.T) {
+	ts := time.Now()
+	intg := &domain.Integration{
+		ID:           "int-mg",
+		WorkspaceID:  "ws-1",
+		ChannelType:  "email",
+		ProviderName: mailgun.ProviderName,
+		Config:       []byte(`{"api_key":"key","domain":"mg.example.com","from_email":"noreply@mg.example.com"}`),
+		Status:       domain.IntegrationStatusConnected,
+		CreatedAt:    ts,
+		UpdatedAt:    ts,
+	}
+	settings := &stubSettingsRepo{values: map[string]string{
+		domain.SettingKeyMessageDispatchMode: string(domain.DispatchProvider),
+	}}
+	svc := NewGatewayService(&stubIntegrationRepo{active: intg}, nil, settings, nil, nil)
 
 	res, err := svc.SendEmail(context.Background(), "ws-1", contracts.Email{
 		To: []string{"a@b.com"}, Subject: "s", HTML: "h",
@@ -151,13 +325,57 @@ func TestGatewayService_SendEmail_providerOnly_memoryIntegration(t *testing.T) {
 	if err != nil {
 		t.Fatalf("SendEmail: %v", err)
 	}
-	if res.ID != "cap-1" {
+	if res.ID != "mg-1" {
 		t.Fatalf("got ID %q", res.ID)
 	}
-	if res.Meta["dispatch_mode"] != string(domain.DispatchProviderOnly) {
-		t.Fatalf("dispatch_mode: %v", res.Meta["dispatch_mode"])
+	if res.Meta["provider_name"] != mailgun.ProviderName {
+		t.Fatalf("provider_name: %v", res.Meta["provider_name"])
+	}
+}
+
+func TestGatewayService_SendEmail_providerDatabase_mailgunIntegration(t *testing.T) {
+	ts := time.Now()
+	intg := &domain.Integration{
+		ID:           "int-mg",
+		WorkspaceID:  "ws-1",
+		ChannelType:  "email",
+		ProviderName: mailgun.ProviderName,
+		Config:       []byte(`{"api_key":"key","domain":"mg.example.com","from_email":"noreply@mg.example.com"}`),
+		Status:       domain.IntegrationStatusConnected,
+		CreatedAt:    ts,
+		UpdatedAt:    ts,
+	}
+	settings := &stubSettingsRepo{values: map[string]string{
+		domain.SettingKeyMessageDispatchMode: string(domain.DispatchProvider),
+		domain.SettingKeyStoreMessageContent: "true",
+	}}
+	inbox := &stubInbox{emailID: "inbox-1"}
+	svc := NewGatewayService(&stubIntegrationRepo{active: intg}, nil, settings, inbox, nil)
+
+	res, err := svc.SendEmail(context.Background(), "ws-1", contracts.Email{
+		To: []string{"a@b.com"}, Subject: "s", HTML: "h",
+	})
+	if err != nil {
+		t.Fatalf("SendEmail: %v", err)
+	}
+	if res.Meta["provider_name"] != mailgun.ProviderName {
+		t.Fatalf("provider_name: %v", res.Meta["provider_name"])
+	}
+	if res.Meta["inbox_message_id"] != "inbox-1" {
+		t.Fatalf("inbox_message_id: %v", res.Meta["inbox_message_id"])
+	}
+}
+
+func TestGatewayService_dispatch_errorResult_stampsProviderMeta(t *testing.T) {
+	svc := NewGatewayService(nil, nil, nil, nil, nil)
+
+	res, err := svc.SendEmail(context.Background(), "ws-1", contracts.Email{
+		To: []string{"a@b.com"}, Subject: "s", HTML: "h",
+	})
+	if err == nil {
+		t.Fatal("expected inbox error")
 	}
-	if res.Meta["integration_id"] != "int-1" {
-		t.Fatalf("integration_id: %v", res.Meta["integration_id"])
+	if contracts.ProviderNameFromResult(res) != domain.ProviderNameMemory {
+		t.Fatalf("provider_name: %q", contracts.ProviderNameFromResult(res))
 	}
 }
diff --git a/internal/core/service/portal_service.go b/internal/core/service/portal_service.go
index 24403d0e..e7584701 100644
--- a/internal/core/service/portal_service.go
+++ b/internal/core/service/portal_service.go
@@ -510,11 +510,45 @@ func (s *PortalService) GetSettings(ctx context.Context, workspaceID string) (ma
 }
 
 func (s *PortalService) PatchSettings(ctx context.Context, workspaceID string, kv map[string]string) error {
+	keys := make([]string, 0, len(kv))
+	for k := range kv {
+		keys = append(keys, k)
+	}
+	slog.InfoContext(ctx, "patching workspace settings", "workspace_id", workspaceID, "keys", keys)
+
 	for k, v := range kv {
+		if err := domain.ValidateWorkspaceSettingValue(k, v); err != nil {
+			slog.WarnContext(ctx, "settings patch rejected: invalid value",
+				"workspace_id", workspaceID,
+				"key", k,
+				"error", err,
+			)
+			return fmt.Errorf("%w: %w", port.ErrInvalidInput, err)
+		}
+
+		if k == domain.SettingKeyMessageDispatchMode && v == string(domain.DispatchProvider) {
+			list, err := s.integrations.ListByWorkspace(ctx, workspaceID)
+			if err != nil {
+				return fmt.Errorf("failed to check integrations for provider enablement: %w", err)
+			}
+			hasConnected := false
+			for _, intg := range list {
+				if intg.ProviderName != domain.ProviderNameMemory && intg.Status == domain.IntegrationStatusConnected {
+					hasConnected = true
+					break
+				}
+			}
+			if !hasConnected {
+				return fmt.Errorf("%w: first configure a provider then you can enable it", port.ErrInvalidInput)
+			}
+		}
+
 		if err := s.settings.Set(ctx, workspaceID, k, v); err != nil {
 			return err
 		}
 	}
+
+	slog.InfoContext(ctx, "workspace settings patched successfully", "workspace_id", workspaceID, "keys", keys)
 	return nil
 }
 
diff --git a/internal/core/service/portal_service_test.go b/internal/core/service/portal_service_test.go
index f7df2f58..01841862 100644
--- a/internal/core/service/portal_service_test.go
+++ b/internal/core/service/portal_service_test.go
@@ -110,3 +110,99 @@ func TestAuthService_Login_masksInfrastructureErrors(t *testing.T) {
 		t.Fatalf("expected invalid email or password error, got %v", err)
 	}
 }
+
+type fakeSettingsRepo struct {
+	values map[string]string
+}
+
+func (f *fakeSettingsRepo) Get(ctx context.Context, workspaceID, key string) (string, error) {
+	return f.values[key], nil
+}
+
+func (f *fakeSettingsRepo) Set(ctx context.Context, workspaceID, key, value string) error {
+	if f.values == nil {
+		f.values = make(map[string]string)
+	}
+	f.values[key] = value
+	return nil
+}
+
+func (f *fakeSettingsRepo) GetAll(ctx context.Context, workspaceID string) (map[string]string, error) {
+	return f.values, nil
+}
+
+type fakeIntegrationRepo struct {
+	integrations []domain.Integration
+}
+
+func (f *fakeIntegrationRepo) Create(ctx context.Context, intg *domain.Integration) error { return nil }
+func (f *fakeIntegrationRepo) ListByWorkspace(ctx context.Context, workspaceID string) ([]domain.Integration, error) {
+	return f.integrations, nil
+}
+func (f *fakeIntegrationRepo) Upsert(ctx context.Context, intg *domain.Integration) error { return nil }
+func (f *fakeIntegrationRepo) GetByID(ctx context.Context, id string) (*domain.Integration, error) {
+	return nil, port.ErrNotFound
+}
+func (f *fakeIntegrationRepo) Delete(ctx context.Context, id string) error { return nil }
+func (f *fakeIntegrationRepo) ListProviders(ctx context.Context) ([]domain.Provider, error) {
+	return nil, nil
+}
+func (f *fakeIntegrationRepo) GetProviderFields(ctx context.Context, name string) ([]domain.ProviderConfigField, error) {
+	return nil, nil
+}
+func (f *fakeIntegrationRepo) GetActiveByWorkspaceAndChannel(ctx context.Context, workspaceID, channel string) (*domain.Integration, error) {
+	return nil, nil
+}
+
+func TestPortalService_PatchSettings_rejectsInvalidDispatchMode(t *testing.T) {
+	svc := NewPortalService(PortalDeps{Settings: &fakeSettingsRepo{}})
+
+	err := svc.PatchSettings(context.Background(), "ws-1", map[string]string{
+		domain.SettingKeyMessageDispatchMode: "invalid",
+	})
+	if !errors.Is(err, port.ErrInvalidInput) {
+		t.Fatalf("expected ErrInvalidInput, got %v", err)
+	}
+}
+
+func TestPortalService_PatchSettings_rejectsProviderWithoutIntegration(t *testing.T) {
+	repo := &fakeSettingsRepo{}
+	intgRepo := &fakeIntegrationRepo{
+		integrations: []domain.Integration{},
+	}
+	svc := NewPortalService(PortalDeps{
+		Settings:     repo,
+		Integrations: intgRepo,
+	})
+
+	err := svc.PatchSettings(context.Background(), "ws-1", map[string]string{
+		domain.SettingKeyMessageDispatchMode: string(domain.DispatchProvider),
+	})
+	if !errors.Is(err, port.ErrInvalidInput) {
+		t.Fatalf("expected ErrInvalidInput, got %v", err)
+	}
+}
+
+func TestPortalService_PatchSettings_persistsValidDispatchSettings(t *testing.T) {
+	repo := &fakeSettingsRepo{}
+	intgRepo := &fakeIntegrationRepo{
+		integrations: []domain.Integration{
+			{ProviderName: "mailgun", Status: domain.IntegrationStatusConnected},
+		},
+	}
+	svc := NewPortalService(PortalDeps{
+		Settings:     repo,
+		Integrations: intgRepo,
+	})
+
+	err := svc.PatchSettings(context.Background(), "ws-1", map[string]string{
+		domain.SettingKeyMessageDispatchMode: string(domain.DispatchProvider),
+		domain.SettingKeyStoreMessageContent: "true",
+	})
+	if err != nil {
+		t.Fatalf("PatchSettings: %v", err)
+	}
+	if repo.values[domain.SettingKeyMessageDispatchMode] != string(domain.DispatchProvider) {
+		t.Fatalf("mode not saved: %+v", repo.values)
+	}
+}
diff --git a/internal/infrastructure/logger/logger.go b/internal/infrastructure/logger/logger.go
index 9e5996db..5be26074 100644
--- a/internal/infrastructure/logger/logger.go
+++ b/internal/infrastructure/logger/logger.go
@@ -114,12 +114,8 @@ func New(env string, extraHandlers ...slog.Handler) (*pkglogger.Logger, error) {
 		return nil, err
 	}
 
-	// Wrap handler with ContextHandler to automatically capture request details
-	wrappedLogger := slog.New(NewContextHandler(log.Handler()))
-
-	// All slog.X() calls throughout the process now use this logger.
-	slog.SetDefault(wrappedLogger)
-	log.Logger = wrappedLogger
+	// ContextExtractors append correlation fields; avoid also wrapping ContextHandler (duplicate attrs).
+	slog.SetDefault(log.Logger)
 
 	return log, nil
 }
@@ -142,9 +138,7 @@ func WithProvider(ctx context.Context, provider string) context.Context {
 	return context.WithValue(ctx, keyProvider, provider)
 }
 
-// Attrs extracts all gateway-specific attributes from ctx into slog key-value pairs.
-// Note: Handlers wrapping standard slog logging now use ContextHandler to extract
-// these fields automatically; Attrs remains for manual or backwards-compatible usage.
+// Attrs extracts gateway correlation fields from ctx for go-pkg ContextExtractors.
 func Attrs(ctx context.Context) []any {
 	attrs := make([]any, 0, 10)
 	if v, _ := ctx.Value(keyWorkspaceID).(string); v != "" {
diff --git a/internal/infrastructure/repository/postgres/limitoffset.go b/internal/infrastructure/repository/postgres/limitoffset.go
new file mode 100644
index 00000000..497ba1a7
--- /dev/null
+++ b/internal/infrastructure/repository/postgres/limitoffset.go
@@ -0,0 +1,29 @@
+package postgres
+
+import "fmt"
+
+const (
+	defaultListLimit = 50
+	maxListLimit     = 500
+)
+
+// clampLimitOffset bounds list query pagination inputs.
+func clampLimitOffset(limit, offset int) (int, int) {
+	if limit <= 0 {
+		limit = defaultListLimit
+	}
+	if limit > maxListLimit {
+		limit = maxListLimit
+	}
+	if offset < 0 {
+		offset = 0
+	}
+	return limit, offset
+}
+
+// limitOffsetSQL returns a safe LIMIT/OFFSET clause for Postgres list queries.
+// Values are clamped in Go — not passed as query parameters (driver limitation).
+func limitOffsetSQL(limit, offset int) string {
+	limit, offset = clampLimitOffset(limit, offset)
+	return fmt.Sprintf("LIMIT %d OFFSET %d", limit, offset)
+}
diff --git a/internal/infrastructure/repository/postgres/limitoffset_test.go b/internal/infrastructure/repository/postgres/limitoffset_test.go
new file mode 100644
index 00000000..30e37904
--- /dev/null
+++ b/internal/infrastructure/repository/postgres/limitoffset_test.go
@@ -0,0 +1,33 @@
+package postgres
+
+import "testing"
+
+func TestClampLimitOffset(t *testing.T) {
+	tests := []struct {
+		name       string
+		limit      int
+		offset     int
+		wantLimit  int
+		wantOffset int
+	}{
+		{"defaults", 0, 0, defaultListLimit, 0},
+		{"caps max", 1000, 0, maxListLimit, 0},
+		{"negative offset", 10, -5, 10, 0},
+		{"valid", 25, 50, 25, 50},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			gotLimit, gotOffset := clampLimitOffset(tt.limit, tt.offset)
+			if gotLimit != tt.wantLimit || gotOffset != tt.wantOffset {
+				t.Fatalf("got (%d,%d), want (%d,%d)", gotLimit, gotOffset, tt.wantLimit, tt.wantOffset)
+			}
+		})
+	}
+}
+
+func TestLimitOffsetSQL(t *testing.T) {
+	if got := limitOffsetSQL(25, 10); got != "LIMIT 25 OFFSET 10" {
+		t.Fatalf("got %q", got)
+	}
+}
diff --git a/internal/infrastructure/repository/postgres/message_request_log_repository.go b/internal/infrastructure/repository/postgres/message_request_log_repository.go
index f29a46cd..082cde33 100644
--- a/internal/infrastructure/repository/postgres/message_request_log_repository.go
+++ b/internal/infrastructure/repository/postgres/message_request_log_repository.go
@@ -51,22 +51,12 @@ func (r *MessageRequestLogRepository) Create(ctx context.Context, log *domain.Me
 		provider, reqID, dur, errMsg,
 	).Scan(&log.ID, &log.CreatedAt)
 	if err != nil {
-		slog.ErrorContext(ctx, "database error: failed to create message request log", "error", err, "workspace_id", log.WorkspaceID, "endpoint", log.Endpoint)
+		slog.ErrorContext(ctx, "database error: failed to create message request log", "error", err, "endpoint", log.Endpoint)
 	}
 	return err
 }
 
 func (r *MessageRequestLogRepository) ListWithSource(ctx context.Context, q port.MessageLogQuery) ([]domain.MessageRequestLogWithSource, int, error) {
-	if q.Limit <= 0 {
-		q.Limit = 50
-	}
-	if q.Limit > 500 {
-		q.Limit = 500
-	}
-	if q.Offset < 0 {
-		q.Offset = 0
-	}
-
 	db := r.client.GetDB(ctx)
 	args := []any{q.WorkspaceID}
 	where := "l.workspace_id = $1"
@@ -89,13 +79,10 @@ func (r *MessageRequestLogRepository) ListWithSource(ctx context.Context, q port
 	countQuery := "SELECT COUNT(*) FROM message_request_logs l WHERE " + where
 	var total int
 	if err := db.QueryRowContext(ctx, countQuery, args...).Scan(&total); err != nil {
-		slog.ErrorContext(ctx, "database error: failed to count message request logs", "error", err, "workspace_id", q.WorkspaceID)
+		slog.ErrorContext(ctx, "database error: failed to count message request logs", "error", err)
 		return nil, 0, err
 	}
 
-	// LIMIT and OFFSET come from bounded Go int values clamped above — not from user input.
-	// database/sql does not support parameterised LIMIT/OFFSET in standard Postgres; using
-	// fmt.Sprintf with validated integers is the correct approach here.
 	listQuery := fmt.Sprintf(`
 		SELECT l.id, l.workspace_id, l.api_key_id, l.channel_type, l.http_method, l.status_code, l.endpoint,
 			l.provider_name, l.request_id, l.duration_ms, l.error_message, l.created_at,
@@ -104,11 +91,11 @@ func (r *MessageRequestLogRepository) ListWithSource(ctx context.Context, q port
 		LEFT JOIN api_keys k ON k.id = l.api_key_id
 		WHERE %s
 		ORDER BY l.created_at DESC
-		LIMIT %d OFFSET %d`, where, q.Limit, q.Offset)
+		%s`, where, limitOffsetSQL(q.Limit, q.Offset))
 
 	rows, err := db.QueryContext(ctx, listQuery, args...)
 	if err != nil {
-		slog.ErrorContext(ctx, "database error: failed to query message request logs", "error", err, "workspace_id", q.WorkspaceID)
+		slog.ErrorContext(ctx, "database error: failed to query message request logs", "error", err)
 		return nil, 0, err
 	}
 	defer rows.Close() //nolint:errcheck
@@ -126,7 +113,7 @@ func (r *MessageRequestLogRepository) ListWithSource(ctx context.Context, q port
 			&prov, &reqID, &dur, &errMsg, &row.CreatedAt,
 			&row.SourceName, &row.ClientID,
 		); err != nil {
-			slog.ErrorContext(ctx, "database error: failed to scan message request log", "error", err, "workspace_id", q.WorkspaceID)
+			slog.ErrorContext(ctx, "database error: failed to scan message request log", "error", err)
 			return nil, 0, err
 		}
 		if apiKeyID.Valid {
@@ -147,7 +134,7 @@ func (r *MessageRequestLogRepository) ListWithSource(ctx context.Context, q port
 		out = append(out, row)
 	}
 	if err := rows.Err(); err != nil {
-		slog.ErrorContext(ctx, "database error: rows iteration failed for message request logs", "error", err, "workspace_id", q.WorkspaceID)
+		slog.ErrorContext(ctx, "database error: rows iteration failed for message request logs", "error", err)
 		return nil, 0, err
 	}
 	return out, total, nil
diff --git a/internal/presentation/handler/portal_handler.go b/internal/presentation/handler/portal_handler.go
index a64dabf7..3d6b47cd 100644
--- a/internal/presentation/handler/portal_handler.go
+++ b/internal/presentation/handler/portal_handler.go
@@ -177,7 +177,9 @@ func (h *PortalHandler) PatchSettings(c echo.Context) error {
 		return echo.NewHTTPError(http.StatusBadRequest, "invalid JSON")
 	}
 	if err := h.svc.PatchSettings(c.Request().Context(), wid, body); err != nil {
-		slog.ErrorContext(c.Request().Context(), "failed to patch settings", "error", err, "workspace_id", wid)
+		if !errors.Is(err, port.ErrInvalidInput) {
+			slog.ErrorContext(c.Request().Context(), "failed to patch settings", "error", err, "workspace_id", wid)
+		}
 		return safeHTTPError(err, http.StatusBadRequest, "failed to patch settings")
 	}
 	return c.NoContent(http.StatusNoContent)
diff --git a/internal/presentation/handler/send_helper.go b/internal/presentation/handler/send_helper.go
index 265fe833..3ebec185 100644
--- a/internal/presentation/handler/send_helper.go
+++ b/internal/presentation/handler/send_helper.go
@@ -38,42 +38,43 @@ func (sh *SendHelper) DispatchAndLog(
 	start := time.Now()
 	ctx := c.Request().Context()
 
-	// Enrich context with gateway-domain attributes for logger
 	ctx = logger.WithWorkspace(ctx, workspaceID, apiKeyID)
 	ctx = logger.WithChannel(ctx, channel)
 
 	if workspaceID == "" {
-		sh.RecordLog(ctx, workspaceID, apiKeyID, channel, c.Request().Method,
-			http.StatusUnauthorized, endpoint, start, "missing workspace context", "")
+		slog.WarnContext(ctx, "send rejected: missing workspace context", "endpoint", endpoint)
 		return c.JSON(http.StatusUnauthorized, map[string]string{"error": "missing workspace context"})
 	}
 
 	if err := json.NewDecoder(c.Request().Body).Decode(dst); err != nil {
-		sh.RecordLog(ctx, workspaceID, apiKeyID, channel, c.Request().Method,
+		slog.WarnContext(ctx, "send rejected: invalid JSON body", "endpoint", endpoint, "error", err)
+		sh.recordLog(ctx, workspaceID, apiKeyID, channel, c.Request().Method,
 			http.StatusBadRequest, endpoint, start, "invalid JSON body", "")
 		return c.JSON(http.StatusBadRequest, map[string]string{"error": "invalid JSON body"})
 	}
 
+	slog.InfoContext(ctx, "send dispatch starting", "endpoint", endpoint)
+
 	result, err := send(ctx)
+	providerName := contracts.ProviderNameFromResult(result)
+	if providerName != "" {
+		ctx = logger.WithProvider(ctx, providerName)
+	}
+
 	if err != nil {
-		// Log the full error internally; never echo infrastructure details to the caller.
-		slog.ErrorContext(ctx, "send failed", "error", err)
-		sh.RecordLog(ctx, workspaceID, apiKeyID, channel, c.Request().Method,
-			http.StatusInternalServerError, endpoint, start, err.Error(), providerFromMeta(result))
+		slog.ErrorContext(ctx, "send failed", "error", err, "endpoint", endpoint, "duration_ms", time.Since(start).Milliseconds())
+		sh.recordLog(ctx, workspaceID, apiKeyID, channel, c.Request().Method,
+			http.StatusInternalServerError, endpoint, start, err.Error(), providerName)
 		return c.JSON(http.StatusInternalServerError, map[string]string{"error": "send failed"})
 	}
 
-	if provider := providerFromMeta(result); provider != "" {
-		ctx = logger.WithProvider(ctx, provider)
-	}
-	slog.InfoContext(ctx, "send ok", "duration_ms", time.Since(start).Milliseconds())
-	sh.RecordLog(ctx, workspaceID, apiKeyID, channel, c.Request().Method,
-		http.StatusOK, endpoint, start, "", providerFromMeta(result))
+	slog.InfoContext(ctx, "send ok", "endpoint", endpoint, "duration_ms", time.Since(start).Milliseconds())
+	sh.recordLog(ctx, workspaceID, apiKeyID, channel, c.Request().Method,
+		http.StatusOK, endpoint, start, "", providerName)
 	return c.JSON(http.StatusOK, result)
 }
 
-// RecordLog persists a MessageRequestLog entry. Failures are logged with slog.
-func (sh *SendHelper) RecordLog(
+func (sh *SendHelper) recordLog(
 	ctx context.Context,
 	workspaceID, apiKeyID, channelType, method string,
 	statusCode int,
@@ -84,7 +85,7 @@ func (sh *SendHelper) RecordLog(
 	if sh.svc == nil || workspaceID == "" {
 		return
 	}
-	entry := &domain.MessageRequestLog{
+	entry := domain.MessageRequestLog{
 		WorkspaceID:  workspaceID,
 		APIKeyID:     apiKeyID,
 		ChannelType:  channelType,
@@ -97,13 +98,6 @@ func (sh *SendHelper) RecordLog(
 		ErrorMessage: errMsg,
 	}
 	if err := sh.svc.RecordLog(ctx, entry); err != nil {
-		slog.ErrorContext(ctx, "message_request_log insert failed", "error", err)
-	}
-}
-
-func providerFromMeta(r *contracts.SendResult) string {
-	if r == nil || r.Meta == nil {
-		return ""
+		slog.WarnContext(ctx, "failed to persist message request log", "error", err, "endpoint", endpoint)
 	}
-	return r.Meta["provider_name"]
 }
diff --git a/internal/presentation/handler/send_helper_test.go b/internal/presentation/handler/send_helper_test.go
index 945680d3..9be5911a 100644
--- a/internal/presentation/handler/send_helper_test.go
+++ b/internal/presentation/handler/send_helper_test.go
@@ -88,12 +88,37 @@ func TestSendHelper_DispatchAndLog(t *testing.T) {
 		}
 	})
 
-	t.Run("repository error logged without failing dispatch", func(t *testing.T) {
+	t.Run("missing workspace returns unauthorized", func(t *testing.T) {
 		req := httptest.NewRequest(http.MethodPost, "/v1/email", strings.NewReader(`{"to":["test@example.com"]}`))
 		rec := httptest.NewRecorder()
 		c := e.NewContext(req, rec)
 
-		repo := &mockLogRepo{createErr: errors.New("db error")}
+		repo := &mockLogRepo{}
+		svc := service.NewGatewayService(nil, nil, nil, nil, repo)
+		helper := NewSendHelper(svc)
+
+		var dst contracts.Email
+		err := helper.DispatchAndLog(c, "email", "", "key-456", "/v1/email", &dst, func(ctx context.Context) (*contracts.SendResult, error) {
+			return &contracts.SendResult{ID: "msg-111"}, nil
+		})
+
+		if err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+		if rec.Code != http.StatusUnauthorized {
+			t.Errorf("expected status 401, got %d", rec.Code)
+		}
+		if len(repo.entries) != 0 {
+			t.Fatalf("expected no log entry without workspace, got %d", len(repo.entries))
+		}
+	})
+
+	t.Run("invalid JSON returns bad request", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodPost, "/v1/email", strings.NewReader(`{invalid`))
+		rec := httptest.NewRecorder()
+		c := e.NewContext(req, rec)
+
+		repo := &mockLogRepo{}
 		svc := service.NewGatewayService(nil, nil, nil, nil, repo)
 		helper := NewSendHelper(svc)
 
@@ -105,9 +130,33 @@ func TestSendHelper_DispatchAndLog(t *testing.T) {
 		if err != nil {
 			t.Fatalf("unexpected error: %v", err)
 		}
+		if rec.Code != http.StatusBadRequest {
+			t.Errorf("expected status 400, got %d", rec.Code)
+		}
+	})
 
-		if rec.Code != http.StatusOK {
-			t.Errorf("expected status OK, got %d", rec.Code)
+	t.Run("send failure returns 500 and logs error", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodPost, "/v1/email", strings.NewReader(`{"to":["test@example.com"]}`))
+		rec := httptest.NewRecorder()
+		c := e.NewContext(req, rec)
+
+		repo := &mockLogRepo{}
+		svc := service.NewGatewayService(nil, nil, nil, nil, repo)
+		helper := NewSendHelper(svc)
+
+		var dst contracts.Email
+		err := helper.DispatchAndLog(c, "email", "ws-123", "key-456", "/v1/email", &dst, func(ctx context.Context) (*contracts.SendResult, error) {
+			return nil, errors.New("dispatch failed")
+		})
+
+		if err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+		if rec.Code != http.StatusInternalServerError {
+			t.Errorf("expected status 500, got %d", rec.Code)
+		}
+		if len(repo.entries) != 1 || repo.entries[0].StatusCode != http.StatusInternalServerError {
+			t.Fatalf("expected error log entry, got %+v", repo.entries)
 		}
 	})
 }
diff --git a/internal/presentation/middleware/auth.go b/internal/presentation/middleware/auth.go
index bf9ddc0c..6d8f2534 100644
--- a/internal/presentation/middleware/auth.go
+++ b/internal/presentation/middleware/auth.go
@@ -11,6 +11,7 @@ import (
 	"github.com/weprodev/go-pkg/crypto"
 
 	"github.com/weprodev/wpd-message-gateway/internal/core/port"
+	applogger "github.com/weprodev/wpd-message-gateway/internal/infrastructure/logger"
 )
 
 type contextKey string
@@ -76,14 +77,14 @@ func APIKeyAuthMiddleware(apiKeyRepo port.APIKeyRepository, workspaceRepo port.W
 			}
 
 			if err := apiKeyRepo.UpdateLastUsedAt(c.Request().Context(), apiKey.ID); err != nil {
-				// Non-fatal: continue request
-				_ = err
+				slog.WarnContext(c.Request().Context(), "failed to update API key last_used_at", "error", err, "api_key_id", apiKey.ID)
 			}
 
 			ctx := c.Request().Context()
 			ctx = context.WithValue(ctx, WorkspaceIDKey, apiKey.WorkspaceID)
 			ctx = context.WithValue(ctx, APIKeyIDKey, apiKey.ID)
 			ctx = context.WithValue(ctx, APIKeyNameKey, apiKey.Name)
+			ctx = applogger.WithWorkspace(ctx, apiKey.WorkspaceID, apiKey.ID)
 			c.SetRequest(c.Request().WithContext(ctx))
 			return next(c)
 		}
diff --git a/pkg/contracts/message.go b/pkg/contracts/message.go
index b4d1f020..56c6559d 100644
--- a/pkg/contracts/message.go
+++ b/pkg/contracts/message.go
@@ -15,3 +15,11 @@ type SendResult struct {
 	Message    string            `json:"message"`
 	Meta       map[string]string `json:"meta,omitempty"`
 }
+
+// ProviderNameFromResult returns provider_name from dispatch metadata when present.
+func ProviderNameFromResult(r *SendResult) string {
+	if r == nil || r.Meta == nil {
+		return ""
+	}
+	return r.Meta["provider_name"]
+}

From 2a59c8fd9db972020235ce3de016a04b802cf222 Mon Sep 17 00:00:00 2001
From: MichaelAndish <maikel1370@gmail.com>
Date: Thu, 2 Jul 2026 23:17:28 +0200
Subject: [PATCH 02/20] WPD-33-feat: added demo credentials output to make dev
 command

---
 Makefile | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/Makefile b/Makefile
index bdbc0c02..a554848f 100644
--- a/Makefile
+++ b/Makefile
@@ -300,11 +300,19 @@ docker-check:
 dev: docker-check
 	@printf "\n"
 	@printf "$(BOLD)$(CYAN)🐳 Starting Gateway, database, and Portal UI via Docker...$(RESET)\n"
-	@docker compose up -d --build
+	@docker compose up -d --build --renew-anon-volumes
 	@printf "$(GREEN)✅ All services started!$(RESET)\n"
 	@printf "\n"
-	@printf "   $(BOLD)Gateway API:$(RESET)  http://localhost:10101\n"
-	@printf "   $(BOLD)Portal UI:$(RESET)    http://localhost:10104\n"
+	@printf "   ╭───────────────────────────────────────────────────╮\n"
+	@printf "   │                                                   │\n"
+	@printf "   │  $(BOLD)Gateway API:$(RESET)  http://localhost:10101             │\n"
+	@printf "   │  $(BOLD)Portal UI:$(RESET)    http://localhost:10104             │\n"
+	@printf "   │                                                   │\n"
+	@printf "   │  $(BOLD)Demo Account$(RESET)                                     │\n"
+	@printf "   │  Email:    demo@weprodev.com                      │\n"
+	@printf "   │  Password: secret                                 │\n"
+	@printf "   │                                                   │\n"
+	@printf "   ╰───────────────────────────────────────────────────╯\n"
 	@printf "\n"
 
 ## Stop Docker Compose

From f900fd5409e98a56d6c2f5116df9698e1f7e7f8a Mon Sep 17 00:00:00 2001
From: MichaelAndish <maikel1370@gmail.com>
Date: Thu, 2 Jul 2026 23:35:55 +0200
Subject: [PATCH 03/20] WPD-33-fix: corrected footer slogan text and alignment

---
 frontend/src/shared/components/app-footer.tsx | 12 ++----------
 1 file changed, 2 insertions(+), 10 deletions(-)

diff --git a/frontend/src/shared/components/app-footer.tsx b/frontend/src/shared/components/app-footer.tsx
index 565fc16f..923afa9f 100644
--- a/frontend/src/shared/components/app-footer.tsx
+++ b/frontend/src/shared/components/app-footer.tsx
@@ -10,13 +10,7 @@ export function AppFooter({ variant = "default" }: AppFooterProps) {
 
   return (
     <footer className="w-full shrink-0 border-t border-divider bg-card">
-      <div
-        className={
-          variant === "dashboard"
-            ? "flex h-16 items-center px-12 py-6"
-            : "flex h-16 items-center justify-between px-12 py-6"
-        }
-      >
+      <div className="flex h-16 items-center justify-between px-12 py-6">
         <p className="text-sm text-text-secondary">
           Developed by{" "}
           <a
@@ -28,9 +22,7 @@ export function AppFooter({ variant = "default" }: AppFooterProps) {
             WeProDev
           </a>
         </p>
-        {variant === "default" ? (
-          <p className="text-sm text-text-tertiary">We develop for grow with growth in mind.</p>
-        ) : null}
+        <p className="text-sm text-text-tertiary">We develop for growth, with growth in mind!</p>
       </div>
     </footer>
   )

From fd629165897802259006fe1633fdf28dbfbd9c8d Mon Sep 17 00:00:00 2001
From: MichaelAndish <maikel1370@gmail.com>
Date: Thu, 2 Jul 2026 23:37:01 +0200
Subject: [PATCH 04/20] WPD-33-fix: moved Danger zone inside General tab
 content

---
 .../features/settings/pages/settings.page.tsx | 20 +++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/frontend/src/features/settings/pages/settings.page.tsx b/frontend/src/features/settings/pages/settings.page.tsx
index 1f0e1feb..c8b36cdb 100644
--- a/frontend/src/features/settings/pages/settings.page.tsx
+++ b/frontend/src/features/settings/pages/settings.page.tsx
@@ -243,6 +243,16 @@ export function SettingsPage() {
 
         <Tabs.Content value="general">
           <GeneralSettingsPanel key={wid} settings={settings} onSave={saveSettings} />
+
+          <section className="mt-4 rounded-lg border border-destructive/30 bg-destructive/5 p-6">
+            <h2 className="text-base font-semibold text-destructive">Danger zone</h2>
+            <p className="mt-1 text-sm text-text-secondary">
+              Permanently delete this workspace and all associated data.
+            </p>
+            <Button type="button" variant="destructive" className="mt-4" disabled>
+              Delete workspace
+            </Button>
+          </section>
         </Tabs.Content>
 
         <Tabs.Content value="developer" className="flex flex-col gap-4">
@@ -294,16 +304,6 @@ export function SettingsPage() {
           />
         </Tabs.Content>
       </Tabs.Root>
-
-      <section className="mt-4 rounded-lg border border-destructive/30 bg-destructive/5 p-6">
-        <h2 className="text-base font-semibold text-destructive">Danger zone</h2>
-        <p className="mt-1 text-sm text-text-secondary">
-          Permanently delete this workspace and all associated data.
-        </p>
-        <Button type="button" variant="destructive" className="mt-4" disabled>
-          Delete workspace
-        </Button>
-      </section>
     </div>
   )
 }

From c4b976fec1f15bb60722b3da588ef8a05b63279b Mon Sep 17 00:00:00 2001
From: MichaelAndish <maikel1370@gmail.com>
Date: Thu, 2 Jul 2026 23:39:18 +0200
Subject: [PATCH 05/20] WPD-33-fix: unlocked DB storage config across all
 dispatch modes and fixed Checkbox styles

---
 frontend/src/components/ui/checkbox.tsx                | 6 +++---
 frontend/src/features/settings/pages/settings.page.tsx | 9 +++------
 2 files changed, 6 insertions(+), 9 deletions(-)

diff --git a/frontend/src/components/ui/checkbox.tsx b/frontend/src/components/ui/checkbox.tsx
index 1eae53bf..b9d74bc5 100644
--- a/frontend/src/components/ui/checkbox.tsx
+++ b/frontend/src/components/ui/checkbox.tsx
@@ -11,15 +11,15 @@ const Checkbox = React.forwardRef<
   <CheckboxPrimitive.Root
     ref={ref}
     className={cn(
-      "grid place-content-center peer h-4 w-4 shrink-0 rounded-sm border border-primary shadow focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:cursor-not-allowed disabled:opacity-50 data-[state=checked]:bg-primary data-[state=checked]:text-primary-foreground",
+      "peer h-4 w-4 shrink-0 rounded-sm border border-primary ring-offset-background focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 disabled:cursor-not-allowed disabled:opacity-50 data-[state=checked]:bg-primary data-[state=checked]:text-primary-foreground",
       className
     )}
     {...props}
   >
     <CheckboxPrimitive.Indicator
-      className={cn("grid place-content-center text-current")}
+      className={cn("flex items-center justify-center text-current")}
     >
-      <Icon name="check" className="h-4 w-4" />
+      <Icon name="check" className="h-3.5 w-3.5 text-[14px]" />
     </CheckboxPrimitive.Indicator>
   </CheckboxPrimitive.Root>
 ))
diff --git a/frontend/src/features/settings/pages/settings.page.tsx b/frontend/src/features/settings/pages/settings.page.tsx
index c8b36cdb..17fde658 100644
--- a/frontend/src/features/settings/pages/settings.page.tsx
+++ b/frontend/src/features/settings/pages/settings.page.tsx
@@ -139,19 +139,16 @@ function DispatchSettingsPanel({ initialConfig, onSave }: DispatchSettingsPanelP
       </div>
 
       <div className="flex items-center justify-between gap-4 rounded-lg border border-border p-4">
-        <label htmlFor="store-message-content" className={cn("flex flex-1 cursor-pointer flex-col gap-1", mode === "memory" && "opacity-50 cursor-not-allowed")}>
+        <label htmlFor="store-message-content" className="flex flex-1 cursor-pointer flex-col gap-1">
           <span className="text-sm font-medium text-foreground">Store message content in inbox</span>
           <span className="text-sm text-text-secondary">
-            {mode === "memory" 
-              ? "Message bodies are always captured in Memory mode." 
-              : "When enabled, message bodies are captured in the portal inbox for review."}
+            When enabled, message bodies are captured in the portal inbox for review.
           </span>
         </label>
         <Checkbox
           id="store-message-content"
-          checked={mode === "memory" ? true : storeMessageContent}
+          checked={storeMessageContent}
           onCheckedChange={(checked) => setStoreMessageContent(checked === true)}
-          disabled={mode === "memory"}
         />
       </div>
 

From bb14502e5e47129af3d4d971c33244bc372fe1b1 Mon Sep 17 00:00:00 2001
From: MichaelAndish <maikel1370@gmail.com>
Date: Thu, 2 Jul 2026 23:40:16 +0200
Subject: [PATCH 06/20] WPD-33-fix: replaced deprecated React.ElementRef with
 React.ComponentRef

---
 frontend/src/components/ui/checkbox.tsx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/frontend/src/components/ui/checkbox.tsx b/frontend/src/components/ui/checkbox.tsx
index b9d74bc5..9b17e647 100644
--- a/frontend/src/components/ui/checkbox.tsx
+++ b/frontend/src/components/ui/checkbox.tsx
@@ -5,7 +5,7 @@ import { Icon } from "@/components/ui/icon"
 import { cn } from "@/lib/utils"
 
 const Checkbox = React.forwardRef<
-  React.ElementRef<typeof CheckboxPrimitive.Root>,
+  React.ComponentRef<typeof CheckboxPrimitive.Root>,
   React.ComponentPropsWithoutRef<typeof CheckboxPrimitive.Root>
 >(({ className, ...props }, ref) => (
   <CheckboxPrimitive.Root

From bf1c441a456eb406ec941295f6105ba705e6c88d Mon Sep 17 00:00:00 2001
From: MichaelAndish <maikel1370@gmail.com>
Date: Fri, 3 Jul 2026 20:58:17 +0200
Subject: [PATCH 07/20] chore: update deps

---
 frontend/package-lock.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index a3c0f3e5..90763c7c 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -4977,9 +4977,9 @@
       "license": "MIT"
     },
     "node_modules/electron-to-chromium": {
-      "version": "1.5.384",
-      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.384.tgz",
-      "integrity": "sha512-g6KAKY1vkYsADvSPWvdJsuYT0ixdcu6lUtD9P/wJKGBEDlZVXh2AX42j1mPqqaQPDluWjara9ziQ7xqAeXCt5A==",
+      "version": "1.5.385",
+      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.385.tgz",
+      "integrity": "sha512-78sa/M08MNAYHQfjoWMvOlKQqZ0ElhSm/L5HNUc96VZ3b+KvDVnngFm8sYQy0XrhTRgAhggHr5abA7yTvRdo4Q==",
       "dev": true,
       "license": "ISC"
     },

From 7809080e43c6fe1925137ee0582491763bb8b00e Mon Sep 17 00:00:00 2001
From: MichaelAndish <maikel1370@gmail.com>
Date: Fri, 3 Jul 2026 21:45:11 +0200
Subject: [PATCH 08/20] feat: implement message request payload storage and
 logging enhancements

- Added a new `message_request_payloads` table to store request and response bodies separately for improved data privacy and retention policies.
- Updated `MessageRequestLog` and related domain models to support payload storage.
- Enhanced logging functionality in `SendHelper` to conditionally store request and response payloads based on dispatch metadata.
- Updated tests to verify the correct behavior of payload storage and retrieval.

This commit enhances the message dispatch system by ensuring that sensitive data is managed appropriately while maintaining operational logging capabilities.
---
 .agents/skills/golang-pro/SKILL.md            |  3 +-
 .agents/skills/software-architecture/SKILL.md |  1 +
 .claude/commands/smell.md                     |  3 +-
 .../20260318000000_init_gateway.down.sql      |  1 +
 .../20260318000000_init_gateway.up.sql        | 11 ++++
 docs/backend/architecture.md                  |  2 +-
 internal/core/domain/log_row.go               |  4 +-
 internal/core/domain/message_request_log.go   | 26 ++++----
 .../core/domain/message_request_payload.go    | 12 ++++
 internal/core/service/gateway_service.go      | 15 ++---
 .../message_request_log_repository.go         | 36 ++++++++---
 .../presentation/handler/portal_handler.go    | 42 ++++++++++++-
 internal/presentation/handler/send_helper.go  | 31 ++++++++-
 .../presentation/handler/send_helper_test.go  | 63 +++++++++++++++++++
 pkg/contracts/message.go                      | 30 ++++++++-
 pkg/contracts/message_test.go                 | 53 ++++++++++++++++
 16 files changed, 296 insertions(+), 37 deletions(-)
 create mode 100644 internal/core/domain/message_request_payload.go
 create mode 100644 pkg/contracts/message_test.go

diff --git a/.agents/skills/golang-pro/SKILL.md b/.agents/skills/golang-pro/SKILL.md
index 378bf7ea..8fd7e8ce 100644
--- a/.agents/skills/golang-pro/SKILL.md
+++ b/.agents/skills/golang-pro/SKILL.md
@@ -97,9 +97,10 @@ Key properties demonstrated: bounded goroutine lifetime via `ctx`, error propaga
 - Handle all errors explicitly (no naked returns)
 - Write table-driven tests with subtests
 - Document all exported functions, types, and packages
-- Use `X | Y` union constraints for generics (Go 1.18+)
+	- Use `X | Y` union constraints for generics (Go 1.18+)
 - Propagate errors with fmt.Errorf("%w", err)
 - Run race detector on tests (-race flag)
+- Maintain pure domain entities (strict DDD): NEVER use `json:"..."`, `db:"..."` or other presentation/infrastructure tags in `internal/core/domain`. ALWAYS map domain models to DTOs in the presentation layer before returning them.
 
 ### MUST NOT DO
 - Ignore errors (avoid _ assignment without justification)
diff --git a/.agents/skills/software-architecture/SKILL.md b/.agents/skills/software-architecture/SKILL.md
index 4aff70f7..8aa6af9f 100644
--- a/.agents/skills/software-architecture/SKILL.md
+++ b/.agents/skills/software-architecture/SKILL.md
@@ -40,6 +40,7 @@ This skill provides guidance for quality focused software development and archit
 - **Clean Architecture & DDD Principles:**
   - Follow domain-driven design and ubiquitous language
   - Separate domain entities from infrastructure concerns
+  - **Strict boundary**: Presentation data transfer objects (DTOs) must be completely separate from Domain entities. The Presentation layer is responsible for mapping Domain objects to DTOs. Domain objects must never contain presentation tags (e.g. JSON) and must never be serialized directly.
   - Keep business logic independent of frameworks
   - Define use cases clearly and keep them isolated
 - **Naming Conventions:**
diff --git a/.claude/commands/smell.md b/.claude/commands/smell.md
index 16020700..8333c987 100644
--- a/.claude/commands/smell.md
+++ b/.claude/commands/smell.md
@@ -101,7 +101,7 @@ Router → Middleware → Handler → Service → Port ← Repository / Provider
 
 | Area | Violation |
 | ---- | --------- |
-| `internal/core/domain/` | Imports Echo, HTTP, infra, or presentation |
+| `internal/core/domain/` | Imports Echo, HTTP, infra, presentation, or contains struct tags (`json`, `db`) |
 | `internal/core/port/` | Contains implementation instead of interfaces |
 | `internal/core/service/` | Direct SQL/HTTP; missing `ctx`; orchestration left in handler |
 | `internal/infrastructure/` | Business rules; bypasses port interfaces |
@@ -219,6 +219,7 @@ Do not invent issues. If the diff is clean, say so.
 | -- | ------- |
 | DDD.LAYER | Business rule or orchestration in the wrong layer (handler/UI/infra) |
 | DDD.BOUNDARY | Bounded context violated (feature↔feature, `pkg`→`internal`, shared→feature) |
+| DDD.DOMAIN-LEAK | Domain object returned directly from handler without DTO mapping, or containing presentation tags (`json`) |
 | DDD.VALUE-TYPE | Domain concept as raw string/number — use typed constant in domain + API/FE mirror |
 
 **General — SOLID**
diff --git a/database/migrations/20260318000000_init_gateway.down.sql b/database/migrations/20260318000000_init_gateway.down.sql
index 8dec95e1..1601b1c7 100644
--- a/database/migrations/20260318000000_init_gateway.down.sql
+++ b/database/migrations/20260318000000_init_gateway.down.sql
@@ -6,6 +6,7 @@ DROP TABLE IF EXISTS workspace_access_audits CASCADE;
 DROP TABLE IF EXISTS workspace_settings CASCADE;
 DROP TABLE IF EXISTS template_components CASCADE;
 DROP TABLE IF EXISTS templates CASCADE;
+DROP TABLE IF EXISTS message_request_payloads CASCADE;
 DROP TABLE IF EXISTS message_request_logs CASCADE;
 DROP TABLE IF EXISTS api_keys CASCADE;
 DROP TABLE IF EXISTS integrations CASCADE;
diff --git a/database/migrations/20260318000000_init_gateway.up.sql b/database/migrations/20260318000000_init_gateway.up.sql
index 5b9bc09f..96dcf1d4 100644
--- a/database/migrations/20260318000000_init_gateway.up.sql
+++ b/database/migrations/20260318000000_init_gateway.up.sql
@@ -272,6 +272,17 @@ CREATE INDEX idx_message_request_logs_workspace_api_created
     ON message_request_logs (workspace_id, api_key_id, created_at DESC)
     WHERE api_key_id IS NOT NULL;
 
+-- ==============================================================================
+-- 11.5. MESSAGE_REQUEST_PAYLOADS TABLE (Append-only body storage)
+-- ==============================================================================
+
+CREATE TABLE message_request_payloads (
+    log_id        UUID        PRIMARY KEY REFERENCES message_request_logs(id) ON DELETE CASCADE,
+    request_body  TEXT,
+    response_body TEXT,
+    created_at    TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
 -- ==============================================================================
 -- 12. TEMPLATES TABLE
 -- ==============================================================================
diff --git a/docs/backend/architecture.md b/docs/backend/architecture.md
index 5e5e444d..befdcf52 100644
--- a/docs/backend/architecture.md
+++ b/docs/backend/architecture.md
@@ -258,7 +258,7 @@ PATCH /api/v1/workspaces/:wid/settings
 { "message_dispatch_mode": "provider", "store_message_content": "true" }
 ```
 
-**Request logs**: Every API send appends a row to `message_request_logs` (operational tracing with correlation `request_id`).
+**Request logs**: Every API send appends a row to `message_request_logs` (operational tracing with correlation `request_id`). Payload bodies are stored in a separate table (`message_request_payloads`) to prevent table bloat and enforce independent data privacy/retention policies.
 
 ---
 
diff --git a/internal/core/domain/log_row.go b/internal/core/domain/log_row.go
index eb9d2661..0cf190e3 100644
--- a/internal/core/domain/log_row.go
+++ b/internal/core/domain/log_row.go
@@ -3,6 +3,6 @@ package domain
 // MessageRequestLogWithSource is a log row joined with API key metadata for portal lists.
 type MessageRequestLogWithSource struct {
 	MessageRequestLog
-	SourceName string `json:"source_name"`
-	ClientID   string `json:"client_id,omitempty"`
+	SourceName string
+	ClientID   string
 }
diff --git a/internal/core/domain/message_request_log.go b/internal/core/domain/message_request_log.go
index c156ba9f..d72ff69c 100644
--- a/internal/core/domain/message_request_log.go
+++ b/internal/core/domain/message_request_log.go
@@ -4,17 +4,19 @@ import "time"
 
 // MessageRequestLog records a gateway API call for monitoring.
 type MessageRequestLog struct {
-	ID           string `json:"id"`
-	WorkspaceID  string `json:"workspace_id"`
-	APIKeyID     string `json:"api_key_id,omitempty"`
-	ChannelType  string `json:"channel_type"`
-	HTTPMethod   string `json:"http_method"`
-	StatusCode   int    `json:"status_code"`
-	Endpoint     string `json:"endpoint"`
-	ProviderName string `json:"provider_name,omitempty"`
-	RequestID    string `json:"request_id,omitempty"`
-	DurationMs   int    `json:"duration_ms,omitempty"`
-	ErrorMessage string `json:"error_message,omitempty"`
+	ID           string
+	WorkspaceID  string
+	APIKeyID     string
+	ChannelType  string
+	HTTPMethod   string
+	StatusCode   int
+	Endpoint     string
+	ProviderName string
+	RequestID    string
+	DurationMs   int
+	ErrorMessage string
 
-	CreatedAt time.Time `json:"created_at"`
+	CreatedAt time.Time
+
+	Payload *MessageRequestPayload
 }
diff --git a/internal/core/domain/message_request_payload.go b/internal/core/domain/message_request_payload.go
new file mode 100644
index 00000000..91200ae8
--- /dev/null
+++ b/internal/core/domain/message_request_payload.go
@@ -0,0 +1,12 @@
+package domain
+
+import "time"
+
+// MessageRequestPayload stores the body of a message request separately
+// from the main metadata logs for optimization and privacy control.
+type MessageRequestPayload struct {
+	LogID        string
+	RequestBody  string
+	ResponseBody string
+	CreatedAt    time.Time
+}
diff --git a/internal/core/service/gateway_service.go b/internal/core/service/gateway_service.go
index 670ae56b..fca073ae 100644
--- a/internal/core/service/gateway_service.go
+++ b/internal/core/service/gateway_service.go
@@ -163,7 +163,7 @@ func (s *GatewayService) dispatch(
 	if config.RoutesViaProvider() {
 		intg, errLookup := s.requireProviderIntegration(ctx, workspaceID, channel)
 		if errLookup != nil {
-			return attachMeta(nil, effectiveMode, channel, integrationID, providerName), errLookup
+			return attachMeta(nil, effectiveMode, config.StoreMessageContent, channel, integrationID, providerName), errLookup
 		}
 
 		integrationID = intg.ID
@@ -173,7 +173,7 @@ func (s *GatewayService) dispatch(
 		provResult, err = sendViaProvider(providerCtx, *intg)
 		if err != nil {
 			slog.WarnContext(providerCtx, "provider dispatch failed", "error", err, "integration_id", integrationID)
-			return attachMeta(nil, effectiveMode, channel, integrationID, providerName), err
+			return attachMeta(nil, effectiveMode, config.StoreMessageContent, channel, integrationID, providerName), err
 		}
 		slog.InfoContext(providerCtx, "message dispatched via provider", "message_id", provResult.ID)
 	}
@@ -183,7 +183,7 @@ func (s *GatewayService) dispatch(
 		if err != nil {
 			slog.ErrorContext(ctx, "inbox write failed", "error", err, "dispatch_mode", effectiveMode, "store_content", config.StoreMessageContent)
 			if effectiveMode == domain.DispatchMemory {
-				return attachMeta(nil, effectiveMode, channel, integrationID, providerName), err
+				return attachMeta(nil, effectiveMode, config.StoreMessageContent, channel, integrationID, providerName), err
 			}
 			slog.WarnContext(ctx, "inbox capture failed after provider dispatch", "dispatch_mode", effectiveMode)
 		} else {
@@ -201,7 +201,7 @@ func (s *GatewayService) dispatch(
 		finalResult.Meta["inbox_message_id"] = inboxResult.ID
 	}
 
-	return attachMeta(finalResult, effectiveMode, channel, integrationID, providerName), nil
+	return attachMeta(finalResult, effectiveMode, config.StoreMessageContent, channel, integrationID, providerName), nil
 }
 
 // ResolveDispatchConfig reads the workspace setting for outbound dispatch behavior.
@@ -323,20 +323,21 @@ func (s *GatewayService) writeChatToInbox(ctx context.Context, workspaceID strin
 // attachMeta stamps standard dispatch metadata onto r. When r is nil (error paths
 // with no provider payload), it allocates a minimal SendResult so callers can
 // still read provider_name via contracts.ProviderNameFromResult.
-func attachMeta(r *contracts.SendResult, effectiveMode domain.MessageDispatchMode, channel, integrationID, providerName string) *contracts.SendResult {
+func attachMeta(r *contracts.SendResult, effectiveMode domain.MessageDispatchMode, storeContent bool, channel, integrationID, providerName string) *contracts.SendResult {
 	if r == nil {
 		r = &contracts.SendResult{}
 	}
 	if r.Meta == nil {
-		r.Meta = make(map[string]string, 4)
+		r.Meta = make(map[string]string, 5)
 	}
 	r.Meta["dispatch_mode"] = string(effectiveMode)
+	contracts.SetStoreContentMeta(r, storeContent)
 	r.Meta["channel"] = channel
 	if integrationID != "" {
 		r.Meta["integration_id"] = integrationID
 	}
 	if providerName != "" {
-		r.Meta["provider_name"] = providerName
+		r.Meta[contracts.MetaKeyProviderName] = providerName
 	}
 	return r
 }
diff --git a/internal/infrastructure/repository/postgres/message_request_log_repository.go b/internal/infrastructure/repository/postgres/message_request_log_repository.go
index 082cde33..84356981 100644
--- a/internal/infrastructure/repository/postgres/message_request_log_repository.go
+++ b/internal/infrastructure/repository/postgres/message_request_log_repository.go
@@ -46,14 +46,34 @@ func (r *MessageRequestLogRepository) Create(ctx context.Context, log *domain.Me
 	if log.ProviderName != "" {
 		provider = log.ProviderName
 	}
-	err := r.client.GetDB(ctx).QueryRowContext(ctx, query,
-		log.WorkspaceID, apiKeyID, log.ChannelType, log.HTTPMethod, log.StatusCode, log.Endpoint,
-		provider, reqID, dur, errMsg,
-	).Scan(&log.ID, &log.CreatedAt)
-	if err != nil {
-		slog.ErrorContext(ctx, "database error: failed to create message request log", "error", err, "endpoint", log.Endpoint)
-	}
-	return err
+	return r.client.RunInTransaction(ctx, func(ctx context.Context) error {
+		err := r.client.GetDB(ctx).QueryRowContext(ctx, query,
+			log.WorkspaceID, apiKeyID, log.ChannelType, log.HTTPMethod, log.StatusCode, log.Endpoint,
+			provider, reqID, dur, errMsg,
+		).Scan(&log.ID, &log.CreatedAt)
+		if err != nil {
+			slog.ErrorContext(ctx, "database error: failed to create message request log", "error", err, "endpoint", log.Endpoint)
+			return err
+		}
+
+		if log.Payload != nil {
+			log.Payload.LogID = log.ID
+			payloadQuery := `
+				INSERT INTO message_request_payloads (log_id, request_body, response_body)
+				VALUES ($1, $2, $3)
+				RETURNING created_at
+			`
+			err = r.client.GetDB(ctx).QueryRowContext(ctx, payloadQuery,
+				log.Payload.LogID, log.Payload.RequestBody, log.Payload.ResponseBody,
+			).Scan(&log.Payload.CreatedAt)
+			if err != nil {
+				slog.ErrorContext(ctx, "database error: failed to create message request payload", "error", err, "log_id", log.ID)
+				return err
+			}
+		}
+
+		return nil
+	})
 }
 
 func (r *MessageRequestLogRepository) ListWithSource(ctx context.Context, q port.MessageLogQuery) ([]domain.MessageRequestLogWithSource, int, error) {
diff --git a/internal/presentation/handler/portal_handler.go b/internal/presentation/handler/portal_handler.go
index 3d6b47cd..52b419fc 100644
--- a/internal/presentation/handler/portal_handler.go
+++ b/internal/presentation/handler/portal_handler.go
@@ -135,6 +135,42 @@ func (h *PortalHandler) RegenerateAPIKey(c echo.Context) error {
 	return c.JSON(http.StatusOK, map[string]string{"client_secret": secret})
 }
 
+type messageRequestLogDTO struct {
+	ID           string    `json:"id"`
+	WorkspaceID  string    `json:"workspace_id"`
+	APIKeyID     string    `json:"api_key_id,omitempty"`
+	ChannelType  string    `json:"channel_type"`
+	HTTPMethod   string    `json:"http_method"`
+	StatusCode   int       `json:"status_code"`
+	Endpoint     string    `json:"endpoint"`
+	ProviderName string    `json:"provider_name,omitempty"`
+	RequestID    string    `json:"request_id,omitempty"`
+	DurationMs   int       `json:"duration_ms,omitempty"`
+	ErrorMessage string    `json:"error_message,omitempty"`
+	CreatedAt    time.Time `json:"created_at"`
+	SourceName   string    `json:"source_name"`
+	ClientID     string    `json:"client_id,omitempty"`
+}
+
+func toMessageRequestLogDTO(l domain.MessageRequestLogWithSource) messageRequestLogDTO {
+	return messageRequestLogDTO{
+		ID:           l.ID,
+		WorkspaceID:  l.WorkspaceID,
+		APIKeyID:     l.APIKeyID,
+		ChannelType:  l.ChannelType,
+		HTTPMethod:   l.HTTPMethod,
+		StatusCode:   l.StatusCode,
+		Endpoint:     l.Endpoint,
+		ProviderName: l.ProviderName,
+		RequestID:    l.RequestID,
+		DurationMs:   l.DurationMs,
+		ErrorMessage: l.ErrorMessage,
+		CreatedAt:    l.CreatedAt,
+		SourceName:   l.SourceName,
+		ClientID:     l.ClientID,
+	}
+}
+
 func (h *PortalHandler) ListLogs(c echo.Context) error {
 	wid := c.Param("wid")
 	q := port.MessageLogQuery{WorkspaceID: wid}
@@ -156,7 +192,11 @@ func (h *PortalHandler) ListLogs(c echo.Context) error {
 		slog.ErrorContext(c.Request().Context(), "failed to list logs", "error", err)
 		return safeHTTPError(err, http.StatusInternalServerError, "failed to list logs")
 	}
-	return c.JSON(http.StatusOK, map[string]any{"items": rows, "total": total})
+	out := make([]messageRequestLogDTO, 0, len(rows))
+	for _, r := range rows {
+		out = append(out, toMessageRequestLogDTO(r))
+	}
+	return c.JSON(http.StatusOK, map[string]any{"items": out, "total": total})
 }
 
 func (h *PortalHandler) GetSettings(c echo.Context) error {
diff --git a/internal/presentation/handler/send_helper.go b/internal/presentation/handler/send_helper.go
index 3ebec185..88e44069 100644
--- a/internal/presentation/handler/send_helper.go
+++ b/internal/presentation/handler/send_helper.go
@@ -49,7 +49,7 @@ func (sh *SendHelper) DispatchAndLog(
 	if err := json.NewDecoder(c.Request().Body).Decode(dst); err != nil {
 		slog.WarnContext(ctx, "send rejected: invalid JSON body", "endpoint", endpoint, "error", err)
 		sh.recordLog(ctx, workspaceID, apiKeyID, channel, c.Request().Method,
-			http.StatusBadRequest, endpoint, start, "invalid JSON body", "")
+			http.StatusBadRequest, endpoint, start, "invalid JSON body", "", nil, nil)
 		return c.JSON(http.StatusBadRequest, map[string]string{"error": "invalid JSON body"})
 	}
 
@@ -64,13 +64,13 @@ func (sh *SendHelper) DispatchAndLog(
 	if err != nil {
 		slog.ErrorContext(ctx, "send failed", "error", err, "endpoint", endpoint, "duration_ms", time.Since(start).Milliseconds())
 		sh.recordLog(ctx, workspaceID, apiKeyID, channel, c.Request().Method,
-			http.StatusInternalServerError, endpoint, start, err.Error(), providerName)
+			http.StatusInternalServerError, endpoint, start, err.Error(), providerName, dst, result)
 		return c.JSON(http.StatusInternalServerError, map[string]string{"error": "send failed"})
 	}
 
 	slog.InfoContext(ctx, "send ok", "endpoint", endpoint, "duration_ms", time.Since(start).Milliseconds())
 	sh.recordLog(ctx, workspaceID, apiKeyID, channel, c.Request().Method,
-		http.StatusOK, endpoint, start, "", providerName)
+		http.StatusOK, endpoint, start, "", providerName, dst, result)
 	return c.JSON(http.StatusOK, result)
 }
 
@@ -81,6 +81,8 @@ func (sh *SendHelper) recordLog(
 	endpoint string,
 	start time.Time,
 	errMsg, providerName string,
+	reqBody any,
+	result *contracts.SendResult,
 ) {
 	if sh.svc == nil || workspaceID == "" {
 		return
@@ -97,6 +99,29 @@ func (sh *SendHelper) recordLog(
 		DurationMs:   int(time.Since(start).Milliseconds()),
 		ErrorMessage: errMsg,
 	}
+
+	if contracts.StoreContentFromResult(result) {
+		var requestBody, responseBody string
+		if reqBody != nil {
+			if b, err := json.Marshal(reqBody); err != nil {
+				slog.WarnContext(ctx, "failed to marshal request body for log payload", "error", err, "endpoint", endpoint)
+			} else {
+				requestBody = string(b)
+			}
+		}
+		if b, err := json.Marshal(result); err != nil {
+			slog.WarnContext(ctx, "failed to marshal response body for log payload", "error", err, "endpoint", endpoint)
+		} else {
+			responseBody = string(b)
+		}
+		if requestBody != "" || responseBody != "" {
+			entry.Payload = &domain.MessageRequestPayload{
+				RequestBody:  requestBody,
+				ResponseBody: responseBody,
+			}
+		}
+	}
+
 	if err := sh.svc.RecordLog(ctx, entry); err != nil {
 		slog.WarnContext(ctx, "failed to persist message request log", "error", err, "endpoint", endpoint)
 	}
diff --git a/internal/presentation/handler/send_helper_test.go b/internal/presentation/handler/send_helper_test.go
index 9be5911a..9bdfdb0c 100644
--- a/internal/presentation/handler/send_helper_test.go
+++ b/internal/presentation/handler/send_helper_test.go
@@ -88,6 +88,69 @@ func TestSendHelper_DispatchAndLog(t *testing.T) {
 		}
 	})
 
+	t.Run("store_content persists request and response payloads", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodPost, "/v1/email", strings.NewReader(`{"to":["test@example.com"],"subject":"hi"}`))
+		rec := httptest.NewRecorder()
+		c := e.NewContext(req, rec)
+
+		repo := &mockLogRepo{}
+		svc := service.NewGatewayService(nil, nil, nil, nil, repo)
+		helper := NewSendHelper(svc)
+
+		var dst contracts.Email
+		err := helper.DispatchAndLog(c, "email", "ws-123", "key-456", "/v1/email", &dst, func(ctx context.Context) (*contracts.SendResult, error) {
+			r := &contracts.SendResult{ID: "msg-111", StatusCode: 200, Message: "sent"}
+			contracts.SetStoreContentMeta(r, true)
+			r.Meta[contracts.MetaKeyProviderName] = "mailgun"
+			return r, nil
+		})
+
+		if err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+		if len(repo.entries) != 1 {
+			t.Fatalf("expected 1 log entry, got %d", len(repo.entries))
+		}
+
+		log := repo.entries[0]
+		if log.Payload == nil {
+			t.Fatal("expected payload on log entry")
+		}
+		if !strings.Contains(log.Payload.RequestBody, "test@example.com") {
+			t.Errorf("request body missing recipient: %q", log.Payload.RequestBody)
+		}
+		if !strings.Contains(log.Payload.ResponseBody, "msg-111") {
+			t.Errorf("response body missing message id: %q", log.Payload.ResponseBody)
+		}
+	})
+
+	t.Run("store_content off skips payload", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodPost, "/v1/email", strings.NewReader(`{"to":["test@example.com"]}`))
+		rec := httptest.NewRecorder()
+		c := e.NewContext(req, rec)
+
+		repo := &mockLogRepo{}
+		svc := service.NewGatewayService(nil, nil, nil, nil, repo)
+		helper := NewSendHelper(svc)
+
+		var dst contracts.Email
+		err := helper.DispatchAndLog(c, "email", "ws-123", "key-456", "/v1/email", &dst, func(ctx context.Context) (*contracts.SendResult, error) {
+			r := &contracts.SendResult{ID: "msg-111"}
+			contracts.SetStoreContentMeta(r, false)
+			return r, nil
+		})
+
+		if err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+		if len(repo.entries) != 1 {
+			t.Fatalf("expected 1 log entry, got %d", len(repo.entries))
+		}
+		if repo.entries[0].Payload != nil {
+			t.Fatalf("expected no payload when store_content is false, got %+v", repo.entries[0].Payload)
+		}
+	})
+
 	t.Run("missing workspace returns unauthorized", func(t *testing.T) {
 		req := httptest.NewRequest(http.MethodPost, "/v1/email", strings.NewReader(`{"to":["test@example.com"]}`))
 		rec := httptest.NewRecorder()
diff --git a/pkg/contracts/message.go b/pkg/contracts/message.go
index 56c6559d..c87aa708 100644
--- a/pkg/contracts/message.go
+++ b/pkg/contracts/message.go
@@ -8,6 +8,14 @@ type Attachment struct {
 	URL         string `json:"url,omitempty"`
 }
 
+const (
+	MetaKeyProviderName = "provider_name"
+	MetaKeyStoreContent = "store_content"
+
+	metaStoreContentTrue  = "true"
+	metaStoreContentFalse = "false"
+)
+
 // SendResult represents the result of sending a message.
 type SendResult struct {
 	ID         string            `json:"id"`
@@ -21,5 +29,25 @@ func ProviderNameFromResult(r *SendResult) string {
 	if r == nil || r.Meta == nil {
 		return ""
 	}
-	return r.Meta["provider_name"]
+	return r.Meta[MetaKeyProviderName]
+}
+
+// StoreContentFromResult reports whether dispatch metadata requests persisting request/response bodies.
+func StoreContentFromResult(r *SendResult) bool {
+	if r == nil || r.Meta == nil {
+		return false
+	}
+	return r.Meta[MetaKeyStoreContent] == metaStoreContentTrue
+}
+
+// SetStoreContentMeta stamps store_content on r.Meta for downstream logging.
+func SetStoreContentMeta(r *SendResult, storeContent bool) {
+	if r.Meta == nil {
+		r.Meta = make(map[string]string)
+	}
+	if storeContent {
+		r.Meta[MetaKeyStoreContent] = metaStoreContentTrue
+	} else {
+		r.Meta[MetaKeyStoreContent] = metaStoreContentFalse
+	}
 }
diff --git a/pkg/contracts/message_test.go b/pkg/contracts/message_test.go
new file mode 100644
index 00000000..70b158fa
--- /dev/null
+++ b/pkg/contracts/message_test.go
@@ -0,0 +1,53 @@
+package contracts
+
+import "testing"
+
+func TestStoreContentFromResult(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name string
+		r    *SendResult
+		want bool
+	}{
+		{"nil result", nil, false},
+		{"nil meta", &SendResult{ID: "1"}, false},
+		{"false", &SendResult{Meta: map[string]string{MetaKeyStoreContent: metaStoreContentFalse}}, false},
+		{"true", &SendResult{Meta: map[string]string{MetaKeyStoreContent: metaStoreContentTrue}}, true},
+		{"missing key", &SendResult{Meta: map[string]string{}}, false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			if got := StoreContentFromResult(tt.r); got != tt.want {
+				t.Fatalf("StoreContentFromResult() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestSetStoreContentMeta(t *testing.T) {
+	t.Parallel()
+
+	t.Run("true", func(t *testing.T) {
+		t.Parallel()
+		r := &SendResult{}
+		SetStoreContentMeta(r, true)
+		if r.Meta[MetaKeyStoreContent] != metaStoreContentTrue {
+			t.Fatalf("meta: %q", r.Meta[MetaKeyStoreContent])
+		}
+	})
+
+	t.Run("false", func(t *testing.T) {
+		t.Parallel()
+		r := &SendResult{Meta: map[string]string{"other": "x"}}
+		SetStoreContentMeta(r, false)
+		if r.Meta[MetaKeyStoreContent] != metaStoreContentFalse {
+			t.Fatalf("meta: %q", r.Meta[MetaKeyStoreContent])
+		}
+		if r.Meta["other"] != "x" {
+			t.Fatalf("unexpected meta overwrite")
+		}
+	})
+}

From 64659338d9762d7ca9173fc8b145c4cb0d738bc9 Mon Sep 17 00:00:00 2001
From: MichaelAndish <maikel1370@gmail.com>
Date: Fri, 3 Jul 2026 22:42:58 +0200
Subject: [PATCH 09/20] refactor: consolidate inbox API, optimize database
 indices, and implement centralized error handling for settings updates.

---
 .../20260318000000_init_gateway.up.sql        |   9 +
 .../components/email-list/email-list.tsx      |  28 +-
 .../inbox/hooks/use-inbox-key.hook.ts         | 121 ---------
 frontend/src/features/inbox/inbox.api.ts      |  83 ++++--
 frontend/src/features/inbox/inbox.types.ts    |   7 +-
 frontend/src/features/inbox/logs.schema.ts    |  33 +++
 .../features/inbox/pages/email-inbox.page.tsx | 166 +++++++++---
 .../features/inbox/pages/overview.page.tsx    |   8 +-
 .../settings/hooks/use-settings.hook.ts       |   1 +
 .../features/settings/pages/settings.page.tsx |  39 ++-
 .../src/features/settings/settings.api.ts     |  12 +-
 internal/app/wire.go                          |  11 +-
 internal/core/port/inbox.go                   |   8 +
 internal/core/port/portal.go                  |   1 +
 internal/core/service/portal_service.go       |  51 ++--
 .../infrastructure/authgate/gate_adapter.go   |  73 ++++-
 .../infrastructure/inbox/notifying_writer.go  |  66 +++++
 internal/infrastructure/inbox/store.go        | 256 ++++++++----------
 .../repository/postgres/api_key_repository.go |   6 +-
 .../message_request_log_repository.go         |  75 ++---
 .../postgres/workspace_member_repository.go   |   3 +-
 .../postgres/workspace_repository.go          |  33 ++-
 .../handler/portal_inbox_handler.go           |  17 +-
 internal/presentation/router.go               |  17 +-
 tests/bruno/Portal/Email/List Emails.bru      |  13 +-
 25 files changed, 698 insertions(+), 439 deletions(-)
 delete mode 100644 frontend/src/features/inbox/hooks/use-inbox-key.hook.ts
 create mode 100644 frontend/src/features/inbox/logs.schema.ts
 create mode 100644 internal/infrastructure/inbox/notifying_writer.go

diff --git a/database/migrations/20260318000000_init_gateway.up.sql b/database/migrations/20260318000000_init_gateway.up.sql
index 96dcf1d4..82cbd7f0 100644
--- a/database/migrations/20260318000000_init_gateway.up.sql
+++ b/database/migrations/20260318000000_init_gateway.up.sql
@@ -62,6 +62,9 @@ CREATE TRIGGER trg_workspaces_set_updated_at
     FOR EACH ROW EXECUTE FUNCTION set_updated_at();
 
 CREATE INDEX idx_workspaces_owner_id ON workspaces(owner_id);
+CREATE INDEX idx_workspaces_active_list
+    ON workspaces (status, is_private, name)
+    WHERE status = 'active';
 
 -- ==============================================================================
 -- 3. ROLES TABLE (RBAC)
@@ -217,6 +220,8 @@ CREATE UNIQUE INDEX idx_integrations_default_per_channel
 
 CREATE INDEX idx_integrations_provider_id ON integrations(provider_id);
 CREATE INDEX idx_integrations_workspace_channel ON integrations(workspace_id, channel_type);
+CREATE INDEX idx_integrations_workspace_channel_status
+    ON integrations (workspace_id, channel_type, status, is_default DESC, created_at DESC);
 
 CREATE TRIGGER trg_integrations_set_updated_at
     BEFORE UPDATE ON integrations
@@ -241,6 +246,7 @@ CREATE TABLE api_keys (
 );
 
 CREATE INDEX idx_api_keys_workspace_id ON api_keys(workspace_id);
+CREATE INDEX idx_api_keys_workspace_created ON api_keys (workspace_id, created_at DESC);
 
 -- ==============================================================================
 -- 11. MESSAGE_REQUEST_LOGS TABLE (Append-only)
@@ -272,6 +278,9 @@ CREATE INDEX idx_message_request_logs_workspace_api_created
     ON message_request_logs (workspace_id, api_key_id, created_at DESC)
     WHERE api_key_id IS NOT NULL;
 
+CREATE INDEX idx_message_request_logs_workspace_channel_created
+    ON message_request_logs (workspace_id, channel_type, created_at DESC);
+
 -- ==============================================================================
 -- 11.5. MESSAGE_REQUEST_PAYLOADS TABLE (Append-only body storage)
 -- ==============================================================================
diff --git a/frontend/src/features/inbox/components/email-list/email-list.tsx b/frontend/src/features/inbox/components/email-list/email-list.tsx
index ac3beef4..8baf8c38 100644
--- a/frontend/src/features/inbox/components/email-list/email-list.tsx
+++ b/frontend/src/features/inbox/components/email-list/email-list.tsx
@@ -1,5 +1,6 @@
 import { useState } from "react"
 import type { StoredEmail } from "../../inbox.types"
+import { Button } from "@/components/ui/button"
 import { SearchInput } from "@/components/ui/search-input"
 import { EmailItem } from "../email-item"
 
@@ -7,9 +8,19 @@ interface EmailListProps {
   messages: StoredEmail[]
   selectedMessageId: string | null
   onSelectMessage: (messageId: string) => void
+  hasMore?: boolean
+  isLoadingMore?: boolean
+  onLoadMore?: () => void
 }
 
-export function EmailList({ messages, selectedMessageId, onSelectMessage }: EmailListProps) {
+export function EmailList({
+  messages,
+  selectedMessageId,
+  onSelectMessage,
+  hasMore = false,
+  isLoadingMore = false,
+  onLoadMore,
+}: EmailListProps) {
   const [searchQuery, setSearchQuery] = useState("")
 
   const filtered = messages.filter((msg) => {
@@ -51,6 +62,21 @@ export function EmailList({ messages, selectedMessageId, onSelectMessage }: Emai
             {searchQuery ? "No messages match your search." : "Your inbox is empty."}
           </div>
         )}
+
+        {hasMore && !searchQuery && onLoadMore && (
+          <div className="p-3 border-t border-border">
+            <Button
+              type="button"
+              variant="outline"
+              size="sm"
+              className="w-full"
+              disabled={isLoadingMore}
+              onClick={onLoadMore}
+            >
+              {isLoadingMore ? "Loading..." : "Load more"}
+            </Button>
+          </div>
+        )}
       </div>
     </div>
   )
diff --git a/frontend/src/features/inbox/hooks/use-inbox-key.hook.ts b/frontend/src/features/inbox/hooks/use-inbox-key.hook.ts
deleted file mode 100644
index 24c5ffea..00000000
--- a/frontend/src/features/inbox/hooks/use-inbox-key.hook.ts
+++ /dev/null
@@ -1,121 +0,0 @@
-import { useEffect, useState } from "react"
-import { apiFetch } from "@/core/api/client"
-import type { InboxCredentials } from "../inbox.types"
-
-interface APIKeyItem {
-  id: string
-  workspace_id: string
-  client_id: string
-  name: string
-  is_active: boolean
-}
-
-export function useInboxKey(workspaceId: string | undefined) {
-  const [creds, setCreds] = useState<InboxCredentials | null>(null)
-  const [isLoading, setIsLoading] = useState(() => !!workspaceId)
-  const [error, setError] = useState<string | null>(null)
-
-  useEffect(() => {
-    let cancelled = false
-    if (!workspaceId) {
-      Promise.resolve().then(() => {
-        if (!cancelled) {
-          setCreds(null)
-          setIsLoading(false)
-          setError(null)
-        }
-      })
-      return
-    }
-
-    const cacheKey = `wpd_inbox_creds_${workspaceId}`
-
-    const bootstrap = async () => {
-      await Promise.resolve() // yield to avoid synchronous state update in effect
-      setIsLoading(true)
-      setError(null)
-
-      try {
-        // 1. Check local storage cache
-        const cached = localStorage.getItem(cacheKey)
-        if (cached) {
-          try {
-            const parsed = JSON.parse(cached) as InboxCredentials
-            if (parsed.clientId && parsed.clientSecret) {
-              if (!cancelled) {
-                setCreds(parsed)
-                setIsLoading(false)
-              }
-              return
-            }
-          } catch {
-            localStorage.removeItem(cacheKey)
-          }
-        }
-
-        // 2. Fetch keys list from backend
-        const listRes = await apiFetch(`/api/v1/workspaces/${workspaceId}/api-keys`)
-        if (!listRes.ok) {
-          throw new Error("Failed to retrieve workspace API keys")
-        }
-        const keys = (await listRes.json()) as APIKeyItem[]
-
-        const portalKey = keys.find((k) => k.name === "Portal UI" && k.is_active)
-
-        let finalCreds: InboxCredentials
-
-        if (portalKey) {
-          // Key exists but secret is hidden; regenerate to get new plaintext secret
-          const regenRes = await apiFetch(
-            `/api/v1/workspaces/${workspaceId}/api-keys/${portalKey.id}/regenerate`,
-            { method: "POST" }
-          )
-          if (!regenRes.ok) {
-            throw new Error("Failed to regenerate Portal UI API credentials")
-          }
-          const data = (await regenRes.json()) as { client_secret: string }
-          finalCreds = {
-            clientId: portalKey.client_id,
-            clientSecret: data.client_secret,
-          }
-        } else {
-          // No Portal UI key exists; create one
-          const createRes = await apiFetch(`/api/v1/workspaces/${workspaceId}/api-keys`, {
-            method: "POST",
-            body: JSON.stringify({ name: "Portal UI" }),
-          })
-          if (!createRes.ok) {
-            throw new Error("Failed to auto-provision Portal UI API credentials")
-          }
-          const data = (await createRes.json()) as { client_id: string; client_secret: string }
-          finalCreds = {
-            clientId: data.client_id,
-            clientSecret: data.client_secret,
-          }
-        }
-
-        // 3. Cache and update state
-        localStorage.setItem(cacheKey, JSON.stringify(finalCreds))
-        if (!cancelled) {
-          setCreds(finalCreds)
-        }
-      } catch (err) {
-        if (!cancelled) {
-          setError(err instanceof Error ? err.message : "Authentication error")
-        }
-      } finally {
-        if (!cancelled) {
-          setIsLoading(false)
-        }
-      }
-    }
-
-    void bootstrap()
-
-    return () => {
-      cancelled = true
-    }
-  }, [workspaceId])
-
-  return { creds, isLoading, error }
-}
diff --git a/frontend/src/features/inbox/inbox.api.ts b/frontend/src/features/inbox/inbox.api.ts
index d2d8942c..4e82c5f2 100644
--- a/frontend/src/features/inbox/inbox.api.ts
+++ b/frontend/src/features/inbox/inbox.api.ts
@@ -1,12 +1,6 @@
 import { apiFetch, getToken } from "@/core/api/client"
-import type { EmailTemplate, InboxCredentials, LogRow, StoredEmail } from "./inbox.types"
-
-function inboxAuthHeaders(creds: InboxCredentials): HeadersInit {
-  return {
-    "X-Api-Client-Id": creds.clientId,
-    "X-Api-Client-Secret": creds.clientSecret,
-  }
-}
+import type { EmailTemplate, InboxEmailPage, LogRow, StoredEmail } from "./inbox.types"
+import { parseLogsResponse } from "./logs.schema"
 
 export async function fetchLogs(
   workspaceId: string,
@@ -29,8 +23,8 @@ export async function fetchLogs(
       const err = (await res.json().catch(() => ({}))) as { message?: string }
       return { ok: false, message: err.message ?? "Failed to fetch logs" }
     }
-    const data = (await res.json()) as { items: LogRow[]; total: number }
-    return { ok: true, items: data.items || [], total: data.total || 0 }
+    const data = parseLogsResponse(await res.json())
+    return { ok: true, items: data.items, total: data.total }
   } catch (err) {
     return { ok: false, message: err instanceof Error ? err.message : "Failed to fetch logs" }
   }
@@ -57,36 +51,70 @@ export async function sendTestRequest(
   }
 }
 
+async function parseApiError(res: Response, fallback: string): Promise<string> {
+  try {
+    const err = (await res.json()) as { message?: string; error?: string }
+    return err.message ?? err.error ?? fallback
+  } catch {
+    return fallback
+  }
+}
+
 export async function fetchInboxEmails(
   workspaceId: string,
-  creds: InboxCredentials
-): Promise<{ ok: true; items: StoredEmail[] } | { ok: false; message?: string }> {
+  params: { limit?: number; cursor?: string } = {}
+): Promise<{ ok: true; page: InboxEmailPage } | { ok: false; message?: string }> {
   try {
-    const res = await apiFetch(`/api/v1/workspaces/${workspaceId}/inbox/emails`, {
-      headers: inboxAuthHeaders(creds),
-    })
+    const query = new URLSearchParams()
+    if (params.limit !== undefined) {
+      query.set("limit", String(params.limit))
+    }
+    if (params.cursor) {
+      query.set("cursor", params.cursor)
+    }
+    const qs = query.toString()
+    const path = `/api/v1/workspaces/${workspaceId}/inbox/emails${qs ? `?${qs}` : ""}`
+    const res = await apiFetch(path)
     if (!res.ok) {
-      return { ok: false, message: "Failed to fetch email inbox messages" }
+      return { ok: false, message: await parseApiError(res, "Failed to fetch email inbox messages") }
     }
-    const data = (await res.json()) as StoredEmail[]
-    const sorted = [...data].sort(
-      (a, b) => new Date(b.created_at).getTime() - new Date(a.created_at).getTime()
-    )
-    return { ok: true, items: sorted }
+    const raw = await res.json()
+    const page: InboxEmailPage = Array.isArray(raw)
+      ? { items: raw, has_more: false }
+      : {
+          items: raw.items ?? [],
+          next_cursor: raw.next_cursor,
+          has_more: raw.has_more ?? false,
+        }
+    return { ok: true, page }
   } catch (err) {
     return { ok: false, message: err instanceof Error ? err.message : "Failed to load emails" }
   }
 }
 
+export async function fetchInboxEmailById(
+  workspaceId: string,
+  messageId: string
+): Promise<{ ok: true; item: StoredEmail } | { ok: false; message?: string }> {
+  try {
+    const res = await apiFetch(`/api/v1/workspaces/${workspaceId}/inbox/emails/${messageId}`)
+    if (!res.ok) {
+      return { ok: false, message: "Failed to fetch email" }
+    }
+    const item = (await res.json()) as StoredEmail
+    return { ok: true, item }
+  } catch (err) {
+    return { ok: false, message: err instanceof Error ? err.message : "Failed to fetch email" }
+  }
+}
+
 export async function deleteInboxEmail(
   workspaceId: string,
-  messageId: string,
-  creds: InboxCredentials
+  messageId: string
 ): Promise<{ ok: true } | { ok: false; message?: string }> {
   try {
     const res = await apiFetch(`/api/v1/workspaces/${workspaceId}/inbox/emails/${messageId}`, {
       method: "DELETE",
-      headers: inboxAuthHeaders(creds),
     })
     if (!res.ok) {
       return { ok: false, message: "Failed to delete email message" }
@@ -97,15 +125,10 @@ export async function deleteInboxEmail(
   }
 }
 
-export function buildInboxEventsUrl(
-  workspaceId: string,
-  creds: InboxCredentials
-): string {
+export function buildInboxEventsUrl(workspaceId: string): string {
   const token = getToken()
   const params = new URLSearchParams({
     access_token: token ?? "",
-    client_id: creds.clientId,
-    client_secret: creds.clientSecret,
   })
   return `/api/v1/workspaces/${workspaceId}/inbox/events?${params.toString()}`
 }
diff --git a/frontend/src/features/inbox/inbox.types.ts b/frontend/src/features/inbox/inbox.types.ts
index 215e3810..54453171 100644
--- a/frontend/src/features/inbox/inbox.types.ts
+++ b/frontend/src/features/inbox/inbox.types.ts
@@ -35,9 +35,10 @@ export interface StoredEmail {
   }
 }
 
-export type InboxCredentials = {
-  clientId: string
-  clientSecret: string
+export type InboxEmailPage = {
+  items: StoredEmail[]
+  next_cursor?: string
+  has_more: boolean
 }
 
 export type EmailTemplate = {
diff --git a/frontend/src/features/inbox/logs.schema.ts b/frontend/src/features/inbox/logs.schema.ts
new file mode 100644
index 00000000..5ea1f80b
--- /dev/null
+++ b/frontend/src/features/inbox/logs.schema.ts
@@ -0,0 +1,33 @@
+import { z } from "zod"
+
+import type { LogRow } from "./inbox.types"
+
+const logRowSchema = z.object({
+  id: z.string(),
+  workspace_id: z.string(),
+  api_key_id: z.string().optional(),
+  channel_type: z.string(),
+  http_method: z.string(),
+  status_code: z.number(),
+  endpoint: z.string(),
+  provider_name: z.string().optional(),
+  request_id: z.string().optional(),
+  duration_ms: z.number().optional(),
+  error_message: z.string().optional(),
+  created_at: z.string(),
+  source_name: z.string().optional(),
+  client_id: z.string().optional(),
+})
+
+const logsResponseSchema = z.object({
+  items: z.array(logRowSchema),
+  total: z.number(),
+})
+
+export function parseLogsResponse(raw: unknown): { items: LogRow[]; total: number } {
+  const parsed = logsResponseSchema.safeParse(raw)
+  if (!parsed.success) {
+    throw new Error("Invalid logs response from server")
+  }
+  return parsed.data
+}
diff --git a/frontend/src/features/inbox/pages/email-inbox.page.tsx b/frontend/src/features/inbox/pages/email-inbox.page.tsx
index b5a9a4f1..6b7870bc 100644
--- a/frontend/src/features/inbox/pages/email-inbox.page.tsx
+++ b/frontend/src/features/inbox/pages/email-inbox.page.tsx
@@ -5,67 +5,155 @@ import { Button } from "@/components/ui/button"
 import { Icon } from "@/components/ui/icon"
 import { Spinner } from "@/components/ui/spinner"
 import { ROUTES } from "@/core/router/routes"
-import { buildInboxEventsUrl, deleteInboxEmail, fetchInboxEmails } from "../inbox.api"
-import { useInboxKey } from "../hooks/use-inbox-key.hook"
+import {
+  buildInboxEventsUrl,
+  deleteInboxEmail,
+  fetchInboxEmailById,
+  fetchInboxEmails,
+} from "../inbox.api"
 import { EmailList } from "../components/email-list"
 import { EmailContent } from "../components/email-content"
 import type { StoredEmail } from "../inbox.types"
 
+const PAGE_SIZE = 50
+
 export function EmailInboxPage() {
   const navigate = useNavigate()
   const { wid } = useParams<{ wid: string }>()
-  const { creds, isLoading: credsLoading, error: credsError } = useInboxKey(wid)
 
   const [messages, setMessages] = useState<StoredEmail[]>([])
   const [selectedMessageId, setSelectedMessageId] = useState<string | null>(null)
   const [isLoading, setIsLoading] = useState(true)
+  const [isLoadingMore, setIsLoadingMore] = useState(false)
   const [isDeleting, setIsDeleting] = useState(false)
   const [error, setError] = useState<string | null>(null)
+  const [nextCursor, setNextCursor] = useState<string | undefined>()
+  const [hasMore, setHasMore] = useState(false)
 
   const fetchEmails = useCallback(async () => {
-    if (!wid || !creds) return
-    await Promise.resolve()
+    if (!wid) return
     setError(null)
+    setIsLoading(true)
 
-    const result = await fetchInboxEmails(wid, creds)
+    const result = await fetchInboxEmails(wid, { limit: PAGE_SIZE })
     if (!result.ok) {
       setError(result.message ?? "Failed to load emails")
       setIsLoading(false)
       return
     }
 
-    setMessages(result.items)
-    if (result.items.length > 0) {
-      setSelectedMessageId((prev) => prev ?? result.items[0].id)
+    setMessages(result.page.items ?? [])
+    setNextCursor(result.page.next_cursor)
+    setHasMore(result.page.has_more)
+    if ((result.page.items ?? []).length > 0) {
+      setSelectedMessageId((prev) => prev ?? (result.page.items ?? [])[0].id)
     }
     setIsLoading(false)
-  }, [wid, creds])
+  }, [wid])
+
+  const loadMoreEmails = useCallback(async () => {
+    if (!wid || !nextCursor || isLoadingMore) return
+    setIsLoadingMore(true)
+
+    const result = await fetchInboxEmails(wid, { limit: PAGE_SIZE, cursor: nextCursor })
+    if (!result.ok) {
+      setError(result.message ?? "Failed to load more emails")
+      setIsLoadingMore(false)
+      return
+    }
+
+    setMessages((prev) => [...(prev ?? []), ...(result.page.items ?? [])])
+    setNextCursor(result.page.next_cursor)
+    setHasMore(result.page.has_more)
+    setIsLoadingMore(false)
+  }, [wid, nextCursor, isLoadingMore])
 
   useEffect(() => {
-    if (creds) {
-      Promise.resolve().then(() => {
-        void fetchEmails()
-      })
+    let cancelled = false
+    ;(async () => {
+      if (!wid) {
+        setIsLoading(false)
+        return
+      }
+      setError(null)
+      setIsLoading(true)
+
+      const result = await fetchInboxEmails(wid, { limit: PAGE_SIZE })
+      if (cancelled) return
+
+      if (!result.ok) {
+        setError(result.message ?? "Failed to load emails")
+        setIsLoading(false)
+        return
+      }
+
+      setMessages(result.page.items ?? [])
+      setNextCursor(result.page.next_cursor)
+      setHasMore(result.page.has_more)
+      if ((result.page.items ?? []).length > 0) {
+        setSelectedMessageId((prev) => prev ?? (result.page.items ?? [])[0].id)
+      }
+      setIsLoading(false)
+    })()
+
+    return () => {
+      cancelled = true
     }
-  }, [creds, fetchEmails])
+  }, [wid])
 
   useEffect(() => {
-    if (!wid || !creds) return
+    if (!wid) return
 
-    const sseUrl = buildInboxEventsUrl(wid, creds)
+    const sseUrl = buildInboxEventsUrl(wid)
     let eventSource: EventSource | null = null
     try {
       eventSource = new EventSource(sseUrl)
 
       eventSource.onmessage = (event) => {
         try {
-          const parsed = JSON.parse(event.data) as { type: string }
-          if (
-            parsed.type === "email_received" ||
-            parsed.type === "email_deleted" ||
-            parsed.type === "messages_cleared"
-          ) {
-            void fetchEmails()
+          const parsed = JSON.parse(event.data) as {
+            type: string
+            data?: { id?: string } | string | null
+          }
+
+          if (parsed.type === "email_received") {
+            const id =
+              typeof parsed.data === "object" && parsed.data !== null
+                ? parsed.data.id
+                : undefined
+            if (!id) return
+            void fetchInboxEmailById(wid, id).then((result) => {
+              if (!result.ok) return
+              setMessages((prev) => {
+                if (prev.some((m) => m.id === result.item.id)) return prev
+                return [result.item, ...prev]
+              })
+              setSelectedMessageId((current) => current ?? id)
+            })
+            return
+          }
+
+          if (parsed.type === "email_deleted") {
+            const id = typeof parsed.data === "string" ? parsed.data : undefined
+            if (!id) return
+            setMessages((prev) => {
+              const remaining = prev.filter((m) => m.id !== id)
+              setSelectedMessageId((current) => {
+                if (current === id) {
+                  return remaining.length > 0 ? remaining[0].id : null
+                }
+                return current
+              })
+              return remaining
+            })
+            return
+          }
+
+          if (parsed.type === "messages_cleared") {
+            setMessages([])
+            setSelectedMessageId(null)
+            setNextCursor(undefined)
+            setHasMore(false)
           }
         } catch (err) {
           console.error("Failed to parse SSE event data:", err)
@@ -78,12 +166,12 @@ export function EmailInboxPage() {
     return () => {
       eventSource?.close()
     }
-  }, [wid, creds, fetchEmails])
+  }, [wid])
 
   const handleDeleteMessage = async (messageId: string) => {
-    if (!wid || !creds) return
+    if (!wid) return
     setIsDeleting(true)
-    const result = await deleteInboxEmail(wid, messageId, creds)
+    const result = await deleteInboxEmail(wid, messageId)
     if (!result.ok) {
       alert(result.message ?? "Failed to delete email")
       setIsDeleting(false)
@@ -109,8 +197,7 @@ export function EmailInboxPage() {
     }
   }
 
-  const activeMessage = messages.find((m) => m.id === selectedMessageId) || null
-  const isBootstrapLoading = credsLoading || (isLoading && !!creds)
+  const activeMessage = (messages ?? []).find((m) => m.id === selectedMessageId) ?? null
 
   return (
     <div className="flex flex-col gap-6 w-full h-[calc(100vh-160px)] min-h-[500px]">
@@ -125,8 +212,8 @@ export function EmailInboxPage() {
         </div>
 
         <div className="flex items-center gap-2.5 shrink-0">
-          <Button type="button" variant="outline" size="sm" onClick={() => void fetchEmails()} disabled={isBootstrapLoading} className="h-10">
-            <Icon name="refresh" size="sm" data-icon="inline-start" className={isBootstrapLoading ? "animate-spin" : undefined} />
+          <Button type="button" variant="outline" size="sm" onClick={() => void fetchEmails()} disabled={isLoading} className="h-10">
+            <Icon name="refresh" size="sm" data-icon="inline-start" className={isLoading ? "animate-spin" : undefined} />
             Refresh
           </Button>
           <Button type="button" size="sm" onClick={handleManageTemplates} className="h-10">
@@ -136,37 +223,40 @@ export function EmailInboxPage() {
         </div>
       </div>
 
-      {credsError || error ? (
+      {error ? (
         <div className="flex-1 bg-card border border-border rounded-2xl flex flex-col items-center justify-center p-6 text-center">
           <span className="text-sm font-semibold text-foreground">Could not connect to Simulated Inbox</span>
           <p className="text-xs text-text-secondary max-w-sm mt-1 mb-4">
-            {credsError || error}
+            {error}
           </p>
           <Button variant="outline" size="sm" onClick={() => void fetchEmails()}>
             Try again
           </Button>
         </div>
-      ) : isBootstrapLoading ? (
+      ) : isLoading ? (
         <div className="flex-1 bg-card border border-border rounded-2xl flex flex-col items-center justify-center gap-3">
           <Spinner size="lg" />
-          <span className="text-sm text-text-secondary">Connecting to secure simulated inbox...</span>
+          <span className="text-sm text-text-secondary">Loading simulated inbox...</span>
         </div>
-      ) : messages.length === 0 ? (
+      ) : (messages ?? []).length === 0 ? (
         <div className="flex-1 bg-card border border-border rounded-2xl flex flex-col items-center justify-center p-8 text-center">
           <div className="mb-4 flex size-16 items-center justify-center rounded-full border border-border bg-muted/40 text-text-tertiary">
             <Icon name="mail" size="lg" />
           </div>
           <h3 className="mb-1 text-lg font-bold text-foreground">Inbox is empty</h3>
           <p className="max-w-xs text-sm text-text-secondary">
-            Send an email to `/v1/email` using this workspace API key to see it captured here in real-time.
+            Send a test email or POST to `/v1/email` to see messages captured here in real-time.
           </p>
         </div>
       ) : (
         <div className="flex-1 bg-card border border-border rounded-2xl overflow-hidden flex flex-col md:flex-row shadow-sm min-h-0">
           <EmailList
-            messages={messages}
+            messages={messages ?? []}
             selectedMessageId={selectedMessageId}
             onSelectMessage={setSelectedMessageId}
+            hasMore={hasMore}
+            isLoadingMore={isLoadingMore}
+            onLoadMore={() => void loadMoreEmails()}
           />
           {activeMessage ? (
             <EmailContent
diff --git a/frontend/src/features/inbox/pages/overview.page.tsx b/frontend/src/features/inbox/pages/overview.page.tsx
index c71508e8..015124a2 100644
--- a/frontend/src/features/inbox/pages/overview.page.tsx
+++ b/frontend/src/features/inbox/pages/overview.page.tsx
@@ -88,10 +88,10 @@ export function OverviewPage({ channel }: OverviewPageProps) {
   const filteredLogs = logs.filter((log) => {
     const q = searchQuery.toLowerCase()
     return (
-      log.endpoint.toLowerCase().includes(q) ||
-      log.http_method.toLowerCase().includes(q) ||
-      String(log.status_code).includes(q) ||
-      (log.source_name && log.source_name.toLowerCase().includes(q))
+      (log.endpoint ?? "").toLowerCase().includes(q) ||
+      (log.http_method ?? "").toLowerCase().includes(q) ||
+      String(log.status_code ?? "").includes(q) ||
+      (log.source_name ?? "").toLowerCase().includes(q)
     )
   })
 
diff --git a/frontend/src/features/settings/hooks/use-settings.hook.ts b/frontend/src/features/settings/hooks/use-settings.hook.ts
index 137140c5..b9db1670 100644
--- a/frontend/src/features/settings/hooks/use-settings.hook.ts
+++ b/frontend/src/features/settings/hooks/use-settings.hook.ts
@@ -51,6 +51,7 @@ export function useSettings(workspaceId: string) {
   async function saveSettings(patch: WorkspaceSettingsPatch) {
     await patchSettings(workspaceId, patch)
     setSettings((prev) => parseWorkspaceSettings({ ...prev, ...patch }))
+    setError(null)
   }
 
   async function addApiKey(name: string) {
diff --git a/frontend/src/features/settings/pages/settings.page.tsx b/frontend/src/features/settings/pages/settings.page.tsx
index 17fde658..03427c36 100644
--- a/frontend/src/features/settings/pages/settings.page.tsx
+++ b/frontend/src/features/settings/pages/settings.page.tsx
@@ -97,22 +97,41 @@ function DispatchSettingsPanel({ initialConfig, onSave }: DispatchSettingsPanelP
   const [mode, setMode] = useState<MessageDispatchMode>(initialConfig.mode)
   const [storeMessageContent, setStoreMessageContent] = useState(initialConfig.storeMessageContent)
   const [isSaving, setIsSaving] = useState(false)
+  const [saveError, setSaveError] = useState<string | null>(null)
+  const [saveSuccess, setSaveSuccess] = useState(false)
 
   const currentConfig: MessageDispatchConfig = { mode, storeMessageContent }
   const isDirty = !dispatchConfigsEqual(currentConfig, initialConfig)
 
   async function handleSave() {
     setIsSaving(true)
+    setSaveError(null)
+    setSaveSuccess(false)
     try {
       await onSave({
         message_dispatch_mode: mode,
         store_message_content: toStoreMessageContentSetting(storeMessageContent),
       })
+      setSaveSuccess(true)
+    } catch (err) {
+      setSaveError(err instanceof Error ? err.message : "Failed to save settings")
     } finally {
       setIsSaving(false)
     }
   }
 
+  function handleModeChange(nextMode: MessageDispatchMode) {
+    setMode(nextMode)
+    setSaveError(null)
+    setSaveSuccess(false)
+  }
+
+  function handleStoreContentChange(checked: boolean) {
+    setStoreMessageContent(checked)
+    setSaveError(null)
+    setSaveSuccess(false)
+  }
+
   return (
     <div className="flex max-w-xl flex-col gap-6">
       <div className="flex flex-col gap-2">
@@ -125,7 +144,7 @@ function DispatchSettingsPanel({ initialConfig, onSave }: DispatchSettingsPanelP
             label="Memory"
             description="Capture messages in memory for development and testing."
             checked={mode === "memory"}
-            onChange={() => setMode("memory")}
+            onChange={() => handleModeChange("memory")}
           />
           <RadioOption
             id="dispatch-provider"
@@ -133,7 +152,7 @@ function DispatchSettingsPanel({ initialConfig, onSave }: DispatchSettingsPanelP
             label="Provider"
             description="Send messages through the connected channel integration."
             checked={mode === "provider"}
-            onChange={() => setMode("provider")}
+            onChange={() => handleModeChange("provider")}
           />
         </div>
       </div>
@@ -148,10 +167,22 @@ function DispatchSettingsPanel({ initialConfig, onSave }: DispatchSettingsPanelP
         <Checkbox
           id="store-message-content"
           checked={storeMessageContent}
-          onCheckedChange={(checked) => setStoreMessageContent(checked === true)}
+          onCheckedChange={(checked) => handleStoreContentChange(checked === true)}
         />
       </div>
 
+      {saveError ? (
+        <p className="rounded-lg border border-destructive/20 bg-destructive/10 p-3 text-sm text-destructive">
+          {saveError}
+        </p>
+      ) : null}
+
+      {saveSuccess ? (
+        <p className="rounded-lg border border-primary-brand/20 bg-primary-brand/5 p-3 text-sm text-primary-brand">
+          Dispatch settings saved.
+        </p>
+      ) : null}
+
       <Button type="button" onClick={handleSave} disabled={isSaving || !isDirty} className="w-fit">
         {isSaving ? "Saving…" : "Save dispatch settings"}
       </Button>
@@ -295,7 +326,7 @@ export function SettingsPage() {
 
         <Tabs.Content value="dispatch">
           <DispatchSettingsPanel
-            key={`${wid}-${messageDispatchConfig.mode}-${messageDispatchConfig.storeMessageContent}`}
+            key={wid}
             initialConfig={messageDispatchConfig}
             onSave={saveSettings}
           />
diff --git a/frontend/src/features/settings/settings.api.ts b/frontend/src/features/settings/settings.api.ts
index 79b003bb..2c06eeeb 100644
--- a/frontend/src/features/settings/settings.api.ts
+++ b/frontend/src/features/settings/settings.api.ts
@@ -3,6 +3,16 @@ import { apiFetch } from "@/core/api/client"
 import { parseWorkspaceSettings } from "./settings.schema"
 import type { ApiKey, WorkspaceSettings, WorkspaceSettingsPatch } from "./settings.types"
 
+async function readApiErrorMessage(res: Response, fallback: string): Promise<string> {
+  try {
+    const body = (await res.json()) as { message?: string }
+    const message = body.message?.trim()
+    return message || fallback
+  } catch {
+    return fallback
+  }
+}
+
 export async function getSettings(workspaceId: string): Promise<WorkspaceSettings> {
   const res = await apiFetch(`/api/v1/workspaces/${workspaceId}/settings`)
   if (!res.ok) {
@@ -18,7 +28,7 @@ export async function patchSettings(workspaceId: string, body: WorkspaceSettings
     body: JSON.stringify(body),
   })
   if (!res.ok) {
-    throw new Error("Failed to save settings")
+    throw new Error(await readApiErrorMessage(res, "Failed to save settings"))
   }
 }
 
diff --git a/internal/app/wire.go b/internal/app/wire.go
index f76403c2..8628b1a5 100644
--- a/internal/app/wire.go
+++ b/internal/app/wire.go
@@ -66,7 +66,7 @@ func Wire(cfg *Config, sysLogger *pkglogger.Logger) (*Application, error) {
 	if err := gateEngine.LoadPolicy(startCtx); err != nil {
 		return nil, fmt.Errorf("load RBAC policies: %w", err)
 	}
-	authGate := authgate.NewGoGateAdapter(gateEngine)
+	authGate := authgate.NewGoGateAdapter(gateEngine, pgClient.GetDB(startCtx))
 
 	// ── Encryption service ──────────────────────────────────────────────────
 	encKey := cfg.EncryptionKey
@@ -125,6 +125,12 @@ func Wire(cfg *Config, sysLogger *pkglogger.Logger) (*Application, error) {
 	inboxStore := inbox.NewStore()
 	memoryStore := memory.GetStore()
 
+	var portalInboxHandler *handler.PortalInboxHandler
+	inboxWriter := inbox.NewNotifyingWriter(inboxStore, inbox.PublishFunc(func(workspaceID, eventType string, data any) {
+		portalInboxHandler.PublishInboxEvent(workspaceID, eventType, data)
+	}))
+	portalInboxHandler = handler.NewPortalInboxHandler(inboxStore, inboxWriter)
+
 	// ── Auth service ──────────────────────────────────────────────────────
 	authService := service.NewAuthService(
 		userRepo,
@@ -137,7 +143,7 @@ func Wire(cfg *Config, sysLogger *pkglogger.Logger) (*Application, error) {
 	)
 
 	// ── Gateway service ─────────────────────────────────────────────────────
-	gatewaySvc := service.NewGatewayService(intgRepo, tmplRepo, settingsRepo, inboxStore, logRepo)
+	gatewaySvc := service.NewGatewayService(intgRepo, tmplRepo, settingsRepo, inboxWriter, logRepo)
 
 	// ── Handlers ─────────────────────────────────────────────────────────────
 	// Portal is always enabled — configuration, templates, and inbox require it.
@@ -146,7 +152,6 @@ func Wire(cfg *Config, sysLogger *pkglogger.Logger) (*Application, error) {
 	portalWorkspaceHandler := handler.NewPortalWorkspaceHandler(portalSvc)
 	portalIntegrationHandler := handler.NewPortalIntegrationHandler(portalSvc)
 	portalTemplateHandler := handler.NewPortalTemplateHandler(portalSvc)
-	portalInboxHandler := handler.NewPortalInboxHandler(inboxStore, inboxStore)
 	gatewayHandler := handler.NewGatewayHandler(gatewaySvc)
 
 	// ── Router ──────────────────────────────────────────────────────────────
diff --git a/internal/core/port/inbox.go b/internal/core/port/inbox.go
index 7b67f829..000191a3 100644
--- a/internal/core/port/inbox.go
+++ b/internal/core/port/inbox.go
@@ -39,10 +39,18 @@ type StoredChat struct {
 	Chat        contracts.ChatMessage `json:"chat"`
 }
 
+// InboxEmailPage is a paginated slice of captured emails (newest first).
+type InboxEmailPage struct {
+	Items      []StoredEmail `json:"items"`
+	NextCursor string        `json:"next_cursor,omitempty"`
+	HasMore    bool          `json:"has_more"`
+}
+
 // InboxReader is the read side of the in-process message capture store.
 type InboxReader interface {
 	StatsForWorkspace(workspaceID string) map[string]int
 	EmailsForWorkspace(workspaceID string) []StoredEmail
+	ListEmailsForWorkspace(workspaceID string, limit int, cursor string) InboxEmailPage
 	EmailByIDForWorkspace(id, workspaceID string) (StoredEmail, bool)
 	DeleteEmailByIDForWorkspace(id, workspaceID string) bool
 	SMSForWorkspace(workspaceID string) []StoredSMS
diff --git a/internal/core/port/portal.go b/internal/core/port/portal.go
index bce329c9..afee1645 100644
--- a/internal/core/port/portal.go
+++ b/internal/core/port/portal.go
@@ -44,4 +44,5 @@ type AuthorizationGate interface {
 	RemoveRole(ctx context.Context, modelType, modelID, teamID, roleName string) error
 	GetRoleNames(ctx context.Context, modelType, modelID, teamID string) ([]string, error)
 	GetAllPermissions(ctx context.Context, modelType, modelID, teamID string) ([]string, error)
+	GetPermissionsForTeams(ctx context.Context, modelType, modelID string, teamIDs []string) (map[string][]string, error)
 }
diff --git a/internal/core/service/portal_service.go b/internal/core/service/portal_service.go
index e7584701..e1f52b1c 100644
--- a/internal/core/service/portal_service.go
+++ b/internal/core/service/portal_service.go
@@ -208,32 +208,39 @@ func (s *PortalService) ListWorkspaces(ctx context.Context, userID string) ([]do
 		return nil, err
 	}
 
+	memberWorkspaceIDs := make([]string, 0, len(workspaces))
 	for i := range workspaces {
 		w := &workspaces[i]
-		// Get role in this workspace
-		role, err := s.members.GetRole(ctx, w.ID, userID)
-		if err != nil {
-			// If not a member, check if it's public
-			if w.Visibility == "public" {
-				w.Role = "viewer"
-				w.Permissions = []string{
-					domain.PermissionWorkspacesRead,
-					domain.PermissionMembersRead,
-					domain.PermissionAPIKeysRead,
-					domain.PermissionLogsRead,
-					domain.PermissionIntegrationsRead,
-					domain.PermissionTemplatesRead,
-					domain.PermissionSettingsRead,
-					domain.PermissionInvitationsRead,
-				}
-			}
+		if w.Role != "" {
+			memberWorkspaceIDs = append(memberWorkspaceIDs, w.ID)
 			continue
 		}
+		if w.Visibility == "public" {
+			w.Role = "viewer"
+			w.Permissions = []string{
+				domain.PermissionWorkspacesRead,
+				domain.PermissionMembersRead,
+				domain.PermissionAPIKeysRead,
+				domain.PermissionLogsRead,
+				domain.PermissionIntegrationsRead,
+				domain.PermissionTemplatesRead,
+				domain.PermissionSettingsRead,
+				domain.PermissionInvitationsRead,
+			}
+		}
+	}
+
+	permsByTeam, err := s.gate.GetPermissionsForTeams(ctx, "users", userID, memberWorkspaceIDs)
+	if err != nil {
+		return nil, fmt.Errorf("load workspace permissions: %w", err)
+	}
 
-		w.Role = role
-		// Get permissions from gogate
-		perms, err := s.gate.GetAllPermissions(ctx, "users", userID, w.ID)
-		if err == nil {
+	for i := range workspaces {
+		w := &workspaces[i]
+		if w.Role == "" {
+			continue
+		}
+		if perms, ok := permsByTeam[w.ID]; ok {
 			w.Permissions = perms
 		}
 	}
@@ -539,7 +546,7 @@ func (s *PortalService) PatchSettings(ctx context.Context, workspaceID string, k
 				}
 			}
 			if !hasConnected {
-				return fmt.Errorf("%w: first configure a provider then you can enable it", port.ErrInvalidInput)
+				return fmt.Errorf("%w: configure a provider in Integrations before switching to provider mode", port.ErrInvalidInput)
 			}
 		}
 
diff --git a/internal/infrastructure/authgate/gate_adapter.go b/internal/infrastructure/authgate/gate_adapter.go
index 20717186..d5af11fb 100644
--- a/internal/infrastructure/authgate/gate_adapter.go
+++ b/internal/infrastructure/authgate/gate_adapter.go
@@ -2,7 +2,11 @@ package authgate
 
 import (
 	"context"
+	"sort"
 
+	"github.com/lib/pq"
+
+	"github.com/weprodev/go-pkg/pgsql"
 	gogate "github.com/weprodev/wpd-gogate"
 
 	"github.com/weprodev/wpd-message-gateway/internal/core/port"
@@ -10,10 +14,11 @@ import (
 
 type GoGateAdapter struct {
 	gate *gogate.Gate
+	db   pgsql.DBTX
 }
 
-func NewGoGateAdapter(gate *gogate.Gate) port.AuthorizationGate {
-	return &GoGateAdapter{gate: gate}
+func NewGoGateAdapter(gate *gogate.Gate, db pgsql.DBTX) port.AuthorizationGate {
+	return &GoGateAdapter{gate: gate, db: db}
 }
 
 func (a *GoGateAdapter) AssignRole(ctx context.Context, modelType, modelID, teamID, roleName string) error {
@@ -31,3 +36,67 @@ func (a *GoGateAdapter) GetRoleNames(ctx context.Context, modelType, modelID, te
 func (a *GoGateAdapter) GetAllPermissions(ctx context.Context, modelType, modelID, teamID string) ([]string, error) {
 	return a.gate.Model(modelType, modelID, teamID).GetAllPermissions(ctx)
 }
+
+func (a *GoGateAdapter) GetPermissionsForTeams(
+	ctx context.Context,
+	modelType, modelID string,
+	teamIDs []string,
+) (map[string][]string, error) {
+	if len(teamIDs) == 0 {
+		return map[string][]string{}, nil
+	}
+
+	query := `
+		SELECT team_id::text, permission FROM (
+			SELECT mhr.team_id, p.name AS permission
+			FROM model_has_roles mhr
+			JOIN roles r ON r.id = mhr.role_id
+			JOIN role_has_permissions rhp ON rhp.role_id = r.id
+			JOIN permissions p ON p.id = rhp.permission_id
+			WHERE mhr.model_type = $1 AND mhr.model_id::text = $2 AND mhr.team_id = ANY($3::uuid[])
+			UNION
+			SELECT mhp.team_id, p.name AS permission
+			FROM model_has_permissions mhp
+			JOIN permissions p ON p.id = mhp.permission_id
+			WHERE mhp.model_type = $1 AND mhp.model_id::text = $2 AND mhp.team_id = ANY($3::uuid[])
+		) AS combined
+		ORDER BY team_id, permission
+	`
+
+	rows, err := a.db.QueryContext(ctx, query, modelType, modelID, pq.Array(teamIDs))
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close() //nolint:errcheck
+
+	out := make(map[string][]string, len(teamIDs))
+	for rows.Next() {
+		var teamID, permission string
+		if err := rows.Scan(&teamID, &permission); err != nil {
+			return nil, err
+		}
+		out[teamID] = append(out[teamID], permission)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+
+	for teamID, perms := range out {
+		sort.Strings(perms)
+		out[teamID] = dedupeSortedStrings(perms)
+	}
+	return out, nil
+}
+
+func dedupeSortedStrings(values []string) []string {
+	if len(values) == 0 {
+		return values
+	}
+	out := values[:1]
+	for _, v := range values[1:] {
+		if v != out[len(out)-1] {
+			out = append(out, v)
+		}
+	}
+	return out
+}
diff --git a/internal/infrastructure/inbox/notifying_writer.go b/internal/infrastructure/inbox/notifying_writer.go
new file mode 100644
index 00000000..1a3d0702
--- /dev/null
+++ b/internal/infrastructure/inbox/notifying_writer.go
@@ -0,0 +1,66 @@
+package inbox
+
+import (
+	"context"
+
+	"github.com/weprodev/wpd-message-gateway/internal/core/port"
+	"github.com/weprodev/wpd-message-gateway/pkg/contracts"
+)
+
+var _ port.InboxWriter = (*NotifyingWriter)(nil)
+
+// EventPublisher receives inbox change notifications for SSE subscribers.
+type EventPublisher interface {
+	Publish(workspaceID, eventType string, data any)
+}
+
+// PublishFunc adapts a function to EventPublisher.
+type PublishFunc func(workspaceID, eventType string, data any)
+
+func (f PublishFunc) Publish(workspaceID, eventType string, data any) {
+	if f != nil {
+		f(workspaceID, eventType, data)
+	}
+}
+
+// NotifyingWriter wraps an InboxWriter and publishes events after successful writes.
+type NotifyingWriter struct {
+	inner port.InboxWriter
+	pub   EventPublisher
+}
+
+func NewNotifyingWriter(inner port.InboxWriter, pub EventPublisher) *NotifyingWriter {
+	return &NotifyingWriter{inner: inner, pub: pub}
+}
+
+func (w *NotifyingWriter) WriteEmail(ctx context.Context, workspaceID string, email contracts.Email) (string, error) {
+	id, err := w.inner.WriteEmail(ctx, workspaceID, email)
+	if err == nil && w.pub != nil {
+		w.pub.Publish(workspaceID, "email_received", map[string]string{"id": id})
+	}
+	return id, err
+}
+
+func (w *NotifyingWriter) WriteSMS(ctx context.Context, workspaceID string, sms contracts.SMS) (string, error) {
+	id, err := w.inner.WriteSMS(ctx, workspaceID, sms)
+	if err == nil && w.pub != nil {
+		w.pub.Publish(workspaceID, "sms_received", map[string]string{"id": id})
+	}
+	return id, err
+}
+
+func (w *NotifyingWriter) WritePush(ctx context.Context, workspaceID string, push contracts.PushNotification) (string, error) {
+	id, err := w.inner.WritePush(ctx, workspaceID, push)
+	if err == nil && w.pub != nil {
+		w.pub.Publish(workspaceID, "push_received", map[string]string{"id": id})
+	}
+	return id, err
+}
+
+func (w *NotifyingWriter) WriteChat(ctx context.Context, workspaceID string, chat contracts.ChatMessage) (string, error) {
+	id, err := w.inner.WriteChat(ctx, workspaceID, chat)
+	if err == nil && w.pub != nil {
+		w.pub.Publish(workspaceID, "chat_received", map[string]string{"id": id})
+	}
+	return id, err
+}
diff --git a/internal/infrastructure/inbox/store.go b/internal/infrastructure/inbox/store.go
index d569e8b5..d85ab5dd 100644
--- a/internal/infrastructure/inbox/store.go
+++ b/internal/infrastructure/inbox/store.go
@@ -11,31 +11,51 @@ import (
 	"github.com/weprodev/wpd-message-gateway/pkg/contracts"
 )
 
+const (
+	defaultInboxPageSize = 50
+	maxInboxPageSize     = 200
+)
+
 var _ port.InboxReader = (*Store)(nil)
 var _ port.InboxWriter = (*Store)(nil)
 
-// Store implements an in-memory message store that satisfies port.InboxReader and port.InboxWriter.
+// Store implements an in-memory message store indexed by workspace for O(1) bucket lookup.
 type Store struct {
-	mu     sync.RWMutex
-	emails []port.StoredEmail
-	sms    []port.StoredSMS
-	pushes []port.StoredPush
-	chats  []port.StoredChat
+	mu       sync.RWMutex
+	emails   map[string][]port.StoredEmail
+	sms      map[string][]port.StoredSMS
+	pushes   map[string][]port.StoredPush
+	chats    map[string][]port.StoredChat
 }
 
 // NewStore creates a new in-memory store.
 func NewStore() *Store {
-	return &Store{}
+	return &Store{
+		emails: make(map[string][]port.StoredEmail),
+		sms:    make(map[string][]port.StoredSMS),
+		pushes: make(map[string][]port.StoredPush),
+		chats:  make(map[string][]port.StoredChat),
+	}
+}
+
+func clampInboxLimit(limit int) int {
+	if limit <= 0 {
+		return defaultInboxPageSize
+	}
+	if limit > maxInboxPageSize {
+		return maxInboxPageSize
+	}
+	return limit
 }
 
 // StatsForWorkspace returns counts for messages belonging to workspace.
 func (s *Store) StatsForWorkspace(workspaceID string) map[string]int {
 	s.mu.RLock()
 	defer s.mu.RUnlock()
-	nEmail := countWorkspace(s.emails, workspaceID)
-	nSMS := countWorkspaceSMS(s.sms, workspaceID)
-	nPush := countWorkspacePush(s.pushes, workspaceID)
-	nChat := countWorkspaceChat(s.chats, workspaceID)
+	nEmail := len(s.emails[workspaceID])
+	nSMS := len(s.sms[workspaceID])
+	nPush := len(s.pushes[workspaceID])
+	nChat := len(s.chats[workspaceID])
 	return map[string]int{
 		"emails": nEmail,
 		"sms":    nSMS,
@@ -45,63 +65,53 @@ func (s *Store) StatsForWorkspace(workspaceID string) map[string]int {
 	}
 }
 
-func countWorkspace(items []port.StoredEmail, workspaceID string) int {
-	n := 0
-	for _, e := range items {
-		if e.WorkspaceID == workspaceID {
-			n++
-		}
-	}
-	return n
+func (s *Store) EmailsForWorkspace(workspaceID string) []port.StoredEmail {
+	page := s.ListEmailsForWorkspace(workspaceID, 0, "")
+	return page.Items
 }
 
-func countWorkspaceSMS(items []port.StoredSMS, workspaceID string) int {
-	n := 0
-	for _, e := range items {
-		if e.WorkspaceID == workspaceID {
-			n++
-		}
-	}
-	return n
-}
+func (s *Store) ListEmailsForWorkspace(workspaceID string, limit int, cursor string) port.InboxEmailPage {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
 
-func countWorkspacePush(items []port.StoredPush, workspaceID string) int {
-	n := 0
-	for _, e := range items {
-		if e.WorkspaceID == workspaceID {
-			n++
+	all := s.emails[workspaceID]
+	limit = clampInboxLimit(limit)
+	start := 0
+	if cursor != "" {
+		for i, item := range all {
+			if item.ID == cursor {
+				start = i + 1
+				break
+			}
 		}
 	}
-	return n
-}
 
-func countWorkspaceChat(items []port.StoredChat, workspaceID string) int {
-	n := 0
-	for _, e := range items {
-		if e.WorkspaceID == workspaceID {
-			n++
-		}
+	end := start + limit
+	hasMore := end < len(all)
+	if end > len(all) {
+		end = len(all)
 	}
-	return n
-}
 
-func (s *Store) EmailsForWorkspace(workspaceID string) []port.StoredEmail {
-	s.mu.RLock()
-	defer s.mu.RUnlock()
-	out := make([]port.StoredEmail, 0)
-	for _, e := range s.emails {
-		if e.WorkspaceID == workspaceID {
-			out = append(out, e)
-		}
+	items := make([]port.StoredEmail, 0, end-start)
+	if start < len(all) {
+		items = append(items, all[start:end]...)
+	}
+	nextCursor := ""
+	if hasMore && len(items) > 0 {
+		nextCursor = items[len(items)-1].ID
+	}
+	return port.InboxEmailPage{
+		Items:      items,
+		NextCursor: nextCursor,
+		HasMore:    hasMore,
 	}
-	return out
 }
 
 func (s *Store) EmailByIDForWorkspace(id, workspaceID string) (port.StoredEmail, bool) {
 	s.mu.RLock()
 	defer s.mu.RUnlock()
-	for _, e := range s.emails {
-		if e.ID == id && e.WorkspaceID == workspaceID {
+	for _, e := range s.emails[workspaceID] {
+		if e.ID == id {
 			return e, true
 		}
 	}
@@ -111,9 +121,10 @@ func (s *Store) EmailByIDForWorkspace(id, workspaceID string) (port.StoredEmail,
 func (s *Store) DeleteEmailByIDForWorkspace(id, workspaceID string) bool {
 	s.mu.Lock()
 	defer s.mu.Unlock()
-	for i, e := range s.emails {
-		if e.ID == id && e.WorkspaceID == workspaceID {
-			s.emails = append(s.emails[:i], s.emails[i+1:]...)
+	items := s.emails[workspaceID]
+	for i, e := range items {
+		if e.ID == id {
+			s.emails[workspaceID] = append(items[:i], items[i+1:]...)
 			return true
 		}
 	}
@@ -123,21 +134,15 @@ func (s *Store) DeleteEmailByIDForWorkspace(id, workspaceID string) bool {
 func (s *Store) SMSForWorkspace(workspaceID string) []port.StoredSMS {
 	s.mu.RLock()
 	defer s.mu.RUnlock()
-	out := make([]port.StoredSMS, 0)
-	for _, e := range s.sms {
-		if e.WorkspaceID == workspaceID {
-			out = append(out, e)
-		}
-	}
-	return out
+	return append([]port.StoredSMS(nil), s.sms[workspaceID]...)
 }
 
 func (s *Store) SMSByIDForWorkspace(id, workspaceID string) (port.StoredSMS, bool) {
 	s.mu.RLock()
 	defer s.mu.RUnlock()
-	for _, e := range s.sms {
-		if e.ID == id && e.WorkspaceID == workspaceID {
-			return e, true
+	for _, item := range s.sms[workspaceID] {
+		if item.ID == id {
+			return item, true
 		}
 	}
 	return port.StoredSMS{}, false
@@ -146,9 +151,10 @@ func (s *Store) SMSByIDForWorkspace(id, workspaceID string) (port.StoredSMS, boo
 func (s *Store) DeleteSMSByIDForWorkspace(id, workspaceID string) bool {
 	s.mu.Lock()
 	defer s.mu.Unlock()
-	for i, e := range s.sms {
-		if e.ID == id && e.WorkspaceID == workspaceID {
-			s.sms = append(s.sms[:i], s.sms[i+1:]...)
+	items := s.sms[workspaceID]
+	for i, e := range items {
+		if e.ID == id {
+			s.sms[workspaceID] = append(items[:i], items[i+1:]...)
 			return true
 		}
 	}
@@ -158,21 +164,15 @@ func (s *Store) DeleteSMSByIDForWorkspace(id, workspaceID string) bool {
 func (s *Store) PushForWorkspace(workspaceID string) []port.StoredPush {
 	s.mu.RLock()
 	defer s.mu.RUnlock()
-	out := make([]port.StoredPush, 0)
-	for _, e := range s.pushes {
-		if e.WorkspaceID == workspaceID {
-			out = append(out, e)
-		}
-	}
-	return out
+	return append([]port.StoredPush(nil), s.pushes[workspaceID]...)
 }
 
 func (s *Store) PushByIDForWorkspace(id, workspaceID string) (port.StoredPush, bool) {
 	s.mu.RLock()
 	defer s.mu.RUnlock()
-	for _, e := range s.pushes {
-		if e.ID == id && e.WorkspaceID == workspaceID {
-			return e, true
+	for _, item := range s.pushes[workspaceID] {
+		if item.ID == id {
+			return item, true
 		}
 	}
 	return port.StoredPush{}, false
@@ -181,9 +181,10 @@ func (s *Store) PushByIDForWorkspace(id, workspaceID string) (port.StoredPush, b
 func (s *Store) DeletePushByIDForWorkspace(id, workspaceID string) bool {
 	s.mu.Lock()
 	defer s.mu.Unlock()
-	for i, e := range s.pushes {
-		if e.ID == id && e.WorkspaceID == workspaceID {
-			s.pushes = append(s.pushes[:i], s.pushes[i+1:]...)
+	items := s.pushes[workspaceID]
+	for i, e := range items {
+		if e.ID == id {
+			s.pushes[workspaceID] = append(items[:i], items[i+1:]...)
 			return true
 		}
 	}
@@ -193,21 +194,15 @@ func (s *Store) DeletePushByIDForWorkspace(id, workspaceID string) bool {
 func (s *Store) ChatForWorkspace(workspaceID string) []port.StoredChat {
 	s.mu.RLock()
 	defer s.mu.RUnlock()
-	out := make([]port.StoredChat, 0)
-	for _, e := range s.chats {
-		if e.WorkspaceID == workspaceID {
-			out = append(out, e)
-		}
-	}
-	return out
+	return append([]port.StoredChat(nil), s.chats[workspaceID]...)
 }
 
 func (s *Store) ChatByIDForWorkspace(id, workspaceID string) (port.StoredChat, bool) {
 	s.mu.RLock()
 	defer s.mu.RUnlock()
-	for _, e := range s.chats {
-		if e.ID == id && e.WorkspaceID == workspaceID {
-			return e, true
+	for _, item := range s.chats[workspaceID] {
+		if item.ID == id {
+			return item, true
 		}
 	}
 	return port.StoredChat{}, false
@@ -216,9 +211,10 @@ func (s *Store) ChatByIDForWorkspace(id, workspaceID string) (port.StoredChat, b
 func (s *Store) DeleteChatByIDForWorkspace(id, workspaceID string) bool {
 	s.mu.Lock()
 	defer s.mu.Unlock()
-	for i, e := range s.chats {
-		if e.ID == id && e.WorkspaceID == workspaceID {
-			s.chats = append(s.chats[:i], s.chats[i+1:]...)
+	items := s.chats[workspaceID]
+	for i, e := range items {
+		if e.ID == id {
+			s.chats[workspaceID] = append(items[:i], items[i+1:]...)
 			return true
 		}
 	}
@@ -228,62 +224,23 @@ func (s *Store) DeleteChatByIDForWorkspace(id, workspaceID string) bool {
 func (s *Store) ClearWorkspace(workspaceID string) {
 	s.mu.Lock()
 	defer s.mu.Unlock()
-	s.emails = filterKeepOtherWorkspaces(s.emails, workspaceID)
-	s.sms = filterKeepOtherWorkspacesSMS(s.sms, workspaceID)
-	s.pushes = filterKeepOtherWorkspacesPush(s.pushes, workspaceID)
-	s.chats = filterKeepOtherWorkspacesChat(s.chats, workspaceID)
-}
-
-func filterKeepOtherWorkspaces(items []port.StoredEmail, workspaceID string) []port.StoredEmail {
-	out := items[:0]
-	for _, e := range items {
-		if e.WorkspaceID != workspaceID {
-			out = append(out, e)
-		}
-	}
-	return out
-}
-
-func filterKeepOtherWorkspacesSMS(items []port.StoredSMS, workspaceID string) []port.StoredSMS {
-	out := items[:0]
-	for _, e := range items {
-		if e.WorkspaceID != workspaceID {
-			out = append(out, e)
-		}
-	}
-	return out
-}
-
-func filterKeepOtherWorkspacesPush(items []port.StoredPush, workspaceID string) []port.StoredPush {
-	out := items[:0]
-	for _, e := range items {
-		if e.WorkspaceID != workspaceID {
-			out = append(out, e)
-		}
-	}
-	return out
-}
-
-func filterKeepOtherWorkspacesChat(items []port.StoredChat, workspaceID string) []port.StoredChat {
-	out := items[:0]
-	for _, e := range items {
-		if e.WorkspaceID != workspaceID {
-			out = append(out, e)
-		}
-	}
-	return out
+	delete(s.emails, workspaceID)
+	delete(s.sms, workspaceID)
+	delete(s.pushes, workspaceID)
+	delete(s.chats, workspaceID)
 }
 
 func (s *Store) WriteEmail(_ context.Context, workspaceID string, email contracts.Email) (string, error) {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	id := uuid.New().String()
-	s.emails = append(s.emails, port.StoredEmail{
+	item := port.StoredEmail{
 		ID:          id,
 		WorkspaceID: workspaceID,
 		CreatedAt:   time.Now(),
 		Email:       email,
-	})
+	}
+	s.emails[workspaceID] = append([]port.StoredEmail{item}, s.emails[workspaceID]...)
 	return id, nil
 }
 
@@ -291,12 +248,13 @@ func (s *Store) WriteSMS(_ context.Context, workspaceID string, sms contracts.SM
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	id := uuid.New().String()
-	s.sms = append(s.sms, port.StoredSMS{
+	item := port.StoredSMS{
 		ID:          id,
 		WorkspaceID: workspaceID,
 		CreatedAt:   time.Now(),
 		SMS:         sms,
-	})
+	}
+	s.sms[workspaceID] = append([]port.StoredSMS{item}, s.sms[workspaceID]...)
 	return id, nil
 }
 
@@ -304,12 +262,13 @@ func (s *Store) WritePush(_ context.Context, workspaceID string, push contracts.
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	id := uuid.New().String()
-	s.pushes = append(s.pushes, port.StoredPush{
+	item := port.StoredPush{
 		ID:          id,
 		WorkspaceID: workspaceID,
 		CreatedAt:   time.Now(),
 		Push:        push,
-	})
+	}
+	s.pushes[workspaceID] = append([]port.StoredPush{item}, s.pushes[workspaceID]...)
 	return id, nil
 }
 
@@ -317,11 +276,12 @@ func (s *Store) WriteChat(_ context.Context, workspaceID string, chat contracts.
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	id := uuid.New().String()
-	s.chats = append(s.chats, port.StoredChat{
+	item := port.StoredChat{
 		ID:          id,
 		WorkspaceID: workspaceID,
 		CreatedAt:   time.Now(),
 		Chat:        chat,
-	})
+	}
+	s.chats[workspaceID] = append([]port.StoredChat{item}, s.chats[workspaceID]...)
 	return id, nil
 }
diff --git a/internal/infrastructure/repository/postgres/api_key_repository.go b/internal/infrastructure/repository/postgres/api_key_repository.go
index 9508f175..2c141fa4 100644
--- a/internal/infrastructure/repository/postgres/api_key_repository.go
+++ b/internal/infrastructure/repository/postgres/api_key_repository.go
@@ -68,8 +68,12 @@ func (r *APIKeyRepository) GetByClientID(ctx context.Context, clientID string) (
 }
 
 func (r *APIKeyRepository) UpdateLastUsedAt(ctx context.Context, id string) error {
+	// Throttle writes: inbox/SSE can hit this on every request.
 	_, err := r.client.GetDB(ctx).ExecContext(ctx,
-		`UPDATE api_keys SET last_used_at = NOW() WHERE id = $1`,
+		`UPDATE api_keys
+		 SET last_used_at = NOW()
+		 WHERE id = $1
+		   AND (last_used_at IS NULL OR last_used_at < NOW() - INTERVAL '5 minutes')`,
 		id,
 	)
 	if err != nil {
diff --git a/internal/infrastructure/repository/postgres/message_request_log_repository.go b/internal/infrastructure/repository/postgres/message_request_log_repository.go
index 84356981..42026db7 100644
--- a/internal/infrastructure/repository/postgres/message_request_log_repository.go
+++ b/internal/infrastructure/repository/postgres/message_request_log_repository.go
@@ -46,34 +46,40 @@ func (r *MessageRequestLogRepository) Create(ctx context.Context, log *domain.Me
 	if log.ProviderName != "" {
 		provider = log.ProviderName
 	}
-	return r.client.RunInTransaction(ctx, func(ctx context.Context) error {
-		err := r.client.GetDB(ctx).QueryRowContext(ctx, query,
-			log.WorkspaceID, apiKeyID, log.ChannelType, log.HTTPMethod, log.StatusCode, log.Endpoint,
-			provider, reqID, dur, errMsg,
-		).Scan(&log.ID, &log.CreatedAt)
-		if err != nil {
-			slog.ErrorContext(ctx, "database error: failed to create message request log", "error", err, "endpoint", log.Endpoint)
-			return err
-		}
 
-		if log.Payload != nil {
-			log.Payload.LogID = log.ID
-			payloadQuery := `
-				INSERT INTO message_request_payloads (log_id, request_body, response_body)
-				VALUES ($1, $2, $3)
-				RETURNING created_at
-			`
-			err = r.client.GetDB(ctx).QueryRowContext(ctx, payloadQuery,
-				log.Payload.LogID, log.Payload.RequestBody, log.Payload.ResponseBody,
-			).Scan(&log.Payload.CreatedAt)
-			if err != nil {
-				slog.ErrorContext(ctx, "database error: failed to create message request payload", "error", err, "log_id", log.ID)
-				return err
-			}
+	err := r.client.GetDB(ctx).QueryRowContext(ctx, query,
+		log.WorkspaceID, apiKeyID, log.ChannelType, log.HTTPMethod, log.StatusCode, log.Endpoint,
+		provider, reqID, dur, errMsg,
+	).Scan(&log.ID, &log.CreatedAt)
+	if err != nil {
+		slog.ErrorContext(ctx, "database error: failed to create message request log", "error", err, "endpoint", log.Endpoint)
+		return err
+	}
+
+	if log.Payload != nil {
+		if err := r.insertPayload(ctx, log); err != nil {
+			// Metadata logs must persist even when optional payload storage fails.
+			slog.WarnContext(ctx, "message request payload not stored", "error", err, "log_id", log.ID)
 		}
+	}
+
+	return nil
+}
 
-		return nil
-	})
+func (r *MessageRequestLogRepository) insertPayload(ctx context.Context, log *domain.MessageRequestLog) error {
+	log.Payload.LogID = log.ID
+	payloadQuery := `
+		INSERT INTO message_request_payloads (log_id, request_body, response_body)
+		VALUES ($1, $2, $3)
+		RETURNING created_at
+	`
+	err := r.client.GetDB(ctx).QueryRowContext(ctx, payloadQuery,
+		log.Payload.LogID, log.Payload.RequestBody, log.Payload.ResponseBody,
+	).Scan(&log.Payload.CreatedAt)
+	if err != nil {
+		return fmt.Errorf("insert message request payload: %w", err)
+	}
+	return nil
 }
 
 func (r *MessageRequestLogRepository) ListWithSource(ctx context.Context, q port.MessageLogQuery) ([]domain.MessageRequestLogWithSource, int, error) {
@@ -96,22 +102,17 @@ func (r *MessageRequestLogRepository) ListWithSource(ctx context.Context, q port
 		args = append(args, *q.To)
 	}
 
-	countQuery := "SELECT COUNT(*) FROM message_request_logs l WHERE " + where
-	var total int
-	if err := db.QueryRowContext(ctx, countQuery, args...).Scan(&total); err != nil {
-		slog.ErrorContext(ctx, "database error: failed to count message request logs", "error", err)
-		return nil, 0, err
-	}
-
+	limit, offset := clampLimitOffset(q.Limit, q.Offset)
 	listQuery := fmt.Sprintf(`
 		SELECT l.id, l.workspace_id, l.api_key_id, l.channel_type, l.http_method, l.status_code, l.endpoint,
 			l.provider_name, l.request_id, l.duration_ms, l.error_message, l.created_at,
-			COALESCE(k.name, ''), COALESCE(k.client_id, '')
+			COALESCE(k.name, ''), COALESCE(k.client_id, ''),
+			COUNT(*) OVER() AS total_count
 		FROM message_request_logs l
 		LEFT JOIN api_keys k ON k.id = l.api_key_id
 		WHERE %s
 		ORDER BY l.created_at DESC
-		%s`, where, limitOffsetSQL(q.Limit, q.Offset))
+		LIMIT %d OFFSET %d`, where, limit, offset)
 
 	rows, err := db.QueryContext(ctx, listQuery, args...)
 	if err != nil {
@@ -121,6 +122,7 @@ func (r *MessageRequestLogRepository) ListWithSource(ctx context.Context, q port
 	defer rows.Close() //nolint:errcheck
 
 	var out []domain.MessageRequestLogWithSource
+	total := 0
 	for rows.Next() {
 		var row domain.MessageRequestLogWithSource
 		var apiKeyID sql.NullString
@@ -128,14 +130,19 @@ func (r *MessageRequestLogRepository) ListWithSource(ctx context.Context, q port
 		var dur sql.NullInt64
 		var errMsg sql.NullString
 		var prov sql.NullString
+		var totalCount int64
 		if err := rows.Scan(
 			&row.ID, &row.WorkspaceID, &apiKeyID, &row.ChannelType, &row.HTTPMethod, &row.StatusCode, &row.Endpoint,
 			&prov, &reqID, &dur, &errMsg, &row.CreatedAt,
 			&row.SourceName, &row.ClientID,
+			&totalCount,
 		); err != nil {
 			slog.ErrorContext(ctx, "database error: failed to scan message request log", "error", err)
 			return nil, 0, err
 		}
+		if total == 0 {
+			total = int(totalCount)
+		}
 		if apiKeyID.Valid {
 			row.APIKeyID = apiKeyID.String
 		}
diff --git a/internal/infrastructure/repository/postgres/workspace_member_repository.go b/internal/infrastructure/repository/postgres/workspace_member_repository.go
index 326a7746..6c1c35d1 100644
--- a/internal/infrastructure/repository/postgres/workspace_member_repository.go
+++ b/internal/infrastructure/repository/postgres/workspace_member_repository.go
@@ -76,7 +76,8 @@ func (r *WorkspaceMemberRepository) GetRole(ctx context.Context, workspaceID, us
 
 func (r *WorkspaceMemberRepository) ListMembers(ctx context.Context, workspaceID string) ([]domain.WorkspaceMember, error) {
 	rows, err := r.client.GetDB(ctx).QueryContext(ctx, `
-		SELECT wm.workspace_id, wm.user_id, r.name, wm.joined_at, u.email, COALESCE(u.display_name, '')
+		SELECT wm.workspace_id, wm.user_id, r.name, wm.joined_at, u.email,
+			COALESCE(NULLIF(TRIM(u.first_name || ' ' || u.last_name), ''), u.email)
 		FROM workspace_members wm
 		JOIN roles r ON r.id = wm.role_id
 		INNER JOIN users u ON u.id = wm.user_id
diff --git a/internal/infrastructure/repository/postgres/workspace_repository.go b/internal/infrastructure/repository/postgres/workspace_repository.go
index c91a7d68..3b0acf64 100644
--- a/internal/infrastructure/repository/postgres/workspace_repository.go
+++ b/internal/infrastructure/repository/postgres/workspace_repository.go
@@ -140,11 +140,13 @@ func (r *WorkspaceRepository) ListForUser(ctx context.Context, userID string) ([
 	query := `
 		SELECT DISTINCT w.id, w.name, w.slug, u.email, w.status,
 		       CASE WHEN w.is_private THEN 'private' ELSE 'public' END,
-		       w.hashed_pin_code, w.icon_key, w.created_at, w.updated_at
+		       w.hashed_pin_code, w.icon_key, w.created_at, w.updated_at,
+		       COALESCE(r.name, '')
 		FROM workspaces w
 		INNER JOIN users u ON u.id = w.owner_id
-		LEFT JOIN workspace_members wm ON wm.workspace_id = w.id
-		WHERE (wm.user_id = $1 OR w.is_private = false) AND w.status = 'active'
+		LEFT JOIN workspace_members wm ON wm.workspace_id = w.id AND wm.user_id = $1
+		LEFT JOIN roles r ON r.id = wm.role_id
+		WHERE (wm.user_id IS NOT NULL OR w.is_private = false) AND w.status = 'active'
 		ORDER BY w.name ASC
 	`
 	rows, err := r.client.GetDB(ctx).QueryContext(ctx, query, userID)
@@ -156,7 +158,7 @@ func (r *WorkspaceRepository) ListForUser(ctx context.Context, userID string) ([
 
 	out := []domain.Workspace{}
 	for rows.Next() {
-		w, err := scanWorkspace(rows)
+		w, err := scanWorkspaceWithRole(rows)
 		if err != nil {
 			slog.ErrorContext(ctx, "database error: failed to scan workspace in list", "error", err, "user_id", userID)
 			return nil, err
@@ -169,3 +171,26 @@ func (r *WorkspaceRepository) ListForUser(ctx context.Context, userID string) ([
 	}
 	return out, nil
 }
+
+func scanWorkspaceWithRole(scanner interface {
+	Scan(dest ...any) error
+}) (domain.Workspace, error) {
+	var w domain.Workspace
+	var hashedPin, iconKey sql.NullString
+	var role sql.NullString
+	err := scanner.Scan(&w.ID, &w.Name, &w.Slug, &w.AdminEmail, &w.Status, &w.Visibility,
+		&hashedPin, &iconKey, &w.CreatedAt, &w.UpdatedAt, &role)
+	if err != nil {
+		return w, err
+	}
+	if hashedPin.Valid {
+		w.HashedPin = hashedPin.String
+	}
+	if iconKey.Valid {
+		w.IconKey = iconKey.String
+	}
+	if role.Valid {
+		w.Role = role.String
+	}
+	return w, nil
+}
diff --git a/internal/presentation/handler/portal_inbox_handler.go b/internal/presentation/handler/portal_inbox_handler.go
index 121fdce2..548be158 100644
--- a/internal/presentation/handler/portal_inbox_handler.go
+++ b/internal/presentation/handler/portal_inbox_handler.go
@@ -7,6 +7,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"net/http"
+	"strconv"
 	"sync"
 
 	"github.com/labstack/echo/v4"
@@ -16,7 +17,7 @@ import (
 )
 
 // PortalInboxHandler serves REST + SSE for the workspace-scoped message inbox (memory provider preview).
-// Routes require JWT + workspace membership + workspace API key (see middleware).
+// Routes require JWT + workspace membership (see middleware).
 type PortalInboxHandler struct {
 	reader      port.InboxReader
 	writer      port.InboxWriter
@@ -41,7 +42,10 @@ func (h *PortalInboxHandler) HandleStats(c echo.Context) error {
 }
 
 func (h *PortalInboxHandler) HandleGetEmails(c echo.Context) error {
-	return c.JSON(http.StatusOK, h.reader.EmailsForWorkspace(workspaceIDParam(c)))
+	limit, _ := strconv.Atoi(c.QueryParam("limit"))
+	cursor := c.QueryParam("cursor")
+	page := h.reader.ListEmailsForWorkspace(workspaceIDParam(c), limit, cursor)
+	return c.JSON(http.StatusOK, page)
 }
 
 func (h *PortalInboxHandler) HandleGetEmailByID(c echo.Context) error {
@@ -146,7 +150,6 @@ func (h *PortalInboxHandler) HandleIngestEmail(c echo.Context) error {
 		return c.JSON(http.StatusInternalServerError, map[string]string{"error": "failed to store email"})
 	}
 
-	h.broadcast(w, "email_received", map[string]string{"id": id})
 	return c.JSON(http.StatusCreated, map[string]string{"id": id})
 }
 
@@ -161,7 +164,6 @@ func (h *PortalInboxHandler) HandleIngestSMS(c echo.Context) error {
 		return c.JSON(http.StatusInternalServerError, map[string]string{"error": "failed to store sms"})
 	}
 
-	h.broadcast(workspaceIDParam(c), "sms_received", map[string]string{"id": id})
 	return c.JSON(http.StatusCreated, map[string]string{"id": id})
 }
 
@@ -176,7 +178,6 @@ func (h *PortalInboxHandler) HandleIngestPush(c echo.Context) error {
 		return c.JSON(http.StatusInternalServerError, map[string]string{"error": "failed to store push"})
 	}
 
-	h.broadcast(workspaceIDParam(c), "push_received", map[string]string{"id": id})
 	return c.JSON(http.StatusCreated, map[string]string{"id": id})
 }
 
@@ -191,10 +192,14 @@ func (h *PortalInboxHandler) HandleIngestChat(c echo.Context) error {
 		return c.JSON(http.StatusInternalServerError, map[string]string{"error": "failed to store chat"})
 	}
 
-	h.broadcast(workspaceIDParam(c), "chat_received", map[string]string{"id": id})
 	return c.JSON(http.StatusCreated, map[string]string{"id": id})
 }
 
+// PublishInboxEvent notifies SSE subscribers of an inbox change.
+func (h *PortalInboxHandler) PublishInboxEvent(workspaceID, eventType string, data any) {
+	h.broadcast(workspaceID, eventType, data)
+}
+
 // HandleSSE streams Server-Sent Events for the workspace inbox (one connection per workspace).
 func (h *PortalInboxHandler) HandleSSE(c echo.Context) error {
 	w := workspaceIDParam(c)
diff --git a/internal/presentation/router.go b/internal/presentation/router.go
index c1c9246b..1b96cf85 100644
--- a/internal/presentation/router.go
+++ b/internal/presentation/router.go
@@ -178,32 +178,31 @@ func (rt *Router) Setup() *echo.Echo {
 	protected.POST("/workspaces/:wid/invitations", pw.CreateInvitation, customMiddleware.RequirePermission(rt.gate, rt.workspaceRepo, domain.PermissionInvitationsWrite))
 	protected.POST("/workspaces/:wid/send-test/:channel", ph.SendTest, customMiddleware.RequirePermission(rt.gate, rt.workspaceRepo, domain.PermissionSendTest))
 
-	// Inbox API — always enabled (portal is always on).
+	// Inbox API — JWT + logs.read (same access model as message logs overview).
 	if rt.memberRepo != nil {
 		inbox := rt.portalInboxHandler
 		inboxGroup := api.Group("/workspaces/:wid/inbox")
 		inboxGroup.Use(customMiddleware.PortalJWTBearerOrQuery(rt.jwtSecret))
-		inboxGroup.Use(customMiddleware.RequireWorkspaceMember(rt.memberRepo))
-		inboxGroup.Use(customMiddleware.RequireWorkspaceAPIKey(rt.apiKeyRepo))
+		inboxGroup.Use(customMiddleware.RequirePermission(rt.gate, rt.workspaceRepo, domain.PermissionLogsRead))
 		inboxGroup.GET("/stats", inbox.HandleStats)
 		inboxGroup.GET("/emails", inbox.HandleGetEmails)
 		inboxGroup.GET("/emails/:id", inbox.HandleGetEmailByID)
-		inboxGroup.DELETE("/emails/:id", inbox.HandleDeleteEmailByID)
 		inboxGroup.GET("/sms", inbox.HandleGetSMS)
 		inboxGroup.GET("/sms/:id", inbox.HandleGetSMSByID)
-		inboxGroup.DELETE("/sms/:id", inbox.HandleDeleteSMSByID)
 		inboxGroup.GET("/push", inbox.HandleGetPush)
 		inboxGroup.GET("/push/:id", inbox.HandleGetPushByID)
-		inboxGroup.DELETE("/push/:id", inbox.HandleDeletePushByID)
 		inboxGroup.GET("/chat", inbox.HandleGetChat)
 		inboxGroup.GET("/chat/:id", inbox.HandleGetChatByID)
-		inboxGroup.DELETE("/chat/:id", inbox.HandleDeleteChatByID)
-		inboxGroup.DELETE("/messages", inbox.HandleClearAll)
 		inboxGroup.GET("/events", inbox.HandleSSE)
+		inboxGroup.DELETE("/emails/:id", inbox.HandleDeleteEmailByID, customMiddleware.RequirePermission(rt.gate, rt.workspaceRepo, domain.PermissionSendTest))
+		inboxGroup.DELETE("/sms/:id", inbox.HandleDeleteSMSByID, customMiddleware.RequirePermission(rt.gate, rt.workspaceRepo, domain.PermissionSendTest))
+		inboxGroup.DELETE("/push/:id", inbox.HandleDeletePushByID, customMiddleware.RequirePermission(rt.gate, rt.workspaceRepo, domain.PermissionSendTest))
+		inboxGroup.DELETE("/chat/:id", inbox.HandleDeleteChatByID, customMiddleware.RequirePermission(rt.gate, rt.workspaceRepo, domain.PermissionSendTest))
+		inboxGroup.DELETE("/messages", inbox.HandleClearAll, customMiddleware.RequirePermission(rt.gate, rt.workspaceRepo, domain.PermissionSendTest))
 
 		internal := api.Group("/workspaces/:wid/internal")
 		internal.Use(customMiddleware.PortalJWTBearerOrQuery(rt.jwtSecret))
-		internal.Use(customMiddleware.RequireWorkspaceMember(rt.memberRepo))
+		internal.Use(customMiddleware.RequirePermission(rt.gate, rt.workspaceRepo, domain.PermissionSendTest))
 		internal.POST("/email", inbox.HandleIngestEmail)
 		internal.POST("/sms", inbox.HandleIngestSMS)
 		internal.POST("/push", inbox.HandleIngestPush)
diff --git a/tests/bruno/Portal/Email/List Emails.bru b/tests/bruno/Portal/Email/List Emails.bru
index ea09c26e..7c6230d5 100644
--- a/tests/bruno/Portal/Email/List Emails.bru	
+++ b/tests/bruno/Portal/Email/List Emails.bru	
@@ -12,23 +12,22 @@ get {
 
 headers {
   Authorization: Bearer {{portalJwt}}
-  X-Api-Client-Id: {{apiClientId}}
-  X-Api-Client-Secret: {{apiSecret}}
 }
 
-
 tests {
   test("should return 200", function() {
     expect(res.status).to.equal(200);
   });
 
-  test("should return array", function() {
-    expect(res.body).to.be.an("array");
+  test("should return paginated page", function() {
+    expect(res.body).to.be.an("object");
+    expect(res.body.items).to.be.an("array");
+    expect(res.body).to.have.property("has_more");
   });
 
   test("should have email with required fields", function() {
-    if (res.body.length > 0) {
-      const email = res.body[0];
+    if (res.body.items.length > 0) {
+      const email = res.body.items[0];
       expect(email).to.have.property("id");
       expect(email).to.have.property("email");
       expect(email).to.have.property("created_at");

From ead3fa7291983351fdb6a3fb71207f379b19acbc Mon Sep 17 00:00:00 2001
From: MichaelAndish <maikel1370@gmail.com>
Date: Sat, 4 Jul 2026 11:46:27 +0200
Subject: [PATCH 10/20] feat: enhance inbox functionality and update code
 structure

- Added `inbox_message_id` to `message_request_logs` for improved tracking of messages.
- Updated Go module dependencies to include `github.com/lib/pq` for PostgreSQL support.
- Refined documentation on DTO usage in the presentation layer, emphasizing the separation of domain and presentation concerns.
- Introduced new utility functions for inbox log handling and improved email content display logic.
- Removed deprecated `SendTestModal` component and replaced it with a `GetStartedDialog` for better onboarding experience.

This commit improves the overall structure and functionality of the inbox feature, ensuring better data management and user experience.
---
 .agents/skills/golang-pro/SKILL.md            |   2 +-
 .../references/wpd-message-gateway.md         |   5 +-
 .claude/commands/smell.md                     |   6 +-
 .../20260318000000_init_gateway.up.sql        |   5 +
 docs/agents/delivery-agent.md                 |   2 +-
 docs/agents/review-agent.md                   |   1 +
 docs/backend/architecture.md                  |   6 +-
 docs/backend/code-conventions.md              |  53 ++++-
 docs/backend/usage.md                         |   5 +-
 frontend/src/core/router/routes.ts            |   2 +
 .../email-content/email-content.tsx           |   6 +-
 .../components/email-item/email-item.test.tsx |   2 +-
 .../components/email-item/email-item.tsx      |  19 +-
 .../components/email-list/email-list.test.tsx |   2 +-
 .../components/email-list/email-list.tsx      |   3 +-
 .../get-started-dialog.stories.tsx            |  27 +++
 .../get-started-dialog/get-started-dialog.tsx |  67 ++++++
 .../components/get-started-dialog/index.ts    |   1 +
 .../inbox/components/send-test-modal/index.ts |   1 -
 .../send-test-modal.stories.tsx               |  45 ----
 .../send-test-modal/send-test-modal.test.tsx  |  23 --
 .../send-test-modal/send-test-modal.tsx       | 223 ------------------
 frontend/src/features/inbox/inbox.api.ts      |  21 --
 frontend/src/features/inbox/inbox.types.ts    |   1 +
 .../src/features/inbox/log-display.utils.ts   |   9 +
 frontend/src/features/inbox/logs.schema.ts    |   1 +
 .../features/inbox/pages/email-inbox.page.tsx |  36 ++-
 .../features/inbox/pages/overview.page.tsx    | 181 +++++++-------
 .../features/settings/pages/settings.page.tsx |   2 +-
 .../layouts/workspace-nav.config.ts           |   5 +-
 go.mod                                        |   2 +-
 internal/app/wire.go                          |   2 +-
 internal/core/domain/message_request_log.go   |  23 +-
 internal/core/service/email_enrichment.go     |  51 ++++
 .../core/service/email_enrichment_test.go     | 105 +++++++++
 internal/core/service/gateway_service.go      |   5 +-
 internal/core/service/gateway_service_test.go |   8 +-
 internal/infrastructure/inbox/store.go        |  10 +-
 .../message_request_log_repository.go         | 104 ++++----
 .../message_request_log_repository_test.go    | 111 +++++++++
 .../repository/postgres/scan_helpers.go       |  26 ++
 .../repository/postgres/scan_helpers_test.go  |  28 +++
 .../postgres/template_repository.go           |   7 -
 internal/presentation/dto/api_key.go          |  62 +++++
 internal/presentation/dto/auth.go             | 119 ++++++++++
 internal/presentation/dto/auth_test.go        |  54 +++++
 internal/presentation/dto/integration.go      |  77 ++++++
 internal/presentation/dto/integration_test.go |  60 +++++
 .../presentation/dto/message_request_log.go   |  62 +++++
 .../dto/message_request_log_test.go           |  39 +++
 internal/presentation/dto/settings.go         |   4 +
 internal/presentation/dto/template.go         |  76 ++++++
 internal/presentation/dto/workspace.go        |  74 ++++++
 .../handler/portal_auth_handler.go            |  32 +--
 .../presentation/handler/portal_handler.go    | 103 +-------
 .../handler/portal_integration_handler.go     |  47 +---
 internal/presentation/handler/portal_send.go  |  46 ----
 .../handler/portal_template_handler.go        |  61 +----
 .../handler/portal_workspace_handler.go       |  52 +---
 internal/presentation/handler/send_helper.go  |   3 +
 .../presentation/handler/send_helper_test.go  |  60 +++++
 internal/presentation/router.go               |   1 -
 pkg/contracts/message.go                      |  43 +++-
 pkg/contracts/message_test.go                 |  72 ++++++
 64 files changed, 1557 insertions(+), 834 deletions(-)
 create mode 100644 frontend/src/features/inbox/components/get-started-dialog/get-started-dialog.stories.tsx
 create mode 100644 frontend/src/features/inbox/components/get-started-dialog/get-started-dialog.tsx
 create mode 100644 frontend/src/features/inbox/components/get-started-dialog/index.ts
 delete mode 100644 frontend/src/features/inbox/components/send-test-modal/index.ts
 delete mode 100644 frontend/src/features/inbox/components/send-test-modal/send-test-modal.stories.tsx
 delete mode 100644 frontend/src/features/inbox/components/send-test-modal/send-test-modal.test.tsx
 delete mode 100644 frontend/src/features/inbox/components/send-test-modal/send-test-modal.tsx
 create mode 100644 frontend/src/features/inbox/log-display.utils.ts
 create mode 100644 internal/core/service/email_enrichment.go
 create mode 100644 internal/core/service/email_enrichment_test.go
 create mode 100644 internal/infrastructure/repository/postgres/message_request_log_repository_test.go
 create mode 100644 internal/infrastructure/repository/postgres/scan_helpers.go
 create mode 100644 internal/infrastructure/repository/postgres/scan_helpers_test.go
 create mode 100644 internal/presentation/dto/api_key.go
 create mode 100644 internal/presentation/dto/auth.go
 create mode 100644 internal/presentation/dto/auth_test.go
 create mode 100644 internal/presentation/dto/integration.go
 create mode 100644 internal/presentation/dto/integration_test.go
 create mode 100644 internal/presentation/dto/message_request_log.go
 create mode 100644 internal/presentation/dto/message_request_log_test.go
 create mode 100644 internal/presentation/dto/settings.go
 create mode 100644 internal/presentation/dto/template.go
 create mode 100644 internal/presentation/dto/workspace.go
 delete mode 100644 internal/presentation/handler/portal_send.go

diff --git a/.agents/skills/golang-pro/SKILL.md b/.agents/skills/golang-pro/SKILL.md
index 8fd7e8ce..4023f53e 100644
--- a/.agents/skills/golang-pro/SKILL.md
+++ b/.agents/skills/golang-pro/SKILL.md
@@ -100,7 +100,7 @@ Key properties demonstrated: bounded goroutine lifetime via `ctx`, error propaga
 	- Use `X | Y` union constraints for generics (Go 1.18+)
 - Propagate errors with fmt.Errorf("%w", err)
 - Run race detector on tests (-race flag)
-- Maintain pure domain entities (strict DDD): NEVER use `json:"..."`, `db:"..."` or other presentation/infrastructure tags in `internal/core/domain`. ALWAYS map domain models to DTOs in the presentation layer before returning them.
+- Maintain pure domain entities (strict DDD): NEVER use `json:"..."`, `db:"..."` or other presentation/infrastructure tags in `internal/core/domain`. Map in **`internal/presentation/dto/`**: outbound **`{Type}FromDomain(domain.X)`** package funcs; inbound **`(r R) ToDomain()`** / **`ToPatch()`** on request DTOs. **Never pass `dto.*` to repositories** — only `domain.*` crosses the port boundary.
 
 ### MUST NOT DO
 - Ignore errors (avoid _ assignment without justification)
diff --git a/.agents/skills/golang-pro/references/wpd-message-gateway.md b/.agents/skills/golang-pro/references/wpd-message-gateway.md
index c3c3be72..cb6dd743 100644
--- a/.agents/skills/golang-pro/references/wpd-message-gateway.md
+++ b/.agents/skills/golang-pro/references/wpd-message-gateway.md
@@ -29,7 +29,7 @@ Router → Middleware → Handler → Service → Port ← Repository / Provider
 | Port | `internal/core/port/` | domain, `pkg/contracts` | implementations |
 | Service | `internal/core/service/` | port, domain, `pkg/contracts`, `pkg/registry` | SQL, HTTP, Echo |
 | Infrastructure | `internal/infrastructure/` | port, domain | presentation |
-| Presentation | `internal/presentation/` | service, port, domain | direct SQL |
+| Presentation | `internal/presentation/` | service, port, domain, **dto** | direct SQL; **inline HTTP DTOs in handlers**; **passing dto to port/repo** |
 | Public SDK | `pkg/*` | `pkg/*` only | `internal/*` |
 
 Sender interfaces (`EmailSender`, `SMSSender`, …) live in **`pkg/contracts/`**, not `internal/core/port/`.
@@ -60,6 +60,7 @@ Do **not** add providers under `internal/infrastructure/provider/` (deprecated).
 - Wrap with `fmt.Errorf("…: %w", err)`
 - Domain/port sentinels: `port.ErrNotFound`, `port.ErrConflict`, etc.
 - Handlers: generic messages on 500; full error in slog only (`send_helper.go` pattern)
+- **HTTP DTOs:** live in **`internal/presentation/dto/`** — never in handlers. Outbound: **`dto.XFromDomain(domain.Y)`** package funcs. Inbound: **`(r R) ToDomain()`** (→ `domain.*`) or **`ToPatch()`** (→ `service.*Patch`). **Ports/repos use `domain.*` only** — never import or accept `dto.*` (see `docs/backend/code-conventions.md`).
 
 ### Concurrency
 
@@ -106,7 +107,7 @@ wpd-message-gateway/
 │   ├── app/              # wire, imports, config
 │   ├── core/             # domain, port, service
 │   ├── infrastructure/   # postgres repos, logger, inbox store
-│   └── presentation/     # router, handlers, middleware
+│   └── presentation/     # router, handlers, middleware, dto/
 ├── pkg/
 │   ├── contracts/        # message types + sender interfaces
 │   ├── gateway/          # embedded SDK
diff --git a/.claude/commands/smell.md b/.claude/commands/smell.md
index 8333c987..dcd750e6 100644
--- a/.claude/commands/smell.md
+++ b/.claude/commands/smell.md
@@ -104,8 +104,8 @@ Router → Middleware → Handler → Service → Port ← Repository / Provider
 | `internal/core/domain/` | Imports Echo, HTTP, infra, presentation, or contains struct tags (`json`, `db`) |
 | `internal/core/port/` | Contains implementation instead of interfaces |
 | `internal/core/service/` | Direct SQL/HTTP; missing `ctx`; orchestration left in handler |
-| `internal/infrastructure/` | Business rules; bypasses port interfaces |
-| `internal/presentation/` | Business logic; handler → repository without service; RBAC in handler instead of middleware |
+| `internal/infrastructure/` | Business rules; bypasses port interfaces; imports `presentation/dto` |
+| `internal/presentation/` | Business logic; handler → repository without service; RBAC in handler instead of middleware; **request/response structs or JSON mappers in `handler/*.go`** |
 | `pkg/gateway`, `pkg/contracts` | Imports `internal/*`; embedded SDK requires PostgreSQL |
 | Providers | No `init()` registration or missing blank import in `internal/app/imports.go` |
 | Auth | Portal mutations without JWT + `RequirePermission`; internal ingest open outside local dev |
@@ -184,6 +184,8 @@ Do not invent issues. If the diff is clean, say so.
 | MGW.MIGRATION | Migration hygiene failure |
 | MGW.LOG-SECRET | Secrets or PII in logs |
 | MGW.N+1-QUERY | Query inside a loop |
+| MGW.HANDLER-DTO | HTTP struct or mapper (`XFromDomain` / `ToDomain` / `ToPatch`) in `handler/*.go` instead of `presentation/dto/` |
+| MGW.DTO-IN-REPO | Repository or port interface accepts `presentation/dto.*` instead of `domain.*` |
 | MGW.GOROUTINE-LEAK | Goroutine without lifecycle control |
 
 **Frontend**
diff --git a/database/migrations/20260318000000_init_gateway.up.sql b/database/migrations/20260318000000_init_gateway.up.sql
index 82cbd7f0..acabc0aa 100644
--- a/database/migrations/20260318000000_init_gateway.up.sql
+++ b/database/migrations/20260318000000_init_gateway.up.sql
@@ -264,6 +264,7 @@ CREATE TABLE message_request_logs (
     request_id    VARCHAR(64),
     duration_ms   INT          CHECK (duration_ms >= 0),
     error_message TEXT,
+    inbox_message_id UUID,
     created_at    TIMESTAMPTZ  NOT NULL DEFAULT NOW()
 );
 
@@ -281,6 +282,10 @@ CREATE INDEX idx_message_request_logs_workspace_api_created
 CREATE INDEX idx_message_request_logs_workspace_channel_created
     ON message_request_logs (workspace_id, channel_type, created_at DESC);
 
+CREATE INDEX idx_message_request_logs_workspace_inbox_message
+    ON message_request_logs (workspace_id, inbox_message_id)
+    WHERE inbox_message_id IS NOT NULL;
+
 -- ==============================================================================
 -- 11.5. MESSAGE_REQUEST_PAYLOADS TABLE (Append-only body storage)
 -- ==============================================================================
diff --git a/docs/agents/delivery-agent.md b/docs/agents/delivery-agent.md
index 622908a4..aed90fd2 100644
--- a/docs/agents/delivery-agent.md
+++ b/docs/agents/delivery-agent.md
@@ -16,7 +16,7 @@ Orchestration note: the **[master-agent](./master-agent.md)** classifies request
 - **Traceability:** Before multi-file edits, state a **short plan** (files/areas + verification). After edits, summarize **what changed** and **how it was verified**.
 - **Bounded retries:** If [verification](./verification.md) fails twice for the **same** mistake class, **stop**, re-read output, and **narrow scope** instead of looping.
 - **No secret material (Data Exposure limits):** Do not echo or commit API keys, JWTs, or pasted credentials. **Hard requirement:** Any code generating secrets must use crypto-safe `crypto/rand`, and secrets must exclusively live in ENV or hashed in Postgres.
-- **Engineering principles (implement time):** Apply **KISS** (smallest correct diff), **DRY** (extract on second duplication), **DDD** (domain constants/types in `internal/core/domain/` + FE `*.types.ts`), **SOLID** (thin handlers, services orchestrate, ports for I/O). Remove dead code and stale comments/docs you touch — do not leave refactor debris.
+- **Engineering principles (implement time):** Apply **KISS**, **DRY**, **DDD**, **SOLID**. Portal HTTP shapes in **`internal/presentation/dto/`**; map to **`domain.*`** before calling services — **never pass DTOs to repositories**.
 - **Comments:** Add only when behavior is non-obvious; delete comments that restate code or became wrong after your edit.
 
 ## 1. Safety & Robustness Pre-Check
diff --git a/docs/agents/review-agent.md b/docs/agents/review-agent.md
index 299c8044..c71f6804 100644
--- a/docs/agents/review-agent.md
+++ b/docs/agents/review-agent.md
@@ -68,6 +68,7 @@ Derived from [backend-engineer.md](../backend/backend-engineer.md) and [code-con
 - [ ] **Database Schema**: If columns/tables changed, the DB diagram and relative docs must be updated.
 - [ ] **Robustness & Scalability**: No goroutine leaks.
 - [ ] **Tests**: Table-driven tests covering **edge cases** and **expected failures**.
+- [ ] **Presentation DTOs**: Types/mappers in `internal/presentation/dto/`; **`domain.*` only** on port/repo interfaces (`MGW.HANDLER-DTO`, `MGW.DTO-IN-REPO`).
 - [ ] **Principles**: Domain constants for statuses/enums; no handler business rules; no `pkg`→`internal` (`DDD.VALUE-TYPE`, `DDD.LAYER`, `SOLID.DIP`).
 
 ## 4. Frontend review checklist
diff --git a/docs/backend/architecture.md b/docs/backend/architecture.md
index befdcf52..1b3f2ecd 100644
--- a/docs/backend/architecture.md
+++ b/docs/backend/architecture.md
@@ -186,7 +186,7 @@ Portal accounts use **email + password** (passwords are stored hashed). All mana
 The core service layer decouples from `wpd-gogate` by depending on the `port.AuthorizationGate` interface. The implementation adapter lives in `internal/infrastructure/authgate/gate_adapter.go`.
 
 - **admin**: Full read/write access to settings, integrations, templates, API keys, and member removal. Assigned automatically to the creator of a workspace.
-- **member**: Read-only access to workspaces, settings, templates, API keys, plus permission to send test messages (`send.test`).
+- **member**: Read-only access to workspaces, settings, templates, API keys, plus inbox management (`send.test`).
 
 Public workspaces (`is_private = false`) are dynamically accessible to any authenticated user as a `"viewer"` with read-only permissions (i.e. `*.read` operations are bypassed and approved automatically without requiring explicit membership or Casbin checks). All write operations on public workspaces remain strictly restricted to workspace admins.
 
@@ -456,9 +456,9 @@ The **memory provider** captures messages in process RAM. It's always available
 
 The React Portal runs at `portal.ui_port` (default **10104**) when the server starts.
 
-**Portal UI today:** sign in, list workspaces, manage **integrations**, **settings** (general, API keys, message dispatch), view message logs, send test messages.
+**Portal UI today:** sign in, list workspaces, manage **integrations**, **settings** (general, API keys, message dispatch), view message logs, browse captured **email inbox**.
 
-**REST only (no UI pages yet):** workspace create, templates, members, memory inbox browser.
+**REST only (no UI pages yet):** workspace create, templates, members, SMS/push/chat inbox browser.
 
 ---
 
diff --git a/docs/backend/code-conventions.md b/docs/backend/code-conventions.md
index f11b9796..e247f6bc 100644
--- a/docs/backend/code-conventions.md
+++ b/docs/backend/code-conventions.md
@@ -17,7 +17,8 @@ internal/           # Private application code (HTTP server mode)
 │   ├── logger/     # Structured logging
 │   └── repository/ # Postgres repositories
 └── presentation/   # HTTP layer
-    ├── handler/    # Request handlers
+    ├── dto/          # Request/response shapes + domain→JSON mappers (never in handler/)
+    ├── handler/    # Request handlers (thin: bind DTO → service → DTO)
     └── middleware/ # Auth, JWT, inbox API key
 
 pkg/                # Public packages (embedded SDK + shared contracts)
@@ -212,3 +213,53 @@ import (
 ```
 
 Use `goimports -local github.com/weprodev/wpd-message-gateway` to auto-format.
+
+## HTTP DTOs (presentation layer)
+
+**Never** define request/response structs in `handler/*.go`. HTTP JSON shapes belong in **`internal/presentation/dto/`** — one file per resource (e.g. `api_key.go`, `integration.go`).
+
+| Do | Don't |
+| -- | ----- |
+| `dto.CreateAPIKeyRequest` in handler bind | `type createAPIKeyBody struct` in handler |
+| `dto.IntegrationFromDomain(intg)` | `integrationToJSON` helper in handler |
+| Exported PascalCase names (`LoginRequest`) | Unexported `*Body` suffix types in handler |
+| Pass `domain.*` to services/repositories | Pass `dto.*` to services or repositories |
+
+### Data flow (DTOs stop at the handler boundary)
+
+Repositories and port interfaces speak **domain only** — never presentation DTOs.
+
+```
+Inbound:  JSON → handler.Bind(dto.Request) → req.ToDomain() → domain.* → Service → Port → Repository
+Outbound: Repository → domain.* → Service → handler → dto.XFromDomain(domain.*) → JSON
+Partial:  JSON → dto.PatchRequest → req.ToPatch() → service.*Patch → Service (load domain, apply, save)
+```
+
+| Layer | Types it uses | Maps how |
+| ----- | ------------- | -------- |
+| **Handler** | `dto.*` | Bind JSON; call `ToDomain` / `ToPatch`; call `XFromDomain` before `c.JSON` |
+| **Service** | `domain.*`, `service.*Patch` | Business rules; orchestrates ports |
+| **Port / Repository** | `domain.*` | Postgres adapters scan rows ↔ domain structs |
+| **Infrastructure** | `domain.*` | No `json` tags required; no import of `presentation/dto` |
+
+**Never send DTOs to a repository.** If a handler has a `dto.CreateTemplateRequest`, call `body.ToDomain(wid)` first, then pass the resulting `*domain.Template` to `PortalService.CreateTemplate`, which passes it to the template repository port. The repository interface looks like:
+
+```go
+Create(ctx context.Context, t *domain.Template) error  // port — domain only
+```
+
+Gateway `/v1/*` handlers may bind **`pkg/contracts`** types directly — those are the public SDK message API, not portal DTOs.
+
+### Mapping convention (idiomatic Go)
+
+| Direction | Style | Example |
+| --------- | ----- | ------- |
+| Domain → response DTO | Package func `{Type}FromDomain` | `dto.APIKeyPublicFromDomain(k)` |
+| Request DTO → domain (create/upsert) | Value-receiver method `ToDomain()` | `body.ToDomain(wid)` |
+| Request DTO → partial update | Value-receiver method `ToPatch()` | `body.ToPatch()` → `service.WorkspacePatch` |
+
+Use **`{Type}FromDomain`** package functions for outbound mapping (not methods on a zero-value receiver). Use **`ToDomain()`** on request DTOs when the result is a **`domain.*`** entity for persistence. Use **`ToPatch()`** when the result is a **service patch command** (service loads domain, applies fields, saves via repository).
+
+**Not infrastructure:** DTOs are presentation concerns (JSON field names, omitempty). `internal/infrastructure/` maps DB rows to **domain**, not HTTP.
+
+New or changed portal endpoints: add/update types in `dto/` and colocate mapper tests (`dto/*_test.go`) when mapping logic is non-trivial.
diff --git a/docs/backend/usage.md b/docs/backend/usage.md
index 35698c13..39263984 100644
--- a/docs/backend/usage.md
+++ b/docs/backend/usage.md
@@ -320,7 +320,7 @@ result, err := gw.SendChat(ctx, &contracts.ChatMessage{
 
 ### Portal REST API (JWT auth)
 
-Routes registered in `internal/presentation/router.go`. **Portal UI pages exist only for auth, workspace list, message logs, and send test** — other management routes are REST-only until UI is built.
+Routes registered in `internal/presentation/router.go`. **Portal UI pages exist for auth, workspace list, message logs, email inbox, integrations, and settings** — other management routes are REST-only until UI is built.
 
 #### Auth
 
@@ -337,7 +337,6 @@ Routes registered in `internal/presentation/router.go`. **Portal UI pages exist
 |--------|----------|:---------:|-------------|
 | GET | `/api/v1/workspaces` | ✓ | List workspaces for the logged-in user |
 | GET | `/api/v1/workspaces/:wid/logs` | ✓ | Message request logs (optionally filter by `channel`) |
-| POST | `/api/v1/workspaces/:wid/send-test/:channel` | ✓ | Send test via gateway (`email` / `sms` / `push` / `chat`) |
 
 #### Workspace provisioning & management (REST only — no Portal UI)
 
@@ -349,7 +348,7 @@ Workspace-scoped routes require a valid portal JWT and are governed by a Role-Ba
 
 Roles and permissions are defined in [permission.go](../../internal/core/domain/permission.go):
 - **admin**: Full read/write access. The creator of a workspace is automatically assigned this role (as `admin` in both members repository and `gogate`).
-- **member**: Read-only access to workspaces, members, API keys, logs, integrations, templates, settings, and invitations, plus the ability to send test messages (`send.test`).
+- **member**: Read-only access to workspaces, members, API keys, logs, integrations, templates, settings, and invitations, plus inbox management (`send.test`).
 
 To bootstrap roles and permissions, make sure you run the database seeds:
 1. Run `database/seeds/001_seed_permissions.sql` to populate roles (`admin`, `member`), default permissions, and role-to-permission mappings.
diff --git a/frontend/src/core/router/routes.ts b/frontend/src/core/router/routes.ts
index 1fcea2a5..e03d63a6 100644
--- a/frontend/src/core/router/routes.ts
+++ b/frontend/src/core/router/routes.ts
@@ -7,6 +7,8 @@ export const ROUTES = {
     pattern: "/workspaces/:wid",
     overview: (workspaceId: string) => `/workspaces/${workspaceId}/overview`,
     email: (workspaceId: string) => `/workspaces/${workspaceId}/email`,
+    emailWithMessage: (workspaceId: string, messageId: string) =>
+      `/workspaces/${workspaceId}/email?message=${encodeURIComponent(messageId)}`,
     emailTemplates: (workspaceId: string) => `/workspaces/${workspaceId}/email/templates`,
     sms: (workspaceId: string) => `/workspaces/${workspaceId}/sms`,
     push: (workspaceId: string) => `/workspaces/${workspaceId}/push`,
diff --git a/frontend/src/features/inbox/components/email-content/email-content.tsx b/frontend/src/features/inbox/components/email-content/email-content.tsx
index d36b9c97..cd91dc97 100644
--- a/frontend/src/features/inbox/components/email-content/email-content.tsx
+++ b/frontend/src/features/inbox/components/email-content/email-content.tsx
@@ -27,8 +27,8 @@ function formatFullTime(dateStr: string) {
 export function EmailContent({ message, onDelete, isDeleting = false }: EmailContentProps) {
   const sender = message.email.from_name
     ? `${message.email.from_name} <${message.email.from}>`
-    : message.email.from || "Unknown Sender"
-  
+    : message.email.from || "Unknown sender"
+
   const recipients = (message.email.to || []).join(", ")
   const formattedDate = formatFullTime(message.created_at)
 
@@ -48,7 +48,7 @@ export function EmailContent({ message, onDelete, isDeleting = false }: EmailCon
             {message.email.subject || "(No Subject)"}
           </h2>
           <p className="text-xs text-text-secondary truncate">
-            {sender} • {formattedDate}
+            To: {recipients || "—"} • {formattedDate}
           </p>
         </div>
 
diff --git a/frontend/src/features/inbox/components/email-item/email-item.test.tsx b/frontend/src/features/inbox/components/email-item/email-item.test.tsx
index a204fab3..17c857d8 100644
--- a/frontend/src/features/inbox/components/email-item/email-item.test.tsx
+++ b/frontend/src/features/inbox/components/email-item/email-item.test.tsx
@@ -21,7 +21,7 @@ const mockEmail = {
 describe("EmailItem Component", () => {
   it("renders correctly with email properties", () => {
     render(<EmailItem message={mockEmail} isSelected={false} onClick={vi.fn()} />)
-    expect(screen.getByText("John Doe")).toBeInTheDocument()
+    expect(screen.getByText("recipient@example.com")).toBeInTheDocument()
     expect(screen.getByText("Test Subject")).toBeInTheDocument()
     expect(screen.getByText("This is the body snippet of the test email.")).toBeInTheDocument()
   })
diff --git a/frontend/src/features/inbox/components/email-item/email-item.tsx b/frontend/src/features/inbox/components/email-item/email-item.tsx
index c3746504..5e995429 100644
--- a/frontend/src/features/inbox/components/email-item/email-item.tsx
+++ b/frontend/src/features/inbox/components/email-item/email-item.tsx
@@ -6,10 +6,15 @@ interface EmailItemProps {
   onClick: () => void
 }
 
-function getSenderInitial(nameOrEmail: string) {
-  if (!nameOrEmail) return "?"
-  const cleaned = nameOrEmail.trim()
-  return cleaned[0].toUpperCase()
+function formatRecipients(to: string[] | undefined) {
+  if (!to || to.length === 0) return "Unknown recipient"
+  return to.join(", ")
+}
+
+function getRecipientInitial(recipient: string) {
+  if (!recipient) return "?"
+  const cleaned = recipient.trim()
+  return cleaned[0]?.toUpperCase() ?? "?"
 }
 
 function formatTime(dateStr: string) {
@@ -26,8 +31,8 @@ function formatTime(dateStr: string) {
 }
 
 export function EmailItem({ message, isSelected, onClick }: EmailItemProps) {
-  const senderName = message.email.from_name || message.email.from || "Unknown Sender"
-  const initial = getSenderInitial(senderName)
+  const recipientLabel = formatRecipients(message.email.to)
+  const initial = getRecipientInitial(message.email.to?.[0] ?? recipientLabel)
   const timestamp = formatTime(message.created_at)
   
   const snippet = message.email.plain_text || message.email.html || message.email.subject || ""
@@ -57,7 +62,7 @@ export function EmailItem({ message, isSelected, onClick }: EmailItemProps) {
             {initial}
           </div>
           <span className="text-sm font-semibold text-foreground truncate">
-            {senderName}
+            {recipientLabel}
           </span>
         </div>
         <span className="text-xs text-text-tertiary shrink-0 font-medium">
diff --git a/frontend/src/features/inbox/components/email-list/email-list.test.tsx b/frontend/src/features/inbox/components/email-list/email-list.test.tsx
index 9b94f21d..29605e05 100644
--- a/frontend/src/features/inbox/components/email-list/email-list.test.tsx
+++ b/frontend/src/features/inbox/components/email-list/email-list.test.tsx
@@ -26,6 +26,6 @@ describe("EmailList Component", () => {
     expect(screen.getByText("Inbox")).toBeInTheDocument()
     expect(screen.getByText("1")).toBeInTheDocument()
     expect(screen.getByPlaceholderText("Search inbox...")).toBeInTheDocument()
-    expect(screen.getByText("John Doe")).toBeInTheDocument()
+    expect(screen.getByText("recipient@example.com")).toBeInTheDocument()
   })
 })
diff --git a/frontend/src/features/inbox/components/email-list/email-list.tsx b/frontend/src/features/inbox/components/email-list/email-list.tsx
index 8baf8c38..ab5f297b 100644
--- a/frontend/src/features/inbox/components/email-list/email-list.tsx
+++ b/frontend/src/features/inbox/components/email-list/email-list.tsx
@@ -26,8 +26,9 @@ export function EmailList({
   const filtered = messages.filter((msg) => {
     const q = searchQuery.toLowerCase()
     const subject = (msg.email.subject || "").toLowerCase()
+    const recipients = (msg.email.to || []).join(" ").toLowerCase()
     const sender = (msg.email.from_name || msg.email.from || "").toLowerCase()
-    return subject.includes(q) || sender.includes(q)
+    return subject.includes(q) || recipients.includes(q) || sender.includes(q)
   })
 
   return (
diff --git a/frontend/src/features/inbox/components/get-started-dialog/get-started-dialog.stories.tsx b/frontend/src/features/inbox/components/get-started-dialog/get-started-dialog.stories.tsx
new file mode 100644
index 00000000..5802a311
--- /dev/null
+++ b/frontend/src/features/inbox/components/get-started-dialog/get-started-dialog.stories.tsx
@@ -0,0 +1,27 @@
+import type { Meta, StoryObj } from "@storybook/react-vite"
+import { MemoryRouter } from "react-router-dom"
+
+import { GetStartedDialog } from "./get-started-dialog"
+
+const meta = {
+  title: "Features/Inbox/GetStartedDialog",
+  component: GetStartedDialog,
+  decorators: [
+    (Story) => (
+      <MemoryRouter>
+        <Story />
+      </MemoryRouter>
+    ),
+  ],
+} satisfies Meta<typeof GetStartedDialog>
+
+export default meta
+type Story = StoryObj<typeof meta>
+
+export const Open: Story = {
+  args: {
+    open: true,
+    onOpenChange: () => undefined,
+    workspaceId: "ws-demo",
+  },
+}
diff --git a/frontend/src/features/inbox/components/get-started-dialog/get-started-dialog.tsx b/frontend/src/features/inbox/components/get-started-dialog/get-started-dialog.tsx
new file mode 100644
index 00000000..d404e653
--- /dev/null
+++ b/frontend/src/features/inbox/components/get-started-dialog/get-started-dialog.tsx
@@ -0,0 +1,67 @@
+import { Link } from "react-router-dom"
+
+import { Button } from "@/components/ui/button"
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+} from "@/components/ui/dialog"
+import { ROUTES } from "@/core/router/routes"
+
+interface GetStartedDialogProps {
+  open: boolean
+  onOpenChange: (open: boolean) => void
+  workspaceId?: string
+}
+
+export function GetStartedDialog({ open, onOpenChange, workspaceId }: GetStartedDialogProps) {
+  const settingsPath = workspaceId ? ROUTES.workspace.settings(workspaceId) : ROUTES.workspaces
+
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      <DialogContent className="max-h-[85vh] max-w-lg gap-0 overflow-hidden p-0">
+        <DialogHeader className="border-b bg-muted/20 px-5 py-4 text-left">
+          <DialogTitle>Get started</DialogTitle>
+          <DialogDescription>
+            Send messages through the same gateway endpoints your integrations use in production.
+          </DialogDescription>
+        </DialogHeader>
+        <div className="flex flex-col gap-4 overflow-y-auto p-6 text-sm text-foreground">
+          <p className="text-xs leading-relaxed text-text-secondary">
+            Create an API key in{" "}
+            <Link to={settingsPath} className="font-semibold text-primary-brand hover:underline">
+              Settings
+            </Link>
+            , then authenticate each request with Basic auth and your workspace slug header.
+          </p>
+          <div className="flex flex-col gap-3">
+            <div>
+              <h4 className="mb-1 text-xs font-bold uppercase text-text-secondary">Email</h4>
+              <pre className="overflow-x-auto rounded-md border bg-muted/80 p-2.5 font-mono text-xs whitespace-pre-wrap">{`curl -X POST http://localhost:10101/v1/email \\
+  -u "client_id:client_secret" \\
+  -H "X-Workspace-Key: your-workspace-slug" \\
+  -H "Content-Type: application/json" \\
+  -d '{"to":["user@example.com"],"subject":"Test","html":"<p>Hi</p>"}'`}</pre>
+            </div>
+            <div>
+              <h4 className="mb-1 text-xs font-bold uppercase text-text-secondary">SMS</h4>
+              <pre className="overflow-x-auto rounded-md border bg-muted/80 p-2.5 font-mono text-xs whitespace-pre-wrap">{`curl -X POST http://localhost:10101/v1/sms \\
+  -u "client_id:client_secret" \\
+  -H "X-Workspace-Key: your-workspace-slug" \\
+  -H "Content-Type: application/json" \\
+  -d '{"to":["+1234567890"],"message":"Hello"}'`}</pre>
+            </div>
+          </div>
+        </div>
+        <DialogFooter className="border-t bg-muted/20 px-5 py-4">
+          <Button type="button" onClick={() => onOpenChange(false)}>
+            Close
+          </Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  )
+}
diff --git a/frontend/src/features/inbox/components/get-started-dialog/index.ts b/frontend/src/features/inbox/components/get-started-dialog/index.ts
new file mode 100644
index 00000000..989854b9
--- /dev/null
+++ b/frontend/src/features/inbox/components/get-started-dialog/index.ts
@@ -0,0 +1 @@
+export { GetStartedDialog } from "./get-started-dialog"
diff --git a/frontend/src/features/inbox/components/send-test-modal/index.ts b/frontend/src/features/inbox/components/send-test-modal/index.ts
deleted file mode 100644
index cb31fba5..00000000
--- a/frontend/src/features/inbox/components/send-test-modal/index.ts
+++ /dev/null
@@ -1 +0,0 @@
-export * from "./send-test-modal"
diff --git a/frontend/src/features/inbox/components/send-test-modal/send-test-modal.stories.tsx b/frontend/src/features/inbox/components/send-test-modal/send-test-modal.stories.tsx
deleted file mode 100644
index bdee6290..00000000
--- a/frontend/src/features/inbox/components/send-test-modal/send-test-modal.stories.tsx
+++ /dev/null
@@ -1,45 +0,0 @@
-import type { Meta, StoryObj } from "@storybook/react-vite"
-import { useState } from "react"
-
-import { Button } from "@/components/ui/button"
-import { SendTestModal } from "./send-test-modal"
-
-const meta = {
-  title: "Features/Inbox/SendTestModal",
-  component: SendTestModal,
-  tags: ["autodocs"],
-  parameters: { layout: "centered" },
-} satisfies Meta<typeof SendTestModal>
-
-export default meta
-
-type Story = StoryObj<typeof meta>
-
-function SendTestModalDemo() {
-  const [open, setOpen] = useState(true)
-  return (
-    <>
-      <Button type="button" onClick={() => setOpen(true)}>
-        Open send test
-      </Button>
-      <SendTestModal
-        workspaceId="00000000-0000-0000-0000-000000000001"
-        open={open}
-        onOpenChange={setOpen}
-        onSent={() => undefined}
-        initialChannel="email"
-      />
-    </>
-  )
-}
-
-export const EmailChannel: Story = {
-  render: () => <SendTestModalDemo />,
-  args: {
-    workspaceId: "00000000-0000-0000-0000-000000000001",
-    open: true,
-    onOpenChange: () => undefined,
-    onSent: () => undefined,
-    initialChannel: "email",
-  },
-}
diff --git a/frontend/src/features/inbox/components/send-test-modal/send-test-modal.test.tsx b/frontend/src/features/inbox/components/send-test-modal/send-test-modal.test.tsx
deleted file mode 100644
index b563a3bf..00000000
--- a/frontend/src/features/inbox/components/send-test-modal/send-test-modal.test.tsx
+++ /dev/null
@@ -1,23 +0,0 @@
-import { render, screen } from "@testing-library/react"
-import { describe, expect, it, vi } from "vitest"
-
-import { SendTestModal } from "./send-test-modal"
-
-vi.mock("../../inbox.api", () => ({
-  sendTestRequest: vi.fn(),
-}))
-
-describe("SendTestModal Component", () => {
-  it("renders correctly when open", () => {
-    render(
-      <SendTestModal
-        workspaceId="w1"
-        open={true}
-        onOpenChange={vi.fn()}
-        onSent={vi.fn()}
-      />
-    )
-    expect(screen.getByText("Send Test Request")).toBeInTheDocument()
-    expect(screen.getByLabelText("To (comma-separated)")).toBeInTheDocument()
-  })
-})
diff --git a/frontend/src/features/inbox/components/send-test-modal/send-test-modal.tsx b/frontend/src/features/inbox/components/send-test-modal/send-test-modal.tsx
deleted file mode 100644
index 5491f047..00000000
--- a/frontend/src/features/inbox/components/send-test-modal/send-test-modal.tsx
+++ /dev/null
@@ -1,223 +0,0 @@
-import { useState } from "react"
-import { Icon } from "@/components/ui/icon"
-import { Button } from "@/components/ui/button"
-import { Input } from "@/components/ui/input"
-import {
-  Dialog,
-  DialogContent,
-  DialogDescription,
-  DialogFooter,
-  DialogHeader,
-  DialogTitle,
-} from "@/components/ui/dialog"
-import { sendTestRequest } from "../../inbox.api"
-import type { MessageChannel } from "../../inbox.types"
-
-interface SendTestModalProps {
-  workspaceId: string
-  open: boolean
-  onOpenChange: (open: boolean) => void
-  onSent: () => void
-  initialChannel?: MessageChannel
-}
-
-export function SendTestModal({
-  workspaceId,
-  open,
-  onOpenChange,
-  onSent,
-  initialChannel = "email",
-}: SendTestModalProps) {
-  const [channel, setChannel] = useState<MessageChannel>(initialChannel)
-  const [to, setTo] = useState("")
-  const [subject, setSubject] = useState("")
-  const [body, setBody] = useState("")
-  const [html, setHtml] = useState("")
-  const [isLoading, setIsLoading] = useState(false)
-  const [error, setError] = useState<string | null>(null)
-
-  const handleSubmit = async (e: React.FormEvent) => {
-    e.preventDefault()
-    setIsLoading(true)
-    setError(null)
-
-    let payload: Record<string, unknown> = {}
-    if (channel === "email") {
-      payload = {
-        to: to.split(",").map((s) => s.trim()),
-        subject,
-        html,
-      }
-    } else if (channel === "sms") {
-      payload = { to, body }
-    } else if (channel === "push") {
-      payload = { to, title: subject, body }
-    } else if (channel === "chat") {
-      payload = { to, body }
-    }
-
-    const res = await sendTestRequest(workspaceId, channel, payload)
-    setIsLoading(false)
-
-    if (!res.ok) {
-      setError(res.message ?? "Failed to trigger test request")
-    } else {
-      onSent()
-      onOpenChange(false)
-    }
-  }
-
-  const handleChannelChange = (newChannel: "email" | "sms" | "push" | "chat") => {
-    setChannel(newChannel)
-    setError(null)
-    if (newChannel === "email") {
-      setTo("user@example.com")
-      setSubject("Welcome to Message Gateway!")
-    } else if (newChannel === "sms") {
-      setTo("+15551234567")
-      setBody("This is a test SMS message.")
-    } else if (newChannel === "push") {
-      setTo("device-token-12345")
-      setSubject("New Notification")
-      setBody("This is a test push notification.")
-    } else if (newChannel === "chat") {
-      setTo("slack-channel-id")
-      setBody("Hello from the Chat API!")
-    }
-  }
-
-  return (
-    <Dialog open={open} onOpenChange={onOpenChange}>
-      <DialogContent className="max-w-md gap-0 p-0 overflow-hidden">
-        <DialogHeader className="border-b px-5 py-4 bg-muted/20 text-left">
-          <DialogTitle>Send Test Request</DialogTitle>
-          <DialogDescription>Trigger a gateway send for your workspace.</DialogDescription>
-        </DialogHeader>
-
-        <form onSubmit={handleSubmit} className="flex flex-col">
-          <div className="flex flex-col gap-4 p-5 max-h-[70vh] overflow-y-auto">
-            {error && (
-              <div
-                role="alert"
-                className="flex items-center gap-2 rounded-lg border border-destructive/20 bg-destructive/10 p-3 text-xs text-destructive"
-              >
-                <Icon name="error" size="sm" className="shrink-0 text-destructive" />
-                <span>{error}</span>
-              </div>
-            )}
-
-            <div className="flex flex-col gap-1.5">
-              <span className="text-xs font-semibold uppercase text-muted-foreground">Channel</span>
-              <div className="grid grid-cols-4 gap-1 rounded-lg bg-muted p-1">
-                {(["email", "sms", "push", "chat"] as const).map((ch) => (
-                  <button
-                    key={ch}
-                    type="button"
-                    onClick={() => handleChannelChange(ch)}
-                    className={`rounded-md py-1.5 text-xs font-medium capitalize transition-all ${
-                      channel === ch
-                        ? "bg-card text-foreground shadow-xs"
-                        : "text-muted-foreground hover:text-foreground"
-                    }`}
-                  >
-                    {ch}
-                  </button>
-                ))}
-              </div>
-            </div>
-
-            <div className="flex flex-col gap-1.5">
-              <label htmlFor="send-test-to" className="text-xs font-semibold uppercase text-muted-foreground">
-                {channel === "email" ? "To (comma-separated)" : "Recipient (To)"}
-              </label>
-              <Input
-                id="send-test-to"
-                required
-                aria-invalid={error ? true : undefined}
-                placeholder={
-                  channel === "email"
-                    ? "user@example.com, another@example.com"
-                    : channel === "sms"
-                      ? "+15551234567"
-                      : "recipient-id"
-                }
-                value={to}
-                onChange={(e) => setTo(e.target.value)}
-                className="bg-background text-sm"
-              />
-            </div>
-
-            {(channel === "email" || channel === "push") && (
-              <div className="flex flex-col gap-1.5">
-                <label htmlFor="send-test-subject" className="text-xs font-semibold uppercase text-muted-foreground">
-                  {channel === "email" ? "Subject" : "Notification Title"}
-                </label>
-                <Input
-                  id="send-test-subject"
-                  required
-                  placeholder={channel === "email" ? "Subject line" : "Title text"}
-                  value={subject}
-                  onChange={(e) => setSubject(e.target.value)}
-                  className="bg-background text-sm"
-                />
-              </div>
-            )}
-
-            {channel === "email" && (
-              <div className="flex flex-col gap-1.5">
-                <label htmlFor="send-test-html" className="text-xs font-semibold uppercase text-muted-foreground">
-                  HTML Content
-                </label>
-                <textarea
-                  id="send-test-html"
-                  required
-                  rows={4}
-                  placeholder="<h1>HTML...</h1>"
-                  value={html}
-                  onChange={(e) => setHtml(e.target.value)}
-                  className="w-full rounded-lg border border-input bg-background px-3 py-2 font-mono text-sm focus-visible:outline-hidden focus-visible:ring-2 focus-visible:ring-ring"
-                />
-              </div>
-            )}
-
-            {channel !== "email" && (
-              <div className="flex flex-col gap-1.5">
-                <label htmlFor="send-test-body" className="text-xs font-semibold uppercase text-muted-foreground">
-                  Message Body
-                </label>
-                <textarea
-                  id="send-test-body"
-                  required
-                  rows={3}
-                  placeholder="Enter message..."
-                  value={body}
-                  onChange={(e) => setBody(e.target.value)}
-                  className="w-full rounded-lg border border-input bg-background px-3 py-2 text-sm focus-visible:outline-hidden focus-visible:ring-2 focus-visible:ring-ring"
-                />
-              </div>
-            )}
-          </div>
-
-          <DialogFooter className="border-t bg-muted/20 px-5 py-4 sm:justify-end">
-            <Button type="button" variant="outline" onClick={() => onOpenChange(false)} disabled={isLoading}>
-              Cancel
-            </Button>
-            <Button type="submit" disabled={isLoading}>
-              {isLoading ? (
-                <>
-                  <span className="size-3.5 animate-spin rounded-full border-2 border-primary-foreground border-t-transparent" />
-                  Sending...
-                </>
-              ) : (
-                <>
-                  <Icon name="send" size="sm" data-icon="inline-start" />
-                  Send Request
-                </>
-              )}
-            </Button>
-          </DialogFooter>
-        </form>
-      </DialogContent>
-    </Dialog>
-  )
-}
diff --git a/frontend/src/features/inbox/inbox.api.ts b/frontend/src/features/inbox/inbox.api.ts
index 4e82c5f2..1c8c6e40 100644
--- a/frontend/src/features/inbox/inbox.api.ts
+++ b/frontend/src/features/inbox/inbox.api.ts
@@ -30,27 +30,6 @@ export async function fetchLogs(
   }
 }
 
-export async function sendTestRequest(
-  workspaceId: string,
-  channel: "email" | "sms" | "push" | "chat",
-  payload: Record<string, unknown>
-): Promise<{ ok: true; id: string } | { ok: false; message?: string }> {
-  try {
-    const res = await apiFetch(`/api/v1/workspaces/${workspaceId}/send-test/${channel}`, {
-      method: "POST",
-      body: JSON.stringify(payload),
-    })
-    if (!res.ok) {
-      const err = (await res.json().catch(() => ({}))) as { message?: string }
-      return { ok: false, message: err.message ?? `Failed to send test ${channel}` }
-    }
-    const data = (await res.json()) as { id: string }
-    return { ok: true, id: data.id }
-  } catch (err) {
-    return { ok: false, message: err instanceof Error ? err.message : `Failed to send test ${channel}` }
-  }
-}
-
 async function parseApiError(res: Response, fallback: string): Promise<string> {
   try {
     const err = (await res.json()) as { message?: string; error?: string }
diff --git a/frontend/src/features/inbox/inbox.types.ts b/frontend/src/features/inbox/inbox.types.ts
index 54453171..32cf07e0 100644
--- a/frontend/src/features/inbox/inbox.types.ts
+++ b/frontend/src/features/inbox/inbox.types.ts
@@ -12,6 +12,7 @@ export type LogRow = {
   request_id?: string
   duration_ms?: number
   error_message?: string
+  inbox_message_id?: string
   created_at: string
   source_name?: string
 }
diff --git a/frontend/src/features/inbox/log-display.utils.ts b/frontend/src/features/inbox/log-display.utils.ts
new file mode 100644
index 00000000..43e6947e
--- /dev/null
+++ b/frontend/src/features/inbox/log-display.utils.ts
@@ -0,0 +1,9 @@
+import type { LogRow } from "./inbox.types"
+
+export function hasInboxContent(log: LogRow) {
+  return Boolean(log.inbox_message_id)
+}
+
+export function isEmailInboxLink(log: LogRow) {
+  return log.channel_type.toLowerCase() === "email" && hasInboxContent(log)
+}
diff --git a/frontend/src/features/inbox/logs.schema.ts b/frontend/src/features/inbox/logs.schema.ts
index 5ea1f80b..da76a565 100644
--- a/frontend/src/features/inbox/logs.schema.ts
+++ b/frontend/src/features/inbox/logs.schema.ts
@@ -14,6 +14,7 @@ const logRowSchema = z.object({
   request_id: z.string().optional(),
   duration_ms: z.number().optional(),
   error_message: z.string().optional(),
+  inbox_message_id: z.string().optional(),
   created_at: z.string(),
   source_name: z.string().optional(),
   client_id: z.string().optional(),
diff --git a/frontend/src/features/inbox/pages/email-inbox.page.tsx b/frontend/src/features/inbox/pages/email-inbox.page.tsx
index 6b7870bc..6151ef7f 100644
--- a/frontend/src/features/inbox/pages/email-inbox.page.tsx
+++ b/frontend/src/features/inbox/pages/email-inbox.page.tsx
@@ -1,5 +1,5 @@
 import { useEffect, useState, useCallback } from "react"
-import { useNavigate, useParams } from "react-router-dom"
+import { useNavigate, useParams, useSearchParams } from "react-router-dom"
 
 import { Button } from "@/components/ui/button"
 import { Icon } from "@/components/ui/icon"
@@ -20,6 +20,8 @@ const PAGE_SIZE = 50
 export function EmailInboxPage() {
   const navigate = useNavigate()
   const { wid } = useParams<{ wid: string }>()
+  const [searchParams, setSearchParams] = useSearchParams()
+  const deepLinkMessageId = searchParams.get("message")
 
   const [messages, setMessages] = useState<StoredEmail[]>([])
   const [selectedMessageId, setSelectedMessageId] = useState<string | null>(null)
@@ -101,6 +103,34 @@ export function EmailInboxPage() {
     }
   }, [wid])
 
+  useEffect(() => {
+    if (!wid || !deepLinkMessageId) return
+
+    let cancelled = false
+    ;(async () => {
+      const result = await fetchInboxEmailById(wid, deepLinkMessageId)
+      if (cancelled) return
+
+      if (result.ok) {
+        setMessages((prev) => {
+          if (prev.some((m) => m.id === result.item.id)) return prev
+          return [result.item, ...prev]
+        })
+        setSelectedMessageId(deepLinkMessageId)
+      }
+
+      setSearchParams((params) => {
+        const next = new URLSearchParams(params)
+        next.delete("message")
+        return next
+      }, { replace: true })
+    })()
+
+    return () => {
+      cancelled = true
+    }
+  }, [wid, deepLinkMessageId, setSearchParams])
+
   useEffect(() => {
     if (!wid) return
 
@@ -207,7 +237,7 @@ export function EmailInboxPage() {
             Email Inbox
           </h1>
           <p className="text-sm text-text-secondary">
-            Read and test outbound emails captured by the memory provider.
+            Outbound emails captured by the gateway for review and testing.
           </p>
         </div>
 
@@ -245,7 +275,7 @@ export function EmailInboxPage() {
           </div>
           <h3 className="mb-1 text-lg font-bold text-foreground">Inbox is empty</h3>
           <p className="max-w-xs text-sm text-text-secondary">
-            Send a test email or POST to `/v1/email` to see messages captured here in real-time.
+            POST to `/v1/email` with your API key to see captured messages here in real-time.
           </p>
         </div>
       ) : (
diff --git a/frontend/src/features/inbox/pages/overview.page.tsx b/frontend/src/features/inbox/pages/overview.page.tsx
index 015124a2..ee14c872 100644
--- a/frontend/src/features/inbox/pages/overview.page.tsx
+++ b/frontend/src/features/inbox/pages/overview.page.tsx
@@ -1,20 +1,14 @@
 import { useState } from "react"
-import { useParams } from "react-router-dom"
+import { useNavigate, useParams } from "react-router-dom"
 
 import { Button } from "@/components/ui/button"
 import { Icon } from "@/components/ui/icon"
 import { SearchInput } from "@/components/ui/search-input"
-import {
-  Dialog,
-  DialogContent,
-  DialogDescription,
-  DialogFooter,
-  DialogHeader,
-  DialogTitle,
-} from "@/components/ui/dialog"
-import { SendTestModal } from "../components/send-test-modal"
+import { ROUTES } from "@/core/router/routes"
+import { GetStartedDialog } from "../components/get-started-dialog"
 import { useInboxLogs } from "../hooks/use-inbox-logs.hook"
 import type { MessageChannel, LogRow } from "../inbox.types"
+import { hasInboxContent, isEmailInboxLink } from "../log-display.utils"
 import { PageHeader } from "@/shared/components/page-header"
 
 interface OverviewPageProps {
@@ -79,10 +73,10 @@ function groupLogsByDate(logs: LogRow[]) {
 }
 
 export function OverviewPage({ channel }: OverviewPageProps) {
+  const navigate = useNavigate()
   const { wid } = useParams<{ wid: string }>()
   const { logs, total, isLoading, error, reload } = useInboxLogs(wid, channel)
-  const [isTestModalOpen, setIsTestModalOpen] = useState(false)
-  const [isDocsOpen, setIsDocsOpen] = useState(false)
+  const [isGetStartedOpen, setIsGetStartedOpen] = useState(false)
   const [searchQuery, setSearchQuery] = useState("")
 
   const filteredLogs = logs.filter((log) => {
@@ -91,12 +85,18 @@ export function OverviewPage({ channel }: OverviewPageProps) {
       (log.endpoint ?? "").toLowerCase().includes(q) ||
       (log.http_method ?? "").toLowerCase().includes(q) ||
       String(log.status_code ?? "").includes(q) ||
-      (log.source_name ?? "").toLowerCase().includes(q)
+      (log.source_name ?? "").toLowerCase().includes(q) ||
+      (log.provider_name ?? "").toLowerCase().includes(q)
     )
   })
 
   const dateGroups = groupLogsByDate(filteredLogs)
 
+  const handleLogClick = (log: LogRow) => {
+    if (!wid || !isEmailInboxLink(log) || !log.inbox_message_id) return
+    navigate(ROUTES.workspace.emailWithMessage(wid, log.inbox_message_id))
+  }
+
   return (
     <div className="flex flex-col gap-6 w-full">
       <div className="flex flex-col gap-4 sm:flex-row sm:items-start sm:justify-between">
@@ -118,9 +118,9 @@ export function OverviewPage({ channel }: OverviewPageProps) {
             Refresh
           </Button>
 
-          <Button type="button" size="sm" onClick={() => setIsTestModalOpen(true)} className="h-10">
-            <Icon name="send" size="sm" data-icon="inline-start" />
-            Send test request
+          <Button type="button" size="sm" onClick={() => setIsGetStartedOpen(true)} className="h-10">
+            <Icon name="code" size="sm" data-icon="inline-start" />
+            Get started
           </Button>
         </div>
       </div>
@@ -129,10 +129,12 @@ export function OverviewPage({ channel }: OverviewPageProps) {
         <div className="grid grid-cols-12 bg-muted/30 px-6 py-3 border-b border-border text-xs font-semibold uppercase tracking-wider text-text-secondary">
           <div className="col-span-2">Time</div>
           <div className="col-span-2">Channel</div>
-          <div className="col-span-3">Source</div>
+          <div className="col-span-2">Source</div>
           <div className="col-span-1">Method</div>
           <div className="col-span-1">Status</div>
-          <div className="col-span-3">Endpoint</div>
+          <div className="col-span-1">Provider</div>
+          <div className="col-span-1">Retained</div>
+          <div className="col-span-2">Endpoint</div>
         </div>
 
         {isLoading && logs.length === 0 ? (
@@ -155,17 +157,12 @@ export function OverviewPage({ channel }: OverviewPageProps) {
             </div>
             <h3 className="mb-1 text-lg font-bold text-foreground">No requests yet</h3>
             <p className="mb-6 max-w-xs text-sm text-text-secondary">
-              Send your first test request to see gateway logs here.
+              Send your first request via the gateway API to see logs here.
             </p>
-            <div className="flex gap-3 justify-center">
-              <Button type="button" onClick={() => setIsTestModalOpen(true)}>
-                <Icon name="send" size="sm" data-icon="inline-start" />
-                Send test request
-              </Button>
-              <Button type="button" variant="outline" onClick={() => setIsDocsOpen(true)}>
-                View API Docs
-              </Button>
-            </div>
+            <Button type="button" onClick={() => setIsGetStartedOpen(true)}>
+              <Icon name="code" size="sm" data-icon="inline-start" />
+              Get started
+            </Button>
           </div>
         ) : filteredLogs.length === 0 ? (
           <div className="flex flex-col items-center justify-center py-20 text-sm text-text-tertiary">
@@ -180,43 +177,72 @@ export function OverviewPage({ channel }: OverviewPageProps) {
                 </div>
 
                 <div className="divide-y divide-border">
-                  {group.logs.map((log) => (
-                    <div
-                      key={log.id}
-                      className="grid grid-cols-12 items-center px-6 py-3.5 text-sm transition-colors hover:bg-muted/10"
-                    >
-                      <div className="col-span-2 font-medium text-text-secondary">
-                        {formatTime(log.created_at)}
-                      </div>
+                  {group.logs.map((log) => {
+                    const clickable = isEmailInboxLink(log)
+                    return (
+                      <div
+                        key={log.id}
+                        role={clickable ? "button" : undefined}
+                        tabIndex={clickable ? 0 : undefined}
+                        onClick={() => handleLogClick(log)}
+                        onKeyDown={(e) => {
+                          if (!clickable) return
+                          if (e.key === "Enter" || e.key === " ") {
+                            e.preventDefault()
+                            handleLogClick(log)
+                          }
+                        }}
+                        className={`grid grid-cols-12 items-center px-6 py-3.5 text-sm transition-colors hover:bg-muted/10 ${
+                          clickable ? "cursor-pointer hover:bg-primary-brand/5" : ""
+                        }`}
+                      >
+                        <div className="col-span-2 font-medium text-text-secondary">
+                          {formatTime(log.created_at)}
+                        </div>
 
-                      <div className="col-span-2 flex items-center gap-2">
-                        <div className="bg-secondary rounded-md size-7 flex items-center justify-center border border-border shrink-0">
-                          <Icon name={getChannelIconName(log.channel_type)} size="sm" className="text-text-secondary" />
+                        <div className="col-span-2 flex items-center gap-2">
+                          <div className="bg-secondary rounded-md size-7 flex items-center justify-center border border-border shrink-0">
+                            <Icon name={getChannelIconName(log.channel_type)} size="sm" className="text-text-secondary" />
+                          </div>
+                          <span className="font-medium capitalize text-foreground">{log.channel_type}</span>
                         </div>
-                        <span className="font-medium capitalize text-foreground">{log.channel_type}</span>
-                      </div>
 
-                      <div className="col-span-3 text-text-secondary truncate pr-4 font-medium" title={log.source_name || "API Request"}>
-                        {log.source_name || "API Request"}
-                      </div>
+                        <div className="col-span-2 text-text-secondary truncate pr-4 font-medium" title={log.source_name || "API Request"}>
+                          {log.source_name || "API Request"}
+                        </div>
 
-                      <div className="col-span-1">
-                        <span className="font-mono text-xs font-bold text-foreground">
-                          {log.http_method || "POST"}
-                        </span>
-                      </div>
+                        <div className="col-span-1">
+                          <span className="font-mono text-xs font-bold text-foreground">
+                            {log.http_method || "POST"}
+                          </span>
+                        </div>
 
-                      <div className="col-span-1">
-                        <span className={`rounded-full px-2.5 py-0.5 text-xs font-mono ${getStatusStyle(log.status_code)}`}>
-                          {log.status_code}
-                        </span>
-                      </div>
+                        <div className="col-span-1">
+                          <span className={`rounded-full px-2.5 py-0.5 text-xs font-mono ${getStatusStyle(log.status_code)}`}>
+                            {log.status_code}
+                          </span>
+                        </div>
 
-                      <div className="col-span-3 truncate font-mono text-xs text-text-tertiary pr-2" title={log.endpoint}>
-                        {log.endpoint || `/v1/${log.channel_type}`}
+                        <div className="col-span-1 truncate text-xs font-medium text-foreground" title={log.provider_name}>
+                          {log.provider_name || "—"}
+                        </div>
+
+                        <div className="col-span-1">
+                          {hasInboxContent(log) ? (
+                            <span className="rounded-full bg-emerald-500/10 px-2 py-0.5 text-xs font-semibold text-emerald-600 dark:text-emerald-400">
+                              Yes
+                            </span>
+                          ) : (
+                            <span className="text-xs text-text-tertiary">No</span>
+                          )}
+                        </div>
+
+                        <div className="col-span-2 truncate font-mono text-xs text-text-tertiary pr-2" title={log.endpoint}>
+                          {log.endpoint || `/v1/${log.channel_type}`}
+                        </div>
                       </div>
-                    </div>
-                  ))}
+                    )
+                  })}
                 </div>
               </div>
             ))}
@@ -233,44 +259,7 @@ export function OverviewPage({ channel }: OverviewPageProps) {
         </div>
       )}
 
-      {wid && (
-        <SendTestModal
-          workspaceId={wid}
-          open={isTestModalOpen}
-          onOpenChange={setIsTestModalOpen}
-          onSent={() => void reload()}
-          initialChannel={channel}
-        />
-      )}
-
-      <Dialog open={isDocsOpen} onOpenChange={setIsDocsOpen}>
-        <DialogContent className="max-h-[85vh] max-w-lg gap-0 overflow-hidden p-0">
-          <DialogHeader className="border-b bg-muted/20 px-5 py-4 text-left">
-            <DialogTitle>API Reference</DialogTitle>
-            <DialogDescription>Integrate Message Gateway into your codebase.</DialogDescription>
-          </DialogHeader>
-          <div className="flex flex-col gap-4 overflow-y-auto p-6 text-sm text-foreground">
-            <p className="text-xs leading-relaxed text-text-secondary">
-              Attach workspace API credentials to each request. See backend usage docs for full reference.
-            </p>
-            <div className="flex flex-col gap-3">
-              <div>
-                <h4 className="mb-1 text-xs font-bold uppercase text-text-secondary">Email</h4>
-                <pre className="rounded-md border bg-muted/80 p-2.5 font-mono text-xs">{`POST /v1/email`}</pre>
-              </div>
-              <div>
-                <h4 className="mb-1 text-xs font-bold uppercase text-text-secondary">SMS</h4>
-                <pre className="rounded-md border bg-muted/80 p-2.5 font-mono text-xs">{`POST /v1/sms`}</pre>
-              </div>
-            </div>
-          </div>
-          <DialogFooter className="border-t bg-muted/20 px-5 py-4">
-            <Button type="button" onClick={() => setIsDocsOpen(false)}>
-              Close
-            </Button>
-          </DialogFooter>
-        </DialogContent>
-      </Dialog>
+      <GetStartedDialog open={isGetStartedOpen} onOpenChange={setIsGetStartedOpen} workspaceId={wid} />
     </div>
   )
 }
diff --git a/frontend/src/features/settings/pages/settings.page.tsx b/frontend/src/features/settings/pages/settings.page.tsx
index 03427c36..8bd30b17 100644
--- a/frontend/src/features/settings/pages/settings.page.tsx
+++ b/frontend/src/features/settings/pages/settings.page.tsx
@@ -300,7 +300,7 @@ export function SettingsPage() {
           <div className="overflow-hidden rounded-lg border border-border bg-card">
             {apiKeys.length === 0 ? (
               <p className="px-4 py-8 text-center text-sm text-text-secondary">
-                No API keys yet. Create one to send test requests.
+                No API keys yet. Create one to authenticate gateway requests.
               </p>
             ) : (
               apiKeys.map((key) => (
diff --git a/frontend/src/features/workspaces/layouts/workspace-nav.config.ts b/frontend/src/features/workspaces/layouts/workspace-nav.config.ts
index da4187b0..5f3600b1 100644
--- a/frontend/src/features/workspaces/layouts/workspace-nav.config.ts
+++ b/frontend/src/features/workspaces/layouts/workspace-nav.config.ts
@@ -1,6 +1,9 @@
 import { ROUTES } from "@/core/router/routes"
 
-export type WorkspaceNavSegment = Exclude<keyof typeof ROUTES.workspace, "pattern">
+export type WorkspaceNavSegment = Exclude<
+  keyof typeof ROUTES.workspace,
+  "pattern" | "emailWithMessage"
+>
 
 export function workspaceHref(workspaceId: string, segment: WorkspaceNavSegment) {
   return ROUTES.workspace[segment](workspaceId)
diff --git a/go.mod b/go.mod
index 7a71afa8..f7370503 100644
--- a/go.mod
+++ b/go.mod
@@ -7,6 +7,7 @@ require (
 	github.com/golang-jwt/jwt/v5 v5.3.1
 	github.com/google/uuid v1.6.0
 	github.com/labstack/echo/v4 v4.15.4
+	github.com/lib/pq v1.12.3
 	github.com/mailgun/mailgun-go/v4 v4.23.0
 	github.com/weprodev/wpd-gogate v1.2.1
 	gopkg.in/yaml.v3 v3.0.1
@@ -20,7 +21,6 @@ require (
 	github.com/go-playground/validator/v10 v10.30.3 // indirect
 	github.com/gorilla/css v1.0.1 // indirect
 	github.com/leodido/go-urn v1.4.0 // indirect
-	github.com/lib/pq v1.12.3 // indirect
 	github.com/microcosm-cc/bluemonday v1.0.27 // indirect
 	golang.org/x/crypto v0.53.0 // indirect
 )
diff --git a/internal/app/wire.go b/internal/app/wire.go
index 8628b1a5..78396822 100644
--- a/internal/app/wire.go
+++ b/internal/app/wire.go
@@ -147,7 +147,7 @@ func Wire(cfg *Config, sysLogger *pkglogger.Logger) (*Application, error) {
 
 	// ── Handlers ─────────────────────────────────────────────────────────────
 	// Portal is always enabled — configuration, templates, and inbox require it.
-	portalHandler := handler.NewPortalHandler(portalSvc, gatewaySvc, logRepo)
+	portalHandler := handler.NewPortalHandler(portalSvc)
 	portalAuthHandler := handler.NewPortalAuthHandler(portalSvc, authService)
 	portalWorkspaceHandler := handler.NewPortalWorkspaceHandler(portalSvc)
 	portalIntegrationHandler := handler.NewPortalIntegrationHandler(portalSvc)
diff --git a/internal/core/domain/message_request_log.go b/internal/core/domain/message_request_log.go
index d72ff69c..28d7a11f 100644
--- a/internal/core/domain/message_request_log.go
+++ b/internal/core/domain/message_request_log.go
@@ -4,17 +4,18 @@ import "time"
 
 // MessageRequestLog records a gateway API call for monitoring.
 type MessageRequestLog struct {
-	ID           string
-	WorkspaceID  string
-	APIKeyID     string
-	ChannelType  string
-	HTTPMethod   string
-	StatusCode   int
-	Endpoint     string
-	ProviderName string
-	RequestID    string
-	DurationMs   int
-	ErrorMessage string
+	ID             string
+	WorkspaceID    string
+	APIKeyID       string
+	ChannelType    string
+	HTTPMethod     string
+	StatusCode     int
+	Endpoint       string
+	ProviderName   string
+	RequestID      string
+	DurationMs     int
+	ErrorMessage   string
+	InboxMessageID string
 
 	CreatedAt time.Time
 
diff --git a/internal/core/service/email_enrichment.go b/internal/core/service/email_enrichment.go
new file mode 100644
index 00000000..68ca27c7
--- /dev/null
+++ b/internal/core/service/email_enrichment.go
@@ -0,0 +1,51 @@
+package service
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"log/slog"
+
+	"github.com/weprodev/wpd-message-gateway/internal/core/port"
+	"github.com/weprodev/wpd-message-gateway/pkg/contracts"
+	"github.com/weprodev/wpd-message-gateway/pkg/registry"
+)
+
+func applyEmailSenderDefaults(email contracts.Email, cfg registry.EmailConfig) contracts.Email {
+	enriched := email
+	if enriched.From == "" && cfg.FromEmail != "" {
+		enriched.From = cfg.FromEmail
+	}
+	if enriched.FromName == "" && cfg.FromName != "" {
+		enriched.FromName = cfg.FromName
+	}
+	return enriched
+}
+
+func (s *GatewayService) enrichEmailFromIntegration(ctx context.Context, workspaceID string, email contracts.Email) contracts.Email {
+	if email.From != "" && email.FromName != "" {
+		return email
+	}
+	if s.integrations == nil {
+		return email
+	}
+
+	intg, err := s.integrations.GetActiveByWorkspaceAndChannel(ctx, workspaceID, channelEmail)
+	if err != nil {
+		if !errors.Is(err, port.ErrNotFound) {
+			slog.WarnContext(ctx, "failed to load email integration for sender enrichment", "error", err)
+		}
+		return email
+	}
+	if intg == nil {
+		return email
+	}
+
+	var cfg registry.EmailConfig
+	if err := json.Unmarshal(intg.Config, &cfg); err != nil {
+		slog.WarnContext(ctx, "failed to parse email integration config for sender enrichment", "error", err)
+		return email
+	}
+
+	return applyEmailSenderDefaults(email, cfg)
+}
diff --git a/internal/core/service/email_enrichment_test.go b/internal/core/service/email_enrichment_test.go
new file mode 100644
index 00000000..1a56feca
--- /dev/null
+++ b/internal/core/service/email_enrichment_test.go
@@ -0,0 +1,105 @@
+package service
+
+import (
+	"context"
+	"testing"
+
+	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
+	"github.com/weprodev/wpd-message-gateway/pkg/contracts"
+	"github.com/weprodev/wpd-message-gateway/pkg/registry"
+)
+
+func TestApplyEmailSenderDefaults(t *testing.T) {
+	t.Parallel()
+
+	cfg := registry.EmailConfig{
+		FromEmail: "noreply@weprodev.com",
+		FromName:  "WeProDev",
+	}
+
+	t.Run("fills empty from and from_name", func(t *testing.T) {
+		t.Parallel()
+		got := applyEmailSenderDefaults(contracts.Email{To: []string{"user@example.com"}}, cfg)
+		if got.From != "noreply@weprodev.com" {
+			t.Fatalf("From: %q", got.From)
+		}
+		if got.FromName != "WeProDev" {
+			t.Fatalf("FromName: %q", got.FromName)
+		}
+	})
+
+	t.Run("preserves explicit from", func(t *testing.T) {
+		t.Parallel()
+		got := applyEmailSenderDefaults(contracts.Email{
+			From: "custom@example.com",
+			To:   []string{"user@example.com"},
+		}, cfg)
+		if got.From != "custom@example.com" {
+			t.Fatalf("From: %q", got.From)
+		}
+		if got.FromName != "WeProDev" {
+			t.Fatalf("FromName: %q", got.FromName)
+		}
+	})
+
+	t.Run("preserves explicit from_name", func(t *testing.T) {
+		t.Parallel()
+		got := applyEmailSenderDefaults(contracts.Email{
+			FromName: "Custom Name",
+			To:       []string{"user@example.com"},
+		}, cfg)
+		if got.From != "noreply@weprodev.com" {
+			t.Fatalf("From: %q", got.From)
+		}
+		if got.FromName != "Custom Name" {
+			t.Fatalf("FromName: %q", got.FromName)
+		}
+	})
+}
+
+func TestGatewayService_SendEmail_enrichesSenderFromIntegration(t *testing.T) {
+	inbox := &capturingInbox{}
+	intg := &domain.Integration{
+		ID:           "intg-1",
+		ProviderName: "mailgun",
+		Config:       []byte(`{"from_email":"noreply@weprodev.com","from_name":"WeProDev"}`),
+		Status:       "connected",
+	}
+	svc := NewGatewayService(&stubIntegrationRepo{active: intg}, nil, nil, inbox, nil)
+
+	_, err := svc.SendEmail(t.Context(), "ws-1", contracts.Email{
+		To:      []string{"user@example.com"},
+		Subject: "hi",
+		HTML:    "<p>x</p>",
+	})
+	if err != nil {
+		t.Fatalf("SendEmail: %v", err)
+	}
+	if inbox.lastEmail.From != "noreply@weprodev.com" {
+		t.Fatalf("From: %q", inbox.lastEmail.From)
+	}
+	if inbox.lastEmail.FromName != "WeProDev" {
+		t.Fatalf("FromName: %q", inbox.lastEmail.FromName)
+	}
+}
+
+type capturingInbox struct {
+	lastEmail contracts.Email
+}
+
+func (s *capturingInbox) WriteEmail(_ context.Context, _ string, email contracts.Email) (string, error) {
+	s.lastEmail = email
+	return "inbox-msg-1", nil
+}
+
+func (s *capturingInbox) WriteSMS(context.Context, string, contracts.SMS) (string, error) {
+	return "inbox-sms-1", nil
+}
+
+func (s *capturingInbox) WritePush(context.Context, string, contracts.PushNotification) (string, error) {
+	return "inbox-push-1", nil
+}
+
+func (s *capturingInbox) WriteChat(context.Context, string, contracts.ChatMessage) (string, error) {
+	return "inbox-chat-1", nil
+}
diff --git a/internal/core/service/gateway_service.go b/internal/core/service/gateway_service.go
index fca073ae..9d24562a 100644
--- a/internal/core/service/gateway_service.go
+++ b/internal/core/service/gateway_service.go
@@ -198,7 +198,7 @@ func (s *GatewayService) dispatch(
 		if finalResult.Meta == nil {
 			finalResult.Meta = make(map[string]string)
 		}
-		finalResult.Meta["inbox_message_id"] = inboxResult.ID
+		finalResult.Meta[contracts.MetaKeyInboxMessageID] = inboxResult.ID
 	}
 
 	return attachMeta(finalResult, effectiveMode, config.StoreMessageContent, channel, integrationID, providerName), nil
@@ -280,6 +280,7 @@ func (s *GatewayService) writeEmailToInbox(ctx context.Context, workspaceID stri
 	if s.inbox == nil {
 		return nil, fmt.Errorf("inbox writer not configured")
 	}
+	email = s.enrichEmailFromIntegration(ctx, workspaceID, email)
 	id, err := s.inbox.WriteEmail(ctx, workspaceID, email)
 	if err != nil {
 		return nil, fmt.Errorf("write email to inbox: %w", err)
@@ -330,7 +331,7 @@ func attachMeta(r *contracts.SendResult, effectiveMode domain.MessageDispatchMod
 	if r.Meta == nil {
 		r.Meta = make(map[string]string, 5)
 	}
-	r.Meta["dispatch_mode"] = string(effectiveMode)
+	contracts.SetDispatchModeMeta(r, string(effectiveMode))
 	contracts.SetStoreContentMeta(r, storeContent)
 	r.Meta["channel"] = channel
 	if integrationID != "" {
diff --git a/internal/core/service/gateway_service_test.go b/internal/core/service/gateway_service_test.go
index 24dac19e..308095dc 100644
--- a/internal/core/service/gateway_service_test.go
+++ b/internal/core/service/gateway_service_test.go
@@ -184,8 +184,8 @@ func TestGatewayService_SendEmail_memoryOnly(t *testing.T) {
 	if res.ID != "mem-1" {
 		t.Fatalf("got ID %q", res.ID)
 	}
-	if res.Meta["dispatch_mode"] != string(domain.DispatchMemory) {
-		t.Fatalf("dispatch_mode: %v", res.Meta["dispatch_mode"])
+	if res.Meta[contracts.MetaKeyDispatchMode] != string(domain.DispatchMemory) {
+		t.Fatalf("dispatch_mode: %v", res.Meta[contracts.MetaKeyDispatchMode])
 	}
 	if res.Meta["channel"] != "email" {
 		t.Fatalf("channel: %v", res.Meta["channel"])
@@ -361,8 +361,8 @@ func TestGatewayService_SendEmail_providerDatabase_mailgunIntegration(t *testing
 	if res.Meta["provider_name"] != mailgun.ProviderName {
 		t.Fatalf("provider_name: %v", res.Meta["provider_name"])
 	}
-	if res.Meta["inbox_message_id"] != "inbox-1" {
-		t.Fatalf("inbox_message_id: %v", res.Meta["inbox_message_id"])
+	if res.Meta[contracts.MetaKeyInboxMessageID] != "inbox-1" {
+		t.Fatalf("inbox_message_id: %v", res.Meta[contracts.MetaKeyInboxMessageID])
 	}
 }
 
diff --git a/internal/infrastructure/inbox/store.go b/internal/infrastructure/inbox/store.go
index d85ab5dd..a69717ac 100644
--- a/internal/infrastructure/inbox/store.go
+++ b/internal/infrastructure/inbox/store.go
@@ -21,11 +21,11 @@ var _ port.InboxWriter = (*Store)(nil)
 
 // Store implements an in-memory message store indexed by workspace for O(1) bucket lookup.
 type Store struct {
-	mu       sync.RWMutex
-	emails   map[string][]port.StoredEmail
-	sms      map[string][]port.StoredSMS
-	pushes   map[string][]port.StoredPush
-	chats    map[string][]port.StoredChat
+	mu     sync.RWMutex
+	emails map[string][]port.StoredEmail
+	sms    map[string][]port.StoredSMS
+	pushes map[string][]port.StoredPush
+	chats  map[string][]port.StoredChat
 }
 
 // NewStore creates a new in-memory store.
diff --git a/internal/infrastructure/repository/postgres/message_request_log_repository.go b/internal/infrastructure/repository/postgres/message_request_log_repository.go
index 42026db7..3343293d 100644
--- a/internal/infrastructure/repository/postgres/message_request_log_repository.go
+++ b/internal/infrastructure/repository/postgres/message_request_log_repository.go
@@ -21,35 +21,27 @@ func NewMessageRequestLogRepository(client *pgsql.PgClient) port.MessageRequestL
 }
 
 func (r *MessageRequestLogRepository) Create(ctx context.Context, log *domain.MessageRequestLog) error {
-	query := `
-		INSERT INTO message_request_logs (workspace_id, api_key_id, channel_type, http_method, status_code, endpoint, provider_name, request_id, duration_ms, error_message)
-		VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)
+	const query = `
+		INSERT INTO message_request_logs (
+			workspace_id, api_key_id, channel_type, http_method, status_code, endpoint,
+			provider_name, request_id, duration_ms, error_message, inbox_message_id
+		)
+		VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)
 		RETURNING id, created_at
 	`
-	var apiKeyID interface{}
-	if log.APIKeyID != "" {
-		apiKeyID = log.APIKeyID
-	}
-	var reqID interface{}
-	if log.RequestID != "" {
-		reqID = log.RequestID
-	}
-	var dur interface{}
-	if log.DurationMs > 0 {
-		dur = log.DurationMs
-	}
-	var errMsg interface{}
-	if log.ErrorMessage != "" {
-		errMsg = log.ErrorMessage
-	}
-	var provider interface{}
-	if log.ProviderName != "" {
-		provider = log.ProviderName
-	}
 
 	err := r.client.GetDB(ctx).QueryRowContext(ctx, query,
-		log.WorkspaceID, apiKeyID, log.ChannelType, log.HTTPMethod, log.StatusCode, log.Endpoint,
-		provider, reqID, dur, errMsg,
+		log.WorkspaceID,
+		nullIfEmpty(log.APIKeyID),
+		log.ChannelType,
+		log.HTTPMethod,
+		log.StatusCode,
+		log.Endpoint,
+		nullIfEmpty(log.ProviderName),
+		nullIfEmpty(log.RequestID),
+		nullIfNonPositive(log.DurationMs),
+		nullIfEmpty(log.ErrorMessage),
+		nullIfEmpty(log.InboxMessageID),
 	).Scan(&log.ID, &log.CreatedAt)
 	if err != nil {
 		slog.ErrorContext(ctx, "database error: failed to create message request log", "error", err, "endpoint", log.Endpoint)
@@ -82,6 +74,36 @@ func (r *MessageRequestLogRepository) insertPayload(ctx context.Context, log *do
 	return nil
 }
 
+func scanMessageRequestLogWithSource(
+	scanner interface{ Scan(dest ...any) error },
+) (domain.MessageRequestLogWithSource, int64, error) {
+	var row domain.MessageRequestLogWithSource
+	var apiKeyID, reqID, errMsg, prov, inboxID sql.NullString
+	var dur sql.NullInt64
+	var totalCount int64
+
+	err := scanner.Scan(
+		&row.ID, &row.WorkspaceID, &apiKeyID, &row.ChannelType, &row.HTTPMethod, &row.StatusCode, &row.Endpoint,
+		&prov, &reqID, &dur, &errMsg, &inboxID, &row.CreatedAt,
+		&row.SourceName, &row.ClientID,
+		&totalCount,
+	)
+	if err != nil {
+		return row, 0, err
+	}
+
+	row.APIKeyID = optionalStringFromNull(apiKeyID)
+	row.ProviderName = optionalStringFromNull(prov)
+	row.RequestID = optionalStringFromNull(reqID)
+	row.ErrorMessage = optionalStringFromNull(errMsg)
+	row.InboxMessageID = optionalStringFromNull(inboxID)
+	if dur.Valid {
+		row.DurationMs = int(dur.Int64)
+	}
+
+	return row, totalCount, nil
+}
+
 func (r *MessageRequestLogRepository) ListWithSource(ctx context.Context, q port.MessageLogQuery) ([]domain.MessageRequestLogWithSource, int, error) {
 	db := r.client.GetDB(ctx)
 	args := []any{q.WorkspaceID}
@@ -105,7 +127,7 @@ func (r *MessageRequestLogRepository) ListWithSource(ctx context.Context, q port
 	limit, offset := clampLimitOffset(q.Limit, q.Offset)
 	listQuery := fmt.Sprintf(`
 		SELECT l.id, l.workspace_id, l.api_key_id, l.channel_type, l.http_method, l.status_code, l.endpoint,
-			l.provider_name, l.request_id, l.duration_ms, l.error_message, l.created_at,
+			l.provider_name, l.request_id, l.duration_ms, l.error_message, l.inbox_message_id, l.created_at,
 			COALESCE(k.name, ''), COALESCE(k.client_id, ''),
 			COUNT(*) OVER() AS total_count
 		FROM message_request_logs l
@@ -124,40 +146,14 @@ func (r *MessageRequestLogRepository) ListWithSource(ctx context.Context, q port
 	var out []domain.MessageRequestLogWithSource
 	total := 0
 	for rows.Next() {
-		var row domain.MessageRequestLogWithSource
-		var apiKeyID sql.NullString
-		var reqID sql.NullString
-		var dur sql.NullInt64
-		var errMsg sql.NullString
-		var prov sql.NullString
-		var totalCount int64
-		if err := rows.Scan(
-			&row.ID, &row.WorkspaceID, &apiKeyID, &row.ChannelType, &row.HTTPMethod, &row.StatusCode, &row.Endpoint,
-			&prov, &reqID, &dur, &errMsg, &row.CreatedAt,
-			&row.SourceName, &row.ClientID,
-			&totalCount,
-		); err != nil {
+		row, totalCount, err := scanMessageRequestLogWithSource(rows)
+		if err != nil {
 			slog.ErrorContext(ctx, "database error: failed to scan message request log", "error", err)
 			return nil, 0, err
 		}
 		if total == 0 {
 			total = int(totalCount)
 		}
-		if apiKeyID.Valid {
-			row.APIKeyID = apiKeyID.String
-		}
-		if prov.Valid {
-			row.ProviderName = prov.String
-		}
-		if reqID.Valid {
-			row.RequestID = reqID.String
-		}
-		if dur.Valid {
-			row.DurationMs = int(dur.Int64)
-		}
-		if errMsg.Valid {
-			row.ErrorMessage = errMsg.String
-		}
 		out = append(out, row)
 	}
 	if err := rows.Err(); err != nil {
diff --git a/internal/infrastructure/repository/postgres/message_request_log_repository_test.go b/internal/infrastructure/repository/postgres/message_request_log_repository_test.go
new file mode 100644
index 00000000..b7edfb64
--- /dev/null
+++ b/internal/infrastructure/repository/postgres/message_request_log_repository_test.go
@@ -0,0 +1,111 @@
+package postgres
+
+import (
+	"database/sql"
+	"testing"
+	"time"
+
+	"github.com/DATA-DOG/go-sqlmock"
+)
+
+func TestScanMessageRequestLogWithSource_nullInboxMessageID(t *testing.T) {
+	t.Parallel()
+
+	db, mock, err := sqlmock.New()
+	if err != nil {
+		t.Fatalf("sqlmock.New: %v", err)
+	}
+	t.Cleanup(func() { _ = db.Close() })
+
+	createdAt := time.Date(2026, 7, 4, 9, 0, 0, 0, time.UTC)
+	rows := sqlmock.NewRows([]string{
+		"id", "workspace_id", "api_key_id", "channel_type", "http_method", "status_code", "endpoint",
+		"provider_name", "request_id", "duration_ms", "error_message", "inbox_message_id", "created_at",
+		"source_name", "client_id", "total_count",
+	}).AddRow(
+		"log-1", "ws-1", nil, "email", "POST", 200, "/v1/email",
+		"memory", nil, 12, nil, nil, createdAt,
+		"Demo Key", "demo-client", int64(1),
+	)
+
+	mock.ExpectQuery("SELECT").WillReturnRows(rows)
+
+	resultRows, err := db.Query("SELECT")
+	if err != nil {
+		t.Fatalf("Query: %v", err)
+	}
+	t.Cleanup(func() { _ = resultRows.Close() })
+
+	if !resultRows.Next() {
+		t.Fatal("expected one row")
+	}
+
+	row, total, err := scanMessageRequestLogWithSource(resultRows)
+	if err != nil {
+		t.Fatalf("scanMessageRequestLogWithSource: %v", err)
+	}
+
+	if row.InboxMessageID != "" {
+		t.Fatalf("InboxMessageID: got %q, want empty for SQL NULL", row.InboxMessageID)
+	}
+	if row.ProviderName != "memory" {
+		t.Fatalf("ProviderName: got %q", row.ProviderName)
+	}
+	if total != 1 {
+		t.Fatalf("total: got %d", total)
+	}
+}
+
+func TestScanMessageRequestLogWithSource_withInboxMessageID(t *testing.T) {
+	t.Parallel()
+
+	db, mock, err := sqlmock.New()
+	if err != nil {
+		t.Fatalf("sqlmock.New: %v", err)
+	}
+	t.Cleanup(func() { _ = db.Close() })
+
+	createdAt := time.Date(2026, 7, 4, 9, 0, 0, 0, time.UTC)
+	inboxID := "inbox-msg-99"
+	rows := sqlmock.NewRows([]string{
+		"id", "workspace_id", "api_key_id", "channel_type", "http_method", "status_code", "endpoint",
+		"provider_name", "request_id", "duration_ms", "error_message", "inbox_message_id", "created_at",
+		"source_name", "client_id", "total_count",
+	}).AddRow(
+		"log-2", "ws-1", nil, "email", "POST", 200, "/v1/email",
+		"memory", nil, 12, nil, inboxID, createdAt,
+		"Demo Key", "demo-client", int64(1),
+	)
+
+	mock.ExpectQuery("SELECT").WillReturnRows(rows)
+
+	resultRows, err := db.Query("SELECT")
+	if err != nil {
+		t.Fatalf("Query: %v", err)
+	}
+	t.Cleanup(func() { _ = resultRows.Close() })
+
+	if !resultRows.Next() {
+		t.Fatal("expected one row")
+	}
+
+	row, _, err := scanMessageRequestLogWithSource(resultRows)
+	if err != nil {
+		t.Fatalf("scanMessageRequestLogWithSource: %v", err)
+	}
+
+	if row.InboxMessageID != inboxID {
+		t.Fatalf("InboxMessageID: got %q, want %q", row.InboxMessageID, inboxID)
+	}
+}
+
+func TestOptionalStringFromNull(t *testing.T) {
+	t.Parallel()
+
+	if got := optionalStringFromNull(sql.NullString{}); got != "" {
+		t.Fatalf("NULL: got %q", got)
+	}
+	if got := optionalStringFromNull(sql.NullString{String: "x", Valid: true}); got != "x" {
+		t.Fatalf("valid: got %q", got)
+	}
+}
diff --git a/internal/infrastructure/repository/postgres/scan_helpers.go b/internal/infrastructure/repository/postgres/scan_helpers.go
new file mode 100644
index 00000000..8c6e2918
--- /dev/null
+++ b/internal/infrastructure/repository/postgres/scan_helpers.go
@@ -0,0 +1,26 @@
+package postgres
+
+import "database/sql"
+
+func optionalStringFromNull(v sql.NullString) string {
+	if v.Valid {
+		return v.String
+	}
+	return ""
+}
+
+// nullIfEmpty maps empty strings to SQL NULL on write.
+func nullIfEmpty(s string) any {
+	if s == "" {
+		return nil
+	}
+	return s
+}
+
+// nullIfNonPositive maps zero or negative integers to SQL NULL on write.
+func nullIfNonPositive(n int) any {
+	if n <= 0 {
+		return nil
+	}
+	return n
+}
diff --git a/internal/infrastructure/repository/postgres/scan_helpers_test.go b/internal/infrastructure/repository/postgres/scan_helpers_test.go
new file mode 100644
index 00000000..6727cbc8
--- /dev/null
+++ b/internal/infrastructure/repository/postgres/scan_helpers_test.go
@@ -0,0 +1,28 @@
+package postgres
+
+import "testing"
+
+func TestNullIfEmpty(t *testing.T) {
+	t.Parallel()
+
+	if got := nullIfEmpty(""); got != nil {
+		t.Fatalf("empty: got %v, want nil", got)
+	}
+	if got := nullIfEmpty("x"); got != "x" {
+		t.Fatalf("non-empty: got %v", got)
+	}
+}
+
+func TestNullIfNonPositive(t *testing.T) {
+	t.Parallel()
+
+	if got := nullIfNonPositive(0); got != nil {
+		t.Fatalf("zero: got %v, want nil", got)
+	}
+	if got := nullIfNonPositive(-1); got != nil {
+		t.Fatalf("negative: got %v, want nil", got)
+	}
+	if got := nullIfNonPositive(42); got != 42 {
+		t.Fatalf("positive: got %v", got)
+	}
+}
diff --git a/internal/infrastructure/repository/postgres/template_repository.go b/internal/infrastructure/repository/postgres/template_repository.go
index 3dc221b0..666b5b05 100644
--- a/internal/infrastructure/repository/postgres/template_repository.go
+++ b/internal/infrastructure/repository/postgres/template_repository.go
@@ -38,13 +38,6 @@ func (r *TemplateRepository) Create(ctx context.Context, template *domain.Templa
 	return nil
 }
 
-func nullIfEmpty(s string) interface{} {
-	if s == "" {
-		return nil
-	}
-	return s
-}
-
 func (r *TemplateRepository) GetByWorkspaceAndKey(ctx context.Context, workspaceID, uniqueKey string) (*domain.Template, error) {
 	query := `
 		SELECT id, workspace_id, name, unique_key, channel_type, category, subject, content, is_active, is_default, created_at, updated_at
diff --git a/internal/presentation/dto/api_key.go b/internal/presentation/dto/api_key.go
new file mode 100644
index 00000000..18afa401
--- /dev/null
+++ b/internal/presentation/dto/api_key.go
@@ -0,0 +1,62 @@
+package dto
+
+import (
+	"time"
+
+	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
+)
+
+// APIKeyPublic is the portal-safe API key representation (no secret hash).
+type APIKeyPublic struct {
+	ID          string     `json:"id"`
+	WorkspaceID string     `json:"workspace_id"`
+	ClientID    string     `json:"client_id"`
+	Name        string     `json:"name"`
+	IsActive    bool       `json:"is_active"`
+	LastUsedAt  *time.Time `json:"last_used_at,omitempty"`
+	CreatedAt   time.Time  `json:"created_at"`
+	ExpiresAt   *time.Time `json:"expires_at,omitempty"`
+}
+
+// APIKeyPublicFromDomain maps a domain API key to its portal response shape.
+func APIKeyPublicFromDomain(k domain.APIKey) APIKeyPublic {
+	return APIKeyPublic{
+		ID:          k.ID,
+		WorkspaceID: k.WorkspaceID,
+		ClientID:    k.ClientID,
+		Name:        k.Name,
+		IsActive:    k.IsActive,
+		LastUsedAt:  k.LastUsedAt,
+		CreatedAt:   k.CreatedAt,
+		ExpiresAt:   k.ExpiresAt,
+	}
+}
+
+// CreateAPIKeyRequest is the JSON body for POST /api/v1/workspaces/:wid/api-keys.
+type CreateAPIKeyRequest struct {
+	Name string `json:"name"`
+}
+
+// CreateAPIKeyResponse is returned once when a new API key secret is issued.
+type CreateAPIKeyResponse struct {
+	APIKeyPublic
+	ClientSecret string `json:"client_secret"`
+}
+
+// CreateAPIKeyResponseFromDomain maps a newly created domain API key and one-time secret.
+func CreateAPIKeyResponseFromDomain(k domain.APIKey, secret string) CreateAPIKeyResponse {
+	return CreateAPIKeyResponse{
+		APIKeyPublic: APIKeyPublicFromDomain(k),
+		ClientSecret: secret,
+	}
+}
+
+// RegenerateAPIKeyResponse is returned when an API key secret is re-issued.
+type RegenerateAPIKeyResponse struct {
+	ClientSecret string `json:"client_secret"`
+}
+
+// RegenerateAPIKeyResponseFromDomain maps a re-issued secret to the portal response.
+func RegenerateAPIKeyResponseFromDomain(secret string) RegenerateAPIKeyResponse {
+	return RegenerateAPIKeyResponse{ClientSecret: secret}
+}
diff --git a/internal/presentation/dto/auth.go b/internal/presentation/dto/auth.go
new file mode 100644
index 00000000..294e00ec
--- /dev/null
+++ b/internal/presentation/dto/auth.go
@@ -0,0 +1,119 @@
+package dto
+
+import (
+	"time"
+
+	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
+)
+
+// RegisterRequest is the JSON body for POST /api/v1/auth/register.
+type RegisterRequest struct {
+	FirstName string `json:"first_name"`
+	LastName  string `json:"last_name"`
+	Email     string `json:"email"`
+	Password  string `json:"password"`
+}
+
+// LoginRequest is the JSON body for POST /api/v1/auth/login.
+type LoginRequest struct {
+	Email    string `json:"email"`
+	Password string `json:"password"`
+}
+
+// User is the portal-safe account shape (no password hash).
+type User struct {
+	ID            string    `json:"id"`
+	FirstName     string    `json:"first_name"`
+	LastName      string    `json:"last_name"`
+	Email         string    `json:"email"`
+	EmailVerified bool      `json:"email_verified"`
+	CreatedAt     time.Time `json:"created_at"`
+	UpdatedAt     time.Time `json:"updated_at"`
+}
+
+// UserFromDomain maps a domain user to the portal response shape.
+func UserFromDomain(u *domain.User) User {
+	if u == nil {
+		return User{}
+	}
+	return User{
+		ID:            u.ID.String(),
+		FirstName:     u.FirstName,
+		LastName:      u.LastName,
+		Email:         u.Email,
+		EmailVerified: u.EmailVerified,
+		CreatedAt:     u.CreatedAt,
+		UpdatedAt:     u.UpdatedAt,
+	}
+}
+
+// UserWorkspace is a workspace as returned on login and /auth/me (no PIN hash).
+type UserWorkspace struct {
+	ID          string    `json:"id"`
+	Name        string    `json:"name"`
+	Slug        string    `json:"slug"`
+	AdminEmail  string    `json:"admin_email"`
+	Status      string    `json:"status"`
+	Visibility  string    `json:"visibility"`
+	IconKey     string    `json:"icon_key,omitempty"`
+	CreatedAt   time.Time `json:"created_at"`
+	UpdatedAt   time.Time `json:"updated_at"`
+	Role        string    `json:"role,omitempty"`
+	Permissions []string  `json:"permissions,omitempty"`
+}
+
+// UserWorkspaceFromDomain maps a domain workspace (with access metadata) to the portal shape.
+func UserWorkspaceFromDomain(w domain.Workspace) UserWorkspace {
+	return UserWorkspace{
+		ID:          w.ID,
+		Name:        w.Name,
+		Slug:        w.Slug,
+		AdminEmail:  w.AdminEmail,
+		Status:      w.Status,
+		Visibility:  w.Visibility,
+		IconKey:     w.IconKey,
+		CreatedAt:   w.CreatedAt,
+		UpdatedAt:   w.UpdatedAt,
+		Role:        w.Role,
+		Permissions: w.Permissions,
+	}
+}
+
+func userWorkspacesFromDomain(workspaces []domain.Workspace) []UserWorkspace {
+	out := make([]UserWorkspace, 0, len(workspaces))
+	for _, w := range workspaces {
+		out = append(out, UserWorkspaceFromDomain(w))
+	}
+	return out
+}
+
+// LoginResponse is returned after successful authentication.
+type LoginResponse struct {
+	Token      string          `json:"token"`
+	User       User            `json:"user"`
+	Workspaces []UserWorkspace `json:"workspaces"`
+}
+
+// LoginResponseFromDomain maps auth results to the login response.
+func LoginResponseFromDomain(token string, user *domain.User, workspaces []domain.Workspace) LoginResponse {
+	return LoginResponse{
+		Token:      token,
+		User:       UserFromDomain(user),
+		Workspaces: userWorkspacesFromDomain(workspaces),
+	}
+}
+
+// UserProfileResponse is returned by GET /api/v1/auth/me.
+// User fields are embedded so JSON matches the flat portal contract (id, first_name, …, workspaces).
+type UserProfileResponse struct {
+	User
+	Workspaces []UserWorkspace `json:"workspaces"`
+}
+
+// UserProfileResponseFromDomain maps the current user and workspaces to the profile response.
+func UserProfileResponseFromDomain(user *domain.User, workspaces []domain.Workspace) UserProfileResponse {
+	return UserProfileResponse{
+		User:       UserFromDomain(user),
+		Workspaces: userWorkspacesFromDomain(workspaces),
+	}
+}
diff --git a/internal/presentation/dto/auth_test.go b/internal/presentation/dto/auth_test.go
new file mode 100644
index 00000000..cfef4c4f
--- /dev/null
+++ b/internal/presentation/dto/auth_test.go
@@ -0,0 +1,54 @@
+package dto
+
+import (
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+
+	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
+)
+
+func TestUserFromDomain(t *testing.T) {
+	t.Parallel()
+
+	uid := uuid.MustParse("11111111-1111-1111-1111-111111111111")
+	now := time.Date(2026, 7, 4, 10, 0, 0, 0, time.UTC)
+	got := UserFromDomain(&domain.User{
+		ID:            uid,
+		FirstName:     "Ada",
+		LastName:      "Lovelace",
+		Email:         "ada@example.com",
+		PasswordHash:  "must-not-leak",
+		EmailVerified: true,
+		CreatedAt:     now,
+		UpdatedAt:     now,
+	})
+
+	if got.ID != uid.String() || got.Email != "ada@example.com" {
+		t.Fatalf("unexpected user mapping: %+v", got)
+	}
+}
+
+func TestUserProfileResponseFromDomain(t *testing.T) {
+	t.Parallel()
+
+	uid := uuid.MustParse("11111111-1111-1111-1111-111111111111")
+	resp := UserProfileResponseFromDomain(&domain.User{
+		ID:        uid,
+		FirstName: "Ada",
+		Email:     "ada@example.com",
+	}, []domain.Workspace{{
+		ID:   "ws-1",
+		Name: "Demo",
+		Slug: "demo",
+		Role: "owner",
+	}})
+
+	if resp.ID != uid.String() || resp.FirstName != "Ada" {
+		t.Fatalf("embedded user fields not promoted: %+v", resp)
+	}
+	if len(resp.Workspaces) != 1 || resp.Workspaces[0].Role != "owner" {
+		t.Fatalf("unexpected workspaces: %+v", resp.Workspaces)
+	}
+}
diff --git a/internal/presentation/dto/integration.go b/internal/presentation/dto/integration.go
new file mode 100644
index 00000000..0eb8201d
--- /dev/null
+++ b/internal/presentation/dto/integration.go
@@ -0,0 +1,77 @@
+package dto
+
+import (
+	"encoding/json"
+	"fmt"
+	"time"
+
+	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
+)
+
+// UpsertIntegrationRequest is the JSON body for PUT /api/v1/workspaces/:wid/integrations.
+type UpsertIntegrationRequest struct {
+	ChannelType  string          `json:"channel_type"`
+	ProviderName string          `json:"provider_name"`
+	Config       json.RawMessage `json:"config"`
+	Status       string          `json:"status"`
+	IsDefault    bool            `json:"is_default"`
+}
+
+// ToDomain maps the request to a domain integration for upsert (passed to service → repository).
+func (r UpsertIntegrationRequest) ToDomain(workspaceID string) (*domain.Integration, error) {
+	cfg, err := normalizeIntegrationConfig(r.Config)
+	if err != nil {
+		return nil, fmt.Errorf("integration config: %w", err)
+	}
+	status := r.Status
+	if status == "" {
+		status = domain.IntegrationStatusConnected
+	}
+	return &domain.Integration{
+		WorkspaceID:  workspaceID,
+		ChannelType:  r.ChannelType,
+		ProviderName: r.ProviderName,
+		Config:       cfg,
+		Status:       status,
+		IsDefault:    r.IsDefault,
+	}, nil
+}
+
+// Integration is the portal response shape for workspace integrations.
+type Integration struct {
+	ID           string          `json:"id"`
+	WorkspaceID  string          `json:"workspace_id"`
+	ChannelType  string          `json:"channel_type"`
+	ProviderName string          `json:"provider_name"`
+	Config       json.RawMessage `json:"config"`
+	Status       string          `json:"status"`
+	IsDefault    bool            `json:"is_default"`
+	CreatedAt    time.Time       `json:"created_at"`
+	UpdatedAt    time.Time       `json:"updated_at"`
+}
+
+// IntegrationFromDomain maps a domain integration to its portal response shape.
+func IntegrationFromDomain(intg domain.Integration) Integration {
+	return Integration{
+		ID:           intg.ID,
+		WorkspaceID:  intg.WorkspaceID,
+		ChannelType:  intg.ChannelType,
+		ProviderName: intg.ProviderName,
+		Config:       json.RawMessage(intg.Config),
+		Status:       intg.Status,
+		IsDefault:    intg.IsDefault,
+		CreatedAt:    intg.CreatedAt,
+		UpdatedAt:    intg.UpdatedAt,
+	}
+}
+
+func normalizeIntegrationConfig(b []byte) ([]byte, error) {
+	if len(b) == 0 {
+		return []byte("{}"), nil
+	}
+	var v any
+	if err := json.Unmarshal(b, &v); err != nil {
+		return nil, err
+	}
+	return json.Marshal(v)
+}
diff --git a/internal/presentation/dto/integration_test.go b/internal/presentation/dto/integration_test.go
new file mode 100644
index 00000000..7be0c4b2
--- /dev/null
+++ b/internal/presentation/dto/integration_test.go
@@ -0,0 +1,60 @@
+package dto
+
+import (
+	"encoding/json"
+	"testing"
+	"time"
+
+	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
+)
+
+func TestIntegrationFromDomain(t *testing.T) {
+	now := time.Now().UTC().Truncate(time.Second)
+	intg := domain.Integration{
+		ID:           "intg-1",
+		WorkspaceID:  "ws-1",
+		ChannelType:  "email",
+		ProviderName: "mailgun",
+		Config:       []byte(`{"api_key":"secret"}`),
+		Status:       domain.IntegrationStatusConnected,
+		IsDefault:    true,
+		CreatedAt:    now,
+		UpdatedAt:    now,
+	}
+
+	got := IntegrationFromDomain(intg)
+	if got.ID != intg.ID || got.WorkspaceID != intg.WorkspaceID {
+		t.Fatalf("unexpected ids: %+v", got)
+	}
+	if string(got.Config) != string(intg.Config) {
+		t.Fatalf("config = %s, want %s", got.Config, intg.Config)
+	}
+
+	var cfg map[string]string
+	if err := json.Unmarshal(got.Config, &cfg); err != nil {
+		t.Fatalf("config not valid JSON: %v", err)
+	}
+	if cfg["api_key"] != "secret" {
+		t.Errorf("api_key = %q, want secret", cfg["api_key"])
+	}
+}
+
+func TestUpsertIntegrationRequestToDomain(t *testing.T) {
+	req := UpsertIntegrationRequest{
+		ChannelType:  "email",
+		ProviderName: "mailgun",
+		Config:       json.RawMessage(`{"api_key":"secret"}`),
+		IsDefault:    true,
+	}
+
+	got, err := req.ToDomain("ws-1")
+	if err != nil {
+		t.Fatalf("ToDomain() error = %v", err)
+	}
+	if got.WorkspaceID != "ws-1" || got.ProviderName != "mailgun" {
+		t.Fatalf("unexpected domain mapping: %+v", got)
+	}
+	if got.Status != domain.IntegrationStatusConnected {
+		t.Errorf("status = %q, want connected", got.Status)
+	}
+}
diff --git a/internal/presentation/dto/message_request_log.go b/internal/presentation/dto/message_request_log.go
new file mode 100644
index 00000000..64125ebb
--- /dev/null
+++ b/internal/presentation/dto/message_request_log.go
@@ -0,0 +1,62 @@
+package dto
+
+import (
+	"time"
+
+	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
+)
+
+// MessageRequestLog is the portal list shape for gateway request logs.
+type MessageRequestLog struct {
+	ID             string    `json:"id"`
+	WorkspaceID    string    `json:"workspace_id"`
+	APIKeyID       string    `json:"api_key_id,omitempty"`
+	ChannelType    string    `json:"channel_type"`
+	HTTPMethod     string    `json:"http_method"`
+	StatusCode     int       `json:"status_code"`
+	Endpoint       string    `json:"endpoint"`
+	ProviderName   string    `json:"provider_name,omitempty"`
+	RequestID      string    `json:"request_id,omitempty"`
+	DurationMs     int       `json:"duration_ms,omitempty"`
+	ErrorMessage   string    `json:"error_message,omitempty"`
+	InboxMessageID string    `json:"inbox_message_id,omitempty"`
+	CreatedAt      time.Time `json:"created_at"`
+	SourceName     string    `json:"source_name"`
+	ClientID       string    `json:"client_id,omitempty"`
+}
+
+// MessageRequestLogFromDomain maps a domain log row (with API key source metadata) to the portal DTO.
+func MessageRequestLogFromDomain(l domain.MessageRequestLogWithSource) MessageRequestLog {
+	return MessageRequestLog{
+		ID:             l.ID,
+		WorkspaceID:    l.WorkspaceID,
+		APIKeyID:       l.APIKeyID,
+		ChannelType:    l.ChannelType,
+		HTTPMethod:     l.HTTPMethod,
+		StatusCode:     l.StatusCode,
+		Endpoint:       l.Endpoint,
+		ProviderName:   l.ProviderName,
+		RequestID:      l.RequestID,
+		DurationMs:     l.DurationMs,
+		ErrorMessage:   l.ErrorMessage,
+		InboxMessageID: l.InboxMessageID,
+		CreatedAt:      l.CreatedAt,
+		SourceName:     l.SourceName,
+		ClientID:       l.ClientID,
+	}
+}
+
+// MessageRequestLogList is the paginated logs API response.
+type MessageRequestLogList struct {
+	Items []MessageRequestLog `json:"items"`
+	Total int                 `json:"total"`
+}
+
+// MessageRequestLogListFromDomain maps domain log rows and total count to the paginated response.
+func MessageRequestLogListFromDomain(rows []domain.MessageRequestLogWithSource, total int) MessageRequestLogList {
+	items := make([]MessageRequestLog, 0, len(rows))
+	for _, r := range rows {
+		items = append(items, MessageRequestLogFromDomain(r))
+	}
+	return MessageRequestLogList{Items: items, Total: total}
+}
diff --git a/internal/presentation/dto/message_request_log_test.go b/internal/presentation/dto/message_request_log_test.go
new file mode 100644
index 00000000..717977b4
--- /dev/null
+++ b/internal/presentation/dto/message_request_log_test.go
@@ -0,0 +1,39 @@
+package dto
+
+import (
+	"testing"
+	"time"
+
+	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
+)
+
+func TestMessageRequestLogFromDomain(t *testing.T) {
+	t.Parallel()
+
+	createdAt := time.Date(2026, 7, 4, 10, 0, 0, 0, time.UTC)
+	row := domain.MessageRequestLogWithSource{
+		MessageRequestLog: domain.MessageRequestLog{
+			ID:             "log-1",
+			WorkspaceID:    "ws-1",
+			ChannelType:    "email",
+			HTTPMethod:     "POST",
+			StatusCode:     200,
+			Endpoint:       "/v1/email",
+			ProviderName:   "memory",
+			InboxMessageID: "inbox-1",
+			CreatedAt:      createdAt,
+		},
+		SourceName: "Demo Key",
+		ClientID:   "demo-client",
+	}
+
+	got := MessageRequestLogFromDomain(row)
+	if got.ID != "log-1" || got.InboxMessageID != "inbox-1" || got.SourceName != "Demo Key" {
+		t.Fatalf("unexpected mapping: %+v", got)
+	}
+
+	list := MessageRequestLogListFromDomain([]domain.MessageRequestLogWithSource{row}, 1)
+	if len(list.Items) != 1 || list.Total != 1 {
+		t.Fatalf("unexpected list mapping: %+v", list)
+	}
+}
diff --git a/internal/presentation/dto/settings.go b/internal/presentation/dto/settings.go
new file mode 100644
index 00000000..985138c9
--- /dev/null
+++ b/internal/presentation/dto/settings.go
@@ -0,0 +1,4 @@
+package dto
+
+// PatchSettingsRequest is the JSON body for PATCH /api/v1/workspaces/:wid/settings.
+type PatchSettingsRequest map[string]string
diff --git a/internal/presentation/dto/template.go b/internal/presentation/dto/template.go
new file mode 100644
index 00000000..962a2ad8
--- /dev/null
+++ b/internal/presentation/dto/template.go
@@ -0,0 +1,76 @@
+package dto
+
+import (
+	"github.com/weprodev/go-pkg/sanitizer"
+
+	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
+	"github.com/weprodev/wpd-message-gateway/internal/core/service"
+)
+
+// CreateTemplateRequest is the JSON body for POST /api/v1/workspaces/:wid/templates.
+type CreateTemplateRequest struct {
+	Name        string `json:"name"`
+	UniqueKey   string `json:"unique_key"`
+	ChannelType string `json:"channel_type"`
+	Category    string `json:"category"`
+	Subject     string `json:"subject"`
+	ContentHTML string `json:"content_html"`
+	IsActive    *bool  `json:"is_active"`
+	IsDefault   *bool  `json:"is_default"`
+}
+
+// ToDomain maps the request to a domain template ready for create.
+func (r CreateTemplateRequest) ToDomain(workspaceID string) *domain.Template {
+	t := &domain.Template{
+		WorkspaceID: workspaceID,
+		Name:        r.Name,
+		UniqueKey:   r.UniqueKey,
+		ChannelType: r.ChannelType,
+		Category:    r.Category,
+		Subject:     r.Subject,
+		ContentHTML: sanitizer.SanitizeHTML(r.ContentHTML),
+		IsActive:    true,
+		IsDefault:   false,
+	}
+	if r.IsActive != nil {
+		t.IsActive = *r.IsActive
+	}
+	if r.IsDefault != nil {
+		t.IsDefault = *r.IsDefault
+	}
+	if t.ChannelType == "" {
+		t.ChannelType = "email"
+	}
+	return t
+}
+
+// PatchTemplateRequest is the JSON body for PATCH /api/v1/workspaces/:wid/templates/:tid.
+type PatchTemplateRequest struct {
+	Name        *string `json:"name"`
+	UniqueKey   *string `json:"unique_key"`
+	ChannelType *string `json:"channel_type"`
+	Category    *string `json:"category"`
+	Subject     *string `json:"subject"`
+	ContentHTML *string `json:"content_html"`
+	IsActive    *bool   `json:"is_active"`
+	IsDefault   *bool   `json:"is_default"`
+}
+
+// ToPatch maps the request to the service patch command (service loads domain, applies, saves via repository).
+func (r PatchTemplateRequest) ToPatch() service.TemplatePatch {
+	patch := service.TemplatePatch{
+		Name:        r.Name,
+		UniqueKey:   r.UniqueKey,
+		ChannelType: r.ChannelType,
+		Category:    r.Category,
+		Subject:     r.Subject,
+		ContentHTML: r.ContentHTML,
+		IsActive:    r.IsActive,
+		IsDefault:   r.IsDefault,
+	}
+	if r.ContentHTML != nil {
+		clean := sanitizer.SanitizeHTML(*r.ContentHTML)
+		patch.ContentHTML = &clean
+	}
+	return patch
+}
diff --git a/internal/presentation/dto/workspace.go b/internal/presentation/dto/workspace.go
new file mode 100644
index 00000000..e0d1d11d
--- /dev/null
+++ b/internal/presentation/dto/workspace.go
@@ -0,0 +1,74 @@
+package dto
+
+import (
+	"time"
+
+	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
+	"github.com/weprodev/wpd-message-gateway/internal/core/service"
+)
+
+// CreateWorkspaceRequest is the JSON body for POST /api/v1/workspaces.
+type CreateWorkspaceRequest struct {
+	Name    string `json:"name"`
+	Slug    string `json:"slug"`
+	IconKey string `json:"icon_key"`
+}
+
+// JoinWorkspaceRequest is the JSON body for POST /api/v1/workspaces/join.
+type JoinWorkspaceRequest struct {
+	Slug string `json:"slug"`
+	PIN  string `json:"pin"`
+}
+
+// PatchWorkspaceRequest is the JSON body for PATCH /api/v1/workspaces/:wid.
+type PatchWorkspaceRequest struct {
+	Name       *string `json:"name"`
+	Visibility *string `json:"visibility"`
+	IconKey    *string `json:"icon_key"`
+}
+
+// ToPatch maps the request to the service patch command (service loads domain, applies, saves via repository).
+func (r PatchWorkspaceRequest) ToPatch() service.WorkspacePatch {
+	return service.WorkspacePatch{
+		Name:       r.Name,
+		Visibility: r.Visibility,
+		IconKey:    r.IconKey,
+	}
+}
+
+// CreateInvitationRequest is the JSON body for POST /api/v1/workspaces/:wid/invitations.
+type CreateInvitationRequest struct {
+	Email string `json:"email"`
+	Role  string `json:"role"`
+}
+
+// ToDomain maps the request to a domain invitation for persistence.
+func (r CreateInvitationRequest) ToDomain(workspaceID string, expiresAt time.Time) *domain.Invitation {
+	return &domain.Invitation{
+		WorkspaceID: workspaceID,
+		Email:       r.Email,
+		Role:        r.Role,
+		ExpiresAt:   expiresAt,
+		Status:      "pending",
+	}
+}
+
+// CreateInvitationResponse is returned once when an invitation is created.
+type CreateInvitationResponse struct {
+	ID        string    `json:"id"`
+	Email     string    `json:"email"`
+	Role      string    `json:"role"`
+	ExpiresAt time.Time `json:"expires_at"`
+	Token     string    `json:"token"`
+}
+
+// CreateInvitationResponseFromDomain maps a persisted invitation and one-time token.
+func CreateInvitationResponseFromDomain(inv domain.Invitation, token string) CreateInvitationResponse {
+	return CreateInvitationResponse{
+		ID:        inv.ID,
+		Email:     inv.Email,
+		Role:      inv.Role,
+		ExpiresAt: inv.ExpiresAt,
+		Token:     token,
+	}
+}
diff --git a/internal/presentation/handler/portal_auth_handler.go b/internal/presentation/handler/portal_auth_handler.go
index 56159877..dc3b8cd5 100644
--- a/internal/presentation/handler/portal_auth_handler.go
+++ b/internal/presentation/handler/portal_auth_handler.go
@@ -10,6 +10,7 @@ import (
 	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
 	"github.com/weprodev/wpd-message-gateway/internal/core/port"
 	"github.com/weprodev/wpd-message-gateway/internal/core/service"
+	"github.com/weprodev/wpd-message-gateway/internal/presentation/dto"
 	customMiddleware "github.com/weprodev/wpd-message-gateway/internal/presentation/middleware"
 )
 
@@ -22,31 +23,8 @@ func NewPortalAuthHandler(svc *service.PortalService, authSvc *service.AuthServi
 	return &PortalAuthHandler{svc: svc, authSvc: authSvc}
 }
 
-type registerBody struct {
-	FirstName string `json:"first_name"`
-	LastName  string `json:"last_name"`
-	Email     string `json:"email"`
-	Password  string `json:"password"`
-}
-
-type loginBody struct {
-	Email    string `json:"email"`
-	Password string `json:"password"`
-}
-
-type tokenResponse struct {
-	Token      string             `json:"token"`
-	User       *domain.User       `json:"user"`
-	Workspaces []domain.Workspace `json:"workspaces"`
-}
-
-type userProfileResponse struct {
-	*domain.User
-	Workspaces []domain.Workspace `json:"workspaces"`
-}
-
 func (h *PortalAuthHandler) Register(c echo.Context) error {
-	var body registerBody
+	var body dto.RegisterRequest
 	if err := c.Bind(&body); err != nil {
 		slog.ErrorContext(c.Request().Context(), "failed to bind register body", "error", err)
 		return echo.NewHTTPError(http.StatusBadRequest, "invalid JSON")
@@ -74,7 +52,7 @@ func (h *PortalAuthHandler) VerifyEmail(c echo.Context) error {
 }
 
 func (h *PortalAuthHandler) Login(c echo.Context) error {
-	var body loginBody
+	var body dto.LoginRequest
 	if err := c.Bind(&body); err != nil {
 		slog.ErrorContext(c.Request().Context(), "failed to bind login body", "error", err)
 		return echo.NewHTTPError(http.StatusBadRequest, "invalid JSON")
@@ -92,7 +70,7 @@ func (h *PortalAuthHandler) Login(c echo.Context) error {
 		workspaces = []domain.Workspace{}
 	}
 
-	return c.JSON(http.StatusOK, tokenResponse{Token: token, User: u, Workspaces: workspaces})
+	return c.JSON(http.StatusOK, dto.LoginResponseFromDomain(token, u, workspaces))
 }
 
 func (h *PortalAuthHandler) Me(c echo.Context) error {
@@ -112,5 +90,5 @@ func (h *PortalAuthHandler) Me(c echo.Context) error {
 		workspaces = []domain.Workspace{}
 	}
 
-	return c.JSON(http.StatusOK, userProfileResponse{User: u, Workspaces: workspaces})
+	return c.JSON(http.StatusOK, dto.UserProfileResponseFromDomain(u, workspaces))
 }
diff --git a/internal/presentation/handler/portal_handler.go b/internal/presentation/handler/portal_handler.go
index 52b419fc..4b68f429 100644
--- a/internal/presentation/handler/portal_handler.go
+++ b/internal/presentation/handler/portal_handler.go
@@ -5,34 +5,21 @@ import (
 	"log/slog"
 	"net/http"
 	"strconv"
-	"time"
 
 	"github.com/labstack/echo/v4"
 
-	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
 	"github.com/weprodev/wpd-message-gateway/internal/core/port"
 	"github.com/weprodev/wpd-message-gateway/internal/core/service"
+	"github.com/weprodev/wpd-message-gateway/internal/presentation/dto"
 )
 
 // PortalHandler exposes REST endpoints for the web portal (JWT, not API keys).
 type PortalHandler struct {
-	svc     *service.PortalService
-	gateway *service.GatewayService
-	logs    port.MessageRequestLogRepository
-	helper  *SendHelper
+	svc *service.PortalService
 }
 
-func NewPortalHandler(
-	svc *service.PortalService,
-	gateway *service.GatewayService,
-	logs port.MessageRequestLogRepository,
-) *PortalHandler {
-	return &PortalHandler{
-		svc:     svc,
-		gateway: gateway,
-		logs:    logs,
-		helper:  NewSendHelper(gateway),
-	}
+func NewPortalHandler(svc *service.PortalService) *PortalHandler {
+	return &PortalHandler{svc: svc}
 }
 
 // safeHTTPError returns an HTTPError with a sanitised message.
@@ -54,28 +41,6 @@ func safeHTTPError(err error, fallbackStatus int, fallbackMessage string) *echo.
 	return echo.NewHTTPError(fallbackStatus, fallbackMessage)
 }
 
-type apiKeyPublic struct {
-	ID          string     `json:"id"`
-	WorkspaceID string     `json:"workspace_id"`
-	ClientID    string     `json:"client_id"`
-	Name        string     `json:"name"`
-	IsActive    bool       `json:"is_active"`
-	LastUsedAt  *time.Time `json:"last_used_at,omitempty"`
-	CreatedAt   time.Time  `json:"created_at"`
-	ExpiresAt   *time.Time `json:"expires_at,omitempty"`
-}
-
-type createAPIKeyBody struct {
-	Name string `json:"name"`
-}
-
-func toAPIKeyPublic(k domain.APIKey) apiKeyPublic {
-	return apiKeyPublic{
-		ID: k.ID, WorkspaceID: k.WorkspaceID, ClientID: k.ClientID, Name: k.Name,
-		IsActive: k.IsActive, LastUsedAt: k.LastUsedAt, CreatedAt: k.CreatedAt, ExpiresAt: k.ExpiresAt,
-	}
-}
-
 func (h *PortalHandler) ListAPIKeys(c echo.Context) error {
 	wid := c.Param("wid")
 	keys, err := h.svc.ListAPIKeys(c.Request().Context(), wid)
@@ -83,16 +48,16 @@ func (h *PortalHandler) ListAPIKeys(c echo.Context) error {
 		slog.ErrorContext(c.Request().Context(), "failed to list api keys", "error", err)
 		return safeHTTPError(err, http.StatusInternalServerError, "failed to list api keys")
 	}
-	out := make([]apiKeyPublic, 0, len(keys))
+	out := make([]dto.APIKeyPublic, 0, len(keys))
 	for _, k := range keys {
-		out = append(out, toAPIKeyPublic(k))
+		out = append(out, dto.APIKeyPublicFromDomain(k))
 	}
 	return c.JSON(http.StatusOK, out)
 }
 
 func (h *PortalHandler) CreateAPIKey(c echo.Context) error {
 	wid := c.Param("wid")
-	var body createAPIKeyBody
+	var body dto.CreateAPIKeyRequest
 	if err := c.Bind(&body); err != nil {
 		slog.ErrorContext(c.Request().Context(), "failed to bind api key body", "error", err, "workspace_id", wid)
 		return echo.NewHTTPError(http.StatusBadRequest, "invalid JSON")
@@ -105,13 +70,7 @@ func (h *PortalHandler) CreateAPIKey(c echo.Context) error {
 		slog.ErrorContext(c.Request().Context(), "failed to create api key", "error", err, "workspace_id", wid, "name", body.Name)
 		return safeHTTPError(err, http.StatusBadRequest, "failed to create api key")
 	}
-	pub := toAPIKeyPublic(*k)
-	return c.JSON(http.StatusCreated, map[string]any{
-		"id": pub.ID, "workspace_id": pub.WorkspaceID, "client_id": pub.ClientID,
-		"name": pub.Name, "is_active": pub.IsActive, "last_used_at": pub.LastUsedAt,
-		"created_at": pub.CreatedAt, "expires_at": pub.ExpiresAt,
-		"client_secret": secret,
-	})
+	return c.JSON(http.StatusCreated, dto.CreateAPIKeyResponseFromDomain(*k, secret))
 }
 
 func (h *PortalHandler) DeleteAPIKey(c echo.Context) error {
@@ -132,43 +91,7 @@ func (h *PortalHandler) RegenerateAPIKey(c echo.Context) error {
 		slog.ErrorContext(c.Request().Context(), "failed to regenerate api key", "error", err, "workspace_id", wid, "api_key_id", keyID)
 		return safeHTTPError(err, http.StatusBadRequest, "failed to regenerate api key")
 	}
-	return c.JSON(http.StatusOK, map[string]string{"client_secret": secret})
-}
-
-type messageRequestLogDTO struct {
-	ID           string    `json:"id"`
-	WorkspaceID  string    `json:"workspace_id"`
-	APIKeyID     string    `json:"api_key_id,omitempty"`
-	ChannelType  string    `json:"channel_type"`
-	HTTPMethod   string    `json:"http_method"`
-	StatusCode   int       `json:"status_code"`
-	Endpoint     string    `json:"endpoint"`
-	ProviderName string    `json:"provider_name,omitempty"`
-	RequestID    string    `json:"request_id,omitempty"`
-	DurationMs   int       `json:"duration_ms,omitempty"`
-	ErrorMessage string    `json:"error_message,omitempty"`
-	CreatedAt    time.Time `json:"created_at"`
-	SourceName   string    `json:"source_name"`
-	ClientID     string    `json:"client_id,omitempty"`
-}
-
-func toMessageRequestLogDTO(l domain.MessageRequestLogWithSource) messageRequestLogDTO {
-	return messageRequestLogDTO{
-		ID:           l.ID,
-		WorkspaceID:  l.WorkspaceID,
-		APIKeyID:     l.APIKeyID,
-		ChannelType:  l.ChannelType,
-		HTTPMethod:   l.HTTPMethod,
-		StatusCode:   l.StatusCode,
-		Endpoint:     l.Endpoint,
-		ProviderName: l.ProviderName,
-		RequestID:    l.RequestID,
-		DurationMs:   l.DurationMs,
-		ErrorMessage: l.ErrorMessage,
-		CreatedAt:    l.CreatedAt,
-		SourceName:   l.SourceName,
-		ClientID:     l.ClientID,
-	}
+	return c.JSON(http.StatusOK, dto.RegenerateAPIKeyResponseFromDomain(secret))
 }
 
 func (h *PortalHandler) ListLogs(c echo.Context) error {
@@ -192,11 +115,7 @@ func (h *PortalHandler) ListLogs(c echo.Context) error {
 		slog.ErrorContext(c.Request().Context(), "failed to list logs", "error", err)
 		return safeHTTPError(err, http.StatusInternalServerError, "failed to list logs")
 	}
-	out := make([]messageRequestLogDTO, 0, len(rows))
-	for _, r := range rows {
-		out = append(out, toMessageRequestLogDTO(r))
-	}
-	return c.JSON(http.StatusOK, map[string]any{"items": out, "total": total})
+	return c.JSON(http.StatusOK, dto.MessageRequestLogListFromDomain(rows, total))
 }
 
 func (h *PortalHandler) GetSettings(c echo.Context) error {
@@ -211,7 +130,7 @@ func (h *PortalHandler) GetSettings(c echo.Context) error {
 
 func (h *PortalHandler) PatchSettings(c echo.Context) error {
 	wid := c.Param("wid")
-	var body map[string]string
+	var body dto.PatchSettingsRequest
 	if err := c.Bind(&body); err != nil {
 		slog.ErrorContext(c.Request().Context(), "failed to bind settings body", "error", err, "workspace_id", wid)
 		return echo.NewHTTPError(http.StatusBadRequest, "invalid JSON")
diff --git a/internal/presentation/handler/portal_integration_handler.go b/internal/presentation/handler/portal_integration_handler.go
index 692eaa04..5565a989 100644
--- a/internal/presentation/handler/portal_integration_handler.go
+++ b/internal/presentation/handler/portal_integration_handler.go
@@ -1,14 +1,13 @@
 package handler
 
 import (
-	"encoding/json"
 	"log/slog"
 	"net/http"
 
 	"github.com/labstack/echo/v4"
 
-	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
 	"github.com/weprodev/wpd-message-gateway/internal/core/service"
+	"github.com/weprodev/wpd-message-gateway/internal/presentation/dto"
 )
 
 type PortalIntegrationHandler struct {
@@ -19,28 +18,6 @@ func NewPortalIntegrationHandler(svc *service.PortalService) *PortalIntegrationH
 	return &PortalIntegrationHandler{svc: svc}
 }
 
-type integrationBody struct {
-	ChannelType  string          `json:"channel_type"`
-	ProviderName string          `json:"provider_name"`
-	Config       json.RawMessage `json:"config"`
-	Status       string          `json:"status"`
-	IsDefault    bool            `json:"is_default"`
-}
-
-func integrationToJSON(intg domain.Integration) map[string]any {
-	return map[string]any{
-		"id":            intg.ID,
-		"workspace_id":  intg.WorkspaceID,
-		"channel_type":  intg.ChannelType,
-		"provider_name": intg.ProviderName,
-		"config":        json.RawMessage(intg.Config),
-		"status":        intg.Status,
-		"is_default":    intg.IsDefault,
-		"created_at":    intg.CreatedAt,
-		"updated_at":    intg.UpdatedAt,
-	}
-}
-
 func (h *PortalIntegrationHandler) ListIntegrations(c echo.Context) error {
 	wid := c.Param("wid")
 	list, err := h.svc.ListIntegrations(c.Request().Context(), wid)
@@ -48,42 +25,30 @@ func (h *PortalIntegrationHandler) ListIntegrations(c echo.Context) error {
 		slog.ErrorContext(c.Request().Context(), "failed to list integrations", "error", err)
 		return safeHTTPError(err, http.StatusInternalServerError, "failed to list integrations")
 	}
-	out := make([]map[string]any, 0, len(list))
+	out := make([]dto.Integration, 0, len(list))
 	for _, intg := range list {
-		out = append(out, integrationToJSON(intg))
+		out = append(out, dto.IntegrationFromDomain(intg))
 	}
 	return c.JSON(http.StatusOK, out)
 }
 
 func (h *PortalIntegrationHandler) UpsertIntegration(c echo.Context) error {
 	wid := c.Param("wid")
-	var body integrationBody
+	var body dto.UpsertIntegrationRequest
 	if err := c.Bind(&body); err != nil {
 		slog.ErrorContext(c.Request().Context(), "failed to bind integration body", "error", err, "workspace_id", wid)
 		return echo.NewHTTPError(http.StatusBadRequest, "invalid JSON")
 	}
-	cfg, err := service.IntegrationConfigJSON(body.Config)
+	intg, err := body.ToDomain(wid)
 	if err != nil {
 		slog.ErrorContext(c.Request().Context(), "failed to parse integration config JSON", "error", err, "workspace_id", wid, "provider_name", body.ProviderName)
 		return echo.NewHTTPError(http.StatusBadRequest, "invalid config JSON")
 	}
-	status := body.Status
-	if status == "" {
-		status = domain.IntegrationStatusConnected
-	}
-	intg := &domain.Integration{
-		WorkspaceID:  wid,
-		ChannelType:  body.ChannelType,
-		ProviderName: body.ProviderName,
-		Config:       cfg,
-		Status:       status,
-		IsDefault:    body.IsDefault,
-	}
 	if err := h.svc.UpsertIntegration(c.Request().Context(), intg); err != nil {
 		slog.ErrorContext(c.Request().Context(), "failed to upsert integration", "error", err, "workspace_id", wid, "provider_name", body.ProviderName)
 		return safeHTTPError(err, http.StatusBadRequest, "failed to upsert integration")
 	}
-	return c.JSON(http.StatusOK, integrationToJSON(*intg))
+	return c.JSON(http.StatusOK, dto.IntegrationFromDomain(*intg))
 }
 
 func (h *PortalIntegrationHandler) DeleteIntegration(c echo.Context) error {
diff --git a/internal/presentation/handler/portal_send.go b/internal/presentation/handler/portal_send.go
deleted file mode 100644
index 6bf71712..00000000
--- a/internal/presentation/handler/portal_send.go
+++ /dev/null
@@ -1,46 +0,0 @@
-package handler
-
-import (
-	"context"
-	"net/http"
-
-	"github.com/labstack/echo/v4"
-
-	"github.com/weprodev/wpd-message-gateway/pkg/contracts"
-)
-
-// SendTest dispatches a test message through the gateway for the workspace (portal JWT auth).
-func (h *PortalHandler) SendTest(c echo.Context) error {
-	if h.gateway == nil || h.helper == nil {
-		return echo.NewHTTPError(http.StatusServiceUnavailable, "send test unavailable")
-	}
-
-	wid := c.Param("wid")
-	channel := c.Param("channel")
-	endpoint := "/api/v1/workspaces/" + wid + "/send-test/" + channel
-
-	switch channel {
-	case "email":
-		var req contracts.Email
-		return h.helper.DispatchAndLog(c, channel, wid, "", endpoint, &req, func(sendCtx context.Context) (*contracts.SendResult, error) {
-			return h.gateway.SendEmail(sendCtx, wid, req)
-		})
-	case "sms":
-		var req contracts.SMS
-		return h.helper.DispatchAndLog(c, channel, wid, "", endpoint, &req, func(sendCtx context.Context) (*contracts.SendResult, error) {
-			return h.gateway.SendSMS(sendCtx, wid, req)
-		})
-	case "push":
-		var req contracts.PushNotification
-		return h.helper.DispatchAndLog(c, channel, wid, "", endpoint, &req, func(sendCtx context.Context) (*contracts.SendResult, error) {
-			return h.gateway.SendPush(sendCtx, wid, req)
-		})
-	case "chat":
-		var req contracts.ChatMessage
-		return h.helper.DispatchAndLog(c, channel, wid, "", endpoint, &req, func(sendCtx context.Context) (*contracts.SendResult, error) {
-			return h.gateway.SendChat(sendCtx, wid, req)
-		})
-	default:
-		return echo.NewHTTPError(http.StatusBadRequest, "unsupported channel")
-	}
-}
diff --git a/internal/presentation/handler/portal_template_handler.go b/internal/presentation/handler/portal_template_handler.go
index 9f32fe35..ed259b2c 100644
--- a/internal/presentation/handler/portal_template_handler.go
+++ b/internal/presentation/handler/portal_template_handler.go
@@ -5,10 +5,9 @@ import (
 	"net/http"
 
 	"github.com/labstack/echo/v4"
-	"github.com/weprodev/go-pkg/sanitizer"
 
-	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
 	"github.com/weprodev/wpd-message-gateway/internal/core/service"
+	"github.com/weprodev/wpd-message-gateway/internal/presentation/dto"
 )
 
 type PortalTemplateHandler struct {
@@ -19,28 +18,6 @@ func NewPortalTemplateHandler(svc *service.PortalService) *PortalTemplateHandler
 	return &PortalTemplateHandler{svc: svc}
 }
 
-type templateBody struct {
-	Name        string `json:"name"`
-	UniqueKey   string `json:"unique_key"`
-	ChannelType string `json:"channel_type"`
-	Category    string `json:"category"`
-	Subject     string `json:"subject"`
-	ContentHTML string `json:"content_html"`
-	IsActive    *bool  `json:"is_active"`
-	IsDefault   *bool  `json:"is_default"`
-}
-
-type patchTemplateBody struct {
-	Name        *string `json:"name"`
-	UniqueKey   *string `json:"unique_key"`
-	ChannelType *string `json:"channel_type"`
-	Category    *string `json:"category"`
-	Subject     *string `json:"subject"`
-	ContentHTML *string `json:"content_html"`
-	IsActive    *bool   `json:"is_active"`
-	IsDefault   *bool   `json:"is_default"`
-}
-
 func (h *PortalTemplateHandler) ListTemplates(c echo.Context) error {
 	wid := c.Param("wid")
 	list, err := h.svc.ListTemplates(c.Request().Context(), wid)
@@ -53,31 +30,12 @@ func (h *PortalTemplateHandler) ListTemplates(c echo.Context) error {
 
 func (h *PortalTemplateHandler) CreateTemplate(c echo.Context) error {
 	wid := c.Param("wid")
-	var body templateBody
+	var body dto.CreateTemplateRequest
 	if err := c.Bind(&body); err != nil {
 		slog.ErrorContext(c.Request().Context(), "failed to bind template create body", "error", err, "workspace_id", wid)
 		return echo.NewHTTPError(http.StatusBadRequest, "invalid JSON")
 	}
-	t := &domain.Template{
-		WorkspaceID: wid,
-		Name:        body.Name,
-		UniqueKey:   body.UniqueKey,
-		ChannelType: body.ChannelType,
-		Category:    body.Category,
-		Subject:     body.Subject,
-		ContentHTML: sanitizer.SanitizeHTML(body.ContentHTML),
-		IsActive:    true,
-		IsDefault:   false,
-	}
-	if body.IsActive != nil {
-		t.IsActive = *body.IsActive
-	}
-	if body.IsDefault != nil {
-		t.IsDefault = *body.IsDefault
-	}
-	if t.ChannelType == "" {
-		t.ChannelType = "email"
-	}
+	t := body.ToDomain(wid)
 	if err := h.svc.CreateTemplate(c.Request().Context(), t); err != nil {
 		slog.ErrorContext(c.Request().Context(), "failed to create template", "error", err, "workspace_id", wid, "unique_key", body.UniqueKey)
 		return safeHTTPError(err, http.StatusBadRequest, "failed to create template")
@@ -88,21 +46,12 @@ func (h *PortalTemplateHandler) CreateTemplate(c echo.Context) error {
 func (h *PortalTemplateHandler) PatchTemplate(c echo.Context) error {
 	wid := c.Param("wid")
 	tid := c.Param("tid")
-	var body patchTemplateBody
+	var body dto.PatchTemplateRequest
 	if err := c.Bind(&body); err != nil {
 		slog.ErrorContext(c.Request().Context(), "failed to bind template patch body", "error", err, "workspace_id", wid, "template_id", tid)
 		return echo.NewHTTPError(http.StatusBadRequest, "invalid JSON")
 	}
-	patch := service.TemplatePatch{
-		Name: body.Name, UniqueKey: body.UniqueKey, ChannelType: body.ChannelType,
-		Category: body.Category, Subject: body.Subject, ContentHTML: body.ContentHTML,
-		IsActive: body.IsActive, IsDefault: body.IsDefault,
-	}
-	if body.ContentHTML != nil {
-		clean := sanitizer.SanitizeHTML(*body.ContentHTML)
-		patch.ContentHTML = &clean
-	}
-	if err := h.svc.PatchTemplate(c.Request().Context(), wid, tid, patch); err != nil {
+	if err := h.svc.PatchTemplate(c.Request().Context(), wid, tid, body.ToPatch()); err != nil {
 		slog.ErrorContext(c.Request().Context(), "failed to patch template", "error", err, "workspace_id", wid, "template_id", tid)
 		return safeHTTPError(err, http.StatusBadRequest, "failed to patch template")
 	}
diff --git a/internal/presentation/handler/portal_workspace_handler.go b/internal/presentation/handler/portal_workspace_handler.go
index 096b8053..7ba06885 100644
--- a/internal/presentation/handler/portal_workspace_handler.go
+++ b/internal/presentation/handler/portal_workspace_handler.go
@@ -7,8 +7,8 @@ import (
 
 	"github.com/labstack/echo/v4"
 
-	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
 	"github.com/weprodev/wpd-message-gateway/internal/core/service"
+	"github.com/weprodev/wpd-message-gateway/internal/presentation/dto"
 	customMiddleware "github.com/weprodev/wpd-message-gateway/internal/presentation/middleware"
 )
 
@@ -20,28 +20,6 @@ func NewPortalWorkspaceHandler(svc *service.PortalService) *PortalWorkspaceHandl
 	return &PortalWorkspaceHandler{svc: svc}
 }
 
-type createWorkspaceBody struct {
-	Name    string `json:"name"`
-	Slug    string `json:"slug"`
-	IconKey string `json:"icon_key"`
-}
-
-type joinBody struct {
-	Slug string `json:"slug"`
-	PIN  string `json:"pin"`
-}
-
-type patchWorkspaceBody struct {
-	Name       *string `json:"name"`
-	Visibility *string `json:"visibility"`
-	IconKey    *string `json:"icon_key"`
-}
-
-type invitationBody struct {
-	Email string `json:"email"`
-	Role  string `json:"role"`
-}
-
 func (h *PortalWorkspaceHandler) ListWorkspaces(c echo.Context) error {
 	uid := customMiddleware.GetPortalUserID(c.Request().Context())
 	list, err := h.svc.ListWorkspaces(c.Request().Context(), uid)
@@ -54,7 +32,7 @@ func (h *PortalWorkspaceHandler) ListWorkspaces(c echo.Context) error {
 
 func (h *PortalWorkspaceHandler) CreateWorkspace(c echo.Context) error {
 	uid := customMiddleware.GetPortalUserID(c.Request().Context())
-	var body createWorkspaceBody
+	var body dto.CreateWorkspaceRequest
 	if err := c.Bind(&body); err != nil {
 		slog.ErrorContext(c.Request().Context(), "failed to bind workspace create body", "error", err, "user_id", uid)
 		return echo.NewHTTPError(http.StatusBadRequest, "invalid JSON")
@@ -69,7 +47,7 @@ func (h *PortalWorkspaceHandler) CreateWorkspace(c echo.Context) error {
 
 func (h *PortalWorkspaceHandler) JoinWorkspace(c echo.Context) error {
 	uid := customMiddleware.GetPortalUserID(c.Request().Context())
-	var body joinBody
+	var body dto.JoinWorkspaceRequest
 	if err := c.Bind(&body); err != nil {
 		slog.ErrorContext(c.Request().Context(), "failed to bind workspace join body", "error", err, "user_id", uid)
 		return echo.NewHTTPError(http.StatusBadRequest, "invalid JSON")
@@ -93,14 +71,12 @@ func (h *PortalWorkspaceHandler) GetWorkspace(c echo.Context) error {
 
 func (h *PortalWorkspaceHandler) PatchWorkspace(c echo.Context) error {
 	wid := c.Param("wid")
-	var body patchWorkspaceBody
+	var body dto.PatchWorkspaceRequest
 	if err := c.Bind(&body); err != nil {
 		slog.ErrorContext(c.Request().Context(), "failed to bind workspace patch body", "error", err, "workspace_id", wid)
 		return echo.NewHTTPError(http.StatusBadRequest, "invalid JSON")
 	}
-	if err := h.svc.PatchWorkspace(c.Request().Context(), wid, service.WorkspacePatch{
-		Name: body.Name, Visibility: body.Visibility, IconKey: body.IconKey,
-	}); err != nil {
+	if err := h.svc.PatchWorkspace(c.Request().Context(), wid, body.ToPatch()); err != nil {
 		slog.ErrorContext(c.Request().Context(), "failed to patch workspace", "error", err, "workspace_id", wid)
 		return safeHTTPError(err, http.StatusBadRequest, "failed to patch workspace")
 	}
@@ -144,7 +120,7 @@ func (h *PortalWorkspaceHandler) ListInvitations(c echo.Context) error {
 
 func (h *PortalWorkspaceHandler) CreateInvitation(c echo.Context) error {
 	wid := c.Param("wid")
-	var body invitationBody
+	var body dto.CreateInvitationRequest
 	if err := c.Bind(&body); err != nil {
 		slog.ErrorContext(c.Request().Context(), "failed to bind invitation body", "error", err, "workspace_id", wid)
 		return echo.NewHTTPError(http.StatusBadRequest, "invalid JSON")
@@ -152,23 +128,11 @@ func (h *PortalWorkspaceHandler) CreateInvitation(c echo.Context) error {
 	if body.Email == "" || body.Role == "" {
 		return echo.NewHTTPError(http.StatusBadRequest, "email and role required")
 	}
-	inv := &domain.Invitation{
-		WorkspaceID: wid,
-		Email:       body.Email,
-		Role:        body.Role,
-		ExpiresAt:   time.Now().Add(7 * 24 * time.Hour),
-		Status:      "pending",
-	}
+	inv := body.ToDomain(wid, time.Now().Add(7*24*time.Hour))
 	rawToken, err := h.svc.CreateInvitation(c.Request().Context(), inv)
 	if err != nil {
 		slog.ErrorContext(c.Request().Context(), "failed to create invitation", "error", err, "workspace_id", wid, "email", body.Email)
 		return safeHTTPError(err, http.StatusBadRequest, "failed to create invitation")
 	}
-	return c.JSON(http.StatusCreated, map[string]any{
-		"id":         inv.ID,
-		"email":      inv.Email,
-		"role":       inv.Role,
-		"expires_at": inv.ExpiresAt,
-		"token":      rawToken,
-	})
+	return c.JSON(http.StatusCreated, dto.CreateInvitationResponseFromDomain(*inv, rawToken))
 }
diff --git a/internal/presentation/handler/send_helper.go b/internal/presentation/handler/send_helper.go
index 88e44069..096c9316 100644
--- a/internal/presentation/handler/send_helper.go
+++ b/internal/presentation/handler/send_helper.go
@@ -99,6 +99,9 @@ func (sh *SendHelper) recordLog(
 		DurationMs:   int(time.Since(start).Milliseconds()),
 		ErrorMessage: errMsg,
 	}
+	if statusCode == http.StatusOK {
+		entry.InboxMessageID = contracts.InboxMessageIDFromResult(result)
+	}
 
 	if contracts.StoreContentFromResult(result) {
 		var requestBody, responseBody string
diff --git a/internal/presentation/handler/send_helper_test.go b/internal/presentation/handler/send_helper_test.go
index 9bdfdb0c..8f4c72d7 100644
--- a/internal/presentation/handler/send_helper_test.go
+++ b/internal/presentation/handler/send_helper_test.go
@@ -88,6 +88,66 @@ func TestSendHelper_DispatchAndLog(t *testing.T) {
 		}
 	})
 
+	t.Run("successful dispatch stores inbox message id in memory mode", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodPost, "/v1/email", strings.NewReader(`{"to":["test@example.com"]}`))
+		rec := httptest.NewRecorder()
+		c := e.NewContext(req, rec)
+
+		repo := &mockLogRepo{}
+		svc := service.NewGatewayService(nil, nil, nil, nil, repo)
+		helper := NewSendHelper(svc)
+
+		var dst contracts.Email
+		err := helper.DispatchAndLog(c, "email", "ws-123", "key-456", "/v1/email", &dst, func(ctx context.Context) (*contracts.SendResult, error) {
+			return &contracts.SendResult{
+				ID: "inbox-msg-1",
+				Meta: map[string]string{
+					contracts.MetaKeyProviderName: "memory",
+					contracts.MetaKeyDispatchMode: contracts.DispatchModeMemory,
+				},
+			}, nil
+		})
+
+		if err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+		if len(repo.entries) != 1 {
+			t.Fatalf("expected 1 log entry, got %d", len(repo.entries))
+		}
+		if repo.entries[0].InboxMessageID != "inbox-msg-1" {
+			t.Errorf("expected inbox message id inbox-msg-1, got %s", repo.entries[0].InboxMessageID)
+		}
+	})
+
+	t.Run("provider dispatch with inbox capture stores inbox_message_id from meta", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodPost, "/v1/email", strings.NewReader(`{"to":["test@example.com"]}`))
+		rec := httptest.NewRecorder()
+		c := e.NewContext(req, rec)
+
+		repo := &mockLogRepo{}
+		svc := service.NewGatewayService(nil, nil, nil, nil, repo)
+		helper := NewSendHelper(svc)
+
+		var dst contracts.Email
+		err := helper.DispatchAndLog(c, "email", "ws-123", "key-456", "/v1/email", &dst, func(ctx context.Context) (*contracts.SendResult, error) {
+			return &contracts.SendResult{
+				ID: "provider-msg-1",
+				Meta: map[string]string{
+					contracts.MetaKeyProviderName:   "mailgun",
+					contracts.MetaKeyDispatchMode:   contracts.DispatchModeProvider,
+					contracts.MetaKeyInboxMessageID: "inbox-msg-2",
+				},
+			}, nil
+		})
+
+		if err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+		if repo.entries[0].InboxMessageID != "inbox-msg-2" {
+			t.Errorf("expected inbox message id inbox-msg-2, got %s", repo.entries[0].InboxMessageID)
+		}
+	})
+
 	t.Run("store_content persists request and response payloads", func(t *testing.T) {
 		req := httptest.NewRequest(http.MethodPost, "/v1/email", strings.NewReader(`{"to":["test@example.com"],"subject":"hi"}`))
 		rec := httptest.NewRecorder()
diff --git a/internal/presentation/router.go b/internal/presentation/router.go
index 1b96cf85..2be33ee6 100644
--- a/internal/presentation/router.go
+++ b/internal/presentation/router.go
@@ -176,7 +176,6 @@ func (rt *Router) Setup() *echo.Echo {
 
 	protected.GET("/workspaces/:wid/invitations", pw.ListInvitations, customMiddleware.RequirePermission(rt.gate, rt.workspaceRepo, domain.PermissionInvitationsRead))
 	protected.POST("/workspaces/:wid/invitations", pw.CreateInvitation, customMiddleware.RequirePermission(rt.gate, rt.workspaceRepo, domain.PermissionInvitationsWrite))
-	protected.POST("/workspaces/:wid/send-test/:channel", ph.SendTest, customMiddleware.RequirePermission(rt.gate, rt.workspaceRepo, domain.PermissionSendTest))
 
 	// Inbox API — JWT + logs.read (same access model as message logs overview).
 	if rt.memberRepo != nil {
diff --git a/pkg/contracts/message.go b/pkg/contracts/message.go
index c87aa708..7a00e173 100644
--- a/pkg/contracts/message.go
+++ b/pkg/contracts/message.go
@@ -9,8 +9,14 @@ type Attachment struct {
 }
 
 const (
-	MetaKeyProviderName = "provider_name"
-	MetaKeyStoreContent = "store_content"
+	MetaKeyProviderName   = "provider_name"
+	MetaKeyStoreContent   = "store_content"
+	MetaKeyInboxMessageID = "inbox_message_id"
+	MetaKeyDispatchMode   = "dispatch_mode"
+
+	// Dispatch mode values mirror domain.MessageDispatchMode
+	DispatchModeMemory   = "memory"
+	DispatchModeProvider = "provider"
 
 	metaStoreContentTrue  = "true"
 	metaStoreContentFalse = "false"
@@ -32,6 +38,14 @@ func ProviderNameFromResult(r *SendResult) string {
 	return r.Meta[MetaKeyProviderName]
 }
 
+// DispatchModeFromResult returns dispatch_mode from metadata when present.
+func DispatchModeFromResult(r *SendResult) string {
+	if r == nil || r.Meta == nil {
+		return ""
+	}
+	return r.Meta[MetaKeyDispatchMode]
+}
+
 // StoreContentFromResult reports whether dispatch metadata requests persisting request/response bodies.
 func StoreContentFromResult(r *SendResult) bool {
 	if r == nil || r.Meta == nil {
@@ -40,6 +54,23 @@ func StoreContentFromResult(r *SendResult) bool {
 	return r.Meta[MetaKeyStoreContent] == metaStoreContentTrue
 }
 
+// InboxMessageIDFromResult returns the inbox message ID when dispatch captured content.
+//
+// Provider dispatch stores the inbox UUID in MetaKeyInboxMessageID; SendResult.ID is the provider ID.
+// Memory-only dispatch has no provider result, so SendResult.ID is the inbox UUID.
+func InboxMessageIDFromResult(r *SendResult) string {
+	if r == nil || r.Meta == nil {
+		return ""
+	}
+	if id := r.Meta[MetaKeyInboxMessageID]; id != "" {
+		return id
+	}
+	if r.Meta[MetaKeyDispatchMode] == DispatchModeMemory && r.ID != "" {
+		return r.ID
+	}
+	return ""
+}
+
 // SetStoreContentMeta stamps store_content on r.Meta for downstream logging.
 func SetStoreContentMeta(r *SendResult, storeContent bool) {
 	if r.Meta == nil {
@@ -51,3 +82,11 @@ func SetStoreContentMeta(r *SendResult, storeContent bool) {
 		r.Meta[MetaKeyStoreContent] = metaStoreContentFalse
 	}
 }
+
+// SetDispatchModeMeta stamps dispatch_mode on r.Meta.
+func SetDispatchModeMeta(r *SendResult, mode string) {
+	if r.Meta == nil {
+		r.Meta = make(map[string]string)
+	}
+	r.Meta[MetaKeyDispatchMode] = mode
+}
diff --git a/pkg/contracts/message_test.go b/pkg/contracts/message_test.go
index 70b158fa..62b63a37 100644
--- a/pkg/contracts/message_test.go
+++ b/pkg/contracts/message_test.go
@@ -27,6 +27,59 @@ func TestStoreContentFromResult(t *testing.T) {
 	}
 }
 
+func TestDispatchModeFromResult(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name string
+		r    *SendResult
+		want string
+	}{
+		{"nil result", nil, ""},
+		{"memory", &SendResult{Meta: map[string]string{MetaKeyDispatchMode: DispatchModeMemory}}, DispatchModeMemory},
+		{"provider", &SendResult{Meta: map[string]string{MetaKeyDispatchMode: DispatchModeProvider}}, DispatchModeProvider},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			if got := DispatchModeFromResult(tt.r); got != tt.want {
+				t.Fatalf("DispatchModeFromResult() = %q, want %q", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestInboxMessageIDFromResult(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name string
+		r    *SendResult
+		want string
+	}{
+		{"nil result", nil, ""},
+		{"provider without inbox", &SendResult{ID: "prov-1", Meta: map[string]string{MetaKeyDispatchMode: DispatchModeProvider}}, ""},
+		{"memory mode", &SendResult{ID: "inbox-1", Meta: map[string]string{MetaKeyDispatchMode: DispatchModeMemory}}, "inbox-1"},
+		{"provider with inbox meta", &SendResult{
+			ID: "prov-1",
+			Meta: map[string]string{
+				MetaKeyDispatchMode:   DispatchModeProvider,
+				MetaKeyInboxMessageID: "inbox-2",
+			},
+		}, "inbox-2"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			if got := InboxMessageIDFromResult(tt.r); got != tt.want {
+				t.Fatalf("InboxMessageIDFromResult() = %q, want %q", got, tt.want)
+			}
+		})
+	}
+}
+
 func TestSetStoreContentMeta(t *testing.T) {
 	t.Parallel()
 
@@ -51,3 +104,22 @@ func TestSetStoreContentMeta(t *testing.T) {
 		}
 	})
 }
+
+func TestSetDispatchModeMeta(t *testing.T) {
+	t.Parallel()
+
+	r := &SendResult{}
+	SetDispatchModeMeta(r, DispatchModeProvider)
+	if got := DispatchModeFromResult(r); got != DispatchModeProvider {
+		t.Fatalf("dispatch_mode: %q", got)
+	}
+}
+
+func TestDispatchModeValuesMatchDomain(t *testing.T) {
+	t.Parallel()
+
+	// Document the cross-package contract without importing internal/domain.
+	if DispatchModeMemory != "memory" || DispatchModeProvider != "provider" {
+		t.Fatal("dispatch mode constants must stay aligned with domain.MessageDispatchMode")
+	}
+}

From 2557364d4217dfe4c4e2498aaf3dd4c772744fff Mon Sep 17 00:00:00 2001
From: MichaelAndish <maikel1370@gmail.com>
Date: Sat, 4 Jul 2026 13:18:30 +0200
Subject: [PATCH 11/20] feat: enhance database initialization and update
 workspace ID handling

- Added utility functions for generating curl examples with workspace ID and client ID for improved onboarding experience in the frontend.
- Refactored inbox-related components and hooks to utilize the new workspace ID structure, enhancing the overall user experience.
- Changed workspace key references in documentation and code to use a UUID format instead of a slug for better consistency and clarity.

This commit improves the database setup process and ensures a more robust handling of workspace identifiers across the application.
---
 .../references/wpd-message-gateway.md         |   2 +-
 .../references/wpd-message-gateway.md         |   2 +-
 Makefile                                      |  13 +-
 Readme.md                                     |   4 +-
 database/init-db.sh                           |   8 +
 database/seeds/001_seed_permissions.sql       |   6 +-
 docs/agents/review-agent.md                   |   2 +-
 docs/backend/architecture.md                  |  25 ++-
 docs/backend/e2e-testing.md                   |   4 +-
 docs/backend/portal-inbox.md                  |  24 +--
 docs/backend/usage.md                         |  42 ++---
 .../get-started-dialog.stories.tsx            |   4 +-
 .../get-started-dialog/get-started-dialog.tsx | 117 ++++++++++---
 .../inbox/get-started-dialog.utils.test.ts    |  17 ++
 .../inbox/get-started-dialog.utils.ts         |  27 +++
 .../src/features/inbox/get-started.api.ts     |  37 +++++
 .../hooks/use-get-started-context.hook.ts     |  44 +++++
 .../inbox/hooks/use-inbox-emails.hook.ts      | 115 +++++++++++++
 .../inbox/hooks/use-inbox-logs.hook.ts        |   1 +
 frontend/src/features/inbox/inbox.api.ts      |  28 ++--
 frontend/src/features/inbox/logs.schema.ts    |   8 +-
 .../features/inbox/pages/email-inbox.page.tsx | 157 ++++--------------
 .../api-key-create-dialog.stories.tsx         |  21 +++
 .../api-key-create-dialog.test.tsx            |  29 ++++
 .../api-key-create-dialog.tsx                 | 100 +++++++++++
 .../components/api-key-create-dialog/index.ts |   1 +
 .../api-key-secret-dialog.stories.tsx         |  20 +++
 .../api-key-secret-dialog.tsx                 |  98 +++++++++++
 .../components/api-key-secret-dialog/index.ts |   1 +
 .../features/settings/pages/settings.page.tsx |  48 +++++-
 .../src/features/settings/settings.types.ts   |   8 +
 internal/app/wire.go                          |  11 +-
 internal/core/domain/permission.go            |   4 +-
 internal/core/service/email_enrichment.go     |   7 +-
 internal/core/service/gateway_service.go      |  21 ++-
 internal/presentation/middleware/auth.go      |  15 +-
 internal/presentation/middleware/auth_test.go |  76 +++++++++
 internal/presentation/router.go               |  12 +-
 38 files changed, 910 insertions(+), 249 deletions(-)
 create mode 100644 frontend/src/features/inbox/get-started-dialog.utils.test.ts
 create mode 100644 frontend/src/features/inbox/get-started-dialog.utils.ts
 create mode 100644 frontend/src/features/inbox/get-started.api.ts
 create mode 100644 frontend/src/features/inbox/hooks/use-get-started-context.hook.ts
 create mode 100644 frontend/src/features/inbox/hooks/use-inbox-emails.hook.ts
 create mode 100644 frontend/src/features/settings/components/api-key-create-dialog/api-key-create-dialog.stories.tsx
 create mode 100644 frontend/src/features/settings/components/api-key-create-dialog/api-key-create-dialog.test.tsx
 create mode 100644 frontend/src/features/settings/components/api-key-create-dialog/api-key-create-dialog.tsx
 create mode 100644 frontend/src/features/settings/components/api-key-create-dialog/index.ts
 create mode 100644 frontend/src/features/settings/components/api-key-secret-dialog/api-key-secret-dialog.stories.tsx
 create mode 100644 frontend/src/features/settings/components/api-key-secret-dialog/api-key-secret-dialog.tsx
 create mode 100644 frontend/src/features/settings/components/api-key-secret-dialog/index.ts
 create mode 100644 internal/presentation/middleware/auth_test.go

diff --git a/.agents/skills/golang-pro/references/wpd-message-gateway.md b/.agents/skills/golang-pro/references/wpd-message-gateway.md
index cb6dd743..64ebbcac 100644
--- a/.agents/skills/golang-pro/references/wpd-message-gateway.md
+++ b/.agents/skills/golang-pro/references/wpd-message-gateway.md
@@ -42,7 +42,7 @@ Sender interfaces (`EmailSender`, `SMSSender`, …) live in **`pkg/contracts/`**
 2. Register via `init()` in `register.go` → `pkg/registry`
 3. Blank-import in **`internal/app/imports.go`** (server mode only)
 
-Do **not** add providers under `internal/infrastructure/provider/` (deprecated).
+Add providers only under **`pkg/provider/<name>/`** (registered via `pkg/registry`, blank-imported in `internal/app/imports.go`).
 
 ---
 
diff --git a/.agents/skills/software-architecture/references/wpd-message-gateway.md b/.agents/skills/software-architecture/references/wpd-message-gateway.md
index 0acc68f0..b57e6c68 100644
--- a/.agents/skills/software-architecture/references/wpd-message-gateway.md
+++ b/.agents/skills/software-architecture/references/wpd-message-gateway.md
@@ -40,7 +40,7 @@ Router → Middleware → Handler → Service → Port ← Repository / Provider
 | `MGW.ARCH-PKG-INTERNAL` | `pkg/` imports `internal/` |
 | `MGW.ARCH-HANDLER-SQL` | SQL or provider SDK in handlers |
 | `MGW.ARCH-SERVICE-HTTP` | Echo/HTTP types in services |
-| `MGW.ARCH-PROVIDER-INTERNAL` | New provider under `internal/infrastructure/provider/` |
+| `MGW.ARCH-PROVIDER-INTERNAL` | New provider under `internal/` instead of `pkg/provider/<name>/` |
 | `MGW.ARCH-FAT-HANDLER` | Handler > ~200 lines or business logic in handler |
 
 **Prefer:** split handlers by portal concern (`portal_auth_handler`, `portal_workspace_handler`, …). Keep handlers thin — decode, call service, map response.
diff --git a/Makefile b/Makefile
index a554848f..64a4b950 100644
--- a/Makefile
+++ b/Makefile
@@ -1,4 +1,4 @@
-.PHONY: it install upgrade setup specify spec clarify clr plan pln tasks tsk implement impl analyze alyz checklist chk pr sync agents agents-kill start stop test audit build clean docker-check dev dev-down seed-demo help ui-install ui ui-build ui-format ui-test ui-lint storybook
+.PHONY: it install upgrade setup specify spec clarify clr plan pln tasks tsk implement impl analyze alyz checklist chk pr sync agents agents-kill start stop test audit build clean docker-check dev dev-down db-init seed-demo help ui-install ui ui-build ui-format ui-test ui-lint storybook
 
 # ============================================================================
 # ANSI Color Codes
@@ -322,6 +322,16 @@ dev-down: docker-check
 	@docker compose down
 	@printf "$(GREEN)✅ Stopped!$(RESET)\n"
 
+## Apply schema + seeds when Postgres volume exists but tables are missing (then restart gateway)
+db-init: docker-check
+	@printf "\n"
+	@printf "$(BOLD)$(CYAN)🗄️  Initializing database schema and seeds...$(RESET)\n"
+	@docker compose exec -T -e POSTGRES_USER=gateway -e POSTGRES_DB=gateway db \
+		bash /docker-entrypoint-initdb.d/init-db.sh
+	@docker compose restart gateway
+	@printf "$(GREEN)✅ Database ready (demo@weprodev.com / secret)$(RESET)\n"
+	@printf "\n"
+
 ## Re-apply SQL seeds to the running Postgres container (demo user, RBAC, providers)
 seed-demo: docker-check
 	@printf "\n"
@@ -376,6 +386,7 @@ help:
 	@printf "$(BOLD)$(GREEN)🐳 Docker$(RESET)\n"
 	@printf "   $(YELLOW)make dev$(RESET)          Start Gateway, DB, and UI via Docker (with hot-reloading)\n"
 	@printf "   $(YELLOW)make dev-down$(RESET)     Stop Docker containers\n"
+	@printf "   $(YELLOW)make db-init$(RESET)      Apply schema + seeds if DB volume is empty (demo login)\n"
 	@printf "   $(YELLOW)make seed-demo$(RESET)    Re-apply SQL seeds (demo@weprodev.com / secret)\n"
 	@printf "\n"
 
diff --git a/Readme.md b/Readme.md
index 7db6392b..84c00018 100644
--- a/Readme.md
+++ b/Readme.md
@@ -108,12 +108,12 @@ Seeded on first DB init. Reset anytime: `make seed-demo`.
 |--|--|
 | Portal | `demo@weprodev.com` / `secret` |
 | API key | `demo-client-id` / `demo-secret` |
-| Workspace key | `demo` |
+| Workspace ID | `00000000-0000-0000-0000-000000000001` |
 
 ```bash
 curl -X POST http://localhost:10101/v1/email \
   -u "demo-client-id:demo-secret" \
-  -H "X-Workspace-Key: demo" \
+  -H "X-Workspace-Key: 00000000-0000-0000-0000-000000000001" \
   -H "Content-Type: application/json" \
   -d '{"to":["user@example.com"],"subject":"Hello","html":"<h1>World</h1>"}'
 ```
diff --git a/database/init-db.sh b/database/init-db.sh
index 00958835..9250b432 100755
--- a/database/init-db.sh
+++ b/database/init-db.sh
@@ -3,6 +3,14 @@ set -e
 
 echo "=== Running Database Init Script ==="
 
+TABLE_EXISTS=$(psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" -tAc \
+  "SELECT EXISTS (SELECT 1 FROM information_schema.tables WHERE table_schema = 'public' AND table_name = 'users');")
+
+if [ "$TABLE_EXISTS" = "t" ]; then
+  echo "Schema already present — skipping migration and seeds."
+  exit 0
+fi
+
 echo "Applying migrations..."
 psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" \
   -f /docker-entrypoint-initdb.d/migrations/20260318000000_init_gateway.up.sql
diff --git a/database/seeds/001_seed_permissions.sql b/database/seeds/001_seed_permissions.sql
index 5cc17afb..27b1beb4 100644
--- a/database/seeds/001_seed_permissions.sql
+++ b/database/seeds/001_seed_permissions.sql
@@ -25,7 +25,7 @@ VALUES
     (gen_random_uuid(), 'settings.write', 'web'),
     (gen_random_uuid(), 'invitations.read', 'web'),
     (gen_random_uuid(), 'invitations.write', 'web'),
-    (gen_random_uuid(), 'send.test', 'web')
+    (gen_random_uuid(), 'inbox.write', 'web')
 ON CONFLICT (name, guard_name) DO NOTHING;
 
 -- 3. Bind permissions to 'admin' role
@@ -36,7 +36,7 @@ CROSS JOIN roles r
 WHERE r.name = 'admin'
 ON CONFLICT (permission_id, role_id) DO NOTHING;
 
--- 4. Bind permissions to 'member' role (read-only + send.test)
+-- 4. Bind permissions to 'member' role (read-only + inbox.write)
 INSERT INTO role_has_permissions (permission_id, role_id)
 SELECT p.id, r.id
 FROM permissions p
@@ -51,6 +51,6 @@ WHERE r.name = 'member'
     'templates.read',
     'settings.read',
     'invitations.read',
-    'send.test'
+    'inbox.write'
   )
 ON CONFLICT (permission_id, role_id) DO NOTHING;
diff --git a/docs/agents/review-agent.md b/docs/agents/review-agent.md
index c71f6804..3215afd8 100644
--- a/docs/agents/review-agent.md
+++ b/docs/agents/review-agent.md
@@ -88,7 +88,7 @@ Derived from [frontend-engineer.md](../frontend/frontend-engineer.md) and [conve
 
 - [ ] **Architecture Check**: If a new layer or directory was created, does it align with the documented architecture? Are docs updated?
 - [ ] **Anti-patterns**: Ensure new patterns introduced do not conflict with existing boundaries.
-- [ ] **No stale docs**: Portal capability claims match code (remove “REST only” when UI exists).
+- [ ] **No stale docs**: Portal capability claims match code (UI pages, permissions, and API tables stay in sync with `frontend/src/core/router/` and `internal/presentation/router.go`).
 
 ## 6. Severity guidance & Reporting
 
diff --git a/docs/backend/architecture.md b/docs/backend/architecture.md
index 1b3f2ecd..674c7670 100644
--- a/docs/backend/architecture.md
+++ b/docs/backend/architecture.md
@@ -186,7 +186,7 @@ Portal accounts use **email + password** (passwords are stored hashed). All mana
 The core service layer decouples from `wpd-gogate` by depending on the `port.AuthorizationGate` interface. The implementation adapter lives in `internal/infrastructure/authgate/gate_adapter.go`.
 
 - **admin**: Full read/write access to settings, integrations, templates, API keys, and member removal. Assigned automatically to the creator of a workspace.
-- **member**: Read-only access to workspaces, settings, templates, API keys, plus inbox management (`send.test`).
+- **member**: Read-only access to workspaces, settings, templates, API keys, and logs, plus inbox mutations (`inbox.write`).
 
 Public workspaces (`is_private = false`) are dynamically accessible to any authenticated user as a `"viewer"` with read-only permissions (i.e. `*.read` operations are bypassed and approved automatically without requiring explicit membership or Casbin checks). All write operations on public workspaces remain strictly restricted to workspace admins.
 
@@ -200,7 +200,7 @@ Authorization: Bearer <workspace-jwt-token>
     OR
 X-Api-Client-Id: wk_abc123
 X-Api-Client-Secret: <secret>
-X-Workspace-Key: <workspace-unique-key>
+X-Workspace-Key: <workspace-id-or-slug>
 ```
 
 ### Dual Authorization Design
@@ -231,7 +231,18 @@ Provider credentials are stored AES-encrypted in the `integrations` table. Confi
 
 ### Portal UI coverage
 
-The React Portal (`frontend/`) implements: auth, workspace list, **integrations**, **settings** (general, API keys, message dispatch), message **logs**, and **send test**. Templates, members, and inbox browsing remain REST/Bruno only.
+The React Portal (`frontend/`) includes:
+
+| Area | Pages |
+| ---- | ----- |
+| **Auth** | Register, sign in |
+| **Workspaces** | List, create, join |
+| **Logs** | Overview (all channels) + per-channel tabs (SMS, push, chat) |
+| **Email** | Captured inbox browser, templates, Get started curl guide |
+| **Integrations** | Connect and manage providers |
+| **Settings** | General, API keys, message dispatch |
+
+**API-only today:** team invites/members UI (placeholder), SMS/push/chat captured-message browsers (email inbox only), internal inbox ingest.
 
 ---
 
@@ -271,12 +282,12 @@ HTTP Client (your app)
     │
     │ POST /v1/email
     │ Authorization: Bearer <workspace-jwt>
-    │ X-Workspace-Key: myapp
+    │ X-Workspace-Key: <workspace-uuid>
     │ { "to": [...], "subject": "...", "html": "..." }
     ▼
 APIKeyAuthMiddleware
     │ Validates workspace-jwt OR client_id+secret
-    │ Resolves workspace UUID from X-Workspace-Key
+    │ Resolves workspace from X-Workspace-Key (UUID or slug)
     │ Sets workspace_id in request context
     ▼
 GatewayHandler.HandleSendEmail()
@@ -456,9 +467,9 @@ The **memory provider** captures messages in process RAM. It's always available
 
 The React Portal runs at `portal.ui_port` (default **10104**) when the server starts.
 
-**Portal UI today:** sign in, list workspaces, manage **integrations**, **settings** (general, API keys, message dispatch), view message logs, browse captured **email inbox**.
+**Portal UI:** sign in, manage workspaces, view request logs, browse the **email** captured inbox, manage **email templates**, configure **integrations** and **settings** (general, API keys, message dispatch).
 
-**REST only (no UI pages yet):** workspace create, templates, members, SMS/push/chat inbox browser.
+**API-only:** team member management, SMS/push/chat captured-message browsers, internal inbox ingest.
 
 ---
 
diff --git a/docs/backend/e2e-testing.md b/docs/backend/e2e-testing.md
index c0851e95..d8c149c7 100644
--- a/docs/backend/e2e-testing.md
+++ b/docs/backend/e2e-testing.md
@@ -39,7 +39,7 @@ The inbox is protected. Every request to `/api/v1/workspaces/:wid/inbox/*` must
 2. **Workspace membership** — user must be a member of the workspace
 3. **Workspace API key** — `X-Api-Client-Id` + `X-Api-Client-Secret` matching the workspace
 
-The **send** endpoint (`POST /v1/*`) uses API key + `X-Workspace-Key` (slug, not UUID).  
+The **send** endpoint (`POST /v1/*`) uses API key + `X-Workspace-Key` (workspace UUID preferred; slug also accepted).  
 The **inbox** endpoint uses the workspace **UUID** in the URL path.
 
 ---
@@ -303,7 +303,7 @@ func TestSignupEmail(t *testing.T) {
 ```bash
 curl -X POST http://localhost:10101/v1/email \
   -u "client_id:client_secret" \
-  -H "X-Workspace-Key: your_workspace_unique_key" \
+  -H "X-Workspace-Key: <workspace-uuid>" \
   -H "Content-Type: application/json" \
   -d '{"to":["user@example.com"],"subject":"Hello","html":"<p>World</p>"}'
 ```
diff --git a/docs/backend/portal-inbox.md b/docs/backend/portal-inbox.md
index d3a03759..61bd14d2 100644
--- a/docs/backend/portal-inbox.md
+++ b/docs/backend/portal-inbox.md
@@ -9,25 +9,27 @@ The Portal is the web UI and REST surface for the WPD Message Gateway when runni
 ### Portal UI (http://localhost:10104)
 
 | Feature | Description |
-|---------|-------------|
+| ------- | ------------- |
 | **Authentication** | Register and sign in (email + password → JWT) |
-| **Workspaces** | List workspaces you belong to; open a workspace dashboard |
+| **Workspaces** | List, create, and join workspaces |
+| **Message logs** | Outbound send request audit trail (Overview + per-channel tabs) |
+| **Email inbox** | Browse captured outbound emails with live SSE updates |
+| **Email templates** | Create and manage reusable email layouts |
 | **Integrations** | Connect, activate, deactivate, or remove messaging providers |
-| **Message logs** | Outbound send **request audit trail** (not memory inbox capture) |
-| **Send test** | Send a test message per channel from the dashboard |
 | **Settings** | General workspace settings, API keys, message dispatch mode |
+| **Get started** | Curl examples for sending via the public gateway API |
 
-REST-only (no dedicated UI page yet): workspace create, templates, members, memory inbox browser.
+Team member management is a settings placeholder. SMS, push, and chat show **request logs** in the UI; captured-message browsing for those channels is API-only.
 
 ### REST API (server)
 
 | Feature | Portal UI | Description |
-|---------|:---------:|-------------|
-| **Inbox capture** | ✓ | Messages captured when `message_dispatch_mode=memory` or `store_message_content=true` — [Inbox API](#inbox-api-reference) |
+| ------- | :-------: | ----------- |
+| **Inbox capture** | Email ✓ | Messages captured when `message_dispatch_mode=memory` or `store_message_content=true` — [Inbox API](#inbox-api-reference) |
 | **Internal ingest** | | Automation writes to inbox (requires Portal auth) |
-| **Workspace provisioning** | | Create workspace, API keys, settings — curl/Bruno/CI only; see [E2E bootstrap](./e2e-testing.md) |
+| **Workspace API** | Partial | Create/join workspaces and manage keys in the UI; additional endpoints in [usage](./usage.md) |
 
-Provider credentials are stored in PostgreSQL (encrypted at rest) and managed via the Portal **Integrations** page. Dispatch settings are configured in **Settings → Message Dispatch** or via REST.
+Provider credentials are stored in PostgreSQL (encrypted at rest) and managed on the Portal **Integrations** page. Dispatch settings are configured in **Settings → Message Dispatch** or via REST.
 
 ---
 
@@ -190,8 +192,8 @@ portal:
   ui_port: 10104     # React dev server (Portal UI)
 ```
 
-> **Provider credentials** (Mailgun API keys, etc.) are **not** in this file.  
-> They are stored AES-encrypted in PostgreSQL and configured via the **Portal REST API** (no Portal UI page yet).
+> **Provider credentials** (Mailgun API keys, etc.) are **not** in this file.
+> Configure them on the Portal **Integrations** page or via the integrations REST API. Values are stored AES-encrypted in PostgreSQL.
 
 ---
 
diff --git a/docs/backend/usage.md b/docs/backend/usage.md
index 39263984..06b68b6e 100644
--- a/docs/backend/usage.md
+++ b/docs/backend/usage.md
@@ -10,7 +10,7 @@
 │  go get .../wpd-message-gateway  │  git clone → make start          │
 │  gateway.New(config)             │  POST /v1/email (HTTP)           │
 │  Config lives in your code       │  Config lives in PostgreSQL      │
-│  No DB required                  │  React Portal UI (partial)       │
+│  No DB required                  │  React Portal UI                 │
 └──────────────────────────────────┴──────────────────────────────────┘
 ```
 
@@ -141,22 +141,28 @@ Open **http://localhost:10104** — the Portal UI.
 
 ### First time setup (Portal UI)
 
-The Portal UI currently supports:
+The Portal UI supports:
 
 1. **Register** and **sign in** (email + password)
-2. **Workspaces** — list workspaces you belong to and open one
+2. **Workspaces** — list, create, and join workspaces
 3. **Integrations** — connect, activate, deactivate, or remove messaging providers
 4. **Message logs** — audit trail of gateway send requests (Overview + channel tabs)
-5. **Send test** — send a test message through the gateway for the workspace
+5. **Email inbox** — browse captured outbound emails (memory dispatch or `store_message_content`)
+6. **Email templates** — create and manage reusable email layouts
+7. **Settings** — general workspace settings, API keys, and message dispatch mode
+
+Use the **Get started** dialog on the logs pages for curl examples. Send traffic through the public gateway API (`POST /v1/email`, `POST /v1/sms`, etc.) with a workspace API key.
 
 For local dev with PostgreSQL, run migrations then apply seeds in order (see `database/init-db.sh`): `001_seed_permissions.sql`, `002_seed_providers.sql`, `003_seed_mailgun_config.sql`, and `004_demo_workspace.sql` (optional demo data: `demo@weprodev.com` / `secret`).
 
 ### Sending via HTTP
 
+`X-Workspace-Key` accepts the workspace **UUID** (recommended — copy from Settings or the Get started dialog) or the workspace slug.
+
 ```bash
 curl -X POST http://localhost:10101/v1/email \
   -u "wk_abc123:your-secret" \
-  -H "X-Workspace-Key: myapp" \
+  -H "X-Workspace-Key: 550e8400-e29b-41d4-a716-446655440000" \
   -H "Content-Type: application/json" \
   -d '{
     "to": ["user@example.com"],
@@ -170,7 +176,7 @@ Or with Bearer token:
 ```bash
 curl -X POST http://localhost:10101/v1/email \
   -H "Authorization: Bearer wk_abc123:your-secret" \
-  -H "X-Workspace-Key: myapp" \
+  -H "X-Workspace-Key: 550e8400-e29b-41d4-a716-446655440000" \
   -H "Content-Type: application/json" \
   -d '{"to": ["user@example.com"], "subject": "Hello", "html": "<h1>World</h1>"}'
 ```
@@ -183,7 +189,7 @@ import requests
 response = requests.post(
     "http://localhost:10101/v1/email",
     auth=("wk_abc123", "your-secret"),
-    headers={"X-Workspace-Key": "myapp"},
+    headers={"X-Workspace-Key": "550e8400-e29b-41d4-a716-446655440000"},
     json={
         "to": ["user@example.com"],
         "subject": "Hello from Python",
@@ -200,7 +206,7 @@ const response = await fetch("http://localhost:10101/v1/email", {
   method: "POST",
   headers: {
     "Authorization": "Basic " + btoa("wk_abc123:your-secret"),
-    "X-Workspace-Key": "myapp",
+    "X-Workspace-Key": "550e8400-e29b-41d4-a716-446655440000",
     "Content-Type": "application/json",
   },
   body: JSON.stringify({
@@ -240,10 +246,10 @@ curl -H "Authorization: Bearer <jwt>" http://localhost:10101/api/v1/workspaces
 Use your **workspace API key** credentials:
 ```bash
 # Basic auth
-curl -u "wk_abc123:secret" -H "X-Workspace-Key: myapp" ...
+curl -u "wk_abc123:secret" -H "X-Workspace-Key: <workspace-uuid>" ...
 
 # Bearer (colon-separated)
-curl -H "Authorization: Bearer wk_abc123:secret" -H "X-Workspace-Key: myapp" ...
+curl -H "Authorization: Bearer wk_abc123:secret" -H "X-Workspace-Key: <workspace-uuid>" ...
 ```
 
 ---
@@ -338,9 +344,7 @@ Routes registered in `internal/presentation/router.go`. **Portal UI pages exist
 | GET | `/api/v1/workspaces` | ✓ | List workspaces for the logged-in user |
 | GET | `/api/v1/workspaces/:wid/logs` | ✓ | Message request logs (optionally filter by `channel`) |
 
-#### Workspace provisioning & management (REST only — no Portal UI)
-
-Used by Bruno, curl, and CI bootstrap. Not documented endpoint-by-endpoint here; see `internal/presentation/router.go` and [E2E testing](./e2e-testing.md) for create workspace, API keys, settings, integrations, templates, and members.
+Additional workspace endpoints (create, API keys, settings, templates, members, inbox) are implemented in `internal/presentation/router.go` and covered in [Portal inbox](./portal-inbox.md) and [E2E testing](./e2e-testing.md).
 
 ### Workspace access (portal JWT routes & RBAC)
 
@@ -348,7 +352,7 @@ Workspace-scoped routes require a valid portal JWT and are governed by a Role-Ba
 
 Roles and permissions are defined in [permission.go](../../internal/core/domain/permission.go):
 - **admin**: Full read/write access. The creator of a workspace is automatically assigned this role (as `admin` in both members repository and `gogate`).
-- **member**: Read-only access to workspaces, members, API keys, logs, integrations, templates, settings, and invitations, plus inbox management (`send.test`).
+- **member**: Read-only access to workspaces, members, API keys, logs, integrations, templates, settings, and invitations, plus inbox mutations (`inbox.write`).
 
 To bootstrap roles and permissions, make sure you run the database seeds:
 1. Run `database/seeds/001_seed_permissions.sql` to populate roles (`admin`, `member`), default permissions, and role-to-permission mappings.
@@ -363,9 +367,9 @@ The HTTP server uses two distinct authorization approaches by design:
 - **Inbox SSE API (`/api/v1/workspaces/:wid/inbox/...`)**: Restricts access using JWT tokens combined with a direct database workspace membership check (`RequireWorkspaceMember`) and the workspace API key (`RequireWorkspaceAPIKey`). This decoupled model allows client-side SDKs, SSE event streaming, and automation runners to interact with the simulated inbox without requiring full portal RBAC configuration.
 
 
-### Inbox API (captured messages — REST / Bruno, not Portal UI)
+### Inbox API
 
-The Portal UI shows **request logs** (`/logs`), not the memory **inbox** (`/inbox/*`). Inbox capture, SSE, and internal ingest are documented in [Portal inbox](./portal-inbox.md).
+Captured messages are available through the Portal **Email** page (UI + SSE) and the REST inbox endpoints documented in [Portal inbox](./portal-inbox.md). SMS, push, and chat channels expose request **logs** in the UI; captured-message browsing for those channels is API-only today.
 
 ---
 
@@ -385,8 +389,8 @@ portal:
   ui_port: 10104
 ```
 
-> **Note:** Provider credentials (Mailgun API keys, etc.) are **NOT** in YAML files.
-> They are configured via the Portal REST API and stored encrypted in PostgreSQL.
+> **Note:** Provider credentials (Mailgun API keys, etc.) are **not** in YAML files.
+> Configure them on the Portal **Integrations** page or via `POST /api/v1/workspaces/:wid/integrations`. Values are stored encrypted in PostgreSQL.
 
 ### Environment Variables (Server)
 
@@ -450,7 +454,7 @@ Check workspace settings via `GET /api/v1/workspaces/:wid/settings`. If `message
 
 ### API Key Rejected
 
-- Ensure `X-Workspace-Key` matches the workspace's `unique_key` (slug, not UUID)
+- Ensure `X-Workspace-Key` matches the workspace UUID or slug
 - Verify the API key is active (`GET /api/v1/workspaces/:wid/api-keys` with portal JWT)
 - Check `client_id` and `client_secret` — secret is shown once at creation
 
diff --git a/frontend/src/features/inbox/components/get-started-dialog/get-started-dialog.stories.tsx b/frontend/src/features/inbox/components/get-started-dialog/get-started-dialog.stories.tsx
index 5802a311..7eb2f39f 100644
--- a/frontend/src/features/inbox/components/get-started-dialog/get-started-dialog.stories.tsx
+++ b/frontend/src/features/inbox/components/get-started-dialog/get-started-dialog.stories.tsx
@@ -8,7 +8,7 @@ const meta = {
   component: GetStartedDialog,
   decorators: [
     (Story) => (
-      <MemoryRouter>
+      <MemoryRouter initialEntries={["/workspaces/ws-demo/overview"]}>
         <Story />
       </MemoryRouter>
     ),
@@ -22,6 +22,6 @@ export const Open: Story = {
   args: {
     open: true,
     onOpenChange: () => undefined,
-    workspaceId: "ws-demo",
+    workspaceId: "00000000-0000-0000-0000-000000000001",
   },
 }
diff --git a/frontend/src/features/inbox/components/get-started-dialog/get-started-dialog.tsx b/frontend/src/features/inbox/components/get-started-dialog/get-started-dialog.tsx
index d404e653..49f3ff72 100644
--- a/frontend/src/features/inbox/components/get-started-dialog/get-started-dialog.tsx
+++ b/frontend/src/features/inbox/components/get-started-dialog/get-started-dialog.tsx
@@ -9,7 +9,10 @@ import {
   DialogHeader,
   DialogTitle,
 } from "@/components/ui/dialog"
+import { Spinner } from "@/components/ui/spinner"
 import { ROUTES } from "@/core/router/routes"
+import { buildGatewayCurlExamples } from "../../get-started-dialog.utils"
+import { useGetStartedContext } from "../../hooks/use-get-started-context.hook"
 
 interface GetStartedDialogProps {
   open: boolean
@@ -17,8 +20,19 @@ interface GetStartedDialogProps {
   workspaceId?: string
 }
 
+function developerSettingsPath(workspaceId: string) {
+  return `${ROUTES.workspace.settings(workspaceId)}?tab=developer`
+}
+
 export function GetStartedDialog({ open, onOpenChange, workspaceId }: GetStartedDialogProps) {
-  const settingsPath = workspaceId ? ROUTES.workspace.settings(workspaceId) : ROUTES.workspaces
+  const { context, isLoading, error } = useGetStartedContext(workspaceId, open)
+  const developerPath = workspaceId ? developerSettingsPath(workspaceId) : ROUTES.workspaces
+
+  const primaryKey = context?.apiKeys[0]
+  const examples =
+    context && primaryKey
+      ? buildGatewayCurlExamples(context.workspaceId, primaryKey.client_id)
+      : null
 
   return (
     <Dialog open={open} onOpenChange={onOpenChange}>
@@ -26,35 +40,88 @@ export function GetStartedDialog({ open, onOpenChange, workspaceId }: GetStarted
         <DialogHeader className="border-b bg-muted/20 px-5 py-4 text-left">
           <DialogTitle>Get started</DialogTitle>
           <DialogDescription>
-            Send messages through the same gateway endpoints your integrations use in production.
+            Send test messages with your workspace API key and ID.
           </DialogDescription>
         </DialogHeader>
         <div className="flex flex-col gap-4 overflow-y-auto p-6 text-sm text-foreground">
-          <p className="text-xs leading-relaxed text-text-secondary">
-            Create an API key in{" "}
-            <Link to={settingsPath} className="font-semibold text-primary-brand hover:underline">
-              Settings
-            </Link>
-            , then authenticate each request with Basic auth and your workspace slug header.
-          </p>
-          <div className="flex flex-col gap-3">
-            <div>
-              <h4 className="mb-1 text-xs font-bold uppercase text-text-secondary">Email</h4>
-              <pre className="overflow-x-auto rounded-md border bg-muted/80 p-2.5 font-mono text-xs whitespace-pre-wrap">{`curl -X POST http://localhost:10101/v1/email \\
-  -u "client_id:client_secret" \\
-  -H "X-Workspace-Key: your-workspace-slug" \\
-  -H "Content-Type: application/json" \\
-  -d '{"to":["user@example.com"],"subject":"Test","html":"<p>Hi</p>"}'`}</pre>
+          {isLoading ? (
+            <div className="flex items-center gap-2 text-sm text-text-secondary">
+              <Spinner size="sm" />
+              Loading workspace credentials…
+            </div>
+          ) : null}
+
+          {error ? (
+            <p className="rounded-md border border-destructive/30 bg-destructive/10 px-3 py-2 text-xs text-destructive">
+              {error}
+            </p>
+          ) : null}
+
+          {context ? (
+            <div className="rounded-lg border border-border bg-muted/30 p-4">
+              <h3 className="text-xs font-bold uppercase tracking-wide text-text-secondary">
+                Your credentials
+              </h3>
+              <dl className="mt-3 flex flex-col gap-2 text-xs">
+                <div className="flex flex-col gap-0.5 sm:flex-row sm:items-baseline sm:gap-2">
+                  <dt className="shrink-0 font-medium text-text-secondary">Workspace ID</dt>
+                  <dd className="font-mono text-foreground break-all">{context.workspaceId}</dd>
+                </div>
+                <div className="flex flex-col gap-0.5 sm:flex-row sm:items-baseline sm:gap-2">
+                  <dt className="shrink-0 font-medium text-text-secondary">Header</dt>
+                  <dd className="font-mono text-foreground break-all">
+                    X-Workspace-Key: {context.workspaceId}
+                  </dd>
+                </div>
+                {primaryKey ? (
+                  <div className="flex flex-col gap-0.5 sm:flex-row sm:items-baseline sm:gap-2">
+                    <dt className="shrink-0 font-medium text-text-secondary">Client ID</dt>
+                    <dd className="font-mono text-foreground">{primaryKey.client_id}</dd>
+                  </div>
+                ) : (
+                  <p className="text-text-secondary">
+                    No API keys yet. Create one in{" "}
+                    <Link to={developerPath} className="font-semibold text-primary-brand hover:underline">
+                      Settings → Developer
+                    </Link>
+                    .
+                  </p>
+                )}
+                <div className="flex flex-col gap-0.5">
+                  <dt className="font-medium text-text-secondary">Client secret</dt>
+                  <dd className="text-text-secondary">
+                    Shown once when you generate or regenerate a key in{" "}
+                    <Link to={developerPath} className="font-semibold text-primary-brand hover:underline">
+                      Settings → Developer
+                    </Link>
+                    . Replace <span className="font-mono text-foreground">YOUR_CLIENT_SECRET</span> in the
+                    examples below.
+                  </dd>
+                </div>
+              </dl>
             </div>
-            <div>
-              <h4 className="mb-1 text-xs font-bold uppercase text-text-secondary">SMS</h4>
-              <pre className="overflow-x-auto rounded-md border bg-muted/80 p-2.5 font-mono text-xs whitespace-pre-wrap">{`curl -X POST http://localhost:10101/v1/sms \\
-  -u "client_id:client_secret" \\
-  -H "X-Workspace-Key: your-workspace-slug" \\
-  -H "Content-Type: application/json" \\
-  -d '{"to":["+1234567890"],"message":"Hello"}'`}</pre>
+          ) : null}
+
+          {examples ? (
+            <div className="flex flex-col gap-3">
+              <div>
+                <h4 className="mb-1 text-xs font-bold uppercase text-text-secondary">Email</h4>
+                <pre className="overflow-x-auto rounded-md border bg-muted/80 p-2.5 font-mono text-xs whitespace-pre-wrap">
+                  {examples.email}
+                </pre>
+              </div>
+              <div>
+                <h4 className="mb-1 text-xs font-bold uppercase text-text-secondary">SMS</h4>
+                <pre className="overflow-x-auto rounded-md border bg-muted/80 p-2.5 font-mono text-xs whitespace-pre-wrap">
+                  {examples.sms}
+                </pre>
+              </div>
             </div>
-          </div>
+          ) : null}
+
+          {!isLoading && !context && !error ? (
+            <p className="text-xs text-text-secondary">Open this dialog from a workspace to load credentials.</p>
+          ) : null}
         </div>
         <DialogFooter className="border-t bg-muted/20 px-5 py-4">
           <Button type="button" onClick={() => onOpenChange(false)}>
diff --git a/frontend/src/features/inbox/get-started-dialog.utils.test.ts b/frontend/src/features/inbox/get-started-dialog.utils.test.ts
new file mode 100644
index 00000000..50094f74
--- /dev/null
+++ b/frontend/src/features/inbox/get-started-dialog.utils.test.ts
@@ -0,0 +1,17 @@
+import { describe, expect, it } from "vitest"
+
+import { buildGatewayCurlExamples } from "./get-started-dialog.utils"
+
+describe("buildGatewayCurlExamples", () => {
+  it("embeds workspace id and client id in curl commands", () => {
+    const examples = buildGatewayCurlExamples(
+      "00000000-0000-0000-0000-000000000001",
+      "demo-client-id",
+    )
+
+    expect(examples.email).toContain("X-Workspace-Key: 00000000-0000-0000-0000-000000000001")
+    expect(examples.email).toContain('-u "demo-client-id:YOUR_CLIENT_SECRET"')
+    expect(examples.sms).toContain("X-Workspace-Key: 00000000-0000-0000-0000-000000000001")
+    expect(examples.sms).toContain('-u "demo-client-id:YOUR_CLIENT_SECRET"')
+  })
+})
diff --git a/frontend/src/features/inbox/get-started-dialog.utils.ts b/frontend/src/features/inbox/get-started-dialog.utils.ts
new file mode 100644
index 00000000..21c6fe36
--- /dev/null
+++ b/frontend/src/features/inbox/get-started-dialog.utils.ts
@@ -0,0 +1,27 @@
+const GATEWAY_BASE_URL = "http://localhost:10101"
+const SECRET_PLACEHOLDER = "YOUR_CLIENT_SECRET"
+
+export interface GatewayCurlExamples {
+  email: string
+  sms: string
+}
+
+export function buildGatewayCurlExamples(
+  workspaceId: string,
+  clientId: string,
+): GatewayCurlExamples {
+  const auth = `${clientId}:${SECRET_PLACEHOLDER}`
+
+  return {
+    email: `curl -X POST ${GATEWAY_BASE_URL}/v1/email \\
+  -u "${auth}" \\
+  -H "X-Workspace-Key: ${workspaceId}" \\
+  -H "Content-Type: application/json" \\
+  -d '{"to":["user@example.com"],"subject":"Test","html":"<p>Hi</p>"}'`,
+    sms: `curl -X POST ${GATEWAY_BASE_URL}/v1/sms \\
+  -u "${auth}" \\
+  -H "X-Workspace-Key: ${workspaceId}" \\
+  -H "Content-Type: application/json" \\
+  -d '{"to":["+1234567890"],"message":"Hello"}'`,
+  }
+}
diff --git a/frontend/src/features/inbox/get-started.api.ts b/frontend/src/features/inbox/get-started.api.ts
new file mode 100644
index 00000000..24802909
--- /dev/null
+++ b/frontend/src/features/inbox/get-started.api.ts
@@ -0,0 +1,37 @@
+import { apiFetch } from "@/core/api/client"
+
+export interface GetStartedApiKey {
+  client_id: string
+  name: string
+  is_active: boolean
+}
+
+export interface GetStartedContext {
+  workspaceId: string
+  apiKeys: GetStartedApiKey[]
+}
+
+export async function fetchGetStartedContext(
+  workspaceId: string,
+): Promise<{ ok: true; context: GetStartedContext } | { ok: false; message?: string }> {
+  try {
+    const keysRes = await apiFetch(`/api/v1/workspaces/${workspaceId}/api-keys`)
+    if (!keysRes.ok) {
+      return { ok: false, message: "Failed to load API keys" }
+    }
+
+    const apiKeys = (await keysRes.json()) as GetStartedApiKey[]
+    return {
+      ok: true,
+      context: {
+        workspaceId,
+        apiKeys: apiKeys.filter((key) => key.is_active),
+      },
+    }
+  } catch (err) {
+    return {
+      ok: false,
+      message: err instanceof Error ? err.message : "Failed to load credentials",
+    }
+  }
+}
diff --git a/frontend/src/features/inbox/hooks/use-get-started-context.hook.ts b/frontend/src/features/inbox/hooks/use-get-started-context.hook.ts
new file mode 100644
index 00000000..fa4aaec1
--- /dev/null
+++ b/frontend/src/features/inbox/hooks/use-get-started-context.hook.ts
@@ -0,0 +1,44 @@
+import { useCallback, useEffect, useState } from "react"
+
+import { fetchGetStartedContext, type GetStartedContext } from "../get-started.api"
+
+export function useGetStartedContext(workspaceId: string | undefined, enabled: boolean) {
+  const [context, setContext] = useState<GetStartedContext | null>(null)
+  const [isLoading, setIsLoading] = useState(false)
+  const [error, setError] = useState<string | null>(null)
+
+  const applyResult = useCallback(
+    (result: Awaited<ReturnType<typeof fetchGetStartedContext>>) => {
+      setIsLoading(false)
+      if (!result.ok) {
+        setContext(null)
+        setError(result.message ?? "Failed to load workspace credentials")
+        return
+      }
+      setError(null)
+      setContext(result.context)
+    },
+    [],
+  )
+
+  useEffect(() => {
+    if (!enabled || !workspaceId) {
+      return
+    }
+
+    let cancelled = false
+    ;(async () => {
+      setIsLoading(true)
+      setError(null)
+      const result = await fetchGetStartedContext(workspaceId)
+      if (cancelled) return
+      applyResult(result)
+    })()
+
+    return () => {
+      cancelled = true
+    }
+  }, [workspaceId, enabled, applyResult])
+
+  return { context, isLoading, error }
+}
diff --git a/frontend/src/features/inbox/hooks/use-inbox-emails.hook.ts b/frontend/src/features/inbox/hooks/use-inbox-emails.hook.ts
new file mode 100644
index 00000000..8d67e7fe
--- /dev/null
+++ b/frontend/src/features/inbox/hooks/use-inbox-emails.hook.ts
@@ -0,0 +1,115 @@
+import { useCallback, useEffect, useState } from "react"
+
+import { fetchInboxEmails } from "../inbox.api"
+import type { StoredEmail } from "../inbox.types"
+
+const PAGE_SIZE = 50
+
+export function useInboxEmails(workspaceId: string | undefined) {
+  const [messages, setMessages] = useState<StoredEmail[]>([])
+  const [selectedMessageId, setSelectedMessageId] = useState<string | null>(null)
+  const [isLoading, setIsLoading] = useState(true)
+  const [isLoadingMore, setIsLoadingMore] = useState(false)
+  const [error, setError] = useState<string | null>(null)
+  const [nextCursor, setNextCursor] = useState<string | undefined>()
+  const [hasMore, setHasMore] = useState(false)
+
+  const applyPage = useCallback((result: Awaited<ReturnType<typeof fetchInboxEmails>>) => {
+    setIsLoading(false)
+    if (!result.ok) {
+      setError(result.message ?? "Failed to load emails")
+      return
+    }
+
+    setError(null)
+    setMessages(result.page.items ?? [])
+    setNextCursor(result.page.next_cursor)
+    setHasMore(result.page.has_more)
+    if ((result.page.items ?? []).length > 0) {
+      setSelectedMessageId((prev) => prev ?? (result.page.items ?? [])[0].id)
+    }
+  }, [])
+
+  useEffect(() => {
+    let cancelled = false
+    ;(async () => {
+      if (!workspaceId) return
+      setIsLoading(true)
+      setError(null)
+      const result = await fetchInboxEmails(workspaceId, { limit: PAGE_SIZE })
+      if (cancelled) return
+      applyPage(result)
+    })()
+
+    return () => {
+      cancelled = true
+    }
+  }, [workspaceId, applyPage])
+
+  const reload = useCallback(async () => {
+    if (!workspaceId) return
+    setIsLoading(true)
+    setError(null)
+    const result = await fetchInboxEmails(workspaceId, { limit: PAGE_SIZE })
+    applyPage(result)
+  }, [workspaceId, applyPage])
+
+  const loadMore = useCallback(async () => {
+    if (!workspaceId || !nextCursor || isLoadingMore) return
+    setIsLoadingMore(true)
+
+    const result = await fetchInboxEmails(workspaceId, { limit: PAGE_SIZE, cursor: nextCursor })
+    setIsLoadingMore(false)
+    if (!result.ok) {
+      setError(result.message ?? "Failed to load more emails")
+      return
+    }
+
+    setMessages((prev) => [...prev, ...(result.page.items ?? [])])
+    setNextCursor(result.page.next_cursor)
+    setHasMore(result.page.has_more)
+  }, [workspaceId, nextCursor, isLoadingMore])
+
+  const prependMessage = useCallback((message: StoredEmail) => {
+    setMessages((prev) => {
+      if (prev.some((m) => m.id === message.id)) return prev
+      return [message, ...prev]
+    })
+  }, [])
+
+  const removeMessage = useCallback((messageId: string) => {
+    setMessages((prev) => {
+      const remaining = prev.filter((m) => m.id !== messageId)
+      setSelectedMessageId((current) => {
+        if (current === messageId) {
+          return remaining.length > 0 ? remaining[0].id : null
+        }
+        return current
+      })
+      return remaining
+    })
+  }, [])
+
+  const clearMessages = useCallback(() => {
+    setMessages([])
+    setSelectedMessageId(null)
+    setNextCursor(undefined)
+    setHasMore(false)
+  }, [])
+
+  return {
+    messages,
+    selectedMessageId,
+    setSelectedMessageId,
+    isLoading,
+    isLoadingMore,
+    error,
+    nextCursor,
+    hasMore,
+    reload,
+    loadMore,
+    prependMessage,
+    removeMessage,
+    clearMessages,
+  }
+}
diff --git a/frontend/src/features/inbox/hooks/use-inbox-logs.hook.ts b/frontend/src/features/inbox/hooks/use-inbox-logs.hook.ts
index 565ad8c0..1d305e0e 100644
--- a/frontend/src/features/inbox/hooks/use-inbox-logs.hook.ts
+++ b/frontend/src/features/inbox/hooks/use-inbox-logs.hook.ts
@@ -16,6 +16,7 @@ export function useInboxLogs(workspaceId: string | undefined, channel?: string)
         setError(res.message ?? "Failed to load request logs")
         return
       }
+      setError(null)
       setLogs(res.items)
       setTotal(res.total)
     },
diff --git a/frontend/src/features/inbox/inbox.api.ts b/frontend/src/features/inbox/inbox.api.ts
index 1c8c6e40..dec23822 100644
--- a/frontend/src/features/inbox/inbox.api.ts
+++ b/frontend/src/features/inbox/inbox.api.ts
@@ -2,6 +2,15 @@ import { apiFetch, getToken } from "@/core/api/client"
 import type { EmailTemplate, InboxEmailPage, LogRow, StoredEmail } from "./inbox.types"
 import { parseLogsResponse } from "./logs.schema"
 
+async function parseApiError(res: Response, fallback: string): Promise<string> {
+  try {
+    const err = (await res.json()) as { message?: string; error?: string }
+    return err.message ?? err.error ?? fallback
+  } catch {
+    return fallback
+  }
+}
+
 export async function fetchLogs(
   workspaceId: string,
   params: { channel?: string; limit?: number; offset?: number } = {}
@@ -20,25 +29,18 @@ export async function fetchLogs(
   try {
     const res = await apiFetch(`/api/v1/workspaces/${workspaceId}/logs?${query.toString()}`)
     if (!res.ok) {
-      const err = (await res.json().catch(() => ({}))) as { message?: string }
-      return { ok: false, message: err.message ?? "Failed to fetch logs" }
+      return { ok: false, message: await parseApiError(res, "Failed to fetch logs") }
     }
-    const data = parseLogsResponse(await res.json())
-    return { ok: true, items: data.items, total: data.total }
+    const parsed = parseLogsResponse(await res.json())
+    if (!parsed.ok) {
+      return { ok: false, message: parsed.message }
+    }
+    return { ok: true, items: parsed.items, total: parsed.total }
   } catch (err) {
     return { ok: false, message: err instanceof Error ? err.message : "Failed to fetch logs" }
   }
 }
 
-async function parseApiError(res: Response, fallback: string): Promise<string> {
-  try {
-    const err = (await res.json()) as { message?: string; error?: string }
-    return err.message ?? err.error ?? fallback
-  } catch {
-    return fallback
-  }
-}
-
 export async function fetchInboxEmails(
   workspaceId: string,
   params: { limit?: number; cursor?: string } = {}
diff --git a/frontend/src/features/inbox/logs.schema.ts b/frontend/src/features/inbox/logs.schema.ts
index da76a565..e428396a 100644
--- a/frontend/src/features/inbox/logs.schema.ts
+++ b/frontend/src/features/inbox/logs.schema.ts
@@ -25,10 +25,12 @@ const logsResponseSchema = z.object({
   total: z.number(),
 })
 
-export function parseLogsResponse(raw: unknown): { items: LogRow[]; total: number } {
+export function parseLogsResponse(
+  raw: unknown,
+): { ok: true; items: LogRow[]; total: number } | { ok: false; message: string } {
   const parsed = logsResponseSchema.safeParse(raw)
   if (!parsed.success) {
-    throw new Error("Invalid logs response from server")
+    return { ok: false, message: "Invalid logs response from server" }
   }
-  return parsed.data
+  return { ok: true, items: parsed.data.items, total: parsed.data.total }
 }
diff --git a/frontend/src/features/inbox/pages/email-inbox.page.tsx b/frontend/src/features/inbox/pages/email-inbox.page.tsx
index 6151ef7f..501d52ff 100644
--- a/frontend/src/features/inbox/pages/email-inbox.page.tsx
+++ b/frontend/src/features/inbox/pages/email-inbox.page.tsx
@@ -1,4 +1,4 @@
-import { useEffect, useState, useCallback } from "react"
+import { useEffect, useState } from "react"
 import { useNavigate, useParams, useSearchParams } from "react-router-dom"
 
 import { Button } from "@/components/ui/button"
@@ -9,99 +9,32 @@ import {
   buildInboxEventsUrl,
   deleteInboxEmail,
   fetchInboxEmailById,
-  fetchInboxEmails,
 } from "../inbox.api"
 import { EmailList } from "../components/email-list"
 import { EmailContent } from "../components/email-content"
-import type { StoredEmail } from "../inbox.types"
-
-const PAGE_SIZE = 50
+import { useInboxEmails } from "../hooks/use-inbox-emails.hook"
 
 export function EmailInboxPage() {
   const navigate = useNavigate()
   const { wid } = useParams<{ wid: string }>()
   const [searchParams, setSearchParams] = useSearchParams()
   const deepLinkMessageId = searchParams.get("message")
-
-  const [messages, setMessages] = useState<StoredEmail[]>([])
-  const [selectedMessageId, setSelectedMessageId] = useState<string | null>(null)
-  const [isLoading, setIsLoading] = useState(true)
-  const [isLoadingMore, setIsLoadingMore] = useState(false)
   const [isDeleting, setIsDeleting] = useState(false)
-  const [error, setError] = useState<string | null>(null)
-  const [nextCursor, setNextCursor] = useState<string | undefined>()
-  const [hasMore, setHasMore] = useState(false)
 
-  const fetchEmails = useCallback(async () => {
-    if (!wid) return
-    setError(null)
-    setIsLoading(true)
-
-    const result = await fetchInboxEmails(wid, { limit: PAGE_SIZE })
-    if (!result.ok) {
-      setError(result.message ?? "Failed to load emails")
-      setIsLoading(false)
-      return
-    }
-
-    setMessages(result.page.items ?? [])
-    setNextCursor(result.page.next_cursor)
-    setHasMore(result.page.has_more)
-    if ((result.page.items ?? []).length > 0) {
-      setSelectedMessageId((prev) => prev ?? (result.page.items ?? [])[0].id)
-    }
-    setIsLoading(false)
-  }, [wid])
-
-  const loadMoreEmails = useCallback(async () => {
-    if (!wid || !nextCursor || isLoadingMore) return
-    setIsLoadingMore(true)
-
-    const result = await fetchInboxEmails(wid, { limit: PAGE_SIZE, cursor: nextCursor })
-    if (!result.ok) {
-      setError(result.message ?? "Failed to load more emails")
-      setIsLoadingMore(false)
-      return
-    }
-
-    setMessages((prev) => [...(prev ?? []), ...(result.page.items ?? [])])
-    setNextCursor(result.page.next_cursor)
-    setHasMore(result.page.has_more)
-    setIsLoadingMore(false)
-  }, [wid, nextCursor, isLoadingMore])
-
-  useEffect(() => {
-    let cancelled = false
-    ;(async () => {
-      if (!wid) {
-        setIsLoading(false)
-        return
-      }
-      setError(null)
-      setIsLoading(true)
-
-      const result = await fetchInboxEmails(wid, { limit: PAGE_SIZE })
-      if (cancelled) return
-
-      if (!result.ok) {
-        setError(result.message ?? "Failed to load emails")
-        setIsLoading(false)
-        return
-      }
-
-      setMessages(result.page.items ?? [])
-      setNextCursor(result.page.next_cursor)
-      setHasMore(result.page.has_more)
-      if ((result.page.items ?? []).length > 0) {
-        setSelectedMessageId((prev) => prev ?? (result.page.items ?? [])[0].id)
-      }
-      setIsLoading(false)
-    })()
-
-    return () => {
-      cancelled = true
-    }
-  }, [wid])
+  const {
+    messages,
+    selectedMessageId,
+    setSelectedMessageId,
+    isLoading,
+    isLoadingMore,
+    error,
+    hasMore,
+    reload,
+    loadMore,
+    prependMessage,
+    removeMessage,
+    clearMessages,
+  } = useInboxEmails(wid)
 
   useEffect(() => {
     if (!wid || !deepLinkMessageId) return
@@ -112,10 +45,7 @@ export function EmailInboxPage() {
       if (cancelled) return
 
       if (result.ok) {
-        setMessages((prev) => {
-          if (prev.some((m) => m.id === result.item.id)) return prev
-          return [result.item, ...prev]
-        })
+        prependMessage(result.item)
         setSelectedMessageId(deepLinkMessageId)
       }
 
@@ -129,7 +59,7 @@ export function EmailInboxPage() {
     return () => {
       cancelled = true
     }
-  }, [wid, deepLinkMessageId, setSearchParams])
+  }, [wid, deepLinkMessageId, setSearchParams, prependMessage, setSelectedMessageId])
 
   useEffect(() => {
     if (!wid) return
@@ -154,10 +84,7 @@ export function EmailInboxPage() {
             if (!id) return
             void fetchInboxEmailById(wid, id).then((result) => {
               if (!result.ok) return
-              setMessages((prev) => {
-                if (prev.some((m) => m.id === result.item.id)) return prev
-                return [result.item, ...prev]
-              })
+              prependMessage(result.item)
               setSelectedMessageId((current) => current ?? id)
             })
             return
@@ -166,24 +93,12 @@ export function EmailInboxPage() {
           if (parsed.type === "email_deleted") {
             const id = typeof parsed.data === "string" ? parsed.data : undefined
             if (!id) return
-            setMessages((prev) => {
-              const remaining = prev.filter((m) => m.id !== id)
-              setSelectedMessageId((current) => {
-                if (current === id) {
-                  return remaining.length > 0 ? remaining[0].id : null
-                }
-                return current
-              })
-              return remaining
-            })
+            removeMessage(id)
             return
           }
 
           if (parsed.type === "messages_cleared") {
-            setMessages([])
-            setSelectedMessageId(null)
-            setNextCursor(undefined)
-            setHasMore(false)
+            clearMessages()
           }
         } catch (err) {
           console.error("Failed to parse SSE event data:", err)
@@ -196,7 +111,7 @@ export function EmailInboxPage() {
     return () => {
       eventSource?.close()
     }
-  }, [wid])
+  }, [wid, prependMessage, removeMessage, clearMessages, setSelectedMessageId])
 
   const handleDeleteMessage = async (messageId: string) => {
     if (!wid) return
@@ -208,16 +123,7 @@ export function EmailInboxPage() {
       return
     }
 
-    setMessages((prev) => {
-      const remaining = prev.filter((m) => m.id !== messageId)
-      setSelectedMessageId((current) => {
-        if (current === messageId) {
-          return remaining.length > 0 ? remaining[0].id : null
-        }
-        return current
-      })
-      return remaining
-    })
+    removeMessage(messageId)
     setIsDeleting(false)
   }
 
@@ -227,7 +133,8 @@ export function EmailInboxPage() {
     }
   }
 
-  const activeMessage = (messages ?? []).find((m) => m.id === selectedMessageId) ?? null
+  const activeMessage = messages.find((m) => m.id === selectedMessageId) ?? null
+  const showLoading = Boolean(wid) && isLoading
 
   return (
     <div className="flex flex-col gap-6 w-full h-[calc(100vh-160px)] min-h-[500px]">
@@ -242,8 +149,8 @@ export function EmailInboxPage() {
         </div>
 
         <div className="flex items-center gap-2.5 shrink-0">
-          <Button type="button" variant="outline" size="sm" onClick={() => void fetchEmails()} disabled={isLoading} className="h-10">
-            <Icon name="refresh" size="sm" data-icon="inline-start" className={isLoading ? "animate-spin" : undefined} />
+          <Button type="button" variant="outline" size="sm" onClick={() => void reload()} disabled={showLoading} className="h-10">
+            <Icon name="refresh" size="sm" data-icon="inline-start" className={showLoading ? "animate-spin" : undefined} />
             Refresh
           </Button>
           <Button type="button" size="sm" onClick={handleManageTemplates} className="h-10">
@@ -259,16 +166,16 @@ export function EmailInboxPage() {
           <p className="text-xs text-text-secondary max-w-sm mt-1 mb-4">
             {error}
           </p>
-          <Button variant="outline" size="sm" onClick={() => void fetchEmails()}>
+          <Button variant="outline" size="sm" onClick={() => void reload()}>
             Try again
           </Button>
         </div>
-      ) : isLoading ? (
+      ) : showLoading ? (
         <div className="flex-1 bg-card border border-border rounded-2xl flex flex-col items-center justify-center gap-3">
           <Spinner size="lg" />
           <span className="text-sm text-text-secondary">Loading simulated inbox...</span>
         </div>
-      ) : (messages ?? []).length === 0 ? (
+      ) : messages.length === 0 ? (
         <div className="flex-1 bg-card border border-border rounded-2xl flex flex-col items-center justify-center p-8 text-center">
           <div className="mb-4 flex size-16 items-center justify-center rounded-full border border-border bg-muted/40 text-text-tertiary">
             <Icon name="mail" size="lg" />
@@ -281,12 +188,12 @@ export function EmailInboxPage() {
       ) : (
         <div className="flex-1 bg-card border border-border rounded-2xl overflow-hidden flex flex-col md:flex-row shadow-sm min-h-0">
           <EmailList
-            messages={messages ?? []}
+            messages={messages}
             selectedMessageId={selectedMessageId}
             onSelectMessage={setSelectedMessageId}
             hasMore={hasMore}
             isLoadingMore={isLoadingMore}
-            onLoadMore={() => void loadMoreEmails()}
+            onLoadMore={() => void loadMore()}
           />
           {activeMessage ? (
             <EmailContent
diff --git a/frontend/src/features/settings/components/api-key-create-dialog/api-key-create-dialog.stories.tsx b/frontend/src/features/settings/components/api-key-create-dialog/api-key-create-dialog.stories.tsx
new file mode 100644
index 00000000..4b695afc
--- /dev/null
+++ b/frontend/src/features/settings/components/api-key-create-dialog/api-key-create-dialog.stories.tsx
@@ -0,0 +1,21 @@
+import type { Meta, StoryObj } from "@storybook/react-vite"
+
+import { ApiKeyCreateDialog } from "./api-key-create-dialog"
+
+const meta = {
+  title: "Features/Settings/ApiKeyCreateDialog",
+  component: ApiKeyCreateDialog,
+} satisfies Meta<typeof ApiKeyCreateDialog>
+
+export default meta
+type Story = StoryObj<typeof meta>
+
+export const Open: Story = {
+  args: {
+    open: true,
+    onClose: () => undefined,
+    onCreate: async () => {
+      await new Promise((resolve) => window.setTimeout(resolve, 500))
+    },
+  },
+}
diff --git a/frontend/src/features/settings/components/api-key-create-dialog/api-key-create-dialog.test.tsx b/frontend/src/features/settings/components/api-key-create-dialog/api-key-create-dialog.test.tsx
new file mode 100644
index 00000000..e94aa024
--- /dev/null
+++ b/frontend/src/features/settings/components/api-key-create-dialog/api-key-create-dialog.test.tsx
@@ -0,0 +1,29 @@
+import { render, screen } from "@testing-library/react"
+import userEvent from "@testing-library/user-event"
+import { describe, expect, it, vi } from "vitest"
+
+import { ApiKeyCreateDialog } from "./api-key-create-dialog"
+
+describe("ApiKeyCreateDialog", () => {
+  it("submits trimmed API key name", async () => {
+    const user = userEvent.setup()
+    const onCreate = vi.fn().mockResolvedValue(undefined)
+
+    render(<ApiKeyCreateDialog open onClose={vi.fn()} onCreate={onCreate} />)
+
+    await user.type(screen.getByLabelText(/api key name/i), "  Production  ")
+    await user.click(screen.getByRole("button", { name: /generate key/i }))
+
+    expect(onCreate).toHaveBeenCalledWith("Production")
+  })
+
+  it("shows validation error when name is empty", async () => {
+    const user = userEvent.setup()
+
+    render(<ApiKeyCreateDialog open onClose={vi.fn()} onCreate={vi.fn()} />)
+
+    await user.click(screen.getByRole("button", { name: /generate key/i }))
+
+    expect(screen.getByText(/api key name is required/i)).toBeInTheDocument()
+  })
+})
diff --git a/frontend/src/features/settings/components/api-key-create-dialog/api-key-create-dialog.tsx b/frontend/src/features/settings/components/api-key-create-dialog/api-key-create-dialog.tsx
new file mode 100644
index 00000000..f419da15
--- /dev/null
+++ b/frontend/src/features/settings/components/api-key-create-dialog/api-key-create-dialog.tsx
@@ -0,0 +1,100 @@
+import { useState } from "react"
+
+import { Button } from "@/components/ui/button"
+import { Input } from "@/components/ui/input"
+import { Modal } from "@/components/ui/modal"
+
+interface ApiKeyCreateDialogProps {
+  open: boolean
+  onClose: () => void
+  onCreate: (name: string) => Promise<void>
+}
+
+export function ApiKeyCreateDialog({ open, onClose, onCreate }: ApiKeyCreateDialogProps) {
+  const [name, setName] = useState("")
+  const [validationError, setValidationError] = useState<string | null>(null)
+  const [submitError, setSubmitError] = useState<string | null>(null)
+  const [isSubmitting, setIsSubmitting] = useState(false)
+
+  function resetForm() {
+    setName("")
+    setValidationError(null)
+    setSubmitError(null)
+    setIsSubmitting(false)
+  }
+
+  function handleClose() {
+    if (isSubmitting) return
+    resetForm()
+    onClose()
+  }
+
+  async function handleSubmit(event: React.FormEvent) {
+    event.preventDefault()
+    const trimmed = name.trim()
+    if (!trimmed) {
+      setValidationError("API key name is required")
+      return
+    }
+
+    setValidationError(null)
+    setSubmitError(null)
+    setIsSubmitting(true)
+    try {
+      await onCreate(trimmed)
+      resetForm()
+      onClose()
+    } catch (err) {
+      setSubmitError(err instanceof Error ? err.message : "Failed to create API key")
+    } finally {
+      setIsSubmitting(false)
+    }
+  }
+
+  return (
+    <Modal isOpen={open} onClose={handleClose} title="Generate API key" preventClose={isSubmitting}>
+      <form onSubmit={handleSubmit} className="flex flex-col gap-4">
+        <p className="text-sm text-text-secondary">
+          Give this key a name so you can identify it later (for example, &quot;Production&quot; or &quot;CI&quot;).
+        </p>
+
+        <div className="flex flex-col gap-2">
+          <label htmlFor="api-key-name" className="text-xs font-semibold uppercase tracking-wide text-text-secondary">
+            API key name
+          </label>
+          <Input
+            id="api-key-name"
+            type="text"
+            value={name}
+            onChange={(event) => {
+              setName(event.target.value)
+              setValidationError(null)
+              setSubmitError(null)
+            }}
+            placeholder="e.g. Production"
+            autoFocus
+            disabled={isSubmitting}
+          />
+          {validationError ? (
+            <p className="text-xs font-medium text-destructive">{validationError}</p>
+          ) : null}
+        </div>
+
+        {submitError ? (
+          <p className="rounded-lg border border-destructive/20 bg-destructive/10 p-3 text-sm text-destructive">
+            {submitError}
+          </p>
+        ) : null}
+
+        <div className="flex flex-col-reverse gap-2 sm:flex-row sm:justify-end">
+          <Button type="button" variant="outline" onClick={handleClose} disabled={isSubmitting}>
+            Cancel
+          </Button>
+          <Button type="submit" disabled={isSubmitting}>
+            {isSubmitting ? "Generating…" : "Generate key"}
+          </Button>
+        </div>
+      </form>
+    </Modal>
+  )
+}
diff --git a/frontend/src/features/settings/components/api-key-create-dialog/index.ts b/frontend/src/features/settings/components/api-key-create-dialog/index.ts
new file mode 100644
index 00000000..a01efaa2
--- /dev/null
+++ b/frontend/src/features/settings/components/api-key-create-dialog/index.ts
@@ -0,0 +1 @@
+export { ApiKeyCreateDialog } from "./api-key-create-dialog"
diff --git a/frontend/src/features/settings/components/api-key-secret-dialog/api-key-secret-dialog.stories.tsx b/frontend/src/features/settings/components/api-key-secret-dialog/api-key-secret-dialog.stories.tsx
new file mode 100644
index 00000000..658198e7
--- /dev/null
+++ b/frontend/src/features/settings/components/api-key-secret-dialog/api-key-secret-dialog.stories.tsx
@@ -0,0 +1,20 @@
+import type { Meta, StoryObj } from "@storybook/react-vite"
+
+import { ApiKeySecretDialog } from "./api-key-secret-dialog"
+
+const meta = {
+  title: "Features/Settings/ApiKeySecretDialog",
+  component: ApiKeySecretDialog,
+} satisfies Meta<typeof ApiKeySecretDialog>
+
+export default meta
+type Story = StoryObj<typeof meta>
+
+export const Open: Story = {
+  args: {
+    open: true,
+    clientId: "demo-client-id",
+    clientSecret: "ZVtUvv8aDOfM0R2krW3qKpn_EQ_FX-KXFa0lRZVfvpU",
+    onClose: () => undefined,
+  },
+}
diff --git a/frontend/src/features/settings/components/api-key-secret-dialog/api-key-secret-dialog.tsx b/frontend/src/features/settings/components/api-key-secret-dialog/api-key-secret-dialog.tsx
new file mode 100644
index 00000000..f7ed9ce5
--- /dev/null
+++ b/frontend/src/features/settings/components/api-key-secret-dialog/api-key-secret-dialog.tsx
@@ -0,0 +1,98 @@
+import { useState } from "react"
+
+import { Button } from "@/components/ui/button"
+import { Icon } from "@/components/ui/icon"
+import { Input } from "@/components/ui/input"
+import { Modal } from "@/components/ui/modal"
+
+interface ApiKeySecretDialogProps {
+  open: boolean
+  clientId?: string
+  clientSecret: string
+  onClose: () => void
+}
+
+export function ApiKeySecretDialog({
+  open,
+  clientId,
+  clientSecret,
+  onClose,
+}: ApiKeySecretDialogProps) {
+  const [copiedField, setCopiedField] = useState<"clientId" | "clientSecret" | null>(null)
+
+  async function copyValue(value: string, field: "clientId" | "clientSecret") {
+    try {
+      await navigator.clipboard.writeText(value)
+      setCopiedField(field)
+      window.setTimeout(() => setCopiedField((current) => (current === field ? null : current)), 2000)
+    } catch {
+      setCopiedField(null)
+    }
+  }
+
+  return (
+    <Modal isOpen={open} onClose={onClose} title="Save your API credentials">
+      <div className="flex flex-col gap-4">
+        <p className="text-sm text-text-secondary">
+          Copy these values now. The client secret is only shown once and cannot be retrieved later.
+        </p>
+
+        {clientId ? (
+          <div className="flex flex-col gap-2">
+            <label htmlFor="api-key-client-id" className="text-xs font-semibold uppercase tracking-wide text-text-secondary">
+              Client ID
+            </label>
+            <div className="flex gap-2">
+              <Input
+                id="api-key-client-id"
+                readOnly
+                value={clientId}
+                className="font-mono text-sm"
+                onFocus={(event) => event.target.select()}
+              />
+              <Button
+                type="button"
+                variant="outline"
+                size="sm"
+                className="shrink-0"
+                onClick={() => void copyValue(clientId, "clientId")}
+              >
+                <Icon name="content_copy" size="sm" data-icon="inline-start" />
+                {copiedField === "clientId" ? "Copied" : "Copy"}
+              </Button>
+            </div>
+          </div>
+        ) : null}
+
+        <div className="flex flex-col gap-2">
+          <label htmlFor="api-key-client-secret" className="text-xs font-semibold uppercase tracking-wide text-text-secondary">
+            Client secret
+          </label>
+          <div className="flex gap-2">
+            <Input
+              id="api-key-client-secret"
+              readOnly
+              value={clientSecret}
+              className="font-mono text-sm"
+              onFocus={(event) => event.target.select()}
+            />
+            <Button
+              type="button"
+              variant="outline"
+              size="sm"
+              className="shrink-0"
+              onClick={() => void copyValue(clientSecret, "clientSecret")}
+            >
+              <Icon name="content_copy" size="sm" data-icon="inline-start" />
+              {copiedField === "clientSecret" ? "Copied" : "Copy"}
+            </Button>
+          </div>
+        </div>
+
+        <Button type="button" className="w-full" onClick={onClose}>
+          Done
+        </Button>
+      </div>
+    </Modal>
+  )
+}
diff --git a/frontend/src/features/settings/components/api-key-secret-dialog/index.ts b/frontend/src/features/settings/components/api-key-secret-dialog/index.ts
new file mode 100644
index 00000000..0bc35277
--- /dev/null
+++ b/frontend/src/features/settings/components/api-key-secret-dialog/index.ts
@@ -0,0 +1 @@
+export { ApiKeySecretDialog } from "./api-key-secret-dialog"
diff --git a/frontend/src/features/settings/pages/settings.page.tsx b/frontend/src/features/settings/pages/settings.page.tsx
index 8bd30b17..f1bd0f0d 100644
--- a/frontend/src/features/settings/pages/settings.page.tsx
+++ b/frontend/src/features/settings/pages/settings.page.tsx
@@ -1,6 +1,6 @@
 import * as Tabs from "@radix-ui/react-tabs"
 import { useState } from "react"
-import { useParams } from "react-router-dom"
+import { useParams, useSearchParams } from "react-router-dom"
 
 import { Button } from "@/components/ui/button"
 import { Checkbox } from "@/components/ui/checkbox"
@@ -10,7 +10,9 @@ import { Spinner } from "@/components/ui/spinner"
 import { PageHeader } from "@/shared/components/page-header"
 import { cn } from "@/lib/utils"
 
+import { ApiKeyCreateDialog } from "../components/api-key-create-dialog"
 import { ApiKeyRow } from "../components/api-key-row"
+import { ApiKeySecretDialog } from "../components/api-key-secret-dialog"
 import { RadioOption } from "../components/radio-option"
 import { useSettings } from "../hooks/use-settings.hook"
 import { dispatchConfigsEqual, toStoreMessageContentSetting } from "../message-dispatch-mode"
@@ -21,6 +23,7 @@ import type {
   WorkspaceSettings,
   WorkspaceSettingsPatch,
 } from "../settings.types"
+import { settingsTabFromSearch } from "../settings.types"
 
 interface GeneralSettingsPanelProps {
   settings: WorkspaceSettings
@@ -192,22 +195,37 @@ function DispatchSettingsPanel({ initialConfig, onSave }: DispatchSettingsPanelP
 
 export function SettingsPage() {
   const { wid = "" } = useParams<{ wid: string }>()
-  const [activeTab, setActiveTab] = useState<SettingsTab>("general")
+  const [searchParams] = useSearchParams()
+  const [activeTab, setActiveTab] = useState<SettingsTab>(() => settingsTabFromSearch(searchParams))
   const [busyKeyId, setBusyKeyId] = useState<string | null>(null)
+  const [createDialogOpen, setCreateDialogOpen] = useState(false)
+  const [revealedSecret, setRevealedSecret] = useState<{
+    clientId?: string
+    clientSecret: string
+  } | null>(null)
 
   const { settings, apiKeys, messageDispatchConfig, isLoading, error, saveSettings, addApiKey, removeApiKey, rotateApiKey } =
     useSettings(wid)
 
-  async function handleCreateApiKey() {
-    const name = window.prompt("API key name")
-    if (!name?.trim()) return
-    await addApiKey(name.trim())
+  async function handleCreateApiKey(name: string) {
+    const created = await addApiKey(name)
+    if (created.client_secret) {
+      setRevealedSecret({
+        clientId: created.client_id,
+        clientSecret: created.client_secret,
+      })
+    }
   }
 
   async function handleRegenerate(keyId: string) {
     setBusyKeyId(keyId)
     try {
-      await rotateApiKey(keyId)
+      const result = await rotateApiKey(keyId)
+      const key = apiKeys.find((item) => item.id === keyId)
+      setRevealedSecret({
+        clientId: key?.client_id,
+        clientSecret: result.client_secret,
+      })
     } finally {
       setBusyKeyId(null)
     }
@@ -291,7 +309,7 @@ export function SettingsPage() {
                 Manage keys used to authenticate gateway requests.
               </p>
             </div>
-            <Button type="button" onClick={handleCreateApiKey}>
+            <Button type="button" onClick={() => setCreateDialogOpen(true)}>
               <Icon name="add" size="sm" />
               Generate key
             </Button>
@@ -332,6 +350,20 @@ export function SettingsPage() {
           />
         </Tabs.Content>
       </Tabs.Root>
+
+      <ApiKeyCreateDialog
+        key={createDialogOpen ? "open" : "closed"}
+        open={createDialogOpen}
+        onClose={() => setCreateDialogOpen(false)}
+        onCreate={handleCreateApiKey}
+      />
+
+      <ApiKeySecretDialog
+        open={revealedSecret !== null}
+        clientId={revealedSecret?.clientId}
+        clientSecret={revealedSecret?.clientSecret ?? ""}
+        onClose={() => setRevealedSecret(null)}
+      />
     </div>
   )
 }
diff --git a/frontend/src/features/settings/settings.types.ts b/frontend/src/features/settings/settings.types.ts
index a03bbbf6..52e8f4e0 100644
--- a/frontend/src/features/settings/settings.types.ts
+++ b/frontend/src/features/settings/settings.types.ts
@@ -24,6 +24,14 @@ export interface ApiKey {
 
 export type SettingsTab = "general" | "developer" | "team" | "dispatch"
 
+export function settingsTabFromSearch(params: URLSearchParams): SettingsTab {
+  const tab = params.get("tab")
+  if (tab === "developer" || tab === "team" || tab === "dispatch" || tab === "general") {
+    return tab
+  }
+  return "general"
+}
+
 export interface MessageDispatchConfig {
   mode: MessageDispatchMode
   storeMessageContent: boolean
diff --git a/internal/app/wire.go b/internal/app/wire.go
index 78396822..fadb8471 100644
--- a/internal/app/wire.go
+++ b/internal/app/wire.go
@@ -125,11 +125,16 @@ func Wire(cfg *Config, sysLogger *pkglogger.Logger) (*Application, error) {
 	inboxStore := inbox.NewStore()
 	memoryStore := memory.GetStore()
 
-	var portalInboxHandler *handler.PortalInboxHandler
+	var publishInboxEvent inbox.PublishFunc
 	inboxWriter := inbox.NewNotifyingWriter(inboxStore, inbox.PublishFunc(func(workspaceID, eventType string, data any) {
-		portalInboxHandler.PublishInboxEvent(workspaceID, eventType, data)
+		if publishInboxEvent != nil {
+			publishInboxEvent(workspaceID, eventType, data)
+		}
 	}))
-	portalInboxHandler = handler.NewPortalInboxHandler(inboxStore, inboxWriter)
+	portalInboxHandler := handler.NewPortalInboxHandler(inboxStore, inboxWriter)
+	publishInboxEvent = func(workspaceID, eventType string, data any) {
+		portalInboxHandler.PublishInboxEvent(workspaceID, eventType, data)
+	}
 
 	// ── Auth service ──────────────────────────────────────────────────────
 	authService := service.NewAuthService(
diff --git a/internal/core/domain/permission.go b/internal/core/domain/permission.go
index 48e0fb44..41f8a764 100644
--- a/internal/core/domain/permission.go
+++ b/internal/core/domain/permission.go
@@ -39,6 +39,6 @@ const (
 	PermissionInvitationsRead  = "invitations.read"
 	PermissionInvitationsWrite = "invitations.write"
 
-	// Testing/Operations
-	PermissionSendTest = "send.test"
+	// Inbox
+	PermissionInboxWrite = "inbox.write"
 )
diff --git a/internal/core/service/email_enrichment.go b/internal/core/service/email_enrichment.go
index 68ca27c7..23f2c069 100644
--- a/internal/core/service/email_enrichment.go
+++ b/internal/core/service/email_enrichment.go
@@ -31,15 +31,12 @@ func (s *GatewayService) enrichEmailFromIntegration(ctx context.Context, workspa
 	}
 
 	intg, err := s.integrations.GetActiveByWorkspaceAndChannel(ctx, workspaceID, channelEmail)
-	if err != nil {
-		if !errors.Is(err, port.ErrNotFound) {
+	if err != nil || intg == nil {
+		if err != nil && !errors.Is(err, port.ErrNotFound) {
 			slog.WarnContext(ctx, "failed to load email integration for sender enrichment", "error", err)
 		}
 		return email
 	}
-	if intg == nil {
-		return email
-	}
 
 	var cfg registry.EmailConfig
 	if err := json.Unmarshal(intg.Config, &cfg); err != nil {
diff --git a/internal/core/service/gateway_service.go b/internal/core/service/gateway_service.go
index 9d24562a..9f6f1085 100644
--- a/internal/core/service/gateway_service.go
+++ b/internal/core/service/gateway_service.go
@@ -170,7 +170,7 @@ func (s *GatewayService) dispatch(
 		providerName = intg.ProviderName
 
 		providerCtx := applogger.WithProvider(ctx, providerName)
-		provResult, err = sendViaProvider(providerCtx, *intg)
+		provResult, err = sendViaProvider(providerCtx, intg)
 		if err != nil {
 			slog.WarnContext(providerCtx, "provider dispatch failed", "error", err, "integration_id", integrationID)
 			return attachMeta(nil, effectiveMode, config.StoreMessageContent, channel, integrationID, providerName), err
@@ -232,7 +232,7 @@ func (s *GatewayService) resolveDispatchConfig(ctx context.Context, workspaceID
 }
 
 // requireProviderIntegration loads and validates the workspace integration for provider dispatch.
-func (s *GatewayService) requireProviderIntegration(ctx context.Context, workspaceID, channel string) (*domain.Integration, error) {
+func (s *GatewayService) requireProviderIntegration(ctx context.Context, workspaceID, channel string) (domain.Integration, error) {
 	if s.integrations == nil {
 		err := fmt.Errorf("integration repository not configured: %w", port.ErrInternal)
 		slog.ErrorContext(ctx, "provider dispatch blocked",
@@ -240,7 +240,7 @@ func (s *GatewayService) requireProviderIntegration(ctx context.Context, workspa
 			"channel", channel,
 			"error", err,
 		)
-		return nil, err
+		return domain.Integration{}, err
 	}
 
 	intg, err := s.integrations.GetActiveByWorkspaceAndChannel(ctx, workspaceID, channel)
@@ -256,7 +256,16 @@ func (s *GatewayService) requireProviderIntegration(ctx context.Context, workspa
 			"channel", channel,
 			"error", err,
 		)
-		return nil, fmt.Errorf("provider integration for %s channel: %w", channel, err)
+		return domain.Integration{}, fmt.Errorf("provider integration for %s channel: %w", channel, err)
+	}
+	if intg == nil {
+		err := fmt.Errorf("provider integration for %s channel: %w", channel, port.ErrNotFound)
+		slog.WarnContext(ctx, "provider dispatch blocked",
+			"reason", "no_active_integration",
+			"channel", channel,
+			"error", err,
+		)
+		return domain.Integration{}, err
 	}
 
 	if err := domain.ValidateProviderIntegration(*intg); err != nil {
@@ -268,10 +277,10 @@ func (s *GatewayService) requireProviderIntegration(ctx context.Context, workspa
 			"status", intg.Status,
 			"error", err,
 		)
-		return nil, err
+		return domain.Integration{}, err
 	}
 
-	return intg, nil
+	return *intg, nil
 }
 
 // inbox write helpers — each converts a domain error into meaningful context.
diff --git a/internal/presentation/middleware/auth.go b/internal/presentation/middleware/auth.go
index 6d8f2534..c1ad1e19 100644
--- a/internal/presentation/middleware/auth.go
+++ b/internal/presentation/middleware/auth.go
@@ -6,10 +6,12 @@ import (
 	"net/http"
 	"strings"
 
+	"github.com/google/uuid"
 	"github.com/labstack/echo/v4"
 
 	"github.com/weprodev/go-pkg/crypto"
 
+	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
 	"github.com/weprodev/wpd-message-gateway/internal/core/port"
 	applogger "github.com/weprodev/wpd-message-gateway/internal/infrastructure/logger"
 )
@@ -23,10 +25,17 @@ const (
 	APIKeyIDKey contextKey = "api_key_id"
 	// APIKeyNameKey is the context key for the API key display name (product/service label).
 	APIKeyNameKey contextKey = "api_key_name"
-	// HeaderWorkspaceKey is the HTTP header carrying the workspace slug.
+	// HeaderWorkspaceKey is the HTTP header carrying the workspace ID or slug.
 	HeaderWorkspaceKey = "X-Workspace-Key"
 )
 
+func resolveWorkspaceByKey(ctx context.Context, repo port.WorkspaceRepository, key string) (*domain.Workspace, error) {
+	if _, err := uuid.Parse(key); err == nil {
+		return repo.GetByID(ctx, key)
+	}
+	return repo.GetBySlug(ctx, key)
+}
+
 // APIKeyAuthMiddleware validates client credentials, optional workspace binding via X-Workspace-Key,
 // and records last_used_at on the API key.
 func APIKeyAuthMiddleware(apiKeyRepo port.APIKeyRepository, workspaceRepo port.WorkspaceRepository) echo.MiddlewareFunc {
@@ -64,9 +73,9 @@ func APIKeyAuthMiddleware(apiKeyRepo port.APIKeyRepository, workspaceRepo port.W
 			wsKey := strings.TrimSpace(c.Request().Header.Get(HeaderWorkspaceKey))
 			if wsKey == "" {
 				slog.WarnContext(c.Request().Context(), "API key auth failed: missing workspace key header", "client_id", clientID)
-				return echo.NewHTTPError(http.StatusBadRequest, "Missing "+HeaderWorkspaceKey+" (workspace slug)")
+				return echo.NewHTTPError(http.StatusBadRequest, "Missing "+HeaderWorkspaceKey+" (workspace id or slug)")
 			}
-			ws, werr := workspaceRepo.GetBySlug(c.Request().Context(), wsKey)
+			ws, werr := resolveWorkspaceByKey(c.Request().Context(), workspaceRepo, wsKey)
 			if werr != nil || ws == nil {
 				slog.WarnContext(c.Request().Context(), "API key auth failed: unknown workspace key", "client_id", clientID, "workspace_key", wsKey)
 				return echo.NewHTTPError(http.StatusForbidden, "Unknown workspace key")
diff --git a/internal/presentation/middleware/auth_test.go b/internal/presentation/middleware/auth_test.go
new file mode 100644
index 00000000..0fa9ff12
--- /dev/null
+++ b/internal/presentation/middleware/auth_test.go
@@ -0,0 +1,76 @@
+package middleware
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
+	"github.com/weprodev/wpd-message-gateway/internal/core/port"
+)
+
+type stubWorkspaceRepo struct {
+	byID   map[string]*domain.Workspace
+	bySlug map[string]*domain.Workspace
+}
+
+func (s *stubWorkspaceRepo) Create(context.Context, *domain.Workspace) error { return nil }
+func (s *stubWorkspaceRepo) Update(context.Context, *domain.Workspace) error { return nil }
+func (s *stubWorkspaceRepo) SetStatus(context.Context, string, string) error { return nil }
+func (s *stubWorkspaceRepo) ListForUser(context.Context, string) ([]domain.Workspace, error) {
+	return nil, nil
+}
+
+func (s *stubWorkspaceRepo) GetByID(_ context.Context, id string) (*domain.Workspace, error) {
+	ws, ok := s.byID[id]
+	if !ok {
+		return nil, port.ErrNotFound
+	}
+	return ws, nil
+}
+
+func (s *stubWorkspaceRepo) GetBySlug(_ context.Context, slug string) (*domain.Workspace, error) {
+	ws, ok := s.bySlug[slug]
+	if !ok {
+		return nil, port.ErrNotFound
+	}
+	return ws, nil
+}
+
+func TestResolveWorkspaceByKey(t *testing.T) {
+	repo := &stubWorkspaceRepo{
+		byID: map[string]*domain.Workspace{
+			"00000000-0000-0000-0000-000000000001": {ID: "00000000-0000-0000-0000-000000000001", Slug: "demo"},
+		},
+		bySlug: map[string]*domain.Workspace{
+			"demo": {ID: "00000000-0000-0000-0000-000000000001", Slug: "demo"},
+		},
+	}
+
+	t.Run("resolves workspace id", func(t *testing.T) {
+		ws, err := resolveWorkspaceByKey(context.Background(), repo, "00000000-0000-0000-0000-000000000001")
+		if err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+		if ws.ID != "00000000-0000-0000-0000-000000000001" {
+			t.Fatalf("got id %q", ws.ID)
+		}
+	})
+
+	t.Run("resolves workspace slug", func(t *testing.T) {
+		ws, err := resolveWorkspaceByKey(context.Background(), repo, "demo")
+		if err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+		if ws.Slug != "demo" {
+			t.Fatalf("got slug %q", ws.Slug)
+		}
+	})
+
+	t.Run("unknown key returns not found", func(t *testing.T) {
+		_, err := resolveWorkspaceByKey(context.Background(), repo, "missing")
+		if !errors.Is(err, port.ErrNotFound) {
+			t.Fatalf("expected ErrNotFound, got %v", err)
+		}
+	})
+}
diff --git a/internal/presentation/router.go b/internal/presentation/router.go
index 2be33ee6..e6e386f6 100644
--- a/internal/presentation/router.go
+++ b/internal/presentation/router.go
@@ -193,15 +193,15 @@ func (rt *Router) Setup() *echo.Echo {
 		inboxGroup.GET("/chat", inbox.HandleGetChat)
 		inboxGroup.GET("/chat/:id", inbox.HandleGetChatByID)
 		inboxGroup.GET("/events", inbox.HandleSSE)
-		inboxGroup.DELETE("/emails/:id", inbox.HandleDeleteEmailByID, customMiddleware.RequirePermission(rt.gate, rt.workspaceRepo, domain.PermissionSendTest))
-		inboxGroup.DELETE("/sms/:id", inbox.HandleDeleteSMSByID, customMiddleware.RequirePermission(rt.gate, rt.workspaceRepo, domain.PermissionSendTest))
-		inboxGroup.DELETE("/push/:id", inbox.HandleDeletePushByID, customMiddleware.RequirePermission(rt.gate, rt.workspaceRepo, domain.PermissionSendTest))
-		inboxGroup.DELETE("/chat/:id", inbox.HandleDeleteChatByID, customMiddleware.RequirePermission(rt.gate, rt.workspaceRepo, domain.PermissionSendTest))
-		inboxGroup.DELETE("/messages", inbox.HandleClearAll, customMiddleware.RequirePermission(rt.gate, rt.workspaceRepo, domain.PermissionSendTest))
+		inboxGroup.DELETE("/emails/:id", inbox.HandleDeleteEmailByID, customMiddleware.RequirePermission(rt.gate, rt.workspaceRepo, domain.PermissionInboxWrite))
+		inboxGroup.DELETE("/sms/:id", inbox.HandleDeleteSMSByID, customMiddleware.RequirePermission(rt.gate, rt.workspaceRepo, domain.PermissionInboxWrite))
+		inboxGroup.DELETE("/push/:id", inbox.HandleDeletePushByID, customMiddleware.RequirePermission(rt.gate, rt.workspaceRepo, domain.PermissionInboxWrite))
+		inboxGroup.DELETE("/chat/:id", inbox.HandleDeleteChatByID, customMiddleware.RequirePermission(rt.gate, rt.workspaceRepo, domain.PermissionInboxWrite))
+		inboxGroup.DELETE("/messages", inbox.HandleClearAll, customMiddleware.RequirePermission(rt.gate, rt.workspaceRepo, domain.PermissionInboxWrite))
 
 		internal := api.Group("/workspaces/:wid/internal")
 		internal.Use(customMiddleware.PortalJWTBearerOrQuery(rt.jwtSecret))
-		internal.Use(customMiddleware.RequirePermission(rt.gate, rt.workspaceRepo, domain.PermissionSendTest))
+		internal.Use(customMiddleware.RequirePermission(rt.gate, rt.workspaceRepo, domain.PermissionInboxWrite))
 		internal.POST("/email", inbox.HandleIngestEmail)
 		internal.POST("/sms", inbox.HandleIngestSMS)
 		internal.POST("/push", inbox.HandleIngestPush)

From 80aacdfbcdd214be2c40128eabc95143dbee656c Mon Sep 17 00:00:00 2001
From: MichaelAndish <maikel1370@gmail.com>
Date: Sat, 4 Jul 2026 14:13:20 +0200
Subject: [PATCH 12/20] feat: add new UI components and tests for improved user
 experience

- Introduced Checkbox component with associated Storybook stories and tests to enhance form functionality.
- Added GetStartedDialog, ConnectModal, and DisconnectModal components with tests to streamline user onboarding and integration management.
- Implemented IntegrationRow and ApiKeyRow components with stories and tests for better integration handling and API key management.
- Created AppHeader, AppFooter, AuthCard, and PageHeader components with corresponding tests and stories to improve overall layout and navigation.
- Developed ThemeToggle and MessageGatewayLogo components to enhance theme management and branding.

This commit enriches the frontend with essential UI components and ensures their functionality through comprehensive testing.
---
 .../src/components/ui/checkbox.stories.tsx    | 29 +++++++
 frontend/src/components/ui/checkbox.test.tsx  | 17 ++++
 .../get-started-dialog.test.tsx               | 52 +++++++++++++
 .../connect-modal/connect-modal.test.tsx      | 68 ++++++++++++++++
 .../disconnect-modal.test.tsx                 | 67 ++++++++++++++++
 .../integration-provider-icon.test.tsx        | 16 ++++
 .../integration-row.stories.tsx               | 78 +++++++++++++++++++
 .../integration-row/integration-row.test.tsx  | 69 ++++++++++++++++
 .../api-key-row/api-key-row.stories.tsx       | 39 ++++++++++
 .../api-key-row/api-key-row.test.tsx          | 40 ++++++++++
 .../api-key-secret-dialog.test.tsx            | 48 ++++++++++++
 .../radio-option/radio-option.stories.tsx     | 50 ++++++++++++
 .../radio-option/radio-option.test.tsx        | 43 ++++++++++
 .../app-footer/app-footer.stories.tsx         | 22 ++++++
 .../components/app-footer/app-footer.test.tsx | 19 +++++
 .../{ => app-footer}/app-footer.tsx           |  0
 .../src/shared/components/app-footer/index.ts |  1 +
 .../app-header/app-header.stories.tsx         | 27 +++++++
 .../components/app-header/app-header.test.tsx | 49 ++++++++++++
 .../{ => app-header}/app-header.tsx           |  4 +-
 .../src/shared/components/app-header/index.ts |  1 +
 .../auth-card/auth-card.stories.tsx           | 21 +++++
 .../components/auth-card/auth-card.test.tsx   | 16 ++++
 .../components/{ => auth-card}/auth-card.tsx  |  0
 .../src/shared/components/auth-card/index.ts  |  1 +
 .../components/message-gateway-logo/index.ts  |  1 +
 .../message-gateway-logo.stories.tsx          | 16 ++++
 .../message-gateway-logo.test.tsx             | 11 +++
 .../message-gateway-logo.tsx                  |  0
 .../shared/components/page-header/index.ts    |  1 +
 .../page-header/page-header.stories.tsx       | 25 ++++++
 .../page-header/page-header.test.tsx          | 13 ++++
 .../{ => page-header}/page-header.tsx         |  0
 .../shared/components/theme-toggle/index.ts   |  1 +
 .../theme-toggle/theme-toggle.stories.tsx     | 24 ++++++
 .../theme-toggle/theme-toggle.test.tsx        | 27 +++++++
 .../{ => theme-toggle}/theme-toggle.tsx       |  0
 37 files changed, 894 insertions(+), 2 deletions(-)
 create mode 100644 frontend/src/components/ui/checkbox.stories.tsx
 create mode 100644 frontend/src/components/ui/checkbox.test.tsx
 create mode 100644 frontend/src/features/inbox/components/get-started-dialog/get-started-dialog.test.tsx
 create mode 100644 frontend/src/features/integrations/components/connect-modal/connect-modal.test.tsx
 create mode 100644 frontend/src/features/integrations/components/disconnect-modal/disconnect-modal.test.tsx
 create mode 100644 frontend/src/features/integrations/components/integration-provider-icon/integration-provider-icon.test.tsx
 create mode 100644 frontend/src/features/integrations/components/integration-row/integration-row.stories.tsx
 create mode 100644 frontend/src/features/integrations/components/integration-row/integration-row.test.tsx
 create mode 100644 frontend/src/features/settings/components/api-key-row/api-key-row.stories.tsx
 create mode 100644 frontend/src/features/settings/components/api-key-row/api-key-row.test.tsx
 create mode 100644 frontend/src/features/settings/components/api-key-secret-dialog/api-key-secret-dialog.test.tsx
 create mode 100644 frontend/src/features/settings/components/radio-option/radio-option.stories.tsx
 create mode 100644 frontend/src/features/settings/components/radio-option/radio-option.test.tsx
 create mode 100644 frontend/src/shared/components/app-footer/app-footer.stories.tsx
 create mode 100644 frontend/src/shared/components/app-footer/app-footer.test.tsx
 rename frontend/src/shared/components/{ => app-footer}/app-footer.tsx (100%)
 create mode 100644 frontend/src/shared/components/app-footer/index.ts
 create mode 100644 frontend/src/shared/components/app-header/app-header.stories.tsx
 create mode 100644 frontend/src/shared/components/app-header/app-header.test.tsx
 rename frontend/src/shared/components/{ => app-header}/app-header.tsx (93%)
 create mode 100644 frontend/src/shared/components/app-header/index.ts
 create mode 100644 frontend/src/shared/components/auth-card/auth-card.stories.tsx
 create mode 100644 frontend/src/shared/components/auth-card/auth-card.test.tsx
 rename frontend/src/shared/components/{ => auth-card}/auth-card.tsx (100%)
 create mode 100644 frontend/src/shared/components/auth-card/index.ts
 create mode 100644 frontend/src/shared/components/message-gateway-logo/index.ts
 create mode 100644 frontend/src/shared/components/message-gateway-logo/message-gateway-logo.stories.tsx
 create mode 100644 frontend/src/shared/components/message-gateway-logo/message-gateway-logo.test.tsx
 rename frontend/src/shared/components/{ => message-gateway-logo}/message-gateway-logo.tsx (100%)
 create mode 100644 frontend/src/shared/components/page-header/index.ts
 create mode 100644 frontend/src/shared/components/page-header/page-header.stories.tsx
 create mode 100644 frontend/src/shared/components/page-header/page-header.test.tsx
 rename frontend/src/shared/components/{ => page-header}/page-header.tsx (100%)
 create mode 100644 frontend/src/shared/components/theme-toggle/index.ts
 create mode 100644 frontend/src/shared/components/theme-toggle/theme-toggle.stories.tsx
 create mode 100644 frontend/src/shared/components/theme-toggle/theme-toggle.test.tsx
 rename frontend/src/shared/components/{ => theme-toggle}/theme-toggle.tsx (100%)

diff --git a/frontend/src/components/ui/checkbox.stories.tsx b/frontend/src/components/ui/checkbox.stories.tsx
new file mode 100644
index 00000000..d537ec87
--- /dev/null
+++ b/frontend/src/components/ui/checkbox.stories.tsx
@@ -0,0 +1,29 @@
+import type { Meta, StoryObj } from "@storybook/react-vite"
+
+import { Checkbox } from "./checkbox"
+
+const meta = {
+  title: "Components/Checkbox",
+  component: Checkbox,
+  tags: ["autodocs"],
+  parameters: { layout: "centered" },
+} satisfies Meta<typeof Checkbox>
+
+export default meta
+type Story = StoryObj<typeof meta>
+
+export const Unchecked: Story = {
+  args: {},
+}
+
+export const Checked: Story = {
+  args: {
+    checked: true,
+  },
+}
+
+export const Disabled: Story = {
+  args: {
+    disabled: true,
+  },
+}
diff --git a/frontend/src/components/ui/checkbox.test.tsx b/frontend/src/components/ui/checkbox.test.tsx
new file mode 100644
index 00000000..08e0f580
--- /dev/null
+++ b/frontend/src/components/ui/checkbox.test.tsx
@@ -0,0 +1,17 @@
+import { render, screen } from "@testing-library/react"
+import userEvent from "@testing-library/user-event"
+import { describe, expect, it, vi } from "vitest"
+
+import { Checkbox } from "./checkbox"
+
+describe("Checkbox", () => {
+  it("renders and toggles checked state", async () => {
+    const user = userEvent.setup()
+    const onCheckedChange = vi.fn()
+
+    render(<Checkbox aria-label="Accept terms" onCheckedChange={onCheckedChange} />)
+
+    await user.click(screen.getByRole("checkbox", { name: /accept terms/i }))
+    expect(onCheckedChange).toHaveBeenCalledWith(true)
+  })
+})
diff --git a/frontend/src/features/inbox/components/get-started-dialog/get-started-dialog.test.tsx b/frontend/src/features/inbox/components/get-started-dialog/get-started-dialog.test.tsx
new file mode 100644
index 00000000..943586f2
--- /dev/null
+++ b/frontend/src/features/inbox/components/get-started-dialog/get-started-dialog.test.tsx
@@ -0,0 +1,52 @@
+import { render, screen } from "@testing-library/react"
+import { describe, expect, it, vi } from "vitest"
+import { MemoryRouter } from "react-router-dom"
+
+import { GetStartedDialog } from "./get-started-dialog"
+import { useGetStartedContext } from "../../hooks/use-get-started-context.hook"
+
+vi.mock("../../hooks/use-get-started-context.hook", () => ({
+  useGetStartedContext: vi.fn(),
+}))
+
+const mockedUseGetStartedContext = vi.mocked(useGetStartedContext)
+
+describe("GetStartedDialog", () => {
+  it("renders workspace credentials and curl examples", () => {
+    mockedUseGetStartedContext.mockReturnValue({
+      context: {
+        workspaceId: "00000000-0000-0000-0000-000000000001",
+        apiKeys: [{ client_id: "demo-client-id" }],
+      },
+      isLoading: false,
+      error: null,
+    })
+
+    render(
+      <MemoryRouter>
+        <GetStartedDialog open onOpenChange={vi.fn()} workspaceId="00000000-0000-0000-0000-000000000001" />
+      </MemoryRouter>,
+    )
+
+    expect(screen.getByText("Your credentials")).toBeInTheDocument()
+    expect(screen.getByText("demo-client-id")).toBeInTheDocument()
+    expect(screen.getAllByText(/X-Workspace-Key: 00000000-0000-0000-0000-000000000001/).length).toBeGreaterThan(0)
+    expect(screen.getByText(/\/v1\/email/)).toBeInTheDocument()
+  })
+
+  it("shows loading state", () => {
+    mockedUseGetStartedContext.mockReturnValue({
+      context: null,
+      isLoading: true,
+      error: null,
+    })
+
+    render(
+      <MemoryRouter>
+        <GetStartedDialog open onOpenChange={vi.fn()} workspaceId="ws-1" />
+      </MemoryRouter>,
+    )
+
+    expect(screen.getByText(/loading workspace credentials/i)).toBeInTheDocument()
+  })
+})
diff --git a/frontend/src/features/integrations/components/connect-modal/connect-modal.test.tsx b/frontend/src/features/integrations/components/connect-modal/connect-modal.test.tsx
new file mode 100644
index 00000000..8cce4835
--- /dev/null
+++ b/frontend/src/features/integrations/components/connect-modal/connect-modal.test.tsx
@@ -0,0 +1,68 @@
+import { render, screen, waitFor } from "@testing-library/react"
+import userEvent from "@testing-library/user-event"
+import { describe, expect, it, vi } from "vitest"
+
+import { ConnectModal } from "./connect-modal"
+
+const mailgunProvider = {
+  id: "mailgun",
+  name: "Mailgun",
+  description: "Reliable transactional email sending service.",
+  icon: "📧",
+  category: "email" as const,
+  isAvailable: true,
+  isConnected: false,
+  isDeactivated: false,
+}
+
+const mockFields = [
+  {
+    id: "f1",
+    provider_id: "mailgun",
+    key: "api_key",
+    label: "API Key",
+    description: "Your Mailgun Private API Key",
+    field_type: "password",
+    required: true,
+    default_value: "",
+    sort_order: 1,
+  },
+]
+
+describe("ConnectModal", () => {
+  it("loads config fields and submits connection", async () => {
+    const user = userEvent.setup()
+    const onConnect = vi.fn().mockResolvedValue({ ok: true })
+    const onClose = vi.fn()
+
+    vi.spyOn(globalThis, "fetch").mockResolvedValue({
+      ok: true,
+      status: 200,
+      json: async () => mockFields,
+    } as Response)
+
+    render(
+      <ConnectModal
+        isOpen
+        onClose={onClose}
+        workspaceId="demo-wid"
+        provider={mailgunProvider}
+        onConnect={onConnect}
+      />,
+    )
+
+    expect(screen.getByText(/loading configuration/i)).toBeInTheDocument()
+
+    await waitFor(() => {
+      expect(screen.getByLabelText(/api key/i)).toBeInTheDocument()
+    })
+
+    await user.type(screen.getByLabelText(/api key/i), "secret-key")
+    await user.click(screen.getByRole("button", { name: /^connect$/i }))
+
+    await waitFor(() => {
+      expect(onConnect).toHaveBeenCalledWith(mailgunProvider, { api_key: "secret-key" })
+      expect(onClose).toHaveBeenCalledTimes(1)
+    })
+  })
+})
diff --git a/frontend/src/features/integrations/components/disconnect-modal/disconnect-modal.test.tsx b/frontend/src/features/integrations/components/disconnect-modal/disconnect-modal.test.tsx
new file mode 100644
index 00000000..50eb1e48
--- /dev/null
+++ b/frontend/src/features/integrations/components/disconnect-modal/disconnect-modal.test.tsx
@@ -0,0 +1,67 @@
+import { render, screen } from "@testing-library/react"
+import userEvent from "@testing-library/user-event"
+import { describe, expect, it, vi } from "vitest"
+
+import { INTEGRATION_STATUS } from "@/features/integrations/integrations.types"
+import { DisconnectModal } from "./disconnect-modal"
+
+const connectedMailgun = {
+  id: "mailgun",
+  name: "Mailgun",
+  description: "Reliable transactional email sending service.",
+  icon: "📧",
+  category: "email" as const,
+  isAvailable: true,
+  isConnected: true,
+  isDeactivated: false,
+  integration: {
+    id: "intg-1",
+    workspace_id: "demo-wid",
+    channel_type: "email" as const,
+    provider_name: "mailgun",
+    config: { api_key: "hidden" },
+    status: INTEGRATION_STATUS.CONNECTED,
+    is_default: true,
+    created_at: "2026-01-01T00:00:00Z",
+    updated_at: "2026-01-01T00:00:00Z",
+  },
+}
+
+describe("DisconnectModal", () => {
+  it("renders disconnect actions for connected provider", () => {
+    render(
+      <DisconnectModal
+        isOpen
+        provider={connectedMailgun}
+        onClose={vi.fn()}
+        onDeactivate={vi.fn().mockResolvedValue({ ok: true })}
+        onRemove={vi.fn().mockResolvedValue({ ok: true })}
+      />,
+    )
+
+    expect(screen.getByText(/disconnect mailgun/i)).toBeInTheDocument()
+    expect(screen.getByRole("button", { name: /deactivate/i })).toBeInTheDocument()
+    expect(screen.getByRole("button", { name: /remove integration/i })).toBeInTheDocument()
+  })
+
+  it("calls deactivate handler", async () => {
+    const user = userEvent.setup()
+    const onDeactivate = vi.fn().mockResolvedValue({ ok: true })
+    const onClose = vi.fn()
+
+    render(
+      <DisconnectModal
+        isOpen
+        provider={connectedMailgun}
+        onClose={onClose}
+        onDeactivate={onDeactivate}
+        onRemove={vi.fn().mockResolvedValue({ ok: true })}
+      />,
+    )
+
+    await user.click(screen.getByRole("button", { name: /^deactivate$/i }))
+
+    expect(onDeactivate).toHaveBeenCalledWith(connectedMailgun)
+    expect(onClose).toHaveBeenCalledTimes(1)
+  })
+})
diff --git a/frontend/src/features/integrations/components/integration-provider-icon/integration-provider-icon.test.tsx b/frontend/src/features/integrations/components/integration-provider-icon/integration-provider-icon.test.tsx
new file mode 100644
index 00000000..beab79cf
--- /dev/null
+++ b/frontend/src/features/integrations/components/integration-provider-icon/integration-provider-icon.test.tsx
@@ -0,0 +1,16 @@
+import { render, screen } from "@testing-library/react"
+import { describe, expect, it } from "vitest"
+
+import { IntegrationProviderIcon } from "./integration-provider-icon"
+
+describe("IntegrationProviderIcon", () => {
+  it("renders emoji icon", () => {
+    render(<IntegrationProviderIcon icon="📧" name="Mailgun" className="size-12" />)
+    expect(screen.getByText("📧")).toBeInTheDocument()
+  })
+
+  it("renders image icon with alt text", () => {
+    render(<IntegrationProviderIcon icon="/providers/mailgun.svg" name="Mailgun" className="size-12" />)
+    expect(screen.getByRole("img", { name: "Mailgun logo" })).toHaveAttribute("src", "/providers/mailgun.svg")
+  })
+})
diff --git a/frontend/src/features/integrations/components/integration-row/integration-row.stories.tsx b/frontend/src/features/integrations/components/integration-row/integration-row.stories.tsx
new file mode 100644
index 00000000..407b05b6
--- /dev/null
+++ b/frontend/src/features/integrations/components/integration-row/integration-row.stories.tsx
@@ -0,0 +1,78 @@
+import type { Meta, StoryObj } from "@storybook/react-vite"
+
+import type { IntegrationViewModel } from "@/features/integrations/hooks/use-integrations.hook"
+import { IntegrationRow } from "./integration-row"
+
+const mailgunProvider: IntegrationViewModel = {
+  id: "mailgun",
+  name: "Mailgun",
+  description: "Reliable transactional email sending service.",
+  icon: "📧",
+  category: "email",
+  isAvailable: true,
+  isConnected: false,
+  isDeactivated: false,
+}
+
+const connectedProvider: IntegrationViewModel = {
+  ...mailgunProvider,
+  isConnected: true,
+}
+
+const deactivatedProvider: IntegrationViewModel = {
+  ...mailgunProvider,
+  isDeactivated: true,
+}
+
+const comingSoonProvider: IntegrationViewModel = {
+  ...mailgunProvider,
+  id: "twilio",
+  name: "Twilio",
+  isAvailable: false,
+  isComingSoon: true,
+}
+
+const meta = {
+  title: "Features/Integrations/IntegrationRow",
+  component: IntegrationRow,
+  parameters: { layout: "padded" },
+} satisfies Meta<typeof IntegrationRow>
+
+export default meta
+type Story = StoryObj<typeof meta>
+
+export const Connect: Story = {
+  args: {
+    provider: mailgunProvider,
+    onConnect: () => undefined,
+    onActivate: () => undefined,
+    onDisconnect: () => undefined,
+  },
+}
+
+export const Connected: Story = {
+  args: {
+    provider: connectedProvider,
+    onConnect: () => undefined,
+    onActivate: () => undefined,
+    onDisconnect: () => undefined,
+  },
+}
+
+export const Deactivated: Story = {
+  args: {
+    provider: deactivatedProvider,
+    onConnect: () => undefined,
+    onActivate: () => undefined,
+    onDisconnect: () => undefined,
+  },
+}
+
+export const ComingSoon: Story = {
+  args: {
+    provider: comingSoonProvider,
+    onConnect: () => undefined,
+    onActivate: () => undefined,
+    onDisconnect: () => undefined,
+  },
+}
diff --git a/frontend/src/features/integrations/components/integration-row/integration-row.test.tsx b/frontend/src/features/integrations/components/integration-row/integration-row.test.tsx
new file mode 100644
index 00000000..c21c5f29
--- /dev/null
+++ b/frontend/src/features/integrations/components/integration-row/integration-row.test.tsx
@@ -0,0 +1,69 @@
+import { render, screen } from "@testing-library/react"
+import userEvent from "@testing-library/user-event"
+import { describe, expect, it, vi } from "vitest"
+
+import type { IntegrationViewModel } from "@/features/integrations/hooks/use-integrations.hook"
+import { IntegrationRow } from "./integration-row"
+
+const mailgunProvider: IntegrationViewModel = {
+  id: "mailgun",
+  name: "Mailgun",
+  description: "Reliable transactional email sending service.",
+  icon: "📧",
+  category: "email",
+  isAvailable: true,
+  isConnected: false,
+  isDeactivated: false,
+}
+
+describe("IntegrationRow", () => {
+  it("shows connect action for available providers", async () => {
+    const user = userEvent.setup()
+    const onConnect = vi.fn()
+
+    render(
+      <IntegrationRow
+        provider={mailgunProvider}
+        onConnect={onConnect}
+        onActivate={vi.fn()}
+        onDisconnect={vi.fn()}
+      />,
+    )
+
+    await user.click(screen.getByRole("button", { name: /connect/i }))
+    expect(onConnect).toHaveBeenCalledWith(mailgunProvider)
+  })
+
+  it("shows disconnect action for connected providers", async () => {
+    const user = userEvent.setup()
+    const onDisconnect = vi.fn()
+    const connected = { ...mailgunProvider, isConnected: true }
+
+    render(
+      <IntegrationRow
+        provider={connected}
+        onConnect={vi.fn()}
+        onActivate={vi.fn()}
+        onDisconnect={onDisconnect}
+      />,
+    )
+
+    expect(screen.getByText("Connected")).toBeInTheDocument()
+    await user.click(screen.getByRole("button", { name: /disconnect/i }))
+    expect(onDisconnect).toHaveBeenCalledWith(connected)
+  })
+
+  it("shows coming soon badge for unavailable providers", () => {
+    render(
+      <IntegrationRow
+        provider={{ ...mailgunProvider, isAvailable: false, isComingSoon: true }}
+        onConnect={vi.fn()}
+        onActivate={vi.fn()}
+        onDisconnect={vi.fn()}
+      />,
+    )
+
+    expect(screen.getByText("Coming soon")).toBeInTheDocument()
+    expect(screen.queryByRole("button", { name: /connect/i })).not.toBeInTheDocument()
+  })
+})
diff --git a/frontend/src/features/settings/components/api-key-row/api-key-row.stories.tsx b/frontend/src/features/settings/components/api-key-row/api-key-row.stories.tsx
new file mode 100644
index 00000000..7dde6a7d
--- /dev/null
+++ b/frontend/src/features/settings/components/api-key-row/api-key-row.stories.tsx
@@ -0,0 +1,39 @@
+import type { Meta, StoryObj } from "@storybook/react-vite"
+
+import { ApiKeyRow } from "./api-key-row"
+
+const meta = {
+  title: "Features/Settings/ApiKeyRow",
+  component: ApiKeyRow,
+  parameters: { layout: "padded" },
+} satisfies Meta<typeof ApiKeyRow>
+
+export default meta
+type Story = StoryObj<typeof meta>
+
+const sampleKey = {
+  id: "key-1",
+  workspace_id: "00000000-0000-0000-0000-000000000001",
+  client_id: "demo-client-id-abcdefghijklmnop",
+  name: "Production",
+  is_active: true,
+  created_at: "2026-01-01T00:00:00Z",
+  last_used_at: null,
+}
+
+export const Default: Story = {
+  args: {
+    apiKey: sampleKey,
+    onRegenerate: () => undefined,
+    onDelete: () => undefined,
+  },
+}
+
+export const Busy: Story = {
+  args: {
+    apiKey: sampleKey,
+    isBusy: true,
+    onRegenerate: () => undefined,
+    onDelete: () => undefined,
+  },
+}
diff --git a/frontend/src/features/settings/components/api-key-row/api-key-row.test.tsx b/frontend/src/features/settings/components/api-key-row/api-key-row.test.tsx
new file mode 100644
index 00000000..cb8834c3
--- /dev/null
+++ b/frontend/src/features/settings/components/api-key-row/api-key-row.test.tsx
@@ -0,0 +1,40 @@
+import { render, screen } from "@testing-library/react"
+import userEvent from "@testing-library/user-event"
+import { describe, expect, it, vi } from "vitest"
+
+import { ApiKeyRow } from "./api-key-row"
+
+const sampleKey = {
+  id: "key-1",
+  workspace_id: "ws-1",
+  client_id: "demo-client-id-abcdefghijklmnop",
+  name: "Production",
+  is_active: true,
+  created_at: "2026-01-01T00:00:00Z",
+  last_used_at: null,
+}
+
+describe("ApiKeyRow", () => {
+  it("renders key details and action buttons", () => {
+    render(<ApiKeyRow apiKey={sampleKey} onRegenerate={vi.fn()} onDelete={vi.fn()} />)
+
+    expect(screen.getByText("Production")).toBeInTheDocument()
+    expect(screen.getByText(/Last used: Never/i)).toBeInTheDocument()
+    expect(screen.getByRole("button", { name: /regenerate/i })).toBeInTheDocument()
+    expect(screen.getByRole("button", { name: /delete/i })).toBeInTheDocument()
+  })
+
+  it("calls regenerate and delete handlers", async () => {
+    const user = userEvent.setup()
+    const onRegenerate = vi.fn()
+    const onDelete = vi.fn()
+
+    render(<ApiKeyRow apiKey={sampleKey} onRegenerate={onRegenerate} onDelete={onDelete} />)
+
+    await user.click(screen.getByRole("button", { name: /regenerate/i }))
+    await user.click(screen.getByRole("button", { name: /delete/i }))
+
+    expect(onRegenerate).toHaveBeenCalledWith("key-1")
+    expect(onDelete).toHaveBeenCalledWith("key-1")
+  })
+})
diff --git a/frontend/src/features/settings/components/api-key-secret-dialog/api-key-secret-dialog.test.tsx b/frontend/src/features/settings/components/api-key-secret-dialog/api-key-secret-dialog.test.tsx
new file mode 100644
index 00000000..249e500c
--- /dev/null
+++ b/frontend/src/features/settings/components/api-key-secret-dialog/api-key-secret-dialog.test.tsx
@@ -0,0 +1,48 @@
+import { render, screen } from "@testing-library/react"
+import userEvent from "@testing-library/user-event"
+import { describe, expect, it, vi } from "vitest"
+
+import { ApiKeySecretDialog } from "./api-key-secret-dialog"
+
+describe("ApiKeySecretDialog", () => {
+  it("renders client credentials and closes on done", async () => {
+    const user = userEvent.setup()
+    const onClose = vi.fn()
+
+    render(
+      <ApiKeySecretDialog
+        open
+        clientId="demo-client-id"
+        clientSecret="secret-value"
+        onClose={onClose}
+      />,
+    )
+
+    expect(screen.getByDisplayValue("demo-client-id")).toBeInTheDocument()
+    expect(screen.getByDisplayValue("secret-value")).toBeInTheDocument()
+
+    await user.click(screen.getByRole("button", { name: /done/i }))
+    expect(onClose).toHaveBeenCalledTimes(1)
+  })
+
+  it("copies client secret to clipboard", async () => {
+    const user = userEvent.setup()
+    const writeText = vi.fn().mockResolvedValue(undefined)
+    vi.spyOn(navigator.clipboard, "writeText").mockImplementation(writeText)
+
+    render(
+      <ApiKeySecretDialog
+        open
+        clientId="demo-client-id"
+        clientSecret="secret-value"
+        onClose={vi.fn()}
+      />,
+    )
+
+    const copyButtons = screen.getAllByRole("button", { name: /copy/i })
+    await user.click(copyButtons[1])
+
+    expect(writeText).toHaveBeenCalledWith("secret-value")
+    expect(screen.getByRole("button", { name: /copied/i })).toBeInTheDocument()
+  })
+})
diff --git a/frontend/src/features/settings/components/radio-option/radio-option.stories.tsx b/frontend/src/features/settings/components/radio-option/radio-option.stories.tsx
new file mode 100644
index 00000000..27bd4a61
--- /dev/null
+++ b/frontend/src/features/settings/components/radio-option/radio-option.stories.tsx
@@ -0,0 +1,50 @@
+import type { Meta, StoryObj } from "@storybook/react-vite"
+import { useState } from "react"
+
+import { RadioOption } from "./radio-option"
+
+const meta = {
+  title: "Features/Settings/RadioOption",
+  component: RadioOption,
+  parameters: { layout: "padded" },
+} satisfies Meta<typeof RadioOption>
+
+export default meta
+type Story = StoryObj<typeof meta>
+
+function RadioOptionDemo() {
+  const [checked, setChecked] = useState(true)
+  return (
+    <RadioOption
+      id="dispatch-memory"
+      name="dispatch-mode"
+      label="Memory"
+      description="Capture messages in memory for development and testing."
+      checked={checked}
+      onChange={() => setChecked((value) => !value)}
+    />
+  )
+}
+
+export const Selected: Story = {
+  render: () => <RadioOptionDemo />,
+  args: {
+    id: "dispatch-memory",
+    name: "dispatch-mode",
+    label: "Memory",
+    description: "Capture messages in memory for development and testing.",
+    checked: true,
+    onChange: () => undefined,
+  },
+}
+
+export const Unselected: Story = {
+  args: {
+    id: "dispatch-provider",
+    name: "dispatch-mode",
+    label: "Provider",
+    description: "Send messages through the connected channel integration.",
+    checked: false,
+    onChange: () => undefined,
+  },
+}
diff --git a/frontend/src/features/settings/components/radio-option/radio-option.test.tsx b/frontend/src/features/settings/components/radio-option/radio-option.test.tsx
new file mode 100644
index 00000000..a1758174
--- /dev/null
+++ b/frontend/src/features/settings/components/radio-option/radio-option.test.tsx
@@ -0,0 +1,43 @@
+import { render, screen } from "@testing-library/react"
+import userEvent from "@testing-library/user-event"
+import { describe, expect, it, vi } from "vitest"
+
+import { RadioOption } from "./radio-option"
+
+describe("RadioOption", () => {
+  it("renders label and description", () => {
+    render(
+      <RadioOption
+        id="dispatch-memory"
+        name="dispatch-mode"
+        label="Memory"
+        description="Capture messages in memory."
+        checked
+        onChange={vi.fn()}
+      />,
+    )
+
+    expect(screen.getByText("Memory")).toBeInTheDocument()
+    expect(screen.getByText("Capture messages in memory.")).toBeInTheDocument()
+    expect(screen.getByRole("radio")).toBeChecked()
+  })
+
+  it("calls onChange when selected", async () => {
+    const user = userEvent.setup()
+    const onChange = vi.fn()
+
+    render(
+      <RadioOption
+        id="dispatch-provider"
+        name="dispatch-mode"
+        label="Provider"
+        description="Send through provider."
+        checked={false}
+        onChange={onChange}
+      />,
+    )
+
+    await user.click(screen.getByRole("radio"))
+    expect(onChange).toHaveBeenCalledTimes(1)
+  })
+})
diff --git a/frontend/src/shared/components/app-footer/app-footer.stories.tsx b/frontend/src/shared/components/app-footer/app-footer.stories.tsx
new file mode 100644
index 00000000..3f6072ad
--- /dev/null
+++ b/frontend/src/shared/components/app-footer/app-footer.stories.tsx
@@ -0,0 +1,22 @@
+import type { Meta, StoryObj } from "@storybook/react-vite"
+
+import { AppFooter } from "./app-footer"
+
+const meta = {
+  title: "Shared/AppFooter",
+  component: AppFooter,
+  parameters: { layout: "fullscreen" },
+} satisfies Meta<typeof AppFooter>
+
+export default meta
+type Story = StoryObj<typeof meta>
+
+export const Default: Story = {
+  args: {},
+}
+
+export const Dashboard: Story = {
+  args: {
+    variant: "dashboard",
+  },
+}
diff --git a/frontend/src/shared/components/app-footer/app-footer.test.tsx b/frontend/src/shared/components/app-footer/app-footer.test.tsx
new file mode 100644
index 00000000..07d4cc8b
--- /dev/null
+++ b/frontend/src/shared/components/app-footer/app-footer.test.tsx
@@ -0,0 +1,19 @@
+import { render, screen } from "@testing-library/react"
+import { describe, expect, it } from "vitest"
+
+import { AppFooter } from "./app-footer"
+
+describe("AppFooter", () => {
+  it("renders attribution link", () => {
+    render(<AppFooter />)
+
+    const link = screen.getByRole("link", { name: "WeProDev" })
+    expect(link).toHaveAttribute("href", "https://weprodev.com")
+  })
+
+  it("applies dashboard link styling", () => {
+    render(<AppFooter variant="dashboard" />)
+
+    expect(screen.getByRole("link", { name: "WeProDev" })).toHaveClass("text-indigo-400")
+  })
+})
diff --git a/frontend/src/shared/components/app-footer.tsx b/frontend/src/shared/components/app-footer/app-footer.tsx
similarity index 100%
rename from frontend/src/shared/components/app-footer.tsx
rename to frontend/src/shared/components/app-footer/app-footer.tsx
diff --git a/frontend/src/shared/components/app-footer/index.ts b/frontend/src/shared/components/app-footer/index.ts
new file mode 100644
index 00000000..5bc775e5
--- /dev/null
+++ b/frontend/src/shared/components/app-footer/index.ts
@@ -0,0 +1 @@
+export { AppFooter } from "./app-footer"
diff --git a/frontend/src/shared/components/app-header/app-header.stories.tsx b/frontend/src/shared/components/app-header/app-header.stories.tsx
new file mode 100644
index 00000000..b80e7aea
--- /dev/null
+++ b/frontend/src/shared/components/app-header/app-header.stories.tsx
@@ -0,0 +1,27 @@
+import type { Meta, StoryObj } from "@storybook/react-vite"
+import { MemoryRouter } from "react-router-dom"
+
+import { ThemeProvider } from "@/shared/context/theme-context"
+import { AppHeader } from "./app-header"
+
+const meta = {
+  title: "Shared/AppHeader",
+  component: AppHeader,
+  parameters: { layout: "fullscreen" },
+  decorators: [
+    (Story) => (
+      <MemoryRouter>
+        <ThemeProvider>
+          <Story />
+        </ThemeProvider>
+      </MemoryRouter>
+    ),
+  ],
+} satisfies Meta<typeof AppHeader>
+
+export default meta
+type Story = StoryObj<typeof meta>
+
+export const Default: Story = {
+  args: {},
+}
diff --git a/frontend/src/shared/components/app-header/app-header.test.tsx b/frontend/src/shared/components/app-header/app-header.test.tsx
new file mode 100644
index 00000000..1de5f2aa
--- /dev/null
+++ b/frontend/src/shared/components/app-header/app-header.test.tsx
@@ -0,0 +1,49 @@
+import { render, screen } from "@testing-library/react"
+import userEvent from "@testing-library/user-event"
+import { describe, expect, it, vi } from "vitest"
+import { MemoryRouter } from "react-router-dom"
+
+import { AppHeader } from "./app-header"
+
+const { navigate, setToken } = vi.hoisted(() => ({
+  navigate: vi.fn(),
+  setToken: vi.fn(),
+}))
+
+vi.mock("react-router-dom", async () => {
+  const actual = await vi.importActual<typeof import("react-router-dom")>("react-router-dom")
+  return {
+    ...actual,
+    useNavigate: () => navigate,
+  }
+})
+
+vi.mock("@/core/api/client", () => ({
+  getToken: vi.fn(() => "portal-jwt"),
+  setToken,
+}))
+
+vi.mock("@/shared/context/theme-context", () => ({
+  useTheme: () => ({
+    theme: "light",
+    toggleTheme: vi.fn(),
+  }),
+}))
+
+describe("AppHeader", () => {
+  it("renders brand and sign out when authenticated", async () => {
+    const user = userEvent.setup()
+
+    render(
+      <MemoryRouter>
+        <AppHeader />
+      </MemoryRouter>,
+    )
+
+    expect(screen.getByText("Message Gateway")).toBeInTheDocument()
+    await user.click(screen.getByRole("button", { name: /sign out/i }))
+
+    expect(setToken).toHaveBeenCalledWith(null)
+    expect(navigate).toHaveBeenCalled()
+  })
+})
diff --git a/frontend/src/shared/components/app-header.tsx b/frontend/src/shared/components/app-header/app-header.tsx
similarity index 93%
rename from frontend/src/shared/components/app-header.tsx
rename to frontend/src/shared/components/app-header/app-header.tsx
index 3714e45d..7095879c 100644
--- a/frontend/src/shared/components/app-header.tsx
+++ b/frontend/src/shared/components/app-header/app-header.tsx
@@ -2,8 +2,8 @@ import { useNavigate } from "react-router-dom"
 import { getToken, setToken } from "@/core/api/client"
 import { ROUTES } from "@/core/router/routes"
 import { Icon } from "@/components/ui/icon"
-import { MessageGatewayLogo } from "./message-gateway-logo"
-import { ThemeToggle } from "./theme-toggle"
+import { MessageGatewayLogo } from "../message-gateway-logo"
+import { ThemeToggle } from "../theme-toggle"
 
 function BrandText() {
   return (
diff --git a/frontend/src/shared/components/app-header/index.ts b/frontend/src/shared/components/app-header/index.ts
new file mode 100644
index 00000000..fa53cb1a
--- /dev/null
+++ b/frontend/src/shared/components/app-header/index.ts
@@ -0,0 +1 @@
+export { AppHeader } from "./app-header"
diff --git a/frontend/src/shared/components/auth-card/auth-card.stories.tsx b/frontend/src/shared/components/auth-card/auth-card.stories.tsx
new file mode 100644
index 00000000..86b4776b
--- /dev/null
+++ b/frontend/src/shared/components/auth-card/auth-card.stories.tsx
@@ -0,0 +1,21 @@
+import type { Meta, StoryObj } from "@storybook/react-vite"
+
+import { AuthCard } from "./auth-card"
+
+const meta = {
+  title: "Shared/AuthCard",
+  component: AuthCard,
+  parameters: { layout: "centered" },
+} satisfies Meta<typeof AuthCard>
+
+export default meta
+type Story = StoryObj<typeof meta>
+
+export const Default: Story = {
+  render: (args) => (
+    <AuthCard {...args}>
+      <h2 className="text-lg font-semibold text-foreground">Sign in</h2>
+      <p className="mt-2 text-sm text-text-secondary">Use your portal credentials.</p>
+    </AuthCard>
+  ),
+}
diff --git a/frontend/src/shared/components/auth-card/auth-card.test.tsx b/frontend/src/shared/components/auth-card/auth-card.test.tsx
new file mode 100644
index 00000000..18b755f1
--- /dev/null
+++ b/frontend/src/shared/components/auth-card/auth-card.test.tsx
@@ -0,0 +1,16 @@
+import { render, screen } from "@testing-library/react"
+import { describe, expect, it } from "vitest"
+
+import { AuthCard } from "./auth-card"
+
+describe("AuthCard", () => {
+  it("renders children inside the card container", () => {
+    render(
+      <AuthCard>
+        <p>Portal login</p>
+      </AuthCard>,
+    )
+
+    expect(screen.getByText("Portal login")).toBeInTheDocument()
+  })
+})
diff --git a/frontend/src/shared/components/auth-card.tsx b/frontend/src/shared/components/auth-card/auth-card.tsx
similarity index 100%
rename from frontend/src/shared/components/auth-card.tsx
rename to frontend/src/shared/components/auth-card/auth-card.tsx
diff --git a/frontend/src/shared/components/auth-card/index.ts b/frontend/src/shared/components/auth-card/index.ts
new file mode 100644
index 00000000..3c0caff1
--- /dev/null
+++ b/frontend/src/shared/components/auth-card/index.ts
@@ -0,0 +1 @@
+export { AuthCard } from "./auth-card"
diff --git a/frontend/src/shared/components/message-gateway-logo/index.ts b/frontend/src/shared/components/message-gateway-logo/index.ts
new file mode 100644
index 00000000..0ff7b3a6
--- /dev/null
+++ b/frontend/src/shared/components/message-gateway-logo/index.ts
@@ -0,0 +1 @@
+export { MessageGatewayLogo } from "./message-gateway-logo"
diff --git a/frontend/src/shared/components/message-gateway-logo/message-gateway-logo.stories.tsx b/frontend/src/shared/components/message-gateway-logo/message-gateway-logo.stories.tsx
new file mode 100644
index 00000000..33753fba
--- /dev/null
+++ b/frontend/src/shared/components/message-gateway-logo/message-gateway-logo.stories.tsx
@@ -0,0 +1,16 @@
+import type { Meta, StoryObj } from "@storybook/react-vite"
+
+import { MessageGatewayLogo } from "./message-gateway-logo"
+
+const meta = {
+  title: "Shared/MessageGatewayLogo",
+  component: MessageGatewayLogo,
+  parameters: { layout: "centered" },
+} satisfies Meta<typeof MessageGatewayLogo>
+
+export default meta
+type Story = StoryObj<typeof meta>
+
+export const Default: Story = {
+  args: {},
+}
diff --git a/frontend/src/shared/components/message-gateway-logo/message-gateway-logo.test.tsx b/frontend/src/shared/components/message-gateway-logo/message-gateway-logo.test.tsx
new file mode 100644
index 00000000..7cd13ae8
--- /dev/null
+++ b/frontend/src/shared/components/message-gateway-logo/message-gateway-logo.test.tsx
@@ -0,0 +1,11 @@
+import { render } from "@testing-library/react"
+import { describe, expect, it } from "vitest"
+
+import { MessageGatewayLogo } from "./message-gateway-logo"
+
+describe("MessageGatewayLogo", () => {
+  it("renders decorative logo markup", () => {
+    const { container } = render(<MessageGatewayLogo />)
+    expect(container.querySelector('[aria-hidden="true"]')).toBeInTheDocument()
+  })
+})
diff --git a/frontend/src/shared/components/message-gateway-logo.tsx b/frontend/src/shared/components/message-gateway-logo/message-gateway-logo.tsx
similarity index 100%
rename from frontend/src/shared/components/message-gateway-logo.tsx
rename to frontend/src/shared/components/message-gateway-logo/message-gateway-logo.tsx
diff --git a/frontend/src/shared/components/page-header/index.ts b/frontend/src/shared/components/page-header/index.ts
new file mode 100644
index 00000000..48f3bfa2
--- /dev/null
+++ b/frontend/src/shared/components/page-header/index.ts
@@ -0,0 +1 @@
+export { PageHeader } from "./page-header"
diff --git a/frontend/src/shared/components/page-header/page-header.stories.tsx b/frontend/src/shared/components/page-header/page-header.stories.tsx
new file mode 100644
index 00000000..713227a4
--- /dev/null
+++ b/frontend/src/shared/components/page-header/page-header.stories.tsx
@@ -0,0 +1,25 @@
+import type { Meta, StoryObj } from "@storybook/react-vite"
+
+import { PageHeader } from "./page-header"
+
+const meta = {
+  title: "Shared/PageHeader",
+  component: PageHeader,
+  parameters: { layout: "padded" },
+} satisfies Meta<typeof PageHeader>
+
+export default meta
+type Story = StoryObj<typeof meta>
+
+export const WithDescription: Story = {
+  args: {
+    title: "Settings",
+    description: "Manage your workspace settings and preferences.",
+  },
+}
+
+export const TitleOnly: Story = {
+  args: {
+    title: "Overview",
+  },
+}
diff --git a/frontend/src/shared/components/page-header/page-header.test.tsx b/frontend/src/shared/components/page-header/page-header.test.tsx
new file mode 100644
index 00000000..0cee8d7d
--- /dev/null
+++ b/frontend/src/shared/components/page-header/page-header.test.tsx
@@ -0,0 +1,13 @@
+import { render, screen } from "@testing-library/react"
+import { describe, expect, it } from "vitest"
+
+import { PageHeader } from "./page-header"
+
+describe("PageHeader", () => {
+  it("renders title and optional description", () => {
+    render(<PageHeader title="Settings" description="Manage workspace settings." />)
+
+    expect(screen.getByRole("heading", { name: "Settings" })).toBeInTheDocument()
+    expect(screen.getByText("Manage workspace settings.")).toBeInTheDocument()
+  })
+})
diff --git a/frontend/src/shared/components/page-header.tsx b/frontend/src/shared/components/page-header/page-header.tsx
similarity index 100%
rename from frontend/src/shared/components/page-header.tsx
rename to frontend/src/shared/components/page-header/page-header.tsx
diff --git a/frontend/src/shared/components/theme-toggle/index.ts b/frontend/src/shared/components/theme-toggle/index.ts
new file mode 100644
index 00000000..28635163
--- /dev/null
+++ b/frontend/src/shared/components/theme-toggle/index.ts
@@ -0,0 +1 @@
+export { ThemeToggle } from "./theme-toggle"
diff --git a/frontend/src/shared/components/theme-toggle/theme-toggle.stories.tsx b/frontend/src/shared/components/theme-toggle/theme-toggle.stories.tsx
new file mode 100644
index 00000000..1b46992c
--- /dev/null
+++ b/frontend/src/shared/components/theme-toggle/theme-toggle.stories.tsx
@@ -0,0 +1,24 @@
+import type { Meta, StoryObj } from "@storybook/react-vite"
+
+import { ThemeProvider } from "@/shared/context/theme-context"
+import { ThemeToggle } from "./theme-toggle"
+
+const meta = {
+  title: "Shared/ThemeToggle",
+  component: ThemeToggle,
+  parameters: { layout: "centered" },
+  decorators: [
+    (Story) => (
+      <ThemeProvider>
+        <Story />
+      </ThemeProvider>
+    ),
+  ],
+} satisfies Meta<typeof ThemeToggle>
+
+export default meta
+type Story = StoryObj<typeof meta>
+
+export const Default: Story = {
+  args: {},
+}
diff --git a/frontend/src/shared/components/theme-toggle/theme-toggle.test.tsx b/frontend/src/shared/components/theme-toggle/theme-toggle.test.tsx
new file mode 100644
index 00000000..c4ad6bd3
--- /dev/null
+++ b/frontend/src/shared/components/theme-toggle/theme-toggle.test.tsx
@@ -0,0 +1,27 @@
+import { render, screen } from "@testing-library/react"
+import userEvent from "@testing-library/user-event"
+import { describe, expect, it, vi } from "vitest"
+
+import { ThemeToggle } from "./theme-toggle"
+
+const { toggleTheme } = vi.hoisted(() => ({
+  toggleTheme: vi.fn(),
+}))
+
+vi.mock("@/shared/context/theme-context", () => ({
+  useTheme: () => ({
+    theme: "light",
+    toggleTheme,
+  }),
+}))
+
+describe("ThemeToggle", () => {
+  it("calls toggleTheme when clicked", async () => {
+    const user = userEvent.setup()
+
+    render(<ThemeToggle />)
+
+    await user.click(screen.getByRole("button", { name: /toggle theme/i }))
+    expect(toggleTheme).toHaveBeenCalledTimes(1)
+  })
+})
diff --git a/frontend/src/shared/components/theme-toggle.tsx b/frontend/src/shared/components/theme-toggle/theme-toggle.tsx
similarity index 100%
rename from frontend/src/shared/components/theme-toggle.tsx
rename to frontend/src/shared/components/theme-toggle/theme-toggle.tsx

From 7dabe3aee07877a74f018578f057e1ee4bad439a Mon Sep 17 00:00:00 2001
From: MichaelAndish <maikel1370@gmail.com>
Date: Sat, 4 Jul 2026 20:08:21 +0200
Subject: [PATCH 13/20] feat: update roles and permissions handling in database
 and frontend

- Changed default guard name for roles and permissions from 'web' to 'msg_web' to align with the new messaging gateway structure.
- Enhanced database migration scripts to include new indices for invitations and provider config fields, improving query performance.
- Added tests for workspace API keys and email inbox functionalities to ensure robust integration and error handling.
- Refactored inbox-related components and hooks to utilize updated API structures, enhancing user experience and data management.

This commit improves the overall handling of roles and permissions while ensuring the frontend and backend are synchronized with the latest changes.
---
 .../20260318000000_init_gateway.up.sql        |  10 +-
 database/seeds/001_seed_permissions.sql       |  32 +--
 .../src/core/api/workspace-api-keys.test.ts   |  64 +++++
 frontend/src/core/api/workspace-api-keys.ts   |  24 ++
 .../features/auth/pages/login.page.test.tsx   |  44 ++++
 .../auth/pages/register.page.test.tsx         |  45 ++++
 .../get-started-dialog.test.tsx               |   2 +-
 .../src/features/inbox/get-started.api.ts     |  20 +-
 .../inbox/hooks/use-inbox-emails.hook.test.ts |  97 ++++++++
 frontend/src/features/inbox/inbox.types.ts    |   1 +
 .../features/inbox/log-display.utils.test.ts  |  46 ++++
 .../inbox/pages/email-inbox.page.test.tsx     | 103 ++++++++
 .../inbox/pages/email-templates.page.test.tsx |  63 +++++
 .../inbox/pages/overview.page.test.tsx        |  66 ++++++
 .../connect-modal/connect-modal.tsx           |  45 +---
 .../disconnect-modal/disconnect-modal.tsx     |   2 +-
 .../integration-row.stories.tsx               |   2 +-
 .../integration-row/integration-row.test.tsx  |   2 +-
 .../integration-row/integration-row.tsx       |   2 +-
 .../hooks/use-integrations.hook.ts            |  14 +-
 .../use-provider-config-fields.hook.test.ts   |  54 +++++
 .../hooks/use-provider-config-fields.hook.ts  |  57 +++++
 .../integrations/integrations.types.ts        |  13 +
 .../pages/integrations.page.test.tsx          |  59 +++++
 .../integrations/pages/integrations.page.tsx  |   3 +-
 .../settings/pages/settings.page.test.tsx     |  74 ++++++
 .../src/features/settings/settings.api.ts     |   7 +-
 .../features/settings/settings.schema.test.ts |  31 +++
 .../workspaces/pages/workspaces.page.test.tsx |  59 +++++
 .../auth-card/auth-card.stories.tsx           |  14 +-
 frontend/vite.config.ts                       |   1 +
 internal/app/wire.go                          |   5 +-
 internal/core/domain/permission.go            |   3 +
 internal/core/logctx/logctx.go                |  62 +++++
 internal/core/logctx/logctx_test.go           |  41 ++++
 internal/core/port/inbox.go                   |  24 ++
 internal/core/service/auth_service_test.go    | 164 +++++++++++++
 internal/core/service/gateway_service.go      |   4 +-
 .../service/gateway_service_channels_test.go  |  93 ++++++++
 internal/core/service/portal_service.go       |  13 +
 .../service/portal_service_extended_test.go   | 196 +++++++++++++++
 internal/core/service/portal_service_test.go  |  21 +-
 .../authgate/gate_adapter_test.go             |  71 ++++++
 internal/infrastructure/inbox/store.go        |  61 ++++-
 .../inbox/store_pagination_test.go            |  85 +++++++
 internal/infrastructure/logger/logger.go      |  63 ++---
 .../postgres/api_key_repository_test.go       |  72 ++++++
 .../postgres/invitation_repository.go         |  20 +-
 .../postgres/invitation_repository_test.go    |  67 ++++++
 .../message_request_log_repository.go         |  25 +-
 .../message_request_log_repository_test.go    |  15 +-
 .../repository/postgres/role_lookup.go        |  26 ++
 .../repository/postgres/role_lookup_test.go   |  32 +++
 .../postgres/sqlmock_client_test.go           |  21 ++
 .../postgres/template_repository_test.go      |  73 ++++++
 .../postgres/workspace_member_repository.go   |   7 +-
 .../workspace_member_repository_test.go       |  72 ++++++
 .../postgres/workspace_repository_test.go     |  67 ++++++
 internal/presentation/dto/workspace.go        |  11 -
 .../handler/portal_auth_handler_test.go       |  94 ++++++++
 .../handler/portal_handler_test.go            | 224 ++++++++++++++++++
 .../handler/portal_inbox_handler.go           |  15 +-
 .../handler/portal_inbox_handler_test.go      | 147 ++++++++++++
 .../handler/portal_workspace_handler.go       |   3 +-
 .../handler/portal_workspace_handler_test.go  |  96 ++++++++
 internal/presentation/handler/send_helper.go  |  10 +-
 .../presentation/handler/send_helper_test.go  |   4 +-
 internal/presentation/middleware/auth.go      |   4 +-
 internal/presentation/middleware/rbac_test.go |   8 +-
 internal/presentation/router.go               |  32 +--
 internal/presentation/router_test.go          |  59 +++++
 pkg/README.md                                 | 170 ++++++-------
 pkg/import_boundary_test.go                   |  45 ++++
 pkg/provider/mailgun/mailgun_test.go          | 123 ++++++++++
 74 files changed, 3190 insertions(+), 314 deletions(-)
 create mode 100644 frontend/src/core/api/workspace-api-keys.test.ts
 create mode 100644 frontend/src/core/api/workspace-api-keys.ts
 create mode 100644 frontend/src/features/auth/pages/login.page.test.tsx
 create mode 100644 frontend/src/features/auth/pages/register.page.test.tsx
 create mode 100644 frontend/src/features/inbox/hooks/use-inbox-emails.hook.test.ts
 create mode 100644 frontend/src/features/inbox/log-display.utils.test.ts
 create mode 100644 frontend/src/features/inbox/pages/email-inbox.page.test.tsx
 create mode 100644 frontend/src/features/inbox/pages/email-templates.page.test.tsx
 create mode 100644 frontend/src/features/inbox/pages/overview.page.test.tsx
 create mode 100644 frontend/src/features/integrations/hooks/use-provider-config-fields.hook.test.ts
 create mode 100644 frontend/src/features/integrations/hooks/use-provider-config-fields.hook.ts
 create mode 100644 frontend/src/features/integrations/pages/integrations.page.test.tsx
 create mode 100644 frontend/src/features/settings/pages/settings.page.test.tsx
 create mode 100644 frontend/src/features/settings/settings.schema.test.ts
 create mode 100644 frontend/src/features/workspaces/pages/workspaces.page.test.tsx
 create mode 100644 internal/core/logctx/logctx.go
 create mode 100644 internal/core/logctx/logctx_test.go
 create mode 100644 internal/core/service/auth_service_test.go
 create mode 100644 internal/core/service/gateway_service_channels_test.go
 create mode 100644 internal/core/service/portal_service_extended_test.go
 create mode 100644 internal/infrastructure/authgate/gate_adapter_test.go
 create mode 100644 internal/infrastructure/inbox/store_pagination_test.go
 create mode 100644 internal/infrastructure/repository/postgres/api_key_repository_test.go
 create mode 100644 internal/infrastructure/repository/postgres/invitation_repository_test.go
 create mode 100644 internal/infrastructure/repository/postgres/role_lookup.go
 create mode 100644 internal/infrastructure/repository/postgres/role_lookup_test.go
 create mode 100644 internal/infrastructure/repository/postgres/sqlmock_client_test.go
 create mode 100644 internal/infrastructure/repository/postgres/template_repository_test.go
 create mode 100644 internal/infrastructure/repository/postgres/workspace_member_repository_test.go
 create mode 100644 internal/infrastructure/repository/postgres/workspace_repository_test.go
 create mode 100644 internal/presentation/handler/portal_auth_handler_test.go
 create mode 100644 internal/presentation/handler/portal_handler_test.go
 create mode 100644 internal/presentation/handler/portal_inbox_handler_test.go
 create mode 100644 internal/presentation/handler/portal_workspace_handler_test.go
 create mode 100644 internal/presentation/router_test.go
 create mode 100644 pkg/import_boundary_test.go
 create mode 100644 pkg/provider/mailgun/mailgun_test.go

diff --git a/database/migrations/20260318000000_init_gateway.up.sql b/database/migrations/20260318000000_init_gateway.up.sql
index acabc0aa..07207d64 100644
--- a/database/migrations/20260318000000_init_gateway.up.sql
+++ b/database/migrations/20260318000000_init_gateway.up.sql
@@ -73,7 +73,7 @@ CREATE INDEX idx_workspaces_active_list
 CREATE TABLE roles (
     id           UUID        PRIMARY KEY DEFAULT gen_random_uuid(),
     name         TEXT        NOT NULL,
-    guard_name   TEXT        NOT NULL DEFAULT 'web',
+    guard_name   TEXT        NOT NULL DEFAULT 'msg_web',
     display_name TEXT,
     created_at   TIMESTAMPTZ NOT NULL DEFAULT NOW(),
     updated_at   TIMESTAMPTZ NOT NULL DEFAULT NOW(),
@@ -126,7 +126,9 @@ CREATE UNIQUE INDEX idx_invitations_pending_per_workspace_email
 
 CREATE INDEX idx_invitations_workspace_id ON invitations(workspace_id);
 CREATE INDEX idx_invitations_token_hash   ON invitations(token_hash);
-CREATE INDEX idx_invitations_role_id       ON invitations(role_id);
+CREATE INDEX idx_invitations_workspace_pending
+    ON invitations (workspace_id, status, expires_at)
+    WHERE status = 'pending';
 
 -- ==============================================================================
 -- 6. WORKSPACE_CHANNELS TABLE
@@ -189,6 +191,8 @@ CREATE TRIGGER trg_provider_config_fields_set_updated_at
     BEFORE UPDATE ON provider_config_fields
     FOR EACH ROW EXECUTE FUNCTION set_updated_at();
 
+CREATE INDEX idx_provider_config_fields_provider_id ON provider_config_fields(provider_id);
+
 -- ==============================================================================
 -- 9. INTEGRATIONS TABLE (Workspace ↔ Provider Credentials)
 -- ==============================================================================
@@ -395,7 +399,7 @@ CREATE INDEX idx_workspace_access_audits_actor_user_id
 CREATE TABLE permissions (
     id           UUID        PRIMARY KEY DEFAULT gen_random_uuid(),
     name         TEXT        NOT NULL,
-    guard_name   TEXT        NOT NULL DEFAULT 'web',
+    guard_name   TEXT        NOT NULL DEFAULT 'msg_web',
     created_at   TIMESTAMPTZ NOT NULL DEFAULT NOW(),
     updated_at   TIMESTAMPTZ NOT NULL DEFAULT NOW(),
 
diff --git a/database/seeds/001_seed_permissions.sql b/database/seeds/001_seed_permissions.sql
index 27b1beb4..69332f18 100644
--- a/database/seeds/001_seed_permissions.sql
+++ b/database/seeds/001_seed_permissions.sql
@@ -10,22 +10,22 @@ ON CONFLICT (name, guard_name) DO NOTHING;
 -- 2. Insert permissions
 INSERT INTO permissions (id, name, guard_name)
 VALUES
-    (gen_random_uuid(), 'workspaces.read', 'web'),
-    (gen_random_uuid(), 'workspaces.write', 'web'),
-    (gen_random_uuid(), 'members.read', 'web'),
-    (gen_random_uuid(), 'members.write', 'web'),
-    (gen_random_uuid(), 'apikeys.read', 'web'),
-    (gen_random_uuid(), 'apikeys.write', 'web'),
-    (gen_random_uuid(), 'logs.read', 'web'),
-    (gen_random_uuid(), 'integrations.read', 'web'),
-    (gen_random_uuid(), 'integrations.write', 'web'),
-    (gen_random_uuid(), 'templates.read', 'web'),
-    (gen_random_uuid(), 'templates.write', 'web'),
-    (gen_random_uuid(), 'settings.read', 'web'),
-    (gen_random_uuid(), 'settings.write', 'web'),
-    (gen_random_uuid(), 'invitations.read', 'web'),
-    (gen_random_uuid(), 'invitations.write', 'web'),
-    (gen_random_uuid(), 'inbox.write', 'web')
+    (gen_random_uuid(), 'workspaces.read', 'msg_web'),
+    (gen_random_uuid(), 'workspaces.write', 'msg_web'),
+    (gen_random_uuid(), 'members.read', 'msg_web'),
+    (gen_random_uuid(), 'members.write', 'msg_web'),
+    (gen_random_uuid(), 'apikeys.read', 'msg_web'),
+    (gen_random_uuid(), 'apikeys.write', 'msg_web'),
+    (gen_random_uuid(), 'logs.read', 'msg_web'),
+    (gen_random_uuid(), 'integrations.read', 'msg_web'),
+    (gen_random_uuid(), 'integrations.write', 'msg_web'),
+    (gen_random_uuid(), 'templates.read', 'msg_web'),
+    (gen_random_uuid(), 'templates.write', 'msg_web'),
+    (gen_random_uuid(), 'settings.read', 'msg_web'),
+    (gen_random_uuid(), 'settings.write', 'msg_web'),
+    (gen_random_uuid(), 'invitations.read', 'msg_web'),
+    (gen_random_uuid(), 'invitations.write', 'msg_web'),
+    (gen_random_uuid(), 'inbox.write', 'msg_web')
 ON CONFLICT (name, guard_name) DO NOTHING;
 
 -- 3. Bind permissions to 'admin' role
diff --git a/frontend/src/core/api/workspace-api-keys.test.ts b/frontend/src/core/api/workspace-api-keys.test.ts
new file mode 100644
index 00000000..e033d7dd
--- /dev/null
+++ b/frontend/src/core/api/workspace-api-keys.test.ts
@@ -0,0 +1,64 @@
+import { describe, expect, it, vi } from "vitest"
+
+vi.mock("@/core/api/client", () => ({
+  apiFetch: vi.fn(),
+}))
+
+import { apiFetch } from "@/core/api/client"
+
+import {
+  activeWorkspaceApiKeys,
+  fetchWorkspaceApiKeys,
+  type WorkspaceApiKey,
+} from "./workspace-api-keys"
+
+const mockedApiFetch = vi.mocked(apiFetch)
+
+const sampleKeys: WorkspaceApiKey[] = [
+  {
+    id: "key-1",
+    workspace_id: "ws-1",
+    client_id: "client-active",
+    name: "Active key",
+    is_active: true,
+    created_at: "2026-01-01T00:00:00Z",
+  },
+  {
+    id: "key-2",
+    workspace_id: "ws-1",
+    client_id: "client-inactive",
+    name: "Inactive key",
+    is_active: false,
+    created_at: "2026-01-02T00:00:00Z",
+  },
+]
+
+describe("activeWorkspaceApiKeys", () => {
+  it("filters out inactive keys", () => {
+    const result = activeWorkspaceApiKeys(sampleKeys)
+
+    expect(result).toHaveLength(1)
+    expect(result[0]?.name).toBe("Active key")
+    expect(result.every((key) => key.is_active)).toBe(true)
+  })
+})
+
+describe("fetchWorkspaceApiKeys", () => {
+  it("returns keys from the API", async () => {
+    mockedApiFetch.mockResolvedValue({
+      ok: true,
+      json: async () => sampleKeys,
+    } as Response)
+
+    const result = await fetchWorkspaceApiKeys("ws-1")
+
+    expect(mockedApiFetch).toHaveBeenCalledWith("/api/v1/workspaces/ws-1/api-keys")
+    expect(result).toEqual(sampleKeys)
+  })
+
+  it("throws when the API response is not ok", async () => {
+    mockedApiFetch.mockResolvedValue({ ok: false } as Response)
+
+    await expect(fetchWorkspaceApiKeys("ws-1")).rejects.toThrow("Failed to load API keys")
+  })
+})
diff --git a/frontend/src/core/api/workspace-api-keys.ts b/frontend/src/core/api/workspace-api-keys.ts
new file mode 100644
index 00000000..408a33f2
--- /dev/null
+++ b/frontend/src/core/api/workspace-api-keys.ts
@@ -0,0 +1,24 @@
+import { apiFetch } from "@/core/api/client"
+
+export interface WorkspaceApiKey {
+  id: string
+  workspace_id: string
+  client_id: string
+  name: string
+  is_active: boolean
+  last_used_at?: string | null
+  created_at: string
+  expires_at?: string | null
+}
+
+export async function fetchWorkspaceApiKeys(workspaceId: string): Promise<WorkspaceApiKey[]> {
+  const res = await apiFetch(`/api/v1/workspaces/${workspaceId}/api-keys`)
+  if (!res.ok) {
+    throw new Error("Failed to load API keys")
+  }
+  return (await res.json()) as WorkspaceApiKey[]
+}
+
+export function activeWorkspaceApiKeys(keys: WorkspaceApiKey[]): WorkspaceApiKey[] {
+  return keys.filter((key) => key.is_active)
+}
diff --git a/frontend/src/features/auth/pages/login.page.test.tsx b/frontend/src/features/auth/pages/login.page.test.tsx
new file mode 100644
index 00000000..93725813
--- /dev/null
+++ b/frontend/src/features/auth/pages/login.page.test.tsx
@@ -0,0 +1,44 @@
+import { render, screen } from "@testing-library/react"
+import userEvent from "@testing-library/user-event"
+import { MemoryRouter } from "react-router-dom"
+import { describe, expect, it, vi } from "vitest"
+
+import { signInWithPassword } from "../auth.api"
+import { LoginPage } from "./login.page"
+
+vi.mock("../auth.api", () => ({
+  signInWithPassword: vi.fn(),
+}))
+
+const mockedSignIn = vi.mocked(signInWithPassword)
+
+describe("LoginPage", () => {
+  it("renders sign-in form", () => {
+    render(
+      <MemoryRouter>
+        <LoginPage />
+      </MemoryRouter>,
+    )
+
+    expect(screen.getByRole("heading", { name: /sign in/i })).toBeInTheDocument()
+    expect(screen.getByLabelText(/email address/i)).toBeInTheDocument()
+    expect(screen.getByLabelText(/^password$/i)).toBeInTheDocument()
+  })
+
+  it("shows API error on failed login", async () => {
+    mockedSignIn.mockResolvedValue({ ok: false, message: "Invalid credentials" })
+
+    render(
+      <MemoryRouter>
+        <LoginPage />
+      </MemoryRouter>,
+    )
+
+    const user = userEvent.setup()
+    await user.type(screen.getByLabelText(/email address/i), "user@example.com")
+    await user.type(screen.getByLabelText(/^password$/i), "wrong")
+    await user.click(screen.getByRole("button", { name: /^login$/i }))
+
+    expect(await screen.findByText("Invalid credentials")).toBeInTheDocument()
+  })
+})
diff --git a/frontend/src/features/auth/pages/register.page.test.tsx b/frontend/src/features/auth/pages/register.page.test.tsx
new file mode 100644
index 00000000..24a41ee8
--- /dev/null
+++ b/frontend/src/features/auth/pages/register.page.test.tsx
@@ -0,0 +1,45 @@
+import { render, screen } from "@testing-library/react"
+import userEvent from "@testing-library/user-event"
+import { MemoryRouter } from "react-router-dom"
+import { describe, expect, it, vi } from "vitest"
+
+import { registerAccount } from "../auth.api"
+import { RegisterPage } from "./register.page"
+
+vi.mock("../auth.api", () => ({
+  registerAccount: vi.fn(),
+}))
+
+const mockedRegister = vi.mocked(registerAccount)
+
+describe("RegisterPage", () => {
+  it("renders sign-up form", () => {
+    render(
+      <MemoryRouter>
+        <RegisterPage />
+      </MemoryRouter>,
+    )
+
+    expect(screen.getByRole("heading", { name: /sign up/i })).toBeInTheDocument()
+    expect(screen.getByLabelText(/full name/i)).toBeInTheDocument()
+    expect(screen.getByLabelText(/email address/i)).toBeInTheDocument()
+  })
+
+  it("shows API error on failed registration", async () => {
+    mockedRegister.mockResolvedValue({ ok: false, message: "Email already taken" })
+
+    render(
+      <MemoryRouter>
+        <RegisterPage />
+      </MemoryRouter>,
+    )
+
+    const user = userEvent.setup()
+    await user.type(screen.getByLabelText(/full name/i), "Demo User")
+    await user.type(screen.getByLabelText(/email address/i), "user@example.com")
+    await user.type(screen.getByLabelText(/^password$/i), "secret123456")
+    await user.click(screen.getByRole("button", { name: /sign up/i }))
+
+    expect(await screen.findByText("Email already taken")).toBeInTheDocument()
+  })
+})
diff --git a/frontend/src/features/inbox/components/get-started-dialog/get-started-dialog.test.tsx b/frontend/src/features/inbox/components/get-started-dialog/get-started-dialog.test.tsx
index 943586f2..dde552c4 100644
--- a/frontend/src/features/inbox/components/get-started-dialog/get-started-dialog.test.tsx
+++ b/frontend/src/features/inbox/components/get-started-dialog/get-started-dialog.test.tsx
@@ -16,7 +16,7 @@ describe("GetStartedDialog", () => {
     mockedUseGetStartedContext.mockReturnValue({
       context: {
         workspaceId: "00000000-0000-0000-0000-000000000001",
-        apiKeys: [{ client_id: "demo-client-id" }],
+        apiKeys: [{ client_id: "demo-client-id", name: "Demo", is_active: true }],
       },
       isLoading: false,
       error: null,
diff --git a/frontend/src/features/inbox/get-started.api.ts b/frontend/src/features/inbox/get-started.api.ts
index 24802909..936a6da0 100644
--- a/frontend/src/features/inbox/get-started.api.ts
+++ b/frontend/src/features/inbox/get-started.api.ts
@@ -1,31 +1,21 @@
-import { apiFetch } from "@/core/api/client"
-
-export interface GetStartedApiKey {
-  client_id: string
-  name: string
-  is_active: boolean
-}
+import { activeWorkspaceApiKeys, fetchWorkspaceApiKeys } from "@/core/api/workspace-api-keys"
+import type { WorkspaceApiKey } from "@/core/api/workspace-api-keys"
 
 export interface GetStartedContext {
   workspaceId: string
-  apiKeys: GetStartedApiKey[]
+  apiKeys: Array<Pick<WorkspaceApiKey, "client_id" | "name" | "is_active">>
 }
 
 export async function fetchGetStartedContext(
   workspaceId: string,
 ): Promise<{ ok: true; context: GetStartedContext } | { ok: false; message?: string }> {
   try {
-    const keysRes = await apiFetch(`/api/v1/workspaces/${workspaceId}/api-keys`)
-    if (!keysRes.ok) {
-      return { ok: false, message: "Failed to load API keys" }
-    }
-
-    const apiKeys = (await keysRes.json()) as GetStartedApiKey[]
+    const apiKeys = activeWorkspaceApiKeys(await fetchWorkspaceApiKeys(workspaceId))
     return {
       ok: true,
       context: {
         workspaceId,
-        apiKeys: apiKeys.filter((key) => key.is_active),
+        apiKeys,
       },
     }
   } catch (err) {
diff --git a/frontend/src/features/inbox/hooks/use-inbox-emails.hook.test.ts b/frontend/src/features/inbox/hooks/use-inbox-emails.hook.test.ts
new file mode 100644
index 00000000..ba056cc8
--- /dev/null
+++ b/frontend/src/features/inbox/hooks/use-inbox-emails.hook.test.ts
@@ -0,0 +1,97 @@
+import { act, renderHook, waitFor } from "@testing-library/react"
+import { describe, expect, it, vi } from "vitest"
+
+import { fetchInboxEmails } from "../inbox.api"
+import { useInboxEmails } from "./use-inbox-emails.hook"
+
+vi.mock("../inbox.api", () => ({
+  fetchInboxEmails: vi.fn(),
+}))
+
+const mockedFetchInboxEmails = vi.mocked(fetchInboxEmails)
+
+const sampleEmail = {
+  id: "email-1",
+  workspace_id: "ws-1",
+  channel: "email",
+  status: "delivered",
+  created_at: "2026-01-01T00:00:00Z",
+  email: {
+    to: ["a@b.com"],
+    subject: "Hello",
+    html: "<p>hi</p>",
+  },
+}
+
+describe("useInboxEmails", () => {
+  it("loads emails for a workspace", async () => {
+    mockedFetchInboxEmails.mockResolvedValue({
+      ok: true,
+      page: { items: [sampleEmail], has_more: false, next_cursor: undefined },
+    })
+
+    const { result } = renderHook(() => useInboxEmails("ws-1"))
+
+    await waitFor(() => {
+      expect(result.current.isLoading).toBe(false)
+    })
+
+    expect(mockedFetchInboxEmails).toHaveBeenCalledWith("ws-1", { limit: 50 })
+    expect(result.current.messages).toHaveLength(1)
+    expect(result.current.selectedMessageId).toBe("email-1")
+    expect(result.current.error).toBeNull()
+  })
+
+  it("surfaces API errors", async () => {
+    mockedFetchInboxEmails.mockResolvedValue({
+      ok: false,
+      message: "inbox unavailable",
+    })
+
+    const { result } = renderHook(() => useInboxEmails("ws-1"))
+
+    await waitFor(() => {
+      expect(result.current.isLoading).toBe(false)
+    })
+
+    expect(result.current.error).toBe("inbox unavailable")
+    expect(result.current.messages).toHaveLength(0)
+  })
+
+  it("appends more emails when loadMore is called", async () => {
+    mockedFetchInboxEmails
+      .mockResolvedValueOnce({
+        ok: true,
+        page: {
+          items: [sampleEmail],
+          has_more: true,
+          next_cursor: "cursor-1",
+        },
+      })
+      .mockResolvedValueOnce({
+        ok: true,
+        page: {
+          items: [{
+            ...sampleEmail,
+            id: "email-2",
+            email: { ...sampleEmail.email, subject: "Second" },
+          }],
+          has_more: false,
+          next_cursor: undefined,
+        },
+      })
+
+    const { result } = renderHook(() => useInboxEmails("ws-1"))
+
+    await waitFor(() => {
+      expect(result.current.hasMore).toBe(true)
+    })
+
+    await act(async () => {
+      await result.current.loadMore()
+    })
+
+    expect(result.current.messages).toHaveLength(2)
+    expect(result.current.hasMore).toBe(false)
+  })
+})
diff --git a/frontend/src/features/inbox/inbox.types.ts b/frontend/src/features/inbox/inbox.types.ts
index 32cf07e0..c282cf1d 100644
--- a/frontend/src/features/inbox/inbox.types.ts
+++ b/frontend/src/features/inbox/inbox.types.ts
@@ -15,6 +15,7 @@ export type LogRow = {
   inbox_message_id?: string
   created_at: string
   source_name?: string
+  client_id?: string
 }
 
 export interface StoredEmail {
diff --git a/frontend/src/features/inbox/log-display.utils.test.ts b/frontend/src/features/inbox/log-display.utils.test.ts
new file mode 100644
index 00000000..a6c16256
--- /dev/null
+++ b/frontend/src/features/inbox/log-display.utils.test.ts
@@ -0,0 +1,46 @@
+import { describe, expect, it } from "vitest"
+
+import type { LogRow } from "./inbox.types"
+import { hasInboxContent, isEmailInboxLink } from "./log-display.utils"
+
+const baseLog: LogRow = {
+  id: "log-1",
+  workspace_id: "ws-1",
+  channel_type: "email",
+  http_method: "POST",
+  status_code: 200,
+  endpoint: "/v1/email",
+  created_at: "2026-01-01T00:00:00Z",
+}
+
+describe("hasInboxContent", () => {
+  it("returns true when inbox_message_id is present", () => {
+    expect(hasInboxContent({ ...baseLog, inbox_message_id: "msg-1" })).toBe(true)
+  })
+
+  it("returns false when inbox_message_id is missing", () => {
+    expect(hasInboxContent(baseLog)).toBe(false)
+  })
+})
+
+describe("isEmailInboxLink", () => {
+  it("returns true for email logs with inbox content", () => {
+    expect(isEmailInboxLink({ ...baseLog, inbox_message_id: "msg-1" })).toBe(true)
+  })
+
+  it("returns false for non-email channels", () => {
+    expect(isEmailInboxLink({ ...baseLog, channel_type: "sms", inbox_message_id: "msg-1" })).toBe(
+      false,
+    )
+  })
+
+  it("returns false for email logs without inbox content", () => {
+    expect(isEmailInboxLink(baseLog)).toBe(false)
+  })
+
+  it("matches email channel type case-insensitively", () => {
+    expect(isEmailInboxLink({ ...baseLog, channel_type: "EMAIL", inbox_message_id: "msg-1" })).toBe(
+      true,
+    )
+  })
+})
diff --git a/frontend/src/features/inbox/pages/email-inbox.page.test.tsx b/frontend/src/features/inbox/pages/email-inbox.page.test.tsx
new file mode 100644
index 00000000..ca95e67d
--- /dev/null
+++ b/frontend/src/features/inbox/pages/email-inbox.page.test.tsx
@@ -0,0 +1,103 @@
+import { render, screen } from "@testing-library/react"
+import { MemoryRouter, Route, Routes } from "react-router-dom"
+import { describe, expect, it, vi } from "vitest"
+
+import { useInboxEmails } from "../hooks/use-inbox-emails.hook"
+import { EmailInboxPage } from "./email-inbox.page"
+
+vi.mock("../hooks/use-inbox-emails.hook", () => ({
+  useInboxEmails: vi.fn(),
+}))
+
+const mockedUseInboxEmails = vi.mocked(useInboxEmails)
+
+const sampleEmail = {
+  id: "email-1",
+  workspace_id: "ws-1",
+  channel: "email",
+  status: "delivered",
+  created_at: "2026-01-01T00:00:00Z",
+  email: {
+    to: ["a@b.com"],
+    subject: "Hello",
+    html: "<p>hi</p>",
+  },
+}
+
+function renderPage() {
+  return render(
+    <MemoryRouter initialEntries={["/workspaces/ws-1/inbox/email"]}>
+      <Routes>
+        <Route path="/workspaces/:wid/inbox/email" element={<EmailInboxPage />} />
+      </Routes>
+    </MemoryRouter>,
+  )
+}
+
+describe("EmailInboxPage", () => {
+  it("shows loading state while emails load", () => {
+    mockedUseInboxEmails.mockReturnValue({
+      messages: [],
+      selectedMessageId: null,
+      setSelectedMessageId: vi.fn(),
+      isLoading: true,
+      isLoadingMore: false,
+      error: null,
+      nextCursor: undefined,
+      hasMore: false,
+      reload: vi.fn(),
+      loadMore: vi.fn(),
+      prependMessage: vi.fn(),
+      removeMessage: vi.fn(),
+      clearMessages: vi.fn(),
+    })
+
+    renderPage()
+
+    expect(screen.getByText(/loading simulated inbox/i)).toBeInTheDocument()
+  })
+
+  it("renders email list when messages are available", () => {
+    mockedUseInboxEmails.mockReturnValue({
+      messages: [sampleEmail],
+      selectedMessageId: "email-1",
+      setSelectedMessageId: vi.fn(),
+      isLoading: false,
+      isLoadingMore: false,
+      error: null,
+      nextCursor: undefined,
+      hasMore: false,
+      reload: vi.fn(),
+      loadMore: vi.fn(),
+      prependMessage: vi.fn(),
+      removeMessage: vi.fn(),
+      clearMessages: vi.fn(),
+    })
+
+    renderPage()
+
+    expect(screen.getAllByText("Hello").length).toBeGreaterThan(0)
+  })
+
+  it("shows error message when hook reports failure", () => {
+    mockedUseInboxEmails.mockReturnValue({
+      messages: [],
+      selectedMessageId: null,
+      setSelectedMessageId: vi.fn(),
+      isLoading: false,
+      isLoadingMore: false,
+      error: "Failed to load emails",
+      nextCursor: undefined,
+      hasMore: false,
+      reload: vi.fn(),
+      loadMore: vi.fn(),
+      prependMessage: vi.fn(),
+      removeMessage: vi.fn(),
+      clearMessages: vi.fn(),
+    })
+
+    renderPage()
+
+    expect(screen.getByText("Failed to load emails")).toBeInTheDocument()
+  })
+})
diff --git a/frontend/src/features/inbox/pages/email-templates.page.test.tsx b/frontend/src/features/inbox/pages/email-templates.page.test.tsx
new file mode 100644
index 00000000..6626a8f3
--- /dev/null
+++ b/frontend/src/features/inbox/pages/email-templates.page.test.tsx
@@ -0,0 +1,63 @@
+import { render, screen, waitFor } from "@testing-library/react"
+import { MemoryRouter, Route, Routes } from "react-router-dom"
+import { describe, expect, it, vi } from "vitest"
+
+import { fetchEmailTemplates } from "../inbox.api"
+import { EmailTemplatesPage } from "./email-templates.page"
+
+vi.mock("../inbox.api", () => ({
+  fetchEmailTemplates: vi.fn(),
+  createEmailTemplate: vi.fn(),
+  deleteEmailTemplate: vi.fn(),
+}))
+
+const mockedFetchTemplates = vi.mocked(fetchEmailTemplates)
+
+function renderPage() {
+  return render(
+    <MemoryRouter initialEntries={["/workspaces/ws-1/inbox/templates"]}>
+      <Routes>
+        <Route path="/workspaces/:wid/inbox/templates" element={<EmailTemplatesPage />} />
+      </Routes>
+    </MemoryRouter>,
+  )
+}
+
+describe("EmailTemplatesPage", () => {
+  it("shows loading state", () => {
+    mockedFetchTemplates.mockReturnValue(new Promise(() => {}))
+
+    renderPage()
+
+    expect(screen.getByText(/loading assets/i)).toBeInTheDocument()
+  })
+
+  it("renders template table rows", async () => {
+    mockedFetchTemplates.mockResolvedValue({
+      ok: true,
+      items: [
+        {
+          id: "tpl-1",
+          workspace_id: "ws-1",
+          name: "Welcome",
+          unique_key: "welcome",
+          channel_type: "email",
+          category: "transactional",
+          subject: "Welcome!",
+          content: "<p>Hi</p>",
+          is_active: true,
+          is_default: false,
+          created_at: "2026-01-01T00:00:00Z",
+          updated_at: "2026-01-01T00:00:00Z",
+        },
+      ],
+    })
+
+    renderPage()
+
+    await waitFor(() => {
+      expect(screen.getByText("Welcome")).toBeInTheDocument()
+    })
+    expect(screen.getByText("welcome")).toBeInTheDocument()
+  })
+})
diff --git a/frontend/src/features/inbox/pages/overview.page.test.tsx b/frontend/src/features/inbox/pages/overview.page.test.tsx
new file mode 100644
index 00000000..11430139
--- /dev/null
+++ b/frontend/src/features/inbox/pages/overview.page.test.tsx
@@ -0,0 +1,66 @@
+import { render, screen } from "@testing-library/react"
+import { MemoryRouter, Route, Routes } from "react-router-dom"
+import { describe, expect, it, vi } from "vitest"
+
+import { useInboxLogs } from "../hooks/use-inbox-logs.hook"
+import { OverviewPage } from "./overview.page"
+
+vi.mock("../hooks/use-inbox-logs.hook", () => ({
+  useInboxLogs: vi.fn(),
+}))
+
+const mockedUseInboxLogs = vi.mocked(useInboxLogs)
+
+function renderPage() {
+  return render(
+    <MemoryRouter initialEntries={["/workspaces/ws-1/overview"]}>
+      <Routes>
+        <Route path="/workspaces/:wid/overview" element={<OverviewPage />} />
+      </Routes>
+    </MemoryRouter>,
+  )
+}
+
+describe("OverviewPage", () => {
+  it("shows loading state", () => {
+    mockedUseInboxLogs.mockReturnValue({
+      logs: [],
+      total: 0,
+      isLoading: true,
+      error: null,
+      reload: vi.fn(),
+    })
+
+    renderPage()
+
+    expect(screen.getByText(/loading request logs/i)).toBeInTheDocument()
+  })
+
+  it("renders log rows", () => {
+    mockedUseInboxLogs.mockReturnValue({
+      logs: [
+        {
+          id: "log-1",
+          workspace_id: "ws-1",
+          channel_type: "email",
+          http_method: "POST",
+          status_code: 200,
+          endpoint: "/v1/email",
+          provider_name: "memory",
+          created_at: "2026-07-04T10:00:00Z",
+          source_name: "Demo Key",
+          client_id: "client-1",
+        },
+      ],
+      total: 1,
+      isLoading: false,
+      error: null,
+      reload: vi.fn(),
+    })
+
+    renderPage()
+
+    expect(screen.getByText("/v1/email")).toBeInTheDocument()
+    expect(screen.getByText("200")).toBeInTheDocument()
+  })
+})
diff --git a/frontend/src/features/integrations/components/connect-modal/connect-modal.tsx b/frontend/src/features/integrations/components/connect-modal/connect-modal.tsx
index cbeaa395..7170e298 100644
--- a/frontend/src/features/integrations/components/connect-modal/connect-modal.tsx
+++ b/frontend/src/features/integrations/components/connect-modal/connect-modal.tsx
@@ -1,13 +1,13 @@
 import type React from "react"
-import { useEffect, useState } from "react"
+import { useState } from "react"
 
 import { Button } from "@/components/ui/button"
 import { Input } from "@/components/ui/input"
 import { Modal } from "@/components/ui/modal"
 import { Spinner } from "@/components/ui/spinner"
 
-import type { IntegrationViewModel } from "@/features/integrations/hooks/use-integrations.hook"
-import { fetchProviderConfigFields, type ProviderConfigField } from "@/features/integrations/integrations.api"
+import { useProviderConfigFields } from "@/features/integrations/hooks/use-provider-config-fields.hook"
+import type { IntegrationViewModel } from "@/features/integrations/integrations.types"
 import type { IntegrationActionResult } from "@/features/integrations/integrations.types"
 
 interface ConnectModalProps {
@@ -47,40 +47,13 @@ interface ConnectFormProps {
 }
 
 function ConnectForm({ workspaceId, provider, onConnect, onClose }: ConnectFormProps) {
-  const [fields, setFields] = useState<ProviderConfigField[]>([])
-  const [isLoading, setIsLoading] = useState(false)
-  const [error, setError] = useState<string | null>(null)
-  const [formData, setFormData] = useState<Record<string, string>>({})
+  const { fields, formData, isLoading, error, updateField, setError } = useProviderConfigFields(
+    workspaceId,
+    provider.id,
+    true,
+  )
   const [isSubmitting, setIsSubmitting] = useState(false)
 
-  useEffect(() => {
-    const loadFields = async () => {
-      setIsLoading(true)
-      setError(null)
-      try {
-        const result = await fetchProviderConfigFields(workspaceId, provider.id)
-        setFields(result)
-
-        const defaults: Record<string, string> = {}
-        result.forEach((field) => {
-          defaults[field.key] = field.default_value || ""
-        })
-        setFormData(defaults)
-      } catch (err) {
-        setError(err instanceof Error ? err.message : "Failed to load configuration fields")
-        setFields([])
-      } finally {
-        setIsLoading(false)
-      }
-    }
-
-    void loadFields()
-  }, [workspaceId, provider.id])
-
-  function handleInputChange(key: string, value: string) {
-    setFormData((prev) => ({ ...prev, [key]: value }))
-  }
-
   async function handleSubmit(e: React.FormEvent) {
     e.preventDefault()
     setIsSubmitting(true)
@@ -139,7 +112,7 @@ function ConnectForm({ workspaceId, provider, onConnect, onClose }: ConnectFormP
               type={field.field_type === "password" ? "password" : field.field_type === "email" ? "email" : "text"}
               required={field.required}
               value={formData[field.key] || ""}
-              onChange={(e) => handleInputChange(field.key, e.target.value)}
+              onChange={(e) => updateField(field.key, e.target.value)}
               placeholder={field.description || `Enter ${field.label.toLowerCase()}`}
               className="bg-input"
             />
diff --git a/frontend/src/features/integrations/components/disconnect-modal/disconnect-modal.tsx b/frontend/src/features/integrations/components/disconnect-modal/disconnect-modal.tsx
index 158ceac6..4f303dd7 100644
--- a/frontend/src/features/integrations/components/disconnect-modal/disconnect-modal.tsx
+++ b/frontend/src/features/integrations/components/disconnect-modal/disconnect-modal.tsx
@@ -7,7 +7,7 @@ import { Modal } from "@/components/ui/modal"
 import { Spinner } from "@/components/ui/spinner"
 
 import { IntegrationProviderIcon } from "@/features/integrations/components/integration-provider-icon"
-import type { IntegrationViewModel } from "@/features/integrations/hooks/use-integrations.hook"
+import type { IntegrationViewModel } from "@/features/integrations/integrations.types"
 import type { IntegrationActionResult } from "@/features/integrations/integrations.types"
 
 type DisconnectAction = "deactivate" | "remove"
diff --git a/frontend/src/features/integrations/components/integration-row/integration-row.stories.tsx b/frontend/src/features/integrations/components/integration-row/integration-row.stories.tsx
index 407b05b6..1e24a175 100644
--- a/frontend/src/features/integrations/components/integration-row/integration-row.stories.tsx
+++ b/frontend/src/features/integrations/components/integration-row/integration-row.stories.tsx
@@ -1,6 +1,6 @@
 import type { Meta, StoryObj } from "@storybook/react-vite"
 
-import type { IntegrationViewModel } from "@/features/integrations/hooks/use-integrations.hook"
+import type { IntegrationViewModel } from "@/features/integrations/integrations.types"
 import { IntegrationRow } from "./integration-row"
 
 const mailgunProvider: IntegrationViewModel = {
diff --git a/frontend/src/features/integrations/components/integration-row/integration-row.test.tsx b/frontend/src/features/integrations/components/integration-row/integration-row.test.tsx
index c21c5f29..1fd13b42 100644
--- a/frontend/src/features/integrations/components/integration-row/integration-row.test.tsx
+++ b/frontend/src/features/integrations/components/integration-row/integration-row.test.tsx
@@ -2,7 +2,7 @@ import { render, screen } from "@testing-library/react"
 import userEvent from "@testing-library/user-event"
 import { describe, expect, it, vi } from "vitest"
 
-import type { IntegrationViewModel } from "@/features/integrations/hooks/use-integrations.hook"
+import type { IntegrationViewModel } from "@/features/integrations/integrations.types"
 import { IntegrationRow } from "./integration-row"
 
 const mailgunProvider: IntegrationViewModel = {
diff --git a/frontend/src/features/integrations/components/integration-row/integration-row.tsx b/frontend/src/features/integrations/components/integration-row/integration-row.tsx
index bd047d8c..10ace676 100644
--- a/frontend/src/features/integrations/components/integration-row/integration-row.tsx
+++ b/frontend/src/features/integrations/components/integration-row/integration-row.tsx
@@ -3,7 +3,7 @@ import { Button } from "@/components/ui/button"
 import { cn } from "@/lib/utils"
 
 import { IntegrationProviderIcon } from "@/features/integrations/components/integration-provider-icon"
-import type { IntegrationViewModel } from "@/features/integrations/hooks/use-integrations.hook"
+import type { IntegrationViewModel } from "@/features/integrations/integrations.types"
 
 interface IntegrationRowProps {
   provider: IntegrationViewModel
diff --git a/frontend/src/features/integrations/hooks/use-integrations.hook.ts b/frontend/src/features/integrations/hooks/use-integrations.hook.ts
index d5eeed66..b09dda4b 100644
--- a/frontend/src/features/integrations/hooks/use-integrations.hook.ts
+++ b/frontend/src/features/integrations/hooks/use-integrations.hook.ts
@@ -8,20 +8,10 @@ import {
   type IntegrationActionResult,
   type IntegrationChannel,
   type IntegrationStatus,
+  type IntegrationViewModel,
 } from "@/features/integrations/integrations.types"
 
-export interface IntegrationViewModel {
-  id: string
-  name: string
-  description: string
-  icon: string
-  category: IntegrationChannel
-  isAvailable: boolean
-  isComingSoon?: boolean
-  integration?: Integration
-  isConnected: boolean
-  isDeactivated: boolean
-}
+export type { IntegrationViewModel } from "@/features/integrations/integrations.types"
 
 function mergeCatalogWithIntegrations(providers: BackendProvider[], integrations: Integration[]): IntegrationViewModel[] {
   return providers.map((provider) => {
diff --git a/frontend/src/features/integrations/hooks/use-provider-config-fields.hook.test.ts b/frontend/src/features/integrations/hooks/use-provider-config-fields.hook.test.ts
new file mode 100644
index 00000000..694419f9
--- /dev/null
+++ b/frontend/src/features/integrations/hooks/use-provider-config-fields.hook.test.ts
@@ -0,0 +1,54 @@
+import { renderHook, waitFor } from "@testing-library/react"
+import { beforeEach, describe, expect, it, vi } from "vitest"
+
+vi.mock("@/features/integrations/integrations.api", () => ({
+  fetchProviderConfigFields: vi.fn(),
+}))
+
+import { fetchProviderConfigFields } from "@/features/integrations/integrations.api"
+
+import { useProviderConfigFields } from "./use-provider-config-fields.hook"
+
+const mockedFetchProviderConfigFields = vi.mocked(fetchProviderConfigFields)
+
+const mockFields = [
+  {
+    id: "f1",
+    provider_id: "mailgun",
+    key: "api_key",
+    label: "API Key",
+    description: "Your Mailgun Private API Key",
+    field_type: "password",
+    required: true,
+    default_value: "default-secret",
+    sort_order: 1,
+  },
+]
+
+describe("useProviderConfigFields", () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  it("loads fields and initializes form data when enabled", async () => {
+    mockedFetchProviderConfigFields.mockResolvedValue(mockFields)
+
+    const { result } = renderHook(() => useProviderConfigFields("ws-1", "mailgun", true))
+
+    await waitFor(() => {
+      expect(result.current.isLoading).toBe(false)
+    })
+
+    expect(mockedFetchProviderConfigFields).toHaveBeenCalledWith("ws-1", "mailgun")
+    expect(result.current.fields).toEqual(mockFields)
+    expect(result.current.formData).toEqual({ api_key: "default-secret" })
+    expect(result.current.error).toBeNull()
+  })
+
+  it("does not fetch when disabled or provider id is missing", () => {
+    renderHook(() => useProviderConfigFields("ws-1", undefined, true))
+    renderHook(() => useProviderConfigFields("ws-1", "mailgun", false))
+
+    expect(mockedFetchProviderConfigFields).not.toHaveBeenCalled()
+  })
+})
diff --git a/frontend/src/features/integrations/hooks/use-provider-config-fields.hook.ts b/frontend/src/features/integrations/hooks/use-provider-config-fields.hook.ts
new file mode 100644
index 00000000..dd9060fe
--- /dev/null
+++ b/frontend/src/features/integrations/hooks/use-provider-config-fields.hook.ts
@@ -0,0 +1,57 @@
+import { useEffect, useState } from "react"
+
+import { fetchProviderConfigFields, type ProviderConfigField } from "@/features/integrations/integrations.api"
+
+export function useProviderConfigFields(workspaceId: string, providerId: string | undefined, enabled: boolean) {
+  const [fields, setFields] = useState<ProviderConfigField[]>([])
+  const [formData, setFormData] = useState<Record<string, string>>({})
+  const [isLoading, setIsLoading] = useState(false)
+  const [error, setError] = useState<string | null>(null)
+
+  useEffect(() => {
+    if (!enabled || !providerId) {
+      return
+    }
+
+    let cancelled = false
+
+    ;(async () => {
+      setIsLoading(true)
+      setError(null)
+      try {
+        const result = await fetchProviderConfigFields(workspaceId, providerId)
+        if (cancelled) return
+
+        setFields(result)
+        const defaults: Record<string, string> = {}
+        result.forEach((field) => {
+          defaults[field.key] = field.default_value || ""
+        })
+        setFormData(defaults)
+      } catch (err) {
+        if (cancelled) return
+        setError(err instanceof Error ? err.message : "Failed to load configuration fields")
+        setFields([])
+      } finally {
+        if (!cancelled) setIsLoading(false)
+      }
+    })()
+
+    return () => {
+      cancelled = true
+    }
+  }, [workspaceId, providerId, enabled])
+
+  function updateField(key: string, value: string) {
+    setFormData((prev) => ({ ...prev, [key]: value }))
+  }
+
+  return {
+    fields,
+    formData,
+    isLoading,
+    error,
+    updateField,
+    setError,
+  }
+}
diff --git a/frontend/src/features/integrations/integrations.types.ts b/frontend/src/features/integrations/integrations.types.ts
index c6c89513..5038ad58 100644
--- a/frontend/src/features/integrations/integrations.types.ts
+++ b/frontend/src/features/integrations/integrations.types.ts
@@ -22,3 +22,16 @@ export interface Integration {
   created_at: string
   updated_at: string
 }
+
+export interface IntegrationViewModel {
+  id: string
+  name: string
+  description: string
+  icon: string
+  category: IntegrationChannel
+  isAvailable: boolean
+  isComingSoon?: boolean
+  integration?: Integration
+  isConnected: boolean
+  isDeactivated: boolean
+}
diff --git a/frontend/src/features/integrations/pages/integrations.page.test.tsx b/frontend/src/features/integrations/pages/integrations.page.test.tsx
new file mode 100644
index 00000000..6d85efaa
--- /dev/null
+++ b/frontend/src/features/integrations/pages/integrations.page.test.tsx
@@ -0,0 +1,59 @@
+import { render, screen } from "@testing-library/react"
+import { MemoryRouter, Route, Routes } from "react-router-dom"
+import { describe, expect, it, vi } from "vitest"
+
+import { useIntegrations } from "../hooks/use-integrations.hook"
+import { IntegrationsPage } from "./integrations.page"
+
+vi.mock("../hooks/use-integrations.hook", () => ({
+  useIntegrations: vi.fn(),
+  filterIntegrationsByTab: vi.fn((items: unknown[]) => items),
+  groupByCategory: vi.fn(() => ({})),
+}))
+
+const mockedUseIntegrations = vi.mocked(useIntegrations)
+
+function renderPage() {
+  return render(
+    <MemoryRouter initialEntries={["/workspaces/ws-1/integrations"]}>
+      <Routes>
+        <Route path="/workspaces/:wid/integrations" element={<IntegrationsPage />} />
+      </Routes>
+    </MemoryRouter>,
+  )
+}
+
+describe("IntegrationsPage", () => {
+  it("shows loading state", () => {
+    mockedUseIntegrations.mockReturnValue({
+      items: [],
+      isLoading: true,
+      error: null,
+      connect: vi.fn(),
+      activate: vi.fn(),
+      deactivate: vi.fn(),
+      removeIntegration: vi.fn(),
+    })
+
+    renderPage()
+
+    expect(screen.getByText(/loading integrations/i)).toBeInTheDocument()
+  })
+
+  it("shows error banner", () => {
+    mockedUseIntegrations.mockReturnValue({
+      items: [],
+      isLoading: false,
+      error: "Failed to load providers",
+      connect: vi.fn(),
+      activate: vi.fn(),
+      deactivate: vi.fn(),
+      removeIntegration: vi.fn(),
+    })
+
+    renderPage()
+
+    expect(screen.getByText("Failed to load providers")).toBeInTheDocument()
+    expect(screen.getByText("Integrations")).toBeInTheDocument()
+  })
+})
diff --git a/frontend/src/features/integrations/pages/integrations.page.tsx b/frontend/src/features/integrations/pages/integrations.page.tsx
index a9c144d8..b3cfb5b8 100644
--- a/frontend/src/features/integrations/pages/integrations.page.tsx
+++ b/frontend/src/features/integrations/pages/integrations.page.tsx
@@ -14,9 +14,8 @@ import {
   filterIntegrationsByTab,
   groupByCategory,
   useIntegrations,
-  type IntegrationViewModel,
 } from "@/features/integrations/hooks/use-integrations.hook"
-import type { IntegrationActionResult, IntegrationChannel } from "@/features/integrations/integrations.types"
+import type { IntegrationActionResult, IntegrationChannel, IntegrationViewModel } from "@/features/integrations/integrations.types"
 
 const CATEGORY_LABELS: Record<IntegrationChannel, string> = {
   email: "Email",
diff --git a/frontend/src/features/settings/pages/settings.page.test.tsx b/frontend/src/features/settings/pages/settings.page.test.tsx
new file mode 100644
index 00000000..d9b254af
--- /dev/null
+++ b/frontend/src/features/settings/pages/settings.page.test.tsx
@@ -0,0 +1,74 @@
+import { render, screen } from "@testing-library/react"
+import { MemoryRouter, Route, Routes } from "react-router-dom"
+import { describe, expect, it, vi } from "vitest"
+
+import { useSettings } from "../hooks/use-settings.hook"
+import { SettingsPage } from "./settings.page"
+
+vi.mock("../hooks/use-settings.hook", () => ({
+  useSettings: vi.fn(),
+}))
+
+const mockedUseSettings = vi.mocked(useSettings)
+
+const sampleApiKey = {
+  id: "key-1",
+  workspace_id: "w1",
+  client_id: "demo-client-id-abcdefghijklmnop",
+  name: "Production",
+  is_active: true,
+  created_at: "2026-01-01T00:00:00Z",
+  last_used_at: null,
+}
+
+function renderSettingsPage(tab = "developer") {
+  return render(
+    <MemoryRouter initialEntries={[`/workspaces/w1/settings?tab=${tab}`]}>
+      <Routes>
+        <Route path="/workspaces/:wid/settings" element={<SettingsPage />} />
+      </Routes>
+    </MemoryRouter>,
+  )
+}
+
+describe("SettingsPage", () => {
+  it("shows loading state while settings are loading", () => {
+    mockedUseSettings.mockReturnValue({
+      settings: {},
+      apiKeys: [],
+      messageDispatchConfig: { mode: "memory", storeMessageContent: false },
+      isLoading: true,
+      error: null,
+      reload: vi.fn(),
+      saveSettings: vi.fn(),
+      addApiKey: vi.fn(),
+      removeApiKey: vi.fn(),
+      rotateApiKey: vi.fn(),
+    })
+
+    renderSettingsPage()
+
+    expect(screen.getByText(/loading settings/i)).toBeInTheDocument()
+  })
+
+  it("renders API keys tab content from useSettings", () => {
+    mockedUseSettings.mockReturnValue({
+      settings: {},
+      apiKeys: [sampleApiKey],
+      messageDispatchConfig: { mode: "memory", storeMessageContent: false },
+      isLoading: false,
+      error: null,
+      reload: vi.fn(),
+      saveSettings: vi.fn(),
+      addApiKey: vi.fn(),
+      removeApiKey: vi.fn(),
+      rotateApiKey: vi.fn(),
+    })
+
+    renderSettingsPage("developer")
+
+    expect(screen.getByRole("heading", { name: "API Keys" })).toBeInTheDocument()
+    expect(screen.getByText("Production")).toBeInTheDocument()
+    expect(screen.getByRole("button", { name: /generate key/i })).toBeInTheDocument()
+  })
+})
diff --git a/frontend/src/features/settings/settings.api.ts b/frontend/src/features/settings/settings.api.ts
index 2c06eeeb..1fcbfb6e 100644
--- a/frontend/src/features/settings/settings.api.ts
+++ b/frontend/src/features/settings/settings.api.ts
@@ -1,3 +1,4 @@
+import { fetchWorkspaceApiKeys } from "@/core/api/workspace-api-keys"
 import { apiFetch } from "@/core/api/client"
 
 import { parseWorkspaceSettings } from "./settings.schema"
@@ -33,11 +34,7 @@ export async function patchSettings(workspaceId: string, body: WorkspaceSettings
 }
 
 export async function listApiKeys(workspaceId: string): Promise<ApiKey[]> {
-  const res = await apiFetch(`/api/v1/workspaces/${workspaceId}/api-keys`)
-  if (!res.ok) {
-    throw new Error("Failed to load API keys")
-  }
-  return (await res.json()) as ApiKey[]
+  return fetchWorkspaceApiKeys(workspaceId)
 }
 
 export async function createApiKey(
diff --git a/frontend/src/features/settings/settings.schema.test.ts b/frontend/src/features/settings/settings.schema.test.ts
new file mode 100644
index 00000000..3b88e937
--- /dev/null
+++ b/frontend/src/features/settings/settings.schema.test.ts
@@ -0,0 +1,31 @@
+import { describe, expect, it } from "vitest"
+
+import { parseWorkspaceSettings } from "./settings.schema"
+
+describe("parseWorkspaceSettings", () => {
+  it("parses valid workspace settings", () => {
+    const result = parseWorkspaceSettings({
+      owner_email: "owner@example.com",
+      pin_code: "123456",
+      message_dispatch_mode: "provider",
+      store_message_content: "true",
+    })
+
+    expect(result).toEqual({
+      owner_email: "owner@example.com",
+      pin_code: "123456",
+      message_dispatch_mode: "provider",
+      store_message_content: "true",
+    })
+  })
+
+  it("accepts an empty object", () => {
+    expect(parseWorkspaceSettings({})).toEqual({})
+  })
+
+  it("throws when settings contain invalid values", () => {
+    expect(() =>
+      parseWorkspaceSettings({ message_dispatch_mode: "invalid-mode" }),
+    ).toThrow("Invalid settings response from server")
+  })
+})
diff --git a/frontend/src/features/workspaces/pages/workspaces.page.test.tsx b/frontend/src/features/workspaces/pages/workspaces.page.test.tsx
new file mode 100644
index 00000000..b9dc6f43
--- /dev/null
+++ b/frontend/src/features/workspaces/pages/workspaces.page.test.tsx
@@ -0,0 +1,59 @@
+import { render, screen } from "@testing-library/react"
+import { MemoryRouter } from "react-router-dom"
+import { describe, expect, it, vi } from "vitest"
+
+import { useWorkspaces } from "../hooks/use-workspaces.hook"
+import { WorkspacesPage } from "./workspaces.page"
+
+vi.mock("../hooks/use-workspaces.hook", () => ({
+  useWorkspaces: vi.fn(),
+}))
+
+const mockedUseWorkspaces = vi.mocked(useWorkspaces)
+
+describe("WorkspacesPage", () => {
+  it("shows loading spinner while workspaces load", () => {
+    mockedUseWorkspaces.mockReturnValue({
+      workspaces: [],
+      isLoading: true,
+      error: null,
+      reload: vi.fn(),
+    })
+
+    render(
+      <MemoryRouter>
+        <WorkspacesPage />
+      </MemoryRouter>,
+    )
+
+    expect(screen.getByText(/loading workspaces/i)).toBeInTheDocument()
+  })
+
+  it("renders workspace cards", () => {
+    mockedUseWorkspaces.mockReturnValue({
+      workspaces: [
+        {
+          id: "ws-1",
+          name: "Demo Workspace",
+          slug: "demo",
+          role: "admin",
+          status: "active",
+          visibility: "public",
+          created_at: "2026-01-01T00:00:00Z",
+        },
+      ],
+      isLoading: false,
+      error: null,
+      reload: vi.fn(),
+    })
+
+    render(
+      <MemoryRouter>
+        <WorkspacesPage />
+      </MemoryRouter>,
+    )
+
+    expect(screen.getByText("Demo Workspace")).toBeInTheDocument()
+    expect(screen.getByPlaceholderText(/search workspaces/i)).toBeInTheDocument()
+  })
+})
diff --git a/frontend/src/shared/components/auth-card/auth-card.stories.tsx b/frontend/src/shared/components/auth-card/auth-card.stories.tsx
index 86b4776b..6d1e64d8 100644
--- a/frontend/src/shared/components/auth-card/auth-card.stories.tsx
+++ b/frontend/src/shared/components/auth-card/auth-card.stories.tsx
@@ -12,10 +12,12 @@ export default meta
 type Story = StoryObj<typeof meta>
 
 export const Default: Story = {
-  render: (args) => (
-    <AuthCard {...args}>
-      <h2 className="text-lg font-semibold text-foreground">Sign in</h2>
-      <p className="mt-2 text-sm text-text-secondary">Use your portal credentials.</p>
-    </AuthCard>
-  ),
+  args: {
+    children: (
+      <>
+        <h2 className="text-lg font-semibold text-foreground">Sign in</h2>
+        <p className="mt-2 text-sm text-text-secondary">Use your portal credentials.</p>
+      </>
+    ),
+  },
 }
diff --git a/frontend/vite.config.ts b/frontend/vite.config.ts
index c05ca2df..434f5fef 100644
--- a/frontend/vite.config.ts
+++ b/frontend/vite.config.ts
@@ -23,5 +23,6 @@ export default defineConfig({
     globals: true,
     environment: "jsdom",
     setupFiles: "./src/test-setup.ts",
+    pool: "forks",
   },
 })
diff --git a/internal/app/wire.go b/internal/app/wire.go
index fadb8471..4914bbd0 100644
--- a/internal/app/wire.go
+++ b/internal/app/wire.go
@@ -16,6 +16,7 @@ import (
 
 	gogate "github.com/weprodev/wpd-gogate"
 
+	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
 	"github.com/weprodev/wpd-message-gateway/internal/core/service"
 	"github.com/weprodev/wpd-message-gateway/internal/infrastructure/authgate"
 	"github.com/weprodev/wpd-message-gateway/internal/infrastructure/inbox"
@@ -62,7 +63,9 @@ func Wire(cfg *Config, sysLogger *pkglogger.Logger) (*Application, error) {
 	}
 
 	// ── RBAC Gate ───────────────────────────────────────────────────────────
-	gateEngine := gogate.NewGate(pgClient.GetDB(startCtx), nil)
+	gateCfg := gogate.DefaultConfig()
+	gateCfg.DefaultGuardName = domain.RBACGuardName
+	gateEngine := gogate.NewGate(pgClient.GetDB(startCtx), &gateCfg)
 	if err := gateEngine.LoadPolicy(startCtx); err != nil {
 		return nil, fmt.Errorf("load RBAC policies: %w", err)
 	}
diff --git a/internal/core/domain/permission.go b/internal/core/domain/permission.go
index 41f8a764..0312d12d 100644
--- a/internal/core/domain/permission.go
+++ b/internal/core/domain/permission.go
@@ -6,6 +6,9 @@ const (
 	RoleMember = "member"
 )
 
+// RBACGuardName is the guard_name used for portal roles and permissions in this project.
+const RBACGuardName = "msg_web"
+
 // Permissions in the RBAC system.
 const (
 	// Workspaces
diff --git a/internal/core/logctx/logctx.go b/internal/core/logctx/logctx.go
new file mode 100644
index 00000000..4ef3afb5
--- /dev/null
+++ b/internal/core/logctx/logctx.go
@@ -0,0 +1,62 @@
+// Package logctx provides request-scoped correlation fields for structured logging.
+// Core and presentation layers use this package — not infrastructure adapters.
+package logctx
+
+import "context"
+
+type contextKey string
+
+const (
+	keyWorkspaceID contextKey = "workspace_id"
+	keyAPIKeyID    contextKey = "api_key_id"
+	keyChannel     contextKey = "channel"
+	keyProvider    contextKey = "provider"
+	keyRequestID   contextKey = "request_id"
+)
+
+func WithRequestID(ctx context.Context, requestID string) context.Context {
+	return context.WithValue(ctx, keyRequestID, requestID)
+}
+
+func GetRequestID(ctx context.Context) string {
+	v, _ := ctx.Value(keyRequestID).(string)
+	return v
+}
+
+func WithWorkspace(ctx context.Context, workspaceID, apiKeyID string) context.Context {
+	ctx = context.WithValue(ctx, keyWorkspaceID, workspaceID)
+	ctx = context.WithValue(ctx, keyAPIKeyID, apiKeyID)
+	return ctx
+}
+
+func WithChannel(ctx context.Context, channel string) context.Context {
+	return context.WithValue(ctx, keyChannel, channel)
+}
+
+func WithProvider(ctx context.Context, provider string) context.Context {
+	return context.WithValue(ctx, keyProvider, provider)
+}
+
+// Attrs extracts gateway correlation fields from ctx for structured log handlers.
+func Attrs(ctx context.Context) []any {
+	if ctx == nil {
+		return nil
+	}
+	attrs := make([]any, 0, 10)
+	if v, _ := ctx.Value(keyWorkspaceID).(string); v != "" {
+		attrs = append(attrs, "workspace_id", v)
+	}
+	if v, _ := ctx.Value(keyAPIKeyID).(string); v != "" {
+		attrs = append(attrs, "api_key_id", v)
+	}
+	if v, _ := ctx.Value(keyChannel).(string); v != "" {
+		attrs = append(attrs, "channel", v)
+	}
+	if v, _ := ctx.Value(keyProvider).(string); v != "" {
+		attrs = append(attrs, "provider", v)
+	}
+	if v, _ := ctx.Value(keyRequestID).(string); v != "" {
+		attrs = append(attrs, "request_id", v)
+	}
+	return attrs
+}
diff --git a/internal/core/logctx/logctx_test.go b/internal/core/logctx/logctx_test.go
new file mode 100644
index 00000000..ed41ee7a
--- /dev/null
+++ b/internal/core/logctx/logctx_test.go
@@ -0,0 +1,41 @@
+package logctx
+
+import (
+	"context"
+	"testing"
+)
+
+func TestWithProvider_addsProviderToAttrs(t *testing.T) {
+	t.Parallel()
+
+	ctx := WithProvider(context.Background(), "mailgun")
+	attrs := Attrs(ctx)
+
+	if len(attrs) != 2 || attrs[0] != "provider" || attrs[1] != "mailgun" {
+		t.Fatalf("Attrs: got %#v", attrs)
+	}
+}
+
+func TestWithWorkspace_addsWorkspaceFields(t *testing.T) {
+	t.Parallel()
+
+	ctx := WithWorkspace(context.Background(), "ws-1", "key-1")
+	attrs := Attrs(ctx)
+
+	if len(attrs) != 4 {
+		t.Fatalf("expected 4 attr entries, got %#v", attrs)
+	}
+}
+
+func TestWithRequestID_roundTrip(t *testing.T) {
+	t.Parallel()
+
+	ctx := WithRequestID(context.Background(), "req-123")
+	if GetRequestID(ctx) != "req-123" {
+		t.Fatalf("GetRequestID: got %q", GetRequestID(ctx))
+	}
+	attrs := Attrs(ctx)
+	if len(attrs) != 2 || attrs[0] != "request_id" || attrs[1] != "req-123" {
+		t.Fatalf("Attrs: got %#v", attrs)
+	}
+}
diff --git a/internal/core/port/inbox.go b/internal/core/port/inbox.go
index 000191a3..5c26a035 100644
--- a/internal/core/port/inbox.go
+++ b/internal/core/port/inbox.go
@@ -46,6 +46,27 @@ type InboxEmailPage struct {
 	HasMore    bool          `json:"has_more"`
 }
 
+// InboxSMSPage is a paginated slice of captured SMS messages (newest first).
+type InboxSMSPage struct {
+	Items      []StoredSMS `json:"items"`
+	NextCursor string      `json:"next_cursor,omitempty"`
+	HasMore    bool        `json:"has_more"`
+}
+
+// InboxPushPage is a paginated slice of captured push notifications (newest first).
+type InboxPushPage struct {
+	Items      []StoredPush `json:"items"`
+	NextCursor string       `json:"next_cursor,omitempty"`
+	HasMore    bool         `json:"has_more"`
+}
+
+// InboxChatPage is a paginated slice of captured chat messages (newest first).
+type InboxChatPage struct {
+	Items      []StoredChat `json:"items"`
+	NextCursor string       `json:"next_cursor,omitempty"`
+	HasMore    bool         `json:"has_more"`
+}
+
 // InboxReader is the read side of the in-process message capture store.
 type InboxReader interface {
 	StatsForWorkspace(workspaceID string) map[string]int
@@ -53,12 +74,15 @@ type InboxReader interface {
 	ListEmailsForWorkspace(workspaceID string, limit int, cursor string) InboxEmailPage
 	EmailByIDForWorkspace(id, workspaceID string) (StoredEmail, bool)
 	DeleteEmailByIDForWorkspace(id, workspaceID string) bool
+	ListSMSForWorkspace(workspaceID string, limit int, cursor string) InboxSMSPage
 	SMSForWorkspace(workspaceID string) []StoredSMS
 	SMSByIDForWorkspace(id, workspaceID string) (StoredSMS, bool)
 	DeleteSMSByIDForWorkspace(id, workspaceID string) bool
+	ListPushForWorkspace(workspaceID string, limit int, cursor string) InboxPushPage
 	PushForWorkspace(workspaceID string) []StoredPush
 	PushByIDForWorkspace(id, workspaceID string) (StoredPush, bool)
 	DeletePushByIDForWorkspace(id, workspaceID string) bool
+	ListChatForWorkspace(workspaceID string, limit int, cursor string) InboxChatPage
 	ChatForWorkspace(workspaceID string) []StoredChat
 	ChatByIDForWorkspace(id, workspaceID string) (StoredChat, bool)
 	DeleteChatByIDForWorkspace(id, workspaceID string) bool
diff --git a/internal/core/service/auth_service_test.go b/internal/core/service/auth_service_test.go
new file mode 100644
index 00000000..ac589d4f
--- /dev/null
+++ b/internal/core/service/auth_service_test.go
@@ -0,0 +1,164 @@
+package service
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/weprodev/go-pkg/crypto"
+
+	"github.com/weprodev/wpd-message-gateway/internal/core/authjwt"
+	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
+	"github.com/weprodev/wpd-message-gateway/internal/core/port"
+	"github.com/weprodev/wpd-message-gateway/pkg/contracts"
+)
+
+type failingEmailSender struct{}
+
+func (f *failingEmailSender) Send(context.Context, contracts.Email) (*contracts.SendResult, error) {
+	return nil, errors.New("smtp down")
+}
+
+func (f *failingEmailSender) Name() string { return "failing" }
+
+func TestAuthService_VerifyEmail_success(t *testing.T) {
+	t.Parallel()
+
+	userID := uuid.New()
+	repo := &fakeUserRepo{
+		byID: &domain.User{
+			ID:            userID,
+			Email:         "user@example.com",
+			EmailVerified: false,
+		},
+	}
+	svc := NewAuthService(repo, &fakeEmailSender{}, testJWTSecret, true, time.Hour, time.Hour, "https://portal.example.com")
+
+	token, err := authjwt.Sign(userID.String(), "user@example.com", testJWTSecret, time.Hour)
+	if err != nil {
+		t.Fatalf("Sign: %v", err)
+	}
+
+	if err := svc.VerifyEmail(context.Background(), token); err != nil {
+		t.Fatalf("VerifyEmail: %v", err)
+	}
+	if len(repo.verifiedUserIDs) != 1 || repo.verifiedUserIDs[0] != userID.String() {
+		t.Fatalf("expected SetEmailVerified for %s, got %v", userID, repo.verifiedUserIDs)
+	}
+}
+
+func TestAuthService_VerifyEmail_rejectsAlreadyVerified(t *testing.T) {
+	t.Parallel()
+
+	userID := uuid.New()
+	repo := &fakeUserRepo{
+		byID: &domain.User{ID: userID, Email: "user@example.com", EmailVerified: true},
+	}
+	svc := NewAuthService(repo, &fakeEmailSender{}, testJWTSecret, true, time.Hour, time.Hour, "")
+
+	token, err := authjwt.Sign(userID.String(), "user@example.com", testJWTSecret, time.Hour)
+	if err != nil {
+		t.Fatalf("Sign: %v", err)
+	}
+
+	err = svc.VerifyEmail(context.Background(), token)
+	if err == nil || err.Error() != "email already verified" {
+		t.Fatalf("expected already verified error, got %v", err)
+	}
+}
+
+func TestAuthService_VerifyEmail_rejectsInvalidToken(t *testing.T) {
+	t.Parallel()
+
+	svc := NewAuthService(&fakeUserRepo{}, &fakeEmailSender{}, testJWTSecret, true, time.Hour, time.Hour, "")
+
+	err := svc.VerifyEmail(context.Background(), "not-a-jwt")
+	if err == nil || err.Error() != "invalid or expired verification token" {
+		t.Fatalf("expected invalid token error, got %v", err)
+	}
+}
+
+func TestAuthService_Login_success(t *testing.T) {
+	t.Parallel()
+
+	hash, err := crypto.HashSecret("correct-password")
+	if err != nil {
+		t.Fatalf("HashSecret: %v", err)
+	}
+	userID := uuid.New()
+	repo := &fakeUserRepo{
+		byEmail: &domain.User{
+			ID:            userID,
+			Email:         "user@example.com",
+			PasswordHash:  hash,
+			EmailVerified: true,
+		},
+	}
+	svc := NewAuthService(repo, &fakeEmailSender{}, testJWTSecret, false, time.Hour, time.Hour, "")
+
+	user, token, err := svc.Login(context.Background(), "user@example.com", "correct-password")
+	if err != nil {
+		t.Fatalf("Login: %v", err)
+	}
+	if user.ID != userID || token == "" {
+		t.Fatalf("unexpected login result: user=%+v token=%q", user, token)
+	}
+
+	claims, err := authjwt.Parse(token, testJWTSecret)
+	if err != nil {
+		t.Fatalf("Parse token: %v", err)
+	}
+	if claims.UserID != userID.String() {
+		t.Fatalf("token subject: got %q want %q", claims.UserID, userID)
+	}
+}
+
+func TestAuthService_Login_rejectsUnverifiedEmail(t *testing.T) {
+	t.Parallel()
+
+	repo := &fakeUserRepo{
+		byEmail: &domain.User{
+			ID:            uuid.New(),
+			Email:         "user@example.com",
+			PasswordHash:  "hash",
+			EmailVerified: false,
+		},
+	}
+	svc := NewAuthService(repo, &fakeEmailSender{}, testJWTSecret, true, time.Hour, time.Hour, "")
+
+	_, _, err := svc.Login(context.Background(), "user@example.com", "pw")
+	if err == nil || err.Error() != "email not verified" {
+		t.Fatalf("expected email not verified error, got %v", err)
+	}
+}
+
+func TestAuthService_RegisterUser_sendsVerificationEmail(t *testing.T) {
+	t.Parallel()
+
+	repo := &fakeUserRepo{err: fmt.Errorf("lookup: %w", port.ErrNotFound)}
+	sender := &fakeEmailSender{}
+	svc := NewAuthService(repo, sender, testJWTSecret, true, time.Hour, time.Hour, "https://portal.example.com")
+
+	user, err := svc.RegisterUser(context.Background(), "First", "Last", "new@example.com", "secret123456")
+	if err != nil {
+		t.Fatalf("RegisterUser: %v", err)
+	}
+	if user.EmailVerified {
+		t.Fatal("expected EmailVerified false when verification enabled")
+	}
+}
+
+func TestAuthService_RegisterUser_failsWhenVerificationEmailFails(t *testing.T) {
+	t.Parallel()
+
+	repo := &fakeUserRepo{err: fmt.Errorf("lookup: %w", port.ErrNotFound)}
+	svc := NewAuthService(repo, &failingEmailSender{}, testJWTSecret, true, time.Hour, time.Hour, "https://portal.example.com")
+
+	_, err := svc.RegisterUser(context.Background(), "First", "Last", "new@example.com", "secret123456")
+	if err == nil || err.Error() != "could not send verification email: smtp down" {
+		t.Fatalf("expected verification email failure, got %v", err)
+	}
+}
diff --git a/internal/core/service/gateway_service.go b/internal/core/service/gateway_service.go
index 9f6f1085..e6fbc4d5 100644
--- a/internal/core/service/gateway_service.go
+++ b/internal/core/service/gateway_service.go
@@ -9,8 +9,8 @@ import (
 	"log/slog"
 
 	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
+	"github.com/weprodev/wpd-message-gateway/internal/core/logctx"
 	"github.com/weprodev/wpd-message-gateway/internal/core/port"
-	applogger "github.com/weprodev/wpd-message-gateway/internal/infrastructure/logger"
 	"github.com/weprodev/wpd-message-gateway/pkg/contracts"
 )
 
@@ -169,7 +169,7 @@ func (s *GatewayService) dispatch(
 		integrationID = intg.ID
 		providerName = intg.ProviderName
 
-		providerCtx := applogger.WithProvider(ctx, providerName)
+		providerCtx := logctx.WithProvider(ctx, providerName)
 		provResult, err = sendViaProvider(providerCtx, intg)
 		if err != nil {
 			slog.WarnContext(providerCtx, "provider dispatch failed", "error", err, "integration_id", integrationID)
diff --git a/internal/core/service/gateway_service_channels_test.go b/internal/core/service/gateway_service_channels_test.go
new file mode 100644
index 00000000..ac4e29d8
--- /dev/null
+++ b/internal/core/service/gateway_service_channels_test.go
@@ -0,0 +1,93 @@
+package service
+
+import (
+	"context"
+	"testing"
+
+	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
+	"github.com/weprodev/wpd-message-gateway/pkg/contracts"
+)
+
+func TestGatewayService_SendSMS_memoryOnly(t *testing.T) {
+	t.Parallel()
+
+	inbox := &stubInbox{}
+	svc := NewGatewayService(&stubIntegrationRepo{}, nil, nil, inbox, nil)
+
+	res, err := svc.SendSMS(context.Background(), "ws-1", contracts.SMS{
+		To:      []string{"+15550001111"},
+		Message: "hello",
+	})
+	if err != nil {
+		t.Fatalf("SendSMS: %v", err)
+	}
+	if res.ID != "inbox-sms-1" {
+		t.Fatalf("got ID %q", res.ID)
+	}
+	if res.Meta[contracts.MetaKeyDispatchMode] != string(domain.DispatchMemory) {
+		t.Fatalf("dispatch_mode: %v", res.Meta[contracts.MetaKeyDispatchMode])
+	}
+	if res.Meta["channel"] != "sms" {
+		t.Fatalf("channel: %v", res.Meta["channel"])
+	}
+}
+
+func TestGatewayService_SendPush_memoryOnly(t *testing.T) {
+	t.Parallel()
+
+	inbox := &stubInbox{}
+	svc := NewGatewayService(&stubIntegrationRepo{}, nil, nil, inbox, nil)
+
+	res, err := svc.SendPush(context.Background(), "ws-1", contracts.PushNotification{
+		DeviceTokens: []string{"device-token-1"},
+		Title:        "Hi",
+		Body:         "There",
+	})
+	if err != nil {
+		t.Fatalf("SendPush: %v", err)
+	}
+	if res.ID != "inbox-push-1" {
+		t.Fatalf("got ID %q", res.ID)
+	}
+	if res.Meta[contracts.MetaKeyDispatchMode] != string(domain.DispatchMemory) {
+		t.Fatalf("dispatch_mode: %v", res.Meta[contracts.MetaKeyDispatchMode])
+	}
+	if res.Meta["channel"] != "push" {
+		t.Fatalf("channel: %v", res.Meta["channel"])
+	}
+}
+
+func TestGatewayService_SendChat_memoryOnly(t *testing.T) {
+	t.Parallel()
+
+	inbox := &stubInbox{}
+	svc := NewGatewayService(&stubIntegrationRepo{}, nil, nil, inbox, nil)
+
+	res, err := svc.SendChat(context.Background(), "ws-1", contracts.ChatMessage{
+		To:      []string{"user-1"},
+		Message: "ping",
+	})
+	if err != nil {
+		t.Fatalf("SendChat: %v", err)
+	}
+	if res.ID != "inbox-chat-1" {
+		t.Fatalf("got ID %q", res.ID)
+	}
+	if res.Meta[contracts.MetaKeyDispatchMode] != string(domain.DispatchMemory) {
+		t.Fatalf("dispatch_mode: %v", res.Meta[contracts.MetaKeyDispatchMode])
+	}
+	if res.Meta["channel"] != "chat" {
+		t.Fatalf("channel: %v", res.Meta["channel"])
+	}
+}
+
+func TestGatewayService_SendSMS_memoryOnly_inboxNil(t *testing.T) {
+	t.Parallel()
+
+	svc := NewGatewayService(&stubIntegrationRepo{}, nil, nil, nil, nil)
+
+	_, err := svc.SendSMS(context.Background(), "ws-1", contracts.SMS{To: []string{"+1"}, Message: "x"})
+	if err == nil {
+		t.Fatal("expected error when inbox is nil")
+	}
+}
diff --git a/internal/core/service/portal_service.go b/internal/core/service/portal_service.go
index e1f52b1c..99b56b8d 100644
--- a/internal/core/service/portal_service.go
+++ b/internal/core/service/portal_service.go
@@ -559,6 +559,19 @@ func (s *PortalService) PatchSettings(ctx context.Context, workspaceID string, k
 	return nil
 }
 
+const invitationTTL = 7 * 24 * time.Hour
+
+// NewPendingInvitation builds a workspace invitation with the standard expiry window.
+func (s *PortalService) NewPendingInvitation(workspaceID, email, role string) *domain.Invitation {
+	return &domain.Invitation{
+		WorkspaceID: workspaceID,
+		Email:       email,
+		Role:        role,
+		ExpiresAt:   time.Now().Add(invitationTTL),
+		Status:      "pending",
+	}
+}
+
 // ListInvitations returns all pending invitations for a workspace.
 func (s *PortalService) ListInvitations(ctx context.Context, workspaceID string) ([]domain.Invitation, error) {
 	return s.invites.ListPendingByWorkspace(ctx, workspaceID)
diff --git a/internal/core/service/portal_service_extended_test.go b/internal/core/service/portal_service_extended_test.go
new file mode 100644
index 00000000..2ac0ae7d
--- /dev/null
+++ b/internal/core/service/portal_service_extended_test.go
@@ -0,0 +1,196 @@
+package service
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+
+	"github.com/weprodev/go-pkg/crypto"
+
+	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
+	"github.com/weprodev/wpd-message-gateway/internal/core/port"
+)
+
+type fakeInvitationRepo struct {
+	created *domain.Invitation
+	list    []domain.Invitation
+}
+
+func (f *fakeInvitationRepo) Create(_ context.Context, inv *domain.Invitation) error {
+	f.created = inv
+	inv.ID = "inv-" + uuid.NewString()
+	return nil
+}
+
+func (f *fakeInvitationRepo) ListPendingByWorkspace(_ context.Context, workspaceID string) ([]domain.Invitation, error) {
+	return f.list, nil
+}
+
+type fakeAPIKeyRepo struct {
+	keys    map[string]*domain.APIKey
+	byWS    map[string][]domain.APIKey
+	created *domain.APIKey
+	deleted string
+}
+
+func (f *fakeAPIKeyRepo) Create(_ context.Context, k *domain.APIKey) error {
+	if f.keys == nil {
+		f.keys = make(map[string]*domain.APIKey)
+	}
+	if f.byWS == nil {
+		f.byWS = make(map[string][]domain.APIKey)
+	}
+	k.ID = "key-" + uuid.NewString()
+	f.created = k
+	f.keys[k.ID] = k
+	f.byWS[k.WorkspaceID] = append(f.byWS[k.WorkspaceID], *k)
+	return nil
+}
+
+func (f *fakeAPIKeyRepo) GetByClientID(_ context.Context, clientID string) (*domain.APIKey, error) {
+	for _, k := range f.keys {
+		if k.ClientID == clientID {
+			return k, nil
+		}
+	}
+	return nil, port.ErrNotFound
+}
+
+func (f *fakeAPIKeyRepo) GetByID(_ context.Context, id string) (*domain.APIKey, error) {
+	k, ok := f.keys[id]
+	if !ok {
+		return nil, port.ErrNotFound
+	}
+	return k, nil
+}
+
+func (f *fakeAPIKeyRepo) ListByWorkspace(_ context.Context, workspaceID string) ([]domain.APIKey, error) {
+	return f.byWS[workspaceID], nil
+}
+
+func (f *fakeAPIKeyRepo) Delete(_ context.Context, id string) error {
+	f.deleted = id
+	delete(f.keys, id)
+	return nil
+}
+
+func (f *fakeAPIKeyRepo) UpdateSecret(_ context.Context, id, clientID, secretHash string) error {
+	k, ok := f.keys[id]
+	if !ok {
+		return port.ErrNotFound
+	}
+	k.ClientID = clientID
+	k.ClientSecretHash = secretHash
+	return nil
+}
+
+func (f *fakeAPIKeyRepo) UpdateLastUsedAt(_ context.Context, id string) error {
+	return nil
+}
+
+func TestPortalService_NewPendingInvitation(t *testing.T) {
+	t.Parallel()
+
+	svc := NewPortalService(PortalDeps{})
+	before := time.Now()
+	inv := svc.NewPendingInvitation("ws-1", "user@example.com", domain.RoleMember)
+	after := time.Now()
+
+	if inv.WorkspaceID != "ws-1" || inv.Email != "user@example.com" || inv.Role != domain.RoleMember {
+		t.Fatalf("unexpected invitation fields: %+v", inv)
+	}
+	if inv.Status != "pending" {
+		t.Fatalf("expected pending status, got %q", inv.Status)
+	}
+	wantMin := before.Add(7 * 24 * time.Hour)
+	wantMax := after.Add(7 * 24 * time.Hour)
+	if inv.ExpiresAt.Before(wantMin) || inv.ExpiresAt.After(wantMax) {
+		t.Fatalf("expected ~7-day expiry, got %v (window %v–%v)", inv.ExpiresAt, wantMin, wantMax)
+	}
+}
+
+func TestPortalService_CreateInvitation(t *testing.T) {
+	t.Parallel()
+
+	repo := &fakeInvitationRepo{}
+	svc := NewPortalService(PortalDeps{Invitations: repo})
+	inv := svc.NewPendingInvitation("ws-1", "user@example.com", domain.RoleMember)
+
+	rawToken, err := svc.CreateInvitation(context.Background(), inv)
+	if err != nil {
+		t.Fatalf("CreateInvitation: %v", err)
+	}
+	if rawToken == "" {
+		t.Fatal("expected non-empty token")
+	}
+	if repo.created == nil || repo.created.TokenHash == "" {
+		t.Fatal("expected hashed token persisted")
+	}
+	if rawToken == repo.created.TokenHash {
+		t.Fatal("stored value must be hash, not plaintext token")
+	}
+	sum := sha256.Sum256([]byte(rawToken))
+	if repo.created.TokenHash != hex.EncodeToString(sum[:]) {
+		t.Fatalf("token hash mismatch: got %q", repo.created.TokenHash)
+	}
+}
+
+func TestPortalService_APIKeys(t *testing.T) {
+	t.Parallel()
+
+	ctx := context.Background()
+	repo := &fakeAPIKeyRepo{}
+	svc := NewPortalService(PortalDeps{APIKeys: repo})
+
+	key, secret, err := svc.CreateAPIKey(ctx, "ws-1", "  My Key  ")
+	if err != nil {
+		t.Fatalf("CreateAPIKey: %v", err)
+	}
+	if secret == "" {
+		t.Fatal("expected plaintext secret")
+	}
+	if key.Name != "My Key" {
+		t.Fatalf("expected trimmed name, got %q", key.Name)
+	}
+	if !crypto.CheckSecretHash(secret, repo.created.ClientSecretHash) {
+		t.Fatal("stored hash does not match returned secret")
+	}
+
+	list, err := svc.ListAPIKeys(ctx, "ws-1")
+	if err != nil {
+		t.Fatalf("ListAPIKeys: %v", err)
+	}
+	if len(list) != 1 || list[0].ID != key.ID {
+		t.Fatalf("expected one key in list, got %+v", list)
+	}
+
+	if err := svc.DeleteAPIKey(ctx, "ws-1", key.ID); err != nil {
+		t.Fatalf("DeleteAPIKey: %v", err)
+	}
+	if repo.deleted != key.ID {
+		t.Fatalf("expected delete id %q, got %q", key.ID, repo.deleted)
+	}
+}
+
+func TestPortalService_DeleteAPIKey_rejectsWrongWorkspace(t *testing.T) {
+	t.Parallel()
+
+	repo := &fakeAPIKeyRepo{
+		keys: map[string]*domain.APIKey{
+			"key-1": {ID: "key-1", WorkspaceID: "ws-other"},
+		},
+	}
+	svc := NewPortalService(PortalDeps{APIKeys: repo})
+
+	err := svc.DeleteAPIKey(context.Background(), "ws-1", "key-1")
+	if err == nil || err.Error() != "api key not in workspace" {
+		t.Fatalf("expected workspace mismatch error, got %v", err)
+	}
+	if repo.deleted != "" {
+		t.Fatal("delete should not run for wrong workspace")
+	}
+}
diff --git a/internal/core/service/portal_service_test.go b/internal/core/service/portal_service_test.go
index 01841862..e5172fde 100644
--- a/internal/core/service/portal_service_test.go
+++ b/internal/core/service/portal_service_test.go
@@ -17,9 +17,12 @@ import (
 const testJWTSecret = "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
 
 type fakeUserRepo struct {
-	byEmail *domain.User
-	err     error
-	created *domain.User
+	byEmail         *domain.User
+	byID            *domain.User
+	err             error
+	created         *domain.User
+	setVerifiedErr  error
+	verifiedUserIDs []string
 }
 
 func (f *fakeUserRepo) Create(ctx context.Context, u *domain.User) error {
@@ -29,14 +32,24 @@ func (f *fakeUserRepo) Create(ctx context.Context, u *domain.User) error {
 }
 
 func (f *fakeUserRepo) GetByEmail(ctx context.Context, email string) (*domain.User, error) {
-	return f.byEmail, f.err
+	if f.err != nil {
+		return nil, f.err
+	}
+	return f.byEmail, nil
 }
 
 func (f *fakeUserRepo) GetByID(ctx context.Context, id string) (*domain.User, error) {
+	if f.byID != nil && f.byID.ID.String() == id {
+		return f.byID, nil
+	}
 	return nil, port.ErrNotFound
 }
 
 func (f *fakeUserRepo) SetEmailVerified(ctx context.Context, id string) error {
+	if f.setVerifiedErr != nil {
+		return f.setVerifiedErr
+	}
+	f.verifiedUserIDs = append(f.verifiedUserIDs, id)
 	return nil
 }
 
diff --git a/internal/infrastructure/authgate/gate_adapter_test.go b/internal/infrastructure/authgate/gate_adapter_test.go
new file mode 100644
index 00000000..71bc922f
--- /dev/null
+++ b/internal/infrastructure/authgate/gate_adapter_test.go
@@ -0,0 +1,71 @@
+package authgate
+
+import (
+	"context"
+	"testing"
+
+	"github.com/DATA-DOG/go-sqlmock"
+)
+
+func TestGoGateAdapter_GetPermissionsForTeams_emptyInput(t *testing.T) {
+	t.Parallel()
+
+	db, _, err := sqlmock.New()
+	if err != nil {
+		t.Fatalf("sqlmock.New: %v", err)
+	}
+	t.Cleanup(func() { _ = db.Close() })
+
+	adapter := NewGoGateAdapter(nil, db)
+	out, err := adapter.GetPermissionsForTeams(context.Background(), "User", "user-1", nil)
+	if err != nil {
+		t.Fatalf("GetPermissionsForTeams: %v", err)
+	}
+	if len(out) != 0 {
+		t.Fatalf("expected empty map, got %+v", out)
+	}
+}
+
+func TestGoGateAdapter_GetPermissionsForTeams_dedupesPermissions(t *testing.T) {
+	t.Parallel()
+
+	db, mock, err := sqlmock.New()
+	if err != nil {
+		t.Fatalf("sqlmock.New: %v", err)
+	}
+	t.Cleanup(func() { _ = db.Close() })
+
+	rows := sqlmock.NewRows([]string{"team_id", "permission"}).
+		AddRow("team-1", "logs.read").
+		AddRow("team-1", "logs.read").
+		AddRow("team-1", "settings.write")
+
+	mock.ExpectQuery(`SELECT team_id::text, permission`).
+		WithArgs("User", "user-1", sqlmock.AnyArg()).
+		WillReturnRows(rows)
+
+	adapter := NewGoGateAdapter(nil, db)
+	out, err := adapter.GetPermissionsForTeams(context.Background(), "User", "user-1", []string{"team-1"})
+	if err != nil {
+		t.Fatalf("GetPermissionsForTeams: %v", err)
+	}
+	perms := out["team-1"]
+	if len(perms) != 2 || perms[0] != "logs.read" || perms[1] != "settings.write" {
+		t.Fatalf("unexpected permissions: %+v", perms)
+	}
+}
+
+func TestDedupeSortedStrings(t *testing.T) {
+	t.Parallel()
+
+	got := dedupeSortedStrings([]string{"a", "a", "b", "c", "c"})
+	want := []string{"a", "b", "c"}
+	if len(got) != len(want) {
+		t.Fatalf("got %v want %v", got, want)
+	}
+	for i := range want {
+		if got[i] != want[i] {
+			t.Fatalf("got %v want %v", got, want)
+		}
+	}
+}
diff --git a/internal/infrastructure/inbox/store.go b/internal/infrastructure/inbox/store.go
index a69717ac..3fd0b24f 100644
--- a/internal/infrastructure/inbox/store.go
+++ b/internal/infrastructure/inbox/store.go
@@ -131,10 +131,47 @@ func (s *Store) DeleteEmailByIDForWorkspace(id, workspaceID string) bool {
 	return false
 }
 
+func paginateByID[T any](all []T, limit int, cursor string, idOf func(T) string) (items []T, nextCursor string, hasMore bool) {
+	limit = clampInboxLimit(limit)
+	start := 0
+	if cursor != "" {
+		for i, item := range all {
+			if idOf(item) == cursor {
+				start = i + 1
+				break
+			}
+		}
+	}
+
+	end := start + limit
+	hasMore = end < len(all)
+	if end > len(all) {
+		end = len(all)
+	}
+
+	items = make([]T, 0, end-start)
+	if start < len(all) {
+		items = append(items, all[start:end]...)
+	}
+	if hasMore && len(items) > 0 {
+		nextCursor = idOf(items[len(items)-1])
+	}
+	return items, nextCursor, hasMore
+}
+
 func (s *Store) SMSForWorkspace(workspaceID string) []port.StoredSMS {
+	page := s.ListSMSForWorkspace(workspaceID, 0, "")
+	return page.Items
+}
+
+func (s *Store) ListSMSForWorkspace(workspaceID string, limit int, cursor string) port.InboxSMSPage {
 	s.mu.RLock()
 	defer s.mu.RUnlock()
-	return append([]port.StoredSMS(nil), s.sms[workspaceID]...)
+
+	items, nextCursor, hasMore := paginateByID(s.sms[workspaceID], limit, cursor, func(item port.StoredSMS) string {
+		return item.ID
+	})
+	return port.InboxSMSPage{Items: items, NextCursor: nextCursor, HasMore: hasMore}
 }
 
 func (s *Store) SMSByIDForWorkspace(id, workspaceID string) (port.StoredSMS, bool) {
@@ -162,9 +199,18 @@ func (s *Store) DeleteSMSByIDForWorkspace(id, workspaceID string) bool {
 }
 
 func (s *Store) PushForWorkspace(workspaceID string) []port.StoredPush {
+	page := s.ListPushForWorkspace(workspaceID, 0, "")
+	return page.Items
+}
+
+func (s *Store) ListPushForWorkspace(workspaceID string, limit int, cursor string) port.InboxPushPage {
 	s.mu.RLock()
 	defer s.mu.RUnlock()
-	return append([]port.StoredPush(nil), s.pushes[workspaceID]...)
+
+	items, nextCursor, hasMore := paginateByID(s.pushes[workspaceID], limit, cursor, func(item port.StoredPush) string {
+		return item.ID
+	})
+	return port.InboxPushPage{Items: items, NextCursor: nextCursor, HasMore: hasMore}
 }
 
 func (s *Store) PushByIDForWorkspace(id, workspaceID string) (port.StoredPush, bool) {
@@ -192,9 +238,18 @@ func (s *Store) DeletePushByIDForWorkspace(id, workspaceID string) bool {
 }
 
 func (s *Store) ChatForWorkspace(workspaceID string) []port.StoredChat {
+	page := s.ListChatForWorkspace(workspaceID, 0, "")
+	return page.Items
+}
+
+func (s *Store) ListChatForWorkspace(workspaceID string, limit int, cursor string) port.InboxChatPage {
 	s.mu.RLock()
 	defer s.mu.RUnlock()
-	return append([]port.StoredChat(nil), s.chats[workspaceID]...)
+
+	items, nextCursor, hasMore := paginateByID(s.chats[workspaceID], limit, cursor, func(item port.StoredChat) string {
+		return item.ID
+	})
+	return port.InboxChatPage{Items: items, NextCursor: nextCursor, HasMore: hasMore}
 }
 
 func (s *Store) ChatByIDForWorkspace(id, workspaceID string) (port.StoredChat, bool) {
diff --git a/internal/infrastructure/inbox/store_pagination_test.go b/internal/infrastructure/inbox/store_pagination_test.go
new file mode 100644
index 00000000..c3c19008
--- /dev/null
+++ b/internal/infrastructure/inbox/store_pagination_test.go
@@ -0,0 +1,85 @@
+package inbox
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"github.com/weprodev/wpd-message-gateway/pkg/contracts"
+)
+
+func TestStore_ListSMSForWorkspace_pagination(t *testing.T) {
+	t.Parallel()
+
+	ctx := context.Background()
+	store := NewStore()
+	workspaceID := "ws-paginate"
+
+	var ids []string
+	for i := 0; i < 5; i++ {
+		id, err := store.WriteSMS(ctx, workspaceID, contracts.SMS{
+			To:      []string{"+15550001111"},
+			Message: fmt.Sprintf("msg-%d", i),
+		})
+		if err != nil {
+			t.Fatalf("WriteSMS %d: %v", i, err)
+		}
+		ids = append(ids, id)
+	}
+
+	// Newest first: ids[4], ids[3], ids[2], ids[1], ids[0]
+	page1 := store.ListSMSForWorkspace(workspaceID, 2, "")
+	if len(page1.Items) != 2 {
+		t.Fatalf("page1 len = %d, want 2", len(page1.Items))
+	}
+	if page1.Items[0].ID != ids[4] || page1.Items[1].ID != ids[3] {
+		t.Fatalf("page1 order = [%s, %s], want [%s, %s]", page1.Items[0].ID, page1.Items[1].ID, ids[4], ids[3])
+	}
+	if !page1.HasMore || page1.NextCursor != ids[3] {
+		t.Fatalf("page1 cursor/hasMore = (%q, %v), want (%q, true)", page1.NextCursor, page1.HasMore, ids[3])
+	}
+
+	page2 := store.ListSMSForWorkspace(workspaceID, 2, page1.NextCursor)
+	if len(page2.Items) != 2 {
+		t.Fatalf("page2 len = %d, want 2", len(page2.Items))
+	}
+	if page2.Items[0].ID != ids[2] || page2.Items[1].ID != ids[1] {
+		t.Fatalf("page2 order = [%s, %s], want [%s, %s]", page2.Items[0].ID, page2.Items[1].ID, ids[2], ids[1])
+	}
+	if !page2.HasMore || page2.NextCursor != ids[1] {
+		t.Fatalf("page2 cursor/hasMore = (%q, %v), want (%q, true)", page2.NextCursor, page2.HasMore, ids[1])
+	}
+
+	page3 := store.ListSMSForWorkspace(workspaceID, 2, page2.NextCursor)
+	if len(page3.Items) != 1 {
+		t.Fatalf("page3 len = %d, want 1", len(page3.Items))
+	}
+	if page3.Items[0].ID != ids[0] {
+		t.Fatalf("page3 item = %s, want %s", page3.Items[0].ID, ids[0])
+	}
+	if page3.HasMore || page3.NextCursor != "" {
+		t.Fatalf("page3 should be last page, got cursor=%q hasMore=%v", page3.NextCursor, page3.HasMore)
+	}
+}
+
+func TestStore_ListSMSForWorkspace_defaultLimit(t *testing.T) {
+	t.Parallel()
+
+	ctx := context.Background()
+	store := NewStore()
+	workspaceID := "ws-default-limit"
+
+	for i := 0; i < defaultInboxPageSize+1; i++ {
+		if _, err := store.WriteSMS(ctx, workspaceID, contracts.SMS{To: []string{"+1"}, Message: "x"}); err != nil {
+			t.Fatalf("WriteSMS: %v", err)
+		}
+	}
+
+	page := store.ListSMSForWorkspace(workspaceID, 0, "")
+	if len(page.Items) != defaultInboxPageSize {
+		t.Fatalf("default page size = %d, want %d", len(page.Items), defaultInboxPageSize)
+	}
+	if !page.HasMore {
+		t.Fatal("expected hasMore with default limit")
+	}
+}
diff --git a/internal/infrastructure/logger/logger.go b/internal/infrastructure/logger/logger.go
index 5be26074..549c3ec7 100644
--- a/internal/infrastructure/logger/logger.go
+++ b/internal/infrastructure/logger/logger.go
@@ -23,30 +23,10 @@ import (
 	"log/slog"
 
 	pkglogger "github.com/weprodev/go-pkg/logger"
-)
-
-// contextKey is an unexported type for keys stored in context.Context.
-type contextKey string
 
-const (
-	keyWorkspaceID contextKey = "workspace_id"
-	keyAPIKeyID    contextKey = "api_key_id"
-	keyChannel     contextKey = "channel"
-	keyProvider    contextKey = "provider"
-	keyRequestID   contextKey = "request_id"
+	"github.com/weprodev/wpd-message-gateway/internal/core/logctx"
 )
 
-// WithRequestID returns a context enriched with request_id (correlation ID).
-func WithRequestID(ctx context.Context, requestID string) context.Context {
-	return context.WithValue(ctx, keyRequestID, requestID)
-}
-
-// GetRequestID retrieves the request_id from context.
-func GetRequestID(ctx context.Context) string {
-	v, _ := ctx.Value(keyRequestID).(string)
-	return v
-}
-
 // ContextHandler extracts request context fields and appends them to slog.Record.
 type ContextHandler struct {
 	next slog.Handler
@@ -66,7 +46,7 @@ func (h *ContextHandler) Handle(ctx context.Context, r slog.Record) error {
 		return h.next.Handle(ctx, r)
 	}
 
-	attrs := Attrs(ctx)
+	attrs := logctx.Attrs(ctx)
 	for i := 0; i < len(attrs); i += 2 {
 		key, ok := attrs[i].(string)
 		if ok {
@@ -99,7 +79,7 @@ func New(env string, extraHandlers ...slog.Handler) (*pkglogger.Logger, error) {
 
 	extractors := []pkglogger.ContextExtractor{
 		func(ctx context.Context) []any {
-			return Attrs(ctx)
+			return logctx.Attrs(ctx)
 		},
 	}
 
@@ -120,43 +100,34 @@ func New(env string, extraHandlers ...slog.Handler) (*pkglogger.Logger, error) {
 	return log, nil
 }
 
+// WithRequestID returns a context enriched with request_id (correlation ID).
+func WithRequestID(ctx context.Context, requestID string) context.Context {
+	return logctx.WithRequestID(ctx, requestID)
+}
+
+// GetRequestID retrieves the request_id from context.
+func GetRequestID(ctx context.Context) string {
+	return logctx.GetRequestID(ctx)
+}
+
 // WithWorkspace returns a context enriched with workspace and api-key identifiers.
-// Pass this context into handler calls so structured log records carry these fields.
 func WithWorkspace(ctx context.Context, workspaceID, apiKeyID string) context.Context {
-	ctx = context.WithValue(ctx, keyWorkspaceID, workspaceID)
-	ctx = context.WithValue(ctx, keyAPIKeyID, apiKeyID)
-	return ctx
+	return logctx.WithWorkspace(ctx, workspaceID, apiKeyID)
 }
 
 // WithChannel enriches a context with the active message channel (email/sms/push/chat).
 func WithChannel(ctx context.Context, channel string) context.Context {
-	return context.WithValue(ctx, keyChannel, channel)
+	return logctx.WithChannel(ctx, channel)
 }
 
 // WithProvider enriches a context with the resolved provider name.
 func WithProvider(ctx context.Context, provider string) context.Context {
-	return context.WithValue(ctx, keyProvider, provider)
+	return logctx.WithProvider(ctx, provider)
 }
 
 // Attrs extracts gateway correlation fields from ctx for go-pkg ContextExtractors.
 func Attrs(ctx context.Context) []any {
-	attrs := make([]any, 0, 10)
-	if v, _ := ctx.Value(keyWorkspaceID).(string); v != "" {
-		attrs = append(attrs, "workspace_id", v)
-	}
-	if v, _ := ctx.Value(keyAPIKeyID).(string); v != "" {
-		attrs = append(attrs, "api_key_id", v)
-	}
-	if v, _ := ctx.Value(keyChannel).(string); v != "" {
-		attrs = append(attrs, "channel", v)
-	}
-	if v, _ := ctx.Value(keyProvider).(string); v != "" {
-		attrs = append(attrs, "provider", v)
-	}
-	if v, _ := ctx.Value(keyRequestID).(string); v != "" {
-		attrs = append(attrs, "request_id", v)
-	}
-	return attrs
+	return logctx.Attrs(ctx)
 }
 
 func isLocalEnv(env string) bool {
diff --git a/internal/infrastructure/repository/postgres/api_key_repository_test.go b/internal/infrastructure/repository/postgres/api_key_repository_test.go
new file mode 100644
index 00000000..7e76e6dd
--- /dev/null
+++ b/internal/infrastructure/repository/postgres/api_key_repository_test.go
@@ -0,0 +1,72 @@
+package postgres
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"testing"
+	"time"
+
+	"github.com/DATA-DOG/go-sqlmock"
+
+	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
+	"github.com/weprodev/wpd-message-gateway/internal/core/port"
+)
+
+func TestAPIKeyRepository_Create(t *testing.T) {
+	t.Parallel()
+
+	client, mock, _ := newMockPgClient(t)
+	repo := NewAPIKeyRepository(client)
+	createdAt := time.Date(2026, 7, 4, 10, 0, 0, 0, time.UTC)
+
+	mock.ExpectQuery(`INSERT INTO api_keys`).
+		WithArgs("ws-1", "client-1", "hash", "Demo", true, nil).
+		WillReturnRows(sqlmock.NewRows([]string{"id", "created_at"}).AddRow("key-1", createdAt))
+
+	key := &domain.APIKey{
+		WorkspaceID:      "ws-1",
+		ClientID:         "client-1",
+		ClientSecretHash: "hash",
+		Name:             "Demo",
+		IsActive:         true,
+	}
+	if err := repo.Create(context.Background(), key); err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+	if key.ID != "key-1" || !key.CreatedAt.Equal(createdAt) {
+		t.Fatalf("unexpected key after create: %+v", key)
+	}
+}
+
+func TestAPIKeyRepository_GetByClientID_notFound(t *testing.T) {
+	t.Parallel()
+
+	client, mock, _ := newMockPgClient(t)
+	repo := NewAPIKeyRepository(client)
+
+	mock.ExpectQuery(`SELECT id, workspace_id`).
+		WithArgs("missing").
+		WillReturnError(sql.ErrNoRows)
+
+	_, err := repo.GetByClientID(context.Background(), "missing")
+	if err == nil || !errors.Is(err, port.ErrNotFound) {
+		t.Fatalf("expected ErrNotFound, got %v", err)
+	}
+}
+
+func TestAPIKeyRepository_Delete_notFound(t *testing.T) {
+	t.Parallel()
+
+	client, mock, _ := newMockPgClient(t)
+	repo := NewAPIKeyRepository(client)
+
+	mock.ExpectExec(`DELETE FROM api_keys WHERE id = \$1`).
+		WithArgs("key-missing").
+		WillReturnResult(sqlmock.NewResult(0, 0))
+
+	err := repo.Delete(context.Background(), "key-missing")
+	if err == nil || !errors.Is(err, port.ErrNotFound) {
+		t.Fatalf("expected ErrNotFound, got %v", err)
+	}
+}
diff --git a/internal/infrastructure/repository/postgres/invitation_repository.go b/internal/infrastructure/repository/postgres/invitation_repository.go
index 2ea12098..a446d9ac 100644
--- a/internal/infrastructure/repository/postgres/invitation_repository.go
+++ b/internal/infrastructure/repository/postgres/invitation_repository.go
@@ -19,13 +19,18 @@ func NewInvitationRepository(client *pgsql.PgClient) port.InvitationRepository {
 }
 
 func (r *InvitationRepository) Create(ctx context.Context, inv *domain.Invitation) error {
+	roleID, err := lookupRoleIDByName(ctx, r.client.GetDB(ctx), inv.Role)
+	if err != nil {
+		return err
+	}
+
 	query := `
-		INSERT INTO invitations (workspace_id, email, role, token_hash, expires_at, status)
+		INSERT INTO invitations (workspace_id, email, role_id, token_hash, expires_at, status)
 		VALUES ($1, $2, $3, $4, $5, $6)
 		RETURNING id, created_at
 	`
-	err := r.client.GetDB(ctx).QueryRowContext(ctx, query,
-		inv.WorkspaceID, inv.Email, inv.Role, inv.TokenHash, inv.ExpiresAt, inv.Status,
+	err = r.client.GetDB(ctx).QueryRowContext(ctx, query,
+		inv.WorkspaceID, inv.Email, roleID, inv.TokenHash, inv.ExpiresAt, inv.Status,
 	).Scan(&inv.ID, &inv.CreatedAt)
 	if err != nil {
 		slog.ErrorContext(ctx, "database error: failed to create invitation", "error", err, "workspace_id", inv.WorkspaceID, "email", inv.Email, "role", inv.Role)
@@ -35,10 +40,11 @@ func (r *InvitationRepository) Create(ctx context.Context, inv *domain.Invitatio
 
 func (r *InvitationRepository) ListPendingByWorkspace(ctx context.Context, workspaceID string) ([]domain.Invitation, error) {
 	rows, err := r.client.GetDB(ctx).QueryContext(ctx, `
-		SELECT id, workspace_id, email, role, token_hash, expires_at, status, created_at
-		FROM invitations
-		WHERE workspace_id = $1 AND status = 'pending' AND expires_at > NOW()
-		ORDER BY created_at DESC
+		SELECT i.id, i.workspace_id, i.email, r.name, i.token_hash, i.expires_at, i.status, i.created_at
+		FROM invitations i
+		INNER JOIN roles r ON r.id = i.role_id
+		WHERE i.workspace_id = $1 AND i.status = 'pending' AND i.expires_at > NOW()
+		ORDER BY i.created_at DESC
 	`, workspaceID)
 	if err != nil {
 		slog.ErrorContext(ctx, "database error: failed to list pending invitations", "error", err, "workspace_id", workspaceID)
diff --git a/internal/infrastructure/repository/postgres/invitation_repository_test.go b/internal/infrastructure/repository/postgres/invitation_repository_test.go
new file mode 100644
index 00000000..0500a870
--- /dev/null
+++ b/internal/infrastructure/repository/postgres/invitation_repository_test.go
@@ -0,0 +1,67 @@
+package postgres
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/DATA-DOG/go-sqlmock"
+
+	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
+)
+
+func TestInvitationRepository_Create(t *testing.T) {
+	t.Parallel()
+
+	client, mock, _ := newMockPgClient(t)
+	repo := NewInvitationRepository(client)
+	createdAt := time.Date(2026, 7, 4, 12, 0, 0, 0, time.UTC)
+	expiresAt := createdAt.Add(7 * 24 * time.Hour)
+
+	mock.ExpectQuery(`SELECT id FROM roles WHERE name`).
+		WithArgs("member", domain.RBACGuardName).
+		WillReturnRows(sqlmock.NewRows([]string{"id"}).AddRow("role-member-id"))
+	mock.ExpectQuery(`INSERT INTO invitations`).
+		WithArgs("ws-1", "invitee@example.com", "role-member-id", "hash", expiresAt, "pending").
+		WillReturnRows(sqlmock.NewRows([]string{"id", "created_at"}).AddRow("inv-1", createdAt))
+
+	inv := &domain.Invitation{
+		WorkspaceID: "ws-1",
+		Email:       "invitee@example.com",
+		Role:        domain.RoleMember,
+		TokenHash:   "hash",
+		ExpiresAt:   expiresAt,
+		Status:      "pending",
+	}
+	if err := repo.Create(context.Background(), inv); err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+	if inv.ID != "inv-1" || !inv.CreatedAt.Equal(createdAt) {
+		t.Fatalf("unexpected invitation after create: %+v", inv)
+	}
+}
+
+func TestInvitationRepository_ListPendingByWorkspace(t *testing.T) {
+	t.Parallel()
+
+	client, mock, _ := newMockPgClient(t)
+	repo := NewInvitationRepository(client)
+	createdAt := time.Date(2026, 7, 4, 12, 0, 0, 0, time.UTC)
+	expiresAt := createdAt.Add(24 * time.Hour)
+
+	rows := sqlmock.NewRows([]string{
+		"id", "workspace_id", "email", "name", "token_hash", "expires_at", "status", "created_at",
+	}).AddRow("inv-1", "ws-1", "a@b.com", "member", "hash", expiresAt, "pending", createdAt)
+
+	mock.ExpectQuery(`FROM invitations i`).
+		WithArgs("ws-1").
+		WillReturnRows(rows)
+
+	list, err := repo.ListPendingByWorkspace(context.Background(), "ws-1")
+	if err != nil {
+		t.Fatalf("ListPendingByWorkspace: %v", err)
+	}
+	if len(list) != 1 || list[0].Email != "a@b.com" || list[0].Role != domain.RoleMember {
+		t.Fatalf("unexpected list: %+v", list)
+	}
+}
diff --git a/internal/infrastructure/repository/postgres/message_request_log_repository.go b/internal/infrastructure/repository/postgres/message_request_log_repository.go
index 3343293d..35cf2f1f 100644
--- a/internal/infrastructure/repository/postgres/message_request_log_repository.go
+++ b/internal/infrastructure/repository/postgres/message_request_log_repository.go
@@ -76,20 +76,18 @@ func (r *MessageRequestLogRepository) insertPayload(ctx context.Context, log *do
 
 func scanMessageRequestLogWithSource(
 	scanner interface{ Scan(dest ...any) error },
-) (domain.MessageRequestLogWithSource, int64, error) {
+) (domain.MessageRequestLogWithSource, error) {
 	var row domain.MessageRequestLogWithSource
 	var apiKeyID, reqID, errMsg, prov, inboxID sql.NullString
 	var dur sql.NullInt64
-	var totalCount int64
 
 	err := scanner.Scan(
 		&row.ID, &row.WorkspaceID, &apiKeyID, &row.ChannelType, &row.HTTPMethod, &row.StatusCode, &row.Endpoint,
 		&prov, &reqID, &dur, &errMsg, &inboxID, &row.CreatedAt,
 		&row.SourceName, &row.ClientID,
-		&totalCount,
 	)
 	if err != nil {
-		return row, 0, err
+		return row, err
 	}
 
 	row.APIKeyID = optionalStringFromNull(apiKeyID)
@@ -101,7 +99,7 @@ func scanMessageRequestLogWithSource(
 		row.DurationMs = int(dur.Int64)
 	}
 
-	return row, totalCount, nil
+	return row, nil
 }
 
 func (r *MessageRequestLogRepository) ListWithSource(ctx context.Context, q port.MessageLogQuery) ([]domain.MessageRequestLogWithSource, int, error) {
@@ -125,11 +123,18 @@ func (r *MessageRequestLogRepository) ListWithSource(ctx context.Context, q port
 	}
 
 	limit, offset := clampLimitOffset(q.Limit, q.Offset)
+
+	countQuery := fmt.Sprintf(`SELECT COUNT(*) FROM message_request_logs l WHERE %s`, where)
+	var total int
+	if err := db.QueryRowContext(ctx, countQuery, args...).Scan(&total); err != nil {
+		slog.ErrorContext(ctx, "database error: failed to count message request logs", "error", err)
+		return nil, 0, err
+	}
+
 	listQuery := fmt.Sprintf(`
 		SELECT l.id, l.workspace_id, l.api_key_id, l.channel_type, l.http_method, l.status_code, l.endpoint,
 			l.provider_name, l.request_id, l.duration_ms, l.error_message, l.inbox_message_id, l.created_at,
-			COALESCE(k.name, ''), COALESCE(k.client_id, ''),
-			COUNT(*) OVER() AS total_count
+			COALESCE(k.name, ''), COALESCE(k.client_id, '')
 		FROM message_request_logs l
 		LEFT JOIN api_keys k ON k.id = l.api_key_id
 		WHERE %s
@@ -144,16 +149,12 @@ func (r *MessageRequestLogRepository) ListWithSource(ctx context.Context, q port
 	defer rows.Close() //nolint:errcheck
 
 	var out []domain.MessageRequestLogWithSource
-	total := 0
 	for rows.Next() {
-		row, totalCount, err := scanMessageRequestLogWithSource(rows)
+		row, err := scanMessageRequestLogWithSource(rows)
 		if err != nil {
 			slog.ErrorContext(ctx, "database error: failed to scan message request log", "error", err)
 			return nil, 0, err
 		}
-		if total == 0 {
-			total = int(totalCount)
-		}
 		out = append(out, row)
 	}
 	if err := rows.Err(); err != nil {
diff --git a/internal/infrastructure/repository/postgres/message_request_log_repository_test.go b/internal/infrastructure/repository/postgres/message_request_log_repository_test.go
index b7edfb64..443b8a04 100644
--- a/internal/infrastructure/repository/postgres/message_request_log_repository_test.go
+++ b/internal/infrastructure/repository/postgres/message_request_log_repository_test.go
@@ -21,11 +21,11 @@ func TestScanMessageRequestLogWithSource_nullInboxMessageID(t *testing.T) {
 	rows := sqlmock.NewRows([]string{
 		"id", "workspace_id", "api_key_id", "channel_type", "http_method", "status_code", "endpoint",
 		"provider_name", "request_id", "duration_ms", "error_message", "inbox_message_id", "created_at",
-		"source_name", "client_id", "total_count",
+		"source_name", "client_id",
 	}).AddRow(
 		"log-1", "ws-1", nil, "email", "POST", 200, "/v1/email",
 		"memory", nil, 12, nil, nil, createdAt,
-		"Demo Key", "demo-client", int64(1),
+		"Demo Key", "demo-client",
 	)
 
 	mock.ExpectQuery("SELECT").WillReturnRows(rows)
@@ -40,7 +40,7 @@ func TestScanMessageRequestLogWithSource_nullInboxMessageID(t *testing.T) {
 		t.Fatal("expected one row")
 	}
 
-	row, total, err := scanMessageRequestLogWithSource(resultRows)
+	row, err := scanMessageRequestLogWithSource(resultRows)
 	if err != nil {
 		t.Fatalf("scanMessageRequestLogWithSource: %v", err)
 	}
@@ -51,9 +51,6 @@ func TestScanMessageRequestLogWithSource_nullInboxMessageID(t *testing.T) {
 	if row.ProviderName != "memory" {
 		t.Fatalf("ProviderName: got %q", row.ProviderName)
 	}
-	if total != 1 {
-		t.Fatalf("total: got %d", total)
-	}
 }
 
 func TestScanMessageRequestLogWithSource_withInboxMessageID(t *testing.T) {
@@ -70,11 +67,11 @@ func TestScanMessageRequestLogWithSource_withInboxMessageID(t *testing.T) {
 	rows := sqlmock.NewRows([]string{
 		"id", "workspace_id", "api_key_id", "channel_type", "http_method", "status_code", "endpoint",
 		"provider_name", "request_id", "duration_ms", "error_message", "inbox_message_id", "created_at",
-		"source_name", "client_id", "total_count",
+		"source_name", "client_id",
 	}).AddRow(
 		"log-2", "ws-1", nil, "email", "POST", 200, "/v1/email",
 		"memory", nil, 12, nil, inboxID, createdAt,
-		"Demo Key", "demo-client", int64(1),
+		"Demo Key", "demo-client",
 	)
 
 	mock.ExpectQuery("SELECT").WillReturnRows(rows)
@@ -89,7 +86,7 @@ func TestScanMessageRequestLogWithSource_withInboxMessageID(t *testing.T) {
 		t.Fatal("expected one row")
 	}
 
-	row, _, err := scanMessageRequestLogWithSource(resultRows)
+	row, err := scanMessageRequestLogWithSource(resultRows)
 	if err != nil {
 		t.Fatalf("scanMessageRequestLogWithSource: %v", err)
 	}
diff --git a/internal/infrastructure/repository/postgres/role_lookup.go b/internal/infrastructure/repository/postgres/role_lookup.go
new file mode 100644
index 00000000..68ae2cee
--- /dev/null
+++ b/internal/infrastructure/repository/postgres/role_lookup.go
@@ -0,0 +1,26 @@
+package postgres
+
+import (
+	"context"
+	"database/sql"
+	"fmt"
+	"log/slog"
+
+	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
+)
+
+type queryRower interface {
+	QueryRowContext(ctx context.Context, query string, args ...any) *sql.Row
+}
+
+func lookupRoleIDByName(ctx context.Context, db queryRower, roleName string) (string, error) {
+	var roleID string
+	err := db.QueryRowContext(ctx, `
+		SELECT id FROM roles WHERE name = $1 AND guard_name = $2
+	`, roleName, domain.RBACGuardName).Scan(&roleID)
+	if err != nil {
+		slog.ErrorContext(ctx, "database error: lookup role failed", "error", err, "role", roleName)
+		return "", fmt.Errorf("wpd-message-gateway: lookup role %q: %w", roleName, err)
+	}
+	return roleID, nil
+}
diff --git a/internal/infrastructure/repository/postgres/role_lookup_test.go b/internal/infrastructure/repository/postgres/role_lookup_test.go
new file mode 100644
index 00000000..38d6a199
--- /dev/null
+++ b/internal/infrastructure/repository/postgres/role_lookup_test.go
@@ -0,0 +1,32 @@
+package postgres
+
+import (
+	"context"
+	"testing"
+
+	"github.com/DATA-DOG/go-sqlmock"
+
+	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
+)
+
+func TestLookupRoleIDByName(t *testing.T) {
+	t.Parallel()
+
+	db, mock, err := sqlmock.New()
+	if err != nil {
+		t.Fatalf("sqlmock.New: %v", err)
+	}
+	t.Cleanup(func() { _ = db.Close() })
+
+	mock.ExpectQuery(`SELECT id FROM roles WHERE name = \$1 AND guard_name = \$2`).
+		WithArgs("admin", domain.RBACGuardName).
+		WillReturnRows(sqlmock.NewRows([]string{"id"}).AddRow("role-admin-id"))
+
+	roleID, err := lookupRoleIDByName(context.Background(), db, "admin")
+	if err != nil {
+		t.Fatalf("lookupRoleIDByName: %v", err)
+	}
+	if roleID != "role-admin-id" {
+		t.Fatalf("roleID: got %q", roleID)
+	}
+}
diff --git a/internal/infrastructure/repository/postgres/sqlmock_client_test.go b/internal/infrastructure/repository/postgres/sqlmock_client_test.go
new file mode 100644
index 00000000..70b8d46d
--- /dev/null
+++ b/internal/infrastructure/repository/postgres/sqlmock_client_test.go
@@ -0,0 +1,21 @@
+package postgres
+
+import (
+	"database/sql"
+	"testing"
+
+	"github.com/DATA-DOG/go-sqlmock"
+	"github.com/weprodev/go-pkg/pgsql"
+)
+
+func newMockPgClient(t *testing.T) (*pgsql.PgClient, sqlmock.Sqlmock, *sql.DB) {
+	t.Helper()
+
+	db, mock, err := sqlmock.New()
+	if err != nil {
+		t.Fatalf("sqlmock.New: %v", err)
+	}
+	t.Cleanup(func() { _ = db.Close() })
+
+	return &pgsql.PgClient{DB: db}, mock, db
+}
diff --git a/internal/infrastructure/repository/postgres/template_repository_test.go b/internal/infrastructure/repository/postgres/template_repository_test.go
new file mode 100644
index 00000000..8c10e04e
--- /dev/null
+++ b/internal/infrastructure/repository/postgres/template_repository_test.go
@@ -0,0 +1,73 @@
+package postgres
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"testing"
+	"time"
+
+	"github.com/DATA-DOG/go-sqlmock"
+
+	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
+	"github.com/weprodev/wpd-message-gateway/internal/core/port"
+)
+
+func TestTemplateRepository_Create(t *testing.T) {
+	t.Parallel()
+
+	client, mock, _ := newMockPgClient(t)
+	repo := NewTemplateRepository(client)
+	now := time.Date(2026, 7, 4, 12, 0, 0, 0, time.UTC)
+
+	mock.ExpectQuery(`INSERT INTO templates`).
+		WithArgs("ws-1", "Welcome", "welcome", "email", nil, nil, "<p>hi</p>", true, false).
+		WillReturnRows(sqlmock.NewRows([]string{"id", "created_at", "updated_at"}).AddRow("tpl-1", now, now))
+
+	tpl := &domain.Template{
+		WorkspaceID: "ws-1",
+		Name:        "Welcome",
+		UniqueKey:   "welcome",
+		ChannelType: "email",
+		ContentHTML: "<p>hi</p>",
+		IsActive:    true,
+	}
+	if err := repo.Create(context.Background(), tpl); err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+	if tpl.ID != "tpl-1" {
+		t.Fatalf("unexpected template: %+v", tpl)
+	}
+}
+
+func TestTemplateRepository_GetByWorkspaceAndKey_notFound(t *testing.T) {
+	t.Parallel()
+
+	client, mock, _ := newMockPgClient(t)
+	repo := NewTemplateRepository(client)
+
+	mock.ExpectQuery(`FROM templates`).
+		WithArgs("ws-1", "missing").
+		WillReturnError(sql.ErrNoRows)
+
+	_, err := repo.GetByWorkspaceAndKey(context.Background(), "ws-1", "missing")
+	if err == nil || !errors.Is(err, port.ErrNotFound) {
+		t.Fatalf("expected ErrNotFound, got %v", err)
+	}
+}
+
+func TestTemplateRepository_Delete_notFound(t *testing.T) {
+	t.Parallel()
+
+	client, mock, _ := newMockPgClient(t)
+	repo := NewTemplateRepository(client)
+
+	mock.ExpectExec(`DELETE FROM templates WHERE id`).
+		WithArgs("tpl-missing").
+		WillReturnResult(sqlmock.NewResult(0, 0))
+
+	err := repo.Delete(context.Background(), "tpl-missing")
+	if err == nil || !errors.Is(err, port.ErrNotFound) {
+		t.Fatalf("expected ErrNotFound, got %v", err)
+	}
+}
diff --git a/internal/infrastructure/repository/postgres/workspace_member_repository.go b/internal/infrastructure/repository/postgres/workspace_member_repository.go
index 6c1c35d1..b08b604f 100644
--- a/internal/infrastructure/repository/postgres/workspace_member_repository.go
+++ b/internal/infrastructure/repository/postgres/workspace_member_repository.go
@@ -22,12 +22,9 @@ func NewWorkspaceMemberRepository(client *pgsql.PgClient) port.WorkspaceMemberRe
 }
 
 func (r *WorkspaceMemberRepository) Add(ctx context.Context, workspaceID, userID, role string) error {
-	// Look up role ID from the roles table by name
-	var roleID string
-	err := r.client.GetDB(ctx).QueryRowContext(ctx, `SELECT id FROM roles WHERE name = $1`, role).Scan(&roleID)
+	roleID, err := lookupRoleIDByName(ctx, r.client.GetDB(ctx), role)
 	if err != nil {
-		slog.ErrorContext(ctx, "database error: lookup role failed", "error", err, "role", role)
-		return fmt.Errorf("wpd-message-gateway: lookup role %q: %w", role, err)
+		return err
 	}
 
 	_, err = r.client.GetDB(ctx).ExecContext(ctx, `
diff --git a/internal/infrastructure/repository/postgres/workspace_member_repository_test.go b/internal/infrastructure/repository/postgres/workspace_member_repository_test.go
new file mode 100644
index 00000000..8d473ea5
--- /dev/null
+++ b/internal/infrastructure/repository/postgres/workspace_member_repository_test.go
@@ -0,0 +1,72 @@
+package postgres
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"testing"
+	"time"
+
+	"github.com/DATA-DOG/go-sqlmock"
+
+	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
+	"github.com/weprodev/wpd-message-gateway/internal/core/port"
+)
+
+func TestWorkspaceMemberRepository_Add(t *testing.T) {
+	t.Parallel()
+
+	client, mock, _ := newMockPgClient(t)
+	repo := NewWorkspaceMemberRepository(client)
+
+	mock.ExpectQuery(`SELECT id FROM roles WHERE name`).
+		WithArgs("admin", domain.RBACGuardName).
+		WillReturnRows(sqlmock.NewRows([]string{"id"}).AddRow("role-admin-id"))
+	mock.ExpectExec(`INSERT INTO workspace_members`).
+		WithArgs("ws-1", "user-1", "role-admin-id").
+		WillReturnResult(sqlmock.NewResult(1, 1))
+
+	if err := repo.Add(context.Background(), "ws-1", "user-1", domain.RoleAdmin); err != nil {
+		t.Fatalf("Add: %v", err)
+	}
+}
+
+func TestWorkspaceMemberRepository_GetRole_notFound(t *testing.T) {
+	t.Parallel()
+
+	client, mock, _ := newMockPgClient(t)
+	repo := NewWorkspaceMemberRepository(client)
+
+	mock.ExpectQuery(`FROM workspace_members wm`).
+		WithArgs("ws-1", "user-missing").
+		WillReturnError(sql.ErrNoRows)
+
+	_, err := repo.GetRole(context.Background(), "ws-1", "user-missing")
+	if err == nil || !errors.Is(err, port.ErrNotFound) {
+		t.Fatalf("expected ErrNotFound, got %v", err)
+	}
+}
+
+func TestWorkspaceMemberRepository_ListMembers(t *testing.T) {
+	t.Parallel()
+
+	client, mock, _ := newMockPgClient(t)
+	repo := NewWorkspaceMemberRepository(client)
+	joinedAt := time.Date(2026, 7, 4, 12, 0, 0, 0, time.UTC)
+
+	rows := sqlmock.NewRows([]string{
+		"workspace_id", "user_id", "name", "joined_at", "email", "display_name",
+	}).AddRow("ws-1", "user-1", "admin", joinedAt, "owner@example.com", "Owner User")
+
+	mock.ExpectQuery(`FROM workspace_members wm`).
+		WithArgs("ws-1").
+		WillReturnRows(rows)
+
+	members, err := repo.ListMembers(context.Background(), "ws-1")
+	if err != nil {
+		t.Fatalf("ListMembers: %v", err)
+	}
+	if len(members) != 1 || members[0].Role != domain.RoleAdmin || members[0].DisplayName != "Owner User" {
+		t.Fatalf("unexpected members: %+v", members)
+	}
+}
diff --git a/internal/infrastructure/repository/postgres/workspace_repository_test.go b/internal/infrastructure/repository/postgres/workspace_repository_test.go
new file mode 100644
index 00000000..3f355a1c
--- /dev/null
+++ b/internal/infrastructure/repository/postgres/workspace_repository_test.go
@@ -0,0 +1,67 @@
+package postgres
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"testing"
+	"time"
+
+	"github.com/DATA-DOG/go-sqlmock"
+
+	"github.com/weprodev/wpd-message-gateway/internal/core/port"
+)
+
+func TestWorkspaceRepository_GetByID(t *testing.T) {
+	t.Parallel()
+
+	client, mock, _ := newMockPgClient(t)
+	repo := NewWorkspaceRepository(client)
+	now := time.Date(2026, 7, 4, 12, 0, 0, 0, time.UTC)
+
+	mock.ExpectQuery(`FROM workspaces w`).
+		WithArgs("ws-1").
+		WillReturnRows(sqlmock.NewRows([]string{
+			"id", "name", "slug", "email", "status", "visibility", "hashed_pin_code", "icon_key", "created_at", "updated_at",
+		}).AddRow("ws-1", "Demo", "demo", "owner@example.com", "active", "public", nil, nil, now, now))
+
+	ws, err := repo.GetByID(context.Background(), "ws-1")
+	if err != nil {
+		t.Fatalf("GetByID: %v", err)
+	}
+	if ws.Name != "Demo" || ws.Slug != "demo" || ws.AdminEmail != "owner@example.com" {
+		t.Fatalf("unexpected workspace: %+v", ws)
+	}
+}
+
+func TestWorkspaceRepository_GetByID_notFound(t *testing.T) {
+	t.Parallel()
+
+	client, mock, _ := newMockPgClient(t)
+	repo := NewWorkspaceRepository(client)
+
+	mock.ExpectQuery(`FROM workspaces w`).
+		WithArgs("missing").
+		WillReturnError(sql.ErrNoRows)
+
+	_, err := repo.GetByID(context.Background(), "missing")
+	if err == nil || !errors.Is(err, port.ErrNotFound) {
+		t.Fatalf("expected ErrNotFound, got %v", err)
+	}
+}
+
+func TestWorkspaceRepository_GetBySlug_notFound(t *testing.T) {
+	t.Parallel()
+
+	client, mock, _ := newMockPgClient(t)
+	repo := NewWorkspaceRepository(client)
+
+	mock.ExpectQuery(`FROM workspaces w`).
+		WithArgs("missing-slug").
+		WillReturnError(sql.ErrNoRows)
+
+	_, err := repo.GetBySlug(context.Background(), "missing-slug")
+	if err == nil || !errors.Is(err, port.ErrNotFound) {
+		t.Fatalf("expected ErrNotFound, got %v", err)
+	}
+}
diff --git a/internal/presentation/dto/workspace.go b/internal/presentation/dto/workspace.go
index e0d1d11d..28c365b9 100644
--- a/internal/presentation/dto/workspace.go
+++ b/internal/presentation/dto/workspace.go
@@ -42,17 +42,6 @@ type CreateInvitationRequest struct {
 	Role  string `json:"role"`
 }
 
-// ToDomain maps the request to a domain invitation for persistence.
-func (r CreateInvitationRequest) ToDomain(workspaceID string, expiresAt time.Time) *domain.Invitation {
-	return &domain.Invitation{
-		WorkspaceID: workspaceID,
-		Email:       r.Email,
-		Role:        r.Role,
-		ExpiresAt:   expiresAt,
-		Status:      "pending",
-	}
-}
-
 // CreateInvitationResponse is returned once when an invitation is created.
 type CreateInvitationResponse struct {
 	ID        string    `json:"id"`
diff --git a/internal/presentation/handler/portal_auth_handler_test.go b/internal/presentation/handler/portal_auth_handler_test.go
new file mode 100644
index 00000000..5fc0ad06
--- /dev/null
+++ b/internal/presentation/handler/portal_auth_handler_test.go
@@ -0,0 +1,94 @@
+package handler
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/labstack/echo/v4"
+
+	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
+	"github.com/weprodev/wpd-message-gateway/internal/core/port"
+	"github.com/weprodev/wpd-message-gateway/internal/core/service"
+	"github.com/weprodev/wpd-message-gateway/pkg/contracts"
+)
+
+const handlerTestJWTSecret = "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+
+type authFakeUserRepo struct {
+	byEmail *domain.User
+	err     error
+}
+
+func (f *authFakeUserRepo) Create(context.Context, *domain.User) error { return nil }
+
+func (f *authFakeUserRepo) GetByEmail(_ context.Context, email string) (*domain.User, error) {
+	return f.byEmail, f.err
+}
+
+func (f *authFakeUserRepo) GetByID(context.Context, string) (*domain.User, error) {
+	return nil, port.ErrNotFound
+}
+
+func (f *authFakeUserRepo) SetEmailVerified(context.Context, string) error { return nil }
+
+type authFakeEmailSender struct{}
+
+func (authFakeEmailSender) Send(context.Context, contracts.Email) (*contracts.SendResult, error) {
+	return &contracts.SendResult{ID: "test-id"}, nil
+}
+
+func (authFakeEmailSender) Name() string { return "fake" }
+
+func newPortalAuthHandlerForTest(userRepo *authFakeUserRepo) *PortalAuthHandler {
+	authSvc := service.NewAuthService(userRepo, authFakeEmailSender{}, handlerTestJWTSecret, false, time.Hour, time.Hour, "")
+	portalSvc := service.NewPortalService(service.PortalDeps{})
+	return NewPortalAuthHandler(portalSvc, authSvc)
+}
+
+func TestPortalAuthHandler_Register_rejectsInvalidJSON(t *testing.T) {
+	t.Parallel()
+	e := echo.New()
+	h := newPortalAuthHandlerForTest(&authFakeUserRepo{})
+
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/auth/register", strings.NewReader("{not-json"))
+	req.Header.Set(echo.HeaderContentType, echo.MIMEApplicationJSON)
+	rec := httptest.NewRecorder()
+	c := e.NewContext(req, rec)
+
+	err := h.Register(c)
+	if err == nil {
+		t.Fatal("expected error")
+	}
+	var httpErr *echo.HTTPError
+	if !errors.As(err, &httpErr) || httpErr.Code != http.StatusBadRequest {
+		t.Fatalf("expected 400 invalid JSON, got %v", err)
+	}
+}
+
+func TestPortalAuthHandler_Login_returns401OnBadCredentials(t *testing.T) {
+	t.Parallel()
+	e := echo.New()
+	repo := &authFakeUserRepo{err: fmt.Errorf("lookup: %w", port.ErrNotFound)}
+	h := newPortalAuthHandlerForTest(repo)
+
+	body := `{"email":"nobody@example.com","password":"wrong-password"}`
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/auth/login", strings.NewReader(body))
+	req.Header.Set(echo.HeaderContentType, echo.MIMEApplicationJSON)
+	rec := httptest.NewRecorder()
+	c := e.NewContext(req, rec)
+
+	err := h.Login(c)
+	if err == nil {
+		t.Fatal("expected error")
+	}
+	var httpErr *echo.HTTPError
+	if !errors.As(err, &httpErr) || httpErr.Code != http.StatusUnauthorized {
+		t.Fatalf("expected 401, got %v", err)
+	}
+}
diff --git a/internal/presentation/handler/portal_handler_test.go b/internal/presentation/handler/portal_handler_test.go
new file mode 100644
index 00000000..48d06826
--- /dev/null
+++ b/internal/presentation/handler/portal_handler_test.go
@@ -0,0 +1,224 @@
+package handler
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/labstack/echo/v4"
+
+	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
+	"github.com/weprodev/wpd-message-gateway/internal/core/port"
+	"github.com/weprodev/wpd-message-gateway/internal/core/service"
+)
+
+type handlerFakeAPIKeyRepo struct {
+	keys    map[string]*domain.APIKey
+	byWS    map[string][]domain.APIKey
+	created *domain.APIKey
+	deleted string
+}
+
+func (f *handlerFakeAPIKeyRepo) Create(_ context.Context, k *domain.APIKey) error {
+	if f.keys == nil {
+		f.keys = make(map[string]*domain.APIKey)
+	}
+	if f.byWS == nil {
+		f.byWS = make(map[string][]domain.APIKey)
+	}
+	k.ID = "key-" + uuid.NewString()
+	f.created = k
+	f.keys[k.ID] = k
+	f.byWS[k.WorkspaceID] = append(f.byWS[k.WorkspaceID], *k)
+	return nil
+}
+
+func (f *handlerFakeAPIKeyRepo) GetByClientID(context.Context, string) (*domain.APIKey, error) {
+	return nil, port.ErrNotFound
+}
+
+func (f *handlerFakeAPIKeyRepo) GetByID(_ context.Context, id string) (*domain.APIKey, error) {
+	k, ok := f.keys[id]
+	if !ok {
+		return nil, port.ErrNotFound
+	}
+	return k, nil
+}
+
+func (f *handlerFakeAPIKeyRepo) ListByWorkspace(_ context.Context, workspaceID string) ([]domain.APIKey, error) {
+	return f.byWS[workspaceID], nil
+}
+
+func (f *handlerFakeAPIKeyRepo) Delete(_ context.Context, id string) error {
+	f.deleted = id
+	delete(f.keys, id)
+	return nil
+}
+
+func (f *handlerFakeAPIKeyRepo) UpdateSecret(context.Context, string, string, string) error {
+	return nil
+}
+
+func (f *handlerFakeAPIKeyRepo) UpdateLastUsedAt(context.Context, string) error {
+	return nil
+}
+
+type handlerFakeSettingsRepo struct {
+	values map[string]string
+}
+
+func (f *handlerFakeSettingsRepo) Get(_ context.Context, _, key string) (string, error) {
+	if f.values == nil {
+		return "", nil
+	}
+	return f.values[key], nil
+}
+
+func (f *handlerFakeSettingsRepo) Set(_ context.Context, _, key, value string) error {
+	if f.values == nil {
+		f.values = make(map[string]string)
+	}
+	f.values[key] = value
+	return nil
+}
+
+func (f *handlerFakeSettingsRepo) GetAll(_ context.Context, _ string) (map[string]string, error) {
+	return f.values, nil
+}
+
+func TestPortalHandler_CreateAPIKey(t *testing.T) {
+	t.Parallel()
+	e := echo.New()
+
+	repo := &handlerFakeAPIKeyRepo{}
+	svc := service.NewPortalService(service.PortalDeps{APIKeys: repo})
+	h := NewPortalHandler(svc)
+
+	body := `{"name":"Portal Key"}`
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/workspaces/ws-1/api-keys", strings.NewReader(body))
+	req.Header.Set(echo.HeaderContentType, echo.MIMEApplicationJSON)
+	rec := httptest.NewRecorder()
+	c := e.NewContext(req, rec)
+	c.SetParamNames("wid")
+	c.SetParamValues("ws-1")
+
+	if err := h.CreateAPIKey(c); err != nil {
+		t.Fatalf("CreateAPIKey: %v", err)
+	}
+	if rec.Code != http.StatusCreated {
+		t.Fatalf("expected 201, got %d body=%s", rec.Code, rec.Body.String())
+	}
+
+	var res map[string]any
+	if err := json.Unmarshal(rec.Body.Bytes(), &res); err != nil {
+		t.Fatalf("decode response: %v", err)
+	}
+	if res["name"] != "Portal Key" {
+		t.Fatalf("unexpected response: %+v", res)
+	}
+	secret, _ := res["client_secret"].(string)
+	if secret == "" {
+		t.Fatal("expected client_secret in response")
+	}
+}
+
+func TestPortalHandler_CreateAPIKey_rejectsMissingName(t *testing.T) {
+	t.Parallel()
+	e := echo.New()
+
+	h := NewPortalHandler(service.NewPortalService(service.PortalDeps{}))
+
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/workspaces/ws-1/api-keys", strings.NewReader(`{}`))
+	req.Header.Set(echo.HeaderContentType, echo.MIMEApplicationJSON)
+	rec := httptest.NewRecorder()
+	c := e.NewContext(req, rec)
+	c.SetParamNames("wid")
+	c.SetParamValues("ws-1")
+
+	err := h.CreateAPIKey(c)
+	if err == nil {
+		t.Fatal("expected validation error")
+	}
+	httpErr, ok := err.(*echo.HTTPError)
+	if !ok || httpErr.Code != http.StatusBadRequest {
+		t.Fatalf("expected 400, got %v", err)
+	}
+}
+
+func TestPortalHandler_ListAPIKeys(t *testing.T) {
+	t.Parallel()
+	e := echo.New()
+
+	ts := time.Now()
+	repo := &handlerFakeAPIKeyRepo{
+		byWS: map[string][]domain.APIKey{
+			"ws-1": {{
+				ID:          "key-1",
+				WorkspaceID: "ws-1",
+				ClientID:    "client-1",
+				Name:        "Demo",
+				IsActive:    true,
+				CreatedAt:   ts,
+			}},
+		},
+	}
+	svc := service.NewPortalService(service.PortalDeps{APIKeys: repo})
+	h := NewPortalHandler(svc)
+
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/workspaces/ws-1/api-keys", nil)
+	rec := httptest.NewRecorder()
+	c := e.NewContext(req, rec)
+	c.SetParamNames("wid")
+	c.SetParamValues("ws-1")
+
+	if err := h.ListAPIKeys(c); err != nil {
+		t.Fatalf("ListAPIKeys: %v", err)
+	}
+	if rec.Code != http.StatusOK {
+		t.Fatalf("expected 200, got %d", rec.Code)
+	}
+
+	var keys []map[string]any
+	if err := json.Unmarshal(rec.Body.Bytes(), &keys); err != nil {
+		t.Fatalf("decode response: %v", err)
+	}
+	if len(keys) != 1 || keys[0]["name"] != "Demo" {
+		t.Fatalf("unexpected keys: %+v", keys)
+	}
+}
+
+func TestPortalHandler_GetSettings(t *testing.T) {
+	t.Parallel()
+	e := echo.New()
+
+	settings := &handlerFakeSettingsRepo{
+		values: map[string]string{
+			domain.SettingKeyMessageDispatchMode: string(domain.DispatchMemory),
+		},
+	}
+	svc := service.NewPortalService(service.PortalDeps{Settings: settings})
+	h := NewPortalHandler(svc)
+
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/workspaces/ws-1/settings", nil)
+	rec := httptest.NewRecorder()
+	c := e.NewContext(req, rec)
+	c.SetParamNames("wid")
+	c.SetParamValues("ws-1")
+
+	if err := h.GetSettings(c); err != nil {
+		t.Fatalf("GetSettings: %v", err)
+	}
+
+	var res map[string]string
+	if err := json.Unmarshal(rec.Body.Bytes(), &res); err != nil {
+		t.Fatalf("decode response: %v", err)
+	}
+	if res[domain.SettingKeyMessageDispatchMode] != string(domain.DispatchMemory) {
+		t.Fatalf("unexpected settings: %+v", res)
+	}
+}
diff --git a/internal/presentation/handler/portal_inbox_handler.go b/internal/presentation/handler/portal_inbox_handler.go
index 548be158..26ed252e 100644
--- a/internal/presentation/handler/portal_inbox_handler.go
+++ b/internal/presentation/handler/portal_inbox_handler.go
@@ -67,7 +67,10 @@ func (h *PortalInboxHandler) HandleDeleteEmailByID(c echo.Context) error {
 }
 
 func (h *PortalInboxHandler) HandleGetSMS(c echo.Context) error {
-	return c.JSON(http.StatusOK, h.reader.SMSForWorkspace(workspaceIDParam(c)))
+	limit, _ := strconv.Atoi(c.QueryParam("limit"))
+	cursor := c.QueryParam("cursor")
+	page := h.reader.ListSMSForWorkspace(workspaceIDParam(c), limit, cursor)
+	return c.JSON(http.StatusOK, page)
 }
 
 func (h *PortalInboxHandler) HandleGetSMSByID(c echo.Context) error {
@@ -89,7 +92,10 @@ func (h *PortalInboxHandler) HandleDeleteSMSByID(c echo.Context) error {
 }
 
 func (h *PortalInboxHandler) HandleGetPush(c echo.Context) error {
-	return c.JSON(http.StatusOK, h.reader.PushForWorkspace(workspaceIDParam(c)))
+	limit, _ := strconv.Atoi(c.QueryParam("limit"))
+	cursor := c.QueryParam("cursor")
+	page := h.reader.ListPushForWorkspace(workspaceIDParam(c), limit, cursor)
+	return c.JSON(http.StatusOK, page)
 }
 
 func (h *PortalInboxHandler) HandleGetPushByID(c echo.Context) error {
@@ -111,7 +117,10 @@ func (h *PortalInboxHandler) HandleDeletePushByID(c echo.Context) error {
 }
 
 func (h *PortalInboxHandler) HandleGetChat(c echo.Context) error {
-	return c.JSON(http.StatusOK, h.reader.ChatForWorkspace(workspaceIDParam(c)))
+	limit, _ := strconv.Atoi(c.QueryParam("limit"))
+	cursor := c.QueryParam("cursor")
+	page := h.reader.ListChatForWorkspace(workspaceIDParam(c), limit, cursor)
+	return c.JSON(http.StatusOK, page)
 }
 
 func (h *PortalInboxHandler) HandleGetChatByID(c echo.Context) error {
diff --git a/internal/presentation/handler/portal_inbox_handler_test.go b/internal/presentation/handler/portal_inbox_handler_test.go
new file mode 100644
index 00000000..b3ddcaf1
--- /dev/null
+++ b/internal/presentation/handler/portal_inbox_handler_test.go
@@ -0,0 +1,147 @@
+package handler
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/labstack/echo/v4"
+
+	"github.com/weprodev/wpd-message-gateway/internal/infrastructure/inbox"
+	"github.com/weprodev/wpd-message-gateway/pkg/contracts"
+)
+
+func TestPortalInboxHandler_HandleGetEmails(t *testing.T) {
+	t.Parallel()
+	e := echo.New()
+
+	store := inbox.NewStore()
+	ctx := context.Background()
+	id, err := store.WriteEmail(ctx, "ws-1", contracts.Email{
+		To:      []string{"a@b.com"},
+		Subject: "Hello",
+		HTML:    "<p>hi</p>",
+	})
+	if err != nil {
+		t.Fatalf("WriteEmail: %v", err)
+	}
+
+	h := NewPortalInboxHandler(store, store)
+
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/workspaces/ws-1/inbox/emails?limit=10", nil)
+	rec := httptest.NewRecorder()
+	c := e.NewContext(req, rec)
+	c.SetParamNames("wid")
+	c.SetParamValues("ws-1")
+
+	if err := h.HandleGetEmails(c); err != nil {
+		t.Fatalf("HandleGetEmails: %v", err)
+	}
+	if rec.Code != http.StatusOK {
+		t.Fatalf("expected 200, got %d", rec.Code)
+	}
+
+	var page struct {
+		Items []struct {
+			ID string `json:"id"`
+		} `json:"items"`
+	}
+	if err := json.Unmarshal(rec.Body.Bytes(), &page); err != nil {
+		t.Fatalf("decode response: %v", err)
+	}
+	if len(page.Items) != 1 || page.Items[0].ID != id {
+		t.Fatalf("unexpected page: %+v", page)
+	}
+}
+
+func TestPortalInboxHandler_HandleGetSMS(t *testing.T) {
+	t.Parallel()
+	e := echo.New()
+
+	store := inbox.NewStore()
+	ctx := context.Background()
+	id, err := store.WriteSMS(ctx, "ws-1", contracts.SMS{
+		To:      []string{"+15550001111"},
+		Message: "ping",
+	})
+	if err != nil {
+		t.Fatalf("WriteSMS: %v", err)
+	}
+
+	h := NewPortalInboxHandler(store, store)
+
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/workspaces/ws-1/inbox/sms?limit=10", nil)
+	rec := httptest.NewRecorder()
+	c := e.NewContext(req, rec)
+	c.SetParamNames("wid")
+	c.SetParamValues("ws-1")
+
+	if err := h.HandleGetSMS(c); err != nil {
+		t.Fatalf("HandleGetSMS: %v", err)
+	}
+
+	var page struct {
+		Items []struct {
+			ID string `json:"id"`
+		} `json:"items"`
+	}
+	if err := json.Unmarshal(rec.Body.Bytes(), &page); err != nil {
+		t.Fatalf("decode response: %v", err)
+	}
+	if len(page.Items) != 1 || page.Items[0].ID != id {
+		t.Fatalf("unexpected page: %+v", page)
+	}
+}
+
+func TestPortalInboxHandler_HandleGetEmailByID_notFound(t *testing.T) {
+	t.Parallel()
+	e := echo.New()
+
+	h := NewPortalInboxHandler(inbox.NewStore(), inbox.NewStore())
+
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/workspaces/ws-1/inbox/emails/missing", nil)
+	rec := httptest.NewRecorder()
+	c := e.NewContext(req, rec)
+	c.SetParamNames("wid", "id")
+	c.SetParamValues("ws-1", "missing")
+
+	if err := h.HandleGetEmailByID(c); err != nil {
+		t.Fatalf("HandleGetEmailByID: %v", err)
+	}
+	if rec.Code != http.StatusNotFound {
+		t.Fatalf("expected 404, got %d", rec.Code)
+	}
+}
+
+func TestPortalInboxHandler_HandleStats(t *testing.T) {
+	t.Parallel()
+	e := echo.New()
+
+	store := inbox.NewStore()
+	ctx := context.Background()
+	if _, err := store.WriteEmail(ctx, "ws-1", contracts.Email{To: []string{"a@b.com"}, Subject: "s"}); err != nil {
+		t.Fatalf("WriteEmail: %v", err)
+	}
+
+	h := NewPortalInboxHandler(store, store)
+
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/workspaces/ws-1/inbox/stats", nil)
+	rec := httptest.NewRecorder()
+	c := e.NewContext(req, rec)
+	c.SetParamNames("wid")
+	c.SetParamValues("ws-1")
+
+	if err := h.HandleStats(c); err != nil {
+		t.Fatalf("HandleStats: %v", err)
+	}
+
+	var stats map[string]int
+	if err := json.Unmarshal(rec.Body.Bytes(), &stats); err != nil {
+		t.Fatalf("decode response: %v", err)
+	}
+	if stats["emails"] < 1 {
+		t.Fatalf("expected at least one email in stats, got %+v", stats)
+	}
+}
diff --git a/internal/presentation/handler/portal_workspace_handler.go b/internal/presentation/handler/portal_workspace_handler.go
index 7ba06885..d79b2b6a 100644
--- a/internal/presentation/handler/portal_workspace_handler.go
+++ b/internal/presentation/handler/portal_workspace_handler.go
@@ -3,7 +3,6 @@ package handler
 import (
 	"log/slog"
 	"net/http"
-	"time"
 
 	"github.com/labstack/echo/v4"
 
@@ -128,7 +127,7 @@ func (h *PortalWorkspaceHandler) CreateInvitation(c echo.Context) error {
 	if body.Email == "" || body.Role == "" {
 		return echo.NewHTTPError(http.StatusBadRequest, "email and role required")
 	}
-	inv := body.ToDomain(wid, time.Now().Add(7*24*time.Hour))
+	inv := h.svc.NewPendingInvitation(wid, body.Email, body.Role)
 	rawToken, err := h.svc.CreateInvitation(c.Request().Context(), inv)
 	if err != nil {
 		slog.ErrorContext(c.Request().Context(), "failed to create invitation", "error", err, "workspace_id", wid, "email", body.Email)
diff --git a/internal/presentation/handler/portal_workspace_handler_test.go b/internal/presentation/handler/portal_workspace_handler_test.go
new file mode 100644
index 00000000..582af488
--- /dev/null
+++ b/internal/presentation/handler/portal_workspace_handler_test.go
@@ -0,0 +1,96 @@
+package handler
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/google/uuid"
+	"github.com/labstack/echo/v4"
+
+	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
+	"github.com/weprodev/wpd-message-gateway/internal/core/service"
+)
+
+type fakeInvitationRepository struct {
+	created *domain.Invitation
+}
+
+func (f *fakeInvitationRepository) Create(_ context.Context, inv *domain.Invitation) error {
+	f.created = inv
+	inv.ID = "inv-" + uuid.NewString()
+	return nil
+}
+
+func (f *fakeInvitationRepository) ListPendingByWorkspace(context.Context, string) ([]domain.Invitation, error) {
+	return nil, nil
+}
+
+func TestPortalWorkspaceHandler_CreateInvitation(t *testing.T) {
+	t.Parallel()
+	e := echo.New()
+
+	repo := &fakeInvitationRepository{}
+	svc := service.NewPortalService(service.PortalDeps{Invitations: repo})
+	h := NewPortalWorkspaceHandler(svc)
+
+	body := `{"email":"invitee@example.com","role":"member"}`
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/workspaces/ws-1/invitations", strings.NewReader(body))
+	req.Header.Set(echo.HeaderContentType, echo.MIMEApplicationJSON)
+	rec := httptest.NewRecorder()
+	c := e.NewContext(req, rec)
+	c.SetParamNames("wid")
+	c.SetParamValues("ws-1")
+
+	if err := h.CreateInvitation(c); err != nil {
+		t.Fatalf("CreateInvitation: %v", err)
+	}
+	if rec.Code != http.StatusCreated {
+		t.Fatalf("expected 201, got %d body=%s", rec.Code, rec.Body.String())
+	}
+
+	var res map[string]any
+	if err := json.Unmarshal(rec.Body.Bytes(), &res); err != nil {
+		t.Fatalf("decode response: %v", err)
+	}
+	if res["email"] != "invitee@example.com" || res["role"] != "member" {
+		t.Fatalf("unexpected response: %+v", res)
+	}
+	token, _ := res["token"].(string)
+	if token == "" {
+		t.Fatal("expected token in response")
+	}
+	if repo.created == nil || repo.created.TokenHash == "" {
+		t.Fatal("expected invitation persisted with token hash")
+	}
+	if repo.created.Email != "invitee@example.com" || repo.created.Status != "pending" {
+		t.Fatalf("unexpected persisted invitation: %+v", repo.created)
+	}
+}
+
+func TestPortalWorkspaceHandler_CreateInvitation_rejectsInvalidJSON(t *testing.T) {
+	t.Parallel()
+	e := echo.New()
+
+	h := NewPortalWorkspaceHandler(service.NewPortalService(service.PortalDeps{}))
+
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/workspaces/ws-1/invitations", strings.NewReader("{bad"))
+	req.Header.Set(echo.HeaderContentType, echo.MIMEApplicationJSON)
+	rec := httptest.NewRecorder()
+	c := e.NewContext(req, rec)
+	c.SetParamNames("wid")
+	c.SetParamValues("ws-1")
+
+	err := h.CreateInvitation(c)
+	if err == nil {
+		t.Fatal("expected error")
+	}
+	var httpErr *echo.HTTPError
+	if !errors.As(err, &httpErr) || httpErr.Code != http.StatusBadRequest {
+		t.Fatalf("expected 400, got %v", err)
+	}
+}
diff --git a/internal/presentation/handler/send_helper.go b/internal/presentation/handler/send_helper.go
index 096c9316..c441466a 100644
--- a/internal/presentation/handler/send_helper.go
+++ b/internal/presentation/handler/send_helper.go
@@ -10,8 +10,8 @@ import (
 	"github.com/labstack/echo/v4"
 
 	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
+	"github.com/weprodev/wpd-message-gateway/internal/core/logctx"
 	"github.com/weprodev/wpd-message-gateway/internal/core/service"
-	"github.com/weprodev/wpd-message-gateway/internal/infrastructure/logger"
 	"github.com/weprodev/wpd-message-gateway/pkg/contracts"
 )
 
@@ -38,8 +38,8 @@ func (sh *SendHelper) DispatchAndLog(
 	start := time.Now()
 	ctx := c.Request().Context()
 
-	ctx = logger.WithWorkspace(ctx, workspaceID, apiKeyID)
-	ctx = logger.WithChannel(ctx, channel)
+	ctx = logctx.WithWorkspace(ctx, workspaceID, apiKeyID)
+	ctx = logctx.WithChannel(ctx, channel)
 
 	if workspaceID == "" {
 		slog.WarnContext(ctx, "send rejected: missing workspace context", "endpoint", endpoint)
@@ -58,7 +58,7 @@ func (sh *SendHelper) DispatchAndLog(
 	result, err := send(ctx)
 	providerName := contracts.ProviderNameFromResult(result)
 	if providerName != "" {
-		ctx = logger.WithProvider(ctx, providerName)
+		ctx = logctx.WithProvider(ctx, providerName)
 	}
 
 	if err != nil {
@@ -95,7 +95,7 @@ func (sh *SendHelper) recordLog(
 		StatusCode:   statusCode,
 		Endpoint:     endpoint,
 		ProviderName: providerName,
-		RequestID:    logger.GetRequestID(ctx),
+		RequestID:    logctx.GetRequestID(ctx),
 		DurationMs:   int(time.Since(start).Milliseconds()),
 		ErrorMessage: errMsg,
 	}
diff --git a/internal/presentation/handler/send_helper_test.go b/internal/presentation/handler/send_helper_test.go
index 8f4c72d7..afe9c801 100644
--- a/internal/presentation/handler/send_helper_test.go
+++ b/internal/presentation/handler/send_helper_test.go
@@ -11,9 +11,9 @@ import (
 	"github.com/labstack/echo/v4"
 
 	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
+	"github.com/weprodev/wpd-message-gateway/internal/core/logctx"
 	"github.com/weprodev/wpd-message-gateway/internal/core/port"
 	"github.com/weprodev/wpd-message-gateway/internal/core/service"
-	"github.com/weprodev/wpd-message-gateway/internal/infrastructure/logger"
 	"github.com/weprodev/wpd-message-gateway/pkg/contracts"
 )
 
@@ -41,7 +41,7 @@ func TestSendHelper_DispatchAndLog(t *testing.T) {
 
 		// Set request ID in context
 		ctx := req.Context()
-		ctx = logger.WithRequestID(ctx, "req-xyz")
+		ctx = logctx.WithRequestID(ctx, "req-xyz")
 		c.SetRequest(req.WithContext(ctx))
 
 		repo := &mockLogRepo{}
diff --git a/internal/presentation/middleware/auth.go b/internal/presentation/middleware/auth.go
index c1ad1e19..80c57f28 100644
--- a/internal/presentation/middleware/auth.go
+++ b/internal/presentation/middleware/auth.go
@@ -12,8 +12,8 @@ import (
 	"github.com/weprodev/go-pkg/crypto"
 
 	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
+	"github.com/weprodev/wpd-message-gateway/internal/core/logctx"
 	"github.com/weprodev/wpd-message-gateway/internal/core/port"
-	applogger "github.com/weprodev/wpd-message-gateway/internal/infrastructure/logger"
 )
 
 type contextKey string
@@ -93,7 +93,7 @@ func APIKeyAuthMiddleware(apiKeyRepo port.APIKeyRepository, workspaceRepo port.W
 			ctx = context.WithValue(ctx, WorkspaceIDKey, apiKey.WorkspaceID)
 			ctx = context.WithValue(ctx, APIKeyIDKey, apiKey.ID)
 			ctx = context.WithValue(ctx, APIKeyNameKey, apiKey.Name)
-			ctx = applogger.WithWorkspace(ctx, apiKey.WorkspaceID, apiKey.ID)
+			ctx = logctx.WithWorkspace(ctx, apiKey.WorkspaceID, apiKey.ID)
 			c.SetRequest(c.Request().WithContext(ctx))
 			return next(c)
 		}
diff --git a/internal/presentation/middleware/rbac_test.go b/internal/presentation/middleware/rbac_test.go
index 2f3b012e..e4ea9ce8 100644
--- a/internal/presentation/middleware/rbac_test.go
+++ b/internal/presentation/middleware/rbac_test.go
@@ -30,7 +30,9 @@ func TestRequirePermission(t *testing.T) {
 	}
 	defer db.Close() //nolint:errcheck
 
-	gate := gogate.NewGate(db, nil)
+	gateCfg := gogate.DefaultConfig()
+	gateCfg.DefaultGuardName = domain.RBACGuardName
+	gate := gogate.NewGate(db, &gateCfg)
 
 	// Build echo instance
 	e := echo.New()
@@ -48,7 +50,7 @@ func TestRequirePermission(t *testing.T) {
 
 		// Mock the check query inside Gate.Check
 		mock.ExpectQuery(`SELECT 'role' AS type, r.name AS value FROM model_has_roles mhr JOIN roles r ON r.id = mhr.role_id WHERE mhr.model_type = \$1 AND mhr.model_id = \$2 AND mhr.team_id = \$5 AND r.guard_name = \$3 UNION ALL SELECT 'permission' AS type, p.name AS value FROM model_has_permissions mhp JOIN permissions p ON p.id = mhp.permission_id WHERE mhp.model_type = \$1 AND mhp.model_id = \$2 AND mhp.team_id = \$5 AND p.name = \$4 AND p.guard_name = \$3`).
-			WithArgs("users", "user-123", "web", domain.PermissionWorkspacesRead, "ws-1").
+			WithArgs("users", "user-123", "msg_web", domain.PermissionWorkspacesRead, "ws-1").
 			WillReturnRows(sqlmock.NewRows([]string{"type", "value"}).AddRow("permission", domain.PermissionWorkspacesRead))
 
 		wsRepo := &mockWorkspaceRepository{
@@ -89,7 +91,7 @@ func TestRequirePermission(t *testing.T) {
 		c.SetRequest(req.WithContext(ctx))
 
 		mock.ExpectQuery(`SELECT 'role' AS type, r.name AS value FROM model_has_roles mhr JOIN roles r ON r.id = mhr.role_id WHERE mhr.model_type = \$1 AND mhr.model_id = \$2 AND mhr.team_id = \$5 AND r.guard_name = \$3 UNION ALL SELECT 'permission' AS type, p.name AS value FROM model_has_permissions mhp JOIN permissions p ON p.id = mhp.permission_id WHERE mhp.model_type = \$1 AND mhp.model_id = \$2 AND mhp.team_id = \$5 AND p.name = \$4 AND p.guard_name = \$3`).
-			WithArgs("users", "user-123", "web", domain.PermissionWorkspacesWrite, "ws-1").
+			WithArgs("users", "user-123", "msg_web", domain.PermissionWorkspacesWrite, "ws-1").
 			WillReturnRows(sqlmock.NewRows([]string{"type", "value"})) // no rows matched
 
 		wsRepo := &mockWorkspaceRepository{
diff --git a/internal/presentation/router.go b/internal/presentation/router.go
index e6e386f6..9ccf7299 100644
--- a/internal/presentation/router.go
+++ b/internal/presentation/router.go
@@ -7,8 +7,8 @@ import (
 	echomiddleware "github.com/labstack/echo/v4/middleware"
 
 	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
+	"github.com/weprodev/wpd-message-gateway/internal/core/logctx"
 	"github.com/weprodev/wpd-message-gateway/internal/core/port"
-	applogger "github.com/weprodev/wpd-message-gateway/internal/infrastructure/logger"
 	"github.com/weprodev/wpd-message-gateway/internal/presentation/handler"
 	customMiddleware "github.com/weprodev/wpd-message-gateway/internal/presentation/middleware"
 
@@ -68,29 +68,33 @@ func NewRouter(
 	}
 }
 
-// Setup configures Echo with all routes.
-func (rt *Router) Setup() *echo.Echo {
-	e := echo.New()
-	e.HideBanner = true
-	e.HTTPErrorHandler = pkgapi.NewEchoErrorHandler(rt.logger.Logger).EchoHandler
-	e.Validator = pkgvalidator.NewValidator()
-
-	e.Use(echomiddleware.Recover())
-	e.Use(echomiddleware.RequestID())
-	e.Use(func(next echo.HandlerFunc) echo.HandlerFunc {
+// enrichRequestIDContext copies Echo's X-Request-ID into the request context for slog correlation.
+func enrichRequestIDContext() echo.MiddlewareFunc {
+	return func(next echo.HandlerFunc) echo.HandlerFunc {
 		return func(c echo.Context) error {
 			reqID := c.Response().Header().Get(echo.HeaderXRequestID)
 			if reqID == "" {
 				reqID = c.Request().Header.Get(echo.HeaderXRequestID)
 			}
 			if reqID != "" {
-				ctx := c.Request().Context()
-				ctx = applogger.WithRequestID(ctx, reqID)
+				ctx := logctx.WithRequestID(c.Request().Context(), reqID)
 				c.SetRequest(c.Request().WithContext(ctx))
 			}
 			return next(c)
 		}
-	})
+	}
+}
+
+// Setup configures Echo with all routes.
+func (rt *Router) Setup() *echo.Echo {
+	e := echo.New()
+	e.HideBanner = true
+	e.HTTPErrorHandler = pkgapi.NewEchoErrorHandler(rt.logger.Logger).EchoHandler
+	e.Validator = pkgvalidator.NewValidator()
+
+	e.Use(echomiddleware.Recover())
+	e.Use(echomiddleware.RequestID())
+	e.Use(enrichRequestIDContext())
 	e.Use(echomiddleware.RequestLoggerWithConfig(echomiddleware.RequestLoggerConfig{
 		LogStatus:   true,
 		LogURI:      true,
diff --git a/internal/presentation/router_test.go b/internal/presentation/router_test.go
new file mode 100644
index 00000000..b6718817
--- /dev/null
+++ b/internal/presentation/router_test.go
@@ -0,0 +1,59 @@
+package presentation
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/labstack/echo/v4"
+	echomiddleware "github.com/labstack/echo/v4/middleware"
+
+	"github.com/weprodev/wpd-message-gateway/internal/core/logctx"
+)
+
+func TestEnrichRequestIDContext_fromEchoMiddleware(t *testing.T) {
+	t.Parallel()
+
+	e := echo.New()
+	e.Use(echomiddleware.RequestID())
+	e.Use(enrichRequestIDContext())
+	e.GET("/", func(c echo.Context) error {
+		if logctx.GetRequestID(c.Request().Context()) == "" {
+			t.Fatal("expected request_id in context")
+		}
+		return c.NoContent(http.StatusNoContent)
+	})
+
+	req := httptest.NewRequest(http.MethodGet, "/", nil)
+	rec := httptest.NewRecorder()
+	e.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusNoContent {
+		t.Fatalf("status: got %d", rec.Code)
+	}
+	if rec.Header().Get(echo.HeaderXRequestID) == "" {
+		t.Fatal("expected X-Request-ID response header")
+	}
+}
+
+func TestEnrichRequestIDContext_honorsInboundHeader(t *testing.T) {
+	t.Parallel()
+
+	e := echo.New()
+	e.Use(enrichRequestIDContext())
+	e.GET("/", func(c echo.Context) error {
+		if got := logctx.GetRequestID(c.Request().Context()); got != "req-inbound" {
+			t.Fatalf("request_id: got %q want req-inbound", got)
+		}
+		return c.NoContent(http.StatusNoContent)
+	})
+
+	req := httptest.NewRequest(http.MethodGet, "/", nil)
+	req.Header.Set(echo.HeaderXRequestID, "req-inbound")
+	rec := httptest.NewRecorder()
+	e.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusNoContent {
+		t.Fatalf("status: got %d", rec.Code)
+	}
+}
diff --git a/pkg/README.md b/pkg/README.md
index 67904a96..d9f4acd4 100644
--- a/pkg/README.md
+++ b/pkg/README.md
@@ -1,110 +1,114 @@
-# WPD Message Gateway SDK
+# WPD Message Gateway SDK (`pkg/`)
 
-The `pkg` directory contains the core SDK for the WPD Message Gateway. It is fully independent from the portal and backend infrastructure, providing a clean, decoupled interface for 3rd party clients and external systems to integrate with multiple messaging providers (Email, SMS, Push, Chat).
+The `pkg/` tree is the **embedded Go SDK** — fully independent from `internal/`, PostgreSQL, and the HTTP portal. Third-party apps import it to send email, SMS, push, and chat through provider plugins without running the gateway server.
 
-## Architecture & Concepts
+**Iron rule:** `pkg/*` must **never** import `internal/*`. Enforced by `pkg/import_boundary_test.go`.
 
-The SDK adheres to clean architecture, Domain-Driven Design (DDD), and SOLID principles:
+## Packages
 
-- **`contracts/`**: Contains the pure domain interfaces (`EmailSender`, `SMSSender`, etc.) and data models (`Email`, `SMS`, `SendResult`). This acts as the universal language across all providers.
-- **`provider/`**: Contains the concrete implementations of those contracts for specific services (e.g., `mailgun`). It also includes a `memory` provider for mocking, testing, and gateway interception.
-- **`registry/`**: A central factory registry that allows dynamic registration and instantiation of providers based on arbitrary configuration maps.
-- **`gateway/`**: Exposes generic client definitions for REST integrations if needed.
+| Package | Role |
+| ------- | ---- |
+| `contracts/` | Channel message types and sender interfaces (`EmailSender`, `SMSSender`, …) |
+| `registry/` | Provider factory registry (register + resolve by name) |
+| `provider/*` | Concrete providers (`mailgun`, `memory`, …) |
+| `gateway/` | High-level `gateway.New(Config)` facade for in-process use |
 
-## How to Use as a Client
-
-Any external system or 3rd party application can import this package to seamlessly send messages through any supported provider without worrying about the underlying HTTP clients or vendor SDKs.
-
-### 1. Direct Provider Usage
-
-If you know exactly which provider you want to use, you can instantiate it directly using the contract interface:
+## Mode 1 — Embedded SDK (no server, no DB)
 
 ```go
-package main
-
 import (
-	"context"
-	"log"
+    "context"
 
-	"github.com/weprodev/wpd-message-gateway/pkg/contracts"
-	"github.com/weprodev/wpd-message-gateway/pkg/provider/mailgun"
+    "github.com/weprodev/wpd-message-gateway/pkg/contracts"
+    "github.com/weprodev/wpd-message-gateway/pkg/gateway"
+    _ "github.com/weprodev/wpd-message-gateway/pkg/provider/memory" // registers "memory"
 )
 
 func main() {
-	// 1. Configure the specific provider
-	sender, err := mailgun.New(mailgun.Config{
-		Domain:    "your-domain.com",
-		APIKey:    "your-api-key",
-		FromEmail: "no-reply@your-domain.com",
-	})
-	if err != nil {
-		log.Fatal(err)
-	}
-
-	// 2. Build the standard contract message
-	email := &contracts.Email{
-		To:      []string{"user@example.com"},
-		Subject: "Welcome to WPD",
-		HTML:    "<h1>Hello World</h1>",
-		From:    "no-reply@your-domain.com",
-	}
-
-	// 3. Send using the unified interface
-	result, err := sender.Send(context.Background(), email)
-	if err != nil {
-		log.Fatal(err)
-	}
-	
-	log.Printf("Sent! ID: %s", result.ID)
+    gw, err := gateway.New(gateway.Config{
+        DefaultEmailProvider: "memory",
+        EmailProviders: map[string]gateway.EmailConfig{
+            "memory": {},
+        },
+    })
+    if err != nil {
+        panic(err)
+    }
+
+    result, err := gw.SendEmail(context.Background(), &contracts.Email{
+        To:      []string{"user@example.com"},
+        Subject: "Hello",
+        HTML:    "<p>Hi</p>",
+    })
+    if err != nil {
+        panic(err)
+    }
+    _ = result.ID
 }
 ```
 
-### 2. Dynamic Provider Resolution (Registry)
+Import only the providers you need via blank import, or use `pkg/gateway` which bundles common providers through `gateway/imports.go`.
 
-For systems that store configurations dynamically (e.g., in a database), you can use the Registry. This allows you to swap providers at runtime without changing your code:
+## Mode 2 — Dynamic resolution via registry
 
-```go
-package main
+For config loaded from your own store (not this repo's PostgreSQL):
 
+```go
 import (
-	"context"
-	"log"
+    "encoding/json"
 
-	"github.com/weprodev/wpd-message-gateway/pkg/contracts"
-	"github.com/weprodev/wpd-message-gateway/pkg/registry"
-	_ "github.com/weprodev/wpd-message-gateway/pkg/provider/mailgun" // Import for side-effects (registration)
+    "github.com/weprodev/wpd-message-gateway/pkg/registry"
+    _ "github.com/weprodev/wpd-message-gateway/pkg/provider/mailgun"
 )
 
 func main() {
-	// Configuration loaded from your DB or Environment
-	config := map[string]interface{}{
-		"domain":  "your-domain.com",
-		"api_key": "your-api-key",
-	}
-
-	// Instantiate the provider dynamically by name
-	sender, err := registry.BuildEmailSender("mailgun", config)
-	if err != nil {
-		log.Fatal(err)
-	}
-
-	email := &contracts.Email{
-		To:      []string{"user@example.com"},
-		Subject: "Dynamic Send",
-		HTML:    "<p>Works perfectly.</p>",
-		From:    "no-reply@your-domain.com",
-	}
-
-	result, err := sender.Send(context.Background(), email)
-	if err != nil {
-		log.Fatal(err)
-	}
+    raw := map[string]any{
+        "api_key":    "key-xxx",
+        "domain":     "mg.example.com",
+        "from_email": "noreply@example.com",
+    }
+    b, _ := json.Marshal(raw)
+
+    factory, err := registry.GetEmailFactory("mailgun")
+    if err != nil {
+        panic(err)
+    }
+
+    var cfg registry.EmailConfig
+    if err := json.Unmarshal(b, &cfg); err != nil {
+        panic(err)
+    }
+
+    sender, err := factory(cfg)
+    if err != nil {
+        panic(err)
+    }
+    _ = sender
 }
 ```
 
-## Creating a New Provider
+## Direct provider usage
+
+```go
+import (
+    "github.com/weprodev/wpd-message-gateway/pkg/contracts"
+    "github.com/weprodev/wpd-message-gateway/pkg/provider/mailgun"
+)
+
+sender, err := mailgun.New(mailgun.Config{
+    Domain:    "mg.example.com",
+    APIKey:    "key-xxx",
+    FromEmail: "noreply@example.com",
+})
+```
+
+## Adding a provider
+
+1. Create `pkg/provider/<name>/`
+2. Implement the relevant `contracts.*Sender` interface
+3. Register in `init()` via `registry.RegisterEmailProvider` (or SMS/push/chat)
+4. Add tests colocated in the provider package
+
+## Relationship to HTTP server
 
-To add a new provider (e.g., Twilio for SMS):
-1. Create a new folder in `pkg/provider/twilio`.
-2. Implement the relevant contract (`contracts.SMSSender`).
-3. Add a builder function and register it via `registry.RegisterSMSBuilder("twilio", builderFn)` in an `init()` block.
+The HTTP server (`cmd/server`, `internal/`) uses the **same** `pkg/contracts` and `pkg/registry` but loads integration config from PostgreSQL. Portal UI and `/v1/*` routes are **not** part of `pkg/`.
diff --git a/pkg/import_boundary_test.go b/pkg/import_boundary_test.go
new file mode 100644
index 00000000..b5aa2158
--- /dev/null
+++ b/pkg/import_boundary_test.go
@@ -0,0 +1,45 @@
+package pkg_test
+
+import (
+	"go/parser"
+	"go/token"
+	"io/fs"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestPkgDoesNotImportInternal(t *testing.T) {
+	t.Parallel()
+
+	const forbidden = "github.com/weprodev/wpd-message-gateway/internal/"
+	fset := token.NewFileSet()
+
+	err := filepath.WalkDir(".", func(path string, d fs.DirEntry, walkErr error) error {
+		if walkErr != nil {
+			return walkErr
+		}
+		if d.IsDir() {
+			return nil
+		}
+		if !strings.HasSuffix(path, ".go") || strings.HasSuffix(path, "_test.go") {
+			return nil
+		}
+
+		file, err := parser.ParseFile(fset, path, nil, parser.ImportsOnly)
+		if err != nil {
+			return err
+		}
+
+		for _, imp := range file.Imports {
+			importPath := strings.Trim(imp.Path.Value, `"`)
+			if strings.HasPrefix(importPath, forbidden) {
+				t.Errorf("%s imports forbidden package %s", path, importPath)
+			}
+		}
+		return nil
+	})
+	if err != nil {
+		t.Fatalf("walk pkg: %v", err)
+	}
+}
diff --git a/pkg/provider/mailgun/mailgun_test.go b/pkg/provider/mailgun/mailgun_test.go
new file mode 100644
index 00000000..7088fac7
--- /dev/null
+++ b/pkg/provider/mailgun/mailgun_test.go
@@ -0,0 +1,123 @@
+package mailgun
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/weprodev/wpd-message-gateway/pkg/contracts"
+)
+
+func TestNew_validationErrors(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name    string
+		cfg     Config
+		wantErr string
+	}{
+		{
+			name:    "missing api key",
+			cfg:     Config{Domain: "mg.example.com"},
+			wantErr: "API key is required",
+		},
+		{
+			name:    "missing domain",
+			cfg:     Config{APIKey: "key-123"},
+			wantErr: "domain is required",
+		},
+	}
+
+	for _, tt := range tests {
+		tt := tt
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			_, err := New(tt.cfg)
+			if err == nil {
+				t.Fatal("expected error")
+			}
+			if !strings.Contains(err.Error(), tt.wantErr) {
+				t.Fatalf("expected %q in error, got %v", tt.wantErr, err)
+			}
+		})
+	}
+}
+
+func TestNew_success(t *testing.T) {
+	t.Parallel()
+
+	p, err := New(Config{APIKey: "key-123", Domain: "mg.example.com", FromEmail: "noreply@mg.example.com"})
+	if err != nil {
+		t.Fatalf("New: %v", err)
+	}
+	if p.fromAddress != "noreply@mg.example.com" {
+		t.Fatalf("expected from address on provider, got %q", p.fromAddress)
+	}
+}
+
+func TestProvider_buildFromAddress(t *testing.T) {
+	t.Parallel()
+
+	defaultProvider := &Provider{
+		fromAddress: "noreply@mg.example.com",
+		fromName:    "Acme",
+	}
+
+	tests := []struct {
+		name     string
+		provider *Provider
+		email    contracts.Email
+		want     string
+	}{
+		{
+			name:     "email overrides defaults",
+			provider: defaultProvider,
+			email:    contracts.Email{From: "custom@example.com", FromName: "Custom"},
+			want:     "Custom <custom@example.com>",
+		},
+		{
+			name:     "uses provider defaults",
+			provider: defaultProvider,
+			email:    contracts.Email{},
+			want:     "Acme <noreply@mg.example.com>",
+		},
+		{
+			name:     "email from with default name",
+			provider: defaultProvider,
+			email:    contracts.Email{From: "only@example.com"},
+			want:     "Acme <only@example.com>",
+		},
+		{
+			name:     "address only when no name",
+			provider: &Provider{fromAddress: "noreply@mg.example.com"},
+			email:    contracts.Email{From: "plain@example.com"},
+			want:     "plain@example.com",
+		},
+		{
+			name:     "empty when no address available",
+			provider: &Provider{fromName: "Name Only"},
+			email:    contracts.Email{},
+			want:     "",
+		},
+	}
+
+	for _, tt := range tests {
+		tt := tt
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			got := tt.provider.buildFromAddress(tt.email)
+			if got != tt.want {
+				t.Fatalf("buildFromAddress() = %q, want %q", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestProvider_Send_rejectsMissingFrom(t *testing.T) {
+	t.Parallel()
+
+	p := &Provider{}
+	_, err := p.Send(t.Context(), contracts.Email{To: []string{"a@b.com"}})
+	if err == nil || err.Error() != "no from address specified" {
+		t.Fatalf("expected missing from error, got %v", err)
+	}
+}

From e6cd72224ffa2c9e2a0691b3a34a6d5aaf4ed71c Mon Sep 17 00:00:00 2001
From: MichaelAndish <maikel1370@gmail.com>
Date: Sat, 4 Jul 2026 20:21:02 +0200
Subject: [PATCH 14/20] fix: update test files and SQL queries for improved
 functionality

- Changed `content` to `content_html` in the email templates test to align with the updated data structure.
- Added `reload` function mock to the integrations page test to enhance test coverage and functionality.
- Introduced `activeWorkspace` to the workspaces page test to ensure proper state management during tests.
- Updated SQL queries in the Go code to use `UNION ALL` and corrected type casting for improved query performance and accuracy.

This commit enhances the testing framework and SQL query handling, ensuring better alignment with the current application structure.
---
 .../src/features/inbox/pages/email-templates.page.test.tsx  | 2 +-
 .../features/integrations/pages/integrations.page.test.tsx  | 2 ++
 .../src/features/workspaces/pages/workspaces.page.test.tsx  | 2 ++
 internal/infrastructure/authgate/gate_adapter.go            | 6 +++---
 .../repository/postgres/workspace_repository.go             | 2 +-
 5 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/frontend/src/features/inbox/pages/email-templates.page.test.tsx b/frontend/src/features/inbox/pages/email-templates.page.test.tsx
index 6626a8f3..9495fa95 100644
--- a/frontend/src/features/inbox/pages/email-templates.page.test.tsx
+++ b/frontend/src/features/inbox/pages/email-templates.page.test.tsx
@@ -44,7 +44,7 @@ describe("EmailTemplatesPage", () => {
           channel_type: "email",
           category: "transactional",
           subject: "Welcome!",
-          content: "<p>Hi</p>",
+          content_html: "<p>Hi</p>",
           is_active: true,
           is_default: false,
           created_at: "2026-01-01T00:00:00Z",
diff --git a/frontend/src/features/integrations/pages/integrations.page.test.tsx b/frontend/src/features/integrations/pages/integrations.page.test.tsx
index 6d85efaa..7ad643e9 100644
--- a/frontend/src/features/integrations/pages/integrations.page.test.tsx
+++ b/frontend/src/features/integrations/pages/integrations.page.test.tsx
@@ -29,6 +29,7 @@ describe("IntegrationsPage", () => {
       items: [],
       isLoading: true,
       error: null,
+      reload: vi.fn(),
       connect: vi.fn(),
       activate: vi.fn(),
       deactivate: vi.fn(),
@@ -45,6 +46,7 @@ describe("IntegrationsPage", () => {
       items: [],
       isLoading: false,
       error: "Failed to load providers",
+      reload: vi.fn(),
       connect: vi.fn(),
       activate: vi.fn(),
       deactivate: vi.fn(),
diff --git a/frontend/src/features/workspaces/pages/workspaces.page.test.tsx b/frontend/src/features/workspaces/pages/workspaces.page.test.tsx
index b9dc6f43..cffffc63 100644
--- a/frontend/src/features/workspaces/pages/workspaces.page.test.tsx
+++ b/frontend/src/features/workspaces/pages/workspaces.page.test.tsx
@@ -15,6 +15,7 @@ describe("WorkspacesPage", () => {
   it("shows loading spinner while workspaces load", () => {
     mockedUseWorkspaces.mockReturnValue({
       workspaces: [],
+      activeWorkspace: null,
       isLoading: true,
       error: null,
       reload: vi.fn(),
@@ -42,6 +43,7 @@ describe("WorkspacesPage", () => {
           created_at: "2026-01-01T00:00:00Z",
         },
       ],
+      activeWorkspace: null,
       isLoading: false,
       error: null,
       reload: vi.fn(),
diff --git a/internal/infrastructure/authgate/gate_adapter.go b/internal/infrastructure/authgate/gate_adapter.go
index d5af11fb..7b4b98b6 100644
--- a/internal/infrastructure/authgate/gate_adapter.go
+++ b/internal/infrastructure/authgate/gate_adapter.go
@@ -53,12 +53,12 @@ func (a *GoGateAdapter) GetPermissionsForTeams(
 			JOIN roles r ON r.id = mhr.role_id
 			JOIN role_has_permissions rhp ON rhp.role_id = r.id
 			JOIN permissions p ON p.id = rhp.permission_id
-			WHERE mhr.model_type = $1 AND mhr.model_id::text = $2 AND mhr.team_id = ANY($3::uuid[])
-			UNION
+			WHERE mhr.model_type = $1 AND mhr.model_id = $2::uuid AND mhr.team_id = ANY($3::uuid[])
+			UNION ALL
 			SELECT mhp.team_id, p.name AS permission
 			FROM model_has_permissions mhp
 			JOIN permissions p ON p.id = mhp.permission_id
-			WHERE mhp.model_type = $1 AND mhp.model_id::text = $2 AND mhp.team_id = ANY($3::uuid[])
+			WHERE mhp.model_type = $1 AND mhp.model_id = $2::uuid AND mhp.team_id = ANY($3::uuid[])
 		) AS combined
 		ORDER BY team_id, permission
 	`
diff --git a/internal/infrastructure/repository/postgres/workspace_repository.go b/internal/infrastructure/repository/postgres/workspace_repository.go
index 3b0acf64..3f3a3fe7 100644
--- a/internal/infrastructure/repository/postgres/workspace_repository.go
+++ b/internal/infrastructure/repository/postgres/workspace_repository.go
@@ -138,7 +138,7 @@ func (r *WorkspaceRepository) SetStatus(ctx context.Context, id, status string)
 
 func (r *WorkspaceRepository) ListForUser(ctx context.Context, userID string) ([]domain.Workspace, error) {
 	query := `
-		SELECT DISTINCT w.id, w.name, w.slug, u.email, w.status,
+		SELECT w.id, w.name, w.slug, u.email, w.status,
 		       CASE WHEN w.is_private THEN 'private' ELSE 'public' END,
 		       w.hashed_pin_code, w.icon_key, w.created_at, w.updated_at,
 		       COALESCE(r.name, '')

From a45c02b33d958e2382bcfa011ec3120340fe36a2 Mon Sep 17 00:00:00 2001
From: MichaelAndish <maikel1370@gmail.com>
Date: Sat, 4 Jul 2026 20:56:10 +0200
Subject: [PATCH 15/20] feat: refactor database seed application and enhance
 workspace management

- Updated the Makefile and init-db.sh to reference the new script location for applying database seeds, improving organization.
- Introduced a new apply-seeds.sh script to ensure idempotent SQL seed application, preventing issues during database initialization.
- Modified the SQL seed files to include a guard name for roles, aligning with the updated permissions structure.
- Enhanced the WorkspaceRepository interface and implementation to include owner ID management and added a delete method for better workspace handling.
- Updated the PortalService and related handlers to support the new workspace creation logic, ensuring proper error handling and rollback mechanisms.

This commit improves the database initialization process and enhances workspace management functionality, ensuring better alignment with the current application structure.
---
 Makefile                                      |  2 +-
 database/init-db.sh                           |  2 +-
 database/{ => scripts}/apply-seeds.sh         |  4 +++-
 database/seeds/001_seed_permissions.sql       |  6 +++---
 internal/core/port/repository.go              |  3 ++-
 internal/core/service/portal_service.go       |  8 ++++++-
 .../repository/postgres/db_errors.go          | 21 +++++++++++++++++++
 .../postgres/workspace_repository.go          | 15 ++++++++++---
 .../handler/portal_workspace_handler.go       |  5 +++++
 internal/presentation/middleware/auth_test.go |  7 ++++---
 10 files changed, 59 insertions(+), 14 deletions(-)
 rename database/{ => scripts}/apply-seeds.sh (60%)
 mode change 100755 => 100644
 create mode 100644 internal/infrastructure/repository/postgres/db_errors.go

diff --git a/Makefile b/Makefile
index 64a4b950..bfcd60ce 100644
--- a/Makefile
+++ b/Makefile
@@ -337,7 +337,7 @@ seed-demo: docker-check
 	@printf "\n"
 	@printf "$(BOLD)$(CYAN)🌱 Applying database seeds...$(RESET)\n"
 	@docker compose exec -T -e POSTGRES_USER=gateway -e POSTGRES_DB=gateway db \
-		bash /docker-entrypoint-initdb.d/apply-seeds.sh /docker-entrypoint-initdb.d/seeds
+		bash /docker-entrypoint-initdb.d/scripts/apply-seeds.sh /docker-entrypoint-initdb.d/seeds
 	@printf "$(GREEN)✅ Seeds applied (demo@weprodev.com / secret)$(RESET)\n"
 	@printf "\n"
 
diff --git a/database/init-db.sh b/database/init-db.sh
index 9250b432..58b59fdf 100755
--- a/database/init-db.sh
+++ b/database/init-db.sh
@@ -17,6 +17,6 @@ psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" \
 
 echo "Applying seeds..."
 export POSTGRES_USER POSTGRES_DB
-bash /docker-entrypoint-initdb.d/apply-seeds.sh /docker-entrypoint-initdb.d/seeds
+bash /docker-entrypoint-initdb.d/scripts/apply-seeds.sh /docker-entrypoint-initdb.d/seeds
 
 echo "=== Database Init Script Completed ==="
diff --git a/database/apply-seeds.sh b/database/scripts/apply-seeds.sh
old mode 100755
new mode 100644
similarity index 60%
rename from database/apply-seeds.sh
rename to database/scripts/apply-seeds.sh
index 34cceb3a..b654b5f7
--- a/database/apply-seeds.sh
+++ b/database/scripts/apply-seeds.sh
@@ -1,5 +1,7 @@
 #!/bin/bash
-# Apply idempotent SQL seeds in order. Used by init-db.sh and `make seed-demo`.
+# Apply idempotent SQL seeds in order. Invoked by init-db.sh and `make seed-demo` only —
+# must NOT live at the docker-entrypoint-initdb.d root (Postgres runs *.sh there alphabetically
+# before init-db.sh, which breaks first-time migration).
 set -euo pipefail
 
 SEEDS_DIR="${1:-/docker-entrypoint-initdb.d/seeds}"
diff --git a/database/seeds/001_seed_permissions.sql b/database/seeds/001_seed_permissions.sql
index 69332f18..d13a1eb7 100644
--- a/database/seeds/001_seed_permissions.sql
+++ b/database/seeds/001_seed_permissions.sql
@@ -1,10 +1,10 @@
 -- Default RBAC Permissions & Role Bindings for WPD Message Gateway
 
 -- 1. Insert default roles
-INSERT INTO roles (id, name, display_name)
+INSERT INTO roles (id, name, display_name, guard_name)
 VALUES
-    ('00000000-0000-0000-0000-000000000020', 'admin', 'Admin'),
-    ('00000000-0000-0000-0000-000000000021', 'member', 'Member')
+    ('00000000-0000-0000-0000-000000000020', 'admin', 'Admin', 'msg_web'),
+    ('00000000-0000-0000-0000-000000000021', 'member', 'Member', 'msg_web')
 ON CONFLICT (name, guard_name) DO NOTHING;
 
 -- 2. Insert permissions
diff --git a/internal/core/port/repository.go b/internal/core/port/repository.go
index 4396ccf1..4d6a1dd7 100644
--- a/internal/core/port/repository.go
+++ b/internal/core/port/repository.go
@@ -7,7 +7,8 @@ import (
 )
 
 type WorkspaceRepository interface {
-	Create(ctx context.Context, workspace *domain.Workspace) error
+	Create(ctx context.Context, workspace *domain.Workspace, ownerID string) error
+	Delete(ctx context.Context, id string) error
 	GetByID(ctx context.Context, id string) (*domain.Workspace, error)
 	GetBySlug(ctx context.Context, slug string) (*domain.Workspace, error)
 	Update(ctx context.Context, workspace *domain.Workspace) error
diff --git a/internal/core/service/portal_service.go b/internal/core/service/portal_service.go
index 99b56b8d..1d2edbeb 100644
--- a/internal/core/service/portal_service.go
+++ b/internal/core/service/portal_service.go
@@ -132,16 +132,22 @@ func (s *PortalService) CreateWorkspace(ctx context.Context, userID, name, slug,
 		Visibility: "private",
 		IconKey:    strings.TrimSpace(iconKey),
 	}
-	if err := s.workspaces.Create(ctx, w); err != nil {
+	if err := s.workspaces.Create(ctx, w, userID); err != nil {
 		slog.ErrorContext(ctx, "workspace creation failed: database error", "error", err, "user_id", userID)
 		return nil, err
 	}
 	if err := s.members.Add(ctx, w.ID, userID, domain.RoleAdmin); err != nil {
 		slog.ErrorContext(ctx, "workspace creation failed: failed to add member", "error", err, "workspace_id", w.ID, "user_id", userID)
+		if delErr := s.workspaces.Delete(ctx, w.ID); delErr != nil {
+			slog.WarnContext(ctx, "failed to roll back workspace after member add error", "error", delErr, "workspace_id", w.ID)
+		}
 		return nil, err
 	}
 	if err := s.gate.AssignRole(ctx, "users", userID, w.ID, domain.RoleAdmin); err != nil {
 		slog.ErrorContext(ctx, "workspace creation failed: failed to assign role", "error", err, "workspace_id", w.ID, "user_id", userID)
+		if delErr := s.workspaces.Delete(ctx, w.ID); delErr != nil {
+			slog.WarnContext(ctx, "failed to roll back workspace after role assign error", "error", delErr, "workspace_id", w.ID)
+		}
 		return nil, err
 	}
 	slog.InfoContext(ctx, "workspace created successfully", "workspace_id", w.ID, "user_id", userID)
diff --git a/internal/infrastructure/repository/postgres/db_errors.go b/internal/infrastructure/repository/postgres/db_errors.go
new file mode 100644
index 00000000..d8501d87
--- /dev/null
+++ b/internal/infrastructure/repository/postgres/db_errors.go
@@ -0,0 +1,21 @@
+package postgres
+
+import (
+	"errors"
+	"fmt"
+
+	"github.com/lib/pq"
+
+	"github.com/weprodev/wpd-message-gateway/internal/core/port"
+)
+
+func mapDBError(err error) error {
+	if err == nil {
+		return nil
+	}
+	var pqErr *pq.Error
+	if errors.As(err, &pqErr) && pqErr.Code == "23505" {
+		return fmt.Errorf("%w: %s", port.ErrConflict, pqErr.Constraint)
+	}
+	return err
+}
diff --git a/internal/infrastructure/repository/postgres/workspace_repository.go b/internal/infrastructure/repository/postgres/workspace_repository.go
index 3f3a3fe7..795dc75b 100644
--- a/internal/infrastructure/repository/postgres/workspace_repository.go
+++ b/internal/infrastructure/repository/postgres/workspace_repository.go
@@ -40,10 +40,10 @@ func scanWorkspace(scanner interface {
 	return w, nil
 }
 
-func (r *WorkspaceRepository) Create(ctx context.Context, workspace *domain.Workspace) error {
+func (r *WorkspaceRepository) Create(ctx context.Context, workspace *domain.Workspace, ownerID string) error {
 	query := `
 		INSERT INTO workspaces (name, slug, owner_id, status, is_private, hashed_pin_code, icon_key)
-		VALUES ($1, $2, (SELECT id FROM users WHERE email = $3), $4, $5 = 'private', $6, $7)
+		VALUES ($1, $2, $3, $4, $5 = 'private', $6, $7)
 		RETURNING id, created_at, updated_at
 	`
 	var hashedPin, icon interface{}
@@ -54,10 +54,19 @@ func (r *WorkspaceRepository) Create(ctx context.Context, workspace *domain.Work
 		icon = workspace.IconKey
 	}
 	err := r.client.GetDB(ctx).QueryRowContext(ctx, query,
-		workspace.Name, workspace.Slug, workspace.AdminEmail, workspace.Status, workspace.Visibility, hashedPin, icon,
+		workspace.Name, workspace.Slug, ownerID, workspace.Status, workspace.Visibility, hashedPin, icon,
 	).Scan(&workspace.ID, &workspace.CreatedAt, &workspace.UpdatedAt)
 	if err != nil {
 		slog.ErrorContext(ctx, "database error: failed to create workspace", "error", err, "name", workspace.Name, "slug", workspace.Slug)
+		return mapDBError(err)
+	}
+	return nil
+}
+
+func (r *WorkspaceRepository) Delete(ctx context.Context, id string) error {
+	_, err := r.client.GetDB(ctx).ExecContext(ctx, `DELETE FROM workspaces WHERE id = $1`, id)
+	if err != nil {
+		slog.ErrorContext(ctx, "database error: failed to delete workspace", "error", err, "id", id)
 	}
 	return err
 }
diff --git a/internal/presentation/handler/portal_workspace_handler.go b/internal/presentation/handler/portal_workspace_handler.go
index d79b2b6a..8e83f5e9 100644
--- a/internal/presentation/handler/portal_workspace_handler.go
+++ b/internal/presentation/handler/portal_workspace_handler.go
@@ -1,11 +1,13 @@
 package handler
 
 import (
+	"errors"
 	"log/slog"
 	"net/http"
 
 	"github.com/labstack/echo/v4"
 
+	"github.com/weprodev/wpd-message-gateway/internal/core/port"
 	"github.com/weprodev/wpd-message-gateway/internal/core/service"
 	"github.com/weprodev/wpd-message-gateway/internal/presentation/dto"
 	customMiddleware "github.com/weprodev/wpd-message-gateway/internal/presentation/middleware"
@@ -39,6 +41,9 @@ func (h *PortalWorkspaceHandler) CreateWorkspace(c echo.Context) error {
 	w, err := h.svc.CreateWorkspace(c.Request().Context(), uid, body.Name, body.Slug, body.IconKey)
 	if err != nil {
 		slog.ErrorContext(c.Request().Context(), "failed to create workspace", "error", err, "user_id", uid, "name", body.Name)
+		if errors.Is(err, port.ErrConflict) {
+			return echo.NewHTTPError(http.StatusConflict, "workspace slug already exists")
+		}
 		return safeHTTPError(err, http.StatusBadRequest, "failed to create workspace")
 	}
 	return c.JSON(http.StatusCreated, w)
diff --git a/internal/presentation/middleware/auth_test.go b/internal/presentation/middleware/auth_test.go
index 0fa9ff12..908931f9 100644
--- a/internal/presentation/middleware/auth_test.go
+++ b/internal/presentation/middleware/auth_test.go
@@ -14,9 +14,10 @@ type stubWorkspaceRepo struct {
 	bySlug map[string]*domain.Workspace
 }
 
-func (s *stubWorkspaceRepo) Create(context.Context, *domain.Workspace) error { return nil }
-func (s *stubWorkspaceRepo) Update(context.Context, *domain.Workspace) error { return nil }
-func (s *stubWorkspaceRepo) SetStatus(context.Context, string, string) error { return nil }
+func (s *stubWorkspaceRepo) Create(context.Context, *domain.Workspace, string) error { return nil }
+func (s *stubWorkspaceRepo) Delete(context.Context, string) error                    { return nil }
+func (s *stubWorkspaceRepo) Update(context.Context, *domain.Workspace) error         { return nil }
+func (s *stubWorkspaceRepo) SetStatus(context.Context, string, string) error         { return nil }
 func (s *stubWorkspaceRepo) ListForUser(context.Context, string) ([]domain.Workspace, error) {
 	return nil, nil
 }

From dd29ae918945de23d362ef47c77c7c9c4a525f38 Mon Sep 17 00:00:00 2001
From: MichaelAndish <maikel1370@gmail.com>
Date: Sat, 4 Jul 2026 21:09:11 +0200
Subject: [PATCH 16/20] feat: enhance message dispatch and inbox capture
 functionality

- Updated the `ShouldCaptureToInbox` method to simplify logic and ensure it only checks the `StoreMessageContent` flag.
- Refactored the `dispatch` method in `GatewayService` to streamline message routing and inbox capture processes.
- Introduced a new `routeMessage` method to handle message delivery based on dispatch mode, improving code organization.
- Enhanced tests to verify the correct behavior of message dispatching and inbox capture under various configurations.
- Updated frontend settings page to clarify the behavior of message retention in the inbox.

This commit improves the overall message dispatch system, ensuring better clarity and functionality in capturing messages in the portal inbox.
---
 .../features/settings/pages/settings.page.tsx |   2 +-
 internal/core/domain/dispatch_mode.go         |   6 +-
 internal/core/domain/dispatch_mode_test.go    |  17 +--
 .../core/service/email_enrichment_test.go     |   4 +-
 internal/core/service/gateway_dispatch.go     | 143 ++++++++++++++++++
 internal/core/service/gateway_service.go      |  97 ++----------
 .../service/gateway_service_channels_test.go  |  25 ++-
 internal/core/service/gateway_service_test.go |  43 +++++-
 internal/core/service/provider_cache.go       |  11 ++
 .../presentation/handler/send_helper_test.go  |   3 +-
 pkg/contracts/message.go                      |   7 +-
 pkg/contracts/message_test.go                 |  15 +-
 12 files changed, 261 insertions(+), 112 deletions(-)
 create mode 100644 internal/core/service/gateway_dispatch.go

diff --git a/frontend/src/features/settings/pages/settings.page.tsx b/frontend/src/features/settings/pages/settings.page.tsx
index f1bd0f0d..6e1f5cba 100644
--- a/frontend/src/features/settings/pages/settings.page.tsx
+++ b/frontend/src/features/settings/pages/settings.page.tsx
@@ -164,7 +164,7 @@ function DispatchSettingsPanel({ initialConfig, onSave }: DispatchSettingsPanelP
         <label htmlFor="store-message-content" className="flex flex-1 cursor-pointer flex-col gap-1">
           <span className="text-sm font-medium text-foreground">Store message content in inbox</span>
           <span className="text-sm text-text-secondary">
-            When enabled, message bodies are captured in the portal inbox for review.
+            When enabled, message bodies are captured in the portal inbox and shown as Retained in message logs.
           </span>
         </label>
         <Checkbox
diff --git a/internal/core/domain/dispatch_mode.go b/internal/core/domain/dispatch_mode.go
index 7287c82c..eb40866d 100644
--- a/internal/core/domain/dispatch_mode.go
+++ b/internal/core/domain/dispatch_mode.go
@@ -51,9 +51,9 @@ func (c MessageDispatchConfig) RoutesViaProvider() bool {
 	return c.Mode == DispatchProvider
 }
 
-// ShouldCaptureToInbox reports whether message content should be written to the inbox writer.
-func (c MessageDispatchConfig) ShouldCaptureToInbox(effectiveMode MessageDispatchMode) bool {
-	return c.StoreMessageContent || effectiveMode == DispatchMemory
+// ShouldCaptureToInbox reports whether message content should be written to the portal inbox.
+func (c MessageDispatchConfig) ShouldCaptureToInbox() bool {
+	return c.StoreMessageContent
 }
 
 // ResolveMessageDispatchConfig reads canonical workspace setting values.
diff --git a/internal/core/domain/dispatch_mode_test.go b/internal/core/domain/dispatch_mode_test.go
index 3e0e8723..0e131fc6 100644
--- a/internal/core/domain/dispatch_mode_test.go
+++ b/internal/core/domain/dispatch_mode_test.go
@@ -62,20 +62,19 @@ func TestResolveMessageDispatchConfig(t *testing.T) {
 
 func TestMessageDispatchConfig_ShouldCaptureToInbox(t *testing.T) {
 	tests := []struct {
-		name          string
-		config        MessageDispatchConfig
-		effectiveMode MessageDispatchMode
-		want          bool
+		name   string
+		config MessageDispatchConfig
+		want   bool
 	}{
-		{"memory always captures", MessageDispatchConfig{Mode: DispatchMemory}, DispatchMemory, true},
-		{"provider without store", MessageDispatchConfig{Mode: DispatchProvider}, DispatchProvider, false},
-		{"provider with store", MessageDispatchConfig{Mode: DispatchProvider, StoreMessageContent: true}, DispatchProvider, true},
-		{"provider fallback to memory", MessageDispatchConfig{Mode: DispatchProvider}, DispatchMemory, true},
+		{"memory without store", MessageDispatchConfig{Mode: DispatchMemory, StoreMessageContent: false}, false},
+		{"memory with store", MessageDispatchConfig{Mode: DispatchMemory, StoreMessageContent: true}, true},
+		{"provider without store", MessageDispatchConfig{Mode: DispatchProvider}, false},
+		{"provider with store", MessageDispatchConfig{Mode: DispatchProvider, StoreMessageContent: true}, true},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			if got := tt.config.ShouldCaptureToInbox(tt.effectiveMode); got != tt.want {
+			if got := tt.config.ShouldCaptureToInbox(); got != tt.want {
 				t.Fatalf("ShouldCaptureToInbox() = %v, want %v", got, tt.want)
 			}
 		})
diff --git a/internal/core/service/email_enrichment_test.go b/internal/core/service/email_enrichment_test.go
index 1a56feca..9e92a929 100644
--- a/internal/core/service/email_enrichment_test.go
+++ b/internal/core/service/email_enrichment_test.go
@@ -65,7 +65,9 @@ func TestGatewayService_SendEmail_enrichesSenderFromIntegration(t *testing.T) {
 		Config:       []byte(`{"from_email":"noreply@weprodev.com","from_name":"WeProDev"}`),
 		Status:       "connected",
 	}
-	svc := NewGatewayService(&stubIntegrationRepo{active: intg}, nil, nil, inbox, nil)
+	svc := NewGatewayService(&stubIntegrationRepo{active: intg}, nil, &stubSettingsRepo{values: map[string]string{
+		domain.SettingKeyStoreMessageContent: "true",
+	}}, inbox, nil)
 
 	_, err := svc.SendEmail(t.Context(), "ws-1", contracts.Email{
 		To:      []string{"user@example.com"},
diff --git a/internal/core/service/gateway_dispatch.go b/internal/core/service/gateway_dispatch.go
new file mode 100644
index 00000000..7213e114
--- /dev/null
+++ b/internal/core/service/gateway_dispatch.go
@@ -0,0 +1,143 @@
+package service
+
+import (
+	"context"
+	"log/slog"
+
+	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
+	"github.com/weprodev/wpd-message-gateway/internal/core/logctx"
+	"github.com/weprodev/wpd-message-gateway/pkg/contracts"
+)
+
+type dispatchMeta struct {
+	provResult    *contracts.SendResult
+	inboxResult   *contracts.SendResult
+	integrationID string
+	providerName  string
+}
+
+// routeMessage delivers the outbound message according to dispatch mode.
+// Portal inbox capture is handled separately when store_message_content is enabled.
+func (s *GatewayService) routeMessage(
+	ctx context.Context,
+	workspaceID string,
+	config domain.MessageDispatchConfig,
+	channel string,
+	sendViaProvider func(context.Context, domain.Integration) (*contracts.SendResult, error),
+	meta *dispatchMeta,
+) error {
+	if config.RoutesViaProvider() {
+		return s.routeViaIntegration(ctx, workspaceID, channel, sendViaProvider, meta)
+	}
+	if config.ShouldCaptureToInbox() {
+		return nil
+	}
+	return s.routeViaMemoryProvider(ctx, sendViaProvider, meta)
+}
+
+func (s *GatewayService) routeViaIntegration(
+	ctx context.Context,
+	workspaceID, channel string,
+	sendViaProvider func(context.Context, domain.Integration) (*contracts.SendResult, error),
+	meta *dispatchMeta,
+) error {
+	intg, err := s.requireProviderIntegration(ctx, workspaceID, channel)
+	if err != nil {
+		return err
+	}
+
+	meta.integrationID = intg.ID
+	meta.providerName = intg.ProviderName
+
+	providerCtx := logctx.WithProvider(ctx, meta.providerName)
+	meta.provResult, err = sendViaProvider(providerCtx, intg)
+	if err != nil {
+		slog.WarnContext(providerCtx, "provider dispatch failed", "error", err, "integration_id", meta.integrationID)
+		return err
+	}
+	slog.InfoContext(providerCtx, "message dispatched via provider", "message_id", meta.provResult.ID)
+	return nil
+}
+
+func (s *GatewayService) routeViaMemoryProvider(
+	ctx context.Context,
+	sendViaProvider func(context.Context, domain.Integration) (*contracts.SendResult, error),
+	meta *dispatchMeta,
+) error {
+	intg := memoryDispatchIntegration()
+	providerCtx := logctx.WithProvider(ctx, domain.ProviderNameMemory)
+
+	var err error
+	meta.provResult, err = sendViaProvider(providerCtx, intg)
+	if err != nil {
+		slog.WarnContext(providerCtx, "memory provider dispatch failed", "error", err)
+		return err
+	}
+
+	meta.providerName = domain.ProviderNameMemory
+	slog.InfoContext(providerCtx, "message dispatched via memory provider", "message_id", meta.provResult.ID)
+	return nil
+}
+
+func (s *GatewayService) captureToInboxIfEnabled(
+	ctx context.Context,
+	config domain.MessageDispatchConfig,
+	writeToInbox func() (*contracts.SendResult, error),
+	meta *dispatchMeta,
+) error {
+	if !config.ShouldCaptureToInbox() {
+		return nil
+	}
+
+	result, err := writeToInbox()
+	if err != nil {
+		slog.ErrorContext(ctx, "inbox write failed", "error", err, "dispatch_mode", config.Mode)
+		if config.RoutesViaProvider() {
+			slog.WarnContext(ctx, "inbox capture failed after provider dispatch", "dispatch_mode", config.Mode)
+			return nil
+		}
+		return err
+	}
+
+	meta.inboxResult = result
+	slog.InfoContext(ctx, "message captured in inbox", "message_id", result.ID)
+	return nil
+}
+
+func mergeDispatchResults(meta dispatchMeta) *contracts.SendResult {
+	if meta.provResult == nil {
+		return meta.inboxResult
+	}
+	if meta.inboxResult == nil {
+		return meta.provResult
+	}
+	if meta.provResult.Meta == nil {
+		meta.provResult.Meta = make(map[string]string)
+	}
+	meta.provResult.Meta[contracts.MetaKeyInboxMessageID] = meta.inboxResult.ID
+	return meta.provResult
+}
+
+func attachDispatchMeta(
+	result *contracts.SendResult,
+	config domain.MessageDispatchConfig,
+	channel string,
+	meta dispatchMeta,
+) *contracts.SendResult {
+	if result == nil {
+		result = &contracts.SendResult{}
+	}
+	if result.Meta == nil {
+		result.Meta = make(map[string]string, 5)
+	}
+	contracts.SetDispatchModeMeta(result, string(config.Mode))
+	contracts.SetStoreContentMeta(result, config.StoreMessageContent)
+	result.Meta["channel"] = channel
+	if meta.integrationID != "" {
+		result.Meta["integration_id"] = meta.integrationID
+	}
+	if meta.providerName != "" {
+		result.Meta[contracts.MetaKeyProviderName] = meta.providerName
+	}
+	return result
+}
diff --git a/internal/core/service/gateway_service.go b/internal/core/service/gateway_service.go
index e6fbc4d5..a2490cce 100644
--- a/internal/core/service/gateway_service.go
+++ b/internal/core/service/gateway_service.go
@@ -9,7 +9,6 @@ import (
 	"log/slog"
 
 	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
-	"github.com/weprodev/wpd-message-gateway/internal/core/logctx"
 	"github.com/weprodev/wpd-message-gateway/internal/core/port"
 	"github.com/weprodev/wpd-message-gateway/pkg/contracts"
 )
@@ -23,9 +22,8 @@ const (
 
 // GatewayService orchestrates message dispatch for a single workspace.
 //
-// It resolves the workspace dispatch mode from WorkspaceSettingsRepository,
-// then routes the message to the in-process InboxWriter, a real provider
-// fetched via IntegrationRepository, or both — depending on the mode.
+// Dispatch mode (memory vs provider) controls where the message is routed.
+// store_message_content controls portal inbox capture independently of routing.
 //
 // Provider instances are cached per (integrationID, updatedAt) so HTTP clients
 // are reused across requests while auto-invalidating on config changes.
@@ -44,8 +42,8 @@ type GatewayService struct {
 
 // NewGatewayService constructs a GatewayService.
 //
-// inbox is the in-process capture store (implements port.InboxWriter).
-// Pass nil to disable memory capture — memory dispatch will then error when inbox is required.
+// inbox is the portal capture store (implements port.InboxWriter).
+// Pass nil to disable inbox capture when store_message_content is enabled.
 func NewGatewayService(
 	integrations port.IntegrationRepository,
 	templates port.TemplateRepository,
@@ -138,11 +136,7 @@ func (s *GatewayService) SendChat(ctx context.Context, workspaceID string, chat
 	)
 }
 
-// dispatch is the single entry point for all channel dispatch logic.
-// It applies the workspace dispatch mode and calls the appropriate fn(s).
-//
-//   - writeToInbox: captures to in-process RAM (always available)
-//   - sendViaProvider: resolves provider from integration and sends
+// dispatch routes the outbound message, then optionally captures it in the portal inbox.
 func (s *GatewayService) dispatch(
 	ctx context.Context,
 	workspaceID string,
@@ -153,55 +147,16 @@ func (s *GatewayService) dispatch(
 ) (*contracts.SendResult, error) {
 	slog.InfoContext(ctx, "dispatching message", "dispatch_mode", config.Mode, "store_content", config.StoreMessageContent)
 
-	var inboxResult *contracts.SendResult
-	var provResult *contracts.SendResult
-	var err error
-	var integrationID, providerName string
-	effectiveMode := config.Mode
-	providerName = domain.ProviderNameMemory
-
-	if config.RoutesViaProvider() {
-		intg, errLookup := s.requireProviderIntegration(ctx, workspaceID, channel)
-		if errLookup != nil {
-			return attachMeta(nil, effectiveMode, config.StoreMessageContent, channel, integrationID, providerName), errLookup
-		}
+	meta := dispatchMeta{providerName: domain.ProviderNameMemory}
 
-		integrationID = intg.ID
-		providerName = intg.ProviderName
-
-		providerCtx := logctx.WithProvider(ctx, providerName)
-		provResult, err = sendViaProvider(providerCtx, intg)
-		if err != nil {
-			slog.WarnContext(providerCtx, "provider dispatch failed", "error", err, "integration_id", integrationID)
-			return attachMeta(nil, effectiveMode, config.StoreMessageContent, channel, integrationID, providerName), err
-		}
-		slog.InfoContext(providerCtx, "message dispatched via provider", "message_id", provResult.ID)
+	if err := s.routeMessage(ctx, workspaceID, config, channel, sendViaProvider, &meta); err != nil {
+		return attachDispatchMeta(nil, config, channel, meta), err
 	}
-
-	if config.ShouldCaptureToInbox(effectiveMode) {
-		inboxResult, err = writeToInbox()
-		if err != nil {
-			slog.ErrorContext(ctx, "inbox write failed", "error", err, "dispatch_mode", effectiveMode, "store_content", config.StoreMessageContent)
-			if effectiveMode == domain.DispatchMemory {
-				return attachMeta(nil, effectiveMode, config.StoreMessageContent, channel, integrationID, providerName), err
-			}
-			slog.WarnContext(ctx, "inbox capture failed after provider dispatch", "dispatch_mode", effectiveMode)
-		} else {
-			slog.InfoContext(ctx, "message captured in inbox", "message_id", inboxResult.ID, "store_content", config.StoreMessageContent)
-		}
+	if err := s.captureToInboxIfEnabled(ctx, config, writeToInbox, &meta); err != nil {
+		return attachDispatchMeta(nil, config, channel, meta), err
 	}
 
-	finalResult := provResult
-	if finalResult == nil {
-		finalResult = inboxResult
-	} else if inboxResult != nil {
-		if finalResult.Meta == nil {
-			finalResult.Meta = make(map[string]string)
-		}
-		finalResult.Meta[contracts.MetaKeyInboxMessageID] = inboxResult.ID
-	}
-
-	return attachMeta(finalResult, effectiveMode, config.StoreMessageContent, channel, integrationID, providerName), nil
+	return attachDispatchMeta(mergeDispatchResults(meta), config, channel, meta), nil
 }
 
 // ResolveDispatchConfig reads the workspace setting for outbound dispatch behavior.
@@ -294,7 +249,7 @@ func (s *GatewayService) writeEmailToInbox(ctx context.Context, workspaceID stri
 	if err != nil {
 		return nil, fmt.Errorf("write email to inbox: %w", err)
 	}
-	return &contracts.SendResult{ID: id, StatusCode: 200, Message: "captured in memory"}, nil
+	return &contracts.SendResult{ID: id, StatusCode: 200, Message: "captured in inbox"}, nil
 }
 
 func (s *GatewayService) writeSMSToInbox(ctx context.Context, workspaceID string, sms contracts.SMS) (*contracts.SendResult, error) {
@@ -305,7 +260,7 @@ func (s *GatewayService) writeSMSToInbox(ctx context.Context, workspaceID string
 	if err != nil {
 		return nil, fmt.Errorf("write SMS to inbox: %w", err)
 	}
-	return &contracts.SendResult{ID: id, StatusCode: 200, Message: "captured in memory"}, nil
+	return &contracts.SendResult{ID: id, StatusCode: 200, Message: "captured in inbox"}, nil
 }
 
 func (s *GatewayService) writePushToInbox(ctx context.Context, workspaceID string, push contracts.PushNotification) (*contracts.SendResult, error) {
@@ -316,7 +271,7 @@ func (s *GatewayService) writePushToInbox(ctx context.Context, workspaceID strin
 	if err != nil {
 		return nil, fmt.Errorf("write push to inbox: %w", err)
 	}
-	return &contracts.SendResult{ID: id, StatusCode: 200, Message: "captured in memory"}, nil
+	return &contracts.SendResult{ID: id, StatusCode: 200, Message: "captured in inbox"}, nil
 }
 
 func (s *GatewayService) writeChatToInbox(ctx context.Context, workspaceID string, chat contracts.ChatMessage) (*contracts.SendResult, error) {
@@ -327,29 +282,7 @@ func (s *GatewayService) writeChatToInbox(ctx context.Context, workspaceID strin
 	if err != nil {
 		return nil, fmt.Errorf("write chat to inbox: %w", err)
 	}
-	return &contracts.SendResult{ID: id, StatusCode: 200, Message: "captured in memory"}, nil
-}
-
-// attachMeta stamps standard dispatch metadata onto r. When r is nil (error paths
-// with no provider payload), it allocates a minimal SendResult so callers can
-// still read provider_name via contracts.ProviderNameFromResult.
-func attachMeta(r *contracts.SendResult, effectiveMode domain.MessageDispatchMode, storeContent bool, channel, integrationID, providerName string) *contracts.SendResult {
-	if r == nil {
-		r = &contracts.SendResult{}
-	}
-	if r.Meta == nil {
-		r.Meta = make(map[string]string, 5)
-	}
-	contracts.SetDispatchModeMeta(r, string(effectiveMode))
-	contracts.SetStoreContentMeta(r, storeContent)
-	r.Meta["channel"] = channel
-	if integrationID != "" {
-		r.Meta["integration_id"] = integrationID
-	}
-	if providerName != "" {
-		r.Meta[contracts.MetaKeyProviderName] = providerName
-	}
-	return r
+	return &contracts.SendResult{ID: id, StatusCode: 200, Message: "captured in inbox"}, nil
 }
 
 // RecordLog persists a MessageRequestLog entry. Repository errors are logged at the infra layer.
diff --git a/internal/core/service/gateway_service_channels_test.go b/internal/core/service/gateway_service_channels_test.go
index ac4e29d8..fae5f4b1 100644
--- a/internal/core/service/gateway_service_channels_test.go
+++ b/internal/core/service/gateway_service_channels_test.go
@@ -6,13 +6,17 @@ import (
 
 	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
 	"github.com/weprodev/wpd-message-gateway/pkg/contracts"
+	_ "github.com/weprodev/wpd-message-gateway/pkg/provider/memory"
 )
 
 func TestGatewayService_SendSMS_memoryOnly(t *testing.T) {
 	t.Parallel()
 
+	settings := &stubSettingsRepo{values: map[string]string{
+		domain.SettingKeyStoreMessageContent: "true",
+	}}
 	inbox := &stubInbox{}
-	svc := NewGatewayService(&stubIntegrationRepo{}, nil, nil, inbox, nil)
+	svc := NewGatewayService(&stubIntegrationRepo{}, nil, settings, inbox, nil)
 
 	res, err := svc.SendSMS(context.Background(), "ws-1", contracts.SMS{
 		To:      []string{"+15550001111"},
@@ -35,8 +39,11 @@ func TestGatewayService_SendSMS_memoryOnly(t *testing.T) {
 func TestGatewayService_SendPush_memoryOnly(t *testing.T) {
 	t.Parallel()
 
+	settings := &stubSettingsRepo{values: map[string]string{
+		domain.SettingKeyStoreMessageContent: "true",
+	}}
 	inbox := &stubInbox{}
-	svc := NewGatewayService(&stubIntegrationRepo{}, nil, nil, inbox, nil)
+	svc := NewGatewayService(&stubIntegrationRepo{}, nil, settings, inbox, nil)
 
 	res, err := svc.SendPush(context.Background(), "ws-1", contracts.PushNotification{
 		DeviceTokens: []string{"device-token-1"},
@@ -60,8 +67,11 @@ func TestGatewayService_SendPush_memoryOnly(t *testing.T) {
 func TestGatewayService_SendChat_memoryOnly(t *testing.T) {
 	t.Parallel()
 
+	settings := &stubSettingsRepo{values: map[string]string{
+		domain.SettingKeyStoreMessageContent: "true",
+	}}
 	inbox := &stubInbox{}
-	svc := NewGatewayService(&stubIntegrationRepo{}, nil, nil, inbox, nil)
+	svc := NewGatewayService(&stubIntegrationRepo{}, nil, settings, inbox, nil)
 
 	res, err := svc.SendChat(context.Background(), "ws-1", contracts.ChatMessage{
 		To:      []string{"user-1"},
@@ -86,8 +96,11 @@ func TestGatewayService_SendSMS_memoryOnly_inboxNil(t *testing.T) {
 
 	svc := NewGatewayService(&stubIntegrationRepo{}, nil, nil, nil, nil)
 
-	_, err := svc.SendSMS(context.Background(), "ws-1", contracts.SMS{To: []string{"+1"}, Message: "x"})
-	if err == nil {
-		t.Fatal("expected error when inbox is nil")
+	res, err := svc.SendSMS(context.Background(), "ws-1", contracts.SMS{To: []string{"+1"}, Message: "x"})
+	if err != nil {
+		t.Fatalf("expected memory provider dispatch without inbox, got: %v", err)
+	}
+	if res.ID == "" {
+		t.Fatal("expected provider message id")
 	}
 }
diff --git a/internal/core/service/gateway_service_test.go b/internal/core/service/gateway_service_test.go
index 308095dc..77687f6d 100644
--- a/internal/core/service/gateway_service_test.go
+++ b/internal/core/service/gateway_service_test.go
@@ -10,6 +10,7 @@ import (
 	"github.com/weprodev/wpd-message-gateway/internal/core/port"
 	"github.com/weprodev/wpd-message-gateway/pkg/contracts"
 	"github.com/weprodev/wpd-message-gateway/pkg/provider/mailgun"
+	_ "github.com/weprodev/wpd-message-gateway/pkg/provider/memory"
 	"github.com/weprodev/wpd-message-gateway/pkg/registry"
 )
 
@@ -137,6 +138,27 @@ func TestGatewayService_ResolveDispatchConfig_fromSettings(t *testing.T) {
 	}
 }
 
+func TestGatewayService_SendEmail_memoryWithoutStoreContent(t *testing.T) {
+	inbox := &stubInbox{emailID: "should-not-write"}
+	svc := NewGatewayService(&stubIntegrationRepo{}, nil, &stubSettingsRepo{}, inbox, nil)
+
+	res, err := svc.SendEmail(context.Background(), "ws-1", contracts.Email{
+		To: []string{"a@b.com"}, Subject: "s", HTML: "h",
+	})
+	if err != nil {
+		t.Fatalf("SendEmail: %v", err)
+	}
+	if res.ID == "should-not-write" {
+		t.Fatal("expected memory provider dispatch, not portal inbox capture")
+	}
+	if res.Meta[contracts.MetaKeyStoreContent] != "false" {
+		t.Fatalf("store_content: %v", res.Meta[contracts.MetaKeyStoreContent])
+	}
+	if contracts.InboxMessageIDFromResult(res) != "" {
+		t.Fatalf("unexpected inbox_message_id: %v", contracts.InboxMessageIDFromResult(res))
+	}
+}
+
 func TestGatewayService_SendEmail_memoryWithStoreContent(t *testing.T) {
 	settings := &stubSettingsRepo{values: map[string]string{
 		domain.SettingKeyStoreMessageContent: "true",
@@ -171,7 +193,10 @@ func TestGatewayService_SendEmail_providerMissingIntegration(t *testing.T) {
 
 func TestGatewayService_SendEmail_memoryOnly(t *testing.T) {
 	inbox := &stubInbox{emailID: "mem-1"}
-	svc := NewGatewayService(&stubIntegrationRepo{}, nil, nil, inbox, nil)
+	settings := &stubSettingsRepo{values: map[string]string{
+		domain.SettingKeyStoreMessageContent: "true",
+	}}
+	svc := NewGatewayService(&stubIntegrationRepo{}, nil, settings, inbox, nil)
 
 	res, err := svc.SendEmail(context.Background(), "ws-1", contracts.Email{
 		To:      []string{"a@b.com"},
@@ -198,9 +223,12 @@ func TestGatewayService_SendEmail_memoryOnly(t *testing.T) {
 func TestGatewayService_SendEmail_memoryOnly_inboxNil(t *testing.T) {
 	svc := NewGatewayService(&stubIntegrationRepo{}, nil, nil, nil, nil)
 
-	_, err := svc.SendEmail(context.Background(), "ws-1", contracts.Email{To: []string{"a@b.com"}, Subject: "s"})
-	if err == nil {
-		t.Fatal("expected error when inbox is nil")
+	res, err := svc.SendEmail(context.Background(), "ws-1", contracts.Email{To: []string{"a@b.com"}, Subject: "s"})
+	if err != nil {
+		t.Fatalf("expected memory provider dispatch without inbox, got: %v", err)
+	}
+	if res.ID == "" {
+		t.Fatal("expected provider message id")
 	}
 }
 
@@ -367,13 +395,16 @@ func TestGatewayService_SendEmail_providerDatabase_mailgunIntegration(t *testing
 }
 
 func TestGatewayService_dispatch_errorResult_stampsProviderMeta(t *testing.T) {
-	svc := NewGatewayService(nil, nil, nil, nil, nil)
+	settings := &stubSettingsRepo{values: map[string]string{
+		domain.SettingKeyStoreMessageContent: "true",
+	}}
+	svc := NewGatewayService(nil, nil, settings, nil, nil)
 
 	res, err := svc.SendEmail(context.Background(), "ws-1", contracts.Email{
 		To: []string{"a@b.com"}, Subject: "s", HTML: "h",
 	})
 	if err == nil {
-		t.Fatal("expected inbox error")
+		t.Fatal("expected inbox error when store content enabled without inbox writer")
 	}
 	if contracts.ProviderNameFromResult(res) != domain.ProviderNameMemory {
 		t.Fatalf("provider_name: %q", contracts.ProviderNameFromResult(res))
diff --git a/internal/core/service/provider_cache.go b/internal/core/service/provider_cache.go
index ab8c175a..bb7d5827 100644
--- a/internal/core/service/provider_cache.go
+++ b/internal/core/service/provider_cache.go
@@ -4,12 +4,23 @@ import (
 	"encoding/json"
 	"fmt"
 	"sync"
+	"time"
 
 	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
 	"github.com/weprodev/wpd-message-gateway/pkg/contracts"
 	"github.com/weprodev/wpd-message-gateway/pkg/registry"
 )
 
+// memoryDispatchIntegration is a stable synthetic integration for in-process memory provider dispatch.
+func memoryDispatchIntegration() domain.Integration {
+	return domain.Integration{
+		ID:           domain.ProviderNameMemory,
+		ProviderName: domain.ProviderNameMemory,
+		Config:       []byte(`{}`),
+		UpdatedAt:    time.Unix(0, 0).UTC(),
+	}
+}
+
 // providerCache caches instantiated send providers keyed by integration ID and
 // the update timestamp. The timestamp acts as a natural version: when the
 // integration config changes, its updated_at advances and the old entry is
diff --git a/internal/presentation/handler/send_helper_test.go b/internal/presentation/handler/send_helper_test.go
index afe9c801..ae7a4987 100644
--- a/internal/presentation/handler/send_helper_test.go
+++ b/internal/presentation/handler/send_helper_test.go
@@ -88,7 +88,7 @@ func TestSendHelper_DispatchAndLog(t *testing.T) {
 		}
 	})
 
-	t.Run("successful dispatch stores inbox message id in memory mode", func(t *testing.T) {
+	t.Run("successful dispatch stores inbox message id when content retained", func(t *testing.T) {
 		req := httptest.NewRequest(http.MethodPost, "/v1/email", strings.NewReader(`{"to":["test@example.com"]}`))
 		rec := httptest.NewRecorder()
 		c := e.NewContext(req, rec)
@@ -104,6 +104,7 @@ func TestSendHelper_DispatchAndLog(t *testing.T) {
 				Meta: map[string]string{
 					contracts.MetaKeyProviderName: "memory",
 					contracts.MetaKeyDispatchMode: contracts.DispatchModeMemory,
+					contracts.MetaKeyStoreContent: "true",
 				},
 			}, nil
 		})
diff --git a/pkg/contracts/message.go b/pkg/contracts/message.go
index 7a00e173..e20ea0c6 100644
--- a/pkg/contracts/message.go
+++ b/pkg/contracts/message.go
@@ -54,10 +54,10 @@ func StoreContentFromResult(r *SendResult) bool {
 	return r.Meta[MetaKeyStoreContent] == metaStoreContentTrue
 }
 
-// InboxMessageIDFromResult returns the inbox message ID when dispatch captured content.
+// InboxMessageIDFromResult returns the inbox message ID when dispatch captured content in the portal inbox.
 //
 // Provider dispatch stores the inbox UUID in MetaKeyInboxMessageID; SendResult.ID is the provider ID.
-// Memory-only dispatch has no provider result, so SendResult.ID is the inbox UUID.
+// Memory dispatch with store_message_content stores the inbox UUID in SendResult.ID.
 func InboxMessageIDFromResult(r *SendResult) string {
 	if r == nil || r.Meta == nil {
 		return ""
@@ -65,6 +65,9 @@ func InboxMessageIDFromResult(r *SendResult) string {
 	if id := r.Meta[MetaKeyInboxMessageID]; id != "" {
 		return id
 	}
+	if !StoreContentFromResult(r) {
+		return ""
+	}
 	if r.Meta[MetaKeyDispatchMode] == DispatchModeMemory && r.ID != "" {
 		return r.ID
 	}
diff --git a/pkg/contracts/message_test.go b/pkg/contracts/message_test.go
index 62b63a37..9da8a79c 100644
--- a/pkg/contracts/message_test.go
+++ b/pkg/contracts/message_test.go
@@ -60,7 +60,20 @@ func TestInboxMessageIDFromResult(t *testing.T) {
 	}{
 		{"nil result", nil, ""},
 		{"provider without inbox", &SendResult{ID: "prov-1", Meta: map[string]string{MetaKeyDispatchMode: DispatchModeProvider}}, ""},
-		{"memory mode", &SendResult{ID: "inbox-1", Meta: map[string]string{MetaKeyDispatchMode: DispatchModeMemory}}, "inbox-1"},
+		{"memory mode retained", &SendResult{
+			ID: "inbox-1",
+			Meta: map[string]string{
+				MetaKeyDispatchMode: DispatchModeMemory,
+				MetaKeyStoreContent: metaStoreContentTrue,
+			},
+		}, "inbox-1"},
+		{"memory mode not retained", &SendResult{
+			ID: "mem-1",
+			Meta: map[string]string{
+				MetaKeyDispatchMode: DispatchModeMemory,
+				MetaKeyStoreContent: metaStoreContentFalse,
+			},
+		}, ""},
 		{"provider with inbox meta", &SendResult{
 			ID: "prov-1",
 			Meta: map[string]string{

From 4d80edf94d36c699deb25a38f87ad79ba1e62d6e Mon Sep 17 00:00:00 2001
From: MichaelAndish <maikel1370@gmail.com>
Date: Sat, 4 Jul 2026 21:30:00 +0200
Subject: [PATCH 17/20] refactor: streamline database initialization and seed
 application process

- Updated Makefile and init-db.sh to clarify the database initialization process, removing references to seed application during initialization.
- Introduced a new ApplySeeds function in the database package to handle seed application on gateway startup, ensuring idempotency and proper execution order.
- Removed the apply-seeds.sh script to simplify the seed application logic and prevent conflicts during database initialization.
- Added tests for the new seed application functionality to ensure correct behavior and error handling.

This commit enhances the database setup process by improving clarity and organization in seed management, aligning with the overall application structure.
---
 Makefile                                      | 19 +++---
 database/init-db.sh                           |  8 +--
 database/scripts/apply-seeds.sh               | 18 ------
 internal/app/wire.go                          |  5 ++
 internal/infrastructure/database/seeds.go     | 51 +++++++++++++++
 .../infrastructure/database/seeds_test.go     | 62 +++++++++++++++++++
 6 files changed, 129 insertions(+), 34 deletions(-)
 delete mode 100644 database/scripts/apply-seeds.sh
 create mode 100644 internal/infrastructure/database/seeds.go
 create mode 100644 internal/infrastructure/database/seeds_test.go

diff --git a/Makefile b/Makefile
index bfcd60ce..5822ca87 100644
--- a/Makefile
+++ b/Makefile
@@ -322,23 +322,22 @@ dev-down: docker-check
 	@docker compose down
 	@printf "$(GREEN)✅ Stopped!$(RESET)\n"
 
-## Apply schema + seeds when Postgres volume exists but tables are missing (then restart gateway)
+## Apply schema when Postgres volume exists but tables are missing (then restart gateway)
 db-init: docker-check
 	@printf "\n"
-	@printf "$(BOLD)$(CYAN)🗄️  Initializing database schema and seeds...$(RESET)\n"
+	@printf "$(BOLD)$(CYAN)🗄️  Initializing database schema...$(RESET)\n"
 	@docker compose exec -T -e POSTGRES_USER=gateway -e POSTGRES_DB=gateway db \
 		bash /docker-entrypoint-initdb.d/init-db.sh
 	@docker compose restart gateway
-	@printf "$(GREEN)✅ Database ready (demo@weprodev.com / secret)$(RESET)\n"
+	@printf "$(GREEN)✅ Database ready — gateway will apply seeds on startup (demo@weprodev.com / secret)$(RESET)\n"
 	@printf "\n"
 
-## Re-apply SQL seeds to the running Postgres container (demo user, RBAC, providers)
+## Re-apply SQL seeds by restarting the gateway (seeds run on every startup)
 seed-demo: docker-check
 	@printf "\n"
-	@printf "$(BOLD)$(CYAN)🌱 Applying database seeds...$(RESET)\n"
-	@docker compose exec -T -e POSTGRES_USER=gateway -e POSTGRES_DB=gateway db \
-		bash /docker-entrypoint-initdb.d/scripts/apply-seeds.sh /docker-entrypoint-initdb.d/seeds
-	@printf "$(GREEN)✅ Seeds applied (demo@weprodev.com / secret)$(RESET)\n"
+	@printf "$(BOLD)$(CYAN)🌱 Re-applying database seeds (gateway restart)...$(RESET)\n"
+	@docker compose restart gateway
+	@printf "$(GREEN)✅ Seeds applied on gateway startup (demo@weprodev.com / secret)$(RESET)\n"
 	@printf "\n"
 
 
@@ -386,8 +385,8 @@ help:
 	@printf "$(BOLD)$(GREEN)🐳 Docker$(RESET)\n"
 	@printf "   $(YELLOW)make dev$(RESET)          Start Gateway, DB, and UI via Docker (with hot-reloading)\n"
 	@printf "   $(YELLOW)make dev-down$(RESET)     Stop Docker containers\n"
-	@printf "   $(YELLOW)make db-init$(RESET)      Apply schema + seeds if DB volume is empty (demo login)\n"
-	@printf "   $(YELLOW)make seed-demo$(RESET)    Re-apply SQL seeds (demo@weprodev.com / secret)\n"
+	@printf "   $(YELLOW)make db-init$(RESET)      Apply schema if DB volume is empty; gateway seeds on start\n"
+	@printf "   $(YELLOW)make seed-demo$(RESET)    Re-apply seeds via gateway restart\n"
 	@printf "\n"
 
 	@printf "$(BOLD)$(CYAN)━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━$(RESET)\n"
diff --git a/database/init-db.sh b/database/init-db.sh
index 58b59fdf..f13789a7 100755
--- a/database/init-db.sh
+++ b/database/init-db.sh
@@ -7,7 +7,7 @@ TABLE_EXISTS=$(psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$PO
   "SELECT EXISTS (SELECT 1 FROM information_schema.tables WHERE table_schema = 'public' AND table_name = 'users');")
 
 if [ "$TABLE_EXISTS" = "t" ]; then
-  echo "Schema already present — skipping migration and seeds."
+  echo "Schema already present — skipping migration."
   exit 0
 fi
 
@@ -15,8 +15,4 @@ echo "Applying migrations..."
 psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" \
   -f /docker-entrypoint-initdb.d/migrations/20260318000000_init_gateway.up.sql
 
-echo "Applying seeds..."
-export POSTGRES_USER POSTGRES_DB
-bash /docker-entrypoint-initdb.d/scripts/apply-seeds.sh /docker-entrypoint-initdb.d/seeds
-
-echo "=== Database Init Script Completed ==="
+echo "=== Database Init Script Completed (seeds run on gateway startup) ==="
diff --git a/database/scripts/apply-seeds.sh b/database/scripts/apply-seeds.sh
deleted file mode 100644
index b654b5f7..00000000
--- a/database/scripts/apply-seeds.sh
+++ /dev/null
@@ -1,18 +0,0 @@
-#!/bin/bash
-# Apply idempotent SQL seeds in order. Invoked by init-db.sh and `make seed-demo` only —
-# must NOT live at the docker-entrypoint-initdb.d root (Postgres runs *.sh there alphabetically
-# before init-db.sh, which breaks first-time migration).
-set -euo pipefail
-
-SEEDS_DIR="${1:-/docker-entrypoint-initdb.d/seeds}"
-PSQL=(psql -v ON_ERROR_STOP=1 --username "${POSTGRES_USER:?}" --dbname "${POSTGRES_DB:?}")
-
-for seed in \
-  001_seed_permissions.sql \
-  002_seed_providers.sql \
-  003_seed_mailgun_config.sql \
-  004_demo_workspace.sql
-do
-  echo "→ seeds/$seed"
-  "${PSQL[@]}" -f "$SEEDS_DIR/$seed"
-done
diff --git a/internal/app/wire.go b/internal/app/wire.go
index 4914bbd0..cdc724f0 100644
--- a/internal/app/wire.go
+++ b/internal/app/wire.go
@@ -19,6 +19,7 @@ import (
 	"github.com/weprodev/wpd-message-gateway/internal/core/domain"
 	"github.com/weprodev/wpd-message-gateway/internal/core/service"
 	"github.com/weprodev/wpd-message-gateway/internal/infrastructure/authgate"
+	"github.com/weprodev/wpd-message-gateway/internal/infrastructure/database"
 	"github.com/weprodev/wpd-message-gateway/internal/infrastructure/inbox"
 	"github.com/weprodev/wpd-message-gateway/internal/infrastructure/repository/postgres"
 	"github.com/weprodev/wpd-message-gateway/internal/presentation"
@@ -62,6 +63,10 @@ func Wire(cfg *Config, sysLogger *pkglogger.Logger) (*Application, error) {
 		return nil, fmt.Errorf("connect to database: %w", err)
 	}
 
+	if err := database.ApplySeeds(startCtx, pgClient.GetDB(startCtx), database.SeedsDir()); err != nil {
+		return nil, fmt.Errorf("apply database seeds: %w", err)
+	}
+
 	// ── RBAC Gate ───────────────────────────────────────────────────────────
 	gateCfg := gogate.DefaultConfig()
 	gateCfg.DefaultGuardName = domain.RBACGuardName
diff --git a/internal/infrastructure/database/seeds.go b/internal/infrastructure/database/seeds.go
new file mode 100644
index 00000000..f8e16801
--- /dev/null
+++ b/internal/infrastructure/database/seeds.go
@@ -0,0 +1,51 @@
+package database
+
+import (
+	"context"
+	"database/sql"
+	"fmt"
+	"log/slog"
+	"os"
+	"path/filepath"
+	"sort"
+)
+
+type seedDB interface {
+	ExecContext(ctx context.Context, query string, args ...any) (sql.Result, error)
+}
+
+const defaultSeedsDir = "database/seeds"
+
+// SeedsDir returns the directory of idempotent SQL seed files.
+func SeedsDir() string {
+	if dir := os.Getenv("DATABASE_SEEDS_DIR"); dir != "" {
+		return dir
+	}
+	return defaultSeedsDir
+}
+
+// ApplySeeds runs all *.sql seed files in dir in lexicographic order.
+// Seed scripts must be idempotent (ON CONFLICT DO NOTHING, etc.).
+func ApplySeeds(ctx context.Context, db seedDB, dir string) error {
+	files, err := filepath.Glob(filepath.Join(dir, "*.sql"))
+	if err != nil {
+		return fmt.Errorf("list seed files: %w", err)
+	}
+	if len(files) == 0 {
+		return fmt.Errorf("no seed files in %s", dir)
+	}
+	sort.Strings(files)
+
+	for _, file := range files {
+		name := filepath.Base(file)
+		sqlBytes, err := os.ReadFile(file)
+		if err != nil {
+			return fmt.Errorf("read seed %s: %w", name, err)
+		}
+		slog.InfoContext(ctx, "applying database seed", "file", name)
+		if _, err := db.ExecContext(ctx, string(sqlBytes)); err != nil {
+			return fmt.Errorf("apply seed %s: %w", name, err)
+		}
+	}
+	return nil
+}
diff --git a/internal/infrastructure/database/seeds_test.go b/internal/infrastructure/database/seeds_test.go
new file mode 100644
index 00000000..6057e5ab
--- /dev/null
+++ b/internal/infrastructure/database/seeds_test.go
@@ -0,0 +1,62 @@
+package database
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/DATA-DOG/go-sqlmock"
+)
+
+func TestSeedsDir_default(t *testing.T) {
+	t.Setenv("DATABASE_SEEDS_DIR", "")
+	if got := SeedsDir(); got != defaultSeedsDir {
+		t.Fatalf("SeedsDir() = %q, want %q", got, defaultSeedsDir)
+	}
+}
+
+func TestSeedsDir_override(t *testing.T) {
+	t.Setenv("DATABASE_SEEDS_DIR", "/custom/seeds")
+	if got := SeedsDir(); got != "/custom/seeds" {
+		t.Fatalf("SeedsDir() = %q", got)
+	}
+}
+
+func TestApplySeeds_runsInOrder(t *testing.T) {
+	dir := t.TempDir()
+	for _, name := range []string{"002_second.sql", "001_first.sql"} {
+		if err := os.WriteFile(filepath.Join(dir, name), []byte("SELECT 1;"), 0o600); err != nil {
+			t.Fatalf("write seed: %v", err)
+		}
+	}
+
+	db, mock, err := sqlmock.New()
+	if err != nil {
+		t.Fatalf("sqlmock: %v", err)
+	}
+	defer db.Close()
+
+	mock.ExpectExec("SELECT 1").WillReturnResult(sqlmock.NewResult(0, 0))
+	mock.ExpectExec("SELECT 1").WillReturnResult(sqlmock.NewResult(0, 0))
+
+	if err := ApplySeeds(context.Background(), db, dir); err != nil {
+		t.Fatalf("ApplySeeds: %v", err)
+	}
+	if err := mock.ExpectationsWereMet(); err != nil {
+		t.Fatalf("expectations: %v", err)
+	}
+}
+
+func TestApplySeeds_noFiles(t *testing.T) {
+	db, _, err := sqlmock.New()
+	if err != nil {
+		t.Fatalf("sqlmock: %v", err)
+	}
+	defer db.Close()
+
+	err = ApplySeeds(context.Background(), db, t.TempDir())
+	if err == nil {
+		t.Fatal("expected error for empty seeds dir")
+	}
+}

From 9cfeb08807afe366da845167eecb5bffdbca6049 Mon Sep 17 00:00:00 2001
From: MichaelAndish <maikel1370@gmail.com>
Date: Sat, 4 Jul 2026 21:57:32 +0200
Subject: [PATCH 18/20] feat: enhance inbox email handling and testing

- Refactored the `useInboxEmails` hook to introduce an `upsertMessage` function for better message management.
- Updated the inbox API to include `fetchInboxEmailById`, improving email retrieval by ID.
- Modified tests for the `useInboxEmails` hook and `EmailInboxPage` to utilize the new `upsertMessage` function, ensuring consistent behavior.
- Enhanced the `PayloadInboxReader` to support email listing and deletion functionalities, improving inbox management.

This commit improves the overall functionality and testing of the inbox email handling, ensuring better user experience and data integrity.
---
 .../inbox/hooks/use-inbox-emails.hook.test.ts |  10 +-
 .../inbox/hooks/use-inbox-emails.hook.ts      |  35 +-
 .../inbox/pages/email-inbox.page.test.tsx     |   6 +-
 .../features/inbox/pages/email-inbox.page.tsx |  36 +-
 internal/app/wire.go                          |   5 +-
 internal/core/port/inbox.go                   |   4 +-
 .../postgres/payload_inbox_reader.go          | 513 ++++++++++++++++++
 .../postgres/payload_inbox_reader_test.go     |  94 ++++
 8 files changed, 660 insertions(+), 43 deletions(-)
 create mode 100644 internal/infrastructure/repository/postgres/payload_inbox_reader.go
 create mode 100644 internal/infrastructure/repository/postgres/payload_inbox_reader_test.go

diff --git a/frontend/src/features/inbox/hooks/use-inbox-emails.hook.test.ts b/frontend/src/features/inbox/hooks/use-inbox-emails.hook.test.ts
index ba056cc8..5766548b 100644
--- a/frontend/src/features/inbox/hooks/use-inbox-emails.hook.test.ts
+++ b/frontend/src/features/inbox/hooks/use-inbox-emails.hook.test.ts
@@ -1,14 +1,16 @@
 import { act, renderHook, waitFor } from "@testing-library/react"
-import { describe, expect, it, vi } from "vitest"
+import { describe, expect, it, vi, beforeEach } from "vitest"
 
-import { fetchInboxEmails } from "../inbox.api"
+import { fetchInboxEmailById, fetchInboxEmails } from "../inbox.api"
 import { useInboxEmails } from "./use-inbox-emails.hook"
 
 vi.mock("../inbox.api", () => ({
   fetchInboxEmails: vi.fn(),
+  fetchInboxEmailById: vi.fn(),
 }))
 
 const mockedFetchInboxEmails = vi.mocked(fetchInboxEmails)
+const mockedFetchInboxEmailById = vi.mocked(fetchInboxEmailById)
 
 const sampleEmail = {
   id: "email-1",
@@ -24,6 +26,10 @@ const sampleEmail = {
 }
 
 describe("useInboxEmails", () => {
+  beforeEach(() => {
+    mockedFetchInboxEmailById.mockResolvedValue({ ok: false })
+  })
+
   it("loads emails for a workspace", async () => {
     mockedFetchInboxEmails.mockResolvedValue({
       ok: true,
diff --git a/frontend/src/features/inbox/hooks/use-inbox-emails.hook.ts b/frontend/src/features/inbox/hooks/use-inbox-emails.hook.ts
index 8d67e7fe..62baf64e 100644
--- a/frontend/src/features/inbox/hooks/use-inbox-emails.hook.ts
+++ b/frontend/src/features/inbox/hooks/use-inbox-emails.hook.ts
@@ -1,6 +1,6 @@
 import { useCallback, useEffect, useState } from "react"
 
-import { fetchInboxEmails } from "../inbox.api"
+import { fetchInboxEmailById, fetchInboxEmails } from "../inbox.api"
 import type { StoredEmail } from "../inbox.types"
 
 const PAGE_SIZE = 50
@@ -14,6 +14,16 @@ export function useInboxEmails(workspaceId: string | undefined) {
   const [nextCursor, setNextCursor] = useState<string | undefined>()
   const [hasMore, setHasMore] = useState(false)
 
+  const upsertMessage = useCallback((message: StoredEmail) => {
+    setMessages((prev) => {
+      const index = prev.findIndex((m) => m.id === message.id)
+      if (index === -1) return [message, ...prev]
+      const next = [...prev]
+      next[index] = message
+      return next
+    })
+  }, [])
+
   const applyPage = useCallback((result: Awaited<ReturnType<typeof fetchInboxEmails>>) => {
     setIsLoading(false)
     if (!result.ok) {
@@ -46,6 +56,20 @@ export function useInboxEmails(workspaceId: string | undefined) {
     }
   }, [workspaceId, applyPage])
 
+  useEffect(() => {
+    if (!workspaceId || !selectedMessageId) return
+
+    let cancelled = false
+    void fetchInboxEmailById(workspaceId, selectedMessageId).then((result) => {
+      if (cancelled || !result.ok) return
+      upsertMessage(result.item)
+    })
+
+    return () => {
+      cancelled = true
+    }
+  }, [workspaceId, selectedMessageId, upsertMessage])
+
   const reload = useCallback(async () => {
     if (!workspaceId) return
     setIsLoading(true)
@@ -70,13 +94,6 @@ export function useInboxEmails(workspaceId: string | undefined) {
     setHasMore(result.page.has_more)
   }, [workspaceId, nextCursor, isLoadingMore])
 
-  const prependMessage = useCallback((message: StoredEmail) => {
-    setMessages((prev) => {
-      if (prev.some((m) => m.id === message.id)) return prev
-      return [message, ...prev]
-    })
-  }, [])
-
   const removeMessage = useCallback((messageId: string) => {
     setMessages((prev) => {
       const remaining = prev.filter((m) => m.id !== messageId)
@@ -108,7 +125,7 @@ export function useInboxEmails(workspaceId: string | undefined) {
     hasMore,
     reload,
     loadMore,
-    prependMessage,
+    upsertMessage,
     removeMessage,
     clearMessages,
   }
diff --git a/frontend/src/features/inbox/pages/email-inbox.page.test.tsx b/frontend/src/features/inbox/pages/email-inbox.page.test.tsx
index ca95e67d..4ff5d57c 100644
--- a/frontend/src/features/inbox/pages/email-inbox.page.test.tsx
+++ b/frontend/src/features/inbox/pages/email-inbox.page.test.tsx
@@ -47,7 +47,7 @@ describe("EmailInboxPage", () => {
       hasMore: false,
       reload: vi.fn(),
       loadMore: vi.fn(),
-      prependMessage: vi.fn(),
+      upsertMessage: vi.fn(),
       removeMessage: vi.fn(),
       clearMessages: vi.fn(),
     })
@@ -69,7 +69,7 @@ describe("EmailInboxPage", () => {
       hasMore: false,
       reload: vi.fn(),
       loadMore: vi.fn(),
-      prependMessage: vi.fn(),
+      upsertMessage: vi.fn(),
       removeMessage: vi.fn(),
       clearMessages: vi.fn(),
     })
@@ -91,7 +91,7 @@ describe("EmailInboxPage", () => {
       hasMore: false,
       reload: vi.fn(),
       loadMore: vi.fn(),
-      prependMessage: vi.fn(),
+      upsertMessage: vi.fn(),
       removeMessage: vi.fn(),
       clearMessages: vi.fn(),
     })
diff --git a/frontend/src/features/inbox/pages/email-inbox.page.tsx b/frontend/src/features/inbox/pages/email-inbox.page.tsx
index 501d52ff..2807393c 100644
--- a/frontend/src/features/inbox/pages/email-inbox.page.tsx
+++ b/frontend/src/features/inbox/pages/email-inbox.page.tsx
@@ -31,35 +31,21 @@ export function EmailInboxPage() {
     hasMore,
     reload,
     loadMore,
-    prependMessage,
+    upsertMessage,
     removeMessage,
     clearMessages,
   } = useInboxEmails(wid)
 
   useEffect(() => {
-    if (!wid || !deepLinkMessageId) return
+    if (!deepLinkMessageId) return
 
-    let cancelled = false
-    ;(async () => {
-      const result = await fetchInboxEmailById(wid, deepLinkMessageId)
-      if (cancelled) return
-
-      if (result.ok) {
-        prependMessage(result.item)
-        setSelectedMessageId(deepLinkMessageId)
-      }
-
-      setSearchParams((params) => {
-        const next = new URLSearchParams(params)
-        next.delete("message")
-        return next
-      }, { replace: true })
-    })()
-
-    return () => {
-      cancelled = true
-    }
-  }, [wid, deepLinkMessageId, setSearchParams, prependMessage, setSelectedMessageId])
+    setSelectedMessageId(deepLinkMessageId)
+    setSearchParams((params) => {
+      const next = new URLSearchParams(params)
+      next.delete("message")
+      return next
+    }, { replace: true })
+  }, [deepLinkMessageId, setSearchParams, setSelectedMessageId])
 
   useEffect(() => {
     if (!wid) return
@@ -84,7 +70,7 @@ export function EmailInboxPage() {
             if (!id) return
             void fetchInboxEmailById(wid, id).then((result) => {
               if (!result.ok) return
-              prependMessage(result.item)
+              upsertMessage(result.item)
               setSelectedMessageId((current) => current ?? id)
             })
             return
@@ -111,7 +97,7 @@ export function EmailInboxPage() {
     return () => {
       eventSource?.close()
     }
-  }, [wid, prependMessage, removeMessage, clearMessages, setSelectedMessageId])
+  }, [wid, upsertMessage, removeMessage, clearMessages, setSelectedMessageId])
 
   const handleDeleteMessage = async (messageId: string) => {
     if (!wid) return
diff --git a/internal/app/wire.go b/internal/app/wire.go
index cdc724f0..da385f32 100644
--- a/internal/app/wire.go
+++ b/internal/app/wire.go
@@ -129,8 +129,9 @@ func Wire(cfg *Config, sysLogger *pkglogger.Logger) (*Application, error) {
 		Gate:         authGate,
 	})
 
-	// ── Memory store & inbox writer ─────────────────────────────────────────
+	// ── Inbox: payload-backed reads, in-memory writes for SSE ───────────────
 	inboxStore := inbox.NewStore()
+	inboxReader := postgres.NewPayloadInboxReader(pgClient, inboxStore)
 	memoryStore := memory.GetStore()
 
 	var publishInboxEvent inbox.PublishFunc
@@ -139,7 +140,7 @@ func Wire(cfg *Config, sysLogger *pkglogger.Logger) (*Application, error) {
 			publishInboxEvent(workspaceID, eventType, data)
 		}
 	}))
-	portalInboxHandler := handler.NewPortalInboxHandler(inboxStore, inboxWriter)
+	portalInboxHandler := handler.NewPortalInboxHandler(inboxReader, inboxWriter)
 	publishInboxEvent = func(workspaceID, eventType string, data any) {
 		portalInboxHandler.PublishInboxEvent(workspaceID, eventType, data)
 	}
diff --git a/internal/core/port/inbox.go b/internal/core/port/inbox.go
index 5c26a035..ebf33ee8 100644
--- a/internal/core/port/inbox.go
+++ b/internal/core/port/inbox.go
@@ -67,7 +67,7 @@ type InboxChatPage struct {
 	HasMore    bool         `json:"has_more"`
 }
 
-// InboxReader is the read side of the in-process message capture store.
+// InboxReader is the read side of the message capture store (persisted payloads).
 type InboxReader interface {
 	StatsForWorkspace(workspaceID string) map[string]int
 	EmailsForWorkspace(workspaceID string) []StoredEmail
@@ -89,7 +89,7 @@ type InboxReader interface {
 	ClearWorkspace(workspaceID string)
 }
 
-// InboxWriter is the write side of the in-process message capture store.
+// InboxWriter is the write side of the message capture store.
 type InboxWriter interface {
 	WriteEmail(ctx context.Context, workspaceID string, email contracts.Email) (id string, err error)
 	WriteSMS(ctx context.Context, workspaceID string, sms contracts.SMS) (id string, err error)
diff --git a/internal/infrastructure/repository/postgres/payload_inbox_reader.go b/internal/infrastructure/repository/postgres/payload_inbox_reader.go
new file mode 100644
index 00000000..23d74427
--- /dev/null
+++ b/internal/infrastructure/repository/postgres/payload_inbox_reader.go
@@ -0,0 +1,513 @@
+package postgres
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"log/slog"
+	"time"
+
+	"github.com/weprodev/go-pkg/pgsql"
+
+	"github.com/weprodev/wpd-message-gateway/internal/core/port"
+	"github.com/weprodev/wpd-message-gateway/pkg/contracts"
+)
+
+const (
+	payloadInboxChannelEmail = "email"
+	payloadInboxChannelSMS   = "sms"
+	payloadInboxChannelPush  = "push"
+	payloadInboxChannelChat  = "chat"
+
+	payloadInboxDefaultPageSize = 50
+	payloadInboxMaxPageSize     = 200
+)
+
+var (
+	_ port.InboxReader = (*PayloadInboxReader)(nil)
+
+	channelStatKeys = map[string]string{
+		payloadInboxChannelEmail: "emails",
+		payloadInboxChannelSMS:   "sms",
+		payloadInboxChannelPush:  "push",
+		payloadInboxChannelChat:  "chat",
+	}
+)
+
+// PayloadInboxReader serves inbox reads from persisted message_request_payloads.
+// An optional fallback reader covers the brief window before request logs are written.
+type PayloadInboxReader struct {
+	client   *pgsql.PgClient
+	fallback port.InboxReader
+}
+
+func NewPayloadInboxReader(client *pgsql.PgClient, fallback port.InboxReader) *PayloadInboxReader {
+	return &PayloadInboxReader{client: client, fallback: fallback}
+}
+
+type payloadInboxRow struct {
+	logID          string
+	workspaceID    string
+	inboxMessageID sql.NullString
+	createdAt      time.Time
+	requestBody    string
+}
+
+func (row payloadInboxRow) messageID() string {
+	if row.inboxMessageID.Valid && row.inboxMessageID.String != "" {
+		return row.inboxMessageID.String
+	}
+	return row.logID
+}
+
+func clampPayloadInboxLimit(limit int) int {
+	if limit <= 0 {
+		return payloadInboxDefaultPageSize
+	}
+	if limit > payloadInboxMaxPageSize {
+		return payloadInboxMaxPageSize
+	}
+	return limit
+}
+
+func unmarshalPayload[T any](requestBody string) (T, error) {
+	var payload T
+	if err := json.Unmarshal([]byte(requestBody), &payload); err != nil {
+		return payload, err
+	}
+	return payload, nil
+}
+
+func listStoredMessages[T any](
+	r *PayloadInboxReader,
+	workspaceID, channel string,
+	limit int,
+	cursor string,
+	parse func(payloadInboxRow) (T, error),
+	idOf func(T) string,
+) ([]T, string, bool) {
+	rows, hasMore := r.queryPayloadRows(workspaceID, channel, limit, cursor)
+	items := make([]T, 0, len(rows))
+	for _, row := range rows {
+		item, err := parse(row)
+		if err != nil {
+			slog.Warn("inbox payload unreadable", "error", err, "log_id", row.logID, "channel", channel)
+			continue
+		}
+		items = append(items, item)
+	}
+
+	nextCursor := ""
+	if hasMore && len(items) > 0 {
+		nextCursor = idOf(items[len(items)-1])
+	}
+	return items, nextCursor, hasMore
+}
+
+func getStoredMessage[T any](primary, fallback func() (T, bool)) (T, bool) {
+	if item, ok := primary(); ok {
+		return item, true
+	}
+	return fallback()
+}
+
+func deleteStoredMessage(primary, fallback func() bool) bool {
+	return primary() || fallback()
+}
+
+func (r *PayloadInboxReader) StatsForWorkspace(workspaceID string) map[string]int {
+	ctx := context.Background()
+	const query = `
+		SELECT l.channel_type, COUNT(*)
+		FROM message_request_logs l
+		INNER JOIN message_request_payloads p ON p.log_id = l.id
+		WHERE l.workspace_id = $1
+		GROUP BY l.channel_type
+	`
+
+	rows, err := r.client.GetDB(ctx).QueryContext(ctx, query, workspaceID)
+	if err != nil {
+		slog.ErrorContext(ctx, "database error: failed to count inbox payloads", "error", err, "workspace_id", workspaceID)
+		return emptyInboxStats()
+	}
+	defer rows.Close() //nolint:errcheck
+
+	counts := emptyInboxStats()
+	for rows.Next() {
+		var channel string
+		var count int
+		if err := rows.Scan(&channel, &count); err != nil {
+			continue
+		}
+		if key, ok := channelStatKeys[channel]; ok {
+			counts[key] = count
+		}
+	}
+	counts["total"] = counts["emails"] + counts["sms"] + counts["push"] + counts["chat"]
+	return counts
+}
+
+func emptyInboxStats() map[string]int {
+	return map[string]int{"emails": 0, "sms": 0, "push": 0, "chat": 0, "total": 0}
+}
+
+func (r *PayloadInboxReader) EmailsForWorkspace(workspaceID string) []port.StoredEmail {
+	return r.ListEmailsForWorkspace(workspaceID, 0, "").Items
+}
+
+func (r *PayloadInboxReader) ListEmailsForWorkspace(workspaceID string, limit int, cursor string) port.InboxEmailPage {
+	items, nextCursor, hasMore := listStoredMessages(
+		r, workspaceID, payloadInboxChannelEmail, limit, cursor, parseStoredEmail,
+		func(item port.StoredEmail) string { return item.ID },
+	)
+	return port.InboxEmailPage{Items: items, NextCursor: nextCursor, HasMore: hasMore}
+}
+
+func (r *PayloadInboxReader) EmailByIDForWorkspace(id, workspaceID string) (port.StoredEmail, bool) {
+	return getStoredMessage(
+		func() (port.StoredEmail, bool) { return r.storedEmailByMessageID(workspaceID, id) },
+		func() (port.StoredEmail, bool) {
+			if r.fallback == nil {
+				return port.StoredEmail{}, false
+			}
+			return r.fallback.EmailByIDForWorkspace(id, workspaceID)
+		},
+	)
+}
+
+func (r *PayloadInboxReader) DeleteEmailByIDForWorkspace(id, workspaceID string) bool {
+	return deleteStoredMessage(
+		func() bool { return r.deletePayloadByMessageID(workspaceID, payloadInboxChannelEmail, id) },
+		func() bool {
+			if r.fallback == nil {
+				return false
+			}
+			return r.fallback.DeleteEmailByIDForWorkspace(id, workspaceID)
+		},
+	)
+}
+
+func (r *PayloadInboxReader) SMSForWorkspace(workspaceID string) []port.StoredSMS {
+	return r.ListSMSForWorkspace(workspaceID, 0, "").Items
+}
+
+func (r *PayloadInboxReader) ListSMSForWorkspace(workspaceID string, limit int, cursor string) port.InboxSMSPage {
+	items, nextCursor, hasMore := listStoredMessages(
+		r, workspaceID, payloadInboxChannelSMS, limit, cursor, parseStoredSMS,
+		func(item port.StoredSMS) string { return item.ID },
+	)
+	return port.InboxSMSPage{Items: items, NextCursor: nextCursor, HasMore: hasMore}
+}
+
+func (r *PayloadInboxReader) SMSByIDForWorkspace(id, workspaceID string) (port.StoredSMS, bool) {
+	return getStoredMessage(
+		func() (port.StoredSMS, bool) { return r.storedSMSByMessageID(workspaceID, id) },
+		func() (port.StoredSMS, bool) {
+			if r.fallback == nil {
+				return port.StoredSMS{}, false
+			}
+			return r.fallback.SMSByIDForWorkspace(id, workspaceID)
+		},
+	)
+}
+
+func (r *PayloadInboxReader) DeleteSMSByIDForWorkspace(id, workspaceID string) bool {
+	return deleteStoredMessage(
+		func() bool { return r.deletePayloadByMessageID(workspaceID, payloadInboxChannelSMS, id) },
+		func() bool {
+			if r.fallback == nil {
+				return false
+			}
+			return r.fallback.DeleteSMSByIDForWorkspace(id, workspaceID)
+		},
+	)
+}
+
+func (r *PayloadInboxReader) PushForWorkspace(workspaceID string) []port.StoredPush {
+	return r.ListPushForWorkspace(workspaceID, 0, "").Items
+}
+
+func (r *PayloadInboxReader) ListPushForWorkspace(workspaceID string, limit int, cursor string) port.InboxPushPage {
+	items, nextCursor, hasMore := listStoredMessages(
+		r, workspaceID, payloadInboxChannelPush, limit, cursor, parseStoredPush,
+		func(item port.StoredPush) string { return item.ID },
+	)
+	return port.InboxPushPage{Items: items, NextCursor: nextCursor, HasMore: hasMore}
+}
+
+func (r *PayloadInboxReader) PushByIDForWorkspace(id, workspaceID string) (port.StoredPush, bool) {
+	return getStoredMessage(
+		func() (port.StoredPush, bool) { return r.storedPushByMessageID(workspaceID, id) },
+		func() (port.StoredPush, bool) {
+			if r.fallback == nil {
+				return port.StoredPush{}, false
+			}
+			return r.fallback.PushByIDForWorkspace(id, workspaceID)
+		},
+	)
+}
+
+func (r *PayloadInboxReader) DeletePushByIDForWorkspace(id, workspaceID string) bool {
+	return deleteStoredMessage(
+		func() bool { return r.deletePayloadByMessageID(workspaceID, payloadInboxChannelPush, id) },
+		func() bool {
+			if r.fallback == nil {
+				return false
+			}
+			return r.fallback.DeletePushByIDForWorkspace(id, workspaceID)
+		},
+	)
+}
+
+func (r *PayloadInboxReader) ChatForWorkspace(workspaceID string) []port.StoredChat {
+	return r.ListChatForWorkspace(workspaceID, 0, "").Items
+}
+
+func (r *PayloadInboxReader) ListChatForWorkspace(workspaceID string, limit int, cursor string) port.InboxChatPage {
+	items, nextCursor, hasMore := listStoredMessages(
+		r, workspaceID, payloadInboxChannelChat, limit, cursor, parseStoredChat,
+		func(item port.StoredChat) string { return item.ID },
+	)
+	return port.InboxChatPage{Items: items, NextCursor: nextCursor, HasMore: hasMore}
+}
+
+func (r *PayloadInboxReader) ChatByIDForWorkspace(id, workspaceID string) (port.StoredChat, bool) {
+	return getStoredMessage(
+		func() (port.StoredChat, bool) { return r.storedChatByMessageID(workspaceID, id) },
+		func() (port.StoredChat, bool) {
+			if r.fallback == nil {
+				return port.StoredChat{}, false
+			}
+			return r.fallback.ChatByIDForWorkspace(id, workspaceID)
+		},
+	)
+}
+
+func (r *PayloadInboxReader) DeleteChatByIDForWorkspace(id, workspaceID string) bool {
+	return deleteStoredMessage(
+		func() bool { return r.deletePayloadByMessageID(workspaceID, payloadInboxChannelChat, id) },
+		func() bool {
+			if r.fallback == nil {
+				return false
+			}
+			return r.fallback.DeleteChatByIDForWorkspace(id, workspaceID)
+		},
+	)
+}
+
+func (r *PayloadInboxReader) ClearWorkspace(workspaceID string) {
+	ctx := context.Background()
+	const query = `
+		DELETE FROM message_request_payloads
+		WHERE log_id IN (
+			SELECT id FROM message_request_logs WHERE workspace_id = $1
+		)
+	`
+	if _, err := r.client.GetDB(ctx).ExecContext(ctx, query, workspaceID); err != nil {
+		slog.ErrorContext(ctx, "database error: failed to clear inbox payloads", "error", err, "workspace_id", workspaceID)
+	}
+	if r.fallback != nil {
+		r.fallback.ClearWorkspace(workspaceID)
+	}
+}
+
+func (r *PayloadInboxReader) storedEmailByMessageID(workspaceID, messageID string) (port.StoredEmail, bool) {
+	return storedMessageByID(r, workspaceID, payloadInboxChannelEmail, messageID, parseStoredEmail)
+}
+
+func (r *PayloadInboxReader) storedSMSByMessageID(workspaceID, messageID string) (port.StoredSMS, bool) {
+	return storedMessageByID(r, workspaceID, payloadInboxChannelSMS, messageID, parseStoredSMS)
+}
+
+func (r *PayloadInboxReader) storedPushByMessageID(workspaceID, messageID string) (port.StoredPush, bool) {
+	return storedMessageByID(r, workspaceID, payloadInboxChannelPush, messageID, parseStoredPush)
+}
+
+func (r *PayloadInboxReader) storedChatByMessageID(workspaceID, messageID string) (port.StoredChat, bool) {
+	return storedMessageByID(r, workspaceID, payloadInboxChannelChat, messageID, parseStoredChat)
+}
+
+func storedMessageByID[T any](
+	r *PayloadInboxReader,
+	workspaceID, channel, messageID string,
+	parse func(payloadInboxRow) (T, error),
+) (T, bool) {
+	var zero T
+	row, ok := r.payloadRowByMessageID(workspaceID, channel, messageID)
+	if !ok {
+		return zero, false
+	}
+	item, err := parse(row)
+	if err != nil {
+		return zero, false
+	}
+	return item, true
+}
+
+func (r *PayloadInboxReader) queryPayloadRows(workspaceID, channel string, limit int, cursor string) ([]payloadInboxRow, bool) {
+	ctx := context.Background()
+	limit = clampPayloadInboxLimit(limit)
+	fetchLimit := limit + 1
+
+	cursorCreatedAt, cursorLogID, hasCursor := r.resolvePayloadCursor(ctx, workspaceID, channel, cursor)
+
+	const baseSelect = `
+		SELECT l.id, l.workspace_id, l.inbox_message_id, l.created_at, p.request_body
+		FROM message_request_logs l
+		INNER JOIN message_request_payloads p ON p.log_id = l.id
+		WHERE l.workspace_id = $1 AND l.channel_type = $2
+	`
+
+	var (
+		rows *sql.Rows
+		err  error
+	)
+	if hasCursor {
+		query := baseSelect + `
+			AND (l.created_at, l.id) < ($3, $4)
+			ORDER BY l.created_at DESC, l.id DESC
+			LIMIT $5
+		`
+		rows, err = r.client.GetDB(ctx).QueryContext(ctx, query, workspaceID, channel, cursorCreatedAt, cursorLogID, fetchLimit)
+	} else {
+		query := baseSelect + `
+			ORDER BY l.created_at DESC, l.id DESC
+			LIMIT $3
+		`
+		rows, err = r.client.GetDB(ctx).QueryContext(ctx, query, workspaceID, channel, fetchLimit)
+	}
+	if err != nil {
+		slog.ErrorContext(ctx, "database error: failed to list inbox payloads", "error", err, "workspace_id", workspaceID, "channel", channel)
+		return nil, false
+	}
+	defer rows.Close() //nolint:errcheck
+
+	var items []payloadInboxRow
+	for rows.Next() {
+		var row payloadInboxRow
+		if err := rows.Scan(&row.logID, &row.workspaceID, &row.inboxMessageID, &row.createdAt, &row.requestBody); err != nil {
+			continue
+		}
+		items = append(items, row)
+	}
+	if err := rows.Err(); err != nil {
+		slog.ErrorContext(ctx, "database error: inbox payload list iteration failed", "error", err)
+		return nil, false
+	}
+
+	hasMore := len(items) > limit
+	if hasMore {
+		items = items[:limit]
+	}
+	return items, hasMore
+}
+
+func (r *PayloadInboxReader) resolvePayloadCursor(ctx context.Context, workspaceID, channel, cursor string) (time.Time, string, bool) {
+	if cursor == "" {
+		return time.Time{}, "", false
+	}
+
+	const query = `
+		SELECT l.created_at, l.id
+		FROM message_request_logs l
+		INNER JOIN message_request_payloads p ON p.log_id = l.id
+		WHERE l.workspace_id = $1 AND l.channel_type = $2
+		  AND (l.inbox_message_id = $3 OR l.id::text = $3)
+	`
+	var createdAt time.Time
+	var logID string
+	err := r.client.GetDB(ctx).QueryRowContext(ctx, query, workspaceID, channel, cursor).Scan(&createdAt, &logID)
+	if errors.Is(err, sql.ErrNoRows) {
+		return time.Time{}, "", false
+	}
+	if err != nil {
+		slog.ErrorContext(ctx, "database error: failed to resolve inbox payload cursor", "error", err, "cursor", cursor)
+		return time.Time{}, "", false
+	}
+	return createdAt, logID, true
+}
+
+func (r *PayloadInboxReader) payloadRowByMessageID(workspaceID, channel, messageID string) (payloadInboxRow, bool) {
+	ctx := context.Background()
+	const query = `
+		SELECT l.id, l.workspace_id, l.inbox_message_id, l.created_at, p.request_body
+		FROM message_request_logs l
+		INNER JOIN message_request_payloads p ON p.log_id = l.id
+		WHERE l.workspace_id = $1 AND l.channel_type = $2
+		  AND (l.inbox_message_id = $3 OR l.id::text = $3)
+	`
+
+	var row payloadInboxRow
+	err := r.client.GetDB(ctx).QueryRowContext(ctx, query, workspaceID, channel, messageID).
+		Scan(&row.logID, &row.workspaceID, &row.inboxMessageID, &row.createdAt, &row.requestBody)
+	if errors.Is(err, sql.ErrNoRows) {
+		return payloadInboxRow{}, false
+	}
+	if err != nil {
+		slog.ErrorContext(ctx, "database error: failed to get inbox payload", "error", err, "message_id", messageID)
+		return payloadInboxRow{}, false
+	}
+	return row, true
+}
+
+func (r *PayloadInboxReader) deletePayloadByMessageID(workspaceID, channel, messageID string) bool {
+	ctx := context.Background()
+	const query = `
+		DELETE FROM message_request_payloads
+		WHERE log_id IN (
+			SELECT l.id
+			FROM message_request_logs l
+			WHERE l.workspace_id = $1 AND l.channel_type = $2
+			  AND (l.inbox_message_id = $3 OR l.id::text = $3)
+		)
+	`
+	res, err := r.client.GetDB(ctx).ExecContext(ctx, query, workspaceID, channel, messageID)
+	if err != nil {
+		slog.ErrorContext(ctx, "database error: failed to delete inbox payload", "error", err, "message_id", messageID)
+		return false
+	}
+	n, err := res.RowsAffected()
+	return err == nil && n > 0
+}
+
+func parseStoredEmail(row payloadInboxRow) (port.StoredEmail, error) {
+	email, err := unmarshalPayload[contracts.Email](row.requestBody)
+	if err != nil {
+		return port.StoredEmail{}, fmt.Errorf("unmarshal email payload: %w", err)
+	}
+	return port.StoredEmail{
+		ID: row.messageID(), WorkspaceID: row.workspaceID, CreatedAt: row.createdAt, Email: email,
+	}, nil
+}
+
+func parseStoredSMS(row payloadInboxRow) (port.StoredSMS, error) {
+	sms, err := unmarshalPayload[contracts.SMS](row.requestBody)
+	if err != nil {
+		return port.StoredSMS{}, fmt.Errorf("unmarshal sms payload: %w", err)
+	}
+	return port.StoredSMS{
+		ID: row.messageID(), WorkspaceID: row.workspaceID, CreatedAt: row.createdAt, SMS: sms,
+	}, nil
+}
+
+func parseStoredPush(row payloadInboxRow) (port.StoredPush, error) {
+	push, err := unmarshalPayload[contracts.PushNotification](row.requestBody)
+	if err != nil {
+		return port.StoredPush{}, fmt.Errorf("unmarshal push payload: %w", err)
+	}
+	return port.StoredPush{
+		ID: row.messageID(), WorkspaceID: row.workspaceID, CreatedAt: row.createdAt, Push: push,
+	}, nil
+}
+
+func parseStoredChat(row payloadInboxRow) (port.StoredChat, error) {
+	chat, err := unmarshalPayload[contracts.ChatMessage](row.requestBody)
+	if err != nil {
+		return port.StoredChat{}, fmt.Errorf("unmarshal chat payload: %w", err)
+	}
+	return port.StoredChat{
+		ID: row.messageID(), WorkspaceID: row.workspaceID, CreatedAt: row.createdAt, Chat: chat,
+	}, nil
+}
diff --git a/internal/infrastructure/repository/postgres/payload_inbox_reader_test.go b/internal/infrastructure/repository/postgres/payload_inbox_reader_test.go
new file mode 100644
index 00000000..79577a0d
--- /dev/null
+++ b/internal/infrastructure/repository/postgres/payload_inbox_reader_test.go
@@ -0,0 +1,94 @@
+package postgres
+
+import (
+	"encoding/json"
+	"regexp"
+	"testing"
+	"time"
+
+	"github.com/DATA-DOG/go-sqlmock"
+
+	"github.com/weprodev/wpd-message-gateway/pkg/contracts"
+)
+
+func TestPayloadInboxReader_ListEmailsForWorkspace(t *testing.T) {
+	t.Parallel()
+
+	client, mock, _ := newMockPgClient(t)
+	repo := NewPayloadInboxReader(client, nil)
+	workspaceID := "ws-1"
+	email := contracts.Email{Subject: "Hello", To: []string{"a@test.com"}, HTML: "<p>Hi</p>"}
+	requestBody, _ := json.Marshal(email)
+	createdAt := time.Now().UTC().Truncate(time.Second)
+
+	mock.ExpectQuery(regexp.QuoteMeta(`
+			SELECT l.id, l.workspace_id, l.inbox_message_id, l.created_at, p.request_body
+			FROM message_request_logs l
+			INNER JOIN message_request_payloads p ON p.log_id = l.id
+			WHERE l.workspace_id = $1 AND l.channel_type = $2
+		`)).
+		WithArgs(workspaceID, payloadInboxChannelEmail, payloadInboxDefaultPageSize+1).
+		WillReturnRows(sqlmock.NewRows([]string{"id", "workspace_id", "inbox_message_id", "created_at", "request_body"}).
+			AddRow("log-1", workspaceID, "inbox-1", createdAt, string(requestBody)))
+
+	page := repo.ListEmailsForWorkspace(workspaceID, 0, "")
+	if len(page.Items) != 1 {
+		t.Fatalf("items len = %d, want 1", len(page.Items))
+	}
+	if page.Items[0].ID != "inbox-1" {
+		t.Fatalf("id = %q, want inbox-1", page.Items[0].ID)
+	}
+	if page.Items[0].Email.Subject != "Hello" {
+		t.Fatalf("subject = %q", page.Items[0].Email.Subject)
+	}
+
+	if err := mock.ExpectationsWereMet(); err != nil {
+		t.Fatalf("expectations: %v", err)
+	}
+}
+
+func TestPayloadInboxReader_DeleteEmailByIDForWorkspace(t *testing.T) {
+	t.Parallel()
+
+	client, mock, _ := newMockPgClient(t)
+	repo := NewPayloadInboxReader(client, nil)
+
+	mock.ExpectExec(regexp.QuoteMeta(`
+		DELETE FROM message_request_payloads
+		WHERE log_id IN (
+			SELECT l.id
+			FROM message_request_logs l
+			WHERE l.workspace_id = $1 AND l.channel_type = $2
+			  AND (l.inbox_message_id = $3 OR l.id::text = $3)
+		)
+	`)).
+		WithArgs("ws-1", payloadInboxChannelEmail, "inbox-1").
+		WillReturnResult(sqlmock.NewResult(0, 1))
+
+	if !repo.DeleteEmailByIDForWorkspace("inbox-1", "ws-1") {
+		t.Fatal("expected delete success")
+	}
+}
+
+func TestPayloadInboxReader_StatsForWorkspace(t *testing.T) {
+	t.Parallel()
+
+	client, mock, _ := newMockPgClient(t)
+	repo := NewPayloadInboxReader(client, nil)
+
+	mock.ExpectQuery(regexp.QuoteMeta(`
+		SELECT l.channel_type, COUNT(*)
+		FROM message_request_logs l
+		INNER JOIN message_request_payloads p ON p.log_id = l.id
+		WHERE l.workspace_id = $1
+		GROUP BY l.channel_type
+	`)).
+		WithArgs("ws-1").
+		WillReturnRows(sqlmock.NewRows([]string{"channel_type", "count"}).
+			AddRow(payloadInboxChannelEmail, 3))
+
+	stats := repo.StatsForWorkspace("ws-1")
+	if stats["emails"] != 3 || stats["total"] != 3 {
+		t.Fatalf("stats = %v", stats)
+	}
+}

From 636894fd78197b683b45538e684ebcb841c5db27 Mon Sep 17 00:00:00 2001
From: MichaelAndish <maikel1370@gmail.com>
Date: Sat, 4 Jul 2026 22:01:52 +0200
Subject: [PATCH 19/20] chore: update deps

---
 frontend/package-lock.json | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 90763c7c..3ce708e2 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -4614,9 +4614,9 @@
       }
     },
     "node_modules/baseline-browser-mapping": {
-      "version": "2.10.41",
-      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.10.41.tgz",
-      "integrity": "sha512-WwS7MHhqGHHlaVsqRZnhvCEMS0owDX+SxRlve7JkuH7My1Ara3ZriTmCQupPfYjxMZ8I/tgxtJYr2t7taHaH4A==",
+      "version": "2.10.42",
+      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.10.42.tgz",
+      "integrity": "sha512-c/jurFrDLyui7o1J86yLkRu4LMsTYcBohveus7/I2Hzdn9KIP2bdJPTue/lR1KH46enoPbD77GKeSYNdyPoD3Q==",
       "dev": true,
       "license": "Apache-2.0",
       "bin": {
@@ -4977,9 +4977,9 @@
       "license": "MIT"
     },
     "node_modules/electron-to-chromium": {
-      "version": "1.5.385",
-      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.385.tgz",
-      "integrity": "sha512-78sa/M08MNAYHQfjoWMvOlKQqZ0ElhSm/L5HNUc96VZ3b+KvDVnngFm8sYQy0XrhTRgAhggHr5abA7yTvRdo4Q==",
+      "version": "1.5.387",
+      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.387.tgz",
+      "integrity": "sha512-TaxwufTFDufvPEoXdhwVrA3UdFWBeWGkYoJ1K8ldF1xe6gKfth6iRNS5lTQ5JPNOHdGQm8PT1QYKUqFLCiUefQ==",
       "dev": true,
       "license": "ISC"
     },

From cc6633b6a286e162b6091a63ca3e936504641a08 Mon Sep 17 00:00:00 2001
From: MichaelAndish <maikel1370@gmail.com>
Date: Sat, 4 Jul 2026 22:13:36 +0200
Subject: [PATCH 20/20] chore: update CI workflow and refactor server
 initialization

- Enhanced the CI workflow to include a readiness check for the server, ensuring it is fully operational before proceeding.
- Removed the default configuration path from the server initialization, allowing for more flexible configuration management.
- Updated the main function to clarify the configuration file path handling, defaulting to environment variables or a specified path.
- Added support for an example configuration file in the application, improving the setup process for new developers.
- Refactored health check endpoint in the router to return a structured JSON response, enhancing API clarity.

This commit improves the CI process and server configuration management, ensuring better reliability and developer experience.
---
 .github/workflows/ci.yml                           |  8 +++++++-
 cmd/server/init.go                                 |  7 -------
 cmd/server/main.go                                 |  2 +-
 internal/app/config.go                             |  1 +
 internal/presentation/router.go                    |  5 +++++
 tests/bruno/Portal/00_Auth/Login.bru               |  2 +-
 tests/bruno/Portal/00_Auth/Register.bru            |  4 ++--
 tests/bruno/Portal/Chat/List Chat.bru              | 10 ++++++----
 tests/bruno/Portal/Push/List Push.bru              | 10 ++++++----
 tests/bruno/Portal/SMS/List SMS.bru                | 10 ++++++----
 tests/bruno/Portal/Workspaces/Create Workspace.bru |  2 +-
 11 files changed, 36 insertions(+), 25 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d1247e62..d0b33a42 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -201,13 +201,19 @@ jobs:
       # Wait for server
       - name: Wait for server to be ready
         run: |
+          ready=0
           for i in {1..30}; do
-            if curl -s http://localhost:10101/health > /dev/null 2>&1; then
+            if curl -sf http://localhost:10101/health > /dev/null 2>&1; then
               echo "Server ready"
+              ready=1
               break
             fi
             sleep 1
           done
+          if [ "$ready" -ne 1 ]; then
+            echo "Server did not become ready within 30s"
+            exit 1
+          fi
 
       - name: Install Bruno CLI
         run: npm install -g @usebruno/cli
diff --git a/cmd/server/init.go b/cmd/server/init.go
index 6ab1055f..df218735 100644
--- a/cmd/server/init.go
+++ b/cmd/server/init.go
@@ -9,13 +9,6 @@ import (
 	applogger "github.com/weprodev/wpd-message-gateway/internal/infrastructure/logger"
 )
 
-// defaultConfigPath can be overridden at build time via -ldflags.
-var defaultConfigPath = "configs/local.yml"
-
-func getDefaultConfigPath() string {
-	return defaultConfigPath
-}
-
 func loadAppConfig(configPath string) (*app.Config, error) {
 	return app.LoadAppConfig(configPath)
 }
diff --git a/cmd/server/main.go b/cmd/server/main.go
index 90d4b7be..267c02b6 100644
--- a/cmd/server/main.go
+++ b/cmd/server/main.go
@@ -20,7 +20,7 @@ func main() {
 }
 
 func run() error {
-	configPath := flag.String("config", getDefaultConfigPath(), "Path to config file")
+	configPath := flag.String("config", "", "Path to config file (default: CONFIG_PATH env or configs/local.yml)")
 	flag.Parse()
 
 	cfg, err := loadAppConfig(*configPath)
diff --git a/internal/app/config.go b/internal/app/config.go
index 513651a1..89b67ff9 100644
--- a/internal/app/config.go
+++ b/internal/app/config.go
@@ -154,6 +154,7 @@ func resolveConfigPath(configPath string) string {
 		"/configs/local.yml",
 		"/configs/config.yml",
 		"configs/local.yml",
+		"configs/local.example.yml",
 	} {
 		if _, err := os.Stat(candidate); err == nil {
 			return candidate
diff --git a/internal/presentation/router.go b/internal/presentation/router.go
index 9ccf7299..f7fabe5a 100644
--- a/internal/presentation/router.go
+++ b/internal/presentation/router.go
@@ -2,6 +2,7 @@ package presentation
 
 import (
 	"log/slog"
+	"net/http"
 
 	"github.com/labstack/echo/v4"
 	echomiddleware "github.com/labstack/echo/v4/middleware"
@@ -112,6 +113,10 @@ func (rt *Router) Setup() *echo.Echo {
 			return nil
 		},
 	}))
+	e.GET("/health", func(c echo.Context) error {
+		return c.JSON(http.StatusOK, map[string]string{"status": "ok"})
+	})
+
 	e.Use(echomiddleware.CORSWithConfig(echomiddleware.CORSConfig{
 		AllowOrigins: []string{"*"},
 		AllowMethods: []string{echo.GET, echo.POST, echo.PUT, echo.PATCH, echo.DELETE, echo.OPTIONS},
diff --git a/tests/bruno/Portal/00_Auth/Login.bru b/tests/bruno/Portal/00_Auth/Login.bru
index feb7c255..03ece0ac 100644
--- a/tests/bruno/Portal/00_Auth/Login.bru
+++ b/tests/bruno/Portal/00_Auth/Login.bru
@@ -23,5 +23,5 @@ tests {
     expect(res.body.token).to.be.a("string");
   });
 
-  bru.setEnvVar("portalJwt", res.body.token);
+  bru.setVar("portalJwt", res.body.token);
 }
diff --git a/tests/bruno/Portal/00_Auth/Register.bru b/tests/bruno/Portal/00_Auth/Register.bru
index f3b6b7cf..f9d05fae 100644
--- a/tests/bruno/Portal/00_Auth/Register.bru
+++ b/tests/bruno/Portal/00_Auth/Register.bru
@@ -14,7 +14,7 @@ body:json {
   {
     "first_name": "Test",
     "last_name": "User",
-    "email": "newuser@example.com",
+    "email": "bruno-{{$timestamp}}@example.com",
     "password": "password123"
   }
 }
@@ -23,6 +23,6 @@ tests {
   test("should register user successfully", function() {
     expect(res.status).to.equal(201);
     expect(res.body.id).to.be.a("string");
-    expect(res.body.email).to.equal("newuser@example.com");
+    expect(res.body.email).to.match(/^bruno-\d+@example\.com$/);
   });
 }
diff --git a/tests/bruno/Portal/Chat/List Chat.bru b/tests/bruno/Portal/Chat/List Chat.bru
index 83361af0..3a988d9d 100644
--- a/tests/bruno/Portal/Chat/List Chat.bru	
+++ b/tests/bruno/Portal/Chat/List Chat.bru	
@@ -22,13 +22,15 @@ tests {
     expect(res.status).to.equal(200);
   });
 
-  test("should return array", function() {
-    expect(res.body).to.be.an("array");
+  test("should return paginated page", function() {
+    expect(res.body).to.be.an("object");
+    expect(res.body.items).to.be.an("array");
+    expect(res.body).to.have.property("has_more");
   });
 
   test("should have chat with required fields", function() {
-    if (res.body.length > 0) {
-      const chat = res.body[0];
+    if (res.body.items.length > 0) {
+      const chat = res.body.items[0];
       expect(chat).to.have.property("id");
       expect(chat).to.have.property("chat");
       expect(chat).to.have.property("created_at");
diff --git a/tests/bruno/Portal/Push/List Push.bru b/tests/bruno/Portal/Push/List Push.bru
index cbc9f171..038fff84 100644
--- a/tests/bruno/Portal/Push/List Push.bru	
+++ b/tests/bruno/Portal/Push/List Push.bru	
@@ -22,13 +22,15 @@ tests {
     expect(res.status).to.equal(200);
   });
 
-  test("should return array", function() {
-    expect(res.body).to.be.an("array");
+  test("should return paginated page", function() {
+    expect(res.body).to.be.an("object");
+    expect(res.body.items).to.be.an("array");
+    expect(res.body).to.have.property("has_more");
   });
 
   test("should have push with required fields", function() {
-    if (res.body.length > 0) {
-      const push = res.body[0];
+    if (res.body.items.length > 0) {
+      const push = res.body.items[0];
       expect(push).to.have.property("id");
       expect(push).to.have.property("push");
       expect(push).to.have.property("created_at");
diff --git a/tests/bruno/Portal/SMS/List SMS.bru b/tests/bruno/Portal/SMS/List SMS.bru
index 119059fa..1aa9e4a9 100644
--- a/tests/bruno/Portal/SMS/List SMS.bru	
+++ b/tests/bruno/Portal/SMS/List SMS.bru	
@@ -22,13 +22,15 @@ tests {
     expect(res.status).to.equal(200);
   });
 
-  test("should return array", function() {
-    expect(res.body).to.be.an("array");
+  test("should return paginated page", function() {
+    expect(res.body).to.be.an("object");
+    expect(res.body.items).to.be.an("array");
+    expect(res.body).to.have.property("has_more");
   });
 
   test("should have SMS with required fields", function() {
-    if (res.body.length > 0) {
-      const sms = res.body[0];
+    if (res.body.items.length > 0) {
+      const sms = res.body.items[0];
       expect(sms).to.have.property("id");
       expect(sms).to.have.property("sms");
       expect(sms).to.have.property("created_at");
diff --git a/tests/bruno/Portal/Workspaces/Create Workspace.bru b/tests/bruno/Portal/Workspaces/Create Workspace.bru
index 00cc30f6..75019fa9 100644
--- a/tests/bruno/Portal/Workspaces/Create Workspace.bru	
+++ b/tests/bruno/Portal/Workspaces/Create Workspace.bru	
@@ -17,7 +17,7 @@ auth:bearer {
 body:json {
   {
     "name": "New Test Workspace",
-    "slug": "new-test-workspace",
+    "slug": "bruno-ws-{{$timestamp}}",
     "icon_key": "package"
   }
 }