diff --git a/.cursor/rules/00-modulith-architecture.mdc b/.cursor/rules/00-modulith-architecture.mdc
index d20612c..748ab0a 100644
--- a/.cursor/rules/00-modulith-architecture.mdc
+++ b/.cursor/rules/00-modulith-architecture.mdc
@@ -22,8 +22,8 @@ Maintain this repo as a **base template** for a **Modular Monolith (Modulith)**
 
 ## When adding a new module
 
--   Use `make new-module <name>`.
+-   Use `just new-module <name>`.
 -   Then:
-    -   `make generate-all` (generates sqlc + proto + mocks)
+    -   `just generate-all` (generates sqlc + proto + mocks)
     -   Register the module in `cmd/server/main.go` (and in its `<mod>-svc` if applicable).
-    -   Run migrations: `make migrate-up`
+    -   Run migrations: `just migrate-up`
diff --git a/.cursor/rules/05-development-workflow.mdc b/.cursor/rules/05-development-workflow.mdc
index 01c299a..0cafacc 100644
--- a/.cursor/rules/05-development-workflow.mdc
+++ b/.cursor/rules/05-development-workflow.mdc
@@ -9,81 +9,81 @@ This project uses `make` commands for all development tasks. Always prefer `make
 
 ## Quick Reference
 
--   **Setup**: `make quickstart` (first time) or `make validate-setup`
--   **Code Generation**: `make generate-all` (runs sqlc + proto + mocks)
--   **Development**: `make dev` (server) or `make dev-worker` (background tasks)
--   **Testing**: `make test-unit` (fast) or `make test-all` (complete)
--   **Quality**: `make format`, `make lint`, `make pre-commit`
+-   **Setup**: `just quickstart` (first time) or `just validate-setup`
+-   **Code Generation**: `just generate-all` (runs sqlc + proto + mocks)
+-   **Development**: `just dev` (server) or `just dev-worker` (background tasks)
+-   **Testing**: `just test-unit` (fast) or `just test-all` (complete)
+-   **Quality**: `just format`, `just lint`, `just pre-commit`
 
 ### Code Generation
 
--   **ALWAYS run `make generate-all`** after modifying:
+-   **ALWAYS run `just generate-all`** after modifying:
     -   SQL queries (`.sql` files) → runs `sqlc`
     -   Protobuf definitions (`.proto` files) → runs `proto`
     -   Interface changes (for mocks) → runs `generate-mocks`
--   Individual commands also available: `make sqlc`, `make proto`, `make generate-mocks`
+-   Individual commands also available: `just sqlc`, `just proto`, `just generate-mocks`
 
 ### Code Quality
 
--   **Before committing**: Run `make pre-commit` (format + lint + test-unit)
--   **Format code**: Use `make format` (uses gofmt + goimports if available)
--   **Lint code**: Use `make lint` (strict linter, 0 issues required)
--   **Tidy dependencies**: Use `make tidy` (runs `go mod tidy`)
+-   **Before committing**: Run `just pre-commit` (format + lint + test-unit)
+-   **Format code**: Use `just format` (uses gofmt + goimports if available)
+-   **Lint code**: Use `just lint` (strict linter, 0 issues required)
+-   **Tidy dependencies**: Use `just tidy` (runs `go mod tidy`)
 
 ### Testing
 
--   **Unit tests**: `make test-unit` (fast, generates mocks automatically)
--   **Integration tests**: `make test-integration` (requires Docker)
--   **All tests**: `make test-all` (unit + integration)
--   **Coverage**: `make coverage-report` or `make coverage-html`
+-   **Unit tests**: `just test-unit` (fast, generates mocks automatically)
+-   **Integration tests**: `just test-integration` (requires Docker)
+-   **All tests**: `just test-all` (unit + integration)
+-   **Coverage**: `just coverage-report` or `just coverage-html`
 
 ### Development Server
 
--   **Main server**: `make dev` (hot reload with Air)
--   **Worker**: `make dev-worker` (background tasks)
--   **Module**: `make dev-module MODULE_NAME=<name>` (single module)
--   **No reload**: `make run` (uses `go run` directly)
+-   **Main server**: `just dev` (hot reload with Air)
+-   **Worker**: `just dev-worker` (background tasks)
+-   **Module**: `just dev-module MODULE_NAME=<name>` (single module)
+-   **No reload**: `just run` (uses `go run` directly)
 
 ### Database & Migrations
 
--   **Run migrations**: `make migrate-up` or `make migrate`
--   **Create migration**: `make migrate-create MODULE=<name> NAME=<migration_name>`
--   **Rollback**: `make migrate-down MODULE=<name>`
--   **Reset database**: `make db-reset` (destructive, drops all tables)
--   **Seed data**: `make seed`
+-   **Run migrations**: `just migrate-up` or `just migrate`
+-   **Create migration**: `just migrate-create MODULE=<name> NAME=<migration_name>`
+-   **Rollback**: `just migrate-down MODULE=<name>`
+-   **Reset database**: `just db-reset` (destructive, drops all tables)
+-   **Seed data**: `just seed`
 
 ### Common Workflows
 
 **First-time setup:**
 
 ```bash
-make quickstart
+just quickstart
 ```
 
 **Daily development:**
 
 ```bash
-make docker-up-minimal  # Start DB + Redis
-make migrate-up         # Run migrations if needed
-make dev                # Start dev server
+just docker-up-minimal  # Start DB + Redis
+just migrate-up         # Run migrations if needed
+just dev                # Start dev server
 ```
 
 **Before committing:**
 
 ```bash
-make generate-all       # Generate code if needed
-make pre-commit         # Format + lint + test
+just generate-all       # Generate code if needed
+just pre-commit         # Format + lint + test
 ```
 
 **Adding a new module:**
 
 ```bash
-make new-module <name>
-make generate-all       # After adding SQL/proto
-make migrate-up
+just new-module <name>
+just generate-all       # After adding SQL/proto
+just migrate-up
 ```
 
 ### Help
 
--   **List all commands**: `make help`
+-   **List all commands**: `just help`
 -   **Full reference**: See `docs/MAKE_COMMANDS_REFERENCE.md`
diff --git a/.cursor/rules/10-go-quality.mdc b/.cursor/rules/10-go-quality.mdc
index 443fae9..0dfa19b 100644
--- a/.cursor/rules/10-go-quality.mdc
+++ b/.cursor/rules/10-go-quality.mdc
@@ -20,9 +20,9 @@ alwaysApply: false
 
 ## Code Quality Workflow
 
--   **Before committing**: Run `make pre-commit` (format + lint + test-unit)
--   **Format code**: Use `make format` to format code with gofmt/goimports
--   **Lint code**: Use `make lint` after any modification that includes `.go` files
+-   **Before committing**: Run `just pre-commit` (format + lint + test-unit)
+-   **Format code**: Use `just format` to format code with gofmt/goimports
+-   **Lint code**: Use `just lint` after any modification that includes `.go` files
 -   **Iterate on fixes** until **all linting issues are resolved** (0 issues).
 -   **NEVER modify `.golangci.yaml`** to ignore or suppress lint errors.
 -   Always implement **proper fixes** for lint issues:
@@ -35,12 +35,12 @@ alwaysApply: false
 
 ## Testing Workflow
 
--   **ALWAYS run `make test-unit`** after adding or modifying tests (faster, generates mocks).
--   Use `make test-all` for complete testing (unit + integration).
+-   **ALWAYS run `just test-unit`** after adding or modifying tests (faster, generates mocks).
+-   Use `just test-all` for complete testing (unit + integration).
 -   Ensure all tests pass before considering the work complete.
 -   Write clear, focused test cases with descriptive names.
 
 ## Code Generation Workflow
 
--   **After modifying SQL/proto/interfaces**: Run `make generate-all` (runs sqlc + proto + mocks)
--   Individual commands available: `make sqlc`, `make proto`, `make generate-mocks`
+-   **After modifying SQL/proto/interfaces**: Run `just generate-all` (runs sqlc + proto + mocks)
+-   Individual commands available: `just sqlc`, `just proto`, `just generate-mocks`
diff --git a/.cursor/rules/25-protobuf-validation.mdc b/.cursor/rules/25-protobuf-validation.mdc
index 3610278..9240679 100644
--- a/.cursor/rules/25-protobuf-validation.mdc
+++ b/.cursor/rules/25-protobuf-validation.mdc
@@ -116,7 +116,7 @@ The module scaffolding template (`templates/module/proto/module.proto.tmpl`) alr
 - Validation import
 - Example validation annotations on request messages
 
-New modules created with `make new-module` will have validation examples by default.
+New modules created with `just new-module` will have validation examples by default.
 
 ### Examples
 
diff --git a/.cursor/rules/30-data-sqlc.mdc b/.cursor/rules/30-data-sqlc.mdc
index 8d6b626..d53a3e3 100644
--- a/.cursor/rules/30-data-sqlc.mdc
+++ b/.cursor/rules/30-data-sqlc.mdc
@@ -30,7 +30,7 @@ alwaysApply: false
   func GetMagicCode(ctx context.Context, code string) (*store.MagicCode, error)
   ```
 
-- After running `make sqlc`, check `modules/<mod>/internal/db/store/models.go` to see the exact generated type names.
+- After running `just sqlc`, check `modules/<mod>/internal/db/store/models.go` to see the exact generated type names.
 
 ## Repository pattern
 
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 68ef52e..85c8135 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -31,7 +31,7 @@ jobs:
 
       - name: Build binaries
         run: |
-          make build-all
+          just build-all
 
       - name: Create changelog
         id: changelog
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 636871f..d79cb0f 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -13,18 +13,18 @@ Thank you for your interest in contributing! This document provides guidelines f
 
 3. **Install dependencies**:
    ```bash
-   make install-deps
+   just install-deps
    ```
 
 4. **Start infrastructure**:
    ```bash
-   make docker-up
+   just docker-up
    ```
 
 5. **Run tests**:
    ```bash
-   make test
-   make lint
+   just test
+   just lint
    ```
 
 ## 📋 Contribution Process
@@ -50,13 +50,13 @@ Ensure you follow the project conventions:
 
 ```bash
 # Linter (must pass with 0 errors)
-make lint
+just lint
 
 # Tests
-make test
+just test
 
 # Coverage (optional but recommended)
-make coverage-report
+just coverage-report
 ```
 
 ### 4. Commit and Push
diff --git a/GETTING_STARTED.md b/GETTING_STARTED.md
index ebbf247..857bcb1 100644
--- a/GETTING_STARTED.md
+++ b/GETTING_STARTED.md
@@ -55,7 +55,7 @@ git commit -m "Initial commit from go-modulith-template"
 For the fastest setup, use the automated quickstart script:
 
 ```bash
-make quickstart
+just quickstart
 ```
 
 This will automatically:
@@ -73,7 +73,7 @@ This will automatically:
 Install all required development tools:
 
 ```bash
-make install-deps
+just install-deps
 ```
 
 This will install:
@@ -93,7 +93,7 @@ This will install:
 which migrate sqlc buf air golangci-lint
 
 # Or run validation
-make validate-setup
+just validate-setup
 ```
 
 ---
@@ -169,12 +169,12 @@ EOF
 
 ## Step 4: Start Infrastructure
 
-> **Note:** If you used `make quickstart`, this step is already complete. Skip to Step 5.
+> **Note:** If you used `just quickstart`, this step is already complete. Skip to Step 5.
 
 Start the required infrastructure services (PostgreSQL, Redis, etc.):
 
 ```bash
-make docker-up
+just docker-up
 ```
 
 This starts:
@@ -191,12 +191,12 @@ This starts:
 docker-compose ps
 
 # Or run comprehensive diagnostics
-make doctor
+just doctor
 ```
 
 You should see all services in "Up" status.
 
-> **Tip:** To start only the database and Redis (faster startup), use `make docker-up-minimal`.
+> **Tip:** To start only the database and Redis (faster startup), use `just docker-up-minimal`.
 
 ---
 
@@ -205,7 +205,7 @@ You should see all services in "Up" status.
 Now let's add a new module. For this example, we'll create an "order" module:
 
 ```bash
-make new-module order
+just new-module order
 ```
 
 This command will:
@@ -310,7 +310,7 @@ Now generate the code from your proto definitions and SQL queries:
 Generate Go code from your Protocol Buffer definitions:
 
 ```bash
-make proto
+just proto
 ```
 
 This will:
@@ -324,7 +324,7 @@ This will:
 Generate type-safe Go code from your SQL queries:
 
 ```bash
-make sqlc
+just sqlc
 ```
 
 This will:
@@ -348,7 +348,7 @@ ls -la modules/order/internal/db/store/
 Run database migrations to create the schema for your new module:
 
 ```bash
-make migrate
+just migrate
 ```
 
 Or run migrations manually using the subcommand:
@@ -395,7 +395,7 @@ You should see tables for your new module (e.g., `orders` table if you created a
 Run tests to verify everything works:
 
 ```bash
-make test
+just test
 ```
 
 Or run tests for a specific module:
@@ -409,7 +409,7 @@ go test ./modules/order/...
 If you're writing tests that require mocks:
 
 ```bash
-make generate-mocks
+just generate-mocks
 ```
 
 This generates mocks for all interfaces in your modules.
@@ -419,7 +419,7 @@ This generates mocks for all interfaces in your modules.
 Run the linter to ensure code quality:
 
 ```bash
-make lint
+just lint
 ```
 
 Fix any issues reported by the linter.
@@ -435,7 +435,7 @@ Now you're ready to run the server with your new module!
 Run the monolith server with hot reload:
 
 ```bash
-make dev
+just dev
 ```
 
 This will:
@@ -451,7 +451,7 @@ This will:
 Run your module as a standalone service:
 
 ```bash
-make dev-module order
+just dev-module order
 ```
 
 This runs only the order module with hot reload.
@@ -462,7 +462,7 @@ Build and run without hot reload:
 
 ```bash
 # Build the server
-make build
+just build
 
 # Run it
 ./bin/server
@@ -548,7 +548,7 @@ For integration tests that require a real database, use testcontainers:
 
 ```bash
 # Run integration tests (requires Docker)
-make test-integration
+just test-integration
 
 # Or run specific integration tests
 go test -v -run Integration ./examples/...
@@ -575,10 +575,10 @@ See `examples/integration_test_example.go` for a complete example showing:
 
 ```bash
 # Generate coverage report
-make coverage-report
+just coverage-report
 
 # View HTML coverage report
-make coverage-html
+just coverage-html
 ```
 
 ## Next Steps
@@ -594,13 +594,13 @@ Now that you have a working module, you can:
 2. **Add More Methods**
 
     - Update `proto/order/v1/order.proto` to add new RPC methods
-    - Run `make proto` to regenerate code
+    - Run `just proto` to regenerate code
     - Implement the methods in your service
 
 3. **Add Database Migrations**
 
     ```bash
-    make migrate-create MODULE=order NAME=add_indexes
+    just migrate-create MODULE=order NAME=add_indexes
     ```
 
     This creates new migration files in `modules/order/resources/db/migration/`
@@ -608,8 +608,8 @@ Now that you have a working module, you can:
 4. **Add Seed Data**
 
     - Edit `modules/order/resources/db/seed/001_example_data.sql`
-    - Run `make seed` or `go run cmd/server/main.go seed`
-    - Note: The module must implement `SeedPath()` method in `module.go` (automatically included when using `make new-module`)
+    - Run `just seed` or `go run cmd/server/main.go seed`
+    - Note: The module must implement `SeedPath()` method in `module.go` (automatically included when using `just new-module`)
 
 5. **Add Tests**
 
@@ -630,10 +630,10 @@ Before troubleshooting, run diagnostic tools:
 
 ```bash
 # Comprehensive environment diagnostics
-make doctor
+just doctor
 
 # Validate setup and prerequisites
-make validate-setup
+just validate-setup
 ```
 
 ### Issue: Module not found after registration
@@ -650,7 +650,7 @@ make validate-setup
 **Solution:**
 
 -   Check database connection string in `configs/server.yaml`
--   Ensure PostgreSQL is running: `docker-compose ps` or `make doctor`
+-   Ensure PostgreSQL is running: `docker-compose ps` or `just doctor`
 -   Check migration files are valid SQL
 -   Verify database container is healthy: `docker ps`
 
@@ -658,7 +658,7 @@ make validate-setup
 
 **Solution:**
 
--   Verify `buf` is installed: `which buf` or `make validate-setup`
+-   Verify `buf` is installed: `which buf` or `just validate-setup`
 -   Check `buf.yaml` and `buf.gen.yaml` are correct
 -   Ensure proto files are valid: `buf lint`
 
@@ -674,18 +674,18 @@ make validate-setup
 
 **Solution:**
 
--   Run `make doctor` to check environment health
+-   Run `just doctor` to check environment health
 -   Check logs for specific errors
 -   Verify all required environment variables are set
--   Ensure database is accessible: `make doctor` will check this
--   Check ports 8000 and 9000 are not in use: `make validate-setup` shows port status
+-   Ensure database is accessible: `just doctor` will check this
+-   Check ports 8000 and 9000 are not in use: `just validate-setup` shows port status
 -   Verify Docker containers are running: `docker-compose ps`
 
 ### Issue: Port conflicts
 
 **Solution:**
 
--   Run `make doctor` to identify which ports are in use
+-   Run `just doctor` to identify which ports are in use
 -   Stop conflicting services or change ports in `configs/server.yaml`
 -   Check `docker-compose ps` for running containers
 
diff --git a/Makefile b/Makefile
deleted file mode 100644
index 3da2d40..0000000
--- a/Makefile
+++ /dev/null
@@ -1,351 +0,0 @@
-.PHONY: help sqlc proto install-deps install-mocks generate-mocks generate-all test-unit graphql-init graphql-generate graphql-generate-module graphql-generate-all graphql-validate graphql-add graphql-from-proto validate-setup quickstart doctor format tidy pre-commit
-.DEFAULT_GOAL := help
-
-help: ## Show available commands
-	@echo "Available commands:"
-	@echo ""
-	@grep -E '^[a-zA-Z_-]+:.*?## .*$$' Makefile | sort | awk 'BEGIN {FS = ":.*?## "}; {printf "  \033[36m%-30s\033[0m %s\n", $$1, $$2}'
-
-install-deps: ## Install developer tools
-	go install -tags 'postgres' github.com/golang-migrate/migrate/v4/cmd/migrate@latest
-	go install github.com/sqlc-dev/sqlc/cmd/sqlc@latest
-	go install github.com/bufbuild/buf/cmd/buf@latest
-	go install github.com/air-verse/air@latest
-	go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest
-	go install github.com/99designs/gqlgen@latest
-	go install go.uber.org/mock/mockgen@latest
-
-install-mocks: ## Install gomock for test mocking
-	go install go.uber.org/mock/mockgen@latest
-
-validate-setup: ## Validate development environment setup
-	@./scripts/validate-setup.sh
-
-quickstart: ## Run complete setup process (install deps, start docker, run migrations)
-	@./scripts/quickstart.sh
-
-doctor: ## Run development environment diagnostics
-	@./scripts/doctor.sh
-
-sqlc: ## Generate type-safe Go code from SQL
-	sqlc generate
-
-proto: ## Generate gRPC code from protobuf definitions
-	buf generate
-
-proto-version-create: ## Create a new API version for a module (usage: make proto-version-create MODULE_NAME=auth VERSION=v2)
-	@if [ -z "$(MODULE_NAME)" ]; then echo "Usage: make proto-version-create MODULE_NAME=<module_name> VERSION=<version>"; exit 1; fi
-	@if [ -z "$(VERSION)" ]; then echo "Usage: make proto-version-create MODULE_NAME=<module_name> VERSION=<version>"; exit 1; fi
-	@./scripts/proto-version-create.sh $(MODULE_NAME) $(VERSION)
-	@echo "✅ New version created. Run 'make proto' to generate code."
-
-proto-breaking-check: ## Check for breaking changes in proto files (usage: make proto-breaking-check [MODULE_NAME=module_name])
-	@if [ -z "$(MODULE_NAME)" ]; then \
-		./scripts/proto-breaking-check.sh; \
-	else \
-		./scripts/proto-breaking-check.sh $(MODULE_NAME); \
-	fi
-
-proto-lint: ## Lint all proto files
-	buf lint
-
-generate-mocks: ## Generate all mocks from interfaces
-	@echo "Generating mocks..."
-	@go generate ./modules/...
-	@echo "Mocks generated successfully"
-
-generate-all: sqlc proto generate-mocks ## Generate all code (sqlc + proto + mocks)
-
-docker-up: ## Run docker-compose
-	docker-compose up -d
-
-docker-up-minimal: ## Run docker-compose with minimal services (db + redis only)
-	docker-compose -f docker-compose.minimal.yaml up -d
-
-test: ## Run tests
-	go test -v -race -cover ./...
-
-test-unit: generate-mocks ## Run unit tests with fresh mocks
-	go test -v -short ./...
-
-test-integration: ## Run integration tests (requires Docker)
-	@echo "Running integration tests with testcontainers..."
-	go test -v -run Integration ./...
-
-test-all: test-unit test-integration ## Run all tests (unit + integration)
-
-test-coverage: ## Run tests with coverage report
-	go test -v -race -coverprofile=coverage.out ./...
-	go tool cover -html=coverage.out
-
-coverage-report: ## Generate detailed coverage report
-	@echo "=== 📊 Coverage Total del Proyecto ==="
-	@echo ""
-	@go test ./... -coverprofile=coverage.out -covermode=atomic 2>&1 | grep "coverage:" | grep -v "0.0%" | grep -v "no test"
-	@echo ""
-	@echo "=== 📈 Resumen por Componente ==="
-	@go tool cover -func=coverage.out | grep -v "\.pb\.go" | grep -v "\.pb\.gw\.go" | grep -v "generated" | tail -20
-	@echo ""
-	@echo "=== 🎯 Coverage Total (sin código generado) ==="
-	@go tool cover -func=coverage.out | grep -v "\.pb\.go" | grep -v "\.pb\.gw\.go" | grep -v "generated" | grep -v "cmd/" | tail -1
-	@echo ""
-	@echo "💡 Para ver el reporte HTML completo: make test-coverage"
-
-coverage-html: ## Open coverage report in browser
-	@go test ./... -coverprofile=coverage.out -covermode=atomic > /dev/null 2>&1
-	@go tool cover -html=coverage.out
-
-lint: ## Run linter
-	golangci-lint run
-
-format: ## Format code with gofmt (and goimports if available)
-	@echo "Formatting code with gofmt..."
-	@gofmt -w .
-	@if command -v goimports > /dev/null; then \
-		echo "Formatting imports with goimports..."; \
-		goimports -w .; \
-	else \
-		echo "💡 Tip: Install goimports for import formatting: go install golang.org/x/tools/cmd/goimports@latest"; \
-	fi
-	@echo "✅ Code formatted"
-
-tidy: ## Tidy Go module dependencies
-	@echo "Tidying Go module dependencies..."
-	@go mod tidy
-	@echo "✅ Dependencies tidied"
-
-pre-commit: format lint test-unit ## Run pre-commit checks (format + lint + test-unit)
-
-docker-down: ## Stop docker-compose services
-	docker-compose down
-
-# Load .env file
-ifneq (,$(wildcard ./.env))
-    include .env
-    export
-endif
-
-# Database migrations are now handled by the modulith itself
-# The server discovers and runs migrations for all registered modules
-
-migrate-up: ## Run all module migrations (uses modulith's migration system)
-	@echo "🚀 Running migrations for all modules..."
-	go run cmd/server/main.go -migrate
-
-migrate: migrate-up ## Alias for migrate-up
-
-seed: ## Run seed data for all modules
-	@echo "🌱 Running seed data for all modules..."
-	go run cmd/server/main.go seed
-
-admin: ## Run admin task (usage: make admin TASK=task_name)
-	@if [ -z "$(TASK)" ]; then echo "Usage: make admin TASK=task_name"; exit 1; fi
-	@echo "🔧 Running admin task: $(TASK)"
-	go run cmd/server/main.go admin $(TASK)
-
-migrate-down: ## Rollback last migration for a specific module (usage: make migrate-down MODULE_NAME=auth)
-	@if [ -z "$(MODULE_NAME)" ]; then echo "Usage: make migrate-down MODULE_NAME=module_name"; exit 1; fi
-	@MIGRATIONS_DIR=modules/$(MODULE_NAME)/resources/db/migration; \
-	if [ ! -d "$$MIGRATIONS_DIR" ]; then \
-		echo "Error: Module '$(MODULE_NAME)' not found or has no migrations directory"; \
-		exit 1; \
-	fi; \
-	echo "⚠️  Rolling back last migration for module: $(MODULE_NAME)"; \
-	migrate -path $$MIGRATIONS_DIR -database "$(DB_DSN)" down 1
-
-migrate-create: ## Create a new migration file for a module (usage: make migrate-create MODULE_NAME=auth NAME=add_users)
-	@if [ -z "$(MODULE_NAME)" ]; then echo "Usage: make migrate-create MODULE_NAME=module_name NAME=migration_name"; exit 1; fi
-	@if [ -z "$(NAME)" ]; then echo "Usage: make migrate-create MODULE_NAME=module_name NAME=migration_name"; exit 1; fi
-	@MIGRATIONS_DIR=modules/$(MODULE_NAME)/resources/db/migration; \
-	if [ ! -d "$$MIGRATIONS_DIR" ]; then \
-		echo "Error: Module '$(MODULE_NAME)' not found or has no migrations directory"; \
-		exit 1; \
-	fi; \
-	migrate create -ext sql -dir $$MIGRATIONS_DIR -seq $(NAME)
-
-migrate-force: ## Force migration version to clean dirty state (usage: make migrate-force MODULE_NAME=auth VERSION=1)
-	@if [ -z "$(MODULE_NAME)" ]; then echo "Usage: make migrate-force MODULE_NAME=module_name VERSION=version_number"; exit 1; fi
-	@if [ -z "$(VERSION)" ]; then echo "Usage: make migrate-force MODULE_NAME=module_name VERSION=version_number"; exit 1; fi
-	@MIGRATIONS_DIR=modules/$(MODULE_NAME)/resources/db/migration; \
-	if [ ! -d "$$MIGRATIONS_DIR" ]; then \
-		echo "Error: Module '$(MODULE_NAME)' not found or has no migrations directory"; \
-		exit 1; \
-	fi; \
-	echo "⚠️  Forcing migration version $(VERSION) for module $(MODULE_NAME) (clears dirty state)..."; \
-	if echo "$(DB_DSN)" | grep -q "?"; then \
-		MODULE_DSN="$(DB_DSN)&x-migrations-table=$(MODULE_NAME)_schema_migrations"; \
-	else \
-		MODULE_DSN="$(DB_DSN)?x-migrations-table=$(MODULE_NAME)_schema_migrations"; \
-	fi; \
-	migrate -path $$MIGRATIONS_DIR -database "$$MODULE_DSN" force $(VERSION)
-
-db-down: ## Rollback ALL migrations for all modules (drops all tables, uses modulith's migration system)
-	@echo "⚠️  WARNING: This will rollback ALL migrations for ALL modules (drops all tables)!"
-	@read -p "Are you sure? Type 'yes' to confirm: " confirm && [ "$$confirm" = "yes" ] || exit 1
-	@echo "🔄 Rolling back all migrations for all modules..."
-	@go run cmd/server/main.go migrate-down
-
-db-reset: ## Drop all module schemas and re-run all migrations (destructive, asks for confirmation)
-	@./scripts/db-reset.sh
-
-VERSION ?= $(shell git describe --tags --always --dirty 2>/dev/null || echo "dev")
-COMMIT ?= $(shell git rev-parse --short HEAD 2>/dev/null || echo "unknown")
-BUILD_TIME ?= $(shell date -u +"%Y-%m-%dT%H:%M:%SZ")
-LDFLAGS := -X github.com/cmelgarejo/go-modulith-template/internal/version.Version=$(VERSION) \
-           -X github.com/cmelgarejo/go-modulith-template/internal/version.Commit=$(COMMIT) \
-           -X github.com/cmelgarejo/go-modulith-template/internal/version.BuildTime=$(BUILD_TIME)
-
-build: ## Build the monolith binary
-	@mkdir -p bin
-	go build -ldflags "$(LDFLAGS)" -o bin/server ./cmd/server/main.go
-
-build-module: ## Build a specific module binary (usage: make build-module MODULE_NAME)
-	@if [ -z "$(MODULE_NAME)" ]; then echo "Usage: make build-module MODULE_NAME"; exit 1; fi
-	@if [ ! -d "cmd/$(MODULE_NAME)" ]; then echo "Error: Module '$(MODULE_NAME)' not found in cmd/"; exit 1; fi
-	@mkdir -p bin
-	@echo "Building module: $(MODULE_NAME)"
-	go build -ldflags "$(LDFLAGS)" -o bin/$(MODULE_NAME) ./cmd/$(MODULE_NAME)/main.go
-
-build-worker: ## Build the worker binary
-	@mkdir -p bin
-	go build -ldflags "$(LDFLAGS)" -o bin/worker ./cmd/worker/main.go
-
-build-all: build build-worker ## Build all binaries (server + worker + all modules)
-	@mkdir -p bin
-	@for dir in cmd/*/; do \
-		module=$$(basename $$dir); \
-		if [ "$$module" != "server" ] && [ "$$module" != "worker" ]; then \
-			echo "Building module: $$module"; \
-			go build -ldflags "$(LDFLAGS)" -o bin/$$module ./cmd/$$module/main.go; \
-		fi \
-	done
-
-clean: ## Clean build artifacts
-	rm -rf bin/
-
-run: ## Run the monolith server (without hot reload)
-	go run -ldflags "$(LDFLAGS)" cmd/server/main.go || true
-
-dev: ## Run the monolith with live reload (requires Air)
-	@./scripts/preflight-check.sh || exit 1
-	@if command -v air > /dev/null; then \
-		air -c .air.toml; \
-	else \
-		echo "Air is not installed. Please install it with: go install github.com/air-verse/air@latest"; \
-	fi
-
-dev-worker: ## Run the worker with live reload (requires Air)
-	@./scripts/preflight-check.sh || exit 1
-	@if command -v air > /dev/null; then \
-		air -c .air.worker.toml; \
-	else \
-		echo "Air is not installed. Please install it with: go install github.com/air-verse/air@latest"; \
-	fi
-
-dev-module: ## Run a specific module with live reload (usage: make dev-module MODULE_NAME)
-	@if [ -z "$(MODULE_NAME)" ]; then echo "Usage: make dev-module MODULE_NAME"; exit 1; fi
-	@if [ ! -f ".air.$(MODULE_NAME).toml" ]; then echo "Error: Air config '.air.$(MODULE_NAME).toml' not found"; exit 1; fi
-	@./scripts/preflight-check.sh || exit 1
-	@if command -v air > /dev/null; then \
-		echo "Starting module: $(MODULE_NAME) with hot reload..."; \
-		air -c .air.$(MODULE_NAME).toml; \
-	else \
-		echo "Air is not installed. Please install it with: go install github.com/air-verse/air@latest"; \
-	fi
-
-# Handle positional arguments for new-module
-ifeq (new-module,$(firstword $(MAKECMDGOALS)))
-  MODULE_NAME := $(wordlist 2,$(words $(MAKECMDGOALS)),$(MAKECMDGOALS))
-  $(eval $(MODULE_NAME):;@:)
-endif
-
-# Handle positional arguments for destroy-module
-ifeq (destroy-module,$(firstword $(MAKECMDGOALS)))
-  MODULE_NAME := $(wordlist 2,$(words $(MAKECMDGOALS)),$(MAKECMDGOALS))
-  $(eval $(MODULE_NAME):;@:)
-endif
-
-# Handle positional arguments for build-module
-ifeq (build-module,$(firstword $(MAKECMDGOALS)))
-  MODULE_NAME := $(wordlist 2,$(words $(MAKECMDGOALS)),$(MAKECMDGOALS))
-  $(eval $(MODULE_NAME):;@:)
-endif
-
-# Handle positional arguments for docker-build-module
-ifeq (docker-build-module,$(firstword $(MAKECMDGOALS)))
-  MODULE_NAME := $(wordlist 2,$(words $(MAKECMDGOALS)),$(MAKECMDGOALS))
-  $(eval $(MODULE_NAME):;@:)
-endif
-
-# Handle positional arguments for dev-module
-ifeq (dev-module,$(firstword $(MAKECMDGOALS)))
-  MODULE_NAME := $(wordlist 2,$(words $(MAKECMDGOALS)),$(MAKECMDGOALS))
-  $(eval $(MODULE_NAME):;@:)
-endif
-
-# Handle positional arguments for graphql-generate-module
-ifeq (graphql-generate-module,$(firstword $(MAKECMDGOALS)))
-  MODULE_NAME := $(wordlist 2,$(words $(MAKECMDGOALS)),$(MAKECMDGOALS))
-  $(eval $(MODULE_NAME):;@:)
-endif
-
-
-##### Docker
-docker-build: ## Build docker image for server
-	docker build \
-		--build-arg TARGET=server \
-		--build-arg VERSION=$(VERSION) \
-		--build-arg COMMIT=$(COMMIT) \
-		--build-arg BUILD_TIME=$(BUILD_TIME) \
-		-t modulith-server:latest .
-
-docker-build-module: ## Build docker image for a specific module (usage: make docker-build-module MODULE_NAME)
-	@if [ -z "$(MODULE_NAME)" ]; then echo "Usage: make docker-build-module MODULE_NAME"; exit 1; fi
-	@if [ ! -d "cmd/$(MODULE_NAME)" ]; then echo "Error: Module '$(MODULE_NAME)' not found in cmd/"; exit 1; fi
-	@echo "Building Docker image for module: $(MODULE_NAME)"
-	docker build \
-		--build-arg TARGET=$(MODULE_NAME) \
-		--build-arg VERSION=$(VERSION) \
-		--build-arg COMMIT=$(COMMIT) \
-		--build-arg BUILD_TIME=$(BUILD_TIME) \
-		-t modulith-$(MODULE_NAME):latest .
-
-##### Modules
-new-module: ## Scaffold a new module (usage: make new-module MODULE_NAME)
-	@if [ -z "$(MODULE_NAME)" ]; then echo "Usage: make new-module NAME"; exit 1; fi
-	./scripts/scaffold-module.sh $(MODULE_NAME)
-
-destroy-module: ## Destroy a module completely (usage: make destroy-module MODULE_NAME)
-	@if [ -z "$(MODULE_NAME)" ]; then echo "Usage: make destroy-module MODULE_NAME"; exit 1; fi
-	./scripts/destroy-module.sh $(MODULE_NAME)
-
-##### GraphQL (Optional)
-graphql-add: ## Add optional GraphQL support using gqlgen (automatically generates code)
-	./scripts/graphql-add-to-project.sh
-
-graphql-init: ## Initialize GraphQL (alias for graphql-add)
-	$(MAKE) graphql-add
-
-graphql-generate: graphql-generate-all ## Generate GraphQL code for all modules (alias for graphql-generate-all)
-
-graphql-generate-module: ## Generate GraphQL code for a specific module (usage: make graphql-generate-module auth)
-	@if [ -z "$(MODULE_NAME)" ]; then echo "Usage: make graphql-generate-module <module_name>"; exit 1; fi
-	./scripts/graphql-generate-module.sh $(MODULE_NAME)
-
-graphql-generate-all: ## Generate GraphQL code for all modules (auto-discovers modules with schemas)
-	./scripts/graphql-generate-all.sh
-
-graphql-from-proto: ## Generate GraphQL schemas from OpenAPI/Swagger files for all modules
-	./scripts/graphql-from-proto-all.sh
-
-graphql-validate: ## Validate GraphQL schema
-
-visualize: ## Visualize module connections (usage: make visualize [FORMAT=html|json|dot] [SERVE=true])
-	@echo "🔍 Analyzing modulith architecture..."
-	@FORMAT=$${FORMAT:-html}; \
-	SERVE=$${SERVE:-false}; \
-	if [ "$$SERVE" = "true" ]; then \
-		go run ./cmd/visualize/main.go -format=$$FORMAT -serve; \
-	else \
-		go run ./cmd/visualize/main.go -format=$$FORMAT; \
-	fi
diff --git a/README.md b/README.md
index d8deeaf..1742802 100644
--- a/README.md
+++ b/README.md
@@ -53,7 +53,7 @@ This is a professional template for building Go applications following the **Mod
 The fastest way to get started is using the automated quickstart script:
 
 ```bash
-make quickstart
+just quickstart
 ```
 
 This will:
@@ -64,7 +64,7 @@ This will:
 4. Run database migrations
 5. Optionally run seed data
 
-> 💡 **Tip**: For a minimal setup (database + Redis only), use `make docker-up-minimal`.
+> 💡 **Tip**: For a minimal setup (database + Redis only), use `just docker-up-minimal`.
 
 ### Manual Setup
 
@@ -73,13 +73,13 @@ This will:
 Check that all prerequisites are installed:
 
 ```bash
-make validate-setup
+just validate-setup
 ```
 
 #### 2. Install dependencies
 
 ```bash
-make install-deps
+just install-deps
 ```
 
 #### 3. Start Complete Infrastructure
@@ -87,7 +87,7 @@ make install-deps
 The template includes a complete observability stack for local development:
 
 ```bash
-make docker-up
+just docker-up
 ```
 
 This starts:
@@ -98,7 +98,7 @@ This starts:
 -   **Prometheus**: Metrics and alerts (UI at http://localhost:9090)
 -   **Grafana**: Visualization dashboards (UI at http://localhost:3000, user: `admin`, password: `admin`)
 
-> 💡 **Tip**: To start only the database and Redis, use `make docker-up-minimal`.
+> 💡 **Tip**: To start only the database and Redis, use `just docker-up-minimal`.
 
 #### 4. Configure (Optional)
 
@@ -121,21 +121,21 @@ On startup, you'll see a log showing the source of each configuration variable.
 #### 5. Run in Development (Hot Reload)
 
 ```bash
-make dev
+just dev
 ```
 
 To run a specific module with hot reload:
 
 ```bash
-make dev-module auth
+just dev-module auth
 ```
 
 To run the worker process (background tasks):
 
 ```bash
-make dev-worker
+just dev-worker
 # or
-make build-worker && ./bin/worker
+just build-worker && ./bin/worker
 ```
 
 > 💡 **Tip**: Air automatically monitors changes in `.go`, `.yaml`, `.env`, `.proto`, `.sql` and configuration files, restarting the server instantly.
@@ -198,7 +198,7 @@ The template includes an administrative task system for maintenance operations:
 
 ```bash
 # Run an administrative task
-make admin TASK=cleanup-sessions
+just admin TASK=cleanup-sessions
 
 # Or directly with the binary
 ./bin/server admin cleanup-sessions
@@ -233,7 +233,7 @@ Administrative tasks run as independent commands and are useful for:
 
 The project automatically generates OpenAPI/Swagger documentation:
 
--   **Location**: `gen/openapiv2/proto/` (generated with `make proto`)
+-   **Location**: `gen/openapiv2/proto/` (generated with `just proto`)
 -   **Format**: JSON compatible with Swagger UI
 -   **Usage**: Import `.swagger.json` files into [Swagger Editor](https://editor.swagger.io/) or any compatible tool
 
@@ -241,7 +241,7 @@ Example for the auth module:
 
 ```bash
 # Generate documentation
-make proto
+just proto
 
 # View the API
 open gen/openapiv2/proto/auth/v1/auth.swagger.json
@@ -251,97 +251,97 @@ open gen/openapiv2/proto/auth/v1/auth.swagger.json
 
 ### Code Generation
 
--   `make proto`: Generates gRPC code from `.proto` files (includes OpenAPI/Swagger in `gen/openapiv2/`).
--   `make sqlc`: Generates Type-safe code for SQL queries.
+-   `just proto`: Generates gRPC code from `.proto` files (includes OpenAPI/Swagger in `gen/openapiv2/`).
+-   `just sqlc`: Generates Type-safe code for SQL queries.
 
 ### Build
 
--   `make build`: Compiles the monolith binary in `bin/server`.
--   `make build-module MODULE_NAME`: Compiles the binary for a specific module (e.g.: `make build-module auth`).
--   `make build-all`: Compiles all binaries (server + all modules).
--   `make clean`: Removes all build artifacts (`bin/` directory).
+-   `just build`: Compiles the monolith binary in `bin/server`.
+-   `just build-module MODULE_NAME`: Compiles the binary for a specific module (e.g.: `just build-module auth`).
+-   `just build-all`: Compiles all binaries (server + all modules).
+-   `just clean`: Removes all build artifacts (`bin/` directory).
 
 ### Setup & Validation
 
--   `make quickstart`: Automated setup process (installs deps, starts docker, runs migrations).
--   `make validate-setup`: Validates development environment setup (prerequisites, tools, ports).
--   `make doctor`: Comprehensive development environment diagnostics (containers, connectivity, configuration).
+-   `just quickstart`: Automated setup process (installs deps, starts docker, runs migrations).
+-   `just validate-setup`: Validates development environment setup (prerequisites, tools, ports).
+-   `just doctor`: Comprehensive development environment diagnostics (containers, connectivity, configuration).
 
 ### Docker
 
--   `make docker-up`: Starts all infrastructure services (PostgreSQL, Redis, Jaeger, Prometheus, Grafana).
--   `make docker-up-minimal`: Starts minimal services (PostgreSQL + Redis only) for faster startup.
--   `make docker-down`: Stops Docker containers.
--   `make docker-build`: Builds the server Docker image (`modulith-server:latest`).
--   `make docker-build-module MODULE_NAME`: Builds the Docker image for a specific module (e.g.: `make docker-build-module auth`).
+-   `just docker-up`: Starts all infrastructure services (PostgreSQL, Redis, Jaeger, Prometheus, Grafana).
+-   `just docker-up-minimal`: Starts minimal services (PostgreSQL + Redis only) for faster startup.
+-   `just docker-down`: Stops Docker containers.
+-   `just docker-build`: Builds the server Docker image (`modulith-server:latest`).
+-   `just docker-build-module MODULE_NAME`: Builds the Docker image for a specific module (e.g.: `just docker-build-module auth`).
 
 ### Code Quality
 
--   `make lint`: Runs the strict linter (**MANDATORY** after changes to `.go` files).
--   `make test`: Runs all unit tests.
--   `make test-unit`: Runs unit tests with mocks (fast, no DB).
--   `make test-coverage`: Runs tests and generates HTML coverage report.
--   `make coverage-report`: Shows detailed coverage report in terminal.
--   `make coverage-html`: Opens coverage report in browser.
--   `make generate-mocks`: Generates interface mocks for testing.
--   `make install-mocks`: Installs gomock for mock generation.
+-   `just lint`: Runs the strict linter (**MANDATORY** after changes to `.go` files).
+-   `just test`: Runs all unit tests.
+-   `just test-unit`: Runs unit tests with mocks (fast, no DB).
+-   `just test-coverage`: Runs tests and generates HTML coverage report.
+-   `just coverage-report`: Shows detailed coverage report in terminal.
+-   `just coverage-html`: Opens coverage report in browser.
+-   `just generate-mocks`: Generates interface mocks for testing.
+-   `just install-mocks`: Installs gomock for mock generation.
 
 ### Development
 
--   `make dev`: Runs the monolith server with hot reload.
--   `make dev-module MODULE_NAME`: Runs a specific module with hot reload (e.g.: `make dev-module auth`).
--   `make new-module MODULE_NAME`: Creates boilerplate for a new functional module with automatic configuration (generates structure + `.air.{MODULE_NAME}.toml`).
+-   `just dev`: Runs the monolith server with hot reload.
+-   `just dev-module MODULE_NAME`: Runs a specific module with hot reload (e.g.: `just dev-module auth`).
+-   `just new-module MODULE_NAME`: Creates boilerplate for a new functional module with automatic configuration (generates structure + `.air.{MODULE_NAME}.toml`).
 
 ### Database
 
--   `make migrate-up` / `make migrate`: Runs migrations for all modules (the modulith discovers them automatically).
--   `make migrate-down MODULE=auth`: Reverts the last migration for a specific module.
--   `make migrate-create MODULE=auth NAME=add_users`: Creates a new migration for a specific module.
--   `make db-down`: ⚠️ Deletes all database tables (destructive).
--   `make db-reset`: ⚠️ Deletes everything and runs all migrations (equivalent to `db-down` + `migrate-up`).
+-   `just migrate-up` / `just migrate`: Runs migrations for all modules (the modulith discovers them automatically).
+-   `just migrate-down MODULE=auth`: Reverts the last migration for a specific module.
+-   `just migrate-create MODULE=auth NAME=add_users`: Creates a new migration for a specific module.
+-   `just db-down`: ⚠️ Deletes all database tables (destructive).
+-   `just db-reset`: ⚠️ Deletes everything and runs all migrations (equivalent to `db-down` + `migrate-up`).
 
 **Note:** Migrations run automatically when you start the server. The modulith discovers and applies migrations for all registered modules.
 
 ### Administrative Tasks
 
--   `make admin TASK=cleanup-sessions`: Runs administrative task to clean expired sessions.
--   `make admin TASK=cleanup-magic-codes`: Runs administrative task to clean expired magic codes.
+-   `just admin TASK=cleanup-sessions`: Runs administrative task to clean expired sessions.
+-   `just admin TASK=cleanup-magic-codes`: Runs administrative task to clean expired magic codes.
 -   `./bin/server admin <task_name>`: Runs an administrative task directly.
 
 **Note:** Administrative tasks run as independent commands. You can list available tasks by running `./bin/server admin` without arguments.
 
 ### GraphQL (Optional)
 
--   `make graphql-init`: Adds optional GraphQL support using gqlgen and automatically generates code (one command does everything).
--   `make graphql-generate-all`: Generates GraphQL code from schemas for all modules.
--   `make graphql-generate-module MODULE_NAME=<name>`: Generates GraphQL code for a specific module (auto-generates schema from proto if missing).
--   `make graphql-from-proto`: Generates GraphQL schemas from OpenAPI/Swagger definitions for all modules.
--   `make graphql-validate`: Validates GraphQL schema.
+-   `just graphql-init`: Adds optional GraphQL support using gqlgen and automatically generates code (one command does everything).
+-   `just graphql-generate-all`: Generates GraphQL code from schemas for all modules.
+-   `just graphql-generate-module MODULE_NAME=<name>`: Generates GraphQL code for a specific module (auto-generates schema from proto if missing).
+-   `just graphql-from-proto`: Generates GraphQL schemas from OpenAPI/Swagger definitions for all modules.
+-   `just graphql-validate`: Validates GraphQL schema.
 
 ### ⚠️ Quality Workflow
 
 **After modifying `.go` files:**
 
-1. Run `make lint` and fix **all** errors (0 issues).
-2. Run `make test` to verify you didn't break anything.
+1. Run `just lint` and fix **all** errors (0 issues).
+2. Run `just test` to verify you didn't break anything.
 3. **NEVER** modify `.golangci.yaml` to ignore errors - implement proper fixes.
 
 ### Troubleshooting
 
 If you encounter issues with your development environment:
 
-1. **Run diagnostics**: `make doctor` - Comprehensive health check of your environment
-2. **Validate setup**: `make validate-setup` - Check prerequisites and configuration
+1. **Run diagnostics**: `just doctor` - Comprehensive health check of your environment
+2. **Validate setup**: `just validate-setup` - Check prerequisites and configuration
 3. **Check containers**: `docker-compose ps` - Verify Docker containers are running
 4. **View logs**: `docker-compose logs [service]` - Check service logs
-5. **Reset database**: `make db-reset` - Drop and recreate database (destructive)
+5. **Reset database**: `just db-reset` - Drop and recreate database (destructive)
 
 Common issues:
 
--   **Port conflicts**: Use `make doctor` to identify which ports are in use
+-   **Port conflicts**: Use `just doctor` to identify which ports are in use
 -   **Docker not running**: Start Docker Desktop or docker service
--   **Database connection errors**: Ensure containers are running with `make docker-up`
--   **Missing tools**: Run `make install-deps` to install all development tools
+-   **Database connection errors**: Ensure containers are running with `just docker-up`
+-   **Missing tools**: Run `just install-deps` to install all development tools
 
 ---
 
diff --git a/cmd/auth/main.go b/cmd/auth/main.go
index dac03a2..00024f2 100644
--- a/cmd/auth/main.go
+++ b/cmd/auth/main.go
@@ -3,7 +3,6 @@ package main
 
 import (
 	"context"
-	"database/sql"
 	"fmt"
 	"log/slog"
 	"net"
@@ -22,7 +21,7 @@ import (
 	"github.com/golang-migrate/migrate/v4"
 	_ "github.com/golang-migrate/migrate/v4/database/postgres"
 	_ "github.com/golang-migrate/migrate/v4/source/file"
-	_ "github.com/jackc/pgx/v5/stdlib"
+	"github.com/jackc/pgx/v5/pgxpool"
 	"github.com/joho/godotenv"
 	"github.com/prometheus/client_golang/prometheus"
 	"github.com/prometheus/client_golang/prometheus/promhttp"
@@ -53,7 +52,7 @@ func main() {
 		return
 	}
 
-	db := initializeDBAuth(ctx, cfg)
+	db := initializeDBAuth(cfg)
 	if db == nil {
 		shutdownObs()
 		return
@@ -105,17 +104,25 @@ func initializeObservabilityAuth(ctx context.Context, cfg *config.AppConfig) (me
 	return
 }
 
-func initializeDBAuth(ctx context.Context, cfg *config.AppConfig) *sql.DB {
-	db, err := sql.Open("pgx", cfg.DBDSN)
+func initializeDBAuth(cfg *config.AppConfig) *pgxpool.Pool {
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	poolCfg, err := pgxpool.ParseConfig(cfg.DBDSN)
 	if err != nil {
-		slog.Error("Failed to open DB", "error", err)
+		slog.Error("Failed to parse DB config", "error", err)
 		return nil
 	}
 
-	if err := db.PingContext(ctx); err != nil {
-		slog.Error("Failed to ping DB", "error", err)
+	db, err := pgxpool.NewWithConfig(context.Background(), poolCfg)
+	if err != nil {
+		slog.Error("Failed to create DB pool", "error", err)
+		return nil
+	}
 
-		_ = db.Close()
+	if err := db.Ping(ctx); err != nil {
+		slog.Error("Failed to ping DB", "error", err)
+		db.Close()
 
 		return nil
 	}
@@ -123,13 +130,11 @@ func initializeDBAuth(ctx context.Context, cfg *config.AppConfig) *sql.DB {
 	return db
 }
 
-func closeDBAuth(db *sql.DB) {
-	if err := db.Close(); err != nil {
-		slog.Error("Failed to close DB", "error", err)
-	}
+func closeDBAuth(db *pgxpool.Pool) {
+	db.Close()
 }
 
-func setupAndStartServersAuth(_ context.Context, cfg *config.AppConfig, db *sql.DB, metricsHandler http.Handler, stop context.CancelFunc) (httpSrv *http.Server, grpcServer *grpc.Server) {
+func setupAndStartServersAuth(_ context.Context, cfg *config.AppConfig, db *pgxpool.Pool, metricsHandler http.Handler, stop context.CancelFunc) (httpSrv *http.Server, grpcServer *grpc.Server) {
 	httpSrv = setupHTTPServer(cfg, db, metricsHandler)
 	startHTTPServerAuth(cfg, httpSrv, stop)
 
@@ -161,8 +166,8 @@ func startHTTPServerAuth(cfg *config.AppConfig, httpSrv *http.Server, stop conte
 	}()
 }
 
-func setupGRPCServerAuth(cfg *config.AppConfig, db *sql.DB, _ net.Listener) *grpc.Server {
-	verifier, err := authn.NewJWTVerifier(cfg.Auth.JWTSecret)
+func setupGRPCServerAuth(cfg *config.AppConfig, db *pgxpool.Pool, _ net.Listener) *grpc.Server {
+	verifier, err := authn.NewJWTVerifier(cfg.Auth.JWTPublicKeyPEM)
 	if err != nil {
 		slog.Error("Failed to initialize jwt verifier", "error", err)
 		return nil
@@ -429,7 +434,7 @@ func runMigrations(dbDSN string) error {
 	return nil
 }
 
-func setupHTTPServer(cfg *config.AppConfig, db *sql.DB, metricsHandler http.Handler) *http.Server {
+func setupHTTPServer(cfg *config.AppConfig, db *pgxpool.Pool, metricsHandler http.Handler) *http.Server {
 	mux := http.NewServeMux()
 
 	mux.HandleFunc("/healthz", func(w http.ResponseWriter, _ *http.Request) {
@@ -438,7 +443,7 @@ func setupHTTPServer(cfg *config.AppConfig, db *sql.DB, metricsHandler http.Hand
 	})
 
 	mux.HandleFunc("/readyz", func(w http.ResponseWriter, r *http.Request) {
-		if err := db.PingContext(r.Context()); err != nil {
+		if err := db.Ping(r.Context()); err != nil {
 			w.WriteHeader(http.StatusServiceUnavailable)
 			_, _ = w.Write([]byte("Disconnected"))
 
diff --git a/cmd/server/commands/common.go b/cmd/server/commands/common.go
index 8c4667e..e8d02dc 100644
--- a/cmd/server/commands/common.go
+++ b/cmd/server/commands/common.go
@@ -3,7 +3,6 @@ package commands
 
 import (
 	"context"
-	"database/sql"
 	"fmt"
 	"log/slog"
 	"os"
@@ -13,10 +12,11 @@ import (
 	"github.com/cmelgarejo/go-modulith-template/internal/config"
 	"github.com/cmelgarejo/go-modulith-template/internal/migration"
 	"github.com/cmelgarejo/go-modulith-template/internal/registry"
+	"github.com/jackc/pgx/v5/pgxpool"
 )
 
 // CommonSetup loads configuration, initializes database, and creates registry.
-func CommonSetup() (*config.AppConfig, *sql.DB, *registry.Registry) {
+func CommonSetup() (*config.AppConfig, *pgxpool.Pool, *registry.Registry) {
 	observability.InitLoggerEarly()
 
 	systemEnvVars := setup.CaptureSystemEnvVars()
@@ -60,10 +60,7 @@ func RunMigrations(dbDSN string, reg *registry.Registry) error {
 
 // RunSeedData runs seed data for all modules.
 func RunSeedData(dbDSN string, reg *registry.Registry) error {
-	// Create adapter for the registry to match migration.ModuleRegistry interface
-	adapter := &registryAdapter{reg: reg}
-
-	seeder, err := migration.NewSeeder(dbDSN, adapter)
+	seeder, err := migration.NewSeeder(dbDSN, reg)
 	if err != nil {
 		return fmt.Errorf("failed to create seeder: %w", err)
 	}
@@ -80,19 +77,3 @@ func RunSeedData(dbDSN string, reg *registry.Registry) error {
 
 	return nil
 }
-
-// registryAdapter adapts registry.Registry to migration.ModuleRegistry.
-type registryAdapter struct {
-	reg *registry.Registry
-}
-
-func (r *registryAdapter) Modules() []interface{} {
-	modules := r.reg.Modules()
-	result := make([]interface{}, len(modules))
-
-	for i, mod := range modules {
-		result[i] = mod
-	}
-
-	return result
-}
diff --git a/cmd/server/commands/seed.go b/cmd/server/commands/seed.go
index ea4d2aa..7f327ba 100644
--- a/cmd/server/commands/seed.go
+++ b/cmd/server/commands/seed.go
@@ -2,9 +2,11 @@
 package commands
 
 import (
+	"context"
 	"log/slog"
 
 	"github.com/cmelgarejo/go-modulith-template/cmd/server/setup"
+	"github.com/cmelgarejo/go-modulith-template/internal/migration"
 )
 
 // RunSeedCommand runs the seed command.
@@ -19,3 +21,28 @@ func RunSeedCommand() {
 
 	slog.Info("✅ Seed data completed successfully")
 }
+
+// RunSeedModuleCommand runs seed data for a single module.
+func RunSeedModuleCommand(moduleName string) {
+	cfg, db, reg := CommonSetup()
+	defer setup.CloseDB(db)
+
+	seeder, err := migration.NewSeeder(cfg.DBDSN, reg)
+	if err != nil {
+		slog.Error("Failed to create seeder", "error", err)
+		return
+	}
+
+	defer func() {
+		if err := seeder.Close(); err != nil {
+			slog.Error("Failed to close seeder", "error", err)
+		}
+	}()
+
+	if err := seeder.SeedModule(context.Background(), moduleName); err != nil {
+		slog.Error("Failed to seed module", "module", moduleName, "error", err)
+		return
+	}
+
+	slog.Info("✅ Seed data for module completed successfully", "module", moduleName)
+}
diff --git a/cmd/server/health/handlers.go b/cmd/server/health/handlers.go
index f03ea9f..b151049 100644
--- a/cmd/server/health/handlers.go
+++ b/cmd/server/health/handlers.go
@@ -3,19 +3,20 @@ package health
 
 import (
 	"context"
-	"database/sql"
 	"encoding/json"
 	"fmt"
 	"net/http"
 
 	"github.com/cmelgarejo/go-modulith-template/internal/registry"
 	"github.com/cmelgarejo/go-modulith-template/internal/websocket"
+	"github.com/jackc/pgx/v5/pgxpool"
 )
 
 const healthStatusHealthy = "healthy"
+const errNotInitialized = "unhealthy: not initialized"
 
 // SetupHealthChecks registers all health check endpoints.
-func SetupHealthChecks(mux *http.ServeMux, db *sql.DB, wsHub *websocket.Hub, reg *registry.Registry) {
+func SetupHealthChecks(mux *http.ServeMux, db *pgxpool.Pool, wsHub *websocket.Hub, reg *registry.Registry) {
 	SetupLivenessProbe(mux)
 	SetupReadinessProbe(mux, db, wsHub, reg)
 	SetupWebSocketHealthCheck(mux, wsHub)
@@ -37,7 +38,7 @@ func SetupLivenessProbe(mux *http.ServeMux) {
 }
 
 // SetupReadinessProbe registers the readiness probe endpoint.
-func SetupReadinessProbe(mux *http.ServeMux, db *sql.DB, wsHub *websocket.Hub, reg *registry.Registry) {
+func SetupReadinessProbe(mux *http.ServeMux, db *pgxpool.Pool, wsHub *websocket.Hub, reg *registry.Registry) {
 	// Readiness probe - checks all dependencies
 	mux.HandleFunc("/readyz", func(w http.ResponseWriter, r *http.Request) {
 		w.Header().Set("Content-Type", "application/json")
@@ -63,7 +64,7 @@ func SetupReadinessProbe(mux *http.ServeMux, db *sql.DB, wsHub *websocket.Hub, r
 }
 
 // CheckReadinessDependencies checks all dependencies and updates the checks map.
-func CheckReadinessDependencies(ctx context.Context, checks map[string]string, db *sql.DB, wsHub *websocket.Hub, reg *registry.Registry) bool {
+func CheckReadinessDependencies(ctx context.Context, checks map[string]string, db *pgxpool.Pool, wsHub *websocket.Hub, reg *registry.Registry) bool {
 	allHealthy := true
 
 	// Check module health
@@ -75,7 +76,7 @@ func CheckReadinessDependencies(ctx context.Context, checks map[string]string, d
 	}
 
 	// Check database connectivity
-	if err := db.PingContext(ctx); err != nil {
+	if err := db.Ping(ctx); err != nil {
 		checks["database"] = fmt.Sprintf("unhealthy: %v", err)
 		allHealthy = false
 	} else {
@@ -86,7 +87,7 @@ func CheckReadinessDependencies(ctx context.Context, checks map[string]string, d
 	if reg.EventBus() != nil {
 		checks["event_bus"] = healthStatusHealthy
 	} else {
-		checks["event_bus"] = "unhealthy: not initialized"
+		checks["event_bus"] = errNotInitialized
 		allHealthy = false
 	}
 
@@ -94,7 +95,20 @@ func CheckReadinessDependencies(ctx context.Context, checks map[string]string, d
 	if wsHub != nil {
 		checks["websocket"] = healthStatusHealthy
 	} else {
-		checks["websocket"] = "unhealthy: not initialized"
+		checks["websocket"] = errNotInitialized
+		allHealthy = false
+	}
+
+	// Check Valkey Cache
+	if reg.Cache() != nil {
+		if err := reg.Cache().Ping(ctx); err != nil {
+			checks["valkey"] = fmt.Sprintf("unhealthy: %v", err)
+			allHealthy = false
+		} else {
+			checks["valkey"] = healthStatusHealthy
+		}
+	} else {
+		checks["valkey"] = errNotInitialized
 		allHealthy = false
 	}
 
diff --git a/cmd/server/main.go b/cmd/server/main.go
index bbf6306..cbec932 100644
--- a/cmd/server/main.go
+++ b/cmd/server/main.go
@@ -3,7 +3,6 @@ package main
 
 import (
 	"context"
-	"database/sql"
 	"flag"
 	"log/slog"
 	"os"
@@ -17,6 +16,8 @@ import (
 	"github.com/cmelgarejo/go-modulith-template/internal/config"
 	"github.com/cmelgarejo/go-modulith-template/internal/migration"
 	"github.com/cmelgarejo/go-modulith-template/internal/registry"
+	"github.com/jackc/pgx/v5/pgxpool"
+	_ "github.com/jackc/pgx/v5/stdlib"
 	"google.golang.org/grpc"
 )
 
@@ -82,12 +83,10 @@ func handleSubcommand(args []string) {
 	command := args[0]
 
 	switch command {
-	case "migrate":
-		commands.RunMigrateCommand()
-	case "migrate-down":
-		commands.RunMigrateDownCommand()
+	case "migrate", "migrate-down":
+		handleMigrateSubcommand(command, args)
 	case "seed":
-		commands.RunSeedCommand()
+		handleSeedSubcommand(command, args)
 	case "admin":
 		if len(args) < 2 {
 			slog.Error("Usage: admin <task_name>")
@@ -102,7 +101,30 @@ func handleSubcommand(args []string) {
 	}
 }
 
-func initializeServices(ctx context.Context, cfg *config.AppConfig) (func(), *sql.DB) {
+func handleMigrateSubcommand(command string, _ []string) {
+	switch command {
+	case "migrate":
+		commands.RunMigrateCommand()
+	case "migrate-down":
+		commands.RunMigrateDownCommand()
+	}
+}
+
+func handleSeedSubcommand(command string, args []string) {
+	switch command {
+	case "seed":
+		commands.RunSeedCommand()
+	case "seed-module":
+		if len(args) < 2 {
+			slog.Error("Usage: seed-module <module_name>")
+			os.Exit(1)
+		}
+
+		commands.RunSeedModuleCommand(args[1])
+	}
+}
+
+func initializeServices(ctx context.Context, cfg *config.AppConfig) (func(), *pgxpool.Pool) {
 	shutdownObs, err := observability.InitObservability(ctx, cfg)
 	if err != nil {
 		slog.Error("Failed to initialize observability", "error", err)
diff --git a/cmd/server/setup/config.go b/cmd/server/setup/config.go
index 68f3e10..1005215 100644
--- a/cmd/server/setup/config.go
+++ b/cmd/server/setup/config.go
@@ -7,9 +7,9 @@ import (
 	"os"
 
 	"github.com/cmelgarejo/go-modulith-template/cmd/server/observability"
+	"github.com/cmelgarejo/go-modulith-template/internal/appversion"
 	"github.com/cmelgarejo/go-modulith-template/internal/config"
 	"github.com/cmelgarejo/go-modulith-template/internal/i18n"
-	"github.com/cmelgarejo/go-modulith-template/internal/version"
 	"github.com/joho/godotenv"
 )
 
@@ -43,7 +43,7 @@ func LoadConfig() *config.AppConfig {
 		return nil
 	}
 
-	slog.Info("Starting application", "version", version.Info())
+	slog.Info("Starting application", "version", appversion.Info())
 
 	return cfg
 }
@@ -79,5 +79,13 @@ func CaptureSystemEnvVars() map[string]string {
 		systemEnvVars["JWT_SECRET"] = secret
 	}
 
+	if key := os.Getenv("JWT_PRIVATE_KEY"); key != "" {
+		systemEnvVars["JWT_PRIVATE_KEY"] = key
+	}
+
+	if key := os.Getenv("JWT_PUBLIC_KEY"); key != "" {
+		systemEnvVars["JWT_PUBLIC_KEY"] = key
+	}
+
 	return systemEnvVars
 }
diff --git a/cmd/server/setup/database.go b/cmd/server/setup/database.go
index 778fb19..076cf1c 100644
--- a/cmd/server/setup/database.go
+++ b/cmd/server/setup/database.go
@@ -3,27 +3,24 @@ package setup
 
 import (
 	"context"
-	"database/sql"
 	"fmt"
 	"log/slog"
 	"time"
 
 	"github.com/cmelgarejo/go-modulith-template/internal/config"
-	_ "github.com/jackc/pgx/v5/stdlib" // Register pgx driver for database/sql
+	"github.com/jackc/pgx/v5/pgxpool"
 )
 
-// InitDB initializes and connects to the database.
-func InitDB(cfg *config.AppConfig) (*sql.DB, error) {
-	db, err := sql.Open("pgx", cfg.DBDSN)
+// InitDB initializes and connects to the database pool.
+func InitDB(cfg *config.AppConfig) (*pgxpool.Pool, error) {
+	poolConfig, err := pgxpool.ParseConfig(cfg.DBDSN)
 	if err != nil {
-		slog.Error("Failed to open DB", "error", err)
-
-		return nil, fmt.Errorf("failed to open database: %w", err)
+		return nil, fmt.Errorf("failed to parse database DSN: %w", err)
 	}
 
 	// Configure connection pool
-	db.SetMaxOpenConns(cfg.DBMaxOpenConns)
-	db.SetMaxIdleConns(cfg.DBMaxIdleConns)
+	poolConfig.MaxConns = int32(cfg.DBMaxOpenConns) // #nosec G115
+	poolConfig.MinConns = int32(cfg.DBMaxIdleConns) // #nosec G115
 
 	// Parse lifetime duration
 	if cfg.DBConnMaxLifetime != "" {
@@ -31,7 +28,7 @@ func InitDB(cfg *config.AppConfig) (*sql.DB, error) {
 		if err != nil {
 			slog.Warn("Invalid DB_CONN_MAX_LIFETIME, using default", "value", cfg.DBConnMaxLifetime, "error", err)
 		} else {
-			db.SetConnMaxLifetime(lifetime)
+			poolConfig.MaxConnLifetime = lifetime
 		}
 	}
 
@@ -49,25 +46,29 @@ func InitDB(cfg *config.AppConfig) (*sql.DB, error) {
 	ctx, cancel := context.WithTimeout(context.Background(), connectTimeout)
 	defer cancel()
 
-	if err := db.PingContext(ctx); err != nil {
-		slog.Error("Failed to ping DB", "error", err, "timeout", connectTimeout)
+	pool, err := pgxpool.NewWithConfig(ctx, poolConfig)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create database pool: %w", err)
+	}
 
+	if err := pool.Ping(ctx); err != nil {
+		pool.Close()
 		return nil, fmt.Errorf("failed to ping database: %w", err)
 	}
 
-	slog.Info("Connected to Database",
-		"max_open_conns", cfg.DBMaxOpenConns,
-		"max_idle_conns", cfg.DBMaxIdleConns,
-		"conn_max_lifetime", cfg.DBConnMaxLifetime,
+	slog.Info("Connected to Database (pgxpool)",
+		"max_conns", poolConfig.MaxConns,
+		"min_conns", poolConfig.MinConns,
+		"conn_max_lifetime", poolConfig.MaxConnLifetime,
 		"connect_timeout", connectTimeout,
 	)
 
-	return db, nil
+	return pool, nil
 }
 
-// CloseDB closes the database connection.
-func CloseDB(db *sql.DB) {
-	if err := db.Close(); err != nil {
-		slog.Error("Failed to close DB", "error", err)
+// CloseDB closes the database connection pool.
+func CloseDB(pool *pgxpool.Pool) {
+	if pool != nil {
+		pool.Close()
 	}
 }
diff --git a/cmd/server/setup/gateway.go b/cmd/server/setup/gateway.go
index 4666cc5..e573364 100644
--- a/cmd/server/setup/gateway.go
+++ b/cmd/server/setup/gateway.go
@@ -61,7 +61,7 @@ func Gateway(ctx context.Context, cfg *config.AppConfig, reg *registry.Registry,
 
 // setupWebSocket configures the WebSocket endpoint with authentication.
 func setupWebSocket(mux *http.ServeMux, cfg *config.AppConfig, wsHub *websocket.Hub) {
-	verifier, err := authn.NewJWTVerifier(cfg.Auth.JWTSecret)
+	verifier, err := authn.NewJWTVerifier(cfg.Auth.JWTPublicKeyPEM)
 	if err != nil {
 		slog.Warn("Failed to create JWT verifier for WebSocket, connections will be unauthenticated",
 			"error", err)
diff --git a/cmd/server/setup/registry.go b/cmd/server/setup/registry.go
index 6557b7d..6b12ad5 100644
--- a/cmd/server/setup/registry.go
+++ b/cmd/server/setup/registry.go
@@ -3,19 +3,23 @@ package setup
 
 import (
 	"context"
-	"database/sql"
+	"fmt"
 	"log/slog"
 
+	"github.com/cmelgarejo/go-modulith-template/internal/audit"
+	"github.com/cmelgarejo/go-modulith-template/internal/cache"
 	"github.com/cmelgarejo/go-modulith-template/internal/config"
 	"github.com/cmelgarejo/go-modulith-template/internal/events"
+	"github.com/cmelgarejo/go-modulith-template/internal/feature"
 	"github.com/cmelgarejo/go-modulith-template/internal/notifier"
 	"github.com/cmelgarejo/go-modulith-template/internal/registry"
 	"github.com/cmelgarejo/go-modulith-template/internal/websocket"
 	"github.com/cmelgarejo/go-modulith-template/modules/auth"
+	"github.com/jackc/pgx/v5/pgxpool"
 )
 
 // CreateRegistry creates a new registry with all dependencies.
-func CreateRegistry(cfg *config.AppConfig, db *sql.DB) *registry.Registry {
+func CreateRegistry(cfg *config.AppConfig, db *pgxpool.Pool) *registry.Registry {
 	// Create shared services
 	ebus := events.NewBus()
 	wsHub := websocket.NewHub(context.Background())
@@ -34,6 +38,37 @@ func CreateRegistry(cfg *config.AppConfig, db *sql.DB) *registry.Registry {
 
 	slog.Info("WebSocket hub initialized")
 
+	// Initialize Audit Logger
+	auditLogger := audit.NewEventBusLogger(ebus)
+
+	// Initialize Cache
+	var cacheImpl cache.Cache
+
+	valkeyCfg := cache.ValkeyConfig{
+		Addr:         cfg.ValkeyAddr,
+		Password:     cfg.ValkeyPassword,
+		DB:           cfg.ValkeyDB,
+		PoolSize:     cfg.ValkeyPoolSize,
+		MinIdleConns: cfg.ValkeyMinIdleConns,
+	}
+
+	valkeyCache, err := cache.NewValkeyCache(valkeyCfg)
+	if err != nil {
+		slog.Error("Failed to initialize Valkey cache", "error", err)
+		// We could decide to fail here or continue without cache
+		// Given it's critical for rate limiting, let's fail in prod
+		if cfg.Env == "prod" {
+			panic(fmt.Errorf("failed to initialize Valkey cache: %w", err))
+		}
+	} else {
+		slog.Info("Valkey cache initialized", "addr", cfg.ValkeyAddr)
+
+		cacheImpl = valkeyCache
+	}
+
+	// Initialize Feature Flag Manager
+	featureMgr := feature.NewSQLManager(db)
+
 	// Create registry with all dependencies
 	return registry.New(
 		registry.WithConfig(cfg),
@@ -41,14 +76,17 @@ func CreateRegistry(cfg *config.AppConfig, db *sql.DB) *registry.Registry {
 		registry.WithEventBus(ebus),
 		registry.WithNotifier(ntf),
 		registry.WithWebSocketHub(wsHub),
+		registry.WithAuditLogger(auditLogger),
+		registry.WithFeature(featureMgr),
+		registry.WithCache(cacheImpl),
 	)
 }
 
 // RegisterModules registers all modules with the registry.
 func RegisterModules(reg *registry.Registry) {
 	// Register all modules here
+	// Order matters: modules that are dependencies must be registered first
 	reg.Register(auth.NewModule())
 	// Add more modules as needed:
-	// reg.Register(order.NewModule())
-	// reg.Register(payment.NewModule())
+	// reg.Register(wallet.NewModule())
 }
diff --git a/cmd/server/setup/server.go b/cmd/server/setup/server.go
index f73823f..d6b38b3 100644
--- a/cmd/server/setup/server.go
+++ b/cmd/server/setup/server.go
@@ -1,4 +1,3 @@
-// Package setup provides server setup and configuration utilities.
 package setup
 
 import (
@@ -9,11 +8,14 @@ import (
 	"net/http"
 	"time"
 
+	"github.com/cmelgarejo/go-modulith-template/internal/audit"
+
 	"github.com/cmelgarejo/go-modulith-template/internal/authn"
 	"github.com/cmelgarejo/go-modulith-template/internal/config"
 	"github.com/cmelgarejo/go-modulith-template/internal/i18n"
 	"github.com/cmelgarejo/go-modulith-template/internal/middleware"
 	"github.com/cmelgarejo/go-modulith-template/internal/registry"
+	"github.com/cmelgarejo/go-modulith-template/internal/telemetry"
 	"github.com/cmelgarejo/go-modulith-template/internal/validation"
 	"go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc"
 	"google.golang.org/grpc"
@@ -27,7 +29,7 @@ func GRPC(cfg *config.AppConfig, reg *registry.Registry) (*grpc.Server, net.List
 		return nil, nil, fmt.Errorf("failed to listen gRPC: %w", err)
 	}
 
-	verifier, err := authn.NewJWTVerifier(cfg.Auth.JWTSecret)
+	verifier, err := authn.NewJWTVerifier(cfg.Auth.JWTPublicKeyPEM)
 	if err != nil {
 		_ = lis.Close()
 		return nil, nil, fmt.Errorf("failed to init jwt verifier: %w", err)
@@ -45,6 +47,8 @@ func GRPC(cfg *config.AppConfig, reg *registry.Registry) (*grpc.Server, net.List
 				Verifier:      verifier,
 				PublicMethods: public,
 			}),
+			audit.UnaryServerInterceptor(reg.AuditLogger()), // Audit authenticated requests
+			telemetry.UnaryServerInterceptor(),              // Record metrics for all calls
 		),
 	)
 
@@ -75,15 +79,15 @@ func AndStartServers(ctx context.Context, cfg *config.AppConfig, reg *registry.R
 		return nil, nil, nil
 	}
 
-	httpServer := StartHTTPServer(cfg, mux)
+	httpServer := StartHTTPServer(cfg, mux, reg)
 	StartGRPCServer(cfg, grpcServer, lis, stop)
 
 	return grpcServer, httpServer, gatewayConn
 }
 
 // StartHTTPServer creates and starts the HTTP server.
-func StartHTTPServer(cfg *config.AppConfig, mux *http.ServeMux) *http.Server {
-	handler := BuildHTTPHandler(cfg, mux)
+func StartHTTPServer(cfg *config.AppConfig, mux *http.ServeMux, reg *registry.Registry) *http.Server {
+	handler := BuildHTTPHandler(cfg, mux, reg)
 	server := CreateHTTPServer(cfg, handler)
 	StartServerAsync(server)
 
@@ -91,7 +95,7 @@ func StartHTTPServer(cfg *config.AppConfig, mux *http.ServeMux) *http.Server {
 }
 
 // BuildHTTPHandler builds the HTTP handler with all middleware.
-func BuildHTTPHandler(cfg *config.AppConfig, mux *http.ServeMux) http.Handler {
+func BuildHTTPHandler(cfg *config.AppConfig, mux *http.ServeMux, reg *registry.Registry) http.Handler {
 	// Wrap with middleware (innermost first)
 	var handler http.Handler = mux
 
@@ -105,7 +109,7 @@ func BuildHTTPHandler(cfg *config.AppConfig, mux *http.ServeMux) http.Handler {
 
 	// Apply rate limiting middleware if enabled
 	if cfg.RateLimitEnabled {
-		rateLimiter := middleware.NewRateLimiter(cfg.RateLimitRPS, cfg.RateLimitBurst)
+		rateLimiter := middleware.NewRateLimiter(cfg.RateLimitRPS, cfg.RateLimitBurst, reg.Cache())
 		handler = rateLimiter.Middleware()(handler)
 
 		slog.Info("Rate limiting enabled",
@@ -124,6 +128,9 @@ func BuildHTTPHandler(cfg *config.AppConfig, mux *http.ServeMux) http.Handler {
 
 	handler = middleware.Timeout(requestTimeout)(handler)
 
+	// Apply security headers (HSTS, CSP, etc.)
+	handler = middleware.SecurityHeaders()(handler)
+
 	// Apply logging middleware (logs requests with method, path, status, duration)
 	handler = middleware.LoggingWithDefaults()(handler)
 
diff --git a/cmd/visualize/analyzer/analyzer.go b/cmd/visualize/analyzer/analyzer.go
index b63b96d..f776729 100644
--- a/cmd/visualize/analyzer/analyzer.go
+++ b/cmd/visualize/analyzer/analyzer.go
@@ -190,6 +190,7 @@ func analyzeProtoConnections(_ string, protoDir string, graph *Graph) error {
 		// Read proto file to find services
 		cleanPath := filepath.Clean(path)
 
+		//nolint:gosec
 		data, err := os.ReadFile(cleanPath)
 		if err != nil {
 			return nil
@@ -242,6 +243,7 @@ func analyzeEventConnections(projectRoot, modulesDir string, graph *Graph) error
 
 		cleanPath := filepath.Clean(path)
 
+		//nolint:gosec
 		data, err := os.ReadFile(cleanPath)
 		if err != nil {
 			return nil
@@ -318,6 +320,8 @@ func analyzeEventConnections(projectRoot, modulesDir string, graph *Graph) error
 		}
 
 		cleanPath := filepath.Clean(path)
+
+		//nolint:gosec
 		data, err := os.ReadFile(cleanPath)
 		if err != nil {
 			return nil
diff --git a/cmd/visualize/main.go b/cmd/visualize/main.go
index a5cf3a7..355c181 100644
--- a/cmd/visualize/main.go
+++ b/cmd/visualize/main.go
@@ -168,7 +168,7 @@ func outputDOT(graph *analyzer.Graph, filename string) error {
 
 	// Add nodes
 	for _, module := range graph.Modules {
-		sb.WriteString(fmt.Sprintf("  \"%s\" [label=\"%s\"];\n", module.Name, module.Name))
+		fmt.Fprintf(&sb, "  \"%s\" [label=\"%s\"];\n", module.Name, module.Name)
 	}
 
 	sb.WriteString("\n")
@@ -181,16 +181,16 @@ func outputDOT(graph *analyzer.Graph, filename string) error {
 				style = "dashed"
 			}
 
-			sb.WriteString(fmt.Sprintf("  \"%s\" -> \"%s\" [label=\"%s\", style=%s];\n",
-				conn.From, conn.To, conn.Service, style))
+			fmt.Fprintf(&sb, "  \"%s\" -> \"%s\" [label=\"%s\", style=%s];\n",
+				conn.From, conn.To, conn.Service, style)
 		}
 	}
 
 	// Add event connections
 	for _, conn := range graph.Connections {
 		if conn.Type == "event" {
-			sb.WriteString(fmt.Sprintf("  \"%s\" -> \"%s\" [label=\"%s\", style=dotted, color=blue];\n",
-				conn.From, conn.To, conn.Event))
+			fmt.Fprintf(&sb, "  \"%s\" -> \"%s\" [label=\"%s\", style=dotted, color=blue];\n",
+				conn.From, conn.To, conn.Event)
 		}
 	}
 
diff --git a/cmd/worker/main.go b/cmd/worker/main.go
index 3db427f..ae8678f 100644
--- a/cmd/worker/main.go
+++ b/cmd/worker/main.go
@@ -4,7 +4,6 @@ package main
 
 import (
 	"context"
-	"database/sql"
 	"fmt"
 	"log/slog"
 	"os"
@@ -19,7 +18,7 @@ import (
 	"github.com/cmelgarejo/go-modulith-template/internal/registry"
 	"github.com/cmelgarejo/go-modulith-template/internal/version"
 	"github.com/cmelgarejo/go-modulith-template/modules/auth"
-	_ "github.com/jackc/pgx/v5/stdlib"
+	"github.com/jackc/pgx/v5/pgxpool"
 	"github.com/joho/godotenv"
 )
 
@@ -80,38 +79,36 @@ func loadConfig() *config.AppConfig {
 	return cfg
 }
 
-func initDB(cfg *config.AppConfig) *sql.DB {
-	db, err := sql.Open("pgx", cfg.DBDSN)
+func initDB(cfg *config.AppConfig) *pgxpool.Pool {
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	poolCfg, err := pgxpool.ParseConfig(cfg.DBDSN)
 	if err != nil {
-		slog.Error("Failed to open DB", "error", err)
+		slog.Error("Failed to parse DB config", "error", err)
 		return nil
 	}
 
 	// Configure connection pool
-	db.SetMaxOpenConns(cfg.DBMaxOpenConns)
-	db.SetMaxIdleConns(cfg.DBMaxIdleConns)
+	poolCfg.MaxConns = int32(cfg.DBMaxOpenConns) // #nosec G115
+	poolCfg.MinConns = int32(cfg.DBMaxIdleConns) // #nosec G115
 
-	// Parse lifetime duration
 	if cfg.DBConnMaxLifetime != "" {
 		if lifetime, err := time.ParseDuration(cfg.DBConnMaxLifetime); err == nil {
-			db.SetConnMaxLifetime(lifetime)
+			poolCfg.MaxConnLifetime = lifetime
 		}
 	}
 
-	// Parse connect timeout and ping with context
-	connectTimeout := 10 * time.Second
-
-	if cfg.DBConnectTimeout != "" {
-		if parsed, err := time.ParseDuration(cfg.DBConnectTimeout); err == nil {
-			connectTimeout = parsed
-		}
+	db, err := pgxpool.NewWithConfig(context.Background(), poolCfg)
+	if err != nil {
+		slog.Error("Failed to create DB pool", "error", err)
+		return nil
 	}
 
-	ctx, cancel := context.WithTimeout(context.Background(), connectTimeout)
-	defer cancel()
+	if err := db.Ping(ctx); err != nil {
+		slog.Error("Failed to ping DB", "error", err)
+		db.Close()
 
-	if err := db.PingContext(ctx); err != nil {
-		slog.Error("Failed to ping DB", "error", err, "timeout", connectTimeout)
 		return nil
 	}
 
@@ -120,13 +117,11 @@ func initDB(cfg *config.AppConfig) *sql.DB {
 	return db
 }
 
-func closeDB(db *sql.DB) {
-	if err := db.Close(); err != nil {
-		slog.Error("Failed to close DB", "error", err)
-	}
+func closeDB(db *pgxpool.Pool) {
+	db.Close()
 }
 
-func createRegistry(cfg *config.AppConfig, db *sql.DB) *registry.Registry {
+func createRegistry(cfg *config.AppConfig, db *pgxpool.Pool) *registry.Registry {
 	// Create shared services
 	ebus := events.NewBus()
 	ntf := notifier.NewLogNotifier()
diff --git a/deployment/README.md b/deployment/README.md
index 34b6267..d4b38cf 100644
--- a/deployment/README.md
+++ b/deployment/README.md
@@ -59,8 +59,8 @@ aws eks update-kubeconfig \
 
 ```bash
 # Build images
-make docker-build                # modulith-server:latest
-make docker-build-module auth    # modulith-auth:latest
+just docker-build                # modulith-server:latest
+just docker-build-module auth    # modulith-auth:latest
 
 # Tag and push to registry (example: ECR)
 docker tag modulith-server:latest 123456789.dkr.ecr.us-east-1.amazonaws.com/modulith-server:v1.0.0
diff --git a/deployment/helm/modulith/README.md b/deployment/helm/modulith/README.md
index d1d7b07..134be21 100644
--- a/deployment/helm/modulith/README.md
+++ b/deployment/helm/modulith/README.md
@@ -66,8 +66,8 @@ El chart construye el nombre completo de la imagen automáticamente:
 
 Esto se alinea con los comandos del Makefile:
 ```bash
-make docker-build          # Crea modulith-server:latest
-make docker-build-module auth  # Crea modulith-auth:latest
+just docker-build          # Crea modulith-server:latest
+just docker-build-module auth  # Crea modulith-auth:latest
 ```
 
 ### Secretos
diff --git a/docs/12_FACTOR_APP.md b/docs/12_FACTOR_APP.md
index 9ada629..2bd8a89 100644
--- a/docs/12_FACTOR_APP.md
+++ b/docs/12_FACTOR_APP.md
@@ -142,8 +142,8 @@ db, err := sql.Open("pgx", cfg.DBDSN)  // DB_DSN desde env
 1. **Build:**
 
     ```bash
-    make build              # Compila binario
-    make docker-build       # Crea imagen Docker
+    just build              # Compila binario
+    just docker-build       # Crea imagen Docker
     ```
 
 2. **Release:**
@@ -335,18 +335,18 @@ log_level: info # debug, info, warn, error
 ```bash
 # Ejecutar migraciones
 go run cmd/server/main.go migrate
-# o: make migrate
+# o: just migrate
 
 # Ejecutar seed data
 go run cmd/server/main.go seed
-# o: make seed
+# o: just seed
 
 # Ejecutar tarea administrativa
 ./bin/server admin cleanup-sessions
 ./bin/server admin cleanup-magic-codes
 
 # O con make
-make admin TASK=cleanup-sessions
+just admin TASK=cleanup-sessions
 ```
 
 **Ver también:** `cmd/server/commands/admin.go` (función `RunAdminCommand`), `internal/admin/runner.go`, `internal/migration/seeder.go`
@@ -482,10 +482,10 @@ git push origin v1.0.0
 
 ```bash
 # Ejecutar tests de integración (requiere Docker)
-make test-integration
+just test-integration
 
 # Ejecutar todos los tests
-make test-all
+just test-all
 
 # Saltar tests de integración en CI
 go test -short ./...
@@ -499,11 +499,11 @@ go test -short ./...
 
 1. **Zero Boilerplate para Tareas Comunes**:
    -   Las migraciones se ejecutan automáticamente
-   -   Seed data con `make seed`
+   -   Seed data con `just seed`
    -   Admin tasks via interfaz simple
 
 2. **Estructura de Módulo Consistente**:
-   -   `make new-module name` crea todo
+   -   `just new-module name` crea todo
    -   Directorio de seed data incluido
    -   Lifecycle hooks disponibles
 
@@ -627,7 +627,7 @@ Antes de desplegar a producción, verificar:
 El template está ahora listo para producción con compliance completo de 12-factor. Áreas de enfoque:
 
 1. **Lógica de Negocio**: Los desarrolladores pueden enfocarse puramente en reglas de negocio
-2. **Desarrollo de Módulos**: Usar `make new-module` para scaffold de nuevas características
+2. **Desarrollo de Módulos**: Usar `just new-module` para scaffold de nuevas características
 3. **Testing**: Escribir integration tests usando testcontainers
 4. **Despliegue**: Usar Helm charts para despliegue en Kubernetes
 5. **Monitoreo**: Aprovechar telemetría existente (métricas, traces, logs)
diff --git a/docs/DEPLOYMENT_SYNC.md b/docs/DEPLOYMENT_SYNC.md
index f522bc2..ce3ec1b 100644
--- a/docs/DEPLOYMENT_SYNC.md
+++ b/docs/DEPLOYMENT_SYNC.md
@@ -17,13 +17,13 @@ The project uses **gomock** for automatic mock generation:
 
 ```bash
 # Generate mocks for all interfaces
-make generate-mocks
+just generate-mocks
 
 # Run unit tests (with mocks, no DB)
-make test-unit
+just test-unit
 
 # Complete tests (including integration)
-make test
+just test
 ```
 
 **Features:**
@@ -38,10 +38,10 @@ make test
 
 ```bash
 # Visual report in terminal with statistics
-make coverage-report
+just coverage-report
 
 # Interactive HTML report
-make coverage-html
+just coverage-html
 ```
 
 **The report shows:**
@@ -61,18 +61,18 @@ All binaries are compiled in `/bin/`:
 
 | Command                      | Output         | Docker Image               |
 | ---------------------------- | -------------- | -------------------------- |
-| `make build`                 | `bin/server`   | `modulith-server:latest`   |
-| `make build-module auth`     | `bin/auth`     | `modulith-auth:latest`     |
-| `make build-module payments` | `bin/payments` | `modulith-payments:latest` |
-| `make build-all`             | `bin/*`        | -                          |
+| `just build`                 | `bin/server`   | `modulith-server:latest`   |
+| `just build-module auth`     | `bin/auth`     | `modulith-auth:latest`     |
+| `just build-module payments` | `bin/payments` | `modulith-payments:latest` |
+| `just build-all`             | `bin/*`        | -                          |
 
 ### Docker Build
 
 | Command                             | Dockerfile ARG    | Resulting Image            |
 | ----------------------------------- | ----------------- | -------------------------- |
-| `make docker-build`                 | `TARGET=server`   | `modulith-server:latest`   |
-| `make docker-build-module auth`     | `TARGET=auth`     | `modulith-auth:latest`     |
-| `make docker-build-module {module}` | `TARGET={module}` | `modulith-{module}:latest` |
+| `just docker-build`                 | `TARGET=server`   | `modulith-server:latest`   |
+| `just docker-build-module auth`     | `TARGET=auth`     | `modulith-auth:latest`     |
+| `just docker-build-module {module}` | `TARGET={module}` | `modulith-{module}:latest` |
 
 **Dockerfile Path:** `/app/bin/service` (internal)
 
@@ -191,12 +191,12 @@ The template follows the **separation of build, release and run** principle from
 
 ```bash
 # Local binary build
-make build                    # → bin/server
-make build-module auth        # → bin/auth
+just build                    # → bin/server
+just build-module auth        # → bin/auth
 
 # Docker image build
-make docker-build             # → modulith-server:latest
-make docker-build-module auth # → modulith-auth:latest
+just docker-build             # → modulith-server:latest
+just docker-build-module auth # → modulith-auth:latest
 ```
 
 **During build:**
@@ -411,11 +411,11 @@ helm install modulith-server ./deployment/helm/modulith
 
 ```bash
 # Option A: Local binary
-make build-module auth
+just build-module auth
 ./bin/auth
 
 # Option B: Local Docker
-make docker-build-module auth
+just docker-build-module auth
 docker run modulith-auth:latest
 ```
 
@@ -460,7 +460,7 @@ helm install modulith-auth ./deployment/helm/modulith \
 
 ```
 ┌─────────────────────┐
-│  make docker-build  │
+│  just docker-build  │
 └──────────┬──────────┘
            ↓
 ┌─────────────────────┐
@@ -481,7 +481,7 @@ helm install modulith-auth ./deployment/helm/modulith \
 
 ```
 ┌──────────────────┐  ┌──────────────────────────┐
-│ make docker-build│  │make docker-build-module  │
+│ just docker-build│  │just docker-build-module  │
 │                  │  │         auth             │
 └────────┬─────────┘  └────────┬─────────────────┘
          ↓                     ↓
@@ -506,7 +506,7 @@ helm install modulith-auth ./deployment/helm/modulith \
 
 ```
 ┌─────────────────────────────────────┐
-│  make docker-build-module {module}  │
+│  just docker-build-module {module}  │
 └──────────────┬──────────────────────┘
                ↓
 ┌──────────────────────────────────────┐
@@ -560,9 +560,9 @@ helm install modulith-server ./deployment/helm/modulith \
 ```
 go-modulith-template/
 ├── bin/                          # Build outputs (gitignored)
-│   ├── server                    # make build
-│   ├── auth                      # make build-module auth
-│   └── {module}                  # make build-module {module}
+│   ├── server                    # just build
+│   ├── auth                      # just build-module auth
+│   └── {module}                  # just build-module {module}
 │
 ├── cmd/                          # Entry points
 │   ├── server/main.go            # Monolith
@@ -647,7 +647,7 @@ go-modulith-template/
 
 ### For Development
 
-1. ✅ Everything ready - use `make dev-module {module}`
+1. ✅ Everything ready - use `just dev-module {module}`
 
 ### For Staging/Production
 
diff --git a/docs/FRONTEND_PROPOSAL.md b/docs/FRONTEND_PROPOSAL.md
index a3a53e0..3427ff3 100644
--- a/docs/FRONTEND_PROPOSAL.md
+++ b/docs/FRONTEND_PROPOSAL.md
@@ -386,7 +386,7 @@ Air is already configured to monitor `.html` files. Template changes will automa
 
 1. Create folder structure (`internal/templates/`, `static/`)
 2. Implement base handler with template parsing
-3. Integrate in `cmd/server/setup/gateway.go` (GraphQL integration is automatic via `make graphql-init`)
+3. Integrate in `cmd/server/setup/gateway.go` (GraphQL integration is automatic via `just graphql-init`)
 4. Create base template and first example page
 5. Configure authentication middleware for web
 6. Document HTMX patterns in the project
diff --git a/docs/GRAPHQL_AUTO_GENERATION.md b/docs/GRAPHQL_AUTO_GENERATION.md
index 6ec71f1..4556343 100644
--- a/docs/GRAPHQL_AUTO_GENERATION.md
+++ b/docs/GRAPHQL_AUTO_GENERATION.md
@@ -8,9 +8,9 @@ The project includes a tool that automatically generates GraphQL schema files fr
 
 ## How It Works
 
-1. **Proto → OpenAPI**: When you run `make proto`, `buf` generates OpenAPI/Swagger JSON files from your proto definitions
+1. **Proto → OpenAPI**: When you run `just proto`, `buf` generates OpenAPI/Swagger JSON files from your proto definitions
 2. **OpenAPI → GraphQL**: The `graphql-from-proto` tool parses these OpenAPI files and generates GraphQL schema files
-3. **GraphQL Code Generation**: Run `make graphql-generate-all` to generate resolver code from the schemas
+3. **GraphQL Code Generation**: Run `just graphql-generate-all` to generate resolver code from the schemas
 
 ## Usage
 
@@ -18,10 +18,10 @@ The project includes a tool that automatically generates GraphQL schema files fr
 
 ```bash
 # First, ensure proto files are compiled to OpenAPI
-make proto
+just proto
 
 # Then generate GraphQL schemas from OpenAPI
-make graphql-from-proto
+just graphql-from-proto
 ```
 
 This will:
@@ -38,7 +38,7 @@ The `graphql-generate-module` command now automatically generates schemas from p
 
 ```bash
 # This will automatically generate the schema from proto if auth.graphql doesn't exist
-make graphql-generate-module MODULE_NAME=auth
+just graphql-generate-module MODULE_NAME=auth
 ```
 
 This workflow:
@@ -54,20 +54,20 @@ This workflow:
 # Edit proto/auth/v1/auth.proto
 
 # 2. Generate gRPC and OpenAPI code
-make proto
+just proto
 
 # 3. Generate GraphQL schemas and code (automatic!)
 # Option A: Generate schemas for all modules
-make graphql-from-proto
+just graphql-from-proto
 
 # Option B: Generate for one module (auto-generates schema if missing)
-make graphql-generate-module MODULE_NAME=auth
+just graphql-generate-module MODULE_NAME=auth
 
 # 4. Review and customize schemas (optional)
 # Edit internal/graphql/schema/auth.graphql if needed
 
 # 5. Generate GraphQL resolver code (if using Option A)
-make graphql-generate-all
+just graphql-generate-all
 
 # 6. Implement resolvers
 # Edit internal/graphql/resolver/auth.go
@@ -161,7 +161,7 @@ The generated schemas are meant to be a starting point. You can:
 
 ### Regeneration
 
-⚠️ **Important**: The generated schema files have a header indicating they're auto-generated. If you make manual changes, they will be overwritten when you regenerate.
+⚠️ **Important**: The generated schema files have a header indicating they're auto-generated. If you just manual changes, they will be overwritten when you regenerate.
 
 **Best Practice**:
 
@@ -171,28 +171,28 @@ The generated schemas are meant to be a starting point. You can:
 
 ## Integration with Module Scaffolding
 
-When you create a new module with `make new-module <name>`, if GraphQL is initialized, it will:
+When you create a new module with `just new-module <name>`, if GraphQL is initialized, it will:
 
 1. Create a basic GraphQL schema template
-2. After you define your proto file and run `make proto`
-3. You can then run `make graphql-generate-module MODULE_NAME=<name>` which will automatically generate the schema from proto if missing, then generate the GraphQL code
+2. After you define your proto file and run `just proto`
+3. You can then run `just graphql-generate-module MODULE_NAME=<name>` which will automatically generate the schema from proto if missing, then generate the GraphQL code
 
 ## Troubleshooting
 
 ### "No OpenAPI files found"
 
-**Solution**: Run `make proto` first to generate OpenAPI definitions from your proto files.
+**Solution**: Run `just proto` first to generate OpenAPI definitions from your proto files.
 
 ### "GraphQL not initialized"
 
-**Solution**: Run `make graphql-init` first to set up GraphQL infrastructure.
+**Solution**: Run `just graphql-init` first to set up GraphQL infrastructure.
 
 ### Schema validation errors
 
 **Solution**:
 
 1. Check that your proto files are valid
-2. Ensure OpenAPI generation succeeded (`make proto`)
+2. Ensure OpenAPI generation succeeded (`just proto`)
 3. Review the generated schema for any issues
 4. You may need to manually fix type mappings for complex types
 
diff --git a/docs/GRAPHQL_INTEGRATION.md b/docs/GRAPHQL_INTEGRATION.md
index 66a4990..4f53a4a 100644
--- a/docs/GRAPHQL_INTEGRATION.md
+++ b/docs/GRAPHQL_INTEGRATION.md
@@ -14,7 +14,7 @@ This guide explains how to optionally add GraphQL to your project using [gqlgen]
 ### Automatic Installation (Recommended)
 
 ```bash
-make graphql-init
+just graphql-init
 ```
 
 This command automatically:
@@ -26,9 +26,9 @@ This command automatically:
 -   ✅ Configures subscriptions with WebSocket
 -   ✅ Everything compiles and is ready to use
 
-After running `make graphql-init`, you can immediately:
+After running `just graphql-init`, you can immediately:
 
--   Start the server with `make run`
+-   Start the server with `just run`
 -   Access GraphQL playground at `http://localhost:8000/graphql/playground` (dev mode)
 -   Access GraphQL endpoint at `http://localhost:8000/graphql`
 
@@ -346,13 +346,13 @@ func NewGraphQLServer(schema generated.ExecutableSchema, wsHub *websocket.Hub) h
 
 ## 🚀 Integration in cmd/server/setup/gateway.go
 
-GraphQL integration is **automatically handled** when you run `make graphql-init`. The script automatically:
+GraphQL integration is **automatically handled** when you run `just graphql-init`. The script automatically:
 
 1. Adds the GraphQL import to `cmd/server/setup/gateway.go`
 2. Integrates GraphQL endpoint setup in the `Gateway()` function
 3. Generates all GraphQL code automatically
 
-### Automatic Integration (via make graphql-init)
+### Automatic Integration (via just graphql-init)
 
 The integration happens in `cmd/server/setup/gateway.go`:
 
@@ -366,7 +366,7 @@ import (
 func Gateway(ctx context.Context, cfg *config.AppConfig, reg *registry.Registry, wsHub *websocket.Hub) (*http.ServeMux, *grpc.ClientConn, error) {
     // ... existing gateway setup code ...
 
-    // Setup GraphQL endpoint (automatically added by make graphql-init)
+    // Setup GraphQL endpoint (automatically added by just graphql-init)
     if graphqlHandler := graphqlServer.Setup(ctx, reg.EventBus(), wsHub); graphqlHandler != nil {
         mux.Handle("/graphql", graphqlHandler)
 
@@ -383,7 +383,7 @@ func Gateway(ctx context.Context, cfg *config.AppConfig, reg *registry.Registry,
 }
 ```
 
-**Note:** You don't need to manually edit this file - `make graphql-init` handles everything automatically!
+**Note:** You don't need to manually edit this file - `just graphql-init` handles everything automatically!
 
 ## 📊 Ejemplo Completo: Query + Mutation + Subscription
 
@@ -525,17 +525,17 @@ func TestRequestLogin(t *testing.T) {
 
 ```bash
 # Inicializar GraphQL en el proyecto
-make graphql-init
+just graphql-init
 
 # Generar código desde schema
 # Generate code for all modules
-make graphql-generate-all
+just graphql-generate-all
 
 # Or generate for a specific module (auto-generates schema from proto if missing)
-make graphql-generate-module MODULE_NAME=auth
+just graphql-generate-module MODULE_NAME=auth
 
 # Validate schema
-make graphql-validate
+just graphql-validate
 
 # Ver playground (requiere servidor corriendo)
 # http://localhost:8080/graphql/playground
@@ -544,7 +544,7 @@ make graphql-validate
 ## 🔄 Flujo de Desarrollo
 
 1. **Definir Schema** (`internal/graphql/schema/*.graphql`)
-2. **Generar Código** (`make graphql-generate-all` or `make graphql-generate-module MODULE_NAME=<module>`)
+2. **Generar Código** (`just graphql-generate-all` or `just graphql-generate-module MODULE_NAME=<module>`)
     - Note: `graphql-generate-module` automatically generates schemas from proto if they're missing
 3. **Implementar Resolvers** (`internal/graphql/resolver/*.go`)
 4. **Conectar con Módulos** (vía gRPC clients)
@@ -582,7 +582,7 @@ make graphql-validate
 
 ### Error: "schema not found"
 
-**Solución:** Ejecuta `make graphql-generate-all` después de crear/modificar schemas. O usa `make graphql-generate-module MODULE_NAME=<module>` para un módulo específico.
+**Solución:** Ejecuta `just graphql-generate-all` después de crear/modificar schemas. O usa `just graphql-generate-module MODULE_NAME=<module>` para un módulo específico.
 
 ### Subscriptions no funcionan
 
@@ -594,8 +594,8 @@ make graphql-validate
 
 ### Tipos no coinciden
 
-**Solución:** Regenera código con `make graphql-generate-all` después de cambios en schema.
+**Solución:** Regenera código con `just graphql-generate-all` después de cambios en schema.
 
 ---
 
-**¿Listo para agregar GraphQL?** Ejecuta `make graphql-init` y sigue las instrucciones! 🚀
+**¿Listo para agregar GraphQL?** Ejecuta `just graphql-init` y sigue las instrucciones! 🚀
diff --git a/docs/IMPROVEMENTS_ROADMAP.md b/docs/IMPROVEMENTS_ROADMAP.md
index c55de1e..3d9e366 100644
--- a/docs/IMPROVEMENTS_ROADMAP.md
+++ b/docs/IMPROVEMENTS_ROADMAP.md
@@ -172,7 +172,7 @@ Teams won't know how to properly test cross-module interactions.
 
 ### What's Missing
 
--   `make deps-graph` - Visualize module dependencies
+-   `just deps-graph` - Visualize module dependencies
 -   Proto compatibility checking tools
 -   Selective module reloading (only reload changed module)
 -   Better test data management tools
diff --git a/docs/MODULE_COMMUNICATION.md b/docs/MODULE_COMMUNICATION.md
index e6d0bc9..467f216 100644
--- a/docs/MODULE_COMMUNICATION.md
+++ b/docs/MODULE_COMMUNICATION.md
@@ -656,7 +656,7 @@ db_dsn: postgres://user:pass@db:5432/modulith
 
 ```bash
 # Single process
-make build
+just build
 ./bin/server
 ```
 
@@ -683,8 +683,8 @@ auth_service_addr: auth-service:9050
 
 ```bash
 # Multiple processes
-make build-module auth
-make build-module order
+just build-module auth
+just build-module order
 ./bin/auth &
 ./bin/order &
 ```
@@ -706,7 +706,7 @@ Decide which modules to extract based on:
 
 ```bash
 # Already exists for auth
-make new-module order  # Creates cmd/order/main.go
+just new-module order  # Creates cmd/order/main.go
 ```
 
 ### Step 3: Update Configuration
diff --git a/docs/MODULE_VISUALIZATION.md b/docs/MODULE_VISUALIZATION.md
index 19faf03..9554c20 100644
--- a/docs/MODULE_VISUALIZATION.md
+++ b/docs/MODULE_VISUALIZATION.md
@@ -18,7 +18,7 @@ The visualization tool analyzes your codebase to discover:
 Generate an HTML visualization and open it in your browser:
 
 ```bash
-make visualize
+just visualize
 ```
 
 This will:
@@ -34,7 +34,7 @@ This will:
 Interactive web-based visualization with D3.js:
 
 ```bash
-make visualize FORMAT=html
+just visualize FORMAT=html
 ```
 
 Opens an interactive graph where you can:
@@ -48,7 +48,7 @@ Opens an interactive graph where you can:
 Raw graph data for programmatic use:
 
 ```bash
-make visualize FORMAT=json
+just visualize FORMAT=json
 ```
 
 Generates `docs/module-graph.json` with complete graph structure.
@@ -58,7 +58,7 @@ Generates `docs/module-graph.json` with complete graph structure.
 Generate a DOT file for rendering with GraphViz:
 
 ```bash
-make visualize FORMAT=dot
+just visualize FORMAT=dot
 ```
 
 Then render with:
@@ -74,7 +74,7 @@ dot -Tpng docs/module-graph.dot -o docs/graph.png
 Start a local web server to view the visualization:
 
 ```bash
-make visualize SERVE=true
+just visualize SERVE=true
 ```
 
 This will start a server on port 8081 (default) and open the visualization in your browser.
@@ -155,7 +155,7 @@ Visualize your module structure to ensure:
 -   Proper module boundaries
 
 ```bash
-make visualize FORMAT=html
+just visualize FORMAT=html
 # Review the graph, then commit
 ```
 
@@ -164,7 +164,7 @@ make visualize FORMAT=html
 Generate a static visualization for documentation:
 
 ```bash
-make visualize FORMAT=dot
+just visualize FORMAT=dot
 dot -Tsvg docs/module-graph.dot -o docs/module-graph.svg
 ```
 
@@ -173,7 +173,7 @@ dot -Tsvg docs/module-graph.dot -o docs/module-graph.svg
 Generate JSON output for automated analysis:
 
 ```bash
-make visualize FORMAT=json
+just visualize FORMAT=json
 # Use docs/module-graph.json in CI to validate architecture
 ```
 
@@ -229,21 +229,21 @@ Use filters or generate separate graphs for:
 ### View current architecture
 
 ```bash
-make visualize
+just visualize
 # Opens docs/module-graph.html
 ```
 
 ### Generate documentation image
 
 ```bash
-make visualize FORMAT=dot
+just visualize FORMAT=dot
 dot -Tpng docs/module-graph.dot -o docs/architecture.png
 ```
 
 ### Analyze specific module
 
 ```bash
-make visualize FORMAT=json
+just visualize FORMAT=json
 # Filter docs/module-graph.json for specific module
 ```
 
diff --git a/docs/MODULITH_ARCHITECTURE.md b/docs/MODULITH_ARCHITECTURE.md
index d16afac..61df44f 100644
--- a/docs/MODULITH_ARCHITECTURE.md
+++ b/docs/MODULITH_ARCHITECTURE.md
@@ -190,7 +190,7 @@ proto/
 
 ### 7.3 When to Create a New Version
 
-Create a new API version (`v2`, `v3`, etc.) when you need to make **breaking changes**:
+Create a new API version (`v2`, `v3`, etc.) when you need to just **breaking changes**:
 
 -   **Removing fields** from messages
 -   **Changing field types** (e.g., `string` → `int32`)
@@ -214,7 +214,7 @@ Create a new API version (`v2`, `v3`, etc.) when you need to make **breaking cha
 3.  Update package name: `package {module}.v{version};`
 4.  Update REST paths: Change `/v{old}/` to `/v{new}/` in HTTP annotations
 5.  Update Go package option: `option go_package = ".../proto/{module}/v{version};{module}v{version}";`
-6.  Generate code: `make proto`
+6.  Generate code: `just proto`
 7.  Implement new service handlers in the module
 
 #### Automated Process
@@ -223,7 +223,7 @@ Use the provided tooling:
 
 ```bash
 # Create a new API version for a module
-make proto-version-create MODULE_NAME=auth VERSION=v2
+just proto-version-create MODULE_NAME=auth VERSION=v2
 
 # This will:
 # - Create proto/auth/v2/ directory
@@ -248,10 +248,10 @@ Check for breaking changes before committing:
 
 ```bash
 # Check for breaking changes in proto files
-make proto-breaking-check
+just proto-breaking-check
 
 # Or check a specific module
-make proto-breaking-check MODULE_NAME=auth
+just proto-breaking-check MODULE_NAME=auth
 ```
 
 ### 7.6 Backward Compatibility Strategy
@@ -267,7 +267,7 @@ make proto-breaking-check MODULE_NAME=auth
 **Step 1: Create new version**
 
 ```bash
-make proto-version-create MODULE_NAME=auth VERSION=v2
+just proto-version-create MODULE_NAME=auth VERSION=v2
 ```
 
 **Step 2: Modify the new proto file**
@@ -303,7 +303,7 @@ service AuthService {
 **Step 3: Generate code**
 
 ```bash
-make proto
+just proto
 ```
 
 **Step 4: Implement service handlers**
@@ -622,7 +622,7 @@ The system automatically validates configuration before starting:
 We use Docker Compose to start dependencies (Database).
 
 -   PostgreSQL port is configurable via `DB_PORT` in the host's `.env`.
--   Useful commands in `Makefile`: `make docker-up`, `make docker-down`.
+-   Useful commands in `Makefile`: `just docker-up`, `just docker-down`.
 
 ## 12. Observability
 
@@ -872,17 +872,17 @@ internal/graphql/
 
 ```bash
 # 1. Add GraphQL to project
-make graphql-init
+just graphql-init
 
 # 2. Define schemas per module in internal/graphql/schema/
 
 # 3. Generate code
-make graphql-generate-all
+just graphql-generate-all
 
 # 4. Implement resolvers in internal/graphql/resolver/
 
 # 5. Validate
-make graphql-validate
+just graphql-validate
 ```
 
 **Endpoints:**
@@ -1044,17 +1044,17 @@ The system:
 
 ```bash
 # Run all migrations for all modules
-make migrate-up  # or simply: make migrate
+just migrate-up  # or simply: just migrate
 
 # Revert last migration for a specific module
-make migrate-down MODULE_NAME=users
+just migrate-down MODULE_NAME=users
 
 # Create a new migration for a module
-make migrate-create MODULE_NAME=users NAME=add_profile_fields
+just migrate-create MODULE_NAME=users NAME=add_profile_fields
 
 # Delete all tables and re-run migrations
-make db-down    # Only deletes tables
-make db-reset   # Deletes and re-runs (db-down + migrate-up)
+just db-down    # Only deletes tables
+just db-reset   # Deletes and re-runs (db-down + migrate-up)
 ```
 
 #### Manual Migration Execution Only
@@ -1063,7 +1063,7 @@ make db-reset   # Deletes and re-runs (db-down + migrate-up)
 # Run only migrations without starting server
 go run cmd/server/main.go -migrate
 # or
-make migrate
+just migrate
 ```
 
 #### Benefits
@@ -1094,7 +1094,7 @@ Seed data can be executed via:
 
 ```bash
 # Run seed data for all modules
-make seed
+just seed
 
 # Or using subcommand
 go run cmd/server/main.go seed
@@ -1107,7 +1107,7 @@ The system:
 3. Each module manages its own seed data
 4. Seed data is typically used for development and testing
 
-**Note:** Seed data is NOT executed automatically on server startup. It must be run explicitly via `make seed` or the seed subcommand.
+**Note:** Seed data is NOT executed automatically on server startup. It must be run explicitly via `just seed` or the seed subcommand.
 
 ### Phase 3: Repository Layer (Adapter)
 
@@ -1243,13 +1243,13 @@ To facilitate unit testing, we use **gomock** (`go.uber.org/mock`) to generate a
 
 ```bash
 # Install tool
-make install-mocks
+just install-mocks
 
 # Generate all mocks
-make generate-mocks
+just generate-mocks
 
 # Run unit tests (generates mocks automatically)
-make test-unit
+just test-unit
 ```
 
 **Adding mocks to a new interface:**
@@ -1267,7 +1267,7 @@ type MyInterface interface {
 }
 ```
 
-2.  Generate: `make generate-mocks`
+2.  Generate: `just generate-mocks`
 
 3.  Use in tests:
 
@@ -1310,11 +1310,11 @@ See `modules/auth/internal/service/service_mock_test.go` for complete examples o
 
 For a smooth development experience, we use **Air** to automatically recompile code on save:
 
-1.  **Monolith:** `make dev`
-2.  **Any Module:** `make dev-module {name}` (e.g. `make dev-module auth`)
+1.  **Monolith:** `just dev`
+2.  **Any Module:** `just dev-module {name}` (e.g. `just dev-module auth`)
 
 > [!TIP]
-> Air watches for changes in `.go`, `.yaml`, `.yml`, `.proto`, `.sql`, `.env` files and specific configuration files, restarting the binary instantly. The module generator (`make new-module`) automatically creates the necessary `.air.{module}.toml` file.
+> Air watches for changes in `.go`, `.yaml`, `.yml`, `.proto`, `.sql`, `.env` files and specific configuration files, restarting the binary instantly. The module generator (`just new-module`) automatically creates the necessary `.air.{module}.toml` file.
 
 ### Generic Build Commands
 
@@ -1322,17 +1322,17 @@ The project provides wildcard commands to work with any module:
 
 ```bash
 # Build
-make build-module auth      # Generates bin/auth
-make build-module payments  # Generates bin/payments
-make build-all              # Compiles server + all modules
+just build-module auth      # Generates bin/auth
+just build-module payments  # Generates bin/payments
+just build-all              # Compiles server + all modules
 
 # Docker
-make docker-build-module auth      # Generates modulith-auth:latest
-make docker-build-module payments  # Generates modulith-payments:latest
+just docker-build-module auth      # Generates modulith-auth:latest
+just docker-build-module payments  # Generates modulith-payments:latest
 
 # Development with Hot Reload
-make dev-module auth      # Runs auth with hot reload
-make dev-module payments  # Runs payments with hot reload
+just dev-module auth      # Runs auth with hot reload
+just dev-module payments  # Runs payments with hot reload
 ```
 
 > [!NOTE]
@@ -1499,7 +1499,7 @@ These examples demonstrate best practices for:
 
 To accelerate the start of new modules and ensure they follow defined standards, we have a robust scaffolding tool.
 
--   **Command:** `make new-module {name}` (e.g. `make new-module payments`)
+-   **Command:** `just new-module {name}` (e.g. `just new-module payments`)
 -   **Automation:**
     -   Generates standard folder structure.
     -   Creates boilerplate files (`module.go`, `service.go`, `repository.go`, `proto`).
@@ -1537,22 +1537,22 @@ To accelerate the start of new modules and ensure they follow defined standards,
 
 ```bash
 # Generate code
-make proto  # Generates gRPC code
-make sqlc   # Generates DB code
+just proto  # Generates gRPC code
+just sqlc   # Generates DB code
 
 # Build
-make build-module payments
+just build-module payments
 
 # Docker
-make docker-build-module payments
+just docker-build-module payments
 
 # Development
-make dev-module payments
+just dev-module payments
 ```
 
 ### Quick Start: Creating Your First Module
 
-Once the module is generated with `make new-module orders`, implement the business logic:
+Once the module is generated with `just new-module orders`, implement the business logic:
 
 ```go
 // modules/orders/internal/service/service.go
@@ -1649,7 +1649,7 @@ func GetUser(ctx context.Context, id string) (*store.User, error)
 func GetMagicCode(ctx context.Context, code string) (*store.MagicCode, error)
 ```
 
-After running `make sqlc`, check `modules/<mod>/internal/db/store/models.go` to see the exact generated type names.
+After running `just sqlc`, check `modules/<mod>/internal/db/store/models.go` to see the exact generated type names.
 
 **Transaction Handling:**
 
@@ -1762,14 +1762,14 @@ After generating a module, verify it compiles:
 
 ```bash
 # Generate code
-make proto
-make sqlc
+just proto
+just sqlc
 
 # Build the module
 go build ./modules/<module-name>/...
 
 # Or build the entire project
-make build
+just build
 ```
 
 #### Common Issues and Solutions
@@ -1821,12 +1821,12 @@ When extending generated modules:
 
 3. **Add SQL Queries:**
    - Place in `modules/<name>/internal/db/query/<name>.sql`
-   - Run `make sqlc` to generate code
+   - Run `just sqlc` to generate code
    - Update repository interface and implementation
 
 4. **Add Proto Methods:**
    - Edit `proto/<name>/v1/<name>.proto`
-   - Run `make proto` to generate code
+   - Run `just proto` to generate code
    - Implement in service layer
 
 ## 18. Granular Deployment and Configuration (Microservices Path)
@@ -1892,15 +1892,15 @@ We use an optimized `Dockerfile` with two stages that supports dynamic building
 
 ```bash
 # Build monolith server
-make docker-build
+just docker-build
 # Generates: modulith-server:latest
 
 # Build a specific module
-make docker-build-module auth
+just docker-build-module auth
 # Generates: modulith-auth:latest
 
 # Build any module
-make docker-build-module payments
+just docker-build-module payments
 # Generates: modulith-payments:latest
 ```
 
@@ -2015,11 +2015,11 @@ The project includes an advanced coverage reporting system:
 
 ```bash
 # Visual report in terminal with statistics
-make coverage-report
+just coverage-report
 
 # Interactive HTML report
-make test-coverage
-make coverage-html
+just test-coverage
+just coverage-html
 ```
 
 The coverage report shows:
@@ -2050,7 +2050,7 @@ We've adopted a strict set of rules to guarantee consistency:
 
 **Mandatory Process:**
 
-1.  **Run:** `make lint` after ANY modification to `.go` files.
+1.  **Run:** `just lint` after ANY modification to `.go` files.
 2.  **Iterate:** Fix all errors until reaching **0 issues**.
 3.  **Appropriate Fixes:**
     -   `errcheck`: Add error handling or explicitly assign to `_` if the error should be intentionally ignored.
@@ -2415,7 +2415,7 @@ Administrative task system for maintenance and cleanup operations.
 
 ```bash
 # Run an administrative task
-make admin TASK=cleanup-sessions
+just admin TASK=cleanup-sessions
 
 # Or directly with the binary
 ./bin/server admin cleanup-sessions
diff --git a/docs/OAUTH_INTEGRATION.md b/docs/OAUTH_INTEGRATION.md
index 38ddc33..f5a8518 100644
--- a/docs/OAUTH_INTEGRATION.md
+++ b/docs/OAUTH_INTEGRATION.md
@@ -349,7 +349,7 @@ If you're adding OAuth to an existing installation:
 
 1. Run migrations:
    ```bash
-   make migrate-up
+   just migrate-up
    ```
 
 2. Configure environment variables
diff --git a/docs/STOCK_ORDER_EXAMPLE.md b/docs/STOCK_ORDER_EXAMPLE.md
index a7dbc91..b0422ec 100644
--- a/docs/STOCK_ORDER_EXAMPLE.md
+++ b/docs/STOCK_ORDER_EXAMPLE.md
@@ -39,7 +39,7 @@ We'll build:
 ### Step 1: Scaffold the Stock Module
 
 ```bash
-make new-module stock
+just new-module stock
 ```
 
 This creates:
@@ -270,10 +270,10 @@ SELECT COUNT(*) FROM products;
 
 ```bash
 # Generate gRPC code from proto
-make proto
+just proto
 
 # Generate SQL code from queries
-make sqlc
+just sqlc
 ```
 
 ### Step 6: Implement Stock Repository
@@ -699,7 +699,7 @@ func (s *StockService) ListProducts(ctx context.Context, req *stockv1.ListProduc
 ### Step 8: Scaffold the Order Module
 
 ```bash
-make new-module order
+just new-module order
 ```
 
 ### Step 9: Define Order Module Proto Contract
@@ -899,7 +899,7 @@ SELECT COUNT(*) FROM orders WHERE user_id = $1;
 ### Step 12: Generate Code Again
 
 ```bash
-make generate-all
+just generate-all
 ```
 
 ### Step 13: Implement Order Repository
@@ -1190,13 +1190,13 @@ func RegisterModules(reg *registry.Registry) {
 
 ```bash
 # Start database
-make docker-up-minimal
+just docker-up-minimal
 
 # Run migrations
-make migrate-up
+just migrate-up
 
 # Start server
-make dev
+just dev
 ```
 
 ### Step 18: Test the System
@@ -1315,7 +1315,7 @@ curl -X POST http://localhost:8080/v1/orders \
 ### Module not found
 
 -   Ensure modules are registered in `cmd/server/setup/registry.go`
--   Run `make generate-all` after proto changes
+-   Run `just generate-all` after proto changes
 
 ### gRPC connection errors
 
diff --git a/docs/TESTING_GUIDE.md b/docs/TESTING_GUIDE.md
index 63a4d6e..55501b9 100644
--- a/docs/TESTING_GUIDE.md
+++ b/docs/TESTING_GUIDE.md
@@ -128,7 +128,7 @@ SQLC generates types using the pattern `{Schema}{TableName}`:
 - `auth.magic_codes` → `store.AuthMagicCode`
 - `auth.sessions` → `store.AuthSession`
 
-Always check `modules/<mod>/internal/db/store/models.go` after running `make sqlc` to see the exact generated type names.
+Always check `modules/<mod>/internal/db/store/models.go` after running `just sqlc` to see the exact generated type names.
 
 ## Integration Testing
 
@@ -632,8 +632,8 @@ func TestCrossModuleGRPC(t *testing.T) {
 ### Run All Tests
 
 ```bash
-make test-unit    # Unit tests only
-make test         # All tests
+just test-unit    # Unit tests only
+just test         # All tests
 go test ./...     # All tests (alternative)
 ```
 
diff --git a/docs/standards/CONTRIBUTING.md b/docs/standards/CONTRIBUTING.md
new file mode 100644
index 0000000..17a9815
--- /dev/null
+++ b/docs/standards/CONTRIBUTING.md
@@ -0,0 +1,171 @@
+# Contributing to Go Modulith Template
+
+Thank you for your interest in contributing! This document provides guidelines for contributing to the project.
+
+## 🚀 Quick Start
+
+1. **Fork the repository**
+2. **Clone your fork**:
+   ```bash
+   git clone https://github.com/LoopContext/go-modulith-template.git
+   cd go-modulith-template
+   ```
+
+3. **Install dependencies**:
+   ```bash
+   just install-deps
+   ```
+
+4. **Start infrastructure**:
+   ```bash
+   just docker-up
+   ```
+
+5. **Run tests**:
+   ```bash
+   just test
+   just lint
+   ```
+
+## 📋 Contribution Process
+
+### 1. Create a branch for your feature
+
+```bash
+git checkout -b feature/descriptive-name
+```
+
+### 2. Make your changes
+
+Ensure you follow the project conventions:
+
+- **Go Code**: Follow [Go Code Review Comments](https://go.dev/wiki/CodeReviewComments)
+- **Commits**: Use descriptive commit messages
+- **Tests**: Add tests for new functionality
+- **Documentation**: Update relevant documentation
+
+### 3. Run validations
+
+**MANDATORY before committing:**
+
+```bash
+# Linter (must pass with 0 errors)
+just lint
+just fe-lint
+
+# Tests
+just test
+just fe-test
+```
+
+### 4. Commit and Push
+
+```bash
+git add .
+git commit -m "feat: brief description of change"
+git push origin feature/descriptive-name
+```
+
+### 5. Create a Pull Request
+
+- Use a descriptive title
+- Explain what changes and why
+- Reference related issues (if applicable)
+- Ensure CI passes
+
+## 🔍 Style Guidelines
+
+### Go Code
+
+- **Linting**: The project uses `golangci-lint` with strict configuration
+- **Formatting**: All code must pass `gofmt` and `goimports`
+- **Naming**: Follow standard Go conventions
+- **Errors**: Always wrap errors with context using `fmt.Errorf("context: %w", err)`
+
+### Tests
+
+- **Unit tests**: For business logic (use `gomock` mocks)
+- **Integration tests**: For DB operations (with `-short` flag)
+- **Minimum coverage**: Aim for >60% on new code
+
+### Documentation
+
+- **README**: Update if you add visible features
+- **Code**: Document public functions/types with GoDoc
+- **Docs**: Update documents in `/docs/` if relevant
+
+## 📝 Commit Types
+
+Use semantic prefixes:
+
+- `feat:` - New feature
+- `fix:` - Bug fix
+- `docs:` - Documentation changes
+- `refactor:` - Refactoring without behavior change
+- `test:` - Add or modify tests
+- `chore:` - Build, deps, etc. changes
+
+### Updating CHANGELOG.md
+
+When adding features, fixes, or important changes, update `CHANGELOG.md`:
+
+1. Add your change in the appropriate `[Unreleased]` section
+2. Use categories: Added, Changed, Deprecated, Removed, Fixed, Security
+3. Follow the existing format
+4. Changes will be moved to a specific version in the next release
+
+## 🐛 Reporting Bugs
+
+When reporting a bug, include:
+
+1. **Description**: What you expected vs what happened
+2. **Steps to reproduce**
+3. **Go version**: `go version`
+4. **Relevant logs**: If applicable
+
+## 💡 Proposing Features
+
+To propose new functionality:
+
+1. **Open an issue** first to discuss it
+2. Explain the use case
+3. Consider the architectural impact
+4. Wait for feedback before implementing
+
+## ⚠️ Important Considerations
+
+### Do Not Modify Without Justification
+
+- `.golangci.yaml` - Do not relax linting rules
+- `sqlc.yaml` - Only change for new modules
+- `buf.yaml` - Standard protobuf configuration
+
+### Architecture
+
+This is a **modulith** template:
+- Maintain isolation between modules
+- Use events for cross-module communication
+- Follow the registry pattern for DI
+- For distributed consistency (reliable events and multi-step compensation), use the [Saga & Outbox pattern](../architecture/SAGA_AND_OUTBOX_ARCHITECTURE.md)
+- Document important architectural decisions
+
+### Performance
+
+- Don't optimize prematurely
+- If you add performance-critical code, include benchmarks
+- Use `go test -bench=.` to validate
+
+## 🤝 Code of Conduct
+
+- Be respectful and constructive
+- Accept feedback with an open mind
+- Focus on the code, not the people
+- Help other contributors when you can
+
+## 📧 Contact
+
+If you have questions, open an issue or discussion on GitHub.
+
+---
+
+Thank you for contributing! 🚀
diff --git a/docs/MAKE_COMMANDS_REFERENCE.md b/docs/standards/JUST_COMMANDS_REFERENCE.md
similarity index 54%
rename from docs/MAKE_COMMANDS_REFERENCE.md
rename to docs/standards/JUST_COMMANDS_REFERENCE.md
index 7c58f38..f79b26e 100644
--- a/docs/MAKE_COMMANDS_REFERENCE.md
+++ b/docs/standards/JUST_COMMANDS_REFERENCE.md
@@ -1,6 +1,6 @@
-# Make Commands Reference
+# Just Commands Reference
 
-Complete reference of all available `make` commands for the Go Modulith Template.
+Complete reference of all available `just` commands for the Go Modulith Template.
 
 ## 📋 Quick Navigation
 
@@ -12,6 +12,7 @@ Complete reference of all available `make` commands for the Go Modulith Template
 - [Database & Migrations](#database--migrations)
 - [Build & Docker](#build--docker)
 - [Modules](#modules)
+- [Frontend](#frontend)
 - [GraphQL (Optional)](#graphql-optional)
 - [Maintenance](#maintenance)
 
@@ -19,10 +20,10 @@ Complete reference of all available `make` commands for the Go Modulith Template
 
 ## Setup & Installation
 
-### `make help`
+### `just help`
 Show all available commands with descriptions.
 
-### `make install-deps`
+### `just install-deps`
 Install all developer tools:
 - `migrate` (golang-migrate)
 - `sqlc`
@@ -32,13 +33,13 @@ Install all developer tools:
 - `gqlgen`
 - `mockgen`
 
-### `make install-mocks`
+### `just install-mocks`
 Install gomock for test mocking (alias for installing mockgen).
 
-### `make validate-setup`
+### `just validate-setup`
 Validate development environment setup (checks Go version, Docker, tools, ports).
 
-### `make quickstart`
+### `just quickstart`
 **Recommended for first-time setup.** Runs complete setup process:
 1. Validates environment
 2. Installs missing development tools
@@ -46,23 +47,23 @@ Validate development environment setup (checks Go version, Docker, tools, ports)
 4. Runs database migrations
 5. Optionally runs seed data
 
-### `make doctor`
+### `just doctor`
 Run development environment diagnostics (troubleshooting tool).
 
 ---
 
 ## Code Generation
 
-### `make sqlc`
+### `just sqlc`
 Generate type-safe Go code from SQL queries (uses `sqlc generate`).
 
-### `make proto`
+### `just proto`
 Generate gRPC code from Protobuf definitions (uses `buf generate`).
 
-### `make generate-mocks`
+### `just generate-mocks`
 Generate all mocks from interfaces in `./modules/...` (runs `go generate`).
 
-### `make generate-all`
+### `just generate-all`
 Generate all code at once (sqlc + proto + mocks).
 - Runs `sqlc`, `proto`, and `generate-mocks` in sequence
 - Useful before committing or when starting fresh
@@ -71,21 +72,21 @@ Generate all code at once (sqlc + proto + mocks).
 
 ## API Versioning
 
-### `make proto-version-create MODULE_NAME=<name> VERSION=<version>`
+### `just proto-version-create <module> <version>`
 Create a new API version for a module (e.g., v2, v3).
 - Automatically copies the latest version as a starting point
 - Updates package names, REST paths, and Go package options
-- Example: `make proto-version-create MODULE_NAME=auth VERSION=v2`
-- After creation, run `make proto` to generate code
+- Example: `just proto-version-create auth v2`
+- After creation, run `just proto` to generate code
 
-### `make proto-breaking-check [MODULE_NAME=<name>]`
+### `just proto-breaking-check [module]`
 Check for breaking changes and linting issues in proto files.
-- Without MODULE_NAME: checks all modules
-- With MODULE_NAME: checks specific module only
-- Example: `make proto-breaking-check MODULE_NAME=auth`
+- Without argument: checks all modules
+- With argument: checks specific module only
+- Example: `just proto-breaking-check auth`
 - Uses `buf lint` to detect issues
 
-### `make proto-lint`
+### `just proto-lint`
 Lint all proto files using buf.
 - Validates proto syntax and best practices
 - Run before committing proto changes
@@ -94,190 +95,242 @@ Lint all proto files using buf.
 
 ## Development
 
-### `make run`
+### `just run`
 Run the monolith server **without** hot reload (uses `go run`).
 
-### `make dev`
+### `just dev`
 Run the monolith server **with hot reload** (requires Air).
 - Automatically monitors `.go`, `.yaml`, `.env`, `.proto`, `.sql` files
 - Runs pre-flight checks before starting
 
-### `make dev-worker`
+### `just dev-worker`
 Run the worker process with hot reload (requires Air).
 - For background tasks, event consumers, scheduled jobs
 
-### `make dev-module MODULE_NAME=<name>`
+### `just dev-module <module>`
 Run a specific module with hot reload.
 Example:
 ```bash
-make dev-module auth
+just dev-module auth
 ```
 
 ---
 
 ## Testing
 
-### `make test`
+### `just test`
 Run all tests with verbose output, race detection, and coverage.
 
-### `make test-unit`
+### `just test-unit`
 Run unit tests only (short tests, generates mocks first).
 
-### `make test-integration`
+### `just test-integration`
 Run integration tests only (requires Docker, uses testcontainers).
 
-### `make test-all`
+### `just test-all`
 Run all tests (unit + integration).
 
-### `make test-coverage`
+### `just test-flow-e2e`
+Run the full E2E parimutuel flow (setup → positions → resolve/settle).
+
+### `just test-e2e-reschedule`
+Run E2E test for reschedule-refund flow (creator reschedules → all positions refunded).
+
+### `just test-e2e-nowinners`
+Run E2E test for no-winners settlement policies (redistribute + void).
+Tests both scenarios sequentially: redistribute (partial refund minus 5% fee) and void (full refund).
+
+### `just test-coverage`
 Run tests and generate HTML coverage report (opens in browser).
 
-### `make coverage-report`
+### `just coverage-report`
 Generate detailed coverage report (terminal output).
 
-### `make coverage-html`
+### `just coverage-html`
 Generate and open coverage report in browser.
 
 ---
 
 ## Database & Migrations
 
-### `make migrate-up` or `make migrate`
+### `just migrate-up` or `just migrate`
 Run all module migrations (uses modulith's migration system).
 - Automatically discovers migrations from all registered modules
 - Executes in registration order
 
-### `make migrate-down MODULE_NAME=<module_name>`
+### `just migrate-down <module>`
 Rollback last migration for a specific module.
 Example:
 ```bash
-make migrate-down MODULE_NAME=auth
+just migrate-down auth
 ```
 
-### `make migrate-create MODULE_NAME=<module_name> NAME=<migration_name>`
+### `just migrate-create <module> <name>`
 Create a new migration file for a module.
 Example:
 ```bash
-make migrate-create MODULE_NAME=auth NAME=add_users_table
+just migrate-create auth add_users_table
 ```
 
-### `make db-down`
-Drop all database tables (destructive, asks for confirmation).
+### `just db-down`
+Rollback all migrations for all modules (drops all tables).
+- Uses the modulith's migration system to rollback in reverse order of registration
+- Includes a resilient fallback that drops schemas if migrations are inconsistent or dirty
 
-### `make db-reset`
+### `just db-nuke`
+**Guaranteed clean state.** Forcibly drops all module schemas and migration tracking tables.
+- Use this if migrations are severely corrupted or when a total reset is needed
+- Asks for confirmation before proceeding
+
+### `just db-reset`
 Drop database and re-run all migrations (`db-down + migrate-up`).
+- Note: If `db-reset` fails due to extreme inconsistency, use `db-nuke` instead
 
-### `make seed`
+### `just seed`
 Run seed data for all modules.
 
-### `make admin TASK=<task_name>`
+### `just admin <task>`
 Run admin task.
 Example:
 ```bash
-make admin TASK=cleanup_old_sessions
+just admin cleanup_old_sessions
 ```
 
 ---
 
 ## Build & Docker
 
-### `make build`
+### `just build`
 Build the monolith binary (output: `bin/server`).
 
-### `make build-worker`
+### `just build-worker`
 Build the worker binary (output: `bin/worker`).
 
-### `make build-module MODULE_NAME=<name>`
+### `just build-module <module>`
 Build a specific module binary.
 Example:
 ```bash
-make build-module auth
+just build-module auth
 ```
 
-### `make build-all`
+### `just build-all`
 Build all binaries (server + worker + all modules).
 
-### `make clean`
+### `just clean`
 Clean build artifacts (removes `bin/` directory).
 
-### `make docker-up`
+### `just docker-up`
 Start all Docker Compose services:
 - PostgreSQL (database)
-- Redis (cache/sessions)
-- Jaeger (tracing UI: http://localhost:16686)
-- Prometheus (metrics: http://localhost:9090)
-- Grafana (dashboards: http://localhost:3000)
+- Valkey (cache/sessions)
+- Jaeger (tracing)
+- Prometheus/Grafana (metrics)
+
+**`just docker-up-minimal`**
 
-### `make docker-up-minimal`
-Start minimal Docker services (PostgreSQL + Redis only).
+Start minimal Docker services (PostgreSQL + Valkey only).
 
-### `make docker-down`
+### `just docker-down`
 Stop all Docker Compose services.
 
-### `make docker-build`
+### `just docker-build`
 Build Docker image for server (`modulith-server:latest`).
 
-### `make docker-build-module MODULE_NAME=<name>`
+### `just docker-build-module <module>`
 Build Docker image for a specific module.
 Example:
 ```bash
-make docker-build-module auth
+just docker-build-module auth
 ```
 
 ---
 
 ## Modules
 
-### `make new-module MODULE_NAME=<name>`
+### `just new-module <name>`
 Scaffold a new module with all boilerplate.
 Example:
 ```bash
-make new-module orders
+just new-module orders
 ```
 
 ---
 
+## Frontend
+
+### `just fe-install`
+Install dependencies for all web projects (`web/app` and `web/admin`).
+
+### `just fe-dev`
+Run development servers for all web projects in parallel.
+
+### `just fe-build`
+Build all web projects for production.
+
+### `just fe-lint`
+Lint all web projects, including the import alias guard.
+
+### `just fe-lint-fix`
+Fix linting issues in all web projects, including the import alias guard.
+
+### `just fe-imports-check`
+Verify that frontend imports use aliases (`@/*`) instead of deep relative paths (`../../../`).
+- Used in PR/CI workflows to prevent alias regressions.
+- If it fails, run `just fe-imports-fix`, review changes, then rerun `just fe-imports-check`.
+
+### `just fe-imports-fix`
+Automatically convert deep relative imports to `@/*` aliases.
+- Safe to run locally before lint/test when touching frontend files.
+
+### `just fe-test`
+Run all frontend tests, including the alias guard unit tests.
+
+### `just fe-guard-test`
+Run the unit tests for the frontend import alias guard script.
+
+---
+
 ## GraphQL (Optional)
 
-### `make graphql-add` or `make graphql-init`
+### `just graphql-add` or `just graphql-init`
 Add optional GraphQL support using gqlgen (automatically generates code).
 
-### `make graphql-generate` or `make graphql-generate-all`
+### `just graphql-generate` or `just graphql-generate-all`
 Generate GraphQL code for all modules (auto-discovers modules with schemas).
 
-### `make graphql-generate-module MODULE_NAME=<name>`
+### `just graphql-generate-module <module>`
 Generate GraphQL code for a specific module.
 Example:
 ```bash
-make graphql-generate-module auth
+just graphql-generate-module auth
 ```
 
-### `make graphql-from-proto`
+### `just graphql-from-proto`
 Generate GraphQL schemas from OpenAPI/Swagger files for all modules.
 
-### `make graphql-validate`
+### `just graphql-validate`
 Validate GraphQL schema.
 
 ---
 
 ## Maintenance
 
-### `make lint`
+### `just lint`
 Run golangci-lint to check code quality.
 
-### `make format`
+### `just format`
 Format code with `gofmt` (and `goimports` if available).
 - Uses built-in `gofmt` for code formatting
 - Uses `goimports` if installed (also formats imports)
 - Provides helpful tip if `goimports` is not installed
 
-### `make tidy`
+### `just tidy`
 Tidy Go module dependencies (runs `go mod tidy`).
 - Removes unused dependencies
 - Adds missing dependencies
 - Updates `go.sum` file
 
-### `make pre-commit`
+### `just pre-commit`
 Run pre-commit checks (format + lint + test-unit).
 - Formats code
 - Runs linter
@@ -290,65 +343,70 @@ Run pre-commit checks (format + lint + test-unit).
 
 ### First-Time Setup
 ```bash
-make quickstart
+just quickstart
 ```
 
 ### Daily Development
 ```bash
 # Start infrastructure
-make docker-up-minimal
+just docker-up-minimal
 
 # Run migrations (if needed)
-make migrate-up
+just migrate-up
 
 # Start dev server with hot reload
-make dev
+just dev
 ```
 
 ### Before Committing
 ```bash
 # Generate all code
-make generate-all
+just generate-all
 
 # Run pre-commit checks (format + lint + test-unit)
-make pre-commit
+just pre-commit
+
+# Frontend alias guard (when touching web/app or web/admin)
+just fe-imports-check
+# Auto-fix if needed
+just fe-imports-fix
 
 # Or run individual checks
-make format
-make lint
-make test-unit
+just format
+just lint
+just test-unit
 ```
 
 ### Adding a New Module
 ```bash
 # Scaffold module
-make new-module orders
+just new-module orders
 
 # Create migration
-make migrate-create MODULE_NAME=orders NAME=create_orders_table
+just migrate-create MODULE_NAME=orders NAME=create_orders_table
 
 # Generate code (after adding SQL/proto)
-make sqlc proto
+just sqlc proto
 
 # Run migrations
-make migrate-up
+just migrate-up
 ```
 
 ### Building for Production
 ```bash
 # Build all binaries
-make build-all
+just build-all
 
 # Or build Docker images
-make docker-build
-make docker-build-module MODULE_NAME=auth
+just docker-build
+just docker-build-module MODULE_NAME=auth
 ```
 
 ---
 
 ## 📝 Notes
 
-- Most commands support the `help` target: `make help`
+- Most commands support the `help` target: `just help`
 - Docker commands require Docker and Docker Compose
 - Development commands (`dev`, `dev-worker`, `dev-module`) require Air to be installed
 - Migration commands require database connection (configured via `.env` or `configs/server.yaml`)
@@ -360,6 +418,6 @@ make docker-build-module MODULE_NAME=auth
 
 The following commands could be added for even better developer experience:
 
-1. **`make update-deps`**: Update Go dependencies (with confirmation)
-2. **`make vendor`**: Vendor dependencies (`go mod vendor`)
+1. **`just update-deps`**: Update Go dependencies (with confirmation)
+2. **`just vendor`**: Vendor dependencies (`go mod vendor`)
 
diff --git a/docs/standards/LOGGING_STANDARDS.md b/docs/standards/LOGGING_STANDARDS.md
new file mode 100644
index 0000000..fdd9623
--- /dev/null
+++ b/docs/standards/LOGGING_STANDARDS.md
@@ -0,0 +1,478 @@
+# Logging Standards
+
+This document defines logging standards and best practices for the modulith template.
+
+## Table of Contents
+
+1. [Overview](#overview)
+2. [Log Levels](#log-levels)
+3. [Structured Logging](#structured-logging)
+4. [Log Format](#log-format)
+5. [Context Fields](#context-fields)
+6. [Best Practices](#best-practices)
+7. [Examples](#examples)
+
+## Overview
+
+The modulith template uses structured logging with `slog` (Go's structured logging package). All logs are JSON-formatted in production for easy parsing and analysis.
+
+## Log Levels
+
+Use the following log levels consistently:
+
+### DEBUG
+Use for detailed information that is only useful for debugging.
+
+```go
+slog.Debug("processing request", "user_id", userID, "request_id", requestID)
+```
+
+**When to use:**
+- Function entry/exit points (in debug mode)
+- Detailed state information
+- Development-only information
+
+### INFO
+Use for informational messages about normal application flow.
+
+```go
+slog.Info("user logged in", "user_id", userID, "method", "email")
+```
+
+**When to use:**
+- Successful operations
+- Important state changes
+- Business events
+- Startup/shutdown messages
+
+### WARN
+Use for warning conditions that don't stop execution but should be noticed.
+
+```go
+slog.Warn("retry attempt failed", "attempt", attempt, "error", err)
+```
+
+**When to use:**
+- Recoverable errors
+- Deprecated feature usage
+- Performance degradation
+- Unusual but valid conditions
+
+### ERROR
+Use for error conditions that require attention but don't stop execution.
+
+```go
+slog.Error("failed to process request", "error", err, "request_id", requestID)
+```
+
+**When to use:**
+- Failed operations
+- External service failures
+- Database errors
+- Configuration issues
+
+## Structured Logging
+
+Always use structured logging with key-value pairs:
+
+```go
+// Good: Structured logging
+slog.Info("user created",
+    "user_id", userID,
+    "email", email,
+    "method", "oauth",
+)
+
+// Bad: String concatenation
+slog.Info(fmt.Sprintf("user created: %s, email: %s", userID, email))
+```
+
+### Benefits
+
+- **Searchable**: Easy to search/filter by field
+- **Parseable**: JSON format can be parsed by log aggregation tools
+- **Queryable**: Can create dashboards and alerts based on fields
+- **Structured**: Consistent format across all logs
+
+## Log Format
+
+### Development
+In development, logs use human-readable text format:
+
+```
+2024-01-15T10:30:45.123Z INFO user created user_id=user-123 email=test@example.com method=oauth
+```
+
+### Production
+In production, logs use JSON format:
+
+```json
+{
+  "time": "2024-01-15T10:30:45.123Z",
+  "level": "INFO",
+  "msg": "user created",
+  "user_id": "user-123",
+  "email": "test@example.com",
+  "method": "oauth"
+}
+```
+
+## Context Fields
+
+Always include relevant context fields in logs:
+
+### Request Context
+
+```go
+slog.Info("request processed",
+    "request_id", requestID,
+    "user_id", userID,
+    "method", r.Method,
+    "path", r.URL.Path,
+    "status_code", statusCode,
+    "duration_ms", duration.Milliseconds(),
+)
+```
+
+### Error Context
+
+```go
+slog.Error("operation failed",
+    "error", err,
+    "operation", "create_user",
+    "user_id", userID,
+    "attempt", attempt,
+)
+```
+
+### Module Context
+
+```go
+slog.Info("module operation",
+    "module", "auth",
+    "operation", "login",
+    "user_id", userID,
+)
+```
+
+### Database Context
+
+```go
+slog.Debug("database query",
+    "query", "SELECT * FROM users",
+    "duration_ms", duration.Milliseconds(),
+    "rows_affected", rowsAffected,
+)
+```
+
+### Event Context
+
+```go
+slog.Info("event published",
+    "event_name", "user.created",
+    "event_id", eventID,
+    "user_id", userID,
+)
+```
+
+## Best Practices
+
+### 1. Use Appropriate Log Levels
+
+- **DEBUG**: Development/debugging only
+- **INFO**: Normal operations, business events
+- **WARN**: Recoverable issues, performance warnings
+- **ERROR**: Failures that need attention
+
+### 2. Include Context
+
+Always include relevant context fields:
+
+```go
+// Good: Includes context
+slog.Error("failed to create user",
+    "error", err,
+    "user_id", userID,
+    "email", email,
+    "operation", "create_user",
+)
+
+// Bad: Missing context
+slog.Error("failed to create user", "error", err)
+```
+
+### 3. Don't Log Sensitive Information
+
+Never log:
+- Passwords or password hashes
+- API keys or secrets
+- Credit card numbers
+- Personal identification numbers (SSN, etc.)
+- Authentication tokens (except for debugging)
+
+#### Automated Log Scrubbing
+
+The system includes a built-in middleware (`internal/middleware/logging.go`) that automatically redacts sensitive fields from URL query parameters. The following keys are automatically replaced with `[REDACTED]`:
+- `password`, `token`, `access_token`, `refresh_token`
+- `auth`, `authorization`, `secret`, `key`
+- `apikey`, `api_key`, `session`, `sessionid`
+
+```go
+// Example: A request to /v1/auth?token=xyz will be logged as:
+// query="token=[REDACTED]"
+```
+
+```go
+// Bad: Logging sensitive information
+slog.Info("user login", "password", password, "api_key", apiKey)
+
+// Good: Logging safe information
+slog.Info("user login", "user_id", userID, "method", "password")
+```
+
+### 4. Use Consistent Field Names
+
+Use consistent field names across the application:
+
+- `user_id`: User identifier
+- `request_id`: Request identifier (from context)
+- `error`: Error object
+- `duration_ms`: Duration in milliseconds
+- `module`: Module name
+- `operation`: Operation name
+- `event_name`: Event name
+- `event_id`: Event identifier
+
+### 5. Log Errors with Context
+
+Always log errors with sufficient context:
+
+```go
+// Good: Error with context
+if err := repo.CreateUser(ctx, user); err != nil {
+    slog.Error("failed to create user",
+        "error", err,
+        "user_id", user.ID,
+        "email", user.Email,
+        "operation", "create_user",
+    )
+    return fmt.Errorf("create user: %w", err)
+}
+
+// Bad: Error without context
+if err := repo.CreateUser(ctx, user); err != nil {
+    slog.Error("failed to create user", "error", err)
+    return err
+}
+```
+
+### 6. Use Request ID from Context
+
+Extract request ID from context for correlation:
+
+```go
+requestID := middleware.RequestIDFromContext(ctx)
+slog.Info("processing request",
+    "request_id", requestID,
+    "user_id", userID,
+)
+```
+
+### 7. Log at Appropriate Granularity
+
+- **Too verbose**: Logging every function call
+- **Too sparse**: Only logging errors
+- **Just right**: Logging important operations, state changes, and errors
+
+### 8. Use Structured Fields for Metrics
+
+Include fields that can be used for metrics:
+
+```go
+slog.Info("request completed",
+    "request_id", requestID,
+    "status_code", statusCode,
+    "duration_ms", duration.Milliseconds(),
+    "method", method,
+    "path", path,
+)
+```
+
+### 9. Don't Log in Hot Paths
+
+Avoid logging in hot paths (frequently called code) unless necessary:
+
+```go
+// Bad: Logging in hot path
+func (s *Service) ProcessItem(item Item) error {
+    slog.Debug("processing item", "item_id", item.ID) // Called millions of times
+    // ... process item
+}
+
+// Good: Logging only when needed
+func (s *Service) ProcessItem(item Item) error {
+    // ... process item
+    if item.Important {
+        slog.Info("processed important item", "item_id", item.ID)
+    }
+}
+```
+
+### 10. Use Context for Scoped Logging
+
+Use context to carry request-scoped information:
+
+```go
+// Add to context
+ctx = context.WithValue(ctx, "user_id", userID)
+ctx = context.WithValue(ctx, "request_id", requestID)
+
+// Use from context
+userID := ctx.Value("user_id")
+slog.Info("operation", "user_id", userID)
+```
+
+## Examples
+
+### Service Layer
+
+```go
+func (s *AuthService) RequestLogin(ctx context.Context, req *authv1.RequestLoginRequest) (*authv1.RequestLoginResponse, error) {
+    requestID := middleware.RequestIDFromContext(ctx)
+
+    slog.Info("login request received",
+        "request_id", requestID,
+        "email", req.Email,
+        "method", "magic_link",
+    )
+
+    code, err := s.repo.CreateMagicCode(ctx, req.Email)
+    if err != nil {
+        slog.Error("failed to create magic code",
+            "error", err,
+            "request_id", requestID,
+            "email", req.Email,
+        )
+        return nil, fmt.Errorf("create magic code: %w", err)
+    }
+
+    slog.Info("magic code created",
+        "request_id", requestID,
+        "email", req.Email,
+    )
+
+    return &authv1.RequestLoginResponse{CodeSent: true}, nil
+}
+```
+
+### Repository Layer
+
+```go
+func (r *Repository) CreateUser(ctx context.Context, user *User) error {
+    start := time.Now()
+
+    err := r.q.CreateUser(ctx, userParams)
+    if err != nil {
+        slog.Error("database error",
+            "error", err,
+            "operation", "create_user",
+            "user_id", user.ID,
+            "duration_ms", time.Since(start).Milliseconds(),
+        )
+        return fmt.Errorf("create user: %w", err)
+    }
+
+    slog.Debug("user created",
+        "user_id", user.ID,
+        "email", user.Email,
+        "duration_ms", time.Since(start).Milliseconds(),
+    )
+
+    return nil
+}
+```
+
+### Event Handlers
+
+```go
+func (h *UserEventHandler) HandleUserCreated(ctx context.Context, event events.Event) error {
+    eventID := event.Metadata["event_id"]
+    userID := event.Payload.(map[string]interface{})["user_id"]
+
+    slog.Info("handling user created event",
+        "event_id", eventID,
+        "event_name", "user.created",
+        "user_id", userID,
+    )
+
+    // Process event
+    if err := h.processUserCreated(ctx, userID); err != nil {
+        slog.Error("failed to handle user created event",
+            "error", err,
+            "event_id", eventID,
+            "user_id", userID,
+        )
+        return fmt.Errorf("handle user created: %w", err)
+    }
+
+    slog.Info("user created event handled",
+        "event_id", eventID,
+        "user_id", userID,
+    )
+
+    return nil
+}
+```
+
+### Middleware
+
+```go
+func LoggingMiddleware(next http.Handler) http.Handler {
+    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+        start := time.Now()
+        requestID := middleware.RequestIDFromContext(r.Context())
+
+        // Log request
+        slog.Info("request started",
+            "request_id", requestID,
+            "method", r.Method,
+            "path", r.URL.Path,
+            "remote_addr", r.RemoteAddr,
+        )
+
+        // Process request
+        next.ServeHTTP(w, r)
+
+        // Log response
+        duration := time.Since(start)
+        statusCode := getStatusCode(w)
+
+        slog.Info("request completed",
+            "request_id", requestID,
+            "method", r.Method,
+            "path", r.URL.Path,
+            "status_code", statusCode,
+            "duration_ms", duration.Milliseconds(),
+        )
+    })
+}
+```
+
+## Summary
+
+- Use structured logging with key-value pairs
+- Use appropriate log levels (DEBUG, INFO, WARN, ERROR)
+- Include relevant context fields
+- Don't log sensitive information
+- Use consistent field names
+- Log errors with sufficient context
+- Extract request ID from context for correlation
+- Log at appropriate granularity
+- Use JSON format in production
+- Follow best practices for performance and security
+
+For more information, see:
+- [Go slog documentation](https://pkg.go.dev/log/slog)
+- [Observability Setup Guide](OBSERVABILITY_SETUP.md)
+- [Error Handling Standards](.cursor/rules/60-errors-telemetry.mdc)
+
diff --git a/docs/standards/TESTING_GUIDE.md b/docs/standards/TESTING_GUIDE.md
new file mode 100644
index 0000000..eef2644
--- /dev/null
+++ b/docs/standards/TESTING_GUIDE.md
@@ -0,0 +1,658 @@
+# Testing Guide
+
+This comprehensive guide covers all testing patterns and best practices for the modulith template.
+
+## Table of Contents
+
+1. [Overview](#overview)
+2. [Unit Testing](#unit-testing)
+3. [Integration Testing](#integration-testing)
+4. [Cross-Module gRPC Testing](#cross-module-grpc-testing)
+5. [Event Bus Testing](#event-bus-testing)
+6. [Contract Testing](#contract-testing)
+7. [End-to-End Testing](#end-to-end-testing)
+8. [Testing Best Practices](#testing-best-practices)
+
+## Overview
+
+The modulith template supports multiple testing strategies:
+
+- **Unit Tests**: Test individual components in isolation
+- **Integration Tests**: Test module interactions with database
+- **Cross-Module Tests**: Test gRPC communication between modules
+- **Event-Driven Tests**: Test event publishing and subscription
+- **Contract Tests**: Test API contracts between modules (Pact)
+- **E2E Tests**: Test complete workflows end-to-end
+
+## Unit Testing
+
+### Testing Services
+
+Test service logic with mocked dependencies:
+
+```go
+func TestAuthService_RequestLogin(t *testing.T) {
+    // Create mocks
+    mockRepo := mocks.NewMockRepository(t)
+    mockTokenSvc := mocks.NewMockTokenService(t)
+    eventBus := events.NewBus()
+
+    // Create service
+    svc := service.NewAuthService(mockRepo, mockTokenSvc, eventBus)
+
+    // Setup expectations
+    mockRepo.EXPECT().
+        CreateMagicCode(gomock.Any(), gomock.Any()).
+        Return(nil)
+
+    // Execute
+    ctx := context.Background()
+    resp, err := svc.RequestLogin(ctx, &authv1.RequestLoginRequest{
+        Email: "test@example.com",
+    })
+
+    // Assert
+    require.NoError(t, err)
+    assert.NotNil(t, resp)
+}
+```
+
+### Testing Repositories
+
+Test repository logic with test database:
+
+```go
+func TestRepository_CreateUser(t *testing.T) {
+    ctx := context.Background()
+
+    pgContainer, err := testutil.NewPostgresContainer(ctx, t)
+    require.NoError(t, err)
+    defer pgContainer.Close(ctx)
+
+    db, err := pgContainer.DB(ctx)
+    require.NoError(t, err)
+    defer db.Close()
+
+    // Run migrations
+    // ... setup ...
+
+    repo := repository.NewSQLRepository(db)
+
+    // Test
+    err = repo.CreateUser(ctx, "user-123", "test@example.com", "")
+    require.NoError(t, err)
+}
+```
+
+### Mock Generation
+
+Generate mocks using `gomock`:
+
+```bash
+# Generate mocks for interfaces
+mockgen -source=modules/auth/internal/repository/repository.go \
+        -destination=modules/auth/internal/repository/mocks/repository_mock.go \
+        -package=mocks
+```
+
+See `modules/auth/internal/service/service_mock_test.go` for examples.
+
+### SQLC Type Names in Tests
+
+**Important:** When writing tests that use SQLC-generated types, always use the correct type names with schema prefixes:
+
+```go
+// ✅ Correct - Use schema-prefixed types
+mockRepo.EXPECT().
+    GetUserByEmail(gomock.Any(), email).
+    Return(&store.AuthUser{
+        ID:    "user-123",
+        Email: sql.NullString{String: email, Valid: true},
+    }, nil)
+
+mockRepo.EXPECT().
+    GetValidMagicCodeByEmail(gomock.Any(), email, code).
+    Return(&store.AuthMagicCode{
+        Code:      code,
+        UserEmail: sql.NullString{String: email, Valid: true},
+    }, nil)
+
+// ❌ Wrong - Missing schema prefix
+mockRepo.EXPECT().
+    GetUserByEmail(gomock.Any(), email).
+    Return(&store.User{...}, nil)  // This will cause "undefined: store.User" error
+```
+
+SQLC generates types using the pattern `{Schema}{TableName}`:
+- `auth.users` → `store.AuthUser`
+- `auth.magic_codes` → `store.AuthMagicCode`
+- `auth.sessions` → `store.AuthSession`
+
+Always check `modules/<mod>/internal/db/store/models.go` after running `just sqlc` to see the exact generated type names.
+
+## Integration Testing
+
+### Testing Module Initialization
+
+Test module setup and initialization:
+
+```go
+func TestModule_Initialize(t *testing.T) {
+    ctx := context.Background()
+
+    pgContainer, err := testutil.NewPostgresContainer(ctx, t)
+    require.NoError(t, err)
+    defer pgContainer.Close(ctx)
+
+    db, err := pgContainer.DB(ctx)
+    require.NoError(t, err)
+    defer db.Close()
+
+    cfg := testutil.TestConfig()
+    cfg.DBDSN = pgContainer.DSN
+
+    reg := registry.New(
+        registry.WithConfig(cfg),
+        registry.WithDatabase(db),
+        registry.WithEventBus(events.NewBus()),
+    )
+
+    mod := auth.NewModule()
+    reg.Register(mod)
+
+    err = reg.InitializeAll()
+    require.NoError(t, err)
+}
+```
+
+### Testing with Testcontainers
+
+Use testcontainers for integration tests:
+
+```go
+import "github.com/LoopContext/go-modulith-template/internal/testutil"
+
+func TestWithDatabase(t *testing.T) {
+    ctx := context.Background()
+
+    pgContainer, err := testutil.NewPostgresContainer(ctx, t)
+    require.NoError(t, err)
+    defer pgContainer.Close(ctx)
+
+    db, err := pgContainer.DB(ctx)
+    require.NoError(t, err)
+    defer db.Close()
+
+    // Use database in tests
+}
+```
+
+See `examples/integration_test_example.go` for complete examples.
+
+## Cross-Module gRPC Testing
+
+Test interactions between modules via gRPC using the standardized test harness.
+
+### Standardized Cross-Module Test Pattern
+
+The `testutil.SetupCrossModuleTest` provides a canonical setup that includes:
+- Isolated Postgres container (Testcontainers)
+- Automated migrations for all involved modules
+- Local gRPC server with full interceptor stack (Auth, Validation, i18n, Telemetry)
+- Shared Registry, Event Bus, and Event Collector
+- Helper methods for Authentication and User Registration
+
+#### Recommended Test Structure
+
+```go
+func TestCrossModuleFlow(t *testing.T) {
+    if testing.Short() {
+        t.Skip("Skipping integration test in short mode")
+    }
+
+    ctx := context.Background()
+
+    // 1. Setup the harness with required modules
+    setup, err := testutil.SetupCrossModuleTest(
+        ctx,
+        t,
+        auth.NewModule(),
+        wallet.NewModule(),
+    )
+    require.NoError(t, err)
+
+    // 2. Register a test user (helper calls Auth.Register RPC)
+    user, err := setup.RegisterUser(ctx, "tester@example.com", "Tester")
+    require.NoError(t, err)
+
+    // 3. Create an authenticated context (injects valid JWT)
+    authCtx, token, err := setup.AuthenticatedContext(ctx, user.Id, "user")
+    require.NoError(t, err)
+
+    // 4. Create module clients from the harness
+    authClient := testutil.NewServiceClient(setup, authv1.NewAuthServiceClient)
+    walletClient := testutil.NewServiceClient(setup, walletv1.NewWalletServiceClient)
+
+    // 5. Execute cross-module flow
+    resp, err := walletClient.GetBalances(authCtx, &walletv1.GetBalancesRequest{})
+    require.NoError(t, err)
+    require.NotNil(t, resp)
+}
+```
+
+### Testing Async Event-Driven Interactions
+
+Use the `EventCollector` integrated into the setup to verify async side effects:
+
+```go
+func TestCrossModule_AsyncEvents(t *testing.T) {
+    ctx := context.Background()
+    setup, err := testutil.SetupCrossModuleTest(ctx, t, auth.NewModule())
+    require.NoError(t, err)
+
+    // Subscribe before action
+    setup.SubscribeEvents("auth.user.registered")
+
+    // Action
+    _, err = setup.RegisterUser(ctx, "async@example.com", "Async")
+    require.NoError(t, err)
+
+    // Wait for event with timeout
+    event, err := setup.WaitForEvent("auth.user.registered", 2*time.Second)
+    require.NoError(t, err)
+    assert.Equal(t, "auth.user.registered", event.Name)
+}
+```
+
+See `examples/cross_module_standard_test.go` for the complete reference implementation.
+
+## Event Bus Testing
+
+### Testing Event Publishing
+
+Test event publishing and collection:
+
+```go
+func TestEventPublishing(t *testing.T) {
+    ctx := context.Background()
+
+    eventBus := events.NewBus()
+    eventCollector := testutil.NewEventCollector()
+
+    // Subscribe collector to events
+    eventCollector.Subscribe(eventBus, "user.created")
+
+    // Publish event
+    eventBus.Publish(ctx, events.Event{
+        Name:    "user.created",
+        Payload: map[string]interface{}{
+            "user_id": "user-123",
+            "email":   "test@example.com",
+        },
+    })
+
+    // Wait for event processing
+    time.Sleep(100 * time.Millisecond)
+
+    // Verify event was collected
+    collectedEvents := eventCollector.AllEvents()
+    require.GreaterOrEqual(t, len(collectedEvents), 1)
+
+    found := false
+    for _, event := range collectedEvents {
+        if event.Name == "user.created" {
+            found = true
+            assert.Equal(t, "user-123",
+                event.Payload.(map[string]interface{})["user_id"])
+            break
+        }
+    }
+    assert.True(t, found)
+}
+```
+
+### Testing Event Handlers
+
+Test event handler execution:
+
+```go
+func TestEventHandler(t *testing.T) {
+    ctx := context.Background()
+
+    eventBus := events.NewBus()
+    handlerCalled := make(chan bool, 1)
+
+    eventBus.Subscribe("test.event", func(ctx context.Context, event events.Event) error {
+        handlerCalled <- true
+        return nil
+    })
+
+    eventBus.Publish(ctx, events.Event{
+        Name:    "test.event",
+        Payload: map[string]interface{}{"key": "value"},
+    })
+
+    select {
+    case <-handlerCalled:
+        // Handler executed
+    case <-time.After(1 * time.Second):
+        t.Fatal("Handler did not execute")
+    }
+}
+```
+
+### Testing Event Ordering
+
+Test event sequencing (note: order not guaranteed in async handlers):
+
+```go
+func TestEventOrdering(t *testing.T) {
+    ctx := context.Background()
+
+    eventBus := events.NewBus()
+    eventCollector := testutil.NewEventCollector()
+
+    eventCollector.Subscribe(eventBus, "ordered.event")
+
+    // Publish events in sequence
+    for i := 1; i <= 3; i++ {
+        eventBus.Publish(ctx, events.Event{
+            Name:    "ordered.event",
+            Payload: map[string]interface{}{"sequence": i},
+        })
+    }
+
+    time.Sleep(200 * time.Millisecond)
+
+    // Verify all events were collected
+    collectedEvents := eventCollector.AllEvents()
+    assert.GreaterOrEqual(t, len(collectedEvents), 3)
+}
+```
+
+See `examples/event_driven_workflow_test.go` for complete examples.
+
+## Contract Testing
+
+Contract testing ensures API contracts between modules remain stable.
+
+### Pact Go Setup
+
+Install Pact Go (test-only dependency):
+
+```bash
+go get github.com/pact-foundation/pact-go/v2
+```
+
+### Consumer Contract Test
+
+Define expected interactions from consumer side:
+
+```go
+// examples/contract_testing_consumer_test.go
+func TestAuthService_Contract_Consumer(t *testing.T) {
+    // Setup Pact
+    pact := pactgo.NewPact()
+    defer pact.Cleanup()
+
+    // Define expected interaction
+    pact.
+        AddInteraction().
+        Given("user exists").
+        UponReceiving("a request to login").
+        WithRequest("POST", "/auth.v1.AuthService/RequestLogin").
+        WillRespondWith(200, map[string]interface{}{
+            "code_sent": true,
+        })
+
+    // Test against mock provider
+    // ...
+}
+```
+
+### Provider Contract Verification
+
+Verify provider matches contract:
+
+```go
+// examples/contract_testing_provider_test.go
+func TestAuthService_Contract_Provider(t *testing.T) {
+    // Setup provider (actual service)
+    // ...
+
+    // Verify against Pact broker or file
+    // pact.VerifyProvider(t, providerURL)
+}
+```
+
+See `docs/CONTRACT_TESTING.md` for detailed contract testing guide (to be created).
+
+## End-to-End Testing
+
+Test complete workflows from API to database:
+
+```go
+func TestE2E_UserRegistration(t *testing.T) {
+    if testing.Short() {
+        t.Skip("Skipping E2E test in short mode")
+    }
+
+    ctx := context.Background()
+
+    // Setup complete environment
+    pgContainer, err := testutil.NewPostgresContainer(ctx, t)
+    require.NoError(t, err)
+    defer pgContainer.Close(ctx)
+
+    // Setup registry, modules, gRPC server, HTTP gateway
+    // ...
+
+    // Execute complete workflow
+    // 1. Create user via gRPC
+    // 2. Verify user in database
+    // 3. Verify events were published
+    // 4. Verify notifications were sent
+}
+```
+
+See `examples/full_module_test.go` for complete E2E examples.
+
+### Standalone E2E Scripts
+
+The project also includes standalone E2E scripts in `scripts/e2e/` that run against a live server. These test full user flows via gRPC:
+
+```bash
+just dev                    # Terminal 1: start server
+just test-flow-e2e          # Terminal 2: setup → positions → resolve/settle
+just test-e2e-reschedule    # Reschedule triggers automated refund
+just test-e2e-nowinners     # No-winners settlement (redistribute + void policies)
+```
+
+Each script: logs in as multiple actors (creator, admin, users), creates events, places positions, triggers settlement, and verifies wallet balances.
+
+## Testing Best Practices
+
+### 1. Use Testcontainers for Integration Tests
+
+Always use testcontainers for database tests:
+
+```go
+pgContainer, err := testutil.NewPostgresContainer(ctx, t)
+require.NoError(t, err)
+defer pgContainer.Close(ctx)
+```
+
+### 2. Clean Up Resources
+
+Always clean up test resources:
+
+```go
+defer pgContainer.Close(ctx)
+defer db.Close()
+defer grpcServer.Stop()
+```
+
+### 3. Use Table-Driven Tests
+
+Use table-driven tests for multiple scenarios:
+
+```go
+func TestService_MultipleScenarios(t *testing.T) {
+    tests := []struct {
+        name    string
+        input   string
+        wantErr bool
+    }{
+        {"valid input", "valid@example.com", false},
+        {"invalid email", "invalid", true},
+        {"empty input", "", true},
+    }
+
+    for _, tt := range tests {
+        t.Run(tt.name, func(t *testing.T) {
+            // Test with tt.input
+        })
+    }
+}
+```
+
+### 4. Skip Long Tests in Short Mode
+
+Skip integration/E2E tests in short mode:
+
+```go
+func TestIntegration(t *testing.T) {
+    if testing.Short() {
+        t.Skip("Skipping integration test in short mode")
+    }
+    // ... test code
+}
+```
+
+Run tests:
+```bash
+go test -short ./...  # Skip long tests
+go test ./...          # Run all tests
+```
+
+### 5. Use Context for Timeouts
+
+Use context for timeouts and cancellation:
+
+```go
+ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+defer cancel()
+
+// Use ctx in operations
+```
+
+### 6. Verify Events with Collectors
+
+Use EventCollector to verify events:
+
+```go
+eventCollector := testutil.NewEventCollector()
+eventCollector.Subscribe(eventBus, "user.created")
+
+event, err := eventCollector.WaitForEventByName("user.created", time.Second)
+require.NoError(t, err)
+assert.Equal(t, "user.created", event.Name)
+```
+
+### 7. Test Error Cases
+
+Always test error cases:
+
+```go
+func TestService_ErrorCases(t *testing.T) {
+    // Test with invalid input
+    // Test with missing dependencies
+    // Test with database errors
+    // Test with network errors
+}
+```
+
+### 8. Use Mocks for External Dependencies
+
+Mock external dependencies in unit tests:
+
+```go
+mockRepo := mocks.NewMockRepository(t)
+mockRepo.EXPECT().CreateUser(gomock.Any(), gomock.Any()).Return(errors.New("db error"))
+```
+
+### 9. Test Transaction Rollback
+
+Test transaction rollback scenarios:
+
+```go
+func TestRepository_TransactionRollback(t *testing.T) {
+    // Setup transaction
+    // Perform operations
+    // Force error
+    // Verify rollback occurred
+}
+```
+
+### 10. Document Test Patterns
+
+Add comments explaining test patterns:
+
+```go
+// This test demonstrates cross-module gRPC communication testing.
+// It sets up a full registry with multiple modules and tests
+// interactions between them via gRPC.
+func TestCrossModuleGRPC(t *testing.T) {
+    // ...
+}
+```
+
+## Running Tests
+
+### Run All Tests
+
+```bash
+just test-unit    # Unit tests only
+just test         # All tests
+go test ./...     # All tests (alternative)
+```
+
+### Run Specific Tests
+
+```bash
+go test ./modules/auth/internal/service -v
+go test -run TestAuthService_RequestLogin ./modules/auth/...
+```
+
+### Run Tests with Coverage
+
+```bash
+go test -cover ./...
+go test -coverprofile=coverage.out ./...
+go tool cover -html=coverage.out
+```
+
+### Run Tests in Parallel
+
+```bash
+go test -parallel 4 ./...
+```
+
+## Summary
+
+- Use unit tests for isolated components
+- Use integration tests with testcontainers for database tests
+- Use cross-module tests for gRPC communication
+- Use event collectors for event testing
+- Use contract tests for API stability
+- Always clean up resources
+- Test error cases
+- Use table-driven tests for multiple scenarios
+- Skip long tests in short mode
+
+For examples, see:
+- `examples/module_communication_test.go` - Module communication patterns
+- `examples/cross_module_grpc_test.go` - Cross-module gRPC testing
+- `examples/event_driven_workflow_test.go` - Event-driven testing
+- `examples/full_module_test.go` - Complete E2E examples
+
diff --git a/docs/standards/git-commit-template.md b/docs/standards/git-commit-template.md
new file mode 100644
index 0000000..969f331
--- /dev/null
+++ b/docs/standards/git-commit-template.md
@@ -0,0 +1,17 @@
+<type>(<scope>): <subject>
+
+<!--
+  Header:
+  - <type>: feat, fix, docs, style, refactor, test, chore
+  - <scope>: module or component affected (e.g., auth, kyc, admin)
+  - <subject>: Short summary (max 50 chars), imperative mood (e.g., "add feature" not "added feature")
+-->
+
+<!-- Body: Detailed description of changes. automated tools parse this section. -->
+
+- change 1
+- change 2
+- change 3
+
+<!-- Footer: References to issues or breaking changes -->
+<!-- Closes #123 -->
diff --git a/docs/standards/pr-template.md b/docs/standards/pr-template.md
new file mode 100644
index 0000000..86203e1
--- /dev/null
+++ b/docs/standards/pr-template.md
@@ -0,0 +1,67 @@
+# PR Title
+
+## Summary
+<!-- Provide a brief overview of the changes introduced in this PR. What problem does it solve? -->
+
+## Type of Change
+<!-- Check the relevant option(s) -->
+- [ ] 🚀 New Feature
+- [ ] 🐛 Bug Fix
+- [ ] 🛠️ Refactor
+- [ ] 📚 Documentation
+- [ ] ⚙️ Configuration / DevOps
+
+## Key Changes & Files
+<!-- Break down the changes by feature or logical unit. List the key files modified to guide reviewers. -->
+
+### 1. [Feature/Fix Name]
+- **Description**: <!-- Brief description of what changed here -->
+- **Key Files**:
+    - `path/to/important_file.go`: <!-- Note on specific change in this file -->
+    - `path/to/another_file.go`
+
+### 2. [Feature/Fix Name]
+- **Description**:
+- **Key Files**:
+    - `path/to/file.ts`
+
+## Architecture / Logic Flow
+<!-- If this PR changes workflows, state machines, or architecture, verify it with a Mermaid diagram. -->
+<!-- Example: Sequence Diagram, State Diagram, Flowchart -->
+
+```mermaid
+%% Example Diagram (Replace with your own)
+sequenceDiagram
+    participant U as User
+    participant A as API
+    participant S as Service
+    participant D as DB
+
+    U->>A: Request Action
+    A->>S: Process Action
+    S->>D: Update State
+    D-->>S: Success
+    S-->>A: confirm
+    A-->>U: 200 OK
+```
+
+<!-- Note: Avoid using quotes in Mermaid labels to prevent rendering errors. -->
+
+## Verification
+<!-- How did you verify these changes? -->
+
+### Automated Tests
+- [ ] `just test-unit` passed
+- [ ] `just lint` passed
+- [ ] New tests added (if applicable)
+
+### Manual Verification
+<!-- Describe the steps to manually verify the changes. -->
+1. Step 1...
+2. Step 2...
+
+## Checklist
+- [ ] My code follows the project's style guidelines
+- [ ] I have performed a self-review of my code
+- [ ] I have commented my code, particularly in hard-to-understand areas
+- [ ] I have made corresponding changes to the documentation
diff --git a/examples/cross_module_grpc_test.go b/examples/cross_module_grpc_test.go
index 291d846..4153922 100644
--- a/examples/cross_module_grpc_test.go
+++ b/examples/cross_module_grpc_test.go
@@ -24,7 +24,7 @@ func setupGRPCTestServer(ctx context.Context, t *testing.T) (*testutil.PostgresC
 	pgContainer, err := testutil.NewPostgresContainer(ctx, t)
 	require.NoError(t, err)
 
-	db, err := pgContainer.DB(ctx)
+	db, err := pgContainer.Pool(ctx)
 	require.NoError(t, err)
 
 	cfg := testutil.TestConfig()
@@ -74,13 +74,9 @@ func TestCrossModuleGRPC_ModuleCommunication(t *testing.T) {
 		_ = pgContainer.Close(ctx)
 	}()
 
-	db, err := pgContainer.DB(ctx)
+	db, err := pgContainer.Pool(ctx)
 	require.NoError(t, err)
 
-	defer func() {
-		_ = db.Close()
-	}()
-
 	// Setup registry with modules
 	cfg := testutil.TestConfig()
 	cfg.DBDSN = pgContainer.DSN
@@ -187,13 +183,9 @@ func TestCrossModuleGRPC_ContextPropagation(t *testing.T) {
 		_ = pgContainer.Close(ctx)
 	}()
 
-	db, err := pgContainer.DB(ctx)
+	db, err := pgContainer.Pool(ctx)
 	require.NoError(t, err)
 
-	defer func() {
-		_ = db.Close()
-	}()
-
 	cfg := testutil.TestConfig()
 	cfg.DBDSN = pgContainer.DSN
 
diff --git a/examples/full_module_test.go b/examples/full_module_test.go
index c096630..508a2fe 100644
--- a/examples/full_module_test.go
+++ b/examples/full_module_test.go
@@ -3,7 +3,6 @@ package examples
 
 import (
 	"context"
-	"database/sql"
 	"testing"
 	"time"
 
@@ -12,6 +11,7 @@ import (
 	"github.com/cmelgarejo/go-modulith-template/internal/registry"
 	"github.com/cmelgarejo/go-modulith-template/internal/testutil"
 	"github.com/cmelgarejo/go-modulith-template/modules/auth"
+	"github.com/jackc/pgx/v5/pgxpool"
 )
 
 // TestExampleFullModule demonstrates a complete end-to-end test for a module.
@@ -31,7 +31,7 @@ func TestExampleFullModule(t *testing.T) {
 
 	// Step 1: Set up test database using testcontainers
 	pgContainer, db := setupTestDatabaseFull(ctx, t)
-	defer cleanupTestDatabaseFull(ctx, t, pgContainer, db)
+	defer cleanupTestDatabaseFull(ctx, t, pgContainer)
 
 	// Step 2: Create configuration
 	cfg := testutil.TestConfig()
@@ -82,7 +82,7 @@ func TestExampleFullModule(t *testing.T) {
 	// Step 10: Verify database state
 	// Example: Check that data was persisted
 	// var count int
-	// err = db.QueryRowContext(ctx, "SELECT COUNT(*) FROM users WHERE email = $1", "test@example.com").Scan(&count)
+	// err = db.QueryRow(ctx, "SELECT COUNT(*) FROM users WHERE email = $1", "test@example.com").Scan(&count)
 	// if err != nil {
 	//     t.Fatalf("Failed to query users: %v", err)
 	// }
@@ -106,13 +106,13 @@ func TestExampleFullModule(t *testing.T) {
 	t.Log("Full module integration test complete")
 }
 
-func setupTestDatabaseFull(ctx context.Context, t *testing.T) (*testutil.PostgresContainer, *sql.DB) {
+func setupTestDatabaseFull(ctx context.Context, t *testing.T) (*testutil.PostgresContainer, *pgxpool.Pool) {
 	pgContainer, err := testutil.NewPostgresContainer(ctx, t)
 	if err != nil {
 		t.Fatalf("Failed to create postgres container: %v", err)
 	}
 
-	db, err := pgContainer.DB(ctx)
+	db, err := pgContainer.Pool(ctx)
 	if err != nil {
 		_ = pgContainer.Close(ctx)
 
@@ -122,11 +122,7 @@ func setupTestDatabaseFull(ctx context.Context, t *testing.T) (*testutil.Postgre
 	return pgContainer, db
 }
 
-func cleanupTestDatabaseFull(ctx context.Context, t *testing.T, pgContainer *testutil.PostgresContainer, db *sql.DB) {
-	if err := db.Close(); err != nil {
-		t.Errorf("Failed to close database: %v", err)
-	}
-
+func cleanupTestDatabaseFull(ctx context.Context, t *testing.T, pgContainer *testutil.PostgresContainer) {
 	if err := pgContainer.Close(ctx); err != nil {
 		t.Errorf("Failed to close container: %v", err)
 	}
@@ -143,7 +139,7 @@ func setupEventBusFull() (*events.Bus, *testutil.EventCollector) {
 	return eventBus, eventCollector
 }
 
-func setupRegistryFull(_ *testing.T, db *sql.DB, cfg *config.AppConfig, eventBus *events.Bus) *registry.Registry {
+func setupRegistryFull(_ *testing.T, db *pgxpool.Pool, cfg *config.AppConfig, eventBus *events.Bus) *registry.Registry {
 	reg := testutil.NewTestRegistryBuilder().
 		WithDatabase(db).
 		WithConfig(cfg).
diff --git a/examples/grpc_service_test.go b/examples/grpc_service_test.go
index 2d984da..7e4cb70 100644
--- a/examples/grpc_service_test.go
+++ b/examples/grpc_service_test.go
@@ -3,13 +3,13 @@ package examples
 
 import (
 	"context"
-	"database/sql"
 	"testing"
 
 	"github.com/cmelgarejo/go-modulith-template/internal/config"
 	"github.com/cmelgarejo/go-modulith-template/internal/registry"
 	"github.com/cmelgarejo/go-modulith-template/internal/testutil"
 	"github.com/cmelgarejo/go-modulith-template/modules/auth"
+	"github.com/jackc/pgx/v5/pgxpool"
 )
 
 // TestExampleGRPCService demonstrates testing gRPC services end-to-end.
@@ -28,7 +28,7 @@ func TestExampleGRPCService(t *testing.T) {
 
 	// Step 1: Set up test database
 	pgContainer, db := setupTestDatabaseGRPC(ctx, t)
-	defer cleanupTestDatabaseGRPC(ctx, t, pgContainer, db)
+	defer cleanupTestDatabaseGRPC(ctx, t, pgContainer)
 
 	// Step 2: Create registry and run migrations
 	cfg := testutil.TestConfig()
@@ -52,13 +52,13 @@ func TestExampleGRPCService(t *testing.T) {
 	testGRPCClient(t, grpcServer)
 }
 
-func setupTestDatabaseGRPC(ctx context.Context, t *testing.T) (*testutil.PostgresContainer, *sql.DB) {
+func setupTestDatabaseGRPC(ctx context.Context, t *testing.T) (*testutil.PostgresContainer, *pgxpool.Pool) {
 	pgContainer, err := testutil.NewPostgresContainer(ctx, t)
 	if err != nil {
 		t.Fatalf("Failed to create postgres container: %v", err)
 	}
 
-	db, err := pgContainer.DB(ctx)
+	db, err := pgContainer.Pool(ctx)
 	if err != nil {
 		_ = pgContainer.Close(ctx)
 
@@ -68,17 +68,13 @@ func setupTestDatabaseGRPC(ctx context.Context, t *testing.T) (*testutil.Postgre
 	return pgContainer, db
 }
 
-func cleanupTestDatabaseGRPC(ctx context.Context, t *testing.T, pgContainer *testutil.PostgresContainer, db *sql.DB) {
-	if err := db.Close(); err != nil {
-		t.Errorf("Failed to close database: %v", err)
-	}
-
+func cleanupTestDatabaseGRPC(ctx context.Context, t *testing.T, pgContainer *testutil.PostgresContainer) {
 	if err := pgContainer.Close(ctx); err != nil {
 		t.Errorf("Failed to close container: %v", err)
 	}
 }
 
-func setupRegistryGRPC(_ *testing.T, db *sql.DB, cfg *config.AppConfig) *registry.Registry {
+func setupRegistryGRPC(_ *testing.T, db *pgxpool.Pool, cfg *config.AppConfig) *registry.Registry {
 	reg := testutil.NewTestRegistryBuilder().
 		WithDatabase(db).
 		WithConfig(cfg).
@@ -115,7 +111,7 @@ func testGRPCClient(t *testing.T, grpcServer *testutil.GRPCTestServer) {
 		t.Fatal("gRPC client is nil")
 	}
 
-	// At this point, you would use the client to make actual gRPC calls
+	// At this point, you would use the client to just actual gRPC calls
 	// Example:
 	// authClient := authv1.NewAuthServiceClient(client)
 	// resp, err := authClient.RequestLogin(ctx, &authv1.RequestLoginRequest{
@@ -140,7 +136,7 @@ func TestExampleGRPCErrorHandling(t *testing.T) {
 
 	// Set up test environment (similar to above)
 	pgContainer, db := setupTestDatabaseGRPC(ctx, t)
-	defer cleanupTestDatabaseGRPC(ctx, t, pgContainer, db)
+	defer cleanupTestDatabaseGRPC(ctx, t, pgContainer)
 
 	cfg := testutil.TestConfig()
 	cfg.DBDSN = pgContainer.DSN
diff --git a/examples/integration_test_example.go b/examples/integration_test_example.go
index 82e74a7..28618b5 100644
--- a/examples/integration_test_example.go
+++ b/examples/integration_test_example.go
@@ -13,23 +13,21 @@
 //
 // Or use the Makefile:
 //
-//	make test-integration
+//	just test-integration
 package examples
 
 import (
 	"context"
-	"database/sql"
 	"testing"
 	"time"
 
-	_ "github.com/jackc/pgx/v5/stdlib" // pgx driver
-
 	"github.com/cmelgarejo/go-modulith-template/internal/config"
 	"github.com/cmelgarejo/go-modulith-template/internal/events"
 	"github.com/cmelgarejo/go-modulith-template/internal/migration"
 	"github.com/cmelgarejo/go-modulith-template/internal/registry"
 	"github.com/cmelgarejo/go-modulith-template/internal/testutil"
 	"github.com/cmelgarejo/go-modulith-template/modules/auth"
+	"github.com/jackc/pgx/v5/pgxpool"
 )
 
 // ExampleIntegrationTest demonstrates a complete integration test for a module.
@@ -37,7 +35,7 @@ import (
 // 1. Sets up a real PostgreSQL database using testcontainers
 // 2. Runs migrations to create the schema
 // 3. Initializes the module with real dependencies
-// 4. Tests the service layer end-to-end
+// 4. Tests the repository layer through SQL queries
 // 5. Verifies event bus integration
 func ExampleIntegrationTest(t *testing.T) {
 	if testing.Short() {
@@ -58,20 +56,16 @@ func ExampleIntegrationTest(t *testing.T) {
 		}
 	}()
 
-	// Step 2: Get database connection
-	db, err := pgContainer.DB(ctx)
+	// Step 2: Get database connection pool
+	pool, err := pgContainer.Pool(ctx)
 	if err != nil {
 		t.Fatalf("Failed to connect to database: %v", err)
 	}
 
-	defer func() {
-		if err := db.Close(); err != nil {
-			t.Errorf("Failed to close database: %v", err)
-		}
-	}()
+	defer pool.Close()
 
 	// Step 3: Run migrations
-	reg := setupRegistry(t, db)
+	reg := setupRegistry(t, pool)
 
 	// Run migrations
 	migrationRunner := migration.NewRunner(pgContainer.DSN, reg)
@@ -83,13 +77,13 @@ func ExampleIntegrationTest(t *testing.T) {
 	eventBus := reg.EventBus()
 
 	// Step 5: Test through database queries
-	testDatabaseOperations(ctx, t, db)
+	testDatabaseOperations(ctx, t, pool)
 
 	// Step 6: Test event bus integration
 	testEventBusIntegration(ctx, t, eventBus)
 }
 
-func setupRegistry(t *testing.T, db *sql.DB) *registry.Registry {
+func setupRegistry(t *testing.T, db *pgxpool.Pool) *registry.Registry {
 	t.Helper()
 
 	// Create a minimal registry for migration discovery
@@ -97,7 +91,7 @@ func setupRegistry(t *testing.T, db *sql.DB) *registry.Registry {
 		Env:      "test",
 		LogLevel: "debug",
 		Auth: config.AuthConfig{
-			JWTSecret: "test-secret-key-that-is-at-least-32-bytes-long-for-testing",
+			JWTPrivateKeyPEM: "test-auth-private-key",
 		},
 	}
 
@@ -118,29 +112,29 @@ func setupRegistry(t *testing.T, db *sql.DB) *registry.Registry {
 	return reg
 }
 
-func testDatabaseOperations(ctx context.Context, t *testing.T, db *sql.DB) {
+func testDatabaseOperations(ctx context.Context, t *testing.T, db *pgxpool.Pool) {
 	t.Helper()
 
 	// Test that migrations created the expected tables
 	var tableExists bool
 
-	err := db.QueryRowContext(ctx,
-		"SELECT EXISTS (SELECT FROM information_schema.tables WHERE table_name = 'magic_codes')",
+	err := db.QueryRow(ctx,
+		"SELECT EXISTS (SELECT FROM information_schema.tables WHERE table_schema = 'auth' AND table_name = 'magic_codes')",
 	).Scan(&tableExists)
 	if err != nil {
 		t.Fatalf("Failed to check table existence: %v", err)
 	}
 
 	if !tableExists {
-		t.Error("Expected magic_codes table to exist after migrations")
+		t.Error("Expected auth.magic_codes table to exist after migrations")
 	}
 
 	// Test inserting and querying data
 	email := "test@example.com"
 	code := "123456"
 
-	_, err = db.ExecContext(ctx,
-		"INSERT INTO magic_codes (email, code, expires_at) VALUES ($1, $2, NOW() + INTERVAL '10 minutes')",
+	_, err = db.Exec(ctx,
+		"INSERT INTO auth.magic_codes (email, code, expires_at) VALUES ($1, $2, NOW() + INTERVAL '10 minutes')",
 		email, code,
 	)
 	if err != nil {
@@ -149,8 +143,8 @@ func testDatabaseOperations(ctx context.Context, t *testing.T, db *sql.DB) {
 
 	var storedCode string
 
-	err = db.QueryRowContext(ctx,
-		"SELECT code FROM magic_codes WHERE email = $1 ORDER BY created_at DESC LIMIT 1",
+	err = db.QueryRow(ctx,
+		"SELECT code FROM auth.magic_codes WHERE email = $1 ORDER BY created_at DESC LIMIT 1",
 		email,
 	).Scan(&storedCode)
 	if err != nil {
@@ -199,23 +193,12 @@ func testEventBusIntegration(ctx context.Context, t *testing.T, eventBus *events
 }
 
 // ExampleRepositoryIntegrationTest demonstrates testing database operations directly.
-// Note: This example doesn't use internal packages - it tests through SQL.
 func ExampleRepositoryIntegrationTest(t *testing.T) {
 	if testing.Short() {
 		t.Skip("Skipping integration test in short mode")
 	}
 
 	ctx := context.Background()
-	db := setupTestDatabase(ctx, t)
-
-	// Example: Test database operations directly
-	t.Run("DatabaseOperations", func(t *testing.T) {
-		testUserOperations(ctx, t, db)
-	})
-}
-
-func setupTestDatabase(ctx context.Context, t *testing.T) *sql.DB {
-	t.Helper()
 
 	// Set up test database
 	pgContainer, err := testutil.NewPostgresContainer(ctx, t)
@@ -229,20 +212,15 @@ func setupTestDatabase(ctx context.Context, t *testing.T) *sql.DB {
 		}
 	}()
 
-	db, err := pgContainer.DB(ctx)
+	pool, err := pgContainer.Pool(ctx)
 	if err != nil {
 		t.Fatalf("Failed to connect to database: %v", err)
 	}
 
-	defer func() {
-		if err := db.Close(); err != nil {
-			t.Errorf("Failed to close database: %v", err)
-		}
-	}()
+	defer pool.Close()
 
-	// Run migrations (simplified - in real tests, use migration runner)
 	// For this example, we'll create a simple table
-	_, err = db.ExecContext(ctx, `
+	_, err = pool.Exec(ctx, `
 		CREATE TABLE IF NOT EXISTS test_users (
 			id TEXT PRIMARY KEY,
 			email TEXT UNIQUE NOT NULL,
@@ -253,17 +231,20 @@ func setupTestDatabase(ctx context.Context, t *testing.T) *sql.DB {
 		t.Fatalf("Failed to create test table: %v", err)
 	}
 
-	return db
+	// Example: Test database operations directly
+	t.Run("DatabaseOperations", func(t *testing.T) {
+		testUserOperations(ctx, t, pool)
+	})
 }
 
-func testUserOperations(ctx context.Context, t *testing.T, db *sql.DB) {
+func testUserOperations(ctx context.Context, t *testing.T, db *pgxpool.Pool) {
 	t.Helper()
 
 	userID := "test-user-123"
 	email := "test@example.com"
 
 	// Insert
-	_, err := db.ExecContext(ctx,
+	_, err := db.Exec(ctx,
 		"INSERT INTO test_users (id, email) VALUES ($1, $2)",
 		userID, email,
 	)
@@ -274,7 +255,7 @@ func testUserOperations(ctx context.Context, t *testing.T, db *sql.DB) {
 	// Query
 	var storedEmail string
 
-	err = db.QueryRowContext(ctx,
+	err = db.QueryRow(ctx,
 		"SELECT email FROM test_users WHERE id = $1",
 		userID,
 	).Scan(&storedEmail)
@@ -288,19 +269,10 @@ func testUserOperations(ctx context.Context, t *testing.T, db *sql.DB) {
 }
 
 // ExampleGRPCIntegrationTest demonstrates testing gRPC endpoints.
-// This requires setting up a gRPC server and client.
 func ExampleGRPCIntegrationTest(t *testing.T) {
 	if testing.Short() {
 		t.Skip("Skipping integration test in short mode")
 	}
 
-	// This is a template for gRPC integration tests
-	// In practice, you would:
-	// 1. Set up test database (as shown above)
-	// 2. Create a gRPC server
-	// 3. Register your service
-	// 4. Create a gRPC client
-	// 5. Make RPC calls and verify responses
-
 	t.Log("gRPC integration test template - implement based on your needs")
 }
diff --git a/examples/module_communication_test.go b/examples/module_communication_test.go
index e305ad3..d77edbf 100644
--- a/examples/module_communication_test.go
+++ b/examples/module_communication_test.go
@@ -3,7 +3,6 @@ package examples
 
 import (
 	"context"
-	"database/sql"
 	"testing"
 	"time"
 
@@ -12,6 +11,7 @@ import (
 	"github.com/cmelgarejo/go-modulith-template/internal/registry"
 	"github.com/cmelgarejo/go-modulith-template/internal/testutil"
 	"github.com/cmelgarejo/go-modulith-template/modules/auth"
+	"github.com/jackc/pgx/v5/pgxpool"
 )
 
 // TestExampleModuleCommunication demonstrates testing inter-module communication.
@@ -28,7 +28,7 @@ func TestExampleModuleCommunication(t *testing.T) {
 
 	// Step 1: Set up test database
 	pgContainer, db := setupTestDatabaseModule(ctx, t)
-	defer cleanupTestDatabaseModule(ctx, t, pgContainer, db)
+	defer cleanupTestDatabaseModule(ctx, t, pgContainer)
 
 	// Step 2: Create registry with event bus
 	cfg := testutil.TestConfig()
@@ -52,13 +52,13 @@ func TestExampleModuleCommunication(t *testing.T) {
 	t.Log("Module communication test complete")
 }
 
-func setupTestDatabaseModule(ctx context.Context, t *testing.T) (*testutil.PostgresContainer, *sql.DB) {
+func setupTestDatabaseModule(ctx context.Context, t *testing.T) (*testutil.PostgresContainer, *pgxpool.Pool) {
 	pgContainer, err := testutil.NewPostgresContainer(ctx, t)
 	if err != nil {
 		t.Fatalf("Failed to create postgres container: %v", err)
 	}
 
-	db, err := pgContainer.DB(ctx)
+	db, err := pgContainer.Pool(ctx)
 	if err != nil {
 		_ = pgContainer.Close(ctx)
 
@@ -68,11 +68,7 @@ func setupTestDatabaseModule(ctx context.Context, t *testing.T) (*testutil.Postg
 	return pgContainer, db
 }
 
-func cleanupTestDatabaseModule(ctx context.Context, t *testing.T, pgContainer *testutil.PostgresContainer, db *sql.DB) {
-	if err := db.Close(); err != nil {
-		t.Errorf("Failed to close database: %v", err)
-	}
-
+func cleanupTestDatabaseModule(ctx context.Context, t *testing.T, pgContainer *testutil.PostgresContainer) {
 	if err := pgContainer.Close(ctx); err != nil {
 		t.Errorf("Failed to close container: %v", err)
 	}
@@ -88,7 +84,7 @@ func setupEventBusModule() (*events.Bus, *testutil.EventCollector) {
 	return eventBus, eventCollector
 }
 
-func setupRegistryModule(_ *testing.T, db *sql.DB, cfg *config.AppConfig, eventBus *events.Bus) *registry.Registry {
+func setupRegistryModule(_ *testing.T, db *pgxpool.Pool, cfg *config.AppConfig, eventBus *events.Bus) *registry.Registry {
 	reg := testutil.NewTestRegistryBuilder().
 		WithDatabase(db).
 		WithConfig(cfg).
diff --git a/examples/repository_transaction_test.go b/examples/repository_transaction_test.go
index 9652840..3879aae 100644
--- a/examples/repository_transaction_test.go
+++ b/examples/repository_transaction_test.go
@@ -3,12 +3,11 @@ package examples
 
 import (
 	"context"
-	"database/sql"
 	"testing"
 
-	_ "github.com/jackc/pgx/v5/stdlib"
-
 	"github.com/cmelgarejo/go-modulith-template/internal/testutil"
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgxpool"
 )
 
 // TestExampleRepositoryTransaction demonstrates testing repository transactions.
@@ -35,19 +34,13 @@ func TestExampleRepositoryTransaction(t *testing.T) {
 		}
 	}()
 
-	db, err := pgContainer.DB(ctx)
+	db, err := pgContainer.Pool(ctx)
 	if err != nil {
 		t.Fatalf("Failed to connect to database: %v", err)
 	}
 
-	defer func() {
-		if err := db.Close(); err != nil {
-			t.Errorf("Failed to close database: %v", err)
-		}
-	}()
-
 	// Step 2: Create test table
-	_, err = db.ExecContext(ctx, `
+	_, err = db.Exec(ctx, `
 		CREATE TABLE IF NOT EXISTS test_transactions (
 			id TEXT PRIMARY KEY,
 			value TEXT NOT NULL,
@@ -76,27 +69,27 @@ func TestExampleRepositoryTransaction(t *testing.T) {
 	t.Log("Repository transaction tests complete")
 }
 
-func testSuccessfulTransaction(ctx context.Context, t *testing.T, db *sql.DB) {
-	tx, err := db.BeginTx(ctx, nil)
+func testSuccessfulTransaction(ctx context.Context, t *testing.T, db *pgxpool.Pool) {
+	tx, err := db.Begin(ctx)
 	if err != nil {
 		t.Fatalf("Failed to begin transaction: %v", err)
 	}
 
-	_, err = tx.ExecContext(ctx, "INSERT INTO test_transactions (id, value) VALUES ($1, $2)", "tx-1", "value-1")
+	_, err = tx.Exec(ctx, "INSERT INTO test_transactions (id, value) VALUES ($1, $2)", "tx-1", "value-1")
 	if err != nil {
-		_ = tx.Rollback()
+		_ = tx.Rollback(ctx)
 
 		t.Fatalf("Failed to insert: %v", err)
 	}
 
-	if err := tx.Commit(); err != nil {
+	if err := tx.Commit(ctx); err != nil {
 		t.Fatalf("Failed to commit: %v", err)
 	}
 
 	// Verify data was committed
 	var value string
 
-	err = db.QueryRowContext(ctx, "SELECT value FROM test_transactions WHERE id = $1", "tx-1").Scan(&value)
+	err = db.QueryRow(ctx, "SELECT value FROM test_transactions WHERE id = $1", "tx-1").Scan(&value)
 	if err != nil {
 		t.Fatalf("Failed to query: %v", err)
 	}
@@ -106,29 +99,29 @@ func testSuccessfulTransaction(ctx context.Context, t *testing.T, db *sql.DB) {
 	}
 }
 
-func testRollbackTransaction(ctx context.Context, t *testing.T, db *sql.DB) {
-	tx, err := db.BeginTx(ctx, nil)
+func testRollbackTransaction(ctx context.Context, t *testing.T, db *pgxpool.Pool) {
+	tx, err := db.Begin(ctx)
 	if err != nil {
 		t.Fatalf("Failed to begin transaction: %v", err)
 	}
 
-	_, err = tx.ExecContext(ctx, "INSERT INTO test_transactions (id, value) VALUES ($1, $2)", "tx-2", "value-2")
+	_, err = tx.Exec(ctx, "INSERT INTO test_transactions (id, value) VALUES ($1, $2)", "tx-2", "value-2")
 	if err != nil {
-		_ = tx.Rollback()
+		_ = tx.Rollback(ctx)
 
 		t.Fatalf("Failed to insert: %v", err)
 	}
 
 	// Rollback instead of commit
-	if err := tx.Rollback(); err != nil {
+	if err := tx.Rollback(ctx); err != nil {
 		t.Fatalf("Failed to rollback: %v", err)
 	}
 
 	// Verify data was NOT committed
 	var value string
 
-	err = db.QueryRowContext(ctx, "SELECT value FROM test_transactions WHERE id = $1", "tx-2").Scan(&value)
-	if err != sql.ErrNoRows {
+	err = db.QueryRow(ctx, "SELECT value FROM test_transactions WHERE id = $1", "tx-2").Scan(&value)
+	if err != pgx.ErrNoRows {
 		if err == nil {
 			t.Error("Expected no rows, but found data after rollback")
 		} else {
@@ -137,55 +130,55 @@ func testRollbackTransaction(ctx context.Context, t *testing.T, db *sql.DB) {
 	}
 }
 
-func testConcurrentTransactions(ctx context.Context, t *testing.T, db *sql.DB) {
+func testConcurrentTransactions(ctx context.Context, t *testing.T, db *pgxpool.Pool) {
 	// This would test concurrent access patterns
 	// In a real scenario, you would:
 	// 1. Start multiple transactions concurrently
 	// 2. Perform operations in each
 	// 3. Verify isolation and consistency
-	tx1, err := db.BeginTx(ctx, nil)
+	tx1, err := db.Begin(ctx)
 	if err != nil {
 		t.Fatalf("Failed to begin transaction 1: %v", err)
 	}
 
-	tx2, err := db.BeginTx(ctx, nil)
+	tx2, err := db.Begin(ctx)
 	if err != nil {
-		_ = tx1.Rollback()
+		_ = tx1.Rollback(ctx)
 
 		t.Fatalf("Failed to begin transaction 2: %v", err)
 	}
 
-	_, err = tx1.ExecContext(ctx, "INSERT INTO test_transactions (id, value) VALUES ($1, $2)", "tx-3", "value-3")
+	_, err = tx1.Exec(ctx, "INSERT INTO test_transactions (id, value) VALUES ($1, $2)", "tx-3", "value-3")
 	if err != nil {
-		_ = tx1.Rollback()
-		_ = tx2.Rollback()
+		_ = tx1.Rollback(ctx)
+		_ = tx2.Rollback(ctx)
 
 		t.Fatalf("Failed to insert in tx1: %v", err)
 	}
 
-	_, err = tx2.ExecContext(ctx, "INSERT INTO test_transactions (id, value) VALUES ($1, $2)", "tx-4", "value-4")
+	_, err = tx2.Exec(ctx, "INSERT INTO test_transactions (id, value) VALUES ($1, $2)", "tx-4", "value-4")
 	if err != nil {
-		_ = tx1.Rollback()
-		_ = tx2.Rollback()
+		_ = tx1.Rollback(ctx)
+		_ = tx2.Rollback(ctx)
 
 		t.Fatalf("Failed to insert in tx2: %v", err)
 	}
 
 	// Commit both
-	if err := tx1.Commit(); err != nil {
-		_ = tx2.Rollback()
+	if err := tx1.Commit(ctx); err != nil {
+		_ = tx2.Rollback(ctx)
 
 		t.Fatalf("Failed to commit tx1: %v", err)
 	}
 
-	if err := tx2.Commit(); err != nil {
+	if err := tx2.Commit(ctx); err != nil {
 		t.Fatalf("Failed to commit tx2: %v", err)
 	}
 
 	// Verify both were committed
 	var count int
 
-	err = db.QueryRowContext(ctx, "SELECT COUNT(*) FROM test_transactions WHERE id IN ('tx-3', 'tx-4')").Scan(&count)
+	err = db.QueryRow(ctx, "SELECT COUNT(*) FROM test_transactions WHERE id IN ('tx-3', 'tx-4')").Scan(&count)
 	if err != nil {
 		t.Fatalf("Failed to query: %v", err)
 	}
diff --git a/gen/go/proto/auth/v1/auth.pb.go b/gen/go/proto/auth/v1/auth.pb.go
index 1517dfb..42e992e 100644
--- a/gen/go/proto/auth/v1/auth.pb.go
+++ b/gen/go/proto/auth/v1/auth.pb.go
@@ -24,6 +24,86 @@ const (
 	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
 )
 
+type GetSystemConfigRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetSystemConfigRequest) Reset() {
+	*x = GetSystemConfigRequest{}
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetSystemConfigRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetSystemConfigRequest) ProtoMessage() {}
+
+func (x *GetSystemConfigRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetSystemConfigRequest.ProtoReflect.Descriptor instead.
+func (*GetSystemConfigRequest) Descriptor() ([]byte, []int) {
+	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{0}
+}
+
+type GetSystemConfigResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Configs       map[string]string      `protobuf:"bytes,1,rep,name=configs,proto3" json:"configs,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetSystemConfigResponse) Reset() {
+	*x = GetSystemConfigResponse{}
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetSystemConfigResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetSystemConfigResponse) ProtoMessage() {}
+
+func (x *GetSystemConfigResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetSystemConfigResponse.ProtoReflect.Descriptor instead.
+func (*GetSystemConfigResponse) Descriptor() ([]byte, []int) {
+	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *GetSystemConfigResponse) GetConfigs() map[string]string {
+	if x != nil {
+		return x.Configs
+	}
+	return nil
+}
+
 // RequestLoginRequest initiates the login process by sending a magic code.
 // Provide either email OR phone (exactly one is required).
 type RequestLoginRequest struct {
@@ -39,7 +119,7 @@ type RequestLoginRequest struct {
 
 func (x *RequestLoginRequest) Reset() {
 	*x = RequestLoginRequest{}
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[0]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[2]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -51,7 +131,7 @@ func (x *RequestLoginRequest) String() string {
 func (*RequestLoginRequest) ProtoMessage() {}
 
 func (x *RequestLoginRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[0]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[2]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -64,7 +144,7 @@ func (x *RequestLoginRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RequestLoginRequest.ProtoReflect.Descriptor instead.
 func (*RequestLoginRequest) Descriptor() ([]byte, []int) {
-	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{0}
+	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{2}
 }
 
 func (x *RequestLoginRequest) GetContactInfo() isRequestLoginRequest_ContactInfo {
@@ -120,7 +200,7 @@ type RequestLoginResponse struct {
 
 func (x *RequestLoginResponse) Reset() {
 	*x = RequestLoginResponse{}
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[1]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[3]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -132,7 +212,7 @@ func (x *RequestLoginResponse) String() string {
 func (*RequestLoginResponse) ProtoMessage() {}
 
 func (x *RequestLoginResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[1]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[3]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -145,7 +225,7 @@ func (x *RequestLoginResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RequestLoginResponse.ProtoReflect.Descriptor instead.
 func (*RequestLoginResponse) Descriptor() ([]byte, []int) {
-	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{1}
+	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{3}
 }
 
 func (x *RequestLoginResponse) GetSuccess() bool {
@@ -179,7 +259,7 @@ type CompleteLoginRequest struct {
 
 func (x *CompleteLoginRequest) Reset() {
 	*x = CompleteLoginRequest{}
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[2]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[4]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -191,7 +271,7 @@ func (x *CompleteLoginRequest) String() string {
 func (*CompleteLoginRequest) ProtoMessage() {}
 
 func (x *CompleteLoginRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[2]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[4]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -204,7 +284,7 @@ func (x *CompleteLoginRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CompleteLoginRequest.ProtoReflect.Descriptor instead.
 func (*CompleteLoginRequest) Descriptor() ([]byte, []int) {
-	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{2}
+	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{4}
 }
 
 func (x *CompleteLoginRequest) GetContactInfo() isCompleteLoginRequest_ContactInfo {
@@ -268,7 +348,7 @@ type CompleteLoginResponse struct {
 
 func (x *CompleteLoginResponse) Reset() {
 	*x = CompleteLoginResponse{}
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[3]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[5]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -280,7 +360,7 @@ func (x *CompleteLoginResponse) String() string {
 func (*CompleteLoginResponse) ProtoMessage() {}
 
 func (x *CompleteLoginResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[3]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[5]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -293,7 +373,7 @@ func (x *CompleteLoginResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CompleteLoginResponse.ProtoReflect.Descriptor instead.
 func (*CompleteLoginResponse) Descriptor() ([]byte, []int) {
-	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{3}
+	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{5}
 }
 
 func (x *CompleteLoginResponse) GetAccessToken() string {
@@ -317,28 +397,203 @@ func (x *CompleteLoginResponse) GetExpiresIn() int64 {
 	return 0
 }
 
-type RefreshTokenRequest struct {
+type RegisterRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Types that are valid to be assigned to ContactInfo:
+	//
+	//	*RegisterRequest_Email
+	//	*RegisterRequest_Phone
+	ContactInfo    isRegisterRequest_ContactInfo `protobuf_oneof:"contact_info"`
+	DisplayName    string                        `protobuf:"bytes,3,opt,name=display_name,json=displayName,proto3" json:"display_name,omitempty"`
+	Nationality    string                        `protobuf:"bytes,4,opt,name=nationality,proto3" json:"nationality,omitempty"`
+	DocumentType   string                        `protobuf:"bytes,5,opt,name=document_type,json=documentType,proto3" json:"document_type,omitempty"`
+	DocumentNumber string                        `protobuf:"bytes,6,opt,name=document_number,json=documentNumber,proto3" json:"document_number,omitempty"`
+	unknownFields  protoimpl.UnknownFields
+	sizeCache      protoimpl.SizeCache
+}
+
+func (x *RegisterRequest) Reset() {
+	*x = RegisterRequest{}
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[6]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RegisterRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RegisterRequest) ProtoMessage() {}
+
+func (x *RegisterRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[6]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RegisterRequest.ProtoReflect.Descriptor instead.
+func (*RegisterRequest) Descriptor() ([]byte, []int) {
+	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *RegisterRequest) GetContactInfo() isRegisterRequest_ContactInfo {
+	if x != nil {
+		return x.ContactInfo
+	}
+	return nil
+}
+
+func (x *RegisterRequest) GetEmail() string {
+	if x != nil {
+		if x, ok := x.ContactInfo.(*RegisterRequest_Email); ok {
+			return x.Email
+		}
+	}
+	return ""
+}
+
+func (x *RegisterRequest) GetPhone() string {
+	if x != nil {
+		if x, ok := x.ContactInfo.(*RegisterRequest_Phone); ok {
+			return x.Phone
+		}
+	}
+	return ""
+}
+
+func (x *RegisterRequest) GetDisplayName() string {
+	if x != nil {
+		return x.DisplayName
+	}
+	return ""
+}
+
+func (x *RegisterRequest) GetNationality() string {
+	if x != nil {
+		return x.Nationality
+	}
+	return ""
+}
+
+func (x *RegisterRequest) GetDocumentType() string {
+	if x != nil {
+		return x.DocumentType
+	}
+	return ""
+}
+
+func (x *RegisterRequest) GetDocumentNumber() string {
+	if x != nil {
+		return x.DocumentNumber
+	}
+	return ""
+}
+
+type isRegisterRequest_ContactInfo interface {
+	isRegisterRequest_ContactInfo()
+}
+
+type RegisterRequest_Email struct {
+	Email string `protobuf:"bytes,1,opt,name=email,proto3,oneof"`
+}
+
+type RegisterRequest_Phone struct {
+	Phone string `protobuf:"bytes,2,opt,name=phone,proto3,oneof"`
+}
+
+func (*RegisterRequest_Email) isRegisterRequest_ContactInfo() {}
+
+func (*RegisterRequest_Phone) isRegisterRequest_ContactInfo() {}
+
+type RegisterResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Success       bool                   `protobuf:"varint,1,opt,name=success,proto3" json:"success,omitempty"`
+	Message       string                 `protobuf:"bytes,2,opt,name=message,proto3" json:"message,omitempty"`
+	User          *User                  `protobuf:"bytes,3,opt,name=user,proto3" json:"user,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *RegisterResponse) Reset() {
+	*x = RegisterResponse{}
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[7]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RegisterResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RegisterResponse) ProtoMessage() {}
+
+func (x *RegisterResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[7]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RegisterResponse.ProtoReflect.Descriptor instead.
+func (*RegisterResponse) Descriptor() ([]byte, []int) {
+	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{7}
+}
+
+func (x *RegisterResponse) GetSuccess() bool {
+	if x != nil {
+		return x.Success
+	}
+	return false
+}
+
+func (x *RegisterResponse) GetMessage() string {
+	if x != nil {
+		return x.Message
+	}
+	return ""
+}
+
+func (x *RegisterResponse) GetUser() *User {
+	if x != nil {
+		return x.User
+	}
+	return nil
+}
+
+// refresh_token may be empty when using HttpOnly cookie (cookie takes precedence).
+type RefreshSessionRequest struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	RefreshToken  string                 `protobuf:"bytes,1,opt,name=refresh_token,json=refreshToken,proto3" json:"refresh_token,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
 
-func (x *RefreshTokenRequest) Reset() {
-	*x = RefreshTokenRequest{}
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[4]
+func (x *RefreshSessionRequest) Reset() {
+	*x = RefreshSessionRequest{}
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[8]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
 
-func (x *RefreshTokenRequest) String() string {
+func (x *RefreshSessionRequest) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*RefreshTokenRequest) ProtoMessage() {}
+func (*RefreshSessionRequest) ProtoMessage() {}
 
-func (x *RefreshTokenRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[4]
+func (x *RefreshSessionRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[8]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -349,19 +604,19 @@ func (x *RefreshTokenRequest) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use RefreshTokenRequest.ProtoReflect.Descriptor instead.
-func (*RefreshTokenRequest) Descriptor() ([]byte, []int) {
-	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{4}
+// Deprecated: Use RefreshSessionRequest.ProtoReflect.Descriptor instead.
+func (*RefreshSessionRequest) Descriptor() ([]byte, []int) {
+	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{8}
 }
 
-func (x *RefreshTokenRequest) GetRefreshToken() string {
+func (x *RefreshSessionRequest) GetRefreshToken() string {
 	if x != nil {
 		return x.RefreshToken
 	}
 	return ""
 }
 
-type RefreshTokenResponse struct {
+type RefreshSessionResponse struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	AccessToken   string                 `protobuf:"bytes,1,opt,name=access_token,json=accessToken,proto3" json:"access_token,omitempty"`
 	RefreshToken  string                 `protobuf:"bytes,2,opt,name=refresh_token,json=refreshToken,proto3" json:"refresh_token,omitempty"`
@@ -370,21 +625,21 @@ type RefreshTokenResponse struct {
 	sizeCache     protoimpl.SizeCache
 }
 
-func (x *RefreshTokenResponse) Reset() {
-	*x = RefreshTokenResponse{}
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[5]
+func (x *RefreshSessionResponse) Reset() {
+	*x = RefreshSessionResponse{}
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[9]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
 
-func (x *RefreshTokenResponse) String() string {
+func (x *RefreshSessionResponse) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*RefreshTokenResponse) ProtoMessage() {}
+func (*RefreshSessionResponse) ProtoMessage() {}
 
-func (x *RefreshTokenResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[5]
+func (x *RefreshSessionResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[9]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -395,26 +650,26 @@ func (x *RefreshTokenResponse) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use RefreshTokenResponse.ProtoReflect.Descriptor instead.
-func (*RefreshTokenResponse) Descriptor() ([]byte, []int) {
-	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{5}
+// Deprecated: Use RefreshSessionResponse.ProtoReflect.Descriptor instead.
+func (*RefreshSessionResponse) Descriptor() ([]byte, []int) {
+	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{9}
 }
 
-func (x *RefreshTokenResponse) GetAccessToken() string {
+func (x *RefreshSessionResponse) GetAccessToken() string {
 	if x != nil {
 		return x.AccessToken
 	}
 	return ""
 }
 
-func (x *RefreshTokenResponse) GetRefreshToken() string {
+func (x *RefreshSessionResponse) GetRefreshToken() string {
 	if x != nil {
 		return x.RefreshToken
 	}
 	return ""
 }
 
-func (x *RefreshTokenResponse) GetExpiresIn() int64 {
+func (x *RefreshSessionResponse) GetExpiresIn() int64 {
 	if x != nil {
 		return x.ExpiresIn
 	}
@@ -431,7 +686,7 @@ type LogoutRequest struct {
 
 func (x *LogoutRequest) Reset() {
 	*x = LogoutRequest{}
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[6]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[10]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -443,7 +698,7 @@ func (x *LogoutRequest) String() string {
 func (*LogoutRequest) ProtoMessage() {}
 
 func (x *LogoutRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[6]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[10]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -456,7 +711,7 @@ func (x *LogoutRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use LogoutRequest.ProtoReflect.Descriptor instead.
 func (*LogoutRequest) Descriptor() ([]byte, []int) {
-	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{6}
+	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{10}
 }
 
 func (x *LogoutRequest) GetRevokeAll() bool {
@@ -476,7 +731,7 @@ type LogoutResponse struct {
 
 func (x *LogoutResponse) Reset() {
 	*x = LogoutResponse{}
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[7]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[11]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -488,7 +743,7 @@ func (x *LogoutResponse) String() string {
 func (*LogoutResponse) ProtoMessage() {}
 
 func (x *LogoutResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[7]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[11]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -501,7 +756,7 @@ func (x *LogoutResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use LogoutResponse.ProtoReflect.Descriptor instead.
 func (*LogoutResponse) Descriptor() ([]byte, []int) {
-	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{7}
+	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{11}
 }
 
 func (x *LogoutResponse) GetSuccess() bool {
@@ -527,13 +782,16 @@ type User struct {
 	AvatarUrl     string                 `protobuf:"bytes,5,opt,name=avatar_url,json=avatarUrl,proto3" json:"avatar_url,omitempty"`
 	CreatedAt     *timestamppb.Timestamp `protobuf:"bytes,6,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"`
 	UpdatedAt     *timestamppb.Timestamp `protobuf:"bytes,7,opt,name=updated_at,json=updatedAt,proto3" json:"updated_at,omitempty"`
+	EmailVerified bool                   `protobuf:"varint,8,opt,name=email_verified,json=emailVerified,proto3" json:"email_verified,omitempty"`
+	PhoneVerified bool                   `protobuf:"varint,9,opt,name=phone_verified,json=phoneVerified,proto3" json:"phone_verified,omitempty"`
+	Timezone      string                 `protobuf:"bytes,10,opt,name=timezone,proto3" json:"timezone,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
 
 func (x *User) Reset() {
 	*x = User{}
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[8]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[12]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -545,7 +803,7 @@ func (x *User) String() string {
 func (*User) ProtoMessage() {}
 
 func (x *User) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[8]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[12]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -558,7 +816,7 @@ func (x *User) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use User.ProtoReflect.Descriptor instead.
 func (*User) Descriptor() ([]byte, []int) {
-	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{8}
+	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{12}
 }
 
 func (x *User) GetId() string {
@@ -610,6 +868,27 @@ func (x *User) GetUpdatedAt() *timestamppb.Timestamp {
 	return nil
 }
 
+func (x *User) GetEmailVerified() bool {
+	if x != nil {
+		return x.EmailVerified
+	}
+	return false
+}
+
+func (x *User) GetPhoneVerified() bool {
+	if x != nil {
+		return x.PhoneVerified
+	}
+	return false
+}
+
+func (x *User) GetTimezone() string {
+	if x != nil {
+		return x.Timezone
+	}
+	return ""
+}
+
 type GetProfileRequest struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	unknownFields protoimpl.UnknownFields
@@ -618,7 +897,7 @@ type GetProfileRequest struct {
 
 func (x *GetProfileRequest) Reset() {
 	*x = GetProfileRequest{}
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[9]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[13]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -630,7 +909,7 @@ func (x *GetProfileRequest) String() string {
 func (*GetProfileRequest) ProtoMessage() {}
 
 func (x *GetProfileRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[9]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[13]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -643,7 +922,7 @@ func (x *GetProfileRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetProfileRequest.ProtoReflect.Descriptor instead.
 func (*GetProfileRequest) Descriptor() ([]byte, []int) {
-	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{9}
+	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{13}
 }
 
 type GetProfileResponse struct {
@@ -655,7 +934,7 @@ type GetProfileResponse struct {
 
 func (x *GetProfileResponse) Reset() {
 	*x = GetProfileResponse{}
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[10]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[14]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -667,7 +946,7 @@ func (x *GetProfileResponse) String() string {
 func (*GetProfileResponse) ProtoMessage() {}
 
 func (x *GetProfileResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[10]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[14]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -680,7 +959,7 @@ func (x *GetProfileResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetProfileResponse.ProtoReflect.Descriptor instead.
 func (*GetProfileResponse) Descriptor() ([]byte, []int) {
-	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{10}
+	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{14}
 }
 
 func (x *GetProfileResponse) GetUser() *User {
@@ -695,13 +974,14 @@ type UpdateProfileRequest struct {
 	// Optional fields - validation only applies when field is set
 	DisplayName   string `protobuf:"bytes,1,opt,name=display_name,json=displayName,proto3" json:"display_name,omitempty"`
 	AvatarUrl     string `protobuf:"bytes,2,opt,name=avatar_url,json=avatarUrl,proto3" json:"avatar_url,omitempty"`
+	Timezone      string `protobuf:"bytes,3,opt,name=timezone,proto3" json:"timezone,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
 
 func (x *UpdateProfileRequest) Reset() {
 	*x = UpdateProfileRequest{}
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[11]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[15]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -713,7 +993,7 @@ func (x *UpdateProfileRequest) String() string {
 func (*UpdateProfileRequest) ProtoMessage() {}
 
 func (x *UpdateProfileRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[11]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[15]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -726,7 +1006,7 @@ func (x *UpdateProfileRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UpdateProfileRequest.ProtoReflect.Descriptor instead.
 func (*UpdateProfileRequest) Descriptor() ([]byte, []int) {
-	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{11}
+	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{15}
 }
 
 func (x *UpdateProfileRequest) GetDisplayName() string {
@@ -743,6 +1023,13 @@ func (x *UpdateProfileRequest) GetAvatarUrl() string {
 	return ""
 }
 
+func (x *UpdateProfileRequest) GetTimezone() string {
+	if x != nil {
+		return x.Timezone
+	}
+	return ""
+}
+
 type UpdateProfileResponse struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	User          *User                  `protobuf:"bytes,1,opt,name=user,proto3" json:"user,omitempty"`
@@ -752,7 +1039,7 @@ type UpdateProfileResponse struct {
 
 func (x *UpdateProfileResponse) Reset() {
 	*x = UpdateProfileResponse{}
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[12]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[16]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -764,7 +1051,7 @@ func (x *UpdateProfileResponse) String() string {
 func (*UpdateProfileResponse) ProtoMessage() {}
 
 func (x *UpdateProfileResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[12]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[16]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -777,7 +1064,7 @@ func (x *UpdateProfileResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UpdateProfileResponse.ProtoReflect.Descriptor instead.
 func (*UpdateProfileResponse) Descriptor() ([]byte, []int) {
-	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{12}
+	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{16}
 }
 
 func (x *UpdateProfileResponse) GetUser() *User {
@@ -796,7 +1083,7 @@ type ChangeEmailRequest struct {
 
 func (x *ChangeEmailRequest) Reset() {
 	*x = ChangeEmailRequest{}
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[13]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[17]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -808,7 +1095,7 @@ func (x *ChangeEmailRequest) String() string {
 func (*ChangeEmailRequest) ProtoMessage() {}
 
 func (x *ChangeEmailRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[13]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[17]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -821,7 +1108,7 @@ func (x *ChangeEmailRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ChangeEmailRequest.ProtoReflect.Descriptor instead.
 func (*ChangeEmailRequest) Descriptor() ([]byte, []int) {
-	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{13}
+	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{17}
 }
 
 func (x *ChangeEmailRequest) GetNewEmail() string {
@@ -841,7 +1128,7 @@ type ChangeEmailResponse struct {
 
 func (x *ChangeEmailResponse) Reset() {
 	*x = ChangeEmailResponse{}
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[14]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[18]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -853,7 +1140,7 @@ func (x *ChangeEmailResponse) String() string {
 func (*ChangeEmailResponse) ProtoMessage() {}
 
 func (x *ChangeEmailResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[14]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[18]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -866,7 +1153,7 @@ func (x *ChangeEmailResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ChangeEmailResponse.ProtoReflect.Descriptor instead.
 func (*ChangeEmailResponse) Descriptor() ([]byte, []int) {
-	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{14}
+	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{18}
 }
 
 func (x *ChangeEmailResponse) GetSuccess() bool {
@@ -892,7 +1179,7 @@ type ChangePhoneRequest struct {
 
 func (x *ChangePhoneRequest) Reset() {
 	*x = ChangePhoneRequest{}
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[15]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[19]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -904,7 +1191,7 @@ func (x *ChangePhoneRequest) String() string {
 func (*ChangePhoneRequest) ProtoMessage() {}
 
 func (x *ChangePhoneRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[15]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[19]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -917,7 +1204,7 @@ func (x *ChangePhoneRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ChangePhoneRequest.ProtoReflect.Descriptor instead.
 func (*ChangePhoneRequest) Descriptor() ([]byte, []int) {
-	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{15}
+	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{19}
 }
 
 func (x *ChangePhoneRequest) GetNewPhone() string {
@@ -937,7 +1224,7 @@ type ChangePhoneResponse struct {
 
 func (x *ChangePhoneResponse) Reset() {
 	*x = ChangePhoneResponse{}
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[16]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[20]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -949,7 +1236,7 @@ func (x *ChangePhoneResponse) String() string {
 func (*ChangePhoneResponse) ProtoMessage() {}
 
 func (x *ChangePhoneResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[16]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[20]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -962,7 +1249,7 @@ func (x *ChangePhoneResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ChangePhoneResponse.ProtoReflect.Descriptor instead.
 func (*ChangePhoneResponse) Descriptor() ([]byte, []int) {
-	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{16}
+	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{20}
 }
 
 func (x *ChangePhoneResponse) GetSuccess() bool {
@@ -993,7 +1280,7 @@ type Session struct {
 
 func (x *Session) Reset() {
 	*x = Session{}
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[17]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[21]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1005,7 +1292,7 @@ func (x *Session) String() string {
 func (*Session) ProtoMessage() {}
 
 func (x *Session) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[17]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[21]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1018,7 +1305,7 @@ func (x *Session) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Session.ProtoReflect.Descriptor instead.
 func (*Session) Descriptor() ([]byte, []int) {
-	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{17}
+	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{21}
 }
 
 func (x *Session) GetId() string {
@@ -1071,7 +1358,7 @@ type ListSessionsRequest struct {
 
 func (x *ListSessionsRequest) Reset() {
 	*x = ListSessionsRequest{}
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[18]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[22]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1083,7 +1370,7 @@ func (x *ListSessionsRequest) String() string {
 func (*ListSessionsRequest) ProtoMessage() {}
 
 func (x *ListSessionsRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[18]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[22]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1096,7 +1383,7 @@ func (x *ListSessionsRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListSessionsRequest.ProtoReflect.Descriptor instead.
 func (*ListSessionsRequest) Descriptor() ([]byte, []int) {
-	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{18}
+	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{22}
 }
 
 type ListSessionsResponse struct {
@@ -1108,7 +1395,7 @@ type ListSessionsResponse struct {
 
 func (x *ListSessionsResponse) Reset() {
 	*x = ListSessionsResponse{}
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[19]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[23]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1120,7 +1407,7 @@ func (x *ListSessionsResponse) String() string {
 func (*ListSessionsResponse) ProtoMessage() {}
 
 func (x *ListSessionsResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[19]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[23]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1133,7 +1420,7 @@ func (x *ListSessionsResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListSessionsResponse.ProtoReflect.Descriptor instead.
 func (*ListSessionsResponse) Descriptor() ([]byte, []int) {
-	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{19}
+	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{23}
 }
 
 func (x *ListSessionsResponse) GetSessions() []*Session {
@@ -1152,7 +1439,7 @@ type RevokeSessionRequest struct {
 
 func (x *RevokeSessionRequest) Reset() {
 	*x = RevokeSessionRequest{}
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[20]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[24]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1164,7 +1451,7 @@ func (x *RevokeSessionRequest) String() string {
 func (*RevokeSessionRequest) ProtoMessage() {}
 
 func (x *RevokeSessionRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[20]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[24]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1177,7 +1464,7 @@ func (x *RevokeSessionRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RevokeSessionRequest.ProtoReflect.Descriptor instead.
 func (*RevokeSessionRequest) Descriptor() ([]byte, []int) {
-	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{20}
+	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{24}
 }
 
 func (x *RevokeSessionRequest) GetSessionId() string {
@@ -1196,7 +1483,7 @@ type RevokeSessionResponse struct {
 
 func (x *RevokeSessionResponse) Reset() {
 	*x = RevokeSessionResponse{}
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[21]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[25]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1208,7 +1495,7 @@ func (x *RevokeSessionResponse) String() string {
 func (*RevokeSessionResponse) ProtoMessage() {}
 
 func (x *RevokeSessionResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[21]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[25]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1221,7 +1508,7 @@ func (x *RevokeSessionResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RevokeSessionResponse.ProtoReflect.Descriptor instead.
 func (*RevokeSessionResponse) Descriptor() ([]byte, []int) {
-	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{21}
+	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{25}
 }
 
 func (x *RevokeSessionResponse) GetSuccess() bool {
@@ -1241,7 +1528,7 @@ type RevokeAllSessionsRequest struct {
 
 func (x *RevokeAllSessionsRequest) Reset() {
 	*x = RevokeAllSessionsRequest{}
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[22]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[26]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1253,7 +1540,7 @@ func (x *RevokeAllSessionsRequest) String() string {
 func (*RevokeAllSessionsRequest) ProtoMessage() {}
 
 func (x *RevokeAllSessionsRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[22]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[26]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1266,7 +1553,7 @@ func (x *RevokeAllSessionsRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RevokeAllSessionsRequest.ProtoReflect.Descriptor instead.
 func (*RevokeAllSessionsRequest) Descriptor() ([]byte, []int) {
-	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{22}
+	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{26}
 }
 
 func (x *RevokeAllSessionsRequest) GetIncludeCurrent() bool {
@@ -1285,7 +1572,7 @@ type RevokeAllSessionsResponse struct {
 
 func (x *RevokeAllSessionsResponse) Reset() {
 	*x = RevokeAllSessionsResponse{}
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[23]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[27]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1297,7 +1584,7 @@ func (x *RevokeAllSessionsResponse) String() string {
 func (*RevokeAllSessionsResponse) ProtoMessage() {}
 
 func (x *RevokeAllSessionsResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[23]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[27]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1310,7 +1597,7 @@ func (x *RevokeAllSessionsResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RevokeAllSessionsResponse.ProtoReflect.Descriptor instead.
 func (*RevokeAllSessionsResponse) Descriptor() ([]byte, []int) {
-	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{23}
+	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{27}
 }
 
 func (x *RevokeAllSessionsResponse) GetRevokedCount() int32 {
@@ -1331,7 +1618,7 @@ type OAuthProvider struct {
 
 func (x *OAuthProvider) Reset() {
 	*x = OAuthProvider{}
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[24]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[28]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1343,7 +1630,7 @@ func (x *OAuthProvider) String() string {
 func (*OAuthProvider) ProtoMessage() {}
 
 func (x *OAuthProvider) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[24]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[28]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1356,7 +1643,7 @@ func (x *OAuthProvider) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use OAuthProvider.ProtoReflect.Descriptor instead.
 func (*OAuthProvider) Descriptor() ([]byte, []int) {
-	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{24}
+	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{28}
 }
 
 func (x *OAuthProvider) GetName() string {
@@ -1388,7 +1675,7 @@ type GetOAuthProvidersRequest struct {
 
 func (x *GetOAuthProvidersRequest) Reset() {
 	*x = GetOAuthProvidersRequest{}
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[25]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[29]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1400,7 +1687,7 @@ func (x *GetOAuthProvidersRequest) String() string {
 func (*GetOAuthProvidersRequest) ProtoMessage() {}
 
 func (x *GetOAuthProvidersRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[25]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[29]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1413,7 +1700,7 @@ func (x *GetOAuthProvidersRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetOAuthProvidersRequest.ProtoReflect.Descriptor instead.
 func (*GetOAuthProvidersRequest) Descriptor() ([]byte, []int) {
-	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{25}
+	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{29}
 }
 
 type GetOAuthProvidersResponse struct {
@@ -1425,7 +1712,7 @@ type GetOAuthProvidersResponse struct {
 
 func (x *GetOAuthProvidersResponse) Reset() {
 	*x = GetOAuthProvidersResponse{}
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[26]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[30]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1437,7 +1724,7 @@ func (x *GetOAuthProvidersResponse) String() string {
 func (*GetOAuthProvidersResponse) ProtoMessage() {}
 
 func (x *GetOAuthProvidersResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[26]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[30]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1450,7 +1737,7 @@ func (x *GetOAuthProvidersResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetOAuthProvidersResponse.ProtoReflect.Descriptor instead.
 func (*GetOAuthProvidersResponse) Descriptor() ([]byte, []int) {
-	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{26}
+	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{30}
 }
 
 func (x *GetOAuthProvidersResponse) GetProviders() []*OAuthProvider {
@@ -1470,7 +1757,7 @@ type InitiateOAuthRequest struct {
 
 func (x *InitiateOAuthRequest) Reset() {
 	*x = InitiateOAuthRequest{}
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[27]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[31]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1482,7 +1769,7 @@ func (x *InitiateOAuthRequest) String() string {
 func (*InitiateOAuthRequest) ProtoMessage() {}
 
 func (x *InitiateOAuthRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[27]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[31]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1495,7 +1782,7 @@ func (x *InitiateOAuthRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use InitiateOAuthRequest.ProtoReflect.Descriptor instead.
 func (*InitiateOAuthRequest) Descriptor() ([]byte, []int) {
-	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{27}
+	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{31}
 }
 
 func (x *InitiateOAuthRequest) GetProvider() string {
@@ -1522,7 +1809,7 @@ type InitiateOAuthResponse struct {
 
 func (x *InitiateOAuthResponse) Reset() {
 	*x = InitiateOAuthResponse{}
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[28]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[32]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1534,7 +1821,7 @@ func (x *InitiateOAuthResponse) String() string {
 func (*InitiateOAuthResponse) ProtoMessage() {}
 
 func (x *InitiateOAuthResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[28]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[32]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1547,7 +1834,7 @@ func (x *InitiateOAuthResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use InitiateOAuthResponse.ProtoReflect.Descriptor instead.
 func (*InitiateOAuthResponse) Descriptor() ([]byte, []int) {
-	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{28}
+	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{32}
 }
 
 func (x *InitiateOAuthResponse) GetAuthUrl() string {
@@ -1575,7 +1862,7 @@ type CompleteOAuthRequest struct {
 
 func (x *CompleteOAuthRequest) Reset() {
 	*x = CompleteOAuthRequest{}
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[29]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[33]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1587,7 +1874,7 @@ func (x *CompleteOAuthRequest) String() string {
 func (*CompleteOAuthRequest) ProtoMessage() {}
 
 func (x *CompleteOAuthRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[29]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[33]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1600,7 +1887,7 @@ func (x *CompleteOAuthRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CompleteOAuthRequest.ProtoReflect.Descriptor instead.
 func (*CompleteOAuthRequest) Descriptor() ([]byte, []int) {
-	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{29}
+	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{33}
 }
 
 func (x *CompleteOAuthRequest) GetProvider() string {
@@ -1637,7 +1924,7 @@ type CompleteOAuthResponse struct {
 
 func (x *CompleteOAuthResponse) Reset() {
 	*x = CompleteOAuthResponse{}
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[30]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[34]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1649,7 +1936,7 @@ func (x *CompleteOAuthResponse) String() string {
 func (*CompleteOAuthResponse) ProtoMessage() {}
 
 func (x *CompleteOAuthResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[30]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[34]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1662,7 +1949,7 @@ func (x *CompleteOAuthResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CompleteOAuthResponse.ProtoReflect.Descriptor instead.
 func (*CompleteOAuthResponse) Descriptor() ([]byte, []int) {
-	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{30}
+	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{34}
 }
 
 func (x *CompleteOAuthResponse) GetAccessToken() string {
@@ -1710,7 +1997,7 @@ type LinkExternalAccountRequest struct {
 
 func (x *LinkExternalAccountRequest) Reset() {
 	*x = LinkExternalAccountRequest{}
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[31]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[35]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1722,7 +2009,7 @@ func (x *LinkExternalAccountRequest) String() string {
 func (*LinkExternalAccountRequest) ProtoMessage() {}
 
 func (x *LinkExternalAccountRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[31]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[35]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1735,7 +2022,7 @@ func (x *LinkExternalAccountRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use LinkExternalAccountRequest.ProtoReflect.Descriptor instead.
 func (*LinkExternalAccountRequest) Descriptor() ([]byte, []int) {
-	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{31}
+	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{35}
 }
 
 func (x *LinkExternalAccountRequest) GetProvider() string {
@@ -1762,7 +2049,7 @@ type LinkExternalAccountResponse struct {
 
 func (x *LinkExternalAccountResponse) Reset() {
 	*x = LinkExternalAccountResponse{}
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[32]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[36]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1774,7 +2061,7 @@ func (x *LinkExternalAccountResponse) String() string {
 func (*LinkExternalAccountResponse) ProtoMessage() {}
 
 func (x *LinkExternalAccountResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[32]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[36]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1787,7 +2074,7 @@ func (x *LinkExternalAccountResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use LinkExternalAccountResponse.ProtoReflect.Descriptor instead.
 func (*LinkExternalAccountResponse) Descriptor() ([]byte, []int) {
-	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{32}
+	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{36}
 }
 
 func (x *LinkExternalAccountResponse) GetAuthUrl() string {
@@ -1813,7 +2100,7 @@ type UnlinkExternalAccountRequest struct {
 
 func (x *UnlinkExternalAccountRequest) Reset() {
 	*x = UnlinkExternalAccountRequest{}
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[33]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[37]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1825,7 +2112,7 @@ func (x *UnlinkExternalAccountRequest) String() string {
 func (*UnlinkExternalAccountRequest) ProtoMessage() {}
 
 func (x *UnlinkExternalAccountRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[33]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[37]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1838,7 +2125,7 @@ func (x *UnlinkExternalAccountRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UnlinkExternalAccountRequest.ProtoReflect.Descriptor instead.
 func (*UnlinkExternalAccountRequest) Descriptor() ([]byte, []int) {
-	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{33}
+	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{37}
 }
 
 func (x *UnlinkExternalAccountRequest) GetProvider() string {
@@ -1858,7 +2145,7 @@ type UnlinkExternalAccountResponse struct {
 
 func (x *UnlinkExternalAccountResponse) Reset() {
 	*x = UnlinkExternalAccountResponse{}
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[34]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[38]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1870,7 +2157,7 @@ func (x *UnlinkExternalAccountResponse) String() string {
 func (*UnlinkExternalAccountResponse) ProtoMessage() {}
 
 func (x *UnlinkExternalAccountResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[34]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[38]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1883,7 +2170,7 @@ func (x *UnlinkExternalAccountResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UnlinkExternalAccountResponse.ProtoReflect.Descriptor instead.
 func (*UnlinkExternalAccountResponse) Descriptor() ([]byte, []int) {
-	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{34}
+	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{38}
 }
 
 func (x *UnlinkExternalAccountResponse) GetSuccess() bool {
@@ -1915,7 +2202,7 @@ type ExternalAccount struct {
 
 func (x *ExternalAccount) Reset() {
 	*x = ExternalAccount{}
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[35]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[39]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1927,7 +2214,7 @@ func (x *ExternalAccount) String() string {
 func (*ExternalAccount) ProtoMessage() {}
 
 func (x *ExternalAccount) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[35]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[39]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1940,7 +2227,7 @@ func (x *ExternalAccount) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ExternalAccount.ProtoReflect.Descriptor instead.
 func (*ExternalAccount) Descriptor() ([]byte, []int) {
-	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{35}
+	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{39}
 }
 
 func (x *ExternalAccount) GetId() string {
@@ -2000,7 +2287,7 @@ type ListLinkedAccountsRequest struct {
 
 func (x *ListLinkedAccountsRequest) Reset() {
 	*x = ListLinkedAccountsRequest{}
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[36]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[40]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2012,7 +2299,7 @@ func (x *ListLinkedAccountsRequest) String() string {
 func (*ListLinkedAccountsRequest) ProtoMessage() {}
 
 func (x *ListLinkedAccountsRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[36]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[40]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2025,7 +2312,7 @@ func (x *ListLinkedAccountsRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListLinkedAccountsRequest.ProtoReflect.Descriptor instead.
 func (*ListLinkedAccountsRequest) Descriptor() ([]byte, []int) {
-	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{36}
+	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{40}
 }
 
 type ListLinkedAccountsResponse struct {
@@ -2037,7 +2324,7 @@ type ListLinkedAccountsResponse struct {
 
 func (x *ListLinkedAccountsResponse) Reset() {
 	*x = ListLinkedAccountsResponse{}
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[37]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[41]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2049,7 +2336,7 @@ func (x *ListLinkedAccountsResponse) String() string {
 func (*ListLinkedAccountsResponse) ProtoMessage() {}
 
 func (x *ListLinkedAccountsResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_auth_v1_auth_proto_msgTypes[37]
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[41]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2062,7 +2349,7 @@ func (x *ListLinkedAccountsResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListLinkedAccountsResponse.ProtoReflect.Descriptor instead.
 func (*ListLinkedAccountsResponse) Descriptor() ([]byte, []int) {
-	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{37}
+	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{41}
 }
 
 func (x *ListLinkedAccountsResponse) GetAccounts() []*ExternalAccount {
@@ -2072,11 +2359,105 @@ func (x *ListLinkedAccountsResponse) GetAccounts() []*ExternalAccount {
 	return nil
 }
 
+type RequestEmailVerificationRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *RequestEmailVerificationRequest) Reset() {
+	*x = RequestEmailVerificationRequest{}
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[42]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RequestEmailVerificationRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RequestEmailVerificationRequest) ProtoMessage() {}
+
+func (x *RequestEmailVerificationRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[42]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RequestEmailVerificationRequest.ProtoReflect.Descriptor instead.
+func (*RequestEmailVerificationRequest) Descriptor() ([]byte, []int) {
+	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{42}
+}
+
+type RequestEmailVerificationResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Success       bool                   `protobuf:"varint,1,opt,name=success,proto3" json:"success,omitempty"`
+	Message       string                 `protobuf:"bytes,2,opt,name=message,proto3" json:"message,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *RequestEmailVerificationResponse) Reset() {
+	*x = RequestEmailVerificationResponse{}
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[43]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RequestEmailVerificationResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RequestEmailVerificationResponse) ProtoMessage() {}
+
+func (x *RequestEmailVerificationResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_proto_auth_v1_auth_proto_msgTypes[43]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RequestEmailVerificationResponse.ProtoReflect.Descriptor instead.
+func (*RequestEmailVerificationResponse) Descriptor() ([]byte, []int) {
+	return file_proto_auth_v1_auth_proto_rawDescGZIP(), []int{43}
+}
+
+func (x *RequestEmailVerificationResponse) GetSuccess() bool {
+	if x != nil {
+		return x.Success
+	}
+	return false
+}
+
+func (x *RequestEmailVerificationResponse) GetMessage() string {
+	if x != nil {
+		return x.Message
+	}
+	return ""
+}
+
 var File_proto_auth_v1_auth_proto protoreflect.FileDescriptor
 
 const file_proto_auth_v1_auth_proto_rawDesc = "" +
 	"\n" +
-	"\x18proto/auth/v1/auth.proto\x12\aauth.v1\x1a\x1cgoogle/api/annotations.proto\x1a\x1fgoogle/protobuf/timestamp.proto\x1a\x1bbuf/validate/validate.proto\"\x80\x01\n" +
+	"\x18proto/auth/v1/auth.proto\x12\aauth.v1\x1a\x1cgoogle/api/annotations.proto\x1a\x1fgoogle/protobuf/timestamp.proto\x1a\x1bbuf/validate/validate.proto\"\x18\n" +
+	"\x16GetSystemConfigRequest\"\x9e\x01\n" +
+	"\x17GetSystemConfigResponse\x12G\n" +
+	"\aconfigs\x18\x01 \x03(\v2-.auth.v1.GetSystemConfigResponse.ConfigsEntryR\aconfigs\x1a:\n" +
+	"\fConfigsEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"\x80\x01\n" +
 	"\x13RequestLoginRequest\x12\x1f\n" +
 	"\x05email\x18\x01 \x01(\tB\a\xbaH\x04r\x02`\x01H\x00R\x05email\x121\n" +
 	"\x05phone\x18\x02 \x01(\tB\x19\xbaH\x16r\x142\x12^\\+?[1-9]\\d{1,14}$H\x00R\x05phoneB\x15\n" +
@@ -2094,10 +2475,23 @@ const file_proto_auth_v1_auth_proto_rawDesc = "" +
 	"\faccess_token\x18\x01 \x01(\tR\vaccessToken\x12#\n" +
 	"\rrefresh_token\x18\x02 \x01(\tR\frefreshToken\x12\x1d\n" +
 	"\n" +
-	"expires_in\x18\x03 \x01(\x03R\texpiresIn\"C\n" +
-	"\x13RefreshTokenRequest\x12,\n" +
-	"\rrefresh_token\x18\x01 \x01(\tB\a\xbaH\x04r\x02\x10\x01R\frefreshToken\"}\n" +
-	"\x14RefreshTokenResponse\x12!\n" +
+	"expires_in\x18\x03 \x01(\x03R\texpiresIn\"\xbf\x02\n" +
+	"\x0fRegisterRequest\x12\x1f\n" +
+	"\x05email\x18\x01 \x01(\tB\a\xbaH\x04r\x02`\x01H\x00R\x05email\x121\n" +
+	"\x05phone\x18\x02 \x01(\tB\x19\xbaH\x16r\x142\x12^\\+?[1-9]\\d{1,14}$H\x00R\x05phone\x12,\n" +
+	"\fdisplay_name\x18\x03 \x01(\tB\t\xbaH\x06r\x04\x10\x02\x18dR\vdisplayName\x123\n" +
+	"\vnationality\x18\x04 \x01(\tB\x11\xbaH\x0er\f2\n" +
+	"^[A-Z]{2}$R\vnationality\x12,\n" +
+	"\rdocument_type\x18\x05 \x01(\tB\a\xbaH\x04r\x02\x10\x01R\fdocumentType\x120\n" +
+	"\x0fdocument_number\x18\x06 \x01(\tB\a\xbaH\x04r\x02\x10\x01R\x0edocumentNumberB\x15\n" +
+	"\fcontact_info\x12\x05\xbaH\x02\b\x01\"i\n" +
+	"\x10RegisterResponse\x12\x18\n" +
+	"\asuccess\x18\x01 \x01(\bR\asuccess\x12\x18\n" +
+	"\amessage\x18\x02 \x01(\tR\amessage\x12!\n" +
+	"\x04user\x18\x03 \x01(\v2\r.auth.v1.UserR\x04user\"<\n" +
+	"\x15RefreshSessionRequest\x12#\n" +
+	"\rrefresh_token\x18\x01 \x01(\tR\frefreshToken\"\x7f\n" +
+	"\x16RefreshSessionResponse\x12!\n" +
 	"\faccess_token\x18\x01 \x01(\tR\vaccessToken\x12#\n" +
 	"\rrefresh_token\x18\x02 \x01(\tR\frefreshToken\x12\x1d\n" +
 	"\n" +
@@ -2107,7 +2501,7 @@ const file_proto_auth_v1_auth_proto_rawDesc = "" +
 	"revoke_all\x18\x01 \x01(\bR\trevokeAll\"D\n" +
 	"\x0eLogoutResponse\x12\x18\n" +
 	"\asuccess\x18\x01 \x01(\bR\asuccess\x12\x18\n" +
-	"\amessage\x18\x02 \x01(\tR\amessage\"\xfa\x01\n" +
+	"\amessage\x18\x02 \x01(\tR\amessage\"\xe4\x02\n" +
 	"\x04User\x12\x0e\n" +
 	"\x02id\x18\x01 \x01(\tR\x02id\x12\x14\n" +
 	"\x05email\x18\x02 \x01(\tR\x05email\x12\x14\n" +
@@ -2118,14 +2512,19 @@ const file_proto_auth_v1_auth_proto_rawDesc = "" +
 	"\n" +
 	"created_at\x18\x06 \x01(\v2\x1a.google.protobuf.TimestampR\tcreatedAt\x129\n" +
 	"\n" +
-	"updated_at\x18\a \x01(\v2\x1a.google.protobuf.TimestampR\tupdatedAt\"\x13\n" +
+	"updated_at\x18\a \x01(\v2\x1a.google.protobuf.TimestampR\tupdatedAt\x12%\n" +
+	"\x0eemail_verified\x18\b \x01(\bR\remailVerified\x12%\n" +
+	"\x0ephone_verified\x18\t \x01(\bR\rphoneVerified\x12\x1a\n" +
+	"\btimezone\x18\n" +
+	" \x01(\tR\btimezone\"\x13\n" +
 	"\x11GetProfileRequest\"7\n" +
 	"\x12GetProfileResponse\x12!\n" +
-	"\x04user\x18\x01 \x01(\v2\r.auth.v1.UserR\x04user\"k\n" +
+	"\x04user\x18\x01 \x01(\v2\r.auth.v1.UserR\x04user\"\x90\x01\n" +
 	"\x14UpdateProfileRequest\x12*\n" +
 	"\fdisplay_name\x18\x01 \x01(\tB\a\xbaH\x04r\x02\x18dR\vdisplayName\x12'\n" +
 	"\n" +
-	"avatar_url\x18\x02 \x01(\tB\b\xbaH\x05r\x03\x88\x01\x01R\tavatarUrl\":\n" +
+	"avatar_url\x18\x02 \x01(\tB\b\xbaH\x05r\x03\x88\x01\x01R\tavatarUrl\x12#\n" +
+	"\btimezone\x18\x03 \x01(\tB\a\xbaH\x04r\x02\x18@R\btimezone\":\n" +
 	"\x15UpdateProfileResponse\x12!\n" +
 	"\x04user\x18\x01 \x01(\v2\r.auth.v1.UserR\x04user\"<\n" +
 	"\x12ChangeEmailRequest\x12&\n" +
@@ -2209,11 +2608,15 @@ const file_proto_auth_v1_auth_proto_rawDesc = "" +
 	"\tlinked_at\x18\a \x01(\v2\x1a.google.protobuf.TimestampR\blinkedAt\"\x1b\n" +
 	"\x19ListLinkedAccountsRequest\"R\n" +
 	"\x1aListLinkedAccountsResponse\x124\n" +
-	"\baccounts\x18\x01 \x03(\v2\x18.auth.v1.ExternalAccountR\baccounts2\xd3\x0f\n" +
+	"\baccounts\x18\x01 \x03(\v2\x18.auth.v1.ExternalAccountR\baccounts\"!\n" +
+	"\x1fRequestEmailVerificationRequest\"V\n" +
+	" RequestEmailVerificationResponse\x12\x18\n" +
+	"\asuccess\x18\x01 \x01(\bR\asuccess\x12\x18\n" +
+	"\amessage\x18\x02 \x01(\tR\amessage2\xc3\x12\n" +
 	"\vAuthService\x12n\n" +
 	"\fRequestLogin\x12\x1c.auth.v1.RequestLoginRequest\x1a\x1d.auth.v1.RequestLoginResponse\"!\x82\xd3\xe4\x93\x02\x1b:\x01*\"\x16/v1/auth/login/request\x12r\n" +
-	"\rCompleteLogin\x12\x1d.auth.v1.CompleteLoginRequest\x1a\x1e.auth.v1.CompleteLoginResponse\"\"\x82\xd3\xe4\x93\x02\x1c:\x01*\"\x17/v1/auth/login/complete\x12n\n" +
-	"\fRefreshToken\x12\x1c.auth.v1.RefreshTokenRequest\x1a\x1d.auth.v1.RefreshTokenResponse\"!\x82\xd3\xe4\x93\x02\x1b:\x01*\"\x16/v1/auth/token/refresh\x12U\n" +
+	"\rCompleteLogin\x12\x1d.auth.v1.CompleteLoginRequest\x1a\x1e.auth.v1.CompleteLoginResponse\"\"\x82\xd3\xe4\x93\x02\x1c:\x01*\"\x17/v1/auth/login/complete\x12t\n" +
+	"\x0eRefreshSession\x12\x1e.auth.v1.RefreshSessionRequest\x1a\x1f.auth.v1.RefreshSessionResponse\"!\x82\xd3\xe4\x93\x02\x1b:\x01*\"\x16/v1/auth/token/refresh\x12U\n" +
 	"\x06Logout\x12\x16.auth.v1.LogoutRequest\x1a\x17.auth.v1.LogoutResponse\"\x1a\x82\xd3\xe4\x93\x02\x14:\x01*\"\x0f/v1/auth/logout\x12_\n" +
 	"\n" +
 	"GetProfile\x12\x1a.auth.v1.GetProfileRequest\x1a\x1b.auth.v1.GetProfileResponse\"\x18\x82\xd3\xe4\x93\x02\x12\x12\x10/v1/auth/profile\x12k\n" +
@@ -2228,7 +2631,10 @@ const file_proto_auth_v1_auth_proto_rawDesc = "" +
 	"\rCompleteOAuth\x12\x1d.auth.v1.CompleteOAuthRequest\x1a\x1e.auth.v1.CompleteOAuthResponse\"\"\x82\xd3\xe4\x93\x02\x1c:\x01*\"\x17/v1/auth/oauth/callback\x12\x8b\x01\n" +
 	"\x13LinkExternalAccount\x12#.auth.v1.LinkExternalAccountRequest\x1a$.auth.v1.LinkExternalAccountResponse\")\x82\xd3\xe4\x93\x02#:\x01*\"\x1e/v1/auth/oauth/{provider}/link\x12\x90\x01\n" +
 	"\x15UnlinkExternalAccount\x12%.auth.v1.UnlinkExternalAccountRequest\x1a&.auth.v1.UnlinkExternalAccountResponse\"(\x82\xd3\xe4\x93\x02\"* /v1/auth/oauth/{provider}/unlink\x12~\n" +
-	"\x12ListLinkedAccounts\x12\".auth.v1.ListLinkedAccountsRequest\x1a#.auth.v1.ListLinkedAccountsResponse\"\x1f\x82\xd3\xe4\x93\x02\x19\x12\x17/v1/auth/oauth/accountsBHZFgithub.com/cmelgarejo/go-modulith-template/gen/go/proto/auth/v1;authv1b\x06proto3"
+	"\x12ListLinkedAccounts\x12\".auth.v1.ListLinkedAccountsRequest\x1a#.auth.v1.ListLinkedAccountsResponse\"\x1f\x82\xd3\xe4\x93\x02\x19\x12\x17/v1/auth/oauth/accounts\x12]\n" +
+	"\bRegister\x12\x18.auth.v1.RegisterRequest\x1a\x19.auth.v1.RegisterResponse\"\x1c\x82\xd3\xe4\x93\x02\x16:\x01*\"\x11/v1/auth/register\x12m\n" +
+	"\x0fGetSystemConfig\x12\x1f.auth.v1.GetSystemConfigRequest\x1a .auth.v1.GetSystemConfigResponse\"\x17\x82\xd3\xe4\x93\x02\x11\x12\x0f/v1/auth/config\x12\x99\x01\n" +
+	"\x18RequestEmailVerification\x12(.auth.v1.RequestEmailVerificationRequest\x1a).auth.v1.RequestEmailVerificationResponse\"(\x82\xd3\xe4\x93\x02\":\x01*\"\x1d/v1/auth/email/verify/requestBHZFgithub.com/cmelgarejo/go-modulith-template/gen/go/proto/auth/v1;authv1b\x06proto3"
 
 var (
 	file_proto_auth_v1_auth_proto_rawDescOnce sync.Once
@@ -2242,99 +2648,114 @@ func file_proto_auth_v1_auth_proto_rawDescGZIP() []byte {
 	return file_proto_auth_v1_auth_proto_rawDescData
 }
 
-var file_proto_auth_v1_auth_proto_msgTypes = make([]protoimpl.MessageInfo, 38)
+var file_proto_auth_v1_auth_proto_msgTypes = make([]protoimpl.MessageInfo, 45)
 var file_proto_auth_v1_auth_proto_goTypes = []any{
-	(*RequestLoginRequest)(nil),           // 0: auth.v1.RequestLoginRequest
-	(*RequestLoginResponse)(nil),          // 1: auth.v1.RequestLoginResponse
-	(*CompleteLoginRequest)(nil),          // 2: auth.v1.CompleteLoginRequest
-	(*CompleteLoginResponse)(nil),         // 3: auth.v1.CompleteLoginResponse
-	(*RefreshTokenRequest)(nil),           // 4: auth.v1.RefreshTokenRequest
-	(*RefreshTokenResponse)(nil),          // 5: auth.v1.RefreshTokenResponse
-	(*LogoutRequest)(nil),                 // 6: auth.v1.LogoutRequest
-	(*LogoutResponse)(nil),                // 7: auth.v1.LogoutResponse
-	(*User)(nil),                          // 8: auth.v1.User
-	(*GetProfileRequest)(nil),             // 9: auth.v1.GetProfileRequest
-	(*GetProfileResponse)(nil),            // 10: auth.v1.GetProfileResponse
-	(*UpdateProfileRequest)(nil),          // 11: auth.v1.UpdateProfileRequest
-	(*UpdateProfileResponse)(nil),         // 12: auth.v1.UpdateProfileResponse
-	(*ChangeEmailRequest)(nil),            // 13: auth.v1.ChangeEmailRequest
-	(*ChangeEmailResponse)(nil),           // 14: auth.v1.ChangeEmailResponse
-	(*ChangePhoneRequest)(nil),            // 15: auth.v1.ChangePhoneRequest
-	(*ChangePhoneResponse)(nil),           // 16: auth.v1.ChangePhoneResponse
-	(*Session)(nil),                       // 17: auth.v1.Session
-	(*ListSessionsRequest)(nil),           // 18: auth.v1.ListSessionsRequest
-	(*ListSessionsResponse)(nil),          // 19: auth.v1.ListSessionsResponse
-	(*RevokeSessionRequest)(nil),          // 20: auth.v1.RevokeSessionRequest
-	(*RevokeSessionResponse)(nil),         // 21: auth.v1.RevokeSessionResponse
-	(*RevokeAllSessionsRequest)(nil),      // 22: auth.v1.RevokeAllSessionsRequest
-	(*RevokeAllSessionsResponse)(nil),     // 23: auth.v1.RevokeAllSessionsResponse
-	(*OAuthProvider)(nil),                 // 24: auth.v1.OAuthProvider
-	(*GetOAuthProvidersRequest)(nil),      // 25: auth.v1.GetOAuthProvidersRequest
-	(*GetOAuthProvidersResponse)(nil),     // 26: auth.v1.GetOAuthProvidersResponse
-	(*InitiateOAuthRequest)(nil),          // 27: auth.v1.InitiateOAuthRequest
-	(*InitiateOAuthResponse)(nil),         // 28: auth.v1.InitiateOAuthResponse
-	(*CompleteOAuthRequest)(nil),          // 29: auth.v1.CompleteOAuthRequest
-	(*CompleteOAuthResponse)(nil),         // 30: auth.v1.CompleteOAuthResponse
-	(*LinkExternalAccountRequest)(nil),    // 31: auth.v1.LinkExternalAccountRequest
-	(*LinkExternalAccountResponse)(nil),   // 32: auth.v1.LinkExternalAccountResponse
-	(*UnlinkExternalAccountRequest)(nil),  // 33: auth.v1.UnlinkExternalAccountRequest
-	(*UnlinkExternalAccountResponse)(nil), // 34: auth.v1.UnlinkExternalAccountResponse
-	(*ExternalAccount)(nil),               // 35: auth.v1.ExternalAccount
-	(*ListLinkedAccountsRequest)(nil),     // 36: auth.v1.ListLinkedAccountsRequest
-	(*ListLinkedAccountsResponse)(nil),    // 37: auth.v1.ListLinkedAccountsResponse
-	(*timestamppb.Timestamp)(nil),         // 38: google.protobuf.Timestamp
+	(*GetSystemConfigRequest)(nil),           // 0: auth.v1.GetSystemConfigRequest
+	(*GetSystemConfigResponse)(nil),          // 1: auth.v1.GetSystemConfigResponse
+	(*RequestLoginRequest)(nil),              // 2: auth.v1.RequestLoginRequest
+	(*RequestLoginResponse)(nil),             // 3: auth.v1.RequestLoginResponse
+	(*CompleteLoginRequest)(nil),             // 4: auth.v1.CompleteLoginRequest
+	(*CompleteLoginResponse)(nil),            // 5: auth.v1.CompleteLoginResponse
+	(*RegisterRequest)(nil),                  // 6: auth.v1.RegisterRequest
+	(*RegisterResponse)(nil),                 // 7: auth.v1.RegisterResponse
+	(*RefreshSessionRequest)(nil),            // 8: auth.v1.RefreshSessionRequest
+	(*RefreshSessionResponse)(nil),           // 9: auth.v1.RefreshSessionResponse
+	(*LogoutRequest)(nil),                    // 10: auth.v1.LogoutRequest
+	(*LogoutResponse)(nil),                   // 11: auth.v1.LogoutResponse
+	(*User)(nil),                             // 12: auth.v1.User
+	(*GetProfileRequest)(nil),                // 13: auth.v1.GetProfileRequest
+	(*GetProfileResponse)(nil),               // 14: auth.v1.GetProfileResponse
+	(*UpdateProfileRequest)(nil),             // 15: auth.v1.UpdateProfileRequest
+	(*UpdateProfileResponse)(nil),            // 16: auth.v1.UpdateProfileResponse
+	(*ChangeEmailRequest)(nil),               // 17: auth.v1.ChangeEmailRequest
+	(*ChangeEmailResponse)(nil),              // 18: auth.v1.ChangeEmailResponse
+	(*ChangePhoneRequest)(nil),               // 19: auth.v1.ChangePhoneRequest
+	(*ChangePhoneResponse)(nil),              // 20: auth.v1.ChangePhoneResponse
+	(*Session)(nil),                          // 21: auth.v1.Session
+	(*ListSessionsRequest)(nil),              // 22: auth.v1.ListSessionsRequest
+	(*ListSessionsResponse)(nil),             // 23: auth.v1.ListSessionsResponse
+	(*RevokeSessionRequest)(nil),             // 24: auth.v1.RevokeSessionRequest
+	(*RevokeSessionResponse)(nil),            // 25: auth.v1.RevokeSessionResponse
+	(*RevokeAllSessionsRequest)(nil),         // 26: auth.v1.RevokeAllSessionsRequest
+	(*RevokeAllSessionsResponse)(nil),        // 27: auth.v1.RevokeAllSessionsResponse
+	(*OAuthProvider)(nil),                    // 28: auth.v1.OAuthProvider
+	(*GetOAuthProvidersRequest)(nil),         // 29: auth.v1.GetOAuthProvidersRequest
+	(*GetOAuthProvidersResponse)(nil),        // 30: auth.v1.GetOAuthProvidersResponse
+	(*InitiateOAuthRequest)(nil),             // 31: auth.v1.InitiateOAuthRequest
+	(*InitiateOAuthResponse)(nil),            // 32: auth.v1.InitiateOAuthResponse
+	(*CompleteOAuthRequest)(nil),             // 33: auth.v1.CompleteOAuthRequest
+	(*CompleteOAuthResponse)(nil),            // 34: auth.v1.CompleteOAuthResponse
+	(*LinkExternalAccountRequest)(nil),       // 35: auth.v1.LinkExternalAccountRequest
+	(*LinkExternalAccountResponse)(nil),      // 36: auth.v1.LinkExternalAccountResponse
+	(*UnlinkExternalAccountRequest)(nil),     // 37: auth.v1.UnlinkExternalAccountRequest
+	(*UnlinkExternalAccountResponse)(nil),    // 38: auth.v1.UnlinkExternalAccountResponse
+	(*ExternalAccount)(nil),                  // 39: auth.v1.ExternalAccount
+	(*ListLinkedAccountsRequest)(nil),        // 40: auth.v1.ListLinkedAccountsRequest
+	(*ListLinkedAccountsResponse)(nil),       // 41: auth.v1.ListLinkedAccountsResponse
+	(*RequestEmailVerificationRequest)(nil),  // 42: auth.v1.RequestEmailVerificationRequest
+	(*RequestEmailVerificationResponse)(nil), // 43: auth.v1.RequestEmailVerificationResponse
+	nil,                                      // 44: auth.v1.GetSystemConfigResponse.ConfigsEntry
+	(*timestamppb.Timestamp)(nil),            // 45: google.protobuf.Timestamp
 }
 var file_proto_auth_v1_auth_proto_depIdxs = []int32{
-	38, // 0: auth.v1.User.created_at:type_name -> google.protobuf.Timestamp
-	38, // 1: auth.v1.User.updated_at:type_name -> google.protobuf.Timestamp
-	8,  // 2: auth.v1.GetProfileResponse.user:type_name -> auth.v1.User
-	8,  // 3: auth.v1.UpdateProfileResponse.user:type_name -> auth.v1.User
-	38, // 4: auth.v1.Session.created_at:type_name -> google.protobuf.Timestamp
-	38, // 5: auth.v1.Session.last_active_at:type_name -> google.protobuf.Timestamp
-	17, // 6: auth.v1.ListSessionsResponse.sessions:type_name -> auth.v1.Session
-	24, // 7: auth.v1.GetOAuthProvidersResponse.providers:type_name -> auth.v1.OAuthProvider
-	8,  // 8: auth.v1.CompleteOAuthResponse.user:type_name -> auth.v1.User
-	38, // 9: auth.v1.ExternalAccount.linked_at:type_name -> google.protobuf.Timestamp
-	35, // 10: auth.v1.ListLinkedAccountsResponse.accounts:type_name -> auth.v1.ExternalAccount
-	0,  // 11: auth.v1.AuthService.RequestLogin:input_type -> auth.v1.RequestLoginRequest
-	2,  // 12: auth.v1.AuthService.CompleteLogin:input_type -> auth.v1.CompleteLoginRequest
-	4,  // 13: auth.v1.AuthService.RefreshToken:input_type -> auth.v1.RefreshTokenRequest
-	6,  // 14: auth.v1.AuthService.Logout:input_type -> auth.v1.LogoutRequest
-	9,  // 15: auth.v1.AuthService.GetProfile:input_type -> auth.v1.GetProfileRequest
-	11, // 16: auth.v1.AuthService.UpdateProfile:input_type -> auth.v1.UpdateProfileRequest
-	13, // 17: auth.v1.AuthService.ChangeEmail:input_type -> auth.v1.ChangeEmailRequest
-	15, // 18: auth.v1.AuthService.ChangePhone:input_type -> auth.v1.ChangePhoneRequest
-	18, // 19: auth.v1.AuthService.ListSessions:input_type -> auth.v1.ListSessionsRequest
-	20, // 20: auth.v1.AuthService.RevokeSession:input_type -> auth.v1.RevokeSessionRequest
-	22, // 21: auth.v1.AuthService.RevokeAllSessions:input_type -> auth.v1.RevokeAllSessionsRequest
-	25, // 22: auth.v1.AuthService.GetOAuthProviders:input_type -> auth.v1.GetOAuthProvidersRequest
-	27, // 23: auth.v1.AuthService.InitiateOAuth:input_type -> auth.v1.InitiateOAuthRequest
-	29, // 24: auth.v1.AuthService.CompleteOAuth:input_type -> auth.v1.CompleteOAuthRequest
-	31, // 25: auth.v1.AuthService.LinkExternalAccount:input_type -> auth.v1.LinkExternalAccountRequest
-	33, // 26: auth.v1.AuthService.UnlinkExternalAccount:input_type -> auth.v1.UnlinkExternalAccountRequest
-	36, // 27: auth.v1.AuthService.ListLinkedAccounts:input_type -> auth.v1.ListLinkedAccountsRequest
-	1,  // 28: auth.v1.AuthService.RequestLogin:output_type -> auth.v1.RequestLoginResponse
-	3,  // 29: auth.v1.AuthService.CompleteLogin:output_type -> auth.v1.CompleteLoginResponse
-	5,  // 30: auth.v1.AuthService.RefreshToken:output_type -> auth.v1.RefreshTokenResponse
-	7,  // 31: auth.v1.AuthService.Logout:output_type -> auth.v1.LogoutResponse
-	10, // 32: auth.v1.AuthService.GetProfile:output_type -> auth.v1.GetProfileResponse
-	12, // 33: auth.v1.AuthService.UpdateProfile:output_type -> auth.v1.UpdateProfileResponse
-	14, // 34: auth.v1.AuthService.ChangeEmail:output_type -> auth.v1.ChangeEmailResponse
-	16, // 35: auth.v1.AuthService.ChangePhone:output_type -> auth.v1.ChangePhoneResponse
-	19, // 36: auth.v1.AuthService.ListSessions:output_type -> auth.v1.ListSessionsResponse
-	21, // 37: auth.v1.AuthService.RevokeSession:output_type -> auth.v1.RevokeSessionResponse
-	23, // 38: auth.v1.AuthService.RevokeAllSessions:output_type -> auth.v1.RevokeAllSessionsResponse
-	26, // 39: auth.v1.AuthService.GetOAuthProviders:output_type -> auth.v1.GetOAuthProvidersResponse
-	28, // 40: auth.v1.AuthService.InitiateOAuth:output_type -> auth.v1.InitiateOAuthResponse
-	30, // 41: auth.v1.AuthService.CompleteOAuth:output_type -> auth.v1.CompleteOAuthResponse
-	32, // 42: auth.v1.AuthService.LinkExternalAccount:output_type -> auth.v1.LinkExternalAccountResponse
-	34, // 43: auth.v1.AuthService.UnlinkExternalAccount:output_type -> auth.v1.UnlinkExternalAccountResponse
-	37, // 44: auth.v1.AuthService.ListLinkedAccounts:output_type -> auth.v1.ListLinkedAccountsResponse
-	28, // [28:45] is the sub-list for method output_type
-	11, // [11:28] is the sub-list for method input_type
-	11, // [11:11] is the sub-list for extension type_name
-	11, // [11:11] is the sub-list for extension extendee
-	0,  // [0:11] is the sub-list for field type_name
+	44, // 0: auth.v1.GetSystemConfigResponse.configs:type_name -> auth.v1.GetSystemConfigResponse.ConfigsEntry
+	12, // 1: auth.v1.RegisterResponse.user:type_name -> auth.v1.User
+	45, // 2: auth.v1.User.created_at:type_name -> google.protobuf.Timestamp
+	45, // 3: auth.v1.User.updated_at:type_name -> google.protobuf.Timestamp
+	12, // 4: auth.v1.GetProfileResponse.user:type_name -> auth.v1.User
+	12, // 5: auth.v1.UpdateProfileResponse.user:type_name -> auth.v1.User
+	45, // 6: auth.v1.Session.created_at:type_name -> google.protobuf.Timestamp
+	45, // 7: auth.v1.Session.last_active_at:type_name -> google.protobuf.Timestamp
+	21, // 8: auth.v1.ListSessionsResponse.sessions:type_name -> auth.v1.Session
+	28, // 9: auth.v1.GetOAuthProvidersResponse.providers:type_name -> auth.v1.OAuthProvider
+	12, // 10: auth.v1.CompleteOAuthResponse.user:type_name -> auth.v1.User
+	45, // 11: auth.v1.ExternalAccount.linked_at:type_name -> google.protobuf.Timestamp
+	39, // 12: auth.v1.ListLinkedAccountsResponse.accounts:type_name -> auth.v1.ExternalAccount
+	2,  // 13: auth.v1.AuthService.RequestLogin:input_type -> auth.v1.RequestLoginRequest
+	4,  // 14: auth.v1.AuthService.CompleteLogin:input_type -> auth.v1.CompleteLoginRequest
+	8,  // 15: auth.v1.AuthService.RefreshSession:input_type -> auth.v1.RefreshSessionRequest
+	10, // 16: auth.v1.AuthService.Logout:input_type -> auth.v1.LogoutRequest
+	13, // 17: auth.v1.AuthService.GetProfile:input_type -> auth.v1.GetProfileRequest
+	15, // 18: auth.v1.AuthService.UpdateProfile:input_type -> auth.v1.UpdateProfileRequest
+	17, // 19: auth.v1.AuthService.ChangeEmail:input_type -> auth.v1.ChangeEmailRequest
+	19, // 20: auth.v1.AuthService.ChangePhone:input_type -> auth.v1.ChangePhoneRequest
+	22, // 21: auth.v1.AuthService.ListSessions:input_type -> auth.v1.ListSessionsRequest
+	24, // 22: auth.v1.AuthService.RevokeSession:input_type -> auth.v1.RevokeSessionRequest
+	26, // 23: auth.v1.AuthService.RevokeAllSessions:input_type -> auth.v1.RevokeAllSessionsRequest
+	29, // 24: auth.v1.AuthService.GetOAuthProviders:input_type -> auth.v1.GetOAuthProvidersRequest
+	31, // 25: auth.v1.AuthService.InitiateOAuth:input_type -> auth.v1.InitiateOAuthRequest
+	33, // 26: auth.v1.AuthService.CompleteOAuth:input_type -> auth.v1.CompleteOAuthRequest
+	35, // 27: auth.v1.AuthService.LinkExternalAccount:input_type -> auth.v1.LinkExternalAccountRequest
+	37, // 28: auth.v1.AuthService.UnlinkExternalAccount:input_type -> auth.v1.UnlinkExternalAccountRequest
+	40, // 29: auth.v1.AuthService.ListLinkedAccounts:input_type -> auth.v1.ListLinkedAccountsRequest
+	6,  // 30: auth.v1.AuthService.Register:input_type -> auth.v1.RegisterRequest
+	0,  // 31: auth.v1.AuthService.GetSystemConfig:input_type -> auth.v1.GetSystemConfigRequest
+	42, // 32: auth.v1.AuthService.RequestEmailVerification:input_type -> auth.v1.RequestEmailVerificationRequest
+	3,  // 33: auth.v1.AuthService.RequestLogin:output_type -> auth.v1.RequestLoginResponse
+	5,  // 34: auth.v1.AuthService.CompleteLogin:output_type -> auth.v1.CompleteLoginResponse
+	9,  // 35: auth.v1.AuthService.RefreshSession:output_type -> auth.v1.RefreshSessionResponse
+	11, // 36: auth.v1.AuthService.Logout:output_type -> auth.v1.LogoutResponse
+	14, // 37: auth.v1.AuthService.GetProfile:output_type -> auth.v1.GetProfileResponse
+	16, // 38: auth.v1.AuthService.UpdateProfile:output_type -> auth.v1.UpdateProfileResponse
+	18, // 39: auth.v1.AuthService.ChangeEmail:output_type -> auth.v1.ChangeEmailResponse
+	20, // 40: auth.v1.AuthService.ChangePhone:output_type -> auth.v1.ChangePhoneResponse
+	23, // 41: auth.v1.AuthService.ListSessions:output_type -> auth.v1.ListSessionsResponse
+	25, // 42: auth.v1.AuthService.RevokeSession:output_type -> auth.v1.RevokeSessionResponse
+	27, // 43: auth.v1.AuthService.RevokeAllSessions:output_type -> auth.v1.RevokeAllSessionsResponse
+	30, // 44: auth.v1.AuthService.GetOAuthProviders:output_type -> auth.v1.GetOAuthProvidersResponse
+	32, // 45: auth.v1.AuthService.InitiateOAuth:output_type -> auth.v1.InitiateOAuthResponse
+	34, // 46: auth.v1.AuthService.CompleteOAuth:output_type -> auth.v1.CompleteOAuthResponse
+	36, // 47: auth.v1.AuthService.LinkExternalAccount:output_type -> auth.v1.LinkExternalAccountResponse
+	38, // 48: auth.v1.AuthService.UnlinkExternalAccount:output_type -> auth.v1.UnlinkExternalAccountResponse
+	41, // 49: auth.v1.AuthService.ListLinkedAccounts:output_type -> auth.v1.ListLinkedAccountsResponse
+	7,  // 50: auth.v1.AuthService.Register:output_type -> auth.v1.RegisterResponse
+	1,  // 51: auth.v1.AuthService.GetSystemConfig:output_type -> auth.v1.GetSystemConfigResponse
+	43, // 52: auth.v1.AuthService.RequestEmailVerification:output_type -> auth.v1.RequestEmailVerificationResponse
+	33, // [33:53] is the sub-list for method output_type
+	13, // [13:33] is the sub-list for method input_type
+	13, // [13:13] is the sub-list for extension type_name
+	13, // [13:13] is the sub-list for extension extendee
+	0,  // [0:13] is the sub-list for field type_name
 }
 
 func init() { file_proto_auth_v1_auth_proto_init() }
@@ -2342,21 +2763,25 @@ func file_proto_auth_v1_auth_proto_init() {
 	if File_proto_auth_v1_auth_proto != nil {
 		return
 	}
-	file_proto_auth_v1_auth_proto_msgTypes[0].OneofWrappers = []any{
+	file_proto_auth_v1_auth_proto_msgTypes[2].OneofWrappers = []any{
 		(*RequestLoginRequest_Email)(nil),
 		(*RequestLoginRequest_Phone)(nil),
 	}
-	file_proto_auth_v1_auth_proto_msgTypes[2].OneofWrappers = []any{
+	file_proto_auth_v1_auth_proto_msgTypes[4].OneofWrappers = []any{
 		(*CompleteLoginRequest_Email)(nil),
 		(*CompleteLoginRequest_Phone)(nil),
 	}
+	file_proto_auth_v1_auth_proto_msgTypes[6].OneofWrappers = []any{
+		(*RegisterRequest_Email)(nil),
+		(*RegisterRequest_Phone)(nil),
+	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_proto_auth_v1_auth_proto_rawDesc), len(file_proto_auth_v1_auth_proto_rawDesc)),
 			NumEnums:      0,
-			NumMessages:   38,
+			NumMessages:   45,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/gen/go/proto/auth/v1/auth.pb.gw.go b/gen/go/proto/auth/v1/auth.pb.gw.go
index 3911bc9..c19fc3a 100644
--- a/gen/go/proto/auth/v1/auth.pb.gw.go
+++ b/gen/go/proto/auth/v1/auth.pb.gw.go
@@ -89,9 +89,9 @@ func local_request_AuthService_CompleteLogin_0(ctx context.Context, marshaler ru
 	return msg, metadata, err
 }
 
-func request_AuthService_RefreshToken_0(ctx context.Context, marshaler runtime.Marshaler, client AuthServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+func request_AuthService_RefreshSession_0(ctx context.Context, marshaler runtime.Marshaler, client AuthServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
 	var (
-		protoReq RefreshTokenRequest
+		protoReq RefreshSessionRequest
 		metadata runtime.ServerMetadata
 	)
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
@@ -100,19 +100,19 @@ func request_AuthService_RefreshToken_0(ctx context.Context, marshaler runtime.M
 	if req.Body != nil {
 		_, _ = io.Copy(io.Discard, req.Body)
 	}
-	msg, err := client.RefreshToken(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	msg, err := client.RefreshSession(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
 
-func local_request_AuthService_RefreshToken_0(ctx context.Context, marshaler runtime.Marshaler, server AuthServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+func local_request_AuthService_RefreshSession_0(ctx context.Context, marshaler runtime.Marshaler, server AuthServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
 	var (
-		protoReq RefreshTokenRequest
+		protoReq RefreshSessionRequest
 		metadata runtime.ServerMetadata
 	)
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
-	msg, err := server.RefreshToken(ctx, &protoReq)
+	msg, err := server.RefreshSession(ctx, &protoReq)
 	return msg, metadata, err
 }
 
@@ -530,6 +530,81 @@ func local_request_AuthService_ListLinkedAccounts_0(ctx context.Context, marshal
 	return msg, metadata, err
 }
 
+func request_AuthService_Register_0(ctx context.Context, marshaler runtime.Marshaler, client AuthServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq RegisterRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
+	msg, err := client.Register(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_AuthService_Register_0(ctx context.Context, marshaler runtime.Marshaler, server AuthServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq RegisterRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.Register(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_AuthService_GetSystemConfig_0(ctx context.Context, marshaler runtime.Marshaler, client AuthServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq GetSystemConfigRequest
+		metadata runtime.ServerMetadata
+	)
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
+	msg, err := client.GetSystemConfig(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_AuthService_GetSystemConfig_0(ctx context.Context, marshaler runtime.Marshaler, server AuthServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq GetSystemConfigRequest
+		metadata runtime.ServerMetadata
+	)
+	msg, err := server.GetSystemConfig(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_AuthService_RequestEmailVerification_0(ctx context.Context, marshaler runtime.Marshaler, client AuthServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq RequestEmailVerificationRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
+	msg, err := client.RequestEmailVerification(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_AuthService_RequestEmailVerification_0(ctx context.Context, marshaler runtime.Marshaler, server AuthServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq RequestEmailVerificationRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.RequestEmailVerification(ctx, &protoReq)
+	return msg, metadata, err
+}
+
 // RegisterAuthServiceHandlerServer registers the http handlers for service AuthService to "mux".
 // UnaryRPC     :call AuthServiceServer directly.
 // StreamingRPC :currently unsupported pending https://github.com/grpc/grpc-go/issues/906.
@@ -576,25 +651,25 @@ func RegisterAuthServiceHandlerServer(ctx context.Context, mux *runtime.ServeMux
 		}
 		forward_AuthService_CompleteLogin_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
 	})
-	mux.Handle(http.MethodPost, pattern_AuthService_RefreshToken_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+	mux.Handle(http.MethodPost, pattern_AuthService_RefreshSession_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
 		ctx, cancel := context.WithCancel(req.Context())
 		defer cancel()
 		var stream runtime.ServerTransportStream
 		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
 		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
-		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/auth.v1.AuthService/RefreshToken", runtime.WithHTTPPathPattern("/v1/auth/token/refresh"))
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/auth.v1.AuthService/RefreshSession", runtime.WithHTTPPathPattern("/v1/auth/token/refresh"))
 		if err != nil {
 			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
 			return
 		}
-		resp, md, err := local_request_AuthService_RefreshToken_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		resp, md, err := local_request_AuthService_RefreshSession_0(annotatedContext, inboundMarshaler, server, req, pathParams)
 		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
 		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
 		if err != nil {
 			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
 			return
 		}
-		forward_AuthService_RefreshToken_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+		forward_AuthService_RefreshSession_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
 	})
 	mux.Handle(http.MethodPost, pattern_AuthService_Logout_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
 		ctx, cancel := context.WithCancel(req.Context())
@@ -876,6 +951,66 @@ func RegisterAuthServiceHandlerServer(ctx context.Context, mux *runtime.ServeMux
 		}
 		forward_AuthService_ListLinkedAccounts_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
 	})
+	mux.Handle(http.MethodPost, pattern_AuthService_Register_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/auth.v1.AuthService/Register", runtime.WithHTTPPathPattern("/v1/auth/register"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_AuthService_Register_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_AuthService_Register_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodGet, pattern_AuthService_GetSystemConfig_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/auth.v1.AuthService/GetSystemConfig", runtime.WithHTTPPathPattern("/v1/auth/config"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_AuthService_GetSystemConfig_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_AuthService_GetSystemConfig_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_AuthService_RequestEmailVerification_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/auth.v1.AuthService/RequestEmailVerification", runtime.WithHTTPPathPattern("/v1/auth/email/verify/request"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_AuthService_RequestEmailVerification_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_AuthService_RequestEmailVerification_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
 
 	return nil
 }
@@ -950,22 +1085,22 @@ func RegisterAuthServiceHandlerClient(ctx context.Context, mux *runtime.ServeMux
 		}
 		forward_AuthService_CompleteLogin_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
 	})
-	mux.Handle(http.MethodPost, pattern_AuthService_RefreshToken_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+	mux.Handle(http.MethodPost, pattern_AuthService_RefreshSession_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
 		ctx, cancel := context.WithCancel(req.Context())
 		defer cancel()
 		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
-		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/auth.v1.AuthService/RefreshToken", runtime.WithHTTPPathPattern("/v1/auth/token/refresh"))
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/auth.v1.AuthService/RefreshSession", runtime.WithHTTPPathPattern("/v1/auth/token/refresh"))
 		if err != nil {
 			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
 			return
 		}
-		resp, md, err := request_AuthService_RefreshToken_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		resp, md, err := request_AuthService_RefreshSession_0(annotatedContext, inboundMarshaler, client, req, pathParams)
 		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
 		if err != nil {
 			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
 			return
 		}
-		forward_AuthService_RefreshToken_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+		forward_AuthService_RefreshSession_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
 	})
 	mux.Handle(http.MethodPost, pattern_AuthService_Logout_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
 		ctx, cancel := context.WithCancel(req.Context())
@@ -1205,45 +1340,102 @@ func RegisterAuthServiceHandlerClient(ctx context.Context, mux *runtime.ServeMux
 		}
 		forward_AuthService_ListLinkedAccounts_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
 	})
+	mux.Handle(http.MethodPost, pattern_AuthService_Register_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/auth.v1.AuthService/Register", runtime.WithHTTPPathPattern("/v1/auth/register"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_AuthService_Register_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_AuthService_Register_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodGet, pattern_AuthService_GetSystemConfig_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/auth.v1.AuthService/GetSystemConfig", runtime.WithHTTPPathPattern("/v1/auth/config"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_AuthService_GetSystemConfig_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_AuthService_GetSystemConfig_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_AuthService_RequestEmailVerification_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/auth.v1.AuthService/RequestEmailVerification", runtime.WithHTTPPathPattern("/v1/auth/email/verify/request"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_AuthService_RequestEmailVerification_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_AuthService_RequestEmailVerification_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
 	return nil
 }
 
 var (
-	pattern_AuthService_RequestLogin_0          = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3}, []string{"v1", "auth", "login", "request"}, ""))
-	pattern_AuthService_CompleteLogin_0         = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3}, []string{"v1", "auth", "login", "complete"}, ""))
-	pattern_AuthService_RefreshToken_0          = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3}, []string{"v1", "auth", "token", "refresh"}, ""))
-	pattern_AuthService_Logout_0                = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2}, []string{"v1", "auth", "logout"}, ""))
-	pattern_AuthService_GetProfile_0            = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2}, []string{"v1", "auth", "profile"}, ""))
-	pattern_AuthService_UpdateProfile_0         = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2}, []string{"v1", "auth", "profile"}, ""))
-	pattern_AuthService_ChangeEmail_0           = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3}, []string{"v1", "auth", "email", "change"}, ""))
-	pattern_AuthService_ChangePhone_0           = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3}, []string{"v1", "auth", "phone", "change"}, ""))
-	pattern_AuthService_ListSessions_0          = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2}, []string{"v1", "auth", "sessions"}, ""))
-	pattern_AuthService_RevokeSession_0         = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 1, 0, 4, 1, 5, 3}, []string{"v1", "auth", "sessions", "session_id"}, ""))
-	pattern_AuthService_RevokeAllSessions_0     = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3}, []string{"v1", "auth", "sessions", "revoke-all"}, ""))
-	pattern_AuthService_GetOAuthProviders_0     = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3}, []string{"v1", "auth", "oauth", "providers"}, ""))
-	pattern_AuthService_InitiateOAuth_0         = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 1, 0, 4, 1, 5, 3, 2, 4}, []string{"v1", "auth", "oauth", "provider", "start"}, ""))
-	pattern_AuthService_CompleteOAuth_0         = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3}, []string{"v1", "auth", "oauth", "callback"}, ""))
-	pattern_AuthService_LinkExternalAccount_0   = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 1, 0, 4, 1, 5, 3, 2, 4}, []string{"v1", "auth", "oauth", "provider", "link"}, ""))
-	pattern_AuthService_UnlinkExternalAccount_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 1, 0, 4, 1, 5, 3, 2, 4}, []string{"v1", "auth", "oauth", "provider", "unlink"}, ""))
-	pattern_AuthService_ListLinkedAccounts_0    = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3}, []string{"v1", "auth", "oauth", "accounts"}, ""))
+	pattern_AuthService_RequestLogin_0             = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3}, []string{"v1", "auth", "login", "request"}, ""))
+	pattern_AuthService_CompleteLogin_0            = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3}, []string{"v1", "auth", "login", "complete"}, ""))
+	pattern_AuthService_RefreshSession_0           = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3}, []string{"v1", "auth", "token", "refresh"}, ""))
+	pattern_AuthService_Logout_0                   = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2}, []string{"v1", "auth", "logout"}, ""))
+	pattern_AuthService_GetProfile_0               = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2}, []string{"v1", "auth", "profile"}, ""))
+	pattern_AuthService_UpdateProfile_0            = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2}, []string{"v1", "auth", "profile"}, ""))
+	pattern_AuthService_ChangeEmail_0              = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3}, []string{"v1", "auth", "email", "change"}, ""))
+	pattern_AuthService_ChangePhone_0              = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3}, []string{"v1", "auth", "phone", "change"}, ""))
+	pattern_AuthService_ListSessions_0             = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2}, []string{"v1", "auth", "sessions"}, ""))
+	pattern_AuthService_RevokeSession_0            = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 1, 0, 4, 1, 5, 3}, []string{"v1", "auth", "sessions", "session_id"}, ""))
+	pattern_AuthService_RevokeAllSessions_0        = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3}, []string{"v1", "auth", "sessions", "revoke-all"}, ""))
+	pattern_AuthService_GetOAuthProviders_0        = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3}, []string{"v1", "auth", "oauth", "providers"}, ""))
+	pattern_AuthService_InitiateOAuth_0            = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 1, 0, 4, 1, 5, 3, 2, 4}, []string{"v1", "auth", "oauth", "provider", "start"}, ""))
+	pattern_AuthService_CompleteOAuth_0            = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3}, []string{"v1", "auth", "oauth", "callback"}, ""))
+	pattern_AuthService_LinkExternalAccount_0      = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 1, 0, 4, 1, 5, 3, 2, 4}, []string{"v1", "auth", "oauth", "provider", "link"}, ""))
+	pattern_AuthService_UnlinkExternalAccount_0    = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 1, 0, 4, 1, 5, 3, 2, 4}, []string{"v1", "auth", "oauth", "provider", "unlink"}, ""))
+	pattern_AuthService_ListLinkedAccounts_0       = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3}, []string{"v1", "auth", "oauth", "accounts"}, ""))
+	pattern_AuthService_Register_0                 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2}, []string{"v1", "auth", "register"}, ""))
+	pattern_AuthService_GetSystemConfig_0          = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2}, []string{"v1", "auth", "config"}, ""))
+	pattern_AuthService_RequestEmailVerification_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3, 2, 4}, []string{"v1", "auth", "email", "verify", "request"}, ""))
 )
 
 var (
-	forward_AuthService_RequestLogin_0          = runtime.ForwardResponseMessage
-	forward_AuthService_CompleteLogin_0         = runtime.ForwardResponseMessage
-	forward_AuthService_RefreshToken_0          = runtime.ForwardResponseMessage
-	forward_AuthService_Logout_0                = runtime.ForwardResponseMessage
-	forward_AuthService_GetProfile_0            = runtime.ForwardResponseMessage
-	forward_AuthService_UpdateProfile_0         = runtime.ForwardResponseMessage
-	forward_AuthService_ChangeEmail_0           = runtime.ForwardResponseMessage
-	forward_AuthService_ChangePhone_0           = runtime.ForwardResponseMessage
-	forward_AuthService_ListSessions_0          = runtime.ForwardResponseMessage
-	forward_AuthService_RevokeSession_0         = runtime.ForwardResponseMessage
-	forward_AuthService_RevokeAllSessions_0     = runtime.ForwardResponseMessage
-	forward_AuthService_GetOAuthProviders_0     = runtime.ForwardResponseMessage
-	forward_AuthService_InitiateOAuth_0         = runtime.ForwardResponseMessage
-	forward_AuthService_CompleteOAuth_0         = runtime.ForwardResponseMessage
-	forward_AuthService_LinkExternalAccount_0   = runtime.ForwardResponseMessage
-	forward_AuthService_UnlinkExternalAccount_0 = runtime.ForwardResponseMessage
-	forward_AuthService_ListLinkedAccounts_0    = runtime.ForwardResponseMessage
+	forward_AuthService_RequestLogin_0             = runtime.ForwardResponseMessage
+	forward_AuthService_CompleteLogin_0            = runtime.ForwardResponseMessage
+	forward_AuthService_RefreshSession_0           = runtime.ForwardResponseMessage
+	forward_AuthService_Logout_0                   = runtime.ForwardResponseMessage
+	forward_AuthService_GetProfile_0               = runtime.ForwardResponseMessage
+	forward_AuthService_UpdateProfile_0            = runtime.ForwardResponseMessage
+	forward_AuthService_ChangeEmail_0              = runtime.ForwardResponseMessage
+	forward_AuthService_ChangePhone_0              = runtime.ForwardResponseMessage
+	forward_AuthService_ListSessions_0             = runtime.ForwardResponseMessage
+	forward_AuthService_RevokeSession_0            = runtime.ForwardResponseMessage
+	forward_AuthService_RevokeAllSessions_0        = runtime.ForwardResponseMessage
+	forward_AuthService_GetOAuthProviders_0        = runtime.ForwardResponseMessage
+	forward_AuthService_InitiateOAuth_0            = runtime.ForwardResponseMessage
+	forward_AuthService_CompleteOAuth_0            = runtime.ForwardResponseMessage
+	forward_AuthService_LinkExternalAccount_0      = runtime.ForwardResponseMessage
+	forward_AuthService_UnlinkExternalAccount_0    = runtime.ForwardResponseMessage
+	forward_AuthService_ListLinkedAccounts_0       = runtime.ForwardResponseMessage
+	forward_AuthService_Register_0                 = runtime.ForwardResponseMessage
+	forward_AuthService_GetSystemConfig_0          = runtime.ForwardResponseMessage
+	forward_AuthService_RequestEmailVerification_0 = runtime.ForwardResponseMessage
 )
diff --git a/gen/go/proto/auth/v1/auth_grpc.pb.go b/gen/go/proto/auth/v1/auth_grpc.pb.go
index 087d61b..49b078b 100644
--- a/gen/go/proto/auth/v1/auth_grpc.pb.go
+++ b/gen/go/proto/auth/v1/auth_grpc.pb.go
@@ -19,23 +19,26 @@ import (
 const _ = grpc.SupportPackageIsVersion9
 
 const (
-	AuthService_RequestLogin_FullMethodName          = "/auth.v1.AuthService/RequestLogin"
-	AuthService_CompleteLogin_FullMethodName         = "/auth.v1.AuthService/CompleteLogin"
-	AuthService_RefreshToken_FullMethodName          = "/auth.v1.AuthService/RefreshToken"
-	AuthService_Logout_FullMethodName                = "/auth.v1.AuthService/Logout"
-	AuthService_GetProfile_FullMethodName            = "/auth.v1.AuthService/GetProfile"
-	AuthService_UpdateProfile_FullMethodName         = "/auth.v1.AuthService/UpdateProfile"
-	AuthService_ChangeEmail_FullMethodName           = "/auth.v1.AuthService/ChangeEmail"
-	AuthService_ChangePhone_FullMethodName           = "/auth.v1.AuthService/ChangePhone"
-	AuthService_ListSessions_FullMethodName          = "/auth.v1.AuthService/ListSessions"
-	AuthService_RevokeSession_FullMethodName         = "/auth.v1.AuthService/RevokeSession"
-	AuthService_RevokeAllSessions_FullMethodName     = "/auth.v1.AuthService/RevokeAllSessions"
-	AuthService_GetOAuthProviders_FullMethodName     = "/auth.v1.AuthService/GetOAuthProviders"
-	AuthService_InitiateOAuth_FullMethodName         = "/auth.v1.AuthService/InitiateOAuth"
-	AuthService_CompleteOAuth_FullMethodName         = "/auth.v1.AuthService/CompleteOAuth"
-	AuthService_LinkExternalAccount_FullMethodName   = "/auth.v1.AuthService/LinkExternalAccount"
-	AuthService_UnlinkExternalAccount_FullMethodName = "/auth.v1.AuthService/UnlinkExternalAccount"
-	AuthService_ListLinkedAccounts_FullMethodName    = "/auth.v1.AuthService/ListLinkedAccounts"
+	AuthService_RequestLogin_FullMethodName             = "/auth.v1.AuthService/RequestLogin"
+	AuthService_CompleteLogin_FullMethodName            = "/auth.v1.AuthService/CompleteLogin"
+	AuthService_RefreshSession_FullMethodName           = "/auth.v1.AuthService/RefreshSession"
+	AuthService_Logout_FullMethodName                   = "/auth.v1.AuthService/Logout"
+	AuthService_GetProfile_FullMethodName               = "/auth.v1.AuthService/GetProfile"
+	AuthService_UpdateProfile_FullMethodName            = "/auth.v1.AuthService/UpdateProfile"
+	AuthService_ChangeEmail_FullMethodName              = "/auth.v1.AuthService/ChangeEmail"
+	AuthService_ChangePhone_FullMethodName              = "/auth.v1.AuthService/ChangePhone"
+	AuthService_ListSessions_FullMethodName             = "/auth.v1.AuthService/ListSessions"
+	AuthService_RevokeSession_FullMethodName            = "/auth.v1.AuthService/RevokeSession"
+	AuthService_RevokeAllSessions_FullMethodName        = "/auth.v1.AuthService/RevokeAllSessions"
+	AuthService_GetOAuthProviders_FullMethodName        = "/auth.v1.AuthService/GetOAuthProviders"
+	AuthService_InitiateOAuth_FullMethodName            = "/auth.v1.AuthService/InitiateOAuth"
+	AuthService_CompleteOAuth_FullMethodName            = "/auth.v1.AuthService/CompleteOAuth"
+	AuthService_LinkExternalAccount_FullMethodName      = "/auth.v1.AuthService/LinkExternalAccount"
+	AuthService_UnlinkExternalAccount_FullMethodName    = "/auth.v1.AuthService/UnlinkExternalAccount"
+	AuthService_ListLinkedAccounts_FullMethodName       = "/auth.v1.AuthService/ListLinkedAccounts"
+	AuthService_Register_FullMethodName                 = "/auth.v1.AuthService/Register"
+	AuthService_GetSystemConfig_FullMethodName          = "/auth.v1.AuthService/GetSystemConfig"
+	AuthService_RequestEmailVerification_FullMethodName = "/auth.v1.AuthService/RequestEmailVerification"
 )
 
 // AuthServiceClient is the client API for AuthService service.
@@ -46,8 +49,8 @@ type AuthServiceClient interface {
 	RequestLogin(ctx context.Context, in *RequestLoginRequest, opts ...grpc.CallOption) (*RequestLoginResponse, error)
 	// CompleteLogin keeps the code and verifies it to return a token
 	CompleteLogin(ctx context.Context, in *CompleteLoginRequest, opts ...grpc.CallOption) (*CompleteLoginResponse, error)
-	// RefreshToken exchanges a refresh token for a new access token
-	RefreshToken(ctx context.Context, in *RefreshTokenRequest, opts ...grpc.CallOption) (*RefreshTokenResponse, error)
+	// RefreshSession exchanges a refresh token for a new access token
+	RefreshSession(ctx context.Context, in *RefreshSessionRequest, opts ...grpc.CallOption) (*RefreshSessionResponse, error)
 	// Logout invalidates the current session and blacklists the token
 	Logout(ctx context.Context, in *LogoutRequest, opts ...grpc.CallOption) (*LogoutResponse, error)
 	// GetProfile returns the current user's profile (requires authentication)
@@ -76,6 +79,12 @@ type AuthServiceClient interface {
 	UnlinkExternalAccount(ctx context.Context, in *UnlinkExternalAccountRequest, opts ...grpc.CallOption) (*UnlinkExternalAccountResponse, error)
 	// ListLinkedAccounts returns the external accounts linked to the current user (requires auth)
 	ListLinkedAccounts(ctx context.Context, in *ListLinkedAccountsRequest, opts ...grpc.CallOption) (*ListLinkedAccountsResponse, error)
+	// Register creates a new user account
+	Register(ctx context.Context, in *RegisterRequest, opts ...grpc.CallOption) (*RegisterResponse, error)
+	// GetSystemConfig returns public system configurations and feature flags
+	GetSystemConfig(ctx context.Context, in *GetSystemConfigRequest, opts ...grpc.CallOption) (*GetSystemConfigResponse, error)
+	// RequestEmailVerification initiates the email verification process
+	RequestEmailVerification(ctx context.Context, in *RequestEmailVerificationRequest, opts ...grpc.CallOption) (*RequestEmailVerificationResponse, error)
 }
 
 type authServiceClient struct {
@@ -106,10 +115,10 @@ func (c *authServiceClient) CompleteLogin(ctx context.Context, in *CompleteLogin
 	return out, nil
 }
 
-func (c *authServiceClient) RefreshToken(ctx context.Context, in *RefreshTokenRequest, opts ...grpc.CallOption) (*RefreshTokenResponse, error) {
+func (c *authServiceClient) RefreshSession(ctx context.Context, in *RefreshSessionRequest, opts ...grpc.CallOption) (*RefreshSessionResponse, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(RefreshTokenResponse)
-	err := c.cc.Invoke(ctx, AuthService_RefreshToken_FullMethodName, in, out, cOpts...)
+	out := new(RefreshSessionResponse)
+	err := c.cc.Invoke(ctx, AuthService_RefreshSession_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -256,6 +265,36 @@ func (c *authServiceClient) ListLinkedAccounts(ctx context.Context, in *ListLink
 	return out, nil
 }
 
+func (c *authServiceClient) Register(ctx context.Context, in *RegisterRequest, opts ...grpc.CallOption) (*RegisterResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(RegisterResponse)
+	err := c.cc.Invoke(ctx, AuthService_Register_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *authServiceClient) GetSystemConfig(ctx context.Context, in *GetSystemConfigRequest, opts ...grpc.CallOption) (*GetSystemConfigResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(GetSystemConfigResponse)
+	err := c.cc.Invoke(ctx, AuthService_GetSystemConfig_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *authServiceClient) RequestEmailVerification(ctx context.Context, in *RequestEmailVerificationRequest, opts ...grpc.CallOption) (*RequestEmailVerificationResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(RequestEmailVerificationResponse)
+	err := c.cc.Invoke(ctx, AuthService_RequestEmailVerification_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 // AuthServiceServer is the server API for AuthService service.
 // All implementations must embed UnimplementedAuthServiceServer
 // for forward compatibility.
@@ -264,8 +303,8 @@ type AuthServiceServer interface {
 	RequestLogin(context.Context, *RequestLoginRequest) (*RequestLoginResponse, error)
 	// CompleteLogin keeps the code and verifies it to return a token
 	CompleteLogin(context.Context, *CompleteLoginRequest) (*CompleteLoginResponse, error)
-	// RefreshToken exchanges a refresh token for a new access token
-	RefreshToken(context.Context, *RefreshTokenRequest) (*RefreshTokenResponse, error)
+	// RefreshSession exchanges a refresh token for a new access token
+	RefreshSession(context.Context, *RefreshSessionRequest) (*RefreshSessionResponse, error)
 	// Logout invalidates the current session and blacklists the token
 	Logout(context.Context, *LogoutRequest) (*LogoutResponse, error)
 	// GetProfile returns the current user's profile (requires authentication)
@@ -294,6 +333,12 @@ type AuthServiceServer interface {
 	UnlinkExternalAccount(context.Context, *UnlinkExternalAccountRequest) (*UnlinkExternalAccountResponse, error)
 	// ListLinkedAccounts returns the external accounts linked to the current user (requires auth)
 	ListLinkedAccounts(context.Context, *ListLinkedAccountsRequest) (*ListLinkedAccountsResponse, error)
+	// Register creates a new user account
+	Register(context.Context, *RegisterRequest) (*RegisterResponse, error)
+	// GetSystemConfig returns public system configurations and feature flags
+	GetSystemConfig(context.Context, *GetSystemConfigRequest) (*GetSystemConfigResponse, error)
+	// RequestEmailVerification initiates the email verification process
+	RequestEmailVerification(context.Context, *RequestEmailVerificationRequest) (*RequestEmailVerificationResponse, error)
 	mustEmbedUnimplementedAuthServiceServer()
 }
 
@@ -310,8 +355,8 @@ func (UnimplementedAuthServiceServer) RequestLogin(context.Context, *RequestLogi
 func (UnimplementedAuthServiceServer) CompleteLogin(context.Context, *CompleteLoginRequest) (*CompleteLoginResponse, error) {
 	return nil, status.Error(codes.Unimplemented, "method CompleteLogin not implemented")
 }
-func (UnimplementedAuthServiceServer) RefreshToken(context.Context, *RefreshTokenRequest) (*RefreshTokenResponse, error) {
-	return nil, status.Error(codes.Unimplemented, "method RefreshToken not implemented")
+func (UnimplementedAuthServiceServer) RefreshSession(context.Context, *RefreshSessionRequest) (*RefreshSessionResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method RefreshSession not implemented")
 }
 func (UnimplementedAuthServiceServer) Logout(context.Context, *LogoutRequest) (*LogoutResponse, error) {
 	return nil, status.Error(codes.Unimplemented, "method Logout not implemented")
@@ -355,6 +400,15 @@ func (UnimplementedAuthServiceServer) UnlinkExternalAccount(context.Context, *Un
 func (UnimplementedAuthServiceServer) ListLinkedAccounts(context.Context, *ListLinkedAccountsRequest) (*ListLinkedAccountsResponse, error) {
 	return nil, status.Error(codes.Unimplemented, "method ListLinkedAccounts not implemented")
 }
+func (UnimplementedAuthServiceServer) Register(context.Context, *RegisterRequest) (*RegisterResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method Register not implemented")
+}
+func (UnimplementedAuthServiceServer) GetSystemConfig(context.Context, *GetSystemConfigRequest) (*GetSystemConfigResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method GetSystemConfig not implemented")
+}
+func (UnimplementedAuthServiceServer) RequestEmailVerification(context.Context, *RequestEmailVerificationRequest) (*RequestEmailVerificationResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method RequestEmailVerification not implemented")
+}
 func (UnimplementedAuthServiceServer) mustEmbedUnimplementedAuthServiceServer() {}
 func (UnimplementedAuthServiceServer) testEmbeddedByValue()                     {}
 
@@ -412,20 +466,20 @@ func _AuthService_CompleteLogin_Handler(srv interface{}, ctx context.Context, de
 	return interceptor(ctx, in, info, handler)
 }
 
-func _AuthService_RefreshToken_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(RefreshTokenRequest)
+func _AuthService_RefreshSession_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(RefreshSessionRequest)
 	if err := dec(in); err != nil {
 		return nil, err
 	}
 	if interceptor == nil {
-		return srv.(AuthServiceServer).RefreshToken(ctx, in)
+		return srv.(AuthServiceServer).RefreshSession(ctx, in)
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: AuthService_RefreshToken_FullMethodName,
+		FullMethod: AuthService_RefreshSession_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(AuthServiceServer).RefreshToken(ctx, req.(*RefreshTokenRequest))
+		return srv.(AuthServiceServer).RefreshSession(ctx, req.(*RefreshSessionRequest))
 	}
 	return interceptor(ctx, in, info, handler)
 }
@@ -682,6 +736,60 @@ func _AuthService_ListLinkedAccounts_Handler(srv interface{}, ctx context.Contex
 	return interceptor(ctx, in, info, handler)
 }
 
+func _AuthService_Register_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(RegisterRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(AuthServiceServer).Register(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: AuthService_Register_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(AuthServiceServer).Register(ctx, req.(*RegisterRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _AuthService_GetSystemConfig_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetSystemConfigRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(AuthServiceServer).GetSystemConfig(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: AuthService_GetSystemConfig_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(AuthServiceServer).GetSystemConfig(ctx, req.(*GetSystemConfigRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _AuthService_RequestEmailVerification_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(RequestEmailVerificationRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(AuthServiceServer).RequestEmailVerification(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: AuthService_RequestEmailVerification_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(AuthServiceServer).RequestEmailVerification(ctx, req.(*RequestEmailVerificationRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 // AuthService_ServiceDesc is the grpc.ServiceDesc for AuthService service.
 // It's only intended for direct use with grpc.RegisterService,
 // and not to be introspected or modified (even as a copy)
@@ -698,8 +806,8 @@ var AuthService_ServiceDesc = grpc.ServiceDesc{
 			Handler:    _AuthService_CompleteLogin_Handler,
 		},
 		{
-			MethodName: "RefreshToken",
-			Handler:    _AuthService_RefreshToken_Handler,
+			MethodName: "RefreshSession",
+			Handler:    _AuthService_RefreshSession_Handler,
 		},
 		{
 			MethodName: "Logout",
@@ -757,6 +865,18 @@ var AuthService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "ListLinkedAccounts",
 			Handler:    _AuthService_ListLinkedAccounts_Handler,
 		},
+		{
+			MethodName: "Register",
+			Handler:    _AuthService_Register_Handler,
+		},
+		{
+			MethodName: "GetSystemConfig",
+			Handler:    _AuthService_GetSystemConfig_Handler,
+		},
+		{
+			MethodName: "RequestEmailVerification",
+			Handler:    _AuthService_RequestEmailVerification_Handler,
+		},
 	},
 	Streams:  []grpc.StreamDesc{},
 	Metadata: "proto/auth/v1/auth.proto",
diff --git a/gen/openapiv2/proto/auth/v1/auth.swagger.json b/gen/openapiv2/proto/auth/v1/auth.swagger.json
index 470ca35..f268657 100644
--- a/gen/openapiv2/proto/auth/v1/auth.swagger.json
+++ b/gen/openapiv2/proto/auth/v1/auth.swagger.json
@@ -16,6 +16,29 @@
     "application/json"
   ],
   "paths": {
+    "/v1/auth/config": {
+      "get": {
+        "summary": "GetSystemConfig returns public system configurations and feature flags",
+        "operationId": "AuthService_GetSystemConfig",
+        "responses": {
+          "200": {
+            "description": "A successful response.",
+            "schema": {
+              "$ref": "#/definitions/v1GetSystemConfigResponse"
+            }
+          },
+          "default": {
+            "description": "An unexpected error response.",
+            "schema": {
+              "$ref": "#/definitions/rpcStatus"
+            }
+          }
+        },
+        "tags": [
+          "AuthService"
+        ]
+      }
+    },
     "/v1/auth/email/change": {
       "post": {
         "summary": "ChangeEmail initiates email change by sending verification to new email",
@@ -49,6 +72,39 @@
         ]
       }
     },
+    "/v1/auth/email/verify/request": {
+      "post": {
+        "summary": "RequestEmailVerification initiates the email verification process",
+        "operationId": "AuthService_RequestEmailVerification",
+        "responses": {
+          "200": {
+            "description": "A successful response.",
+            "schema": {
+              "$ref": "#/definitions/v1RequestEmailVerificationResponse"
+            }
+          },
+          "default": {
+            "description": "An unexpected error response.",
+            "schema": {
+              "$ref": "#/definitions/rpcStatus"
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "body",
+            "in": "body",
+            "required": true,
+            "schema": {
+              "$ref": "#/definitions/v1RequestEmailVerificationRequest"
+            }
+          }
+        ],
+        "tags": [
+          "AuthService"
+        ]
+      }
+    },
     "/v1/auth/login/complete": {
       "post": {
         "summary": "CompleteLogin keeps the code and verifies it to return a token",
@@ -425,6 +481,39 @@
         ]
       }
     },
+    "/v1/auth/register": {
+      "post": {
+        "summary": "Register creates a new user account",
+        "operationId": "AuthService_Register",
+        "responses": {
+          "200": {
+            "description": "A successful response.",
+            "schema": {
+              "$ref": "#/definitions/v1RegisterResponse"
+            }
+          },
+          "default": {
+            "description": "An unexpected error response.",
+            "schema": {
+              "$ref": "#/definitions/rpcStatus"
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "body",
+            "in": "body",
+            "required": true,
+            "schema": {
+              "$ref": "#/definitions/v1RegisterRequest"
+            }
+          }
+        ],
+        "tags": [
+          "AuthService"
+        ]
+      }
+    },
     "/v1/auth/sessions": {
       "get": {
         "summary": "ListSessions returns all active sessions for the current user",
@@ -514,13 +603,13 @@
     },
     "/v1/auth/token/refresh": {
       "post": {
-        "summary": "RefreshToken exchanges a refresh token for a new access token",
-        "operationId": "AuthService_RefreshToken",
+        "summary": "RefreshSession exchanges a refresh token for a new access token",
+        "operationId": "AuthService_RefreshSession",
         "responses": {
           "200": {
             "description": "A successful response.",
             "schema": {
-              "$ref": "#/definitions/v1RefreshTokenResponse"
+              "$ref": "#/definitions/v1RefreshSessionResponse"
             }
           },
           "default": {
@@ -533,10 +622,11 @@
         "parameters": [
           {
             "name": "body",
+            "description": "refresh_token may be empty when using HttpOnly cookie (cookie takes precedence).",
             "in": "body",
             "required": true,
             "schema": {
-              "$ref": "#/definitions/v1RefreshTokenRequest"
+              "$ref": "#/definitions/v1RefreshSessionRequest"
             }
           }
         ],
@@ -750,6 +840,17 @@
         }
       }
     },
+    "v1GetSystemConfigResponse": {
+      "type": "object",
+      "properties": {
+        "configs": {
+          "type": "object",
+          "additionalProperties": {
+            "type": "string"
+          }
+        }
+      }
+    },
     "v1InitiateOAuthResponse": {
       "type": "object",
       "properties": {
@@ -834,15 +935,16 @@
         }
       }
     },
-    "v1RefreshTokenRequest": {
+    "v1RefreshSessionRequest": {
       "type": "object",
       "properties": {
         "refreshToken": {
           "type": "string"
         }
-      }
+      },
+      "description": "refresh_token may be empty when using HttpOnly cookie (cookie takes precedence)."
     },
-    "v1RefreshTokenResponse": {
+    "v1RefreshSessionResponse": {
       "type": "object",
       "properties": {
         "accessToken": {
@@ -857,6 +959,57 @@
         }
       }
     },
+    "v1RegisterRequest": {
+      "type": "object",
+      "properties": {
+        "email": {
+          "type": "string"
+        },
+        "phone": {
+          "type": "string"
+        },
+        "displayName": {
+          "type": "string"
+        },
+        "nationality": {
+          "type": "string"
+        },
+        "documentType": {
+          "type": "string"
+        },
+        "documentNumber": {
+          "type": "string"
+        }
+      }
+    },
+    "v1RegisterResponse": {
+      "type": "object",
+      "properties": {
+        "success": {
+          "type": "boolean"
+        },
+        "message": {
+          "type": "string"
+        },
+        "user": {
+          "$ref": "#/definitions/v1User"
+        }
+      }
+    },
+    "v1RequestEmailVerificationRequest": {
+      "type": "object"
+    },
+    "v1RequestEmailVerificationResponse": {
+      "type": "object",
+      "properties": {
+        "success": {
+          "type": "boolean"
+        },
+        "message": {
+          "type": "string"
+        }
+      }
+    },
     "v1RequestLoginRequest": {
       "type": "object",
       "properties": {
@@ -954,6 +1107,9 @@
         },
         "avatarUrl": {
           "type": "string"
+        },
+        "timezone": {
+          "type": "string"
         }
       }
     },
@@ -990,6 +1146,15 @@
         "updatedAt": {
           "type": "string",
           "format": "date-time"
+        },
+        "emailVerified": {
+          "type": "boolean"
+        },
+        "phoneVerified": {
+          "type": "boolean"
+        },
+        "timezone": {
+          "type": "string"
         }
       }
     }
diff --git a/go.mod b/go.mod
index e2ab517..b26ffa8 100644
--- a/go.mod
+++ b/go.mod
@@ -20,7 +20,7 @@ require (
 	github.com/markbates/goth v1.82.0
 	github.com/nicksnyder/go-i18n/v2 v2.6.1
 	github.com/prometheus/client_golang v1.23.2
-	github.com/sqlc-dev/pqtype v0.3.0
+	github.com/redis/go-redis/v9 v9.18.0
 	github.com/stretchr/testify v1.11.1
 	github.com/testcontainers/testcontainers-go v0.40.0
 	github.com/testcontainers/testcontainers-go/modules/postgres v0.40.0
@@ -34,6 +34,7 @@ require (
 	go.opentelemetry.io/otel/sdk/metric v1.39.0
 	go.opentelemetry.io/otel/trace v1.39.0
 	go.uber.org/mock v0.6.0
+	golang.org/x/sync v0.19.0
 	golang.org/x/text v0.32.0
 	golang.org/x/time v0.14.0
 	google.golang.org/genproto/googleapis/api v0.0.0-20251222181119-0a764e51fe1b
@@ -71,6 +72,7 @@ require (
 	github.com/cpuguy83/dockercfg v0.3.2 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/decred/dcrd/dcrec/secp256k1/v4 v4.2.0 // indirect
+	github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
 	github.com/distribution/reference v0.6.0 // indirect
 	github.com/docker/docker v28.5.1+incompatible // indirect
 	github.com/docker/go-connections v0.6.0 // indirect
@@ -89,6 +91,7 @@ require (
 	github.com/gorilla/mux v1.7.4 // indirect
 	github.com/gorilla/securecookie v1.1.1 // indirect
 	github.com/gorilla/sessions v1.1.1 // indirect
+	github.com/jackc/pgerrcode v0.0.0-20220416144525-469b46aa5efa // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
 	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
 	github.com/jackc/puddle/v2 v2.2.2 // indirect
@@ -132,12 +135,12 @@ require (
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.39.0 // indirect
 	go.opentelemetry.io/proto/otlp v1.9.0 // indirect
+	go.uber.org/atomic v1.11.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.3 // indirect
 	golang.org/x/crypto v0.45.0 // indirect
 	golang.org/x/exp v0.0.0-20250813145105-42675adae3e6 // indirect
 	golang.org/x/net v0.47.0 // indirect
 	golang.org/x/oauth2 v0.34.0 // indirect
-	golang.org/x/sync v0.19.0 // indirect
 	golang.org/x/sys v0.39.0 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20251222181119-0a764e51fe1b // indirect
 )
diff --git a/go.sum b/go.sum
index d97f5fa..432c6bf 100644
--- a/go.sum
+++ b/go.sum
@@ -54,6 +54,10 @@ github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/brianvoe/gofakeit/v6 v6.28.0 h1:Xib46XXuQfmlLS2EXRuJpqcw8St6qSZz75OUo0tgAW4=
 github.com/brianvoe/gofakeit/v6 v6.28.0/go.mod h1:Xj58BMSnFqcn/fAQeSK+/PLtC5kSb7FJIq4JyGa8vEs=
+github.com/bsm/ginkgo/v2 v2.12.0 h1:Ny8MWAHyOepLGlLKYmXG4IEkioBysk6GpaRTLC8zwWs=
+github.com/bsm/ginkgo/v2 v2.12.0/go.mod h1:SwYbGRRDovPVboqFv0tPTcG1sN61LM1Z4ARdbAV9g4c=
+github.com/bsm/gomega v1.27.10 h1:yeMWxP2pV2fG3FgAODIY8EiRE3dy0aeFYt4l7wh6yKA=
+github.com/bsm/gomega v1.27.10/go.mod h1:JyEr/xRbxbtgWNi8tIEVPUYZ5Dzef52k01W3YH0H+O0=
 github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
 github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
 github.com/cenkalti/backoff/v5 v5.0.3 h1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM=
@@ -79,6 +83,8 @@ github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8Yc
 github.com/decred/dcrd/crypto/blake256 v1.0.1/go.mod h1:2OfgNZ5wDpcsFmHmCK5gZTPcCXqlm2ArzUIkw9czNJo=
 github.com/decred/dcrd/dcrec/secp256k1/v4 v4.2.0 h1:8UrgZ3GkP4i/CLijOJx79Yu+etlyjdBU4sfcs2WYQMs=
 github.com/decred/dcrd/dcrec/secp256k1/v4 v4.2.0/go.mod h1:v57UDF4pDQJcEfFUCRop3lJL149eHGSe9Jvczhzjo/0=
+github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f h1:lO4WD4F/rVNCu3HqELle0jiPLLBs70cWOduZpkS1E78=
+github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f/go.mod h1:cuUVRXasLTGF7a8hSLbxyZXjz+1KgoB3wDUb6vlszIc=
 github.com/dhui/dktest v0.4.6 h1:+DPKyScKSEp3VLtbMDHcUq6V5Lm5zfZZVb0Sk7Ahom4=
 github.com/dhui/dktest v0.4.6/go.mod h1:JHTSYDtKkvFNFHJKqCzVzqXecyv+tKt8EzceOmQOgbU=
 github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
@@ -135,6 +141,8 @@ github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aN
 github.com/gorilla/websocket v1.5.3/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.4 h1:kEISI/Gx67NzH3nJxAmY/dGac80kKZgZt134u7Y/k1s=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.4/go.mod h1:6Nz966r3vQYCqIzWsuEl9d7cf7mRhtDmm++sOxlnfxI=
+github.com/jackc/pgerrcode v0.0.0-20220416144525-469b46aa5efa h1:s+4MhCQ6YrzisK6hFJUX53drDT4UsSW3DEhKn0ifuHw=
+github.com/jackc/pgerrcode v0.0.0-20220416144525-469b46aa5efa/go.mod h1:a/s9Lp5W7n/DD0VrVoyJ00FbP2ytTPDVOivvn2bMlds=
 github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM=
 github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
 github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo=
@@ -147,6 +155,8 @@ github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0=
 github.com/joho/godotenv v1.5.1/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4=
 github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
 github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
+github.com/klauspost/cpuid/v2 v2.0.9 h1:lgaqFMSdTdQYdZ04uHyN2d/eKdOMyi2YLSvlQIBFYa4=
+github.com/klauspost/cpuid/v2 v2.0.9/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
@@ -223,6 +233,8 @@ github.com/prometheus/otlptranslator v1.0.0 h1:s0LJW/iN9dkIH+EnhiD3BlkkP5QVIUVEo
 github.com/prometheus/otlptranslator v1.0.0/go.mod h1:vRYWnXvI6aWGpsdY/mOT/cbeVRBlPWtBNDb7kGR3uKM=
 github.com/prometheus/procfs v0.19.2 h1:zUMhqEW66Ex7OXIiDkll3tl9a1ZdilUOd/F6ZXw4Vws=
 github.com/prometheus/procfs v0.19.2/go.mod h1:M0aotyiemPhBCM0z5w87kL22CxfcH05ZpYlu+b4J7mw=
+github.com/redis/go-redis/v9 v9.18.0 h1:pMkxYPkEbMPwRdenAzUNyFNrDgHx9U+DrBabWNfSRQs=
+github.com/redis/go-redis/v9 v9.18.0/go.mod h1:k3ufPphLU5YXwNTUcCRXGxUoF1fqxnhFQmscfkCoDA0=
 github.com/rodaine/protogofakeit v0.1.1 h1:ZKouljuRM3A+TArppfBqnH8tGZHOwM/pjvtXe9DaXH8=
 github.com/rodaine/protogofakeit v0.1.1/go.mod h1:pXn/AstBYMaSfc1/RqH3N82pBuxtWgejz1AlYpY1mI0=
 github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
@@ -231,8 +243,6 @@ github.com/shirou/gopsutil/v4 v4.25.6 h1:kLysI2JsKorfaFPcYmcJqbzROzsBWEOAtw6A7dI
 github.com/shirou/gopsutil/v4 v4.25.6/go.mod h1:PfybzyydfZcN+JMMjkF6Zb8Mq1A/VcogFFg7hj50W9c=
 github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
 github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
-github.com/sqlc-dev/pqtype v0.3.0 h1:b09TewZ3cSnO5+M1Kqq05y0+OjqIptxELaSayg7bmqk=
-github.com/sqlc-dev/pqtype v0.3.0/go.mod h1:oyUjp5981ctiL9UYvj1bVvCKi8OXkCa0u645hce7CAs=
 github.com/stoewer/go-strcase v1.3.1 h1:iS0MdW+kVTxgMoE1LAZyMiYJFKlOzLooE4MxjirtkAs=
 github.com/stoewer/go-strcase v1.3.1/go.mod h1:fAH5hQ5pehh+j3nZfvwdk2RgEgQjAoM8wodgtPmh1xo=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
@@ -261,6 +271,8 @@ github.com/tklauser/numcpus v0.6.1/go.mod h1:1XfjsgE2zo8GVw7POkMbHENHzVg3GzmoZ9f
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo0=
 github.com/yusufpapurcu/wmi v1.2.4/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
+github.com/zeebo/xxh3 v1.0.2 h1:xZmwmqxHZA8AI603jOQ0tMqmBr9lPeFwGg6d+xy9DC0=
+github.com/zeebo/xxh3 v1.0.2/go.mod h1:5NWz9Sef7zIDm2JHfFlcQvNekmcEl9ekUZQQKCYaDcA=
 go.jetify.com/typeid v1.3.0 h1:fuWV7oxO4mSsgpxwhaVpFXgt0IfjogR29p+XAjDCVKY=
 go.jetify.com/typeid v1.3.0/go.mod h1:CtVGyt2+TSp4Rq5+ARLvGsJqdNypKBAC6INQ9TLPlmk=
 go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
@@ -289,6 +301,8 @@ go.opentelemetry.io/otel/trace v1.39.0 h1:2d2vfpEDmCJ5zVYz7ijaJdOF59xLomrvj7bjt6
 go.opentelemetry.io/otel/trace v1.39.0/go.mod h1:88w4/PnZSazkGzz/w84VHpQafiU4EtqqlVdxWy+rNOA=
 go.opentelemetry.io/proto/otlp v1.9.0 h1:l706jCMITVouPOqEnii2fIAuO3IVGBRPV5ICjceRb/A=
 go.opentelemetry.io/proto/otlp v1.9.0/go.mod h1:xE+Cx5E/eEHw+ISFkwPLwCZefwVjY+pqKg1qcK03+/4=
+go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=
+go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.uber.org/mock v0.6.0 h1:hyF9dfmbgIX5EfOdasqLsWD6xqpNZlXblLB/Dbnwv3Y=
diff --git a/internal/admin/tasks/cleanup_magic_codes.go b/internal/admin/tasks/cleanup_magic_codes.go
index 4f6b68b..efbfaa4 100644
--- a/internal/admin/tasks/cleanup_magic_codes.go
+++ b/internal/admin/tasks/cleanup_magic_codes.go
@@ -3,20 +3,20 @@ package tasks
 
 import (
 	"context"
-	"database/sql"
 	"fmt"
 	"log/slog"
 
 	"github.com/cmelgarejo/go-modulith-template/internal/admin"
+	"github.com/jackc/pgx/v5/pgxpool"
 )
 
 // CleanupExpiredMagicCodesTask removes expired magic codes from the database.
 type CleanupExpiredMagicCodesTask struct {
-	db *sql.DB
+	db *pgxpool.Pool
 }
 
 // NewCleanupExpiredMagicCodesTask creates a new cleanup expired magic codes task.
-func NewCleanupExpiredMagicCodesTask(db *sql.DB) admin.Task {
+func NewCleanupExpiredMagicCodesTask(db *pgxpool.Pool) admin.Task {
 	return &CleanupExpiredMagicCodesTask{db: db}
 }
 
@@ -32,15 +32,12 @@ func (t *CleanupExpiredMagicCodesTask) Description() string {
 
 // Execute runs the cleanup task.
 func (t *CleanupExpiredMagicCodesTask) Execute(ctx context.Context) error {
-	result, err := t.db.ExecContext(ctx, "DELETE FROM magic_codes WHERE expires_at < CURRENT_TIMESTAMP")
+	result, err := t.db.Exec(ctx, "DELETE FROM auth.magic_codes WHERE expires_at < CURRENT_TIMESTAMP")
 	if err != nil {
 		return fmt.Errorf("failed to cleanup expired magic codes: %w", err)
 	}
 
-	count, err := result.RowsAffected()
-	if err != nil {
-		return fmt.Errorf("failed to get rows affected: %w", err)
-	}
+	count := result.RowsAffected()
 
 	slog.Info("Cleaned up expired magic codes", "count", count)
 
diff --git a/internal/admin/tasks/cleanup_sessions.go b/internal/admin/tasks/cleanup_sessions.go
index 854dd59..e4ddfc9 100644
--- a/internal/admin/tasks/cleanup_sessions.go
+++ b/internal/admin/tasks/cleanup_sessions.go
@@ -3,21 +3,21 @@ package tasks
 
 import (
 	"context"
-	"database/sql"
 	"fmt"
 	"log/slog"
 
 	"github.com/cmelgarejo/go-modulith-template/internal/admin"
+	"github.com/jackc/pgx/v5/pgxpool"
 )
 
 // CleanupExpiredSessionsTask removes expired sessions from the database.
 // Sessions are deleted if they expired more than 7 days ago.
 type CleanupExpiredSessionsTask struct {
-	db *sql.DB
+	db *pgxpool.Pool
 }
 
 // NewCleanupExpiredSessionsTask creates a new cleanup expired sessions task.
-func NewCleanupExpiredSessionsTask(db *sql.DB) admin.Task {
+func NewCleanupExpiredSessionsTask(db *pgxpool.Pool) admin.Task {
 	return &CleanupExpiredSessionsTask{db: db}
 }
 
@@ -33,15 +33,12 @@ func (t *CleanupExpiredSessionsTask) Description() string {
 
 // Execute runs the cleanup task.
 func (t *CleanupExpiredSessionsTask) Execute(ctx context.Context) error {
-	result, err := t.db.ExecContext(ctx, "DELETE FROM sessions WHERE expires_at < CURRENT_TIMESTAMP - INTERVAL '7 days'")
+	result, err := t.db.Exec(ctx, "DELETE FROM auth.sessions WHERE expires_at < CURRENT_TIMESTAMP - INTERVAL '7 days'")
 	if err != nil {
 		return fmt.Errorf("failed to cleanup expired sessions: %w", err)
 	}
 
-	count, err := result.RowsAffected()
-	if err != nil {
-		return fmt.Errorf("failed to get rows affected: %w", err)
-	}
+	count := result.RowsAffected()
 
 	slog.Info("Cleaned up expired sessions", "count", count)
 
diff --git a/internal/admin/tasks/register.go b/internal/admin/tasks/register.go
index eab97b1..d2ed159 100644
--- a/internal/admin/tasks/register.go
+++ b/internal/admin/tasks/register.go
@@ -2,14 +2,13 @@
 package tasks
 
 import (
-	"database/sql"
-
 	"github.com/cmelgarejo/go-modulith-template/internal/admin"
+	"github.com/jackc/pgx/v5/pgxpool"
 )
 
 // RegisterExampleTasks registers example admin tasks with the runner.
 // This demonstrates how to register cleanup and maintenance tasks.
-func RegisterExampleTasks(runner *admin.Runner, db *sql.DB) {
+func RegisterExampleTasks(runner *admin.Runner, db *pgxpool.Pool) {
 	runner.Register(NewCleanupExpiredSessionsTask(db))
 	runner.Register(NewCleanupExpiredMagicCodesTask(db))
 }
diff --git a/internal/appversion/version.go b/internal/appversion/version.go
new file mode 100644
index 0000000..967403f
--- /dev/null
+++ b/internal/appversion/version.go
@@ -0,0 +1,42 @@
+// Package appversion provides build information for the application.
+package appversion
+
+import (
+	"fmt"
+	"runtime"
+)
+
+// Build information. These variables are set via ldflags at build time.
+var (
+	// Version is the semantic version of the build.
+	Version = "dev"
+	// Commit is the git commit hash.
+	Commit = "unknown"
+	// BuildTime is the build timestamp.
+	BuildTime = "unknown"
+	// GoVersion is the Go version used to build.
+	GoVersion = runtime.Version()
+)
+
+// Info returns the full build information.
+func Info() string {
+	return fmt.Sprintf("Version: %s, Commit: %s, Built: %s, Go: %s",
+		Version, Commit, BuildTime, GoVersion)
+}
+
+// Short returns a short version string.
+func Short() string {
+	if Version == "dev" {
+		if Commit == "unknown" || len(Commit) == 0 {
+			return "dev"
+		}
+		// Take first 7 characters of commit hash
+		if len(Commit) >= 7 {
+			return fmt.Sprintf("dev-%s", Commit[:7])
+		}
+
+		return fmt.Sprintf("dev-%s", Commit)
+	}
+
+	return Version
+}
diff --git a/internal/audit/interceptor.go b/internal/audit/interceptor.go
new file mode 100644
index 0000000..a97fc84
--- /dev/null
+++ b/internal/audit/interceptor.go
@@ -0,0 +1,140 @@
+package audit
+
+import (
+	"context"
+	"strings"
+	"time"
+
+	"github.com/cmelgarejo/go-modulith-template/internal/authn"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/peer"
+	"google.golang.org/grpc/status"
+)
+
+// UnaryServerInterceptor returns a new unary server interceptor that audits requests.
+func UnaryServerInterceptor(logger Logger) grpc.UnaryServerInterceptor {
+	return func(ctx context.Context, req interface{}, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (interface{}, error) {
+		// filter read-only methods
+		if isReadOnly(info.FullMethod) {
+			return handler(ctx, req)
+		}
+
+		startTime := time.Now()
+		resp, err := handler(ctx, req)
+		duration := time.Since(startTime)
+
+		// Extract metadata
+		userID, _ := authn.UserIDFromContext(ctx)
+		ip := getClientIP(ctx)
+		userAgent := getUserAgent(ctx)
+
+		// Determine status
+		success := true
+		errorMsg := ""
+
+		if err != nil {
+			success = false
+
+			st, _ := status.FromError(err)
+			if st.Code() != codes.OK {
+				errorMsg = st.Message()
+			}
+		}
+
+		// Parse Method for Resource/Action
+		// Format: /package.Service/Method
+		parts := strings.Split(info.FullMethod, "/")
+		resource := "unknown"
+		action := "unknown"
+
+		if len(parts) >= 3 {
+			resource = parts[1] // package.Service
+			action = parts[2]   // Method
+		}
+
+		// Log asynchronously to avoid blocking response
+		// In a production system with high volume, this might go to a queue
+		// For now, the event bus in the logger handles it non-blocking enough
+		go func() {
+			// Detach cancellation but preserve request-scoped values for audit logging.
+			logCtx := context.WithoutCancel(ctx)
+
+			logger.Log(logCtx, LogParams{
+				UserID:    userID,
+				ActorID:   userID, // Primary actor is the authenticated user
+				Action:    action,
+				Resource:  resource,
+				IPAddress: ip,
+				UserAgent: userAgent,
+				Success:   success,
+				ErrorMsg:  errorMsg,
+				Metadata: map[string]any{
+					"duration_ms": duration.Milliseconds(),
+					"method":      info.FullMethod,
+				},
+				// Note: Request/Response bodies (OldValue/NewValue) are hard to capture generically
+				// without reflection or specific proto handling.
+				// For detailed field auditing, manual calls inside services are still better.
+				// This interceptor provides a "Who doing What" baseline.
+			})
+		}()
+
+		return resp, err
+	}
+}
+
+// MetadataFromContext extracts metadata from the context.
+func MetadataFromContext(ctx context.Context) map[string]any {
+	userID, _ := authn.UserIDFromContext(ctx)
+	ip := getClientIP(ctx)
+	userAgent := getUserAgent(ctx)
+
+	return map[string]any{
+		"user_id":    userID,
+		"ip_address": ip,
+		"user_agent": userAgent,
+	}
+}
+
+func isReadOnly(method string) bool {
+	// Simple heuristic: if method starts with specific verbs
+	parts := strings.Split(method, "/")
+	if len(parts) < 3 {
+		return false
+	}
+
+	methodName := parts[2]
+
+	prefixes := []string{"Get", "List", "View", "Check", "Watch", "Stream"}
+	for _, p := range prefixes {
+		if strings.HasPrefix(methodName, p) {
+			return true
+		}
+	}
+
+	return false
+}
+
+func getClientIP(ctx context.Context) string {
+	if p, ok := peer.FromContext(ctx); ok {
+		return p.Addr.String()
+	}
+
+	return ""
+}
+
+func getUserAgent(ctx context.Context) string {
+	if md, ok := metadata.FromIncomingContext(ctx); ok {
+		if userAgents := md.Get("user-agent"); len(userAgents) > 0 {
+			return userAgents[0]
+		}
+
+		if userAgents := md.Get("grpcgateway-user-agent"); len(userAgents) > 0 {
+			return userAgents[0]
+		}
+	}
+
+	return ""
+}
diff --git a/internal/audit/logger.go b/internal/audit/logger.go
new file mode 100644
index 0000000..6486933
--- /dev/null
+++ b/internal/audit/logger.go
@@ -0,0 +1,52 @@
+// Package audit provides the audit logging interface and event bus implementation.
+package audit
+
+import (
+	"context"
+
+	"github.com/cmelgarejo/go-modulith-template/internal/events"
+)
+
+// LogParams defines the data for an audit log entry.
+type LogParams struct {
+	UserID     string         `json:"user_id"`
+	ActorID    string         `json:"actor_id"`
+	Action     string         `json:"action"`
+	Resource   string         `json:"resource"`
+	ResourceID string         `json:"resource_id"`
+	OldValue   any            `json:"old_value"`
+	NewValue   any            `json:"new_value"`
+	Metadata   map[string]any `json:"metadata"`
+	IPAddress  string         `json:"ip_address"`
+	UserAgent  string         `json:"user_agent"`
+	Success    bool           `json:"success"`
+	ErrorMsg   string         `json:"error_msg"`
+}
+
+// Logger is the interface for recording audit events.
+type Logger interface {
+	Log(ctx context.Context, params LogParams)
+}
+
+type eventBusLogger struct {
+	bus *events.Bus
+}
+
+// NewEventBusLogger creates a new Logger that publishes audit events to the event bus.
+func NewEventBusLogger(bus *events.Bus) Logger {
+	return &eventBusLogger{bus: bus}
+}
+
+// Log publishes an audit event to the event bus.
+func (l *eventBusLogger) Log(ctx context.Context, params LogParams) {
+	l.bus.Publish(ctx, events.Event{
+		Name:    events.EventAuditLogCreated,
+		Payload: params,
+	})
+}
+
+// NoopLogger is a logger that does nothing (e.g., for testing).
+type NoopLogger struct{}
+
+// Log does nothing.
+func (n *NoopLogger) Log(_ context.Context, _ LogParams) {}
diff --git a/internal/authn/authn.go b/internal/authn/authn.go
index bc1cc75..7c8ad3e 100644
--- a/internal/authn/authn.go
+++ b/internal/authn/authn.go
@@ -26,6 +26,16 @@ func ContextWithClaims(ctx context.Context, c Claims) context.Context {
 	return ctx
 }
 
+// SystemContext returns a context with platform-level claims for internal
+// service-to-service calls (e.g., event bus handlers, background workers)
+// that are not initiated by an authenticated user.
+func SystemContext(ctx context.Context) context.Context {
+	return ContextWithClaims(ctx, Claims{
+		UserID: "system",
+		Role:   "platform",
+	})
+}
+
 // UserIDFromContext extracts the authenticated user id from context.
 func UserIDFromContext(ctx context.Context) (string, bool) {
 	v, ok := ctx.Value(ctxUserID).(string)
diff --git a/internal/authn/interceptor.go b/internal/authn/interceptor.go
index 6e9693e..b8a9d06 100644
--- a/internal/authn/interceptor.go
+++ b/internal/authn/interceptor.go
@@ -11,6 +11,12 @@ import (
 	"google.golang.org/grpc/status"
 )
 
+// Cookie names used for auth tokens (HttpOnly cookies).
+const (
+	AccessTokenCookieName  = "access_token"
+	RefreshTokenCookieName = "refresh_token"
+)
+
 // InterceptorConfig configures the gRPC auth interceptor.
 type InterceptorConfig struct {
 	Verifier      Verifier
@@ -52,26 +58,37 @@ func bearerTokenFromMetadata(ctx context.Context) (string, error) {
 		return "", fmt.Errorf("missing metadata")
 	}
 
+	// 1. Try Authorization header (standard Bearer token)
 	vals := md.Get("authorization")
-	if len(vals) == 0 {
-		return "", fmt.Errorf("authorization header not found")
-	}
+	if len(vals) > 0 {
+		v := strings.TrimSpace(vals[0])
 
-	// Take the first value.
-	v := strings.TrimSpace(vals[0])
-	if v == "" {
-		return "", fmt.Errorf("authorization header empty")
+		const prefix = "bearer "
+		if len(v) >= len(prefix) && strings.ToLower(v[:len(prefix)]) == prefix {
+			token := strings.TrimSpace(v[len(prefix):])
+			if token != "" {
+				return token, nil
+			}
+		}
 	}
 
-	const prefix = "bearer "
-	if len(v) < len(prefix) || strings.ToLower(v[:len(prefix)]) != prefix {
-		return "", fmt.Errorf("authorization header is not bearer token")
-	}
+	// 2. Try Cookie header (HttpOnly cookies)
+	cookies := md.Get("cookie")
+	if len(cookies) > 0 {
+		// Cookie header can contain multiple cookies: "name1=val1; name2=val2"
+		for _, cookieStr := range cookies {
+			parts := strings.Split(cookieStr, ";")
+
+			for _, part := range parts {
+				part = strings.TrimSpace(part)
 
-	token := strings.TrimSpace(v[len(prefix):])
-	if token == "" {
-		return "", fmt.Errorf("bearer token empty")
+				prefix := AccessTokenCookieName + "="
+				if strings.HasPrefix(part, prefix) {
+					return strings.TrimPrefix(part, prefix), nil
+				}
+			}
+		}
 	}
 
-	return token, nil
+	return "", fmt.Errorf("authorization token not found in header or cookie")
 }
diff --git a/internal/authn/jwt_verifier.go b/internal/authn/jwt_verifier.go
index a45ea98..57026de 100644
--- a/internal/authn/jwt_verifier.go
+++ b/internal/authn/jwt_verifier.go
@@ -2,6 +2,9 @@ package authn
 
 import (
 	"context"
+	"crypto/rsa"
+	"crypto/x509"
+	"encoding/pem"
 	"fmt"
 	"time"
 
@@ -14,23 +17,42 @@ type Verifier interface {
 	VerifyToken(ctx context.Context, tokenString string) (*Claims, error)
 }
 
-// JWTVerifier verifies HS256 JWT tokens that include a "sub" and a "role" claim.
+// JWTVerifier verifies RS256 JWT tokens that include a "sub" and a "role" claim.
 type JWTVerifier struct {
-	key []byte
+	publicKey *rsa.PublicKey
 }
 
-// NewJWTVerifier creates a verifier for HS256 tokens.
-func NewJWTVerifier(secret string) (*JWTVerifier, error) {
-	if secret == "" {
-		return nil, fmt.Errorf("jwt secret is empty")
+// NewJWTVerifier creates a verifier for RS256 tokens using the given PEM-encoded RSA public key.
+func NewJWTVerifier(publicKeyPEM string) (*JWTVerifier, error) {
+	if publicKeyPEM == "" {
+		return nil, fmt.Errorf("jwt public key PEM is empty")
 	}
 
-	return &JWTVerifier{key: []byte(secret)}, nil
+	block, _ := pem.Decode([]byte(publicKeyPEM))
+	if block == nil {
+		return nil, fmt.Errorf("failed to decode JWT public key PEM")
+	}
+
+	pub, err := x509.ParsePKIXPublicKey(block.Bytes)
+	if err != nil {
+		// Try PKCS1
+		pub, err = x509.ParsePKCS1PublicKey(block.Bytes)
+		if err != nil {
+			return nil, fmt.Errorf("failed to parse JWT public key: %w", err)
+		}
+	}
+
+	rsaPub, ok := pub.(*rsa.PublicKey)
+	if !ok {
+		return nil, fmt.Errorf("JWT public key must be RSA, got %T", pub)
+	}
+
+	return &JWTVerifier{publicKey: rsaPub}, nil
 }
 
-// VerifyToken parses and validates the given token string, returning claims if valid.
+// VerifyToken parses and validates the given token string (RS256), returning claims if valid.
 func (v *JWTVerifier) VerifyToken(_ context.Context, tokenString string) (*Claims, error) {
-	tok, err := jwt.ParseSigned(tokenString, []jose.SignatureAlgorithm{jose.HS256})
+	tok, err := jwt.ParseSigned(tokenString, []jose.SignatureAlgorithm{jose.RS256})
 	if err != nil {
 		return nil, fmt.Errorf("failed to parse token: %w", err)
 	}
@@ -38,14 +60,25 @@ func (v *JWTVerifier) VerifyToken(_ context.Context, tokenString string) (*Claim
 	stdClaims := jwt.Claims{}
 	privateClaims := make(map[string]interface{})
 
-	if err := tok.Claims(v.key, &stdClaims, &privateClaims); err != nil {
+	if err := tok.Claims(v.publicKey, &stdClaims, &privateClaims); err != nil {
 		return nil, fmt.Errorf("failed to deserialize claims: %w", err)
 	}
 
-	if err := stdClaims.Validate(jwt.Expected{Time: time.Now()}); err != nil {
+	if err := stdClaims.Validate(jwt.Expected{
+		Time:   time.Now(),
+		Issuer: "opos-auth-service",
+	}); err != nil {
 		return nil, fmt.Errorf("token validation failed: %w", err)
 	}
 
+	if err := validateAudience(stdClaims.Audience); err != nil {
+		return nil, err
+	}
+
+	if stdClaims.ID == "" {
+		return nil, fmt.Errorf("missing token ID (jti)")
+	}
+
 	role, _ := privateClaims["role"].(string)
 
 	if stdClaims.Subject == "" {
@@ -57,3 +90,17 @@ func (v *JWTVerifier) VerifyToken(_ context.Context, tokenString string) (*Claim
 		Role:   role,
 	}, nil
 }
+
+func validateAudience(audiences []string) error {
+	if len(audiences) == 0 {
+		return nil
+	}
+
+	for _, aud := range audiences {
+		if aud == "opos-microservices" || aud == "opos-frontend" {
+			return nil
+		}
+	}
+
+	return fmt.Errorf("invalid token audience")
+}
diff --git a/internal/authn/jwt_verifier_test.go b/internal/authn/jwt_verifier_test.go
index d5db351..542c47e 100644
--- a/internal/authn/jwt_verifier_test.go
+++ b/internal/authn/jwt_verifier_test.go
@@ -2,6 +2,9 @@ package authn
 
 import (
 	"context"
+	"crypto/rsa"
+	"crypto/x509"
+	"encoding/pem"
 	"testing"
 	"time"
 
@@ -9,9 +12,49 @@ import (
 	"github.com/go-jose/go-jose/v4/jwt"
 )
 
+// Test RSA key pair for RS256 (testing only). Must match internal/testutil/jwt_keys.go.
+const testJWTPublicKeyPEM = `-----BEGIN PUBLIC KEY-----
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzdZn/gHvspc7YC+BUnRN
+3k0AB/zcrjrMzi16wyEAIeGaaXvtudPWqWzDwcK3VhUrgxTFRKRmiiXDVdhcDkJu
+0b5OAiKSbxoKwY+OQOZhjOn+jGK5TtD15uPtjxU7WLnegI2z6m+OnBbxUxL/zBh9
+y5V1eI0RBJm0EbPKy2QSKZIvvjPv1i74X6vphQWV2+OAHQLEed++wFQ6FfcNqTSK
+C6QEKSrx/hbSwb6OIPV7H/35mLCubb/rFiwz+NGUeahlvu0kpMRRLwJA3pJjr/Im
+aw+CW96WpImu79LdcYTUZ3k/N1CCnba8KjMsvHQVxWGHjUegqA5dq/eng9SPPMuj
+fQIDAQAB
+-----END PUBLIC KEY-----`
+
+const testJWTPrivateKeyPEM = `-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDN1mf+Ae+ylztg
+L4FSdE3eTQAH/NyuOszOLXrDIQAh4Zppe+2509apbMPBwrdWFSuDFMVEpGaKJcNV
+2FwOQm7Rvk4CIpJvGgrBj45A5mGM6f6MYrlO0PXm4+2PFTtYud6AjbPqb46cFvFT
+Ev/MGH3LlXV4jREEmbQRs8rLZBIpki++M+/WLvhfq+mFBZXb44AdAsR5377AVDoV
+9w2pNIoLpAQpKvH+FtLBvo4g9Xsf/fmYsK5tv+sWLDP40ZR5qGW+7SSkxFEvAkDe
+kmOv8iZrD4Jb3pakia7v0t1xhNRneT83UIKdtrwqMyy8dBXFYYeNR6CoDl2r96eD
+1I88y6N9AgMBAAECggEACCYVTtp/xUe0a43l5kBBduwAdNB/Ygxk4EKvqfrr+Oto
+BAYKdsFarbFnHIwbWvaSluljF+EUSCLPlV3v4wahQX9xsibxOiHDTD9lJ8+XDA+V
+arRb1rFyErZySKhUBaKyGs/BUCYjdK1510qYwtkzXbRohqG7Cz4UgWDnRd8L0wZq
+21at4l+bDWKxa8vCIZAzvI3XMvWCs+wfvU416XYEC8kBNjEYOqESHwZw6NFA+iOv
+haciwkpWAVG1jWMG4jPPLzXEtz/BLjXDHp62gYtZ89dxdKzl2NcD/JFVulI3idTf
+GeWbc1lj8pgPmHomt/QJTEbFItY/GWM4fS8Pj51VoQKBgQDssb3AM4OAGhQzUwbG
+iFEJRKfa41NQoNguKSfqEoHP+7W+9qK6wy1FEr9MyKr1GVaAhI+Oa9640HVJz/cN
+EjdcZ1+dwswxqACpQCoikfIKjA7TVGBAQSYgw02n+VyvpnGs32CdNkq5zPX+uaYz
+TKyT/GoX8mhhq3pOaS4u07gYMQKBgQDeoF1l2XtsunF+/YjOs+QI81V16r4xfymX
+c6WgcF8zpMUTZhs+BCuKBfgCasaShLB8QIPztjCyCPY5boHMNDZwAao/S7KEqvoo
+0t30n1JmcmCDNT3arn2SdTVnoLc6tBA2QfZfwmldfNypWFO2KIMZIN4vGz2yO4/D
+In1Bm6e5DQKBgA36GPhmkldYMuUs+/NxTUe81CSq09qpBNsE9yRtX1kGxh62tblN
+mTjA+KbyGpZKnr8MFOYWHJrRRHvNWgtdjgNY316TiDdOcmuMLHDKKX7R8nYsP1rL
+/hJlNgq7QOvmakQJFM1zzUnXfpdCIzxYRMCgYSt01xEdbSWANIfzXKWhAoGBAMQT
+Z89BegRsPXQEZw7uv4PmlTly06qSfhZHI/QnpKG+mFiakJnRYGuDEElIs7XuKeZ1
+iAIJT+AuJna0zpsEzYFe5gwzZnqUgBmehyBhhlh2mmxVYzIMhsqMcsnfciHA35p6
+BD2Y4+YUB+EayzfffH+QREAm9PLapKbP5JP5PQKtAoGBAMjaHnQYPicw0lWjO6r0
+8xwDcbyZIEKAZKGNp1kiETwSjfILJUjuzrWsIBPiKRrIuvFmjjs8R5sL2bdzTb+Q
+xz3LbR46bN3fWjDqdmhlUplbqMdw/r69Nx0PiDKblwZQFuvSE8+hb+FJGSz3WirL
+BstKaGEUzkQp5SFKsepviqfS
+-----END PRIVATE KEY-----`
+
 func TestNewJWTVerifier(t *testing.T) {
-	t.Run("valid secret", func(t *testing.T) {
-		verifier, err := NewJWTVerifier("my-secret-key")
+	t.Run("valid public key", func(t *testing.T) {
+		verifier, err := NewJWTVerifier(testJWTPublicKeyPEM)
 		if err != nil {
 			t.Fatalf("expected no error, got %v", err)
 		}
@@ -21,10 +64,10 @@ func TestNewJWTVerifier(t *testing.T) {
 		}
 	})
 
-	t.Run("empty secret", func(t *testing.T) {
+	t.Run("empty public key", func(t *testing.T) {
 		verifier, err := NewJWTVerifier("")
 		if err == nil {
-			t.Fatal("expected error for empty secret")
+			t.Fatal("expected error for empty public key")
 		}
 
 		if verifier != nil {
@@ -34,23 +77,21 @@ func TestNewJWTVerifier(t *testing.T) {
 }
 
 func TestJWTVerifier_VerifyToken(t *testing.T) {
-	secret := "test-secret-key-that-is-at-least-32-bytes-long"
-
-	verifier, err := NewJWTVerifier(secret)
+	verifier, err := NewJWTVerifier(testJWTPublicKeyPEM)
 	if err != nil {
 		t.Fatalf("failed to create verifier: %v", err)
 	}
 
 	t.Run("valid token", func(t *testing.T) {
-		testValidToken(t, verifier, secret)
+		testValidToken(t, verifier)
 	})
 
 	t.Run("expired token", func(t *testing.T) {
-		testExpiredToken(t, verifier, secret)
+		testExpiredToken(t, verifier)
 	})
 
 	t.Run("missing subject", func(t *testing.T) {
-		testMissingSubject(t, verifier, secret)
+		testMissingSubject(t, verifier)
 	})
 
 	t.Run("invalid signature", func(t *testing.T) {
@@ -62,7 +103,7 @@ func TestJWTVerifier_VerifyToken(t *testing.T) {
 	})
 
 	t.Run("token without role claim", func(t *testing.T) {
-		testTokenWithoutRole(t, verifier, secret)
+		testTokenWithoutRole(t, verifier)
 	})
 
 	t.Run("empty token string", func(t *testing.T) {
@@ -70,10 +111,10 @@ func TestJWTVerifier_VerifyToken(t *testing.T) {
 	})
 }
 
-func testValidToken(t *testing.T, verifier *JWTVerifier, secret string) {
+func testValidToken(t *testing.T, verifier *JWTVerifier) {
 	t.Helper()
 
-	token := createTestToken(t, secret, "user-123", "admin", time.Now().Add(time.Hour))
+	token := createTestTokenRS256(t, "user-123", "admin", time.Now().Add(time.Hour))
 
 	claims, err := verifier.VerifyToken(context.Background(), token)
 	if err != nil {
@@ -89,10 +130,10 @@ func testValidToken(t *testing.T, verifier *JWTVerifier, secret string) {
 	}
 }
 
-func testExpiredToken(t *testing.T, verifier *JWTVerifier, secret string) {
+func testExpiredToken(t *testing.T, verifier *JWTVerifier) {
 	t.Helper()
 
-	token := createTestToken(t, secret, "user-123", "admin", time.Now().Add(-time.Hour))
+	token := createTestTokenRS256(t, "user-123", "admin", time.Now().Add(-time.Hour))
 
 	_, err := verifier.VerifyToken(context.Background(), token)
 	if err == nil {
@@ -100,10 +141,10 @@ func testExpiredToken(t *testing.T, verifier *JWTVerifier, secret string) {
 	}
 }
 
-func testMissingSubject(t *testing.T, verifier *JWTVerifier, secret string) {
+func testMissingSubject(t *testing.T, verifier *JWTVerifier) {
 	t.Helper()
 
-	token := createTestToken(t, secret, "", "admin", time.Now().Add(time.Hour))
+	token := createTestTokenRS256WithSubject(t, "", "admin", time.Now().Add(time.Hour))
 
 	_, err := verifier.VerifyToken(context.Background(), token)
 	if err == nil {
@@ -114,8 +155,12 @@ func testMissingSubject(t *testing.T, verifier *JWTVerifier, secret string) {
 func testInvalidSignature(t *testing.T, verifier *JWTVerifier) {
 	t.Helper()
 
-	wrongSecret := "wrong-secret-key-that-is-at-least-32-bytes-long-x"
-	token := createTestToken(t, wrongSecret, "user-123", "admin", time.Now().Add(time.Hour))
+	// Token signed with different key (we use another key or tampered payload)
+	token := createTestTokenRS256(t, "user-123", "admin", time.Now().Add(time.Hour))
+	// Tamper with token (change one character in signature part)
+	if len(token) > 10 {
+		token = token[:len(token)-2] + "xx"
+	}
 
 	_, err := verifier.VerifyToken(context.Background(), token)
 	if err == nil {
@@ -132,18 +177,14 @@ func testMalformedToken(t *testing.T, verifier *JWTVerifier) {
 	}
 }
 
-func testTokenWithoutRole(t *testing.T, verifier *JWTVerifier, secret string) {
+func testTokenWithoutRole(t *testing.T, verifier *JWTVerifier) {
 	t.Helper()
 
-	token := createTestToken(t, secret, "user-456", "", time.Now().Add(time.Hour))
+	token := createTestTokenRS256WithRole(t, "user-123", "", time.Now().Add(time.Hour))
 
 	claims, err := verifier.VerifyToken(context.Background(), token)
 	if err != nil {
-		t.Fatalf("expected no error, got %v", err)
-	}
-
-	if claims.UserID != "user-456" {
-		t.Errorf("expected user ID 'user-456', got %s", claims.UserID)
+		t.Fatalf("expected no error for token without role, got %v", err)
 	}
 
 	if claims.Role != "" {
@@ -160,43 +201,53 @@ func testEmptyTokenString(t *testing.T, verifier *JWTVerifier) {
 	}
 }
 
-func TestJWTVerifier_DifferentSecrets(t *testing.T) {
-	secret1 := "first-secret-key-that-is-at-least-32-bytes-long"
-	secret2 := "second-secret-key-that-is-at-least-32-bytes-long"
-
-	verifier1, err := NewJWTVerifier(secret1)
+func TestJWTVerifier_DifferentKeys(t *testing.T) {
+	verifier1, err := NewJWTVerifier(testJWTPublicKeyPEM)
 	if err != nil {
 		t.Fatalf("failed to create verifier1: %v", err)
 	}
 
-	verifier2, err := NewJWTVerifier(secret2)
-	if err != nil {
-		t.Fatalf("failed to create verifier2: %v", err)
-	}
+	// Verifier1 uses test key; token is signed with test private key so it should verify
+	token := createTestTokenRS256(t, "user-123", "admin", time.Now().Add(time.Hour))
 
-	token := createTestToken(t, secret1, "user-123", "admin", time.Now().Add(time.Hour))
-
-	// verifier1 should succeed
 	_, err = verifier1.VerifyToken(context.Background(), token)
 	if err != nil {
-		t.Errorf("verifier1 should verify token signed with secret1, got error: %v", err)
+		t.Errorf("verifier1 should verify token signed with test key, got error: %v", err)
 	}
+}
 
-	// verifier2 should fail
-	_, err = verifier2.VerifyToken(context.Background(), token)
-	if err == nil {
-		t.Error("verifier2 should not verify token signed with secret1")
-	}
+// createTestTokenRS256 creates a JWT signed with the test private key (RS256).
+//
+//nolint:unparam // subject/role vary by test
+func createTestTokenRS256(t *testing.T, subject, role string, expiresAt time.Time) string {
+	return createTestTokenRS256WithSubject(t, subject, role, expiresAt)
+}
+
+func createTestTokenRS256WithSubject(t *testing.T, subject, role string, expiresAt time.Time) string {
+	t.Helper()
+	return createTestTokenRS256WithRole(t, subject, role, expiresAt)
 }
 
-// Helper function to create a test JWT token
-func createTestToken(t *testing.T, secret, subject, role string, expiresAt time.Time) string {
+func createTestTokenRS256WithRole(t *testing.T, subject, role string, expiresAt time.Time) string {
 	t.Helper()
 
-	key := []byte(secret)
+	block, _ := pem.Decode([]byte(testJWTPrivateKeyPEM))
+	if block == nil {
+		t.Fatal("failed to decode test private key PEM")
+	}
+
+	key, err := x509.ParsePKCS8PrivateKey(block.Bytes)
+	if err != nil {
+		t.Fatalf("failed to parse private key: %v", err)
+	}
+
+	rsaKey, ok := key.(*rsa.PrivateKey)
+	if !ok {
+		t.Fatal("private key is not RSA")
+	}
 
 	signer, err := jose.NewSigner(
-		jose.SigningKey{Algorithm: jose.HS256, Key: key},
+		jose.SigningKey{Algorithm: jose.RS256, Key: rsaKey},
 		(&jose.SignerOptions{}).WithType("JWT"),
 	)
 	if err != nil {
@@ -207,6 +258,9 @@ func createTestToken(t *testing.T, secret, subject, role string, expiresAt time.
 		Subject:  subject,
 		Expiry:   jwt.NewNumericDate(expiresAt),
 		IssuedAt: jwt.NewNumericDate(time.Now()),
+		Issuer:   "opos-auth-service",
+		Audience: []string{"opos-microservices"},
+		ID:       "test-jti",
 	}
 
 	privateClaims := make(map[string]interface{})
diff --git a/internal/authtoken/jose.go b/internal/authtoken/jose.go
new file mode 100644
index 0000000..1332202
--- /dev/null
+++ b/internal/authtoken/jose.go
@@ -0,0 +1,131 @@
+// Package authtoken provides token generation and validation services using RS256.
+package authtoken
+
+import (
+	"crypto/rsa"
+	"crypto/x509"
+	"encoding/pem"
+	"fmt"
+	"time"
+
+	"github.com/go-jose/go-jose/v4"
+	"github.com/go-jose/go-jose/v4/jwt"
+)
+
+// Service handles JOSE token operations with RS256 (asymmetric) signing.
+type Service struct {
+	signer    jose.Signer
+	publicKey *rsa.PublicKey
+}
+
+// NewService creates a new Service using the given PEM-encoded RSA private key (RS256).
+// The public key for verification is derived from the private key.
+func NewService(privateKeyPEM string) (*Service, error) {
+	if privateKeyPEM == "" {
+		return nil, fmt.Errorf("JWT private key PEM cannot be empty")
+	}
+
+	block, _ := pem.Decode([]byte(privateKeyPEM))
+	if block == nil {
+		return nil, fmt.Errorf("failed to decode JWT private key PEM")
+	}
+
+	privateKey, err := x509.ParsePKCS1PrivateKey(block.Bytes)
+	if err != nil {
+		// Try PKCS8
+		key, parseErr := x509.ParsePKCS8PrivateKey(block.Bytes)
+		if parseErr != nil {
+			return nil, fmt.Errorf("failed to parse JWT private key: %w", err)
+		}
+
+		var ok bool
+
+		privateKey, ok = key.(*rsa.PrivateKey)
+		if !ok {
+			return nil, fmt.Errorf("JWT private key must be RSA, got %T", key)
+		}
+	}
+
+	sig, err := jose.NewSigner(
+		jose.SigningKey{Algorithm: jose.RS256, Key: privateKey},
+		(&jose.SignerOptions{}).WithType("JWT"),
+	)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create RS256 signer: %w", err)
+	}
+
+	return &Service{
+		signer:    sig,
+		publicKey: &privateKey.PublicKey,
+	}, nil
+}
+
+// Claims represents the custom claims in the JWT
+type Claims struct {
+	Subject   string   `json:"sub"`
+	Role      string   `json:"role"`
+	Scope     []string `json:"scope,omitempty"`
+	ExpiresAt int64    `json:"exp"`
+	Issuer    string   `json:"iss,omitempty"`
+	Audience  []string `json:"aud,omitempty"`
+	ID        string   `json:"jti,omitempty"`
+}
+
+// CreateToken generates a new signed JWT for the given user and role (RS256).
+func (s *Service) CreateToken(userID, role string, duration time.Duration) (string, string, error) {
+	now := time.Now()
+	jti := fmt.Sprintf("%d-%s", now.UnixNano(), userID)
+
+	claims := jwt.Claims{
+		Subject:   userID,
+		Expiry:    jwt.NewNumericDate(now.Add(duration)),
+		IssuedAt:  jwt.NewNumericDate(now),
+		NotBefore: jwt.NewNumericDate(now),
+		Issuer:    "opos-auth-service",
+		Audience:  []string{"opos-microservices", "opos-frontend"},
+		ID:        jti,
+	}
+	privateClaims := map[string]interface{}{
+		"role": role,
+	}
+
+	raw, err := jwt.Signed(s.signer).Claims(claims).Claims(privateClaims).Serialize()
+	if err != nil {
+		return "", "", fmt.Errorf("failed to sign token: %w", err)
+	}
+
+	return raw, jti, nil
+}
+
+// VerifyToken parses and validates the given token string (RS256), returning the claims if valid.
+func (s *Service) VerifyToken(tokenString string) (*Claims, error) {
+	tok, err := jwt.ParseSigned(tokenString, []jose.SignatureAlgorithm{jose.RS256})
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse token: %w", err)
+	}
+
+	claims := jwt.Claims{}
+	privateClaims := make(map[string]interface{})
+
+	if err := tok.Claims(s.publicKey, &claims, &privateClaims); err != nil {
+		return nil, fmt.Errorf("failed to deserialize claims: %w", err)
+	}
+
+	if err := claims.Validate(jwt.Expected{Time: time.Now()}); err != nil {
+		return nil, fmt.Errorf("token validation failed: %w", err)
+	}
+
+	role, _ := privateClaims["role"].(string)
+
+	var expiresAt int64
+	if claims.Expiry != nil {
+		expiresAt = claims.Expiry.Time().Unix()
+	}
+
+	return &Claims{
+		Subject:   claims.Subject,
+		Role:      role,
+		ExpiresAt: expiresAt,
+		ID:        claims.ID,
+	}, nil
+}
diff --git a/internal/cache/cache.go b/internal/cache/cache.go
index b2a978d..b0c8595 100644
--- a/internal/cache/cache.go
+++ b/internal/cache/cache.go
@@ -1,11 +1,13 @@
 // Package cache provides a caching abstraction for the application.
-// It supports multiple backends (memory, Redis) and can be used for
+// It supports multiple backends (memory, Valkey) and can be used for
 // session storage, rate limiting data, or general-purpose caching.
 package cache
 
 import (
 	"context"
 	"errors"
+	"fmt"
+	"strings"
 	"time"
 )
 
@@ -32,9 +34,31 @@ type Cache interface {
 	// Returns nil if the key doesn't exist.
 	Delete(ctx context.Context, key string) error
 
+	// DeleteMany removes multiple values from the cache.
+	// Returns nil if no keys exist.
+	DeleteMany(ctx context.Context, keys ...string) error
+
+	// DeleteByPrefix removes all values that share a common key prefix.
+	// Implementations should treat this as a best-effort bulk invalidation helper.
+	DeleteByPrefix(ctx context.Context, prefix string) error
+
 	// Exists checks if a key exists in the cache.
 	Exists(ctx context.Context, key string) (bool, error)
 
+	// Increment increments a numeric value in the cache.
+	// Returns the new value.
+	Increment(ctx context.Context, key string) (int64, error)
+
+	// Decrement decrements a numeric value in the cache.
+	// Returns the new value.
+	Decrement(ctx context.Context, key string) (int64, error)
+
+	// Expire sets a new expiration time for a key.
+	Expire(ctx context.Context, key string, ttl time.Duration) error
+
+	// Ping checks the cache connection.
+	Ping(ctx context.Context) error
+
 	// Close closes the cache connection.
 	Close() error
 }
@@ -47,6 +71,20 @@ type StringCache struct {
 	cache Cache
 }
 
+// Key builds a standardized cache key using ":" separators while skipping empty parts.
+func Key(parts ...string) string {
+	filtered := make([]string, 0, len(parts))
+	for _, part := range parts {
+		if part == "" {
+			continue
+		}
+
+		filtered = append(filtered, strings.Trim(part, ":"))
+	}
+
+	return strings.Join(filtered, ":")
+}
+
 // NewStringCache wraps a Cache with string convenience methods.
 func NewStringCache(c Cache) *StringCache {
 	return &StringCache{cache: c}
@@ -78,6 +116,20 @@ func (sc *StringCache) Delete(ctx context.Context, key string) error {
 	return sc.cache.Delete(ctx, key)
 }
 
+// DeleteMany removes multiple values from the cache.
+//
+//nolint:wrapcheck // Thin wrapper passes through errors
+func (sc *StringCache) DeleteMany(ctx context.Context, keys ...string) error {
+	return sc.cache.DeleteMany(ctx, keys...)
+}
+
+// DeleteByPrefix removes all values for a cache key prefix.
+//
+//nolint:wrapcheck // Thin wrapper passes through errors
+func (sc *StringCache) DeleteByPrefix(ctx context.Context, prefix string) error {
+	return sc.cache.DeleteByPrefix(ctx, prefix)
+}
+
 // Exists checks if a key exists in the cache.
 //
 //nolint:wrapcheck // Thin wrapper passes through errors
@@ -85,9 +137,39 @@ func (sc *StringCache) Exists(ctx context.Context, key string) (bool, error) {
 	return sc.cache.Exists(ctx, key)
 }
 
+// Increment increments a value in the cache and returns the new value.
+//
+//nolint:wrapcheck // Thin wrapper passes through errors
+func (sc *StringCache) Increment(ctx context.Context, key string) (int64, error) {
+	return sc.cache.Increment(ctx, key)
+}
+
+// Decrement decrements a value in the cache and returns the new value.
+//
+//nolint:wrapcheck // Thin wrapper passes through errors
+func (sc *StringCache) Decrement(ctx context.Context, key string) (int64, error) {
+	return sc.cache.Decrement(ctx, key)
+}
+
+// Expire sets a new expiration time for a key.
+//
+//nolint:wrapcheck // Thin wrapper passes through errors
+func (sc *StringCache) Expire(ctx context.Context, key string, ttl time.Duration) error {
+	return sc.cache.Expire(ctx, key, ttl)
+}
+
 // Close closes the underlying cache.
 //
 //nolint:wrapcheck // Thin wrapper passes through errors
 func (sc *StringCache) Close() error {
 	return sc.cache.Close()
 }
+
+// Ping checks the underlying cache.
+func (sc *StringCache) Ping(ctx context.Context) error {
+	if err := sc.cache.Ping(ctx); err != nil {
+		return fmt.Errorf("cache ping: %w", err)
+	}
+
+	return nil
+}
diff --git a/internal/cache/invalidator.go b/internal/cache/invalidator.go
new file mode 100644
index 0000000..3d77c58
--- /dev/null
+++ b/internal/cache/invalidator.go
@@ -0,0 +1,77 @@
+package cache
+
+import (
+	"context"
+	"fmt"
+	"log/slog"
+
+	"github.com/cmelgarejo/go-modulith-template/internal/events"
+)
+
+// Invalidator connects cache invalidation rules to the in-process event bus.
+type Invalidator struct {
+	cache        Cache
+	eventBus     *events.Bus
+	unsubscribes []func()
+}
+
+// NewInvalidator creates an event-driven cache invalidator.
+func NewInvalidator(c Cache, bus *events.Bus) *Invalidator {
+	return &Invalidator{
+		cache:        c,
+		eventBus:     bus,
+		unsubscribes: make([]func(), 0),
+	}
+}
+
+// SubscribeKeys removes exact cache keys when the given event is published.
+func (i *Invalidator) SubscribeKeys(eventName string, keys ...string) {
+	if i == nil || i.cache == nil || i.eventBus == nil || len(keys) == 0 {
+		return
+	}
+
+	unsubscribe := i.eventBus.Subscribe(eventName, func(ctx context.Context, event events.Event) error {
+		if err := i.cache.DeleteMany(ctx, keys...); err != nil {
+			return fmt.Errorf("invalidate keys for event %s: %w", event.Name, err)
+		}
+
+		return nil
+	})
+
+	i.unsubscribes = append(i.unsubscribes, unsubscribe)
+}
+
+// SubscribePrefixes removes cache keys matching prefixes when the given event is published.
+func (i *Invalidator) SubscribePrefixes(eventName string, prefixes ...string) {
+	if i == nil || i.cache == nil || i.eventBus == nil || len(prefixes) == 0 {
+		return
+	}
+
+	unsubscribe := i.eventBus.Subscribe(eventName, func(ctx context.Context, event events.Event) error {
+		for _, prefix := range prefixes {
+			if err := i.cache.DeleteByPrefix(ctx, prefix); err != nil {
+				return fmt.Errorf("invalidate prefix %s for event %s: %w", prefix, event.Name, err)
+			}
+		}
+
+		return nil
+	})
+
+	i.unsubscribes = append(i.unsubscribes, unsubscribe)
+}
+
+// Close removes all event subscriptions created by the invalidator.
+func (i *Invalidator) Close() {
+	if i == nil {
+		return
+	}
+
+	for _, unsubscribe := range i.unsubscribes {
+		if unsubscribe != nil {
+			unsubscribe()
+		}
+	}
+
+	slog.Debug("Cache invalidator closed", "subscriptions", len(i.unsubscribes))
+	i.unsubscribes = nil
+}
diff --git a/internal/cache/memory.go b/internal/cache/memory.go
index cc88877..d82ed9f 100644
--- a/internal/cache/memory.go
+++ b/internal/cache/memory.go
@@ -3,6 +3,7 @@ package cache
 
 import (
 	"context"
+	"fmt"
 	"sync"
 	"time"
 )
@@ -121,6 +122,32 @@ func (mc *MemoryCache) Delete(_ context.Context, key string) error {
 	return nil
 }
 
+// DeleteMany removes multiple values from the cache.
+func (mc *MemoryCache) DeleteMany(_ context.Context, keys ...string) error {
+	mc.mu.Lock()
+	defer mc.mu.Unlock()
+
+	for _, key := range keys {
+		delete(mc.items, key)
+	}
+
+	return nil
+}
+
+// DeleteByPrefix removes all values for a cache key prefix.
+func (mc *MemoryCache) DeleteByPrefix(_ context.Context, prefix string) error {
+	mc.mu.Lock()
+	defer mc.mu.Unlock()
+
+	for key := range mc.items {
+		if len(key) >= len(prefix) && key[:len(prefix)] == prefix {
+			delete(mc.items, key)
+		}
+	}
+
+	return nil
+}
+
 // Exists checks if a key exists and is not expired.
 func (mc *MemoryCache) Exists(_ context.Context, key string) (bool, error) {
 	mc.mu.RLock()
@@ -138,6 +165,87 @@ func (mc *MemoryCache) Exists(_ context.Context, key string) (bool, error) {
 	return true, nil
 }
 
+// Increment increments a value in the cache and returns the new value.
+func (mc *MemoryCache) Increment(_ context.Context, key string) (int64, error) {
+	mc.mu.Lock()
+	defer mc.mu.Unlock()
+
+	i, ok := mc.items[key]
+	if !ok || i.isExpired() {
+		val := int64(1)
+		mc.items[key] = &item{
+			value: []byte(fmt.Sprintf("%d", val)),
+		}
+
+		return val, nil
+	}
+
+	var val int64
+
+	_, err := fmt.Sscanf(string(i.value), "%d", &val)
+	if err != nil {
+		return 0, fmt.Errorf("failed to parse cache value as int64: %w", err)
+	}
+
+	val++
+	i.value = []byte(fmt.Sprintf("%d", val))
+
+	return val, nil
+}
+
+// Decrement decrements a value in the cache and returns the new value.
+func (mc *MemoryCache) Decrement(_ context.Context, key string) (int64, error) {
+	mc.mu.Lock()
+	defer mc.mu.Unlock()
+
+	i, ok := mc.items[key]
+	if !ok || i.isExpired() {
+		val := int64(-1)
+		mc.items[key] = &item{
+			value: []byte(fmt.Sprintf("%d", val)),
+		}
+
+		return val, nil
+	}
+
+	var val int64
+
+	_, err := fmt.Sscanf(string(i.value), "%d", &val)
+	if err != nil {
+		return 0, fmt.Errorf("failed to parse cache value as int64: %w", err)
+	}
+
+	val--
+	i.value = []byte(fmt.Sprintf("%d", val))
+
+	return val, nil
+}
+
+// Expire sets a new expiration time for a key.
+func (mc *MemoryCache) Expire(_ context.Context, key string, ttl time.Duration) error {
+	mc.mu.Lock()
+	defer mc.mu.Unlock()
+
+	i, ok := mc.items[key]
+	if !ok || i.isExpired() {
+		return ErrNotFound
+	}
+
+	if ttl > 0 {
+		i.expiresAt = time.Now().Add(ttl)
+		i.hasExpiry = true
+	} else {
+		i.hasExpiry = false
+	}
+
+	return nil
+}
+
+// Ping checks the cache connection.
+func (mc *MemoryCache) Ping(_ context.Context) error {
+	return nil
+}
+
 // Close stops the cleanup goroutine and clears the cache.
 func (mc *MemoryCache) Close() error {
 	mc.stopOnce.Do(func() {
diff --git a/internal/cache/proto.go b/internal/cache/proto.go
new file mode 100644
index 0000000..da0c764
--- /dev/null
+++ b/internal/cache/proto.go
@@ -0,0 +1,94 @@
+package cache
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"time"
+
+	"golang.org/x/sync/singleflight"
+	"google.golang.org/protobuf/encoding/protojson"
+	"google.golang.org/protobuf/proto"
+)
+
+var protoLoadGroup singleflight.Group
+
+// SetProto marshals and stores a protobuf message in cache.
+func SetProto[T proto.Message](ctx context.Context, c Cache, key string, value T, ttl time.Duration) error {
+	data, err := protojson.Marshal(value)
+	if err != nil {
+		return fmt.Errorf("marshal proto cache value: %w", err)
+	}
+
+	if err := c.Set(ctx, key, data, ttl); err != nil {
+		return fmt.Errorf("set proto cache value: %w", err)
+	}
+
+	return nil
+}
+
+// GetProto retrieves and unmarshals a protobuf message from cache.
+func GetProto[T proto.Message](ctx context.Context, c Cache, key string, newValue func() T) (T, error) {
+	var zero T
+
+	data, err := c.Get(ctx, key)
+	if err != nil {
+		if errors.Is(err, ErrNotFound) {
+			return zero, ErrNotFound
+		}
+
+		return zero, fmt.Errorf("get proto cache value: %w", err)
+	}
+
+	value := newValue()
+	if err := protojson.Unmarshal(data, value); err != nil {
+		return zero, fmt.Errorf("unmarshal proto cache value: %w", err)
+	}
+
+	return value, nil
+}
+
+// GetOrLoadProto returns a cached protobuf message or loads and stores it.
+func GetOrLoadProto[T proto.Message](
+	ctx context.Context,
+	c Cache,
+	key string,
+	ttl time.Duration,
+	newValue func() T,
+	loader func(context.Context) (T, error),
+) (T, error) {
+	value, err := GetProto(ctx, c, key, newValue)
+	if err == nil {
+		return value, nil
+	}
+
+	if err != nil && err != ErrNotFound {
+		var zero T
+		return zero, err
+	}
+
+	result, err, _ := protoLoadGroup.Do(key, func() (interface{}, error) {
+		loaded, loadErr := loader(ctx)
+		if loadErr != nil {
+			return nil, loadErr
+		}
+
+		if setErr := SetProto(ctx, c, key, loaded, ttl); setErr != nil {
+			return nil, setErr
+		}
+
+		return loaded, nil
+	})
+	if err != nil {
+		var zero T
+		return zero, fmt.Errorf("load proto cache value: %w", err)
+	}
+
+	typed, ok := result.(T)
+	if !ok {
+		var zero T
+		return zero, fmt.Errorf("unexpected cached proto type for key %s", key)
+	}
+
+	return typed, nil
+}
diff --git a/internal/cache/valkey.go b/internal/cache/valkey.go
new file mode 100644
index 0000000..419964b
--- /dev/null
+++ b/internal/cache/valkey.go
@@ -0,0 +1,230 @@
+// Package cache provides a caching abstraction for the application.
+package cache
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/cmelgarejo/go-modulith-template/internal/telemetry"
+	"github.com/redis/go-redis/v9"
+)
+
+// ValkeyConfig holds Valkey connection configuration.
+type ValkeyConfig struct {
+	// Addr is the server address (e.g., "localhost:6379").
+	Addr string
+	// Password is the password (optional).
+	Password string //nolint:gosec
+	// DB is the database number (default 0).
+	DB int
+	// PoolSize is the maximum number of connections.
+	PoolSize int
+	// MinIdleConns is the minimum number of idle connections.
+	MinIdleConns int
+	// DialTimeout is the timeout for establishing new connections.
+	DialTimeout time.Duration
+	// ReadTimeout is the timeout for read operations.
+	ReadTimeout time.Duration
+	// WriteTimeout is the timeout for write operations.
+	WriteTimeout time.Duration
+}
+
+// DefaultValkeyConfig returns default Valkey configuration.
+func DefaultValkeyConfig() ValkeyConfig {
+	return ValkeyConfig{
+		Addr:         "localhost:6379",
+		Password:     "",
+		DB:           0,
+		PoolSize:     10,
+		MinIdleConns: 2,
+		DialTimeout:  5 * time.Second,
+		ReadTimeout:  3 * time.Second,
+		WriteTimeout: 3 * time.Second,
+	}
+}
+
+// ValkeyCache is a Valkey-backed cache implementation (using Redis protocol).
+type ValkeyCache struct {
+	config ValkeyConfig
+	client *redis.Client
+}
+
+// NewValkeyCache creates a new Valkey cache.
+// Returns an error if connection fails.
+func NewValkeyCache(cfg ValkeyConfig) (*ValkeyCache, error) {
+	client := redis.NewClient(&redis.Options{
+		Addr:         cfg.Addr,
+		Password:     cfg.Password,
+		DB:           cfg.DB,
+		PoolSize:     cfg.PoolSize,
+		MinIdleConns: cfg.MinIdleConns,
+		DialTimeout:  cfg.DialTimeout,
+		ReadTimeout:  cfg.ReadTimeout,
+		WriteTimeout: cfg.WriteTimeout,
+	})
+
+	ctx, cancel := context.WithTimeout(context.Background(), cfg.DialTimeout)
+	defer cancel()
+
+	if err := client.Ping(ctx).Err(); err != nil {
+		return nil, fmt.Errorf("valkey connection failed: %w", err)
+	}
+
+	return &ValkeyCache{
+		config: cfg,
+		client: client,
+	}, nil
+}
+
+// Get retrieves a value from the cache.
+func (rc *ValkeyCache) Get(ctx context.Context, key string) ([]byte, error) {
+	ctx, span := telemetry.ModuleSpan(ctx, "cache", "Get")
+	defer span.End()
+
+	val, err := rc.client.Get(ctx, key).Bytes()
+	if err != nil {
+		if err == redis.Nil {
+			return nil, ErrNotFound
+		}
+
+		return nil, fmt.Errorf("valkey get: %w", err)
+	}
+
+	return val, nil
+}
+
+// Set stores a value in the cache.
+func (rc *ValkeyCache) Set(ctx context.Context, key string, value []byte, ttl time.Duration) error {
+	ctx, span := telemetry.ModuleSpan(ctx, "cache", "Set")
+	defer span.End()
+
+	if err := rc.client.Set(ctx, key, value, ttl).Err(); err != nil {
+		return fmt.Errorf("valkey set: %w", err)
+	}
+
+	return nil
+}
+
+// Delete removes a value from the cache.
+func (rc *ValkeyCache) Delete(ctx context.Context, key string) error {
+	ctx, span := telemetry.ModuleSpan(ctx, "cache", "Delete")
+	defer span.End()
+
+	if err := rc.client.Del(ctx, key).Err(); err != nil {
+		return fmt.Errorf("valkey delete: %w", err)
+	}
+
+	return nil
+}
+
+// DeleteMany removes multiple values from the cache.
+func (rc *ValkeyCache) DeleteMany(ctx context.Context, keys ...string) error {
+	ctx, span := telemetry.ModuleSpan(ctx, "cache", "DeleteMany")
+	defer span.End()
+
+	if len(keys) == 0 {
+		return nil
+	}
+
+	if err := rc.client.Del(ctx, keys...).Err(); err != nil {
+		return fmt.Errorf("valkey delete many: %w", err)
+	}
+
+	return nil
+}
+
+// DeleteByPrefix removes all keys matching a prefix using SCAN to avoid blocking Redis.
+func (rc *ValkeyCache) DeleteByPrefix(ctx context.Context, prefix string) error {
+	ctx, span := telemetry.ModuleSpan(ctx, "cache", "DeleteByPrefix")
+	defer span.End()
+
+	var cursor uint64
+
+	for {
+		keys, nextCursor, err := rc.client.Scan(ctx, cursor, prefix+"*", 100).Result()
+		if err != nil {
+			return fmt.Errorf("valkey delete by prefix scan: %w", err)
+		}
+
+		if len(keys) > 0 {
+			if err := rc.client.Del(ctx, keys...).Err(); err != nil {
+				return fmt.Errorf("valkey delete by prefix delete: %w", err)
+			}
+		}
+
+		cursor = nextCursor
+		if cursor == 0 {
+			return nil
+		}
+	}
+}
+
+// Exists checks if a key exists in the cache.
+func (rc *ValkeyCache) Exists(ctx context.Context, key string) (bool, error) {
+	ctx, span := telemetry.ModuleSpan(ctx, "cache", "Exists")
+	defer span.End()
+
+	n, err := rc.client.Exists(ctx, key).Result()
+	if err != nil {
+		return false, fmt.Errorf("valkey exists: %w", err)
+	}
+
+	return n > 0, nil
+}
+
+// Increment increments a numeric value in the cache.
+func (rc *ValkeyCache) Increment(ctx context.Context, key string) (int64, error) {
+	ctx, span := telemetry.ModuleSpan(ctx, "cache", "Increment")
+	defer span.End()
+
+	n, err := rc.client.Incr(ctx, key).Result()
+	if err != nil {
+		return 0, fmt.Errorf("valkey incr: %w", err)
+	}
+
+	return n, nil
+}
+
+// Decrement decrements a numeric value in the cache.
+func (rc *ValkeyCache) Decrement(ctx context.Context, key string) (int64, error) {
+	ctx, span := telemetry.ModuleSpan(ctx, "cache", "Decrement")
+	defer span.End()
+
+	n, err := rc.client.Decr(ctx, key).Result()
+	if err != nil {
+		return 0, fmt.Errorf("valkey decr: %w", err)
+	}
+
+	return n, nil
+}
+
+// Expire sets a new expiration time for a key.
+func (rc *ValkeyCache) Expire(ctx context.Context, key string, ttl time.Duration) error {
+	ctx, span := telemetry.ModuleSpan(ctx, "cache", "Expire")
+	defer span.End()
+
+	if err := rc.client.Expire(ctx, key, ttl).Err(); err != nil {
+		return fmt.Errorf("valkey expire: %w", err)
+	}
+
+	return nil
+}
+
+// Close closes the connection.
+func (rc *ValkeyCache) Close() error {
+	if err := rc.client.Close(); err != nil {
+		return fmt.Errorf("valkey close: %w", err)
+	}
+
+	return nil
+}
+
+// Ping checks the connection.
+func (rc *ValkeyCache) Ping(ctx context.Context) error {
+	if err := rc.client.Ping(ctx).Err(); err != nil {
+		return fmt.Errorf("valkey ping: %w", err)
+	}
+
+	return nil
+}
diff --git a/internal/config/config.go b/internal/config/config.go
index 74fe498..0424b7e 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -8,6 +8,7 @@ import (
 	"path/filepath"
 	"strconv"
 	"strings"
+	"unicode"
 
 	"gopkg.in/yaml.v3"
 )
@@ -18,10 +19,12 @@ const (
 	sourceSystem  = "system"
 	sourceDefault = "default"
 	envTrue       = "true"
+	envProd       = "prod"
 )
 
 // AppConfig is the root configuration for the entire modulith
 type AppConfig struct {
+	AppName  string `yaml:"app_name" env:"APP_NAME"`
 	Env      string `yaml:"env" env:"ENV"`
 	LogLevel string `yaml:"log_level" env:"LOG_LEVEL"`
 	HTTPPort string `yaml:"http_port" env:"HTTP_PORT"`
@@ -46,6 +49,13 @@ type AppConfig struct {
 	RateLimitRPS     int  `yaml:"rate_limit_rps" env:"RATE_LIMIT_RPS"`
 	RateLimitBurst   int  `yaml:"rate_limit_burst" env:"RATE_LIMIT_BURST"`
 
+	// Redis/Valkey
+	ValkeyAddr         string `yaml:"valkey_addr" env:"VALKEY_ADDR"`
+	ValkeyPassword     string `yaml:"valkey_password" env:"VALKEY_PASSWORD"`
+	ValkeyDB           int    `yaml:"valkey_db" env:"VALKEY_DB"`
+	ValkeyPoolSize     int    `yaml:"valkey_pool_size" env:"VALKEY_POOL_SIZE"`
+	ValkeyMinIdleConns int    `yaml:"valkey_min_idle_conns" env:"VALKEY_MIN_IDLE_CONNS"`
+
 	// Timeouts
 	ReadTimeout     string `yaml:"read_timeout" env:"READ_TIMEOUT"`         // HTTP server read timeout (e.g., "5s")
 	WriteTimeout    string `yaml:"write_timeout" env:"WRITE_TIMEOUT"`       // HTTP server write timeout (e.g., "10s")
@@ -58,8 +68,55 @@ type AppConfig struct {
 	// Swagger/OpenAPI documentation
 	SwaggerAPITitle string `yaml:"swagger_api_title" env:"SWAGGER_API_TITLE"` // API title shown in Swagger UI
 
+	// Outbox configuration
+	OutboxPollInterval string `yaml:"outbox_poll_interval" env:"OUTBOX_POLL_INTERVAL"` // e.g. "5s", "100ms"
+
 	// Module specific configs
-	Auth AuthConfig `yaml:"auth"`
+	Auth  AuthConfig  `yaml:"auth"`
+	KYC   KycConfig   `yaml:"kyc"`
+	Feeds FeedsConfig `yaml:"feeds"`
+	Seeds SeedConfig  `yaml:"seeds"`
+	E2E   E2EConfig   `yaml:"e2e"`
+}
+
+// FeedsConfig contains configuration for the data feeds module.
+type FeedsConfig struct {
+	TheOddsAPIKey  string `yaml:"the_odds_api_key" env:"THE_ODDS_API_KEY"`
+	APIFootballKey string `yaml:"api_football_key" env:"API_FOOTBALL_KEY"`
+}
+
+// SeedConfig contains configuration for seeding data.
+type SeedConfig struct {
+	Users []SeedUser `yaml:"users"`
+}
+
+// SeedUser represents a user to be seeded.
+type SeedUser struct {
+	Name           string  `yaml:"name"`
+	Email          string  `yaml:"email"`
+	Role           string  `yaml:"role"`
+	Phone          string  `yaml:"phone"`
+	InitialBalance float64 `yaml:"initial_balance"`
+	Currency       string  `yaml:"currency"`
+}
+
+// PlatformEmail returns the email of the platform-role user from the seed config.
+// Falls back to "system@opos.dev" if no platform user is configured.
+func (s *SeedConfig) PlatformEmail() string {
+	for _, u := range s.Users {
+		if u.Role == "platform" {
+			return u.Email
+		}
+	}
+
+	return "system@opos.dev"
+}
+
+// E2EConfig contains configuration for E2E tests.
+type E2EConfig struct {
+	GRPCAddr     string `yaml:"grpc_addr" env:"E2E_GRPC_ADDR"`
+	CreatorEmail string `yaml:"creator_email" env:"E2E_CREATOR_EMAIL"`
+	AdminEmail   string `yaml:"admin_email" env:"E2E_ADMIN_EMAIL"`
 }
 
 // Load loads the configuration following this priority order (from lowest to highest):
@@ -69,26 +126,34 @@ type AppConfig struct {
 //
 // Priority: YAML > .env > system ENV vars
 // systemEnvVars should be captured BEFORE godotenv.Load() is called in main()
+//
+//nolint:funlen // Configuration loading requires many sequential steps
 func Load(yamlPath string, systemEnvVars map[string]string) (*AppConfig, error) {
 	cfg := &AppConfig{
-		Env:               "dev",
-		LogLevel:          "debug",
-		HTTPPort:          "8080",
-		GRPCPort:          "9050",
-		ServiceName:       "modulith-server",
-		DBMaxOpenConns:    25,
-		DBMaxIdleConns:    25,
-		DBConnMaxLifetime: "5m",
-		DBConnectTimeout:  "10s",
-		RateLimitEnabled:  false,
-		RateLimitRPS:      100,
-		RateLimitBurst:    50,
-		ReadTimeout:       "5s",
-		WriteTimeout:      "10s",
-		RequestTimeout:    "30s",
-		ShutdownTimeout:   "30s",
-		DefaultLocale:     "en",
-		SwaggerAPITitle:   "Modulith API",
+		AppName:            "Modulith Project",
+		Env:                "dev",
+		LogLevel:           "debug",
+		HTTPPort:           "8080",
+		GRPCPort:           "9050",
+		ServiceName:        "modulith-server",
+		DBMaxOpenConns:     25,
+		DBMaxIdleConns:     25,
+		DBConnMaxLifetime:  "5m",
+		DBConnectTimeout:   "10s",
+		RateLimitEnabled:   false,
+		RateLimitRPS:       100,
+		RateLimitBurst:     50,
+		ReadTimeout:        "5s",
+		WriteTimeout:       "10s",
+		RequestTimeout:     "30s",
+		ShutdownTimeout:    "30s",
+		DefaultLocale:      "en",
+		SwaggerAPITitle:    "Modulith API",
+		ValkeyAddr:         "localhost:6379",
+		ValkeyPassword:     "",
+		ValkeyDB:           0,
+		ValkeyPoolSize:     10,
+		ValkeyMinIdleConns: 2,
 	}
 
 	// Track sources for each config value
@@ -106,6 +171,18 @@ func Load(yamlPath string, systemEnvVars map[string]string) (*AppConfig, error)
 		return nil, err
 	}
 
+	// Step 3.5: Load Seeds YAML config file based on env
+	seedPath := fmt.Sprintf("configs/seeds/%s.yaml", cfg.Env)
+	if _, err := os.Stat(seedPath); err == nil {
+		if err := loadYAMLConfig(seedPath, cfg, sources); err != nil {
+			return nil, fmt.Errorf("failed to load seed config: %w", err)
+		}
+	} else if cfg.Env == "dev" {
+		// Fallback to development.yaml if env is dev and file missing?
+		// Or just ignore if missing.
+		slog.Info("Seed config not found, skipping", "path", seedPath)
+	}
+
 	// Step 4: Apply standard PORT env var (12-factor app compliance)
 	// PORT takes precedence over HTTP_PORT for compatibility with Heroku, Cloud Run, Railway, etc.
 	// Priority: PORT > HTTP_PORT > default
@@ -116,17 +193,22 @@ func Load(yamlPath string, systemEnvVars map[string]string) (*AppConfig, error)
 
 	// Log configuration sources in a readable format
 	slog.Info("Configuration sources",
-		"ENV", fmt.Sprintf("%s = %s", cfg.Env, getSource(sources, "ENV")),
-		"LOG_LEVEL", fmt.Sprintf("%s = %s", cfg.LogLevel, getSource(sources, "LOG_LEVEL")),
-		"HTTP_PORT", fmt.Sprintf("%s = %s", cfg.HTTPPort, getSource(sources, "HTTP_PORT")),
-		"GRPC_PORT", fmt.Sprintf("%s = %s", cfg.GRPCPort, getSource(sources, "GRPC_PORT")),
-		"DB_DSN", fmt.Sprintf("%s = %s", cfg.DBDSN, getSource(sources, "DB_DSN")),
-		"OTLP_ENDPOINT", fmt.Sprintf("%s = %s", cfg.OTLPEndpoint, getSource(sources, "OTLP_ENDPOINT")),
-		"SERVICE_NAME", fmt.Sprintf("%s = %s", cfg.ServiceName, getSource(sources, "SERVICE_NAME")),
-		"JWT_SECRET", fmt.Sprintf("[%d bytes] = %s", len(cfg.Auth.JWTSecret), getSource(sources, "JWT_SECRET")),
-		"RATE_LIMIT_ENABLED", fmt.Sprintf("%v = %s", cfg.RateLimitEnabled, getSource(sources, "RATE_LIMIT_ENABLED")),
-		"CORS_ALLOWED_ORIGINS", fmt.Sprintf("%v = %s", cfg.CORSAllowedOrigins, getSource(sources, "CORS_ALLOWED_ORIGINS")),
-		"SWAGGER_API_TITLE", fmt.Sprintf("%s = %s", cfg.SwaggerAPITitle, getSource(sources, "SWAGGER_API_TITLE")),
+		"APP_NAME", formatConfigSourceValue(cfg.AppName, getSource(sources, "APP_NAME")),
+		"ENV", formatConfigSourceValue(cfg.Env, getSource(sources, "ENV")),
+		"LOG_LEVEL", formatConfigSourceValue(cfg.LogLevel, getSource(sources, "LOG_LEVEL")),
+		"HTTP_PORT", formatConfigSourceValue(cfg.HTTPPort, getSource(sources, "HTTP_PORT")),
+		"GRPC_PORT", formatConfigSourceValue(cfg.GRPCPort, getSource(sources, "GRPC_PORT")),
+		"DB_DSN", formatConfigSecretValue(cfg.DBDSN, getSource(sources, "DB_DSN"), "chars"),
+		"OTLP_ENDPOINT", formatConfigSourceValue(cfg.OTLPEndpoint, getSource(sources, "OTLP_ENDPOINT")),
+		"SERVICE_NAME", formatConfigSourceValue(cfg.ServiceName, getSource(sources, "SERVICE_NAME")),
+		"JWT_PRIVATE_KEY", formatConfigSecretValue(cfg.Auth.JWTPrivateKeyPEM, getSource(sources, "JWT_PRIVATE_KEY"), "bytes"),
+		"JWT_PUBLIC_KEY", formatConfigSecretValue(cfg.Auth.JWTPublicKeyPEM, getSource(sources, "JWT_PUBLIC_KEY"), "bytes"),
+		"KYC_ENFORCEMENT_ENABLED", formatConfigBoolValue(cfg.KYC.EnforcementEnabled, getSource(sources, "KYC_ENFORCEMENT_ENABLED")),
+		"RATE_LIMIT_ENABLED", formatConfigBoolValue(cfg.RateLimitEnabled, getSource(sources, "RATE_LIMIT_ENABLED")),
+		"CORS_ALLOWED_ORIGINS", formatConfigSourceValue(strings.Join(cfg.CORSAllowedOrigins, ","), getSource(sources, "CORS_ALLOWED_ORIGINS")),
+		"SWAGGER_API_TITLE", formatConfigSourceValue(cfg.SwaggerAPITitle, getSource(sources, "SWAGGER_API_TITLE")),
+		"THE_ODDS_API_KEY", formatConfigSecretValue(cfg.Feeds.TheOddsAPIKey, getSource(sources, "THE_ODDS_API_KEY"), "chars"),
+		"API_FOOTBALL_KEY", formatConfigSecretValue(cfg.Feeds.APIFootballKey, getSource(sources, "API_FOOTBALL_KEY"), "chars"),
 	)
 
 	// Validation
@@ -142,8 +224,14 @@ func Load(yamlPath string, systemEnvVars map[string]string) (*AppConfig, error)
 // Updates the sources map to track where each value came from.
 // In a production app, consider using a library like cleanenv or envconfig.
 //
-//nolint:cyclop,funlen,gocognit // Configuration parsing requires many sequential environment variable checks
+//nolint:cyclop,funlen,gocognit,gocyclo // Configuration parsing requires many sequential environment variable checks
+//nolint:gocyclo // Complexity is needed for config overrides
 func (c *AppConfig) OverrideWithEnv(sources map[string]string, sourceName string) {
+	if appName := os.Getenv("APP_NAME"); appName != "" {
+		c.AppName = appName
+		sources["APP_NAME"] = sourceName
+	}
+
 	if env := os.Getenv("ENV"); env != "" {
 		c.Env = env
 		sources["ENV"] = sourceName
@@ -203,9 +291,14 @@ func (c *AppConfig) OverrideWithEnv(sources map[string]string, sourceName string
 		sources["SERVICE_NAME"] = sourceName
 	}
 
-	if secret := os.Getenv("JWT_SECRET"); secret != "" {
-		c.Auth.JWTSecret = secret
-		sources["JWT_SECRET"] = sourceName
+	if key := os.Getenv("JWT_PRIVATE_KEY"); key != "" {
+		c.Auth.JWTPrivateKeyPEM = key
+		sources["JWT_PRIVATE_KEY"] = sourceName
+	}
+
+	if key := os.Getenv("JWT_PUBLIC_KEY"); key != "" {
+		c.Auth.JWTPublicKeyPEM = key
+		sources["JWT_PUBLIC_KEY"] = sourceName
 	}
 
 	if timeout := os.Getenv("READ_TIMEOUT"); timeout != "" {
@@ -272,6 +365,22 @@ func (c *AppConfig) OverrideWithEnv(sources map[string]string, sourceName string
 
 	// OAuth configuration
 	c.overrideOAuthEnv(sources, sourceName)
+
+	// KYC configuration
+	if enabled := os.Getenv("KYC_ENFORCEMENT_ENABLED"); enabled == envTrue {
+		c.KYC.EnforcementEnabled = true
+		sources["KYC_ENFORCEMENT_ENABLED"] = sourceName
+	}
+
+	if apiKey := os.Getenv("THE_ODDS_API_KEY"); apiKey != "" {
+		c.Feeds.TheOddsAPIKey = apiKey
+		sources["THE_ODDS_API_KEY"] = sourceName
+	}
+
+	if apiKey := os.Getenv("API_FOOTBALL_KEY"); apiKey != "" {
+		c.Feeds.APIFootballKey = apiKey
+		sources["API_FOOTBALL_KEY"] = sourceName
+	}
 }
 
 // overrideOAuthEnv handles OAuth-specific environment variables.
@@ -385,6 +494,7 @@ func (c *AppConfig) overrideOAuthEnv(sources map[string]string, sourceName strin
 // 1. The variable was not in system ENV vars (new variable from .env), OR
 // 2. The value changed from system ENV vars (overridden by .env)
 func (c *AppConfig) OverrideWithEnvFromDotenv(sources, systemEnvVars map[string]string, sourceName string) {
+	c.overrideEnvVar("APP_NAME", func(val string) { c.AppName = val }, sources, systemEnvVars, sourceName)
 	c.overrideEnvVar("ENV", func(val string) { c.Env = val }, sources, systemEnvVars, sourceName)
 	c.overrideEnvVar("LOG_LEVEL", func(val string) { c.LogLevel = val }, sources, systemEnvVars, sourceName)
 	c.overrideEnvVar("HTTP_PORT", func(val string) { c.HTTPPort = val }, sources, systemEnvVars, sourceName)
@@ -404,7 +514,8 @@ func (c *AppConfig) OverrideWithEnvFromDotenv(sources, systemEnvVars map[string]
 	c.overrideEnvVar("DB_CONNECT_TIMEOUT", func(val string) { c.DBConnectTimeout = val }, sources, systemEnvVars, sourceName)
 	c.overrideEnvVar("OTLP_ENDPOINT", func(val string) { c.OTLPEndpoint = val }, sources, systemEnvVars, sourceName)
 	c.overrideEnvVar("SERVICE_NAME", func(val string) { c.ServiceName = val }, sources, systemEnvVars, sourceName)
-	c.overrideEnvVar("JWT_SECRET", func(val string) { c.Auth.JWTSecret = val }, sources, systemEnvVars, sourceName)
+	c.overrideEnvVar("JWT_PRIVATE_KEY", func(val string) { c.Auth.JWTPrivateKeyPEM = val }, sources, systemEnvVars, sourceName)
+	c.overrideEnvVar("JWT_PUBLIC_KEY", func(val string) { c.Auth.JWTPublicKeyPEM = val }, sources, systemEnvVars, sourceName)
 	c.overrideEnvVar("READ_TIMEOUT", func(val string) { c.ReadTimeout = val }, sources, systemEnvVars, sourceName)
 	c.overrideEnvVar("WRITE_TIMEOUT", func(val string) { c.WriteTimeout = val }, sources, systemEnvVars, sourceName)
 	c.overrideEnvVar("REQUEST_TIMEOUT", func(val string) { c.RequestTimeout = val }, sources, systemEnvVars, sourceName)
@@ -437,6 +548,13 @@ func (c *AppConfig) OverrideWithEnvFromDotenv(sources, systemEnvVars map[string]
 	// Swagger/OpenAPI from .env
 	c.overrideEnvVar("SWAGGER_API_TITLE", func(val string) { c.SwaggerAPITitle = val }, sources, systemEnvVars, sourceName)
 
+	// KYC from .env
+	c.overrideEnvVar("KYC_ENFORCEMENT_ENABLED", func(val string) { c.KYC.EnforcementEnabled = val == envTrue }, sources, systemEnvVars, sourceName)
+
+	// Feeds from .env
+	c.overrideEnvVar("THE_ODDS_API_KEY", func(val string) { c.Feeds.TheOddsAPIKey = val }, sources, systemEnvVars, sourceName)
+	c.overrideEnvVar("API_FOOTBALL_KEY", func(val string) { c.Feeds.APIFootballKey = val }, sources, systemEnvVars, sourceName)
+
 	// OAuth configuration from .env
 	c.overrideOAuthEnvFromDotenv(sources, systemEnvVars, sourceName)
 }
@@ -496,24 +614,53 @@ func (c *AppConfig) overrideEnvVar(key string, setter func(string), sources, sys
 
 // Validate ensures the configuration is semantically correct.
 func (c *AppConfig) Validate() error {
-	if c.DBDSN == "" && c.Env == "prod" {
-		return fmt.Errorf("DB_DSN is required in production")
-	}
+	if c.Env == envProd {
+		if c.DBDSN == "" {
+			return fmt.Errorf("DB_DSN is required in production")
+		}
 
-	if c.Auth.JWTSecret == "" && c.Env == "prod" {
-		return fmt.Errorf("JWT_SECRET is required in production")
+		if c.Auth.JWTPublicKeyPEM == "" {
+			return fmt.Errorf("JWT_PUBLIC_KEY is required in production (RS256 verification)")
+		}
 	}
 
-	// Validate JWT secret length (HS256 requires at least 32 bytes)
-	if c.Auth.JWTSecret != "" && len(c.Auth.JWTSecret) < 32 {
-		return fmt.Errorf("JWT_SECRET must be at least 32 bytes (256 bits) for HS256 algorithm, got %d bytes", len(c.Auth.JWTSecret))
+	if err := c.validateJWT(); err != nil {
+		return err
 	}
 
-	// Validate OAuth configuration
-	if err := c.validateOAuthConfig(); err != nil {
+	if err := c.validateCORS(); err != nil {
 		return err
 	}
 
+	return c.validateOAuthConfig()
+}
+
+func (c *AppConfig) validateJWT() error {
+	// RS256: public key required for verification; private key required only for auth/admin token issuance
+	if c.Auth.JWTPublicKeyPEM != "" {
+		// Basic PEM structure check
+		if len(c.Auth.JWTPublicKeyPEM) < 100 {
+			return fmt.Errorf("JWT_PUBLIC_KEY appears invalid (PEM too short)")
+		}
+	}
+
+	if c.Auth.JWTPrivateKeyPEM != "" && len(c.Auth.JWTPrivateKeyPEM) < 100 {
+		return fmt.Errorf("JWT_PRIVATE_KEY appears invalid (PEM too short)")
+	}
+
+	return nil
+}
+
+func (c *AppConfig) validateCORS() error {
+	// Enforce strict CORS in production
+	if c.Env == envProd {
+		for _, origin := range c.CORSAllowedOrigins {
+			if origin == "*" {
+				return fmt.Errorf("wildcard CORS origin '*' is not allowed in production")
+			}
+		}
+	}
+
 	return nil
 }
 
@@ -613,8 +760,23 @@ func loadYAMLConfig(yamlPath string, cfg *AppConfig, sources map[string]string)
 
 // applyYAMLConfig applies YAML configuration values to the config struct
 //
-//nolint:cyclop,funlen // Configuration parsing requires many sequential YAML value checks
+//nolint:cyclop,funlen,gocyclo,gocognit // Configuration parsing requires many sequential YAML value checks
 func applyYAMLConfig(cfg, yamlOnly *AppConfig, sources map[string]string) {
+	if len(yamlOnly.Seeds.Users) > 0 {
+		cfg.Seeds = yamlOnly.Seeds
+		sources["SEEDS"] = sourceYAML
+	}
+
+	if yamlOnly.E2E.GRPCAddr != "" {
+		cfg.E2E = yamlOnly.E2E
+		sources["E2E"] = sourceYAML
+	}
+
+	if yamlOnly.AppName != "" {
+		cfg.AppName = yamlOnly.AppName
+		sources["APP_NAME"] = sourceYAML
+	}
+
 	if yamlOnly.Env != "" {
 		cfg.Env = yamlOnly.Env
 		sources["ENV"] = sourceYAML
@@ -640,6 +802,31 @@ func applyYAMLConfig(cfg, yamlOnly *AppConfig, sources map[string]string) {
 		sources["DB_DSN"] = sourceYAML
 	}
 
+	if yamlOnly.ValkeyAddr != "" {
+		cfg.ValkeyAddr = yamlOnly.ValkeyAddr
+		sources["VALKEY_ADDR"] = sourceYAML
+	}
+
+	if yamlOnly.ValkeyPassword != "" {
+		cfg.ValkeyPassword = yamlOnly.ValkeyPassword
+		sources["VALKEY_PASSWORD"] = sourceYAML
+	}
+
+	if yamlOnly.ValkeyDB >= 0 {
+		cfg.ValkeyDB = yamlOnly.ValkeyDB
+		sources["VALKEY_DB"] = sourceYAML
+	}
+
+	if yamlOnly.ValkeyPoolSize > 0 {
+		cfg.ValkeyPoolSize = yamlOnly.ValkeyPoolSize
+		sources["VALKEY_POOL_SIZE"] = sourceYAML
+	}
+
+	if yamlOnly.ValkeyMinIdleConns > 0 {
+		cfg.ValkeyMinIdleConns = yamlOnly.ValkeyMinIdleConns
+		sources["VALKEY_MIN_IDLE_CONNS"] = sourceYAML
+	}
+
 	if yamlOnly.DBMaxOpenConns > 0 {
 		cfg.DBMaxOpenConns = yamlOnly.DBMaxOpenConns
 		sources["DB_MAX_OPEN_CONNS"] = sourceYAML
@@ -670,9 +857,14 @@ func applyYAMLConfig(cfg, yamlOnly *AppConfig, sources map[string]string) {
 		sources["SERVICE_NAME"] = sourceYAML
 	}
 
-	if yamlOnly.Auth.JWTSecret != "" {
-		cfg.Auth.JWTSecret = yamlOnly.Auth.JWTSecret
-		sources["JWT_SECRET"] = sourceYAML
+	if yamlOnly.Auth.JWTPrivateKeyPEM != "" {
+		cfg.Auth.JWTPrivateKeyPEM = yamlOnly.Auth.JWTPrivateKeyPEM
+		sources["JWT_PRIVATE_KEY"] = sourceYAML
+	}
+
+	if yamlOnly.Auth.JWTPublicKeyPEM != "" {
+		cfg.Auth.JWTPublicKeyPEM = yamlOnly.Auth.JWTPublicKeyPEM
+		sources["JWT_PUBLIC_KEY"] = sourceYAML
 	}
 
 	if yamlOnly.ReadTimeout != "" {
@@ -729,6 +921,16 @@ func applyYAMLConfig(cfg, yamlOnly *AppConfig, sources map[string]string) {
 
 	// Apply OAuth configuration from YAML
 	applyYAMLOAuthConfig(cfg, yamlOnly, sources)
+
+	if yamlOnly.Feeds.TheOddsAPIKey != "" {
+		cfg.Feeds.TheOddsAPIKey = yamlOnly.Feeds.TheOddsAPIKey
+		sources["THE_ODDS_API_KEY"] = sourceYAML
+	}
+
+	if yamlOnly.Feeds.APIFootballKey != "" {
+		cfg.Feeds.APIFootballKey = yamlOnly.Feeds.APIFootballKey
+		sources["API_FOOTBALL_KEY"] = sourceYAML
+	}
 }
 
 // applyYAMLOAuthConfig applies OAuth configuration from YAML.
@@ -781,6 +983,12 @@ func applyYAMLOAuthProviders(cfg, yamlOnly *AppConfig, sources map[string]string
 		sources["GITHUB_CLIENT_ID"] = sourceYAML
 	}
 
+	// KYC
+	if yamlOnly.KYC.EnforcementEnabled {
+		cfg.KYC.EnforcementEnabled = true
+		sources["KYC_ENFORCEMENT_ENABLED"] = sourceYAML
+	}
+
 	// Microsoft
 	if providers.Microsoft.ClientID != "" {
 		cfg.Auth.OAuth.Providers.Microsoft = providers.Microsoft
@@ -809,6 +1017,31 @@ func getSource(sources map[string]string, key string) string {
 	return sourceDefault
 }
 
+func formatConfigSourceValue(value, source string) string {
+	return fmt.Sprintf("%s = %s", sanitizeConfigLogValue(value), sanitizeConfigLogValue(source))
+}
+
+func formatConfigBoolValue(value bool, source string) string {
+	return fmt.Sprintf("%t = %s", value, sanitizeConfigLogValue(source))
+}
+
+func formatConfigSecretValue(value, source, unit string) string {
+	return fmt.Sprintf("[%d %s] = %s", len(value), unit, sanitizeConfigLogValue(source))
+}
+
+func sanitizeConfigLogValue(value string) string {
+	return strings.Map(func(r rune) rune {
+		switch {
+		case r == '\n' || r == '\r' || r == '\t':
+			return ' '
+		case unicode.IsPrint(r):
+			return r
+		default:
+			return -1
+		}
+	}, value)
+}
+
 // parseCommaSeparated parses a comma-separated string into a slice of strings.
 // Trims whitespace from each element.
 func parseCommaSeparated(s string) []string {
diff --git a/internal/config/config_test.go b/internal/config/config_test.go
index 66437a4..46896cc 100644
--- a/internal/config/config_test.go
+++ b/internal/config/config_test.go
@@ -6,6 +6,8 @@ import (
 	"testing"
 )
 
+const envDev = "dev"
+
 func TestLoad_Defaults(t *testing.T) {
 	// Clear environment
 	clearTestEnv(t)
@@ -15,7 +17,7 @@ func TestLoad_Defaults(t *testing.T) {
 		t.Fatalf("expected no error, got %v", err)
 	}
 
-	if cfg.Env != "dev" {
+	if cfg.Env != envDev {
 		t.Errorf("expected default env 'dev', got %s", cfg.Env)
 	}
 
@@ -59,8 +61,8 @@ func TestLoad_EnvironmentVariables(t *testing.T) {
 		t.Errorf("expected OTLP endpoint 'http://localhost:4317', got %s", cfg.OTLPEndpoint)
 	}
 
-	if cfg.Auth.JWTSecret != "test-secret-key-that-is-at-least-32-bytes-long" {
-		t.Errorf("expected JWT secret to be set")
+	if cfg.Auth.JWTPublicKeyPEM != "test-public-key-pem-that-is-at-least-100-characters-long-to-pass-validation-logic-for-pem-format-checking-in-config-validation" {
+		t.Errorf("expected JWTPublicKeyPEM to be set")
 	}
 }
 
@@ -77,7 +79,7 @@ grpc_port: "9999"
 db_dsn: "postgres://localhost/staging"
 otlp_endpoint: "http://otlp:4317"
 auth:
-  jwt_secret: "yaml-secret-key-that-is-at-least-32-bytes-long"
+  jwt_public_key: "yaml-public-key-pem-that-is-at-least-100-characters-long-to-pass-validation-logic-for-pem-format-checking-in-config-validation"
 `
 
 	if err := os.WriteFile(yamlPath, []byte(yamlContent), 0o600); err != nil {
@@ -109,8 +111,8 @@ auth:
 		t.Errorf("expected OTLP endpoint 'http://otlp:4317', got %s", cfg.OTLPEndpoint)
 	}
 
-	if cfg.Auth.JWTSecret != "yaml-secret-key-that-is-at-least-32-bytes-long" {
-		t.Errorf("expected JWT secret to be set from YAML")
+	if cfg.Auth.JWTPublicKeyPEM != "yaml-public-key-pem-that-is-at-least-100-characters-long-to-pass-validation-logic-for-pem-format-checking-in-config-validation" {
+		t.Errorf("expected JWTPublicKeyPEM to be set from YAML")
 	}
 }
 
@@ -181,7 +183,7 @@ func TestValidate_ProductionRequirements(t *testing.T) {
 			GRPCPort: "9050",
 			DBDSN:    "",
 			Auth: AuthConfig{
-				JWTSecret: "valid-secret-key-that-is-at-least-32-bytes-long",
+				JWTPublicKeyPEM: "valid-public-key-pem-that-is-at-least-100-characters-long-to-pass-validation-logic-for-pem-format-checking-in-config-validation",
 			},
 		}
 
@@ -198,7 +200,7 @@ func TestValidate_ProductionRequirements(t *testing.T) {
 			GRPCPort: "9050",
 			DBDSN:    "postgres://localhost/db",
 			Auth: AuthConfig{
-				JWTSecret: "",
+				JWTPublicKeyPEM: "",
 			},
 		}
 
@@ -215,7 +217,7 @@ func TestValidate_ProductionRequirements(t *testing.T) {
 			GRPCPort: "9050",
 			DBDSN:    "postgres://localhost/db",
 			Auth: AuthConfig{
-				JWTSecret: "valid-secret-key-that-is-at-least-32-bytes-long",
+				JWTPublicKeyPEM: "valid-public-key-pem-that-is-at-least-100-characters-long-to-pass-validation-logic-for-pem-format-checking-in-config-validation",
 			},
 		}
 
@@ -226,36 +228,36 @@ func TestValidate_ProductionRequirements(t *testing.T) {
 	})
 }
 
-func TestValidate_JWTSecretLength(t *testing.T) {
-	t.Run("JWT secret too short", func(t *testing.T) {
+func TestValidate_JWTPEMLength(t *testing.T) {
+	t.Run("JWT public key too short", func(t *testing.T) {
 		cfg := &AppConfig{
-			Env:      "dev",
+			Env:      envDev,
 			HTTPPort: "8080",
 			GRPCPort: "9050",
 			Auth: AuthConfig{
-				JWTSecret: "short",
+				JWTPublicKeyPEM: "short-pem",
 			},
 		}
 
 		err := cfg.Validate()
 		if err == nil {
-			t.Fatal("expected error for short JWT secret")
+			t.Fatal("expected error for short JWT public key")
 		}
 	})
 
-	t.Run("JWT secret exactly 32 bytes", func(t *testing.T) {
+	t.Run("JWT public key long enough", func(t *testing.T) {
 		cfg := &AppConfig{
-			Env:      "dev",
+			Env:      envDev,
 			HTTPPort: "8080",
 			GRPCPort: "9050",
 			Auth: AuthConfig{
-				JWTSecret: "12345678901234567890123456789012",
+				JWTPublicKeyPEM: "valid-public-key-pem-that-is-at-least-100-characters-long-to-pass-validation-logic-for-pem-format-checking-in-config-validation",
 			},
 		}
 
 		err := cfg.Validate()
 		if err != nil {
-			t.Errorf("expected no error for 32-byte secret, got %v", err)
+			t.Errorf("expected no error for long enough PEM, got %v", err)
 		}
 	})
 }
@@ -280,12 +282,12 @@ func setupTestEnv(t *testing.T) {
 	t.Helper()
 
 	envVars := map[string]string{
-		"ENV":           "test",
-		"HTTP_PORT":     "3000",
-		"GRPC_PORT":     "4000",
-		"DB_DSN":        "postgres://localhost/test",
-		"OTLP_ENDPOINT": "http://localhost:4317",
-		"JWT_SECRET":    "test-secret-key-that-is-at-least-32-bytes-long",
+		"ENV":            "test",
+		"HTTP_PORT":      "3000",
+		"GRPC_PORT":      "4000",
+		"DB_DSN":         "postgres://localhost/test",
+		"OTLP_ENDPOINT":  "http://localhost:4317",
+		"JWT_PUBLIC_KEY": "test-public-key-pem-that-is-at-least-100-characters-long-to-pass-validation-logic-for-pem-format-checking-in-config-validation",
 	}
 
 	for key, value := range envVars {
@@ -318,7 +320,8 @@ func clearTestEnv(t *testing.T) {
 	_ = os.Unsetenv("GRPC_PORT")
 	_ = os.Unsetenv("DB_DSN")
 	_ = os.Unsetenv("OTLP_ENDPOINT")
-	_ = os.Unsetenv("JWT_SECRET")
+	_ = os.Unsetenv("JWT_PUBLIC_KEY")
+	_ = os.Unsetenv("JWT_PRIVATE_KEY")
 
 	// OAuth vars
 	_ = os.Unsetenv("OAUTH_ENABLED")
@@ -394,7 +397,7 @@ func setupOAuthEnv(t *testing.T) {
 	_ = os.Setenv("FACEBOOK_CLIENT_SECRET", "facebook-client-secret")
 	_ = os.Setenv("GITHUB_CLIENT_ID", "github-client-id")
 	_ = os.Setenv("GITHUB_CLIENT_SECRET", "github-client-secret")
-	_ = os.Setenv("JWT_SECRET", "test-secret-key-that-is-at-least-32-bytes-long")
+	_ = os.Setenv("JWT_PUBLIC_KEY", "test-public-key-pem-that-is-at-least-100-characters-long-to-pass-validation-logic-for-pem-format-checking-in-config-validation")
 }
 
 func TestLoad_OAuthYAMLConfiguration(t *testing.T) {
@@ -448,7 +451,7 @@ func createOAuthYAMLConfig(t *testing.T) string {
 http_port: "8080"
 grpc_port: "9050"
 auth:
-  jwt_secret: "test-secret-key-that-is-at-least-32-bytes-long"
+  jwt_public_key: "test-public-key-pem-that-is-at-least-100-characters-long-to-pass-validation-logic-for-pem-format-checking-in-config-validation"
   oauth:
     enabled: true
     auto_link_by_email: true
@@ -523,11 +526,11 @@ func TestValidate_OAuthConfig(t *testing.T) {
 
 	t.Run("OAuth disabled, no validation required", func(t *testing.T) {
 		cfg := &AppConfig{
-			Env:      "dev",
+			Env:      envDev,
 			HTTPPort: "8080",
 			GRPCPort: "9050",
 			Auth: AuthConfig{
-				JWTSecret: "valid-secret-key-that-is-at-least-32-bytes-long",
+				JWTPublicKeyPEM: "valid-public-key-pem-that-is-at-least-100-characters-long-to-pass-validation-logic-for-pem-format-checking-in-config-validation",
 				OAuth: OAuthConfig{
 					Enabled: false,
 				},
@@ -543,11 +546,11 @@ func TestValidate_OAuthConfig(t *testing.T) {
 
 func validOAuthConfig() *AppConfig {
 	return &AppConfig{
-		Env:      "dev",
+		Env:      envDev,
 		HTTPPort: "8080",
 		GRPCPort: "9050",
 		Auth: AuthConfig{
-			JWTSecret: "valid-secret-key-that-is-at-least-32-bytes-long",
+			JWTPublicKeyPEM: "valid-public-key-pem-that-is-at-least-100-characters-long-to-pass-validation-logic-for-pem-format-checking-in-config-validation",
 			OAuth: OAuthConfig{
 				Enabled:            true,
 				BaseURL:            "http://localhost:8080",
diff --git a/internal/config/modules.go b/internal/config/modules.go
index 42d09b6..cf296b0 100644
--- a/internal/config/modules.go
+++ b/internal/config/modules.go
@@ -3,8 +3,9 @@ package config
 // AuthConfig holds the Auth module settings.
 // This is defined here to avoid import cycles between config and modules.
 type AuthConfig struct {
-	JWTSecret string      `yaml:"jwt_secret"`
-	OAuth     OAuthConfig `yaml:"oauth"`
+	JWTPrivateKeyPEM string      `yaml:"jwt_private_key"` // PEM-encoded RSA private key for signing (auth service only)
+	JWTPublicKeyPEM  string      `yaml:"jwt_public_key"`  // PEM-encoded RSA public key for verification (all services)
+	OAuth            OAuthConfig `yaml:"oauth"`
 }
 
 // OAuthConfig holds OAuth provider settings.
@@ -32,7 +33,7 @@ type OAuthProviders struct {
 type OAuthProviderConfig struct {
 	Enabled      bool     `yaml:"enabled"`
 	ClientID     string   `yaml:"client_id"`
-	ClientSecret string   `yaml:"client_secret"`
+	ClientSecret string   `yaml:"client_secret"` //nolint:gosec
 	Scopes       []string `yaml:"scopes"`
 }
 
@@ -45,3 +46,8 @@ type AppleOAuthConfig struct {
 	PrivateKeyPath string   `yaml:"private_key_path"` // Path to .p8 file
 	Scopes         []string `yaml:"scopes"`
 }
+
+// KycConfig holds the KYC module settings.
+type KycConfig struct {
+	EnforcementEnabled bool `yaml:"enforcement_enabled"`
+}
diff --git a/internal/errors/errors.go b/internal/errors/errors.go
index 7910021..81151ac 100644
--- a/internal/errors/errors.go
+++ b/internal/errors/errors.go
@@ -388,6 +388,8 @@ func ToGRPCWithContext(ctx context.Context, defaultLocale string, err error) err
 }
 
 // mapErrorCodeToTranslationKey maps error codes to translation keys.
+//
+//nolint:gosec
 var errorCodeToTranslationKey = map[ErrorCode]string{
 	CodeUserNotFound:           "errors.user_not_found",
 	CodeAuthInvalidCreds:       "errors.invalid_credentials",
diff --git a/internal/events/bus.go b/internal/events/bus.go
index a291507..ba538d4 100644
--- a/internal/events/bus.go
+++ b/internal/events/bus.go
@@ -5,6 +5,7 @@ package events
 
 import (
 	"context"
+	"fmt"
 	"log/slog"
 	"sync"
 )
@@ -25,7 +26,8 @@ type ErrorHandler func(ctx context.Context, event Event, err error)
 // This interface allows for different implementations (in-memory, Kafka, RabbitMQ, etc.)
 type EventBus interface {
 	// Subscribe registers a handler for a specific event name.
-	Subscribe(eventName string, handler Handler)
+	// It returns a function that can be called to unsubscribe.
+	Subscribe(eventName string, handler Handler) func()
 
 	// Publish broadcasts an event to all registered handlers.
 	Publish(ctx context.Context, event Event)
@@ -65,12 +67,27 @@ func (b *Bus) SetErrorHandler(handler ErrorHandler) {
 	b.errorHandler = handler
 }
 
-// Subscribe registers a handler for a specific event name
-func (b *Bus) Subscribe(eventName string, handler Handler) {
+// Subscribe registers a handler for a specific event name and returns an unsubscribe function.
+func (b *Bus) Subscribe(eventName string, handler Handler) func() {
 	b.mu.Lock()
 	defer b.mu.Unlock()
 
 	b.handlers[eventName] = append(b.handlers[eventName], handler)
+
+	// Return unsubscribe function
+	return func() {
+		b.mu.Lock()
+		defer b.mu.Unlock()
+
+		handlers := b.handlers[eventName]
+		for i, h := range handlers {
+			// Compare function pointers
+			if fmt.Sprintf("%p", h) == fmt.Sprintf("%p", handler) {
+				b.handlers[eventName] = append(handlers[:i], handlers[i+1:]...)
+				break
+			}
+		}
+	}
 }
 
 // Publish broadcasts an event to all registered handlers
@@ -80,6 +97,8 @@ func (b *Bus) Publish(ctx context.Context, event Event) {
 	errorHandler := b.errorHandler
 	b.mu.RUnlock()
 
+	slog.Info("Event bus publishing", "event", event.Name, "handlers_count", len(handlers))
+
 	if !ok {
 		return
 	}
diff --git a/internal/events/types.go b/internal/events/types.go
index 356805d..da467c4 100644
--- a/internal/events/types.go
+++ b/internal/events/types.go
@@ -5,15 +5,17 @@ package events
 // Each module should define its own event constants here.
 const (
 	// Auth module events
-	EventAuthMagicCodeRequested = "auth.magic_code_requested"
-	EventAuthUserCreated        = "auth.user.created"
-	EventAuthUserLoggedIn       = "auth.user.logged_in"
-	EventAuthUserLoggedOut      = "auth.user.logged_out"
-	EventAuthSessionCreated     = "auth.session.created"
-	EventAuthSessionRevoked     = "auth.session.revoked"
-	EventAuthProfileUpdated     = "auth.profile.updated"
-	EventAuthEmailChanged       = "auth.email.changed"
-	EventAuthPhoneChanged       = "auth.phone.changed"
+	EventAuthMagicCodeRequested         = "auth.magic_code_requested"
+	EventAuthUserCreated                = "auth.user.created"
+	EventAuthUserRegistered             = "auth.user.registered"
+	EventAuthUserLoggedIn               = "auth.user.logged_in"
+	EventAuthUserLoggedOut              = "auth.user.logged_out"
+	EventAuthSessionCreated             = "auth.session.created"
+	EventAuthSessionRevoked             = "auth.session.revoked"
+	EventAuthProfileUpdated             = "auth.profile.updated"
+	EventAuthEmailChanged               = "auth.email.changed"
+	EventAuthPhoneChanged               = "auth.phone.changed"
+	EventAuthEmailVerificationRequested = "auth.email_verification_requested"
 
 	// OAuth events
 	EventOAuthAccountLinked   = "auth.oauth.account_linked"
@@ -23,6 +25,74 @@ const (
 	EventUserCreated = "user.created"
 	EventUserUpdated = "user.updated"
 	EventUserDeleted = "user.deleted"
+
+	// Audit events
+	EventAuditLogCreated = "audit.log.created"
+
+	// KYC events
+	EventKYCDocumentUploaded      = "kyc.document_uploaded"
+	EventKYCVerificationInitiated = "kyc.verification_initiated"
+	EventKYCUserScreened          = "kyc.user_screened"
+	EventKYCVerified              = "kyc.verified"
+	EventKYCScreeningMatch        = "kyc.screening_match"
+
+	// Positions events
+	EventPositionsOpened  = "positions.opened"
+	EventPositionWon      = "position.won"
+	EventPositionRefunded = "position.refunded"
+	EventPositionsInsured = "positions.insured"
+
+	// Derivatives events
+	EventDerivativesContractCreated   = "derivatives.contract_created"
+	EventDerivativesOptionBought      = "derivatives.option_bought"
+	EventDerivativesContractFilled    = "derivatives.contract_filled"
+	EventDerivativesContractSettled   = "derivatives.contract_settled"
+	EventDerivativesContractCancelled = "derivatives.contract_cancelled"
+	EventDerivativesContractExpired   = "derivatives.contract_expired"
+
+	// Events module events
+	EventEventCreated        = "events.created"
+	EventEventUpdated        = "events.updated"
+	EventEventRescheduled    = "events.rescheduled"
+	EventEventCancelled      = "events.cancelled"
+	EventEventResultProposed = "events.result_proposed"
+	EventTemplateCreated     = "events.template_created"
+	EventTemplateUpdated     = "events.template_updated"
+	EventPoolUpdated         = "events.pool_updated"
+	EventLiveUpdate          = "events.live_update"
+
+	// Settlement events
+	EventSettlementCompleted = "settlement.completed"
+	EventSettlementRefunded  = "settlement.refunded"
+	EventSettlementVoided    = "settlement.voided"
+
+	// Dispute events
+	EventDisputeCreated  = "dispute.created"
+	EventDisputeResolved = "dispute.resolved"
+
+	// Feeds events
+	EventFeedsResultReported = "feeds.result_reported"
+
+	// Wallet events
+	EventWalletCurrencyExchanged     = "wallet.currency_exchanged"
+	EventWalletIntegrityVerified     = "wallet.integrity_verified"
+	EventWalletBalanceAdjusted       = "wallet.balance_adjusted"
+	EventWalletConfigUpdated         = "wallet.config.updated"
+	EventWalletIntentVerifyIntegrity = "wallet.intent.verify_integrity"
+
+	// Messaging events
+	EventMessagingProviderCreated = "messaging.provider.created"
+	EventMessagingMessageSent     = "messaging.message.sent"
+	EventMessagingMessageReceived = "messaging.message.received"
+	EventMessagingStatusUpdated   = "messaging.status.updated"
+	EventMessagingWebhookReceived = "messaging.webhook.received"
+	EventMessagingSendCommand     = "messaging.send_command"
+
+	// Bot Intent events (Decoupled requests)
+	EventBotIntentBalanceRequested = "bot.intent.balance_requested"
+	EventBotIntentProfileRequested = "bot.intent.profile_requested"
+	EventBotIntentEventsRequested  = "bot.intent.events_requested"
+	EventBotIntentBetRequested     = "bot.intent.bet_requested"
 )
 
 // EventPayload provides type-safe payload construction helpers.
@@ -78,3 +148,16 @@ func NewOAuthAccountLinkedPayload(userID, provider, providerUserID string) Event
 		"provider_user_id": providerUserID,
 	}
 }
+
+// NewUserRegisteredPayload creates a payload for auth.user.registered events.
+func NewUserRegisteredPayload(userID, email, phone, displayName, nationality, docType, docNumber string) EventPayload {
+	return EventPayload{
+		"user_id":         userID,
+		"email":           email,
+		"phone":           phone,
+		"display_name":    displayName,
+		"nationality":     nationality,
+		"document_type":   docType,
+		"document_number": docNumber,
+	}
+}
diff --git a/internal/feature/flags.go b/internal/feature/flags.go
index d995805..e77c964 100644
--- a/internal/feature/flags.go
+++ b/internal/feature/flags.go
@@ -5,7 +5,15 @@ package feature
 
 import (
 	"context"
+	"fmt"
 	"sync"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+const (
+	flagTrue  = "true"
+	flagFalse = "false"
 )
 
 // Flag represents a feature flag with its configuration.
@@ -173,6 +181,115 @@ func (m *InMemoryManager) RegisterFlag(name, description string, enabled bool) {
 	})
 }
 
+// SQLManager is a database-backed implementation of feature flag management.
+type SQLManager struct {
+	db *pgxpool.Pool
+	// tableMap maps module/context to table name
+	tableMap map[string]string
+}
+
+// NewSQLManager creates a new SQLManager.
+func NewSQLManager(db *pgxpool.Pool) *SQLManager {
+	return &SQLManager{
+		db: db,
+		tableMap: map[string]string{
+			"system":     "admin.system_config",
+			"feeds":      "feeds.feed_config",
+			"auth":       "auth.auth_config",
+			"bets":       "bets.bets_config",
+			"events":     "events.events_config",
+			"kyc":        "kyc.kyc_config",
+			"wallet":     "wallet.wallet_config",
+			"settlement": "settlement.settlement_config",
+			"admin":      "admin.admin_config",
+		},
+	}
+}
+
+// IsEnabled checks if a feature flag is enabled globally.
+// It assumes the flag is in the "system" context.
+func (m *SQLManager) IsEnabled(ctx context.Context, flagName string) bool {
+	return m.IsEnabledFor(ctx, flagName, Context{Attributes: map[string]interface{}{"context": "system"}})
+}
+
+// IsEnabledFor checks if a feature flag is enabled for a specific context.
+// The context should contain a "context" attribute mapping to a module name.
+func (m *SQLManager) IsEnabledFor(ctx context.Context, flagName string, featureCtx Context) bool {
+	module, ok := featureCtx.Attributes["context"].(string)
+	if !ok {
+		module = "system"
+	}
+
+	tableName, ok := m.tableMap[module]
+	if !ok {
+		return false
+	}
+
+	query := "SELECT value FROM " + tableName + " WHERE key = $1"
+
+	var val string
+
+	err := m.db.QueryRow(ctx, query, flagName).Scan(&val)
+	if err != nil {
+		return false
+	}
+
+	return val == flagTrue
+}
+
+// GetFlag returns the full flag configuration (simplified for SQLManager).
+func (m *SQLManager) GetFlag(ctx context.Context, flagName string) (*Flag, bool) {
+	// For now, only basic Enabled check is implemented in SQLManager
+	enabled := m.IsEnabled(ctx, flagName)
+	return &Flag{Name: flagName, Enabled: enabled}, true
+}
+
+// SetFlag updates or creates a flag in the "system" context.
+func (m *SQLManager) SetFlag(ctx context.Context, flag Flag) error {
+	query := `
+		INSERT INTO admin.system_config (key, value, updated_at)
+		VALUES ($1, $2, NOW())
+		ON CONFLICT (key) DO UPDATE
+		SET value = EXCLUDED.value, updated_at = NOW()
+	`
+
+	val := flagFalse
+
+	if flag.Enabled {
+		val = flagTrue
+	}
+
+	if _, err := m.db.Exec(ctx, query, flag.Name, val); err != nil {
+		return fmt.Errorf("failed to set feature flag in database: %w", err)
+	}
+
+	return nil
+}
+
+// ListFlags returns all registered flags from the "system" context.
+func (m *SQLManager) ListFlags(ctx context.Context) []Flag {
+	query := "SELECT key, value FROM admin.system_config"
+
+	rows, err := m.db.Query(ctx, query)
+	if err != nil {
+		return nil
+	}
+
+	defer rows.Close()
+
+	var flags []Flag
+
+	for rows.Next() {
+		var key, val string
+
+		if err := rows.Scan(&key, &val); err == nil {
+			flags = append(flags, Flag{Name: key, Enabled: val == flagTrue})
+		}
+	}
+
+	return flags
+}
+
 // hashToBucket converts a string to a bucket number (0-100) for consistent hashing.
 func hashToBucket(s string) int {
 	if s == "" {
@@ -182,8 +299,8 @@ func hashToBucket(s string) int {
 	// Simple hash function for bucket assignment
 	var hash uint32
 
-	for _, c := range s {
-		hash = hash*31 + uint32(c)
+	for _, b := range []byte(s) {
+		hash = hash*31 + uint32(b)
 	}
 
 	return int(hash % 100)
diff --git a/internal/feature/sql_manager_integration_test.go b/internal/feature/sql_manager_integration_test.go
new file mode 100644
index 0000000..be49457
--- /dev/null
+++ b/internal/feature/sql_manager_integration_test.go
@@ -0,0 +1,180 @@
+package feature_test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/cmelgarejo/go-modulith-template/internal/config"
+	"github.com/cmelgarejo/go-modulith-template/internal/events"
+	"github.com/cmelgarejo/go-modulith-template/internal/feature"
+	"github.com/cmelgarejo/go-modulith-template/internal/migration"
+	"github.com/cmelgarejo/go-modulith-template/internal/registry"
+	"github.com/cmelgarejo/go-modulith-template/internal/testutil"
+	"github.com/jackc/pgx/v5/pgxpool"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestIntegration_SQLManager(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping integration test")
+	}
+
+	ctx := context.Background()
+	pool, cleanup := setupTestDB(ctx, t)
+
+	defer cleanup()
+
+	manager := feature.NewSQLManager(pool)
+
+	t.Run("IsEnabled_DefaultValues", func(t *testing.T) {
+		testDefaultValues(ctx, t, manager)
+	})
+
+	t.Run("SetAndGetFlag", func(t *testing.T) {
+		testSetAndGetFlag(ctx, t, manager)
+	})
+
+	t.Run("ListFlags", func(t *testing.T) {
+		testListFlags(ctx, t, manager)
+	})
+
+	t.Run("IsEnabledFor_ModuleContext", func(t *testing.T) {
+		testModuleContext(ctx, t, manager)
+	})
+}
+
+func setupTestDB(ctx context.Context, t *testing.T) (*pgxpool.Pool, func()) {
+	container, err := testutil.NewPostgresContainer(ctx, t)
+	if err != nil {
+		t.Fatalf("Failed to create postgres container: %v", err)
+	}
+
+	cleanup := func() {
+		if err := container.Close(ctx); err != nil {
+			t.Logf("Failed to close container: %v", err)
+		}
+	}
+
+	pool, err := container.Pool(ctx)
+	if err != nil {
+		cleanup()
+		t.Fatalf("Failed to connect to database: %v", err)
+	}
+
+	createMockSchema(ctx, t, pool)
+
+	runMigrationsAndSeeds(ctx, t, container.DSN, pool)
+
+	return pool, func() {
+		pool.Close()
+		cleanup()
+	}
+}
+
+func createMockSchema(ctx context.Context, t *testing.T, pool *pgxpool.Pool) {
+	t.Helper()
+	// Create missing admin schema and system_config table for template-only tests
+	_, err := pool.Exec(ctx, `
+		CREATE SCHEMA IF NOT EXISTS admin;
+		CREATE TABLE IF NOT EXISTS admin.system_config (
+			key TEXT PRIMARY KEY,
+			value TEXT NOT NULL,
+			updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+		);
+		-- Add other tables if needed by tableMap
+		CREATE SCHEMA IF NOT EXISTS kyc;
+		CREATE TABLE IF NOT EXISTS kyc.kyc_config (
+			key TEXT PRIMARY KEY,
+			value TEXT NOT NULL,
+			updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+		);
+
+		-- Add default flags expected by tests
+		INSERT INTO admin.system_config (key, value) VALUES 
+			('feeds_enabled', 'false'),
+			('kyc_enabled', 'true'),
+			('module_management_enabled', 'true')
+		ON CONFLICT (key) DO NOTHING;
+	`)
+	if err != nil {
+		t.Fatalf("Failed to create mock schema: %v", err)
+	}
+}
+
+func runMigrationsAndSeeds(ctx context.Context, t *testing.T, dsn string, pool *pgxpool.Pool) {
+	t.Helper()
+	// Run migrations
+	cfg := &config.AppConfig{}
+	reg := registry.New(
+		registry.WithConfig(cfg),
+		registry.WithDatabase(pool),
+		registry.WithEventBus(events.NewBus()),
+	)
+
+	migrationRunner := migration.NewRunner(dsn, reg)
+	if err := migrationRunner.RunAll(); err != nil {
+		t.Fatalf("Failed to run migrations: %v", err)
+	}
+
+	// Run seeding
+	seeder, err := migration.NewSeeder(dsn, reg)
+	if err != nil {
+		t.Fatalf("Failed to create seeder: %v", err)
+	}
+
+	if err := seeder.SeedAll(ctx); err != nil {
+		_ = seeder.Close()
+
+		t.Fatalf("Failed to run seeding: %v", err)
+	}
+
+	_ = seeder.Close()
+}
+
+func testDefaultValues(ctx context.Context, t *testing.T, manager *feature.SQLManager) {
+	// These should be true from migration
+	assert.False(t, manager.IsEnabled(ctx, "feeds_enabled"))
+	assert.True(t, manager.IsEnabled(ctx, "kyc_enabled"))
+	assert.True(t, manager.IsEnabled(ctx, "module_management_enabled"))
+}
+
+func testSetAndGetFlag(ctx context.Context, t *testing.T, manager *feature.SQLManager) {
+	err := manager.SetFlag(ctx, feature.Flag{
+		Name:    "new_feature",
+		Enabled: true,
+	})
+	assert.NoError(t, err)
+	assert.True(t, manager.IsEnabled(ctx, "new_feature"))
+
+	err = manager.SetFlag(ctx, feature.Flag{
+		Name:    "new_feature",
+		Enabled: false,
+	})
+	assert.NoError(t, err)
+	assert.False(t, manager.IsEnabled(ctx, "new_feature"))
+}
+
+func testListFlags(ctx context.Context, t *testing.T, manager *feature.SQLManager) {
+	flags := manager.ListFlags(ctx)
+	assert.NotEmpty(t, flags)
+
+	found := false
+
+	for _, f := range flags {
+		if f.Name == "kyc_enabled" {
+			found = true
+			break
+		}
+	}
+
+	assert.True(t, found, "expected to find kyc_enabled in list")
+}
+
+func testModuleContext(ctx context.Context, t *testing.T, manager *feature.SQLManager) {
+	// Mock a value in another module's config table if possible
+	// For now we just test the 'system' default
+	featureCtx := feature.Context{
+		Attributes: map[string]interface{}{"context": "system"},
+	}
+	assert.True(t, manager.IsEnabledFor(ctx, "kyc_enabled", featureCtx))
+}
diff --git a/internal/graphql/resolver/resolver.go b/internal/graphql/resolver/resolver.go
index 5b3a8ec..20e970c 100644
--- a/internal/graphql/resolver/resolver.go
+++ b/internal/graphql/resolver/resolver.go
@@ -1,6 +1,6 @@
 // Package resolver implements GraphQL resolvers.
 // This package provides the root resolver structure that will be used by gqlgen
-// when GraphQL is initialized via `make add-graphql`.
+// when GraphQL is initialized via `just add-graphql`.
 //
 // The resolver structure is ready to use and provides:
 // - Query resolver for read operations
@@ -30,19 +30,19 @@ func NewRootResolver(eventBus *events.Bus, wsHub *websocket.Hub) *RootResolver {
 }
 
 // Query returns the query resolver.
-// This will implement generated.QueryResolver after running: make add-graphql
+// This will implement generated.QueryResolver after running: just add-graphql
 func (r *RootResolver) Query() interface{} {
 	return r.queryResolver
 }
 
 // Mutation returns the mutation resolver.
-// This will implement generated.MutationResolver after running: make add-graphql
+// This will implement generated.MutationResolver after running: just add-graphql
 func (r *RootResolver) Mutation() interface{} {
 	return r.mutationResolver
 }
 
 // Subscription returns the subscription resolver.
-// This will implement generated.SubscriptionResolver after running: make add-graphql
+// This will implement generated.SubscriptionResolver after running: just add-graphql
 func (r *RootResolver) Subscription() interface{} {
 	return r.subscriptionResolver
 }
diff --git a/internal/graphql/server.go b/internal/graphql/server.go
index 9f09887..07fe1f5 100644
--- a/internal/graphql/server.go
+++ b/internal/graphql/server.go
@@ -13,17 +13,17 @@ import (
 
 // Setup initializes and returns a GraphQL handler.
 // Returns nil if GraphQL is not properly configured.
-// This is a stub - the actual implementation requires running: make add-graphql
+// This is a stub - the actual implementation requires running: just add-graphql
 func Setup(_ context.Context, _ *events.Bus, _ *websocket.Hub) http.Handler {
 	// Stub implementation - returns nil until GraphQL is initialized
-	// After running: make add-graphql, this will return a proper handler
+	// After running: just add-graphql, this will return a proper handler
 	return nil
 }
 
 // PlaygroundHandler returns the GraphQL playground handler.
-// This is a stub - the actual implementation requires running: make add-graphql
+// This is a stub - the actual implementation requires running: just add-graphql
 func PlaygroundHandler() http.Handler {
 	// Stub implementation - returns nil until GraphQL is initialized
-	// After running: make add-graphql, this will return a proper handler
+	// After running: just add-graphql, this will return a proper handler
 	return http.NotFoundHandler()
 }
diff --git a/internal/graphql/server_test.go b/internal/graphql/server_test.go
index c28c3ab..85e38ae 100644
--- a/internal/graphql/server_test.go
+++ b/internal/graphql/server_test.go
@@ -11,12 +11,12 @@ import (
 	"github.com/cmelgarejo/go-modulith-template/internal/websocket"
 )
 
-// Note: These tests require GraphQL to be initialized (run: make add-graphql)
+// Note: These tests require GraphQL to be initialized (run: just add-graphql)
 // They will be skipped if the Setup function doesn't exist yet.
 // Once GraphQL is set up, these tests will run and verify the server functionality.
 
 func TestSetup_WhenGraphQLInitialized(t *testing.T) {
-	// This test will only work after running: make add-graphql
+	// This test will only work after running: just add-graphql
 	// We check if Setup function exists by trying to call it
 	// If it fails to compile, the test is skipped
 	ctx := context.Background()
@@ -32,7 +32,7 @@ func TestSetup_WhenGraphQLInitialized(t *testing.T) {
 	handler := Setup(ctx, eventBus, wsHub)
 
 	if handler == nil {
-		t.Skip("GraphQL not initialized. Run: make add-graphql to enable these tests")
+		t.Skip("GraphQL not initialized. Run: just add-graphql to enable these tests")
 	}
 
 	// Verify it's an http.Handler
@@ -49,7 +49,7 @@ func TestSetup_WithNilEventBus_WhenGraphQLInitialized(t *testing.T) {
 	handler := Setup(ctx, nil, wsHub)
 
 	if handler == nil {
-		t.Skip("GraphQL not initialized. Run: make add-graphql")
+		t.Skip("GraphQL not initialized. Run: just add-graphql")
 	}
 
 	// Should still create handler (resolvers handle nil gracefully)
@@ -69,7 +69,7 @@ func TestSetup_HandlerServesHTTP_WhenGraphQLInitialized(t *testing.T) {
 	handler := Setup(ctx, eventBus, wsHub)
 
 	if handler == nil {
-		t.Skip("GraphQL not initialized. Run: make add-graphql")
+		t.Skip("GraphQL not initialized. Run: just add-graphql")
 	}
 
 	// Create a test request
@@ -89,7 +89,7 @@ func TestPlaygroundHandler_WhenGraphQLInitialized(t *testing.T) {
 	handler := PlaygroundHandler()
 
 	if handler == nil {
-		t.Skip("GraphQL not initialized. Run: make add-graphql")
+		t.Skip("GraphQL not initialized. Run: just add-graphql")
 	}
 
 	// Verify it's an http.Handler
@@ -100,7 +100,7 @@ func TestPlaygroundHandler_ServesHTTP_WhenGraphQLInitialized(t *testing.T) {
 	handler := PlaygroundHandler()
 
 	if handler == nil {
-		t.Skip("GraphQL not initialized. Run: make add-graphql")
+		t.Skip("GraphQL not initialized. Run: just add-graphql")
 	}
 
 	req := httptest.NewRequest(http.MethodGet, "/graphql/playground", nil)
@@ -109,9 +109,9 @@ func TestPlaygroundHandler_ServesHTTP_WhenGraphQLInitialized(t *testing.T) {
 	handler.ServeHTTP(w, req)
 
 	// Stub returns NotFoundHandler, so we expect 404 until GraphQL is initialized
-	// After running: make add-graphql, this should return 200
+	// After running: just add-graphql, this should return 200
 	if w.Code == http.StatusNotFound {
-		t.Skip("GraphQL not fully initialized. Playground returns 404 until setup is complete. Run: make add-graphql")
+		t.Skip("GraphQL not fully initialized. Playground returns 404 until setup is complete. Run: just add-graphql")
 	}
 
 	// When GraphQL is initialized, should return HTML content
@@ -136,7 +136,7 @@ func TestSetup_ConcurrentRequests_WhenGraphQLInitialized(t *testing.T) {
 	handler := Setup(ctx, eventBus, wsHub)
 
 	if handler == nil {
-		t.Skip("GraphQL not initialized. Run: make add-graphql")
+		t.Skip("GraphQL not initialized. Run: just add-graphql")
 	}
 
 	// Test concurrent requests
@@ -177,7 +177,7 @@ func TestSetup_HandlerIsReusable_WhenGraphQLInitialized(t *testing.T) {
 	handler := Setup(ctx, eventBus, wsHub)
 
 	if handler == nil {
-		t.Skip("GraphQL not initialized. Run: make add-graphql")
+		t.Skip("GraphQL not initialized. Run: just add-graphql")
 	}
 
 	// Use the same handler multiple times
diff --git a/internal/middleware/cors.go b/internal/middleware/cors.go
index c296ec9..432dc1e 100644
--- a/internal/middleware/cors.go
+++ b/internal/middleware/cors.go
@@ -62,14 +62,7 @@ func CORS(config CORSConfig) func(http.Handler) http.Handler {
 
 // setCORSHeaders sets the appropriate CORS headers on the response.
 func setCORSHeaders(w http.ResponseWriter, r *http.Request, config CORSConfig) {
-	origin := r.Header.Get("Origin")
-
-	// Check if origin is allowed
-	if origin != "" && isOriginAllowed(origin, config.AllowedOrigins) {
-		w.Header().Set("Access-Control-Allow-Origin", origin)
-	} else if len(config.AllowedOrigins) == 1 && config.AllowedOrigins[0] == "*" {
-		w.Header().Set("Access-Control-Allow-Origin", "*")
-	}
+	setOriginHeaders(w, r, config)
 
 	if config.AllowCredentials {
 		w.Header().Set("Access-Control-Allow-Credentials", "true")
@@ -92,6 +85,42 @@ func setCORSHeaders(w http.ResponseWriter, r *http.Request, config CORSConfig) {
 	}
 }
 
+func setOriginHeaders(w http.ResponseWriter, r *http.Request, config CORSConfig) {
+	origin := r.Header.Get("Origin")
+	hasGlobalWildcard := false
+
+	for _, allowed := range config.AllowedOrigins {
+		if allowed == "*" {
+			hasGlobalWildcard = true
+			break
+		}
+	}
+
+	if origin != "" && isOriginAllowed(origin, config.AllowedOrigins) {
+		setAllowedOriginHeader(w, origin, hasGlobalWildcard, config.AllowCredentials)
+		return
+	}
+
+	if hasGlobalWildcard {
+		if config.AllowCredentials {
+			w.Header().Set("Access-Control-Allow-Origin", "null")
+		} else {
+			w.Header().Set("Access-Control-Allow-Origin", "*")
+		}
+	}
+}
+
+func setAllowedOriginHeader(w http.ResponseWriter, origin string, hasGlobalWildcard, allowCredentials bool) {
+	switch {
+	case hasGlobalWildcard && allowCredentials:
+		w.Header().Set("Access-Control-Allow-Origin", "null")
+	case hasGlobalWildcard:
+		w.Header().Set("Access-Control-Allow-Origin", "*")
+	default:
+		w.Header().Set("Access-Control-Allow-Origin", origin)
+	}
+}
+
 // isOriginAllowed checks if the origin is in the allowed origins list.
 func isOriginAllowed(origin string, allowedOrigins []string) bool {
 	for _, allowed := range allowedOrigins {
diff --git a/internal/middleware/logging.go b/internal/middleware/logging.go
index 20831e9..3d46408 100644
--- a/internal/middleware/logging.go
+++ b/internal/middleware/logging.go
@@ -2,7 +2,10 @@
 package middleware
 
 import (
+	"bufio"
+	"fmt"
 	"log/slog"
+	"net"
 	"net/http"
 	"time"
 )
@@ -34,6 +37,19 @@ func (rw *responseWriter) Write(b []byte) (int, error) {
 	return n, err
 }
 
+func (rw *responseWriter) Hijack() (net.Conn, *bufio.ReadWriter, error) {
+	if hj, ok := rw.ResponseWriter.(http.Hijacker); ok {
+		conn, rw, err := hj.Hijack()
+		if err != nil {
+			return nil, nil, fmt.Errorf("failed to hijack connection: %w", err)
+		}
+
+		return conn, rw, nil
+	}
+
+	return nil, nil, fmt.Errorf("http.ResponseWriter does not implement http.Hijacker")
+}
+
 // LoggingConfig configures the logging middleware behavior.
 type LoggingConfig struct {
 	// SkipPaths are paths that should not be logged (e.g., health checks).
@@ -53,6 +69,7 @@ func DefaultLoggingConfig() LoggingConfig {
 			"/healthz",
 			"/readyz",
 			"/metrics",
+			"/ws",
 		},
 		LogRequestBody:       false,
 		LogResponseBody:      false,
@@ -85,44 +102,78 @@ func Logging(config LoggingConfig) func(http.Handler) http.Handler {
 			// Calculate duration
 			duration := time.Since(start)
 
-			// Build log attributes
-			attrs := []slog.Attr{
-				slog.String("method", r.Method),
-				slog.String("path", r.URL.Path),
-				slog.Int("status", wrapped.statusCode),
-				slog.Duration("duration", duration),
-				slog.Int("bytes", wrapped.bytesWritten),
-				slog.String("remote_addr", r.RemoteAddr),
-				slog.String("user_agent", r.UserAgent()),
-			}
+			// Build and execute log
+			attrs := buildLogAttrs(r, wrapped, duration)
+			executeLog(r, wrapped, duration, config.SlowRequestThreshold, attrs)
+		})
+	}
+}
 
-			// Add request ID if present
-			if reqID := GetRequestID(r.Context()); reqID != "" {
-				attrs = append(attrs, slog.String("request_id", reqID))
-			}
+func buildLogAttrs(r *http.Request, wrapped *responseWriter, duration time.Duration) []slog.Attr {
+	attrs := []slog.Attr{
+		slog.String("method", r.Method),
+		slog.String("path", r.URL.Path),
+		slog.Int("status", wrapped.statusCode),
+		slog.Duration("duration", duration),
+		slog.Int("bytes", wrapped.bytesWritten),
+		slog.String("remote_addr", r.RemoteAddr),
+		slog.String("user_agent", r.UserAgent()),
+	}
 
-			// Add query params if present (be careful with PII)
-			if r.URL.RawQuery != "" {
-				attrs = append(attrs, slog.String("query", r.URL.RawQuery))
-			}
+	if reqID := GetRequestID(r.Context()); reqID != "" {
+		attrs = append(attrs, slog.String("request_id", reqID))
+	}
 
-			// Determine log level based on status and duration
-			ctx := r.Context()
-			msg := "HTTP request"
-
-			switch {
-			case wrapped.statusCode >= 500:
-				slog.LogAttrs(ctx, slog.LevelError, msg, attrs...)
-			case wrapped.statusCode >= 400:
-				slog.LogAttrs(ctx, slog.LevelWarn, msg, attrs...)
-			case duration > config.SlowRequestThreshold:
-				attrs = append(attrs, slog.Bool("slow", true))
-				slog.LogAttrs(ctx, slog.LevelWarn, msg, attrs...)
-			default:
-				slog.LogAttrs(ctx, slog.LevelInfo, msg, attrs...)
+	if r.URL.RawQuery != "" {
+		q := r.URL.Query()
+		for k := range q {
+			if isSensitiveField(k) {
+				q.Set(k, "[REDACTED]")
 			}
-		})
+		}
+
+		attrs = append(attrs, slog.String("query", q.Encode()))
 	}
+
+	return attrs
+}
+
+func executeLog(r *http.Request, wrapped *responseWriter, duration, threshold time.Duration, attrs []slog.Attr) {
+	ctx := r.Context()
+	msg := "HTTP request"
+
+	switch {
+	case wrapped.statusCode >= 500:
+		slog.LogAttrs(ctx, slog.LevelError, msg, attrs...)
+	case wrapped.statusCode >= 400:
+		slog.LogAttrs(ctx, slog.LevelWarn, msg, attrs...)
+	case duration > threshold:
+		attrs = append(attrs, slog.Bool("slow", true))
+		slog.LogAttrs(ctx, slog.LevelWarn, msg, attrs...)
+	default:
+		slog.LogAttrs(ctx, slog.LevelInfo, msg, attrs...)
+	}
+}
+
+// isSensitiveField returns true if the key name indicates a sensitive field.
+func isSensitiveField(key string) bool {
+	// Add common sensitive field names here
+	sensitive := map[string]bool{
+		"password":      true,
+		"token":         true,
+		"access_token":  true,
+		"refresh_token": true,
+		"auth":          true,
+		"authorization": true,
+		"secret":        true,
+		"key":           true,
+		"apikey":        true,
+		"api_key":       true,
+		"session":       true,
+		"sessionid":     true,
+	}
+
+	return sensitive[key]
 }
 
 // LoggingWithDefaults returns the logging middleware with default configuration.
diff --git a/internal/middleware/rate_limit.go b/internal/middleware/rate_limit.go
index 18f549c..6e497e9 100644
--- a/internal/middleware/rate_limit.go
+++ b/internal/middleware/rate_limit.go
@@ -1,53 +1,66 @@
 package middleware
 
 import (
+	"context"
 	"net/http"
+	"strings"
 	"sync"
 	"time"
 
+	"github.com/cmelgarejo/go-modulith-template/internal/cache"
 	"golang.org/x/time/rate"
 )
 
 // RateLimiter holds the rate limiter configuration and state.
 type RateLimiter struct {
-	limiters map[string]*rate.Limiter
+	limiters map[string]*limiterWithUsage
 	mu       sync.RWMutex
 	rate     rate.Limit
 	burst    int
+	cache    cache.Cache // Optional: for centralized rate limiting
+	maxAge   time.Duration
+}
+
+type limiterWithUsage struct {
+	limiter    *rate.Limiter
+	lastAccess time.Time
 }
 
 // NewRateLimiter creates a new rate limiter middleware.
 // rate is requests per second, burst is the maximum burst size.
-func NewRateLimiter(rps int, burst int) *RateLimiter {
-	return &RateLimiter{
-		limiters: make(map[string]*rate.Limiter),
+func NewRateLimiter(rps int, burst int, c cache.Cache) *RateLimiter {
+	rl := &RateLimiter{
+		limiters: make(map[string]*limiterWithUsage),
 		rate:     rate.Limit(rps),
 		burst:    burst,
+		cache:    c,
+		maxAge:   10 * time.Minute,
 	}
+
+	// Start cleanup goroutine
+	go rl.CleanupExpired(5 * time.Minute)
+
+	return rl
 }
 
 // getLimiter returns a rate limiter for the given key (typically IP address).
 func (rl *RateLimiter) getLimiter(key string) *rate.Limiter {
-	rl.mu.RLock()
-	limiter, exists := rl.limiters[key]
-	rl.mu.RUnlock()
-
-	if exists {
-		return limiter
-	}
-
 	rl.mu.Lock()
 	defer rl.mu.Unlock()
 
-	// Double-check after acquiring write lock
-	if limiter, exists := rl.limiters[key]; exists {
-		return limiter
+	l, exists := rl.limiters[key]
+	if exists {
+		l.lastAccess = time.Now()
+		return l.limiter
 	}
 
-	limiter = rate.NewLimiter(rl.rate, rl.burst)
-	rl.limiters[key] = limiter
+	l = &limiterWithUsage{
+		limiter:    rate.NewLimiter(rl.rate, rl.burst),
+		lastAccess: time.Now(),
+	}
+	rl.limiters[key] = l
 
-	return limiter
+	return l.limiter
 }
 
 // Middleware returns an HTTP middleware that rate limits requests.
@@ -56,6 +69,15 @@ func (rl *RateLimiter) Middleware() func(http.Handler) http.Handler {
 		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 			// Use IP address as the key for rate limiting
 			ip := getIPAddress(r)
+
+			// Centralized limiting check if cache is available
+			if rl.cache != nil {
+				if blocked := rl.checkCentralizedLimit(r.Context(), ip); blocked {
+					http.Error(w, "Too Many Requests (Centralized)", http.StatusTooManyRequests)
+					return
+				}
+			}
+
 			limiter := rl.getLimiter(ip)
 
 			if !limiter.Allow() {
@@ -68,26 +90,51 @@ func (rl *RateLimiter) Middleware() func(http.Handler) http.Handler {
 	}
 }
 
-// CleanupExpired removes limiters that haven't been used recently.
-// Should be called periodically in a goroutine.
-// Note: This is a no-op implementation. In production, you would track
-// last access time and remove old entries to prevent memory leaks.
+func (rl *RateLimiter) checkCentralizedLimit(ctx context.Context, ip string) bool {
+	key := "ratelimit:" + ip
+
+	count, err := rl.cache.Increment(ctx, key)
+	if err != nil {
+		return false
+	}
+
+	if count == 1 {
+		_ = rl.cache.Expire(ctx, key, 1*time.Second)
+	}
+
+	// If centralized count exceeds (rps * 2) or some threshold, block.
+	return count > int64(rl.burst*2)
+}
+
+// CleanupExpired removes limiters that haven't been used recently to prevent memory leaks.
 func (rl *RateLimiter) CleanupExpired(interval time.Duration) {
 	ticker := time.NewTicker(interval)
 	defer ticker.Stop()
 
 	for range ticker.C {
-		// TODO: Implement cleanup logic to remove old limiters
-		// Example: track last access time and remove entries older than threshold
-		continue
+		rl.mu.Lock()
+
+		now := time.Now()
+		for ip, l := range rl.limiters {
+			if now.Sub(l.lastAccess) > rl.maxAge {
+				delete(rl.limiters, ip)
+			}
+		}
+
+		rl.mu.Unlock()
 	}
 }
 
 // getIPAddress extracts the client IP address from the request.
+// It prioritizes X-Forwarded-For but takes only the first IP to mitigate spoofing.
 func getIPAddress(r *http.Request) string {
 	// Check X-Forwarded-For header (set by proxies)
 	if xff := r.Header.Get("X-Forwarded-For"); xff != "" {
-		return xff
+		// Take only the first IP in the list to prevent spoofing of internal IPs
+		parts := strings.Split(xff, ",")
+		if len(parts) > 0 {
+			return strings.TrimSpace(parts[0])
+		}
 	}
 
 	// Check X-Real-IP header
diff --git a/internal/middleware/security.go b/internal/middleware/security.go
new file mode 100644
index 0000000..0dd2a3b
--- /dev/null
+++ b/internal/middleware/security.go
@@ -0,0 +1,33 @@
+package middleware
+
+import (
+	"net/http"
+)
+
+// SecurityHeaders returns a middleware that adds standard security headers to the response.
+func SecurityHeaders() func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			// HSTS: Strict-Transport-Security (1 year)
+			w.Header().Set("Strict-Transport-Security", "max-age=31536000; includeSubDomains")
+
+			// X-Frame-Options: Prevent clickjacking
+			w.Header().Set("X-Frame-Options", "DENY")
+
+			// X-Content-Type-Options: Prevent MIME sniffing
+			w.Header().Set("X-Content-Type-Options", "nosniff")
+
+			// Referrer-Policy: Control referrer information
+			w.Header().Set("Referrer-Policy", "strict-origin-when-cross-origin")
+
+			// Content-Security-Policy: Modern security policy
+			// Note: This is a restrictive default, might need adjustments based on UI needs.
+			w.Header().Set("Content-Security-Policy", "default-src 'self'; script-src 'self'; object-src 'none';")
+
+			// X-XSS-Protection: Legacy but still useful for some browsers
+			w.Header().Set("X-XSS-Protection", "1; mode=block")
+
+			next.ServeHTTP(w, r)
+		})
+	}
+}
diff --git a/internal/middleware/timeout.go b/internal/middleware/timeout.go
index e3692e3..21e39e6 100644
--- a/internal/middleware/timeout.go
+++ b/internal/middleware/timeout.go
@@ -2,9 +2,12 @@
 package middleware
 
 import (
+	"bufio"
 	"context"
 	"fmt"
+	"net"
 	"net/http"
+	"strings"
 	"time"
 )
 
@@ -16,6 +19,12 @@ import (
 func Timeout(timeout time.Duration) func(http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			// Skip timeout for WebSocket connections
+			if strings.HasPrefix(r.URL.Path, "/ws") {
+				next.ServeHTTP(w, r)
+				return
+			}
+
 			ctx, cancel := context.WithTimeout(r.Context(), timeout)
 			defer cancel()
 
@@ -74,3 +83,16 @@ func (rw *timeoutResponseWriter) Write(b []byte) (int, error) {
 
 	return n, nil
 }
+
+func (rw *timeoutResponseWriter) Hijack() (net.Conn, *bufio.ReadWriter, error) {
+	if hj, ok := rw.ResponseWriter.(http.Hijacker); ok {
+		conn, rw, err := hj.Hijack()
+		if err != nil {
+			return nil, nil, fmt.Errorf("failed to hijack connection: %w", err)
+		}
+
+		return conn, rw, nil
+	}
+
+	return nil, nil, fmt.Errorf("http.ResponseWriter does not implement http.Hijacker")
+}
diff --git a/internal/migration/migration.go b/internal/migration/migration.go
index 95dd4a4..75ff6e8 100644
--- a/internal/migration/migration.go
+++ b/internal/migration/migration.go
@@ -2,6 +2,7 @@
 package migration
 
 import (
+	"context"
 	"fmt"
 	"log/slog"
 	"net/url"
@@ -11,8 +12,8 @@ import (
 	"github.com/cmelgarejo/go-modulith-template/internal/registry"
 	"github.com/golang-migrate/migrate/v4"
 
-	// Import postgres driver for migrations
-	_ "github.com/golang-migrate/migrate/v4/database/postgres"
+	// Import pgx5 driver for migrations
+	_ "github.com/golang-migrate/migrate/v4/database/pgx/v5"
 	// Import file source driver for migrations
 	_ "github.com/golang-migrate/migrate/v4/source/file"
 )
@@ -119,6 +120,11 @@ func (r *Runner) buildModuleDSN(moduleName string) (string, error) {
 		return "", fmt.Errorf("failed to parse DSN: %w", err)
 	}
 
+	// For golang-migrate with pgx/v5, the scheme must be pgx5
+	if parsedDSN.Scheme == "postgres" || parsedDSN.Scheme == "postgresql" {
+		parsedDSN.Scheme = "pgx5"
+	}
+
 	// Get existing query parameters
 	query := parsedDSN.Query()
 
@@ -218,22 +224,25 @@ func (r *Runner) rollbackMigrations(m *migrate.Migrate, moduleName string) error
 }
 
 // rollbackAllMigrations rolls back all migrations to version 0 and logs the result.
+// rollbackAllMigrations rolls back all migrations to version 0 and logs the result.
+// If the database is in a dirty state, it will log a warning and still try to proceed
+// with a full rollback (Down), as that's often the best way to clean up an inconsistent state.
 func (r *Runner) rollbackAllMigrations(m *migrate.Migrate, moduleName string) error {
 	// Check current version first to handle version 0 case
 	version, dirty, err := m.Version()
 	if err != nil && err != migrate.ErrNilVersion {
-		return fmt.Errorf("failed to get migration version: %w", err)
+		// Log error but don't return if we're trying to nuke everything
+		slog.Warn("Could not determine migration version, proceeding with nuke", "module", moduleName, "error", err)
 	}
 
 	// If no migrations are applied (version 0 or ErrNilVersion), there's nothing to rollback
-	if err == migrate.ErrNilVersion || version == 0 {
+	if (err == migrate.ErrNilVersion || version == 0) && !dirty {
 		slog.Debug("No migrations to rollback (database is at version 0)", "module", moduleName)
 		return nil
 	}
 
-	// If database is dirty, we can't rollback
 	if dirty {
-		return fmt.Errorf("database is in dirty state at version %d, use migrate-force to fix", version)
+		slog.Warn("Database is in dirty state, attempting forced rollback", "module", moduleName, "version", version)
 	}
 
 	// Rollback all migrations to version 0
@@ -251,6 +260,44 @@ func (r *Runner) rollbackAllMigrations(m *migrate.Migrate, moduleName string) er
 	return nil
 }
 
+// DropModuleSchema is a drastic fallback that drops the module's schema and its migration table.
+// This is used when standard migration rollbacks fail.
+func (r *Runner) DropModuleSchema(moduleName string) error {
+	slog.Warn("🔥 Attempting drastic fallback: dropping module schema", "module", moduleName)
+
+	// Since we're using pgxpool for regular DB operations but golang-migrate for others,
+	// we'll get a connection from our shared pool to execute the DROP SCHEMA.
+	db := r.reg.DB()
+	if db == nil {
+		return fmt.Errorf("database connection pool not available")
+	}
+
+	ctx := context.Background()
+
+	// 1. Drop the module schema (CASCADE drops all tables, views, etc.)
+	query := fmt.Sprintf("DROP SCHEMA IF EXISTS %s CASCADE", moduleName)
+	if _, err := db.Exec(ctx, query); err != nil {
+		return fmt.Errorf("failed to drop schema %s: %w", moduleName, err)
+	}
+
+	// 2. Drop the migration tracking table
+	migTable := fmt.Sprintf("%s_schema_migrations", moduleName)
+
+	query = fmt.Sprintf("DROP TABLE IF EXISTS %s CASCADE", migTable)
+	if _, err := db.Exec(ctx, query); err != nil {
+		slog.Warn("Failed to drop migration table, it might be in a different schema", "table", migTable, "error", err)
+		// Try public schema explicitly as a last resort
+		query = fmt.Sprintf("DROP TABLE IF EXISTS public.%s CASCADE", migTable)
+		if _, err := db.Exec(ctx, query); err != nil {
+			return fmt.Errorf("failed to drop migration table in public schema: %w", err)
+		}
+	}
+
+	slog.Info("✅ Module schema and migration table dropped successfully", "module", moduleName)
+
+	return nil
+}
+
 // RunForModule runs migrations for a specific module by name.
 func (r *Runner) RunForModule(moduleName string) error {
 	mod := r.reg.GetModule(moduleName)
@@ -286,7 +333,11 @@ func (r *Runner) DownAll() error {
 
 	var lastError error
 
-	for _, mod := range modules {
+	// Rollback modules in reverse order of registration
+	// This is important because modules registered later often depend on those registered earlier
+	for i := len(modules) - 1; i >= 0; i-- {
+		mod := modules[i]
+
 		migMod, ok := mod.(registry.ModuleMigrations)
 		if !ok {
 			continue
@@ -302,11 +353,15 @@ func (r *Runner) DownAll() error {
 		slog.Info("Rolling back all migrations for module", "module", mod.Name(), "path", path)
 
 		if err := r.runModuleMigrationWithDirection(mod.Name(), path, "down-all"); err != nil {
-			// Log error but continue with other modules
-			slog.Error("Failed to rollback all migrations for module", "module", mod.Name(), "error", err)
-			lastError = err
-			// Don't return error immediately - try to rollback other modules
-			continue
+			slog.Error("Failed to rollback migrations for module, attempting fallback", "module", mod.Name(), "error", err)
+
+			// Fallback: Drop the schema directly
+			if fallbackErr := r.DropModuleSchema(mod.Name()); fallbackErr != nil {
+				slog.Error("Fallback also failed", "module", mod.Name(), "error", fallbackErr)
+				lastError = fallbackErr
+
+				continue
+			}
 		}
 
 		rolledBackCount++
@@ -354,6 +409,93 @@ func (r *Runner) DownForModule(moduleName string) error {
 	return r.runModuleMigrationWithDirection(moduleName, path, "down")
 }
 
+// NukeModule forcibly drops a specific module schema.
+func (r *Runner) NukeModule(moduleName string) error {
+	mod := r.reg.GetModule(moduleName)
+	if mod == nil {
+		return fmt.Errorf("module %s not found", moduleName)
+	}
+
+	migMod, ok := mod.(registry.ModuleMigrations)
+	if !ok {
+		return fmt.Errorf("module %s does not implement ModuleMigrations", moduleName)
+	}
+
+	path := migMod.MigrationPath()
+	if path == "" {
+		return fmt.Errorf("module %s has no migration path", moduleName)
+	}
+
+	slog.Info("Nuking module schema", "module", moduleName)
+
+	if err := r.DropModuleSchema(moduleName); err != nil {
+		return fmt.Errorf("failed to nuke module schema: %w", err)
+	}
+
+	return nil
+}
+
+// NukeAll forcibly drops all registered module schemas.
+// This is a destructive operation that bypasses standard migration rollbacks
+// and ensures a clean state by dropping schemas directly.
+func (r *Runner) NukeAll() error {
+	modules := r.reg.Modules()
+	if len(modules) == 0 {
+		slog.Info("No modules registered, skipping nuke")
+		return nil
+	}
+
+	modulesWithMigrations := 0
+	droppedCount := 0
+
+	var lastError error
+
+	// Drop modules in reverse order of registration
+	for i := len(modules) - 1; i >= 0; i-- {
+		mod := modules[i]
+
+		migMod, ok := mod.(registry.ModuleMigrations)
+		if !ok {
+			continue
+		}
+
+		path := migMod.MigrationPath()
+		if path == "" {
+			continue
+		}
+
+		modulesWithMigrations++
+
+		slog.Info("Nuking all tables for module", "module", mod.Name())
+
+		if err := r.DropModuleSchema(mod.Name()); err != nil {
+			slog.Error("Failed to nuke module schema", "module", mod.Name(), "error", err)
+			lastError = err
+
+			continue
+		}
+
+		droppedCount++
+	}
+
+	if modulesWithMigrations == 0 {
+		slog.Info("No modules with migrations found to nuke")
+		return nil
+	}
+
+	if droppedCount == 0 {
+		if lastError != nil {
+			return fmt.Errorf("all module nukes failed, last error: %w", lastError)
+		}
+
+		return fmt.Errorf("failed to nuke any module")
+	}
+
+	slog.Info("All module schemas nuked successfully", "count", droppedCount, "total", modulesWithMigrations)
+
+	return nil
+}
+
 // findProjectRoot finds the project root by looking for go.mod file.
 func findProjectRoot() string {
 	wd, err := os.Getwd()
diff --git a/internal/migration/seeder.go b/internal/migration/seeder.go
index a4f75be..2c55c64 100644
--- a/internal/migration/seeder.go
+++ b/internal/migration/seeder.go
@@ -9,6 +9,8 @@ import (
 	"path/filepath"
 	"sort"
 	"strings"
+
+	"github.com/cmelgarejo/go-modulith-template/internal/registry"
 )
 
 // ModuleSeeder defines the interface for modules that provide seed data.
@@ -21,20 +23,28 @@ type ModuleSeeder interface {
 	SeedPath() string
 }
 
+// ModuleProgrammaticSeeder defines the interface for modules that provide seed data programmatically.
+type ModuleProgrammaticSeeder interface {
+	// Seed runs programmatic seed data using the application's registry/dependencies.
+	Seed(ctx context.Context, r interface{}) error
+}
+
 // ModuleRegistry defines the basic interface for accessing registered modules.
 type ModuleRegistry interface {
-	Modules() []interface{}
+	Modules() []registry.Module
 }
 
 // ModuleProvider defines the interface for accessing registered modules.
 type ModuleProvider interface {
-	GetModules() []ModuleSeeder
+	GetSQLSeeders() []ModuleSeeder
+	GetProgrammaticSeeders() []ModuleProgrammaticSeeder
 }
 
 // Seeder manages seed data execution for modules.
 type Seeder struct {
 	db       *sql.DB
 	provider ModuleProvider
+	registry ModuleRegistry
 }
 
 // registryAdapter adapts a ModuleRegistry to ModuleProvider.
@@ -42,7 +52,7 @@ type registryAdapter struct {
 	registry ModuleRegistry
 }
 
-func (r *registryAdapter) GetModules() []ModuleSeeder {
+func (r *registryAdapter) GetSQLSeeders() []ModuleSeeder {
 	modules := r.registry.Modules()
 	seeders := make([]ModuleSeeder, 0)
 
@@ -55,8 +65,21 @@ func (r *registryAdapter) GetModules() []ModuleSeeder {
 	return seeders
 }
 
+func (r *registryAdapter) GetProgrammaticSeeders() []ModuleProgrammaticSeeder {
+	modules := r.registry.Modules()
+	seeders := make([]ModuleProgrammaticSeeder, 0)
+
+	for _, mod := range modules {
+		if seeder, ok := mod.(ModuleProgrammaticSeeder); ok {
+			seeders = append(seeders, seeder)
+		}
+	}
+
+	return seeders
+}
+
 // NewSeeder creates a new seed data runner.
-func NewSeeder(dbDSN string, registry ModuleRegistry) (*Seeder, error) {
+func NewSeeder(dbDSN string, r ModuleRegistry) (*Seeder, error) {
 	db, err := sql.Open("pgx", dbDSN)
 	if err != nil {
 		return nil, fmt.Errorf("failed to open database: %w", err)
@@ -69,7 +92,8 @@ func NewSeeder(dbDSN string, registry ModuleRegistry) (*Seeder, error) {
 
 	return &Seeder{
 		db:       db,
-		provider: &registryAdapter{registry: registry},
+		provider: &registryAdapter{registry: r},
+		registry: r,
 	}, nil
 }
 
@@ -84,15 +108,83 @@ func (s *Seeder) Close() error {
 	return nil
 }
 
-// SeedAll runs seed data for all modules that implement ModuleSeeder.
+// SeedAll runs seed data for all modules that implement ModuleSeeder or ModuleProgrammaticSeeder.
 func (s *Seeder) SeedAll(ctx context.Context) error {
-	modules := s.provider.GetModules()
-	if len(modules) == 0 {
+	sqlSeeders := s.provider.GetSQLSeeders()
+	progSeeders := s.provider.GetProgrammaticSeeders()
+
+	if len(sqlSeeders) == 0 && len(progSeeders) == 0 {
 		slog.Info("No modules with seed data registered")
 		return nil
 	}
 
-	for _, seeder := range modules {
+	// 1. Run SQL Seeds
+	if err := s.runSQLSeeds(ctx, sqlSeeders); err != nil {
+		return err
+	}
+
+	// 2. Run Programmatic Seeds
+	if err := s.runProgrammaticSeeds(ctx, progSeeders); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// SeedModule runs seed data for a single module.
+// SeedModule runs seed data for a single module.
+func (s *Seeder) SeedModule(ctx context.Context, moduleName string) error {
+	ranSQL, err := s.seedSQLModule(ctx, moduleName)
+	if err != nil {
+		return err
+	}
+
+	ranProg, err := s.seedProgrammaticModule(ctx, moduleName)
+	if err != nil {
+		return err
+	}
+
+	if !ranSQL && !ranProg {
+		return fmt.Errorf("module %s not found or has no seed data", moduleName)
+	}
+
+	return nil
+}
+
+func (s *Seeder) seedSQLModule(ctx context.Context, moduleName string) (bool, error) {
+	sqlSeeders := s.provider.GetSQLSeeders()
+
+	for _, seeder := range sqlSeeders {
+		if seeder.Name() == moduleName {
+			if err := s.runSQLSeeds(ctx, []ModuleSeeder{seeder}); err != nil {
+				return true, err
+			}
+
+			return true, nil
+		}
+	}
+
+	return false, nil
+}
+
+func (s *Seeder) seedProgrammaticModule(ctx context.Context, moduleName string) (bool, error) {
+	progSeeders := s.provider.GetProgrammaticSeeders()
+
+	for _, seeder := range progSeeders {
+		if m, ok := seeder.(interface{ Name() string }); ok && m.Name() == moduleName {
+			if err := s.runProgrammaticSeeds(ctx, []ModuleProgrammaticSeeder{seeder}); err != nil {
+				return true, err
+			}
+
+			return true, nil
+		}
+	}
+
+	return false, nil
+}
+
+func (s *Seeder) runSQLSeeds(ctx context.Context, seeders []ModuleSeeder) error {
+	for _, seeder := range seeders {
 		seedPath := seeder.SeedPath()
 		if seedPath == "" {
 			continue
@@ -106,13 +198,33 @@ func (s *Seeder) SeedAll(ctx context.Context) error {
 			continue
 		}
 
-		slog.Info("Running seed data", "module", moduleName, "path", seedPath)
+		slog.Info("Running SQL seed data", "module", moduleName, "path", seedPath)
 
 		if err := s.runSeedFiles(ctx, seedPath, moduleName); err != nil {
-			return fmt.Errorf("failed to seed module %s: %w", moduleName, err)
+			return fmt.Errorf("failed to SQL seed module %s: %w", moduleName, err)
+		}
+
+		slog.Info("SQL seed data completed", "module", moduleName)
+	}
+
+	return nil
+}
+
+func (s *Seeder) runProgrammaticSeeds(ctx context.Context, seeders []ModuleProgrammaticSeeder) error {
+	for _, seeder := range seeders {
+		// We need the module name for logging, we can type assert to registry.Module if needed
+		moduleName := "unknown"
+		if m, ok := seeder.(interface{ Name() string }); ok {
+			moduleName = m.Name()
+		}
+
+		slog.Info("Running programmatic seed data", "module", moduleName)
+
+		if err := seeder.Seed(ctx, s.registry); err != nil {
+			return fmt.Errorf("failed to programmatic seed module %s: %w", moduleName, err)
 		}
 
-		slog.Info("Seed data completed", "module", moduleName)
+		slog.Info("Programmatic seed data completed", "module", moduleName)
 	}
 
 	return nil
diff --git a/internal/migration/seeder_test.go b/internal/migration/seeder_test.go
index 59545af..c6fcf59 100644
--- a/internal/migration/seeder_test.go
+++ b/internal/migration/seeder_test.go
@@ -3,23 +3,25 @@ package migration
 import (
 	"context"
 	"testing"
+
+	"github.com/cmelgarejo/go-modulith-template/internal/registry"
 )
 
 type mockSeederRegistry struct {
-	modules []interface{}
+	modules []registry.Module
 }
 
-func (m *mockSeederRegistry) Modules() []interface{} {
+func (m *mockSeederRegistry) Modules() []registry.Module {
 	return m.modules
 }
 
 func TestSeeder_SeedAll_NoModules(t *testing.T) {
-	registry := &mockSeederRegistry{modules: []interface{}{}}
-	adapter := &registryAdapter{registry: registry}
+	reg := &mockSeederRegistry{modules: []registry.Module{}}
 
 	// Create seeder (skip DB connection for this test)
 	seeder := &Seeder{
-		provider: adapter,
+		registry: reg,
+		provider: &registryAdapter{registry: reg},
 	}
 
 	// Should not error with no modules
@@ -29,16 +31,18 @@ func TestSeeder_SeedAll_NoModules(t *testing.T) {
 }
 
 func TestSeeder_SeedAll_ModuleWithoutSeeder(t *testing.T) {
-	type moduleWithoutSeeder struct {
+	// mockModule implements registry.Module
+	type mockModule struct {
+		registry.Module
 		name string
 	}
 
-	mod := &moduleWithoutSeeder{name: "test"}
-	registry := &mockSeederRegistry{modules: []interface{}{mod}}
-	adapter := &registryAdapter{registry: registry}
+	mod := &mockModule{name: "test"}
+	reg := &mockSeederRegistry{modules: []registry.Module{mod}}
 
 	seeder := &Seeder{
-		provider: adapter,
+		registry: reg,
+		provider: &registryAdapter{registry: reg},
 	}
 
 	// Should not error when module doesn't implement ModuleSeeder
diff --git a/internal/oauth/crypto_test.go b/internal/oauth/crypto_test.go
index de1d450..43b3d44 100644
--- a/internal/oauth/crypto_test.go
+++ b/internal/oauth/crypto_test.go
@@ -32,6 +32,7 @@ func TestTokenEncryptor_EncryptDecrypt(t *testing.T) {
 			name:      "unicode",
 			plaintext: "こんにちは世界 🌍🔐",
 		},
+		//nolint:gosec
 		{
 			name:      "oauth token format",
 			plaintext: "ya29.a0AfH6SMB2xS5lZC0M7qR_Xy_example_access_token_1234567890",
diff --git a/internal/oauth/handler.go b/internal/oauth/handler.go
index 2d07d5b..3fef1ed 100644
--- a/internal/oauth/handler.go
+++ b/internal/oauth/handler.go
@@ -199,6 +199,7 @@ func (h *Handler) redirectWithSuccess(w http.ResponseWriter, r *http.Request, re
 		// Return JSON response if no redirect URL
 		w.Header().Set("Content-Type", "application/json")
 
+		//nolint:gosec
 		if err := json.NewEncoder(w).Encode(result); err != nil {
 			slog.Error("Failed to encode result", "error", err)
 		}
diff --git a/internal/oauth/registry_test.go b/internal/oauth/registry_test.go
index 85650c1..75448eb 100644
--- a/internal/oauth/registry_test.go
+++ b/internal/oauth/registry_test.go
@@ -40,6 +40,7 @@ func TestNewRegistry_WithProviders(t *testing.T) {
 				ClientID:     "test-google-client-id",
 				ClientSecret: "test-google-secret",
 			},
+			//nolint:gosec
 			GitHub: config.OAuthProviderConfig{
 				Enabled:      true,
 				ClientID:     "test-github-client-id",
diff --git a/internal/outbox/outbox.go b/internal/outbox/outbox.go
index ae42d9a..3b55cd0 100644
--- a/internal/outbox/outbox.go
+++ b/internal/outbox/outbox.go
@@ -10,10 +10,13 @@ package outbox
 
 import (
 	"context"
-	"database/sql"
 	"encoding/json"
 	"fmt"
+	"log/slog"
 	"time"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgxpool"
 )
 
 // Entry represents a single event stored in the outbox table.
@@ -25,11 +28,14 @@ type Entry struct {
 	PublishedAt *time.Time
 }
 
-// Repository provides methods for storing and retrieving outbox entries.
-type Repository interface {
+// StoreRepository provides methods for storing outbox entries.
+type StoreRepository interface {
 	// Store stores an event in the outbox table within the current transaction.
-	Store(ctx context.Context, tx *sql.Tx, eventName string, payload interface{}) error
+	Store(ctx context.Context, tx pgx.Tx, eventName string, payload interface{}) error
+}
 
+// PublisherRepository provides methods for retrieving and marking outbox entries.
+type PublisherRepository interface {
 	// GetUnpublished retrieves unpublished events (for publisher worker).
 	GetUnpublished(ctx context.Context, limit int) ([]Entry, error)
 
@@ -37,20 +43,26 @@ type Repository interface {
 	MarkPublished(ctx context.Context, ids []string) error
 }
 
-// SQLRepository implements the Repository interface using SQL.
+// Repository combines StoreRepository and PublisherRepository.
+type Repository interface {
+	StoreRepository
+	PublisherRepository
+}
+
+// SQLRepository implements the Repository interface using pgx.
 type SQLRepository struct {
-	db *sql.DB
+	db *pgxpool.Pool
 }
 
 // NewRepository creates a new outbox repository.
-func NewRepository(db *sql.DB) *SQLRepository {
+func NewRepository(db *pgxpool.Pool) *SQLRepository {
 	return &SQLRepository{
 		db: db,
 	}
 }
 
 // Store stores an event in the outbox table within the provided transaction.
-func (r *SQLRepository) Store(ctx context.Context, tx *sql.Tx, eventName string, payload interface{}) error {
+func (r *SQLRepository) Store(ctx context.Context, tx pgx.Tx, eventName string, payload interface{}) error {
 	payloadBytes, err := json.Marshal(payload)
 	if err != nil {
 		return fmt.Errorf("failed to marshal payload: %w", err)
@@ -63,7 +75,7 @@ func (r *SQLRepository) Store(ctx context.Context, tx *sql.Tx, eventName string,
 		VALUES ($1, $2, $3, NOW())
 	`
 
-	_, err = tx.ExecContext(ctx, query, id, eventName, payloadBytes)
+	_, err = tx.Exec(ctx, query, id, eventName, payloadBytes)
 	if err != nil {
 		return fmt.Errorf("failed to store outbox entry: %w", err)
 	}
@@ -81,21 +93,20 @@ func (r *SQLRepository) GetUnpublished(ctx context.Context, limit int) ([]Entry,
 		LIMIT $1
 	`
 
-	rows, err := r.db.QueryContext(ctx, query, limit)
+	rows, err := r.db.Query(ctx, query, limit)
 	if err != nil {
 		return nil, fmt.Errorf("failed to query unpublished events: %w", err)
 	}
 
-	defer func() {
-		_ = rows.Close()
-	}()
+	defer rows.Close()
 
 	var entries []Entry
 
 	for rows.Next() {
-		var entry Entry
-
-		var publishedAt sql.NullTime
+		var (
+			entry       Entry
+			publishedAt *time.Time
+		)
 
 		if err := rows.Scan(
 			&entry.ID,
@@ -107,10 +118,7 @@ func (r *SQLRepository) GetUnpublished(ctx context.Context, limit int) ([]Entry,
 			return nil, fmt.Errorf("failed to scan outbox entry: %w", err)
 		}
 
-		if publishedAt.Valid {
-			entry.PublishedAt = &publishedAt.Time
-		}
-
+		entry.PublishedAt = publishedAt
 		entries = append(entries, entry)
 	}
 
@@ -133,7 +141,7 @@ func (r *SQLRepository) MarkPublished(ctx context.Context, ids []string) error {
 		WHERE id = ANY($1)
 	`
 
-	_, err := r.db.ExecContext(ctx, query, ids)
+	_, err := r.db.Exec(ctx, query, ids)
 	if err != nil {
 		return fmt.Errorf("failed to mark events as published: %w", err)
 	}
@@ -143,9 +151,11 @@ func (r *SQLRepository) MarkPublished(ctx context.Context, ids []string) error {
 
 // Publisher publishes events from the outbox table to the event bus.
 type Publisher struct {
-	repo      Repository
-	publisher PublisherFunc
-	batchSize int
+	repo         PublisherRepository
+	publisher    PublisherFunc
+	batchSize    int
+	pollInterval time.Duration
+	stopChan     chan struct{}
 }
 
 // PublisherFunc is a function type for publishing events.
@@ -158,19 +168,50 @@ type PublisherFunc func(ctx context.Context, eventName string, payload interface
 //	Example: NewPublisher(repo, func(ctx context.Context, name string, payload interface{}) {
 //	    bus.Publish(ctx, events.Event{Name: name, Payload: payload})
 //	})
-func NewPublisher(repo Repository, publisher PublisherFunc) *Publisher {
+func NewPublisher(repo PublisherRepository, publisher PublisherFunc) *Publisher {
 	return &Publisher{
-		repo:      repo,
-		publisher: publisher,
-		batchSize: 100, // Default batch size
+		repo:         repo,
+		publisher:    publisher,
+		batchSize:    100,             // Default batch size
+		pollInterval: 5 * time.Second, // Default poll interval
+		stopChan:     make(chan struct{}),
 	}
 }
 
+// Start starts the outbox publisher background worker.
+func (p *Publisher) Start(ctx context.Context) {
+	ticker := time.NewTicker(p.pollInterval)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-p.stopChan:
+			return
+		case <-ticker.C:
+			if err := p.Process(ctx); err != nil {
+				slog.ErrorContext(ctx, "failed to process outbox", "error", err)
+			}
+		}
+	}
+}
+
+// Stop stops the outbox publisher.
+func (p *Publisher) Stop() {
+	close(p.stopChan)
+}
+
 // SetBatchSize sets the number of events to process per batch.
 func (p *Publisher) SetBatchSize(size int) {
 	p.batchSize = size
 }
 
+// SetPollInterval sets the interval between polls.
+func (p *Publisher) SetPollInterval(interval time.Duration) {
+	p.pollInterval = interval
+}
+
 // Process processes unpublished events from the outbox and publishes them.
 // This should be called periodically by a background worker.
 func (p *Publisher) Process(ctx context.Context) error {
diff --git a/internal/registry/module.go b/internal/registry/module.go
index 350dfa9..7ed060a 100644
--- a/internal/registry/module.go
+++ b/internal/registry/module.go
@@ -54,3 +54,16 @@ type ModuleAuth interface {
 	// Format: "/package.service/Method"
 	PublicEndpoints() []string
 }
+
+// ModuleSeeder defines the interface for modules that provide seed data via SQL files.
+type ModuleSeeder interface {
+	// SeedPath returns the path to the module's seed directory.
+	// Return empty string if the module has no seed data.
+	SeedPath() string
+}
+
+// ModuleProgrammaticSeeder defines the interface for modules that provide seed data programmatically via Go.
+type ModuleProgrammaticSeeder interface {
+	// Seed runs programmatic seed data using the application's registry/dependencies.
+	Seed(ctx context.Context, r interface{}) error
+}
diff --git a/internal/registry/options.go b/internal/registry/options.go
index 15d6c0a..e8df142 100644
--- a/internal/registry/options.go
+++ b/internal/registry/options.go
@@ -1,12 +1,15 @@
 package registry
 
 import (
-	"database/sql"
 	"net/http"
 
+	"github.com/cmelgarejo/go-modulith-template/internal/audit"
+	"github.com/cmelgarejo/go-modulith-template/internal/cache"
 	"github.com/cmelgarejo/go-modulith-template/internal/events"
+	"github.com/cmelgarejo/go-modulith-template/internal/feature"
 	"github.com/cmelgarejo/go-modulith-template/internal/notifier"
 	"github.com/cmelgarejo/go-modulith-template/internal/websocket"
+	"github.com/jackc/pgx/v5/pgxpool"
 )
 
 // Option is a functional option for configuring the Registry.
@@ -21,8 +24,8 @@ func WithConfig(cfg any) Option {
 	}
 }
 
-// WithDatabase sets the database connection.
-func WithDatabase(db *sql.DB) Option {
+// WithDatabase sets the database connection pool.
+func WithDatabase(db *pgxpool.Pool) Option {
 	return func(r *Registry) {
 		r.db = db
 	}
@@ -66,3 +69,24 @@ func WithMetricsHandler(h http.Handler) Option {
 		r.metricsHandler = h
 	}
 }
+
+// WithAuditLogger sets the audit logger.
+func WithAuditLogger(l audit.Logger) Option {
+	return func(r *Registry) {
+		r.audit = l
+	}
+}
+
+// WithFeature sets the feature flag manager.
+func WithFeature(m feature.Manager) Option {
+	return func(r *Registry) {
+		r.feature = m
+	}
+}
+
+// WithCache sets the cache service.
+func WithCache(c cache.Cache) Option {
+	return func(r *Registry) {
+		r.cache = c
+	}
+}
diff --git a/internal/registry/registry.go b/internal/registry/registry.go
index 02cce62..f885c1c 100644
--- a/internal/registry/registry.go
+++ b/internal/registry/registry.go
@@ -2,15 +2,18 @@ package registry
 
 import (
 	"context"
-	"database/sql"
 	"fmt"
 	"log/slog"
 	"net/http"
 
+	"github.com/cmelgarejo/go-modulith-template/internal/audit"
+	"github.com/cmelgarejo/go-modulith-template/internal/cache"
 	"github.com/cmelgarejo/go-modulith-template/internal/events"
+	"github.com/cmelgarejo/go-modulith-template/internal/feature"
 	"github.com/cmelgarejo/go-modulith-template/internal/notifier"
 	"github.com/cmelgarejo/go-modulith-template/internal/websocket"
 	"github.com/grpc-ecosystem/grpc-gateway/v2/runtime"
+	"github.com/jackc/pgx/v5/pgxpool"
 	"google.golang.org/grpc"
 )
 
@@ -19,10 +22,13 @@ import (
 type Registry struct {
 	// Core dependencies - config is any to avoid import cycles
 	config   any
-	db       *sql.DB
+	db       *pgxpool.Pool
 	bus      *events.Bus
 	notifier notifier.Notifier
 	wsHub    *websocket.Hub
+	audit    audit.Logger
+	feature  feature.Manager
+	cache    cache.Cache
 
 	// Infrastructure
 	metricsHandler http.Handler
@@ -144,8 +150,8 @@ func (r *Registry) Config() any {
 	return r.config
 }
 
-// DB returns the database connection.
-func (r *Registry) DB() *sql.DB {
+// DB returns the database connection pool.
+func (r *Registry) DB() *pgxpool.Pool {
 	return r.db
 }
 
@@ -164,6 +170,21 @@ func (r *Registry) WebSocketHub() *websocket.Hub {
 	return r.wsHub
 }
 
+// AuditLogger returns the audit logger.
+func (r *Registry) AuditLogger() audit.Logger {
+	return r.audit
+}
+
+// FlagManager returns the feature flag manager.
+func (r *Registry) FlagManager() feature.Manager {
+	return r.feature
+}
+
+// Cache returns the cache service.
+func (r *Registry) Cache() cache.Cache {
+	return r.cache
+}
+
 // MetricsHandler returns the metrics HTTP handler.
 func (r *Registry) MetricsHandler() http.Handler {
 	return r.metricsHandler
diff --git a/internal/telemetry/business.go b/internal/telemetry/business.go
new file mode 100644
index 0000000..680501b
--- /dev/null
+++ b/internal/telemetry/business.go
@@ -0,0 +1,93 @@
+package telemetry
+
+import (
+	"context"
+	"fmt"
+)
+
+var (
+	// GMVTotal tracks the Total Gross Merchandise Value.
+	GMVTotal *Counter
+	// SettlementPayout tracks the total settlement payouts.
+	SettlementPayout *Counter
+	// ActiveUsersGauge tracks the current number of active users.
+	ActiveUsersGauge *Gauge
+	// BetPlacementLatency tracks the latency of bet placements.
+	BetPlacementLatency *Histogram
+	// AuthLoginTotal tracks the total number of logins.
+	AuthLoginTotal *Counter
+	// AuthSignupTotal tracks the total number of new signups.
+	AuthSignupTotal *Counter
+	// PositionsPlacedTotal tracks the total number of positions placed.
+	PositionsPlacedTotal *Counter
+	// WalletTransactionsTotal tracks the total number of wallet transactions.
+	WalletTransactionsTotal *Counter
+	// WalletTransactionLatency tracks the latency of wallet transactions.
+	WalletTransactionLatency *Histogram
+)
+
+// InitBusinessMetrics initializes the business-specific metrics.
+func InitBusinessMetrics() error {
+	var err error
+
+	GMVTotal, err = NewCounter("opos_gmv_total", "Total Gross Merchandise Volume (staked amount)")
+	if err != nil {
+		return fmt.Errorf("failed to create gmv_total metric: %w", err)
+	}
+
+	SettlementPayout, err = NewCounter("opos_settlement_payout_total", "Total amount paid out to winners")
+	if err != nil {
+		return fmt.Errorf("failed to create settlement_payout_total metric: %w", err)
+	}
+
+	ActiveUsersGauge, err = NewGauge("opos_active_users", "Number of active users in the last 5 minutes")
+	if err != nil {
+		return fmt.Errorf("failed to create active_users metric: %w", err)
+	}
+
+	BetPlacementLatency, err = NewHistogram("opos_bet_placement_duration_seconds", "Duration of bet placement operations", "s")
+	if err != nil {
+		return fmt.Errorf("failed to create bet_placement_duration metric: %w", err)
+	}
+
+	AuthLoginTotal, err = NewCounter("opos_auth_login_total", "Total number of successful logins")
+	if err != nil {
+		return fmt.Errorf("failed to create auth_login_total metric: %w", err)
+	}
+
+	AuthSignupTotal, err = NewCounter("opos_auth_signup_total", "Total number of new signups")
+	if err != nil {
+		return fmt.Errorf("failed to create auth_signup_total metric: %w", err)
+	}
+
+	PositionsPlacedTotal, err = NewCounter("opos_positions_placed_total", "Total number of positions placed")
+	if err != nil {
+		return fmt.Errorf("failed to create positions_placed_total metric: %w", err)
+	}
+
+	WalletTransactionsTotal, err = NewCounter("opos_wallet_transactions_total", "Total number of wallet transactions")
+	if err != nil {
+		return fmt.Errorf("failed to create wallet_transactions_total metric: %w", err)
+	}
+
+	WalletTransactionLatency, err = NewHistogram("opos_wallet_transaction_duration_seconds", "Duration of wallet transaction operations", "s")
+	if err != nil {
+		return fmt.Errorf("failed to create wallet_transaction_duration metric: %w", err)
+	}
+
+	return nil
+}
+
+// TrackGMV records a staked amount in the GMV metric.
+func TrackGMV(ctx context.Context, amount int64, currency string) {
+	if GMVTotal != nil {
+		GMVTotal.WithAttributes(Attr("currency", currency)).Add(ctx, amount)
+	}
+}
+
+// TrackPayout records a payout amount.
+func TrackPayout(ctx context.Context, amount int64, currency string) {
+	if SettlementPayout != nil {
+		SettlementPayout.WithAttributes(Attr("currency", currency)).Add(ctx, amount)
+	}
+}
diff --git a/internal/telemetry/interceptor.go b/internal/telemetry/interceptor.go
new file mode 100644
index 0000000..e4c0d80
--- /dev/null
+++ b/internal/telemetry/interceptor.go
@@ -0,0 +1,82 @@
+package telemetry
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/status"
+)
+
+var (
+	// gRPC metrics
+	grpcRequestsTotal  *Counter
+	grpcErrorsTotal    *Counter
+	grpcLatencySeconds *Histogram
+)
+
+// InitGRPCMetrics initializes the standardized gRPC metrics.
+func InitGRPCMetrics() error {
+	var err error
+
+	grpcRequestsTotal, err = NewCounter("grpc_requests_total", "Total number of gRPC requests")
+	if err != nil {
+		return fmt.Errorf("failed to create grpc_requests_total metric: %w", err)
+	}
+
+	grpcErrorsTotal, err = NewCounter("grpc_errors_total", "Total number of gRPC errors")
+	if err != nil {
+		return fmt.Errorf("failed to create grpc_errors_total metric: %w", err)
+	}
+
+	grpcLatencySeconds, err = NewHistogram("grpc_request_duration_seconds", "gRPC request latency in seconds", "s")
+	if err != nil {
+		return fmt.Errorf("failed to create grpc_request_duration_seconds metric: %w", err)
+	}
+
+	return nil
+}
+
+// UnaryServerInterceptor returns a new unary server interceptor that records metrics.
+func UnaryServerInterceptor() grpc.UnaryServerInterceptor {
+	return func(
+		ctx context.Context,
+		req interface{},
+		info *grpc.UnaryServerInfo,
+		handler grpc.UnaryHandler,
+	) (interface{}, error) {
+		start := time.Now()
+
+		// Execute handler
+		resp, err := handler(ctx, req)
+
+		duration := time.Since(start)
+		method := info.FullMethod
+		code := status.Code(err).String()
+
+		// Record metrics
+		if grpcRequestsTotal != nil {
+			grpcRequestsTotal.WithAttributes(
+				Attr("method", method),
+				Attr("code", code),
+			).Inc(ctx)
+		}
+
+		if err != nil && grpcErrorsTotal != nil {
+			grpcErrorsTotal.WithAttributes(
+				Attr("method", method),
+				Attr("code", code),
+			).Inc(ctx)
+		}
+
+		if grpcLatencySeconds != nil {
+			grpcLatencySeconds.WithAttributes(
+				RecordAttr("method", method),
+				RecordAttr("code", code),
+			).RecordDuration(ctx, duration)
+		}
+
+		return resp, err
+	}
+}
diff --git a/internal/telemetry/prometheus.go b/internal/telemetry/prometheus.go
new file mode 100644
index 0000000..264eeb9
--- /dev/null
+++ b/internal/telemetry/prometheus.go
@@ -0,0 +1,49 @@
+package telemetry
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"sync"
+
+	"github.com/prometheus/client_golang/prometheus/promhttp"
+	"go.opentelemetry.io/otel"
+	"go.opentelemetry.io/otel/exporters/prometheus"
+	"go.opentelemetry.io/otel/sdk/metric"
+)
+
+// NewPrometheusHandler returns an http.Handler that serves Prometheus metrics.
+func NewPrometheusHandler() (http.Handler, error) {
+	exporter, err := prometheus.New()
+	if err != nil {
+		return nil, fmt.Errorf("failed to create prometheus exporter: %w", err)
+	}
+
+	provider := metric.NewMeterProvider(metric.WithReader(exporter))
+	otel.SetMeterProvider(provider)
+
+	// Refresh the meter instance used by metrics.go
+	meterOnce = sync.Once{}
+
+	getMeter()
+
+	return promhttp.Handler(), nil
+}
+
+// InitTelemetry initializes both tracing and metrics.
+func InitTelemetry(_ context.Context) (func(context.Context) error, error) {
+	// Initialize business metrics
+	if err := InitBusinessMetrics(); err != nil {
+		return nil, err
+	}
+
+	// Initialize gRPC metrics
+	if err := InitGRPCMetrics(); err != nil {
+		return nil, err
+	}
+
+	// This is a placeholder for tracing initialization if needed
+	return func(_ context.Context) error {
+		return nil
+	}, nil
+}
diff --git a/internal/telemetry/telemetry.go b/internal/telemetry/telemetry.go
index 320d680..c06e314 100644
--- a/internal/telemetry/telemetry.go
+++ b/internal/telemetry/telemetry.go
@@ -11,7 +11,7 @@ import (
 
 const (
 	// TracerName is the name of the tracer used by this application.
-	TracerName = "modulith"
+	TracerName = "template-server"
 )
 
 // StartSpan starts a new span with the given name and returns the new context and span.
diff --git a/internal/testutil/cross_module.go b/internal/testutil/cross_module.go
index a95f331..2ca6817 100644
--- a/internal/testutil/cross_module.go
+++ b/internal/testutil/cross_module.go
@@ -4,88 +4,247 @@ package testutil
 import (
 	"context"
 	"fmt"
+	"sync"
+	"testing"
+	"time"
 
+	authv1 "github.com/cmelgarejo/go-modulith-template/gen/go/proto/auth/v1"
+	"github.com/cmelgarejo/go-modulith-template/internal/authtoken"
+	"github.com/cmelgarejo/go-modulith-template/internal/config"
 	"github.com/cmelgarejo/go-modulith-template/internal/events"
+	"github.com/cmelgarejo/go-modulith-template/internal/migration"
 	"github.com/cmelgarejo/go-modulith-template/internal/registry"
+	"github.com/jackc/pgx/v5/pgxpool"
 	"google.golang.org/grpc"
+	"google.golang.org/grpc/metadata"
 )
 
-// CrossModuleTestSetup provides setup for testing cross-module interactions.
+// CrossModuleTestSetup provides the canonical setup for testing module interactions.
 type CrossModuleTestSetup struct {
+	Config         *config.AppConfig
+	Postgres       *PostgresContainer
+	Pool           *pgxpool.Pool
 	Registry       *registry.Registry
-	GRPCServer     *grpc.Server
+	GRPCTestServer *GRPCTestServer
 	EventBus       *events.Bus
 	EventCollector *EventCollector
+	TokenService   *authtoken.Service
 	Cleanup        func()
 }
 
-// SetupCrossModuleTest creates a test setup with registry and gRPC server for cross-module testing.
-// This helper makes it easy to test interactions between modules via gRPC.
-func SetupCrossModuleTest(_ context.Context, modules ...registry.Module) (*CrossModuleTestSetup, error) {
-	// Create event bus
-	eventBus := events.NewBus()
-	eventCollector := NewEventCollector()
+// SetupCrossModuleTest creates a reusable integration harness for cross-module gRPC tests.
+func SetupCrossModuleTest(
+	ctx context.Context,
+	t *testing.T,
+	modules ...registry.Module,
+) (*CrossModuleTestSetup, error) {
+	t.Helper()
 
-	// Create registry
-	reg := registry.New(
-		registry.WithEventBus(eventBus),
-	)
+	container, pool, cfg, eventBus, eventCollector, reg, err := newCrossModuleComponents(ctx, t, modules...)
+	if err != nil {
+		return nil, err
+	}
 
-	// Register modules
-	for _, mod := range modules {
-		reg.Register(mod)
+	grpcTestServer, err := NewGRPCTestServer(cfg, reg)
+	if err != nil {
+		cleanupCrossModuleResources(ctx, container, pool, eventBus, nil)
+
+		return nil, fmt.Errorf("create gRPC test server: %w", err)
 	}
 
-	// Initialize modules
-	if err := reg.InitializeAll(); err != nil {
-		return nil, fmt.Errorf("failed to initialize modules: %w", err)
+	if err := grpcTestServer.Start(); err != nil {
+		cleanupCrossModuleResources(ctx, container, pool, eventBus, grpcTestServer)
+
+		return nil, fmt.Errorf("start gRPC test server: %w", err)
 	}
 
-	// Create gRPC server
-	grpcServer := grpc.NewServer()
-	reg.RegisterGRPCAll(grpcServer)
+	if err := reg.OnStartAll(ctx); err != nil {
+		cleanupCrossModuleResources(ctx, container, pool, eventBus, grpcTestServer)
 
-	cleanup := func() {
-		grpcServer.Stop()
+		return nil, fmt.Errorf("start modules: %w", err)
+	}
 
-		_ = eventBus.Close()
+	tokenService, _ := authtoken.NewService(cfg.Auth.JWTPrivateKeyPEM)
+
+	var cleanupOnce sync.Once
+
+	cleanup := func() {
+		cleanupOnce.Do(func() {
+			_ = reg.OnStopAll(ctx)
+			cleanupCrossModuleResources(ctx, container, pool, eventBus, grpcTestServer)
+		})
 	}
 
+	t.Cleanup(cleanup)
+
 	return &CrossModuleTestSetup{
+		Config:         cfg,
+		Postgres:       container,
+		Pool:           pool,
 		Registry:       reg,
-		GRPCServer:     grpcServer,
+		GRPCTestServer: grpcTestServer,
 		EventBus:       eventBus,
 		EventCollector: eventCollector,
+		TokenService:   tokenService,
 		Cleanup:        cleanup,
 	}, nil
 }
 
-// GetModuleServiceClient returns a gRPC client for a specific module service.
-// This helper makes it easy to get a client for testing module-to-module calls.
-func GetModuleServiceClient[T any](
-	_ context.Context,
-	_ *grpc.Server,
-	conn *grpc.ClientConn,
-	_ func(grpc.ServiceRegistrar, T),
-	getClientFunc func(*grpc.ClientConn) interface{},
-) (interface{}, error) {
-	// For now, this is a placeholder that documents the pattern
-	// Actual implementation depends on the specific service type
-	// Users should use the generated gRPC client directly
-	return getClientFunc(conn), nil
+func newCrossModuleComponents(
+	ctx context.Context,
+	t *testing.T,
+	modules ...registry.Module,
+) (*PostgresContainer, *pgxpool.Pool, *config.AppConfig, *events.Bus, *EventCollector, *registry.Registry, error) {
+	container, err := NewPostgresContainer(ctx, t)
+	if err != nil {
+		return nil, nil, nil, nil, nil, nil, fmt.Errorf("create postgres container: %w", err)
+	}
+
+	pool, err := container.Pool(ctx)
+	if err != nil {
+		_ = container.Close(ctx)
+
+		return nil, nil, nil, nil, nil, nil, fmt.Errorf("connect postgres pool: %w", err)
+	}
+
+	cfg := TestConfig()
+	cfg.DBDSN = container.DSN
+	cfg.Env = "dev" // Enable magic code bypass for testing
+
+	eventBus := events.NewBus()
+	eventCollector := NewEventCollector()
+	reg := NewTestRegistryBuilder().
+		WithDatabase(pool).
+		WithConfig(cfg).
+		WithEventBus(eventBus).
+		WithModules(modules...).
+		Build()
+
+	if err := reg.InitializeAll(); err != nil {
+		cleanupCrossModuleResources(ctx, container, pool, eventBus, nil)
+
+		return nil, nil, nil, nil, nil, nil, fmt.Errorf("initialize modules: %w", err)
+	}
+
+	if err := RunMigrationsForTest(ctx, container.DSN, reg); err != nil {
+		cleanupCrossModuleResources(ctx, container, pool, eventBus, nil)
+
+		return nil, nil, nil, nil, nil, nil, fmt.Errorf("run migrations: %w", err)
+	}
+
+	seeder, err := migration.NewSeeder(container.DSN, reg)
+	if err != nil {
+		cleanupCrossModuleResources(ctx, container, pool, eventBus, nil)
+
+		return nil, nil, nil, nil, nil, nil, fmt.Errorf("create seeder: %w", err)
+	}
+
+	defer func() {
+		_ = seeder.Close()
+	}()
+
+	if err := seeder.SeedAll(ctx); err != nil {
+		cleanupCrossModuleResources(ctx, container, pool, eventBus, nil)
+
+		return nil, nil, nil, nil, nil, nil, fmt.Errorf("seed modules: %w", err)
+	}
+
+	return container, pool, cfg, eventBus, eventCollector, reg, nil
+}
+
+func cleanupCrossModuleResources(
+	ctx context.Context,
+	container *PostgresContainer,
+	pool *pgxpool.Pool,
+	eventBus *events.Bus,
+	grpcTestServer *GRPCTestServer,
+) {
+	if grpcTestServer != nil {
+		_ = grpcTestServer.Stop()
+	}
+
+	if pool != nil {
+		pool.Close()
+	}
+
+	if eventBus != nil {
+		_ = eventBus.Close()
+	}
+
+	if container != nil {
+		_ = container.Close(ctx)
+	}
+}
+
+// Client returns the active client connection for generated gRPC clients.
+func (s *CrossModuleTestSetup) Client() *grpc.ClientConn {
+	if s == nil || s.GRPCTestServer == nil {
+		return nil
+	}
+
+	return s.GRPCTestServer.Client()
+}
+
+// NewServiceClient creates a typed generated gRPC client from the shared harness.
+func NewServiceClient[T any](setup *CrossModuleTestSetup, factory func(grpc.ClientConnInterface) T) T {
+	return factory(setup.Client())
+}
+
+// AuthenticatedContext returns a new context with a valid JWT token for the given user.
+func (s *CrossModuleTestSetup) AuthenticatedContext(ctx context.Context, userID, role string) (context.Context, string, error) {
+	if s.TokenService == nil {
+		return nil, "", fmt.Errorf("token service not initialized")
+	}
+
+	token, _, err := s.TokenService.CreateToken(userID, role, time.Hour)
+	if err != nil {
+		return nil, "", fmt.Errorf("create token: %w", err)
+	}
+
+	md := metadata.Pairs("authorization", "Bearer "+token)
+
+	return metadata.NewOutgoingContext(ctx, md), token, nil
+}
+
+// RegisterUser creates a new user via the Auth module if available.
+func (s *CrossModuleTestSetup) RegisterUser(ctx context.Context, email, displayName string) (*authv1.User, error) {
+	authClient := NewServiceClient(s, authv1.NewAuthServiceClient)
+
+	resp, err := authClient.Register(ctx, &authv1.RegisterRequest{
+		ContactInfo: &authv1.RegisterRequest_Email{
+			Email: email,
+		},
+		DisplayName:    displayName,
+		Nationality:    "US",
+		DocumentType:   "PASSPORT",
+		DocumentNumber: "123456789",
+	})
+	if err != nil {
+		return nil, fmt.Errorf("register user: %w", err)
+	}
+
+	return resp.User, nil
+}
+
+// SubscribeEvents wires the event collector to the provided event names.
+func (s *CrossModuleTestSetup) SubscribeEvents(eventNames ...string) {
+	for _, eventName := range eventNames {
+		s.EventCollector.Subscribe(s.EventBus, eventName)
+	}
+}
+
+// WaitForEvent waits until the named event is observed or the timeout expires.
+func (s *CrossModuleTestSetup) WaitForEvent(eventName string, timeout time.Duration) (events.Event, error) {
+	return s.EventCollector.WaitForEventByName(eventName, timeout)
 }
 
 // AssertEventPublished checks if an event with the given name was published.
-// This is a convenience function that checks if any collected event matches.
 func AssertEventPublished(
 	collector *EventCollector,
 	eventName string,
 ) error {
-	events := collector.AllEvents()
-	for _, event := range events {
-		if event.Name == eventName {
-			return nil
-		}
+	if collector.HasEvent(eventName) {
+		return nil
 	}
 
 	return fmt.Errorf("event %s was not published", eventName)
diff --git a/internal/testutil/cross_module_integration_test.go b/internal/testutil/cross_module_integration_test.go
new file mode 100644
index 0000000..f5b7feb
--- /dev/null
+++ b/internal/testutil/cross_module_integration_test.go
@@ -0,0 +1,36 @@
+package testutil_test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	authv1 "github.com/cmelgarejo/go-modulith-template/gen/go/proto/auth/v1"
+	"github.com/cmelgarejo/go-modulith-template/internal/testutil"
+	"github.com/cmelgarejo/go-modulith-template/modules/auth"
+)
+
+func TestSetupCrossModuleTest(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping integration test")
+	}
+
+	ctx := context.Background()
+
+	setup, err := testutil.SetupCrossModuleTest(ctx, t, auth.NewModule())
+	require.NoError(t, err)
+	require.NotNil(t, setup.Client())
+	require.NotNil(t, setup.Registry)
+	require.NotNil(t, setup.Pool)
+
+	authClient := testutil.NewServiceClient(setup, authv1.NewAuthServiceClient)
+
+	resp, err := authClient.RequestLogin(ctx, &authv1.RequestLoginRequest{
+		ContactInfo: &authv1.RequestLoginRequest_Email{
+			Email: "integration@example.com",
+		},
+	})
+	require.NoError(t, err)
+	require.True(t, resp.Success)
+}
diff --git a/internal/testutil/events.go b/internal/testutil/events.go
index f9106f7..fb6b585 100644
--- a/internal/testutil/events.go
+++ b/internal/testutil/events.go
@@ -4,6 +4,7 @@ package testutil
 import (
 	"context"
 	"errors"
+	"fmt"
 	"sync"
 	"time"
 
@@ -52,6 +53,27 @@ func (c *EventCollector) WaitForEvent(timeout time.Duration) (events.Event, erro
 	}
 }
 
+// WaitForEventByName waits until the named event is observed or the timeout expires.
+func (c *EventCollector) WaitForEventByName(eventName string, timeout time.Duration) (events.Event, error) {
+	if event, ok := c.EventByName(eventName); ok {
+		return event, nil
+	}
+
+	timer := time.NewTimer(timeout)
+	defer timer.Stop()
+
+	for {
+		select {
+		case event := <-c.ch:
+			if event.Name == eventName {
+				return event, nil
+			}
+		case <-timer.C:
+			return events.Event{}, fmt.Errorf("timeout waiting for event %s", eventName)
+		}
+	}
+}
+
 // AllEvents returns all collected events.
 func (c *EventCollector) AllEvents() []events.Event {
 	c.mu.RLock()
@@ -79,6 +101,26 @@ func (c *EventCollector) Clear() {
 	}
 }
 
+// EventByName returns the first collected event that matches the given name.
+func (c *EventCollector) EventByName(eventName string) (events.Event, bool) {
+	c.mu.RLock()
+	defer c.mu.RUnlock()
+
+	for _, event := range c.events {
+		if event.Name == eventName {
+			return event, true
+		}
+	}
+
+	return events.Event{}, false
+}
+
+// HasEvent reports whether an event with the given name was collected.
+func (c *EventCollector) HasEvent(eventName string) bool {
+	_, ok := c.EventByName(eventName)
+	return ok
+}
+
 // Count returns the number of collected events.
 func (c *EventCollector) Count() int {
 	c.mu.RLock()
diff --git a/internal/testutil/fixtures.go b/internal/testutil/fixtures.go
index 2839478..d886a89 100644
--- a/internal/testutil/fixtures.go
+++ b/internal/testutil/fixtures.go
@@ -5,7 +5,9 @@ import (
 	"github.com/cmelgarejo/go-modulith-template/internal/config"
 )
 
-// TestConfig returns a minimal valid config for testing.
+// TestConfig returns a minimal valid config for testing (RS256 JWT keys).
+//
+//nolint:gosec // G101: test DSN only, not production credentials
 func TestConfig() *config.AppConfig {
 	return &config.AppConfig{
 		Env:      "test",
@@ -14,21 +16,18 @@ func TestConfig() *config.AppConfig {
 		GRPCPort: "9090",
 		DBDSN:    "postgres://test:test@localhost:5432/test?sslmode=disable",
 		Auth: config.AuthConfig{
-			JWTSecret: TestJWTSecret(),
+			JWTPrivateKeyPEM: TestJWTPrivateKeyPEM,
+			JWTPublicKeyPEM:  TestJWTPublicKeyPEM,
 		},
-		DBMaxOpenConns:    10,
-		DBMaxIdleConns:    5,
-		DBConnMaxLifetime: "5m",
-		DBConnectTimeout:  "10s",
-		DefaultLocale:     "en",
-		RequestTimeout:    "30s",
-		ReadTimeout:       "5s",
-		WriteTimeout:      "10s",
-		ShutdownTimeout:   "30s",
+		DBMaxOpenConns:     10,
+		DBMaxIdleConns:     5,
+		DBConnMaxLifetime:  "5m",
+		DBConnectTimeout:   "10s",
+		DefaultLocale:      "en",
+		OutboxPollInterval: "100ms",
+		RequestTimeout:     "30s",
+		ReadTimeout:        "5s",
+		WriteTimeout:       "10s",
+		ShutdownTimeout:    "30s",
 	}
 }
-
-// TestJWTSecret returns a valid JWT secret for testing (32+ bytes).
-func TestJWTSecret() string {
-	return "test-secret-key-that-is-at-least-32-bytes-long-for-testing"
-}
diff --git a/internal/testutil/grpc.go b/internal/testutil/grpc.go
index 20bc7ec..9f9a75b 100644
--- a/internal/testutil/grpc.go
+++ b/internal/testutil/grpc.go
@@ -38,7 +38,7 @@ func NewGRPCTestServer(cfg *config.AppConfig, reg *registry.Registry) (*GRPCTest
 		return nil, fmt.Errorf("failed to listen: %w", err)
 	}
 
-	verifier, err := authn.NewJWTVerifier(cfg.Auth.JWTSecret)
+	verifier, err := authn.NewJWTVerifier(cfg.Auth.JWTPublicKeyPEM)
 	if err != nil {
 		_ = lis.Close()
 		return nil, fmt.Errorf("failed to init jwt verifier: %w", err)
diff --git a/internal/testutil/integration_test.go b/internal/testutil/integration_test.go
index 383be14..e769106 100644
--- a/internal/testutil/integration_test.go
+++ b/internal/testutil/integration_test.go
@@ -4,8 +4,6 @@ import (
 	"context"
 	"testing"
 
-	_ "github.com/jackc/pgx/v5/stdlib" // pgx driver
-
 	"github.com/cmelgarejo/go-modulith-template/internal/testutil"
 )
 
@@ -28,26 +26,22 @@ func TestPostgresContainer(t *testing.T) {
 	}()
 
 	// Test database connection
-	db, err := container.DB(ctx)
+	pool, err := container.Pool(ctx)
 	if err != nil {
 		t.Fatalf("Failed to connect to database: %v", err)
 	}
 
-	defer func() {
-		if err := db.Close(); err != nil {
-			t.Errorf("Failed to close database: %v", err)
-		}
-	}()
+	defer pool.Close()
 
 	// Verify connection
-	if err := db.PingContext(ctx); err != nil {
+	if err := pool.Ping(ctx); err != nil {
 		t.Errorf("Failed to ping database: %v", err)
 	}
 
 	// Test a simple query
 	var result int
 
-	err = db.QueryRowContext(ctx, "SELECT 1").Scan(&result)
+	err = pool.QueryRow(ctx, "SELECT 1").Scan(&result)
 	if err != nil {
 		t.Errorf("Failed to execute query: %v", err)
 	}
diff --git a/internal/testutil/jwt_keys.go b/internal/testutil/jwt_keys.go
new file mode 100644
index 0000000..fcc2bab
--- /dev/null
+++ b/internal/testutil/jwt_keys.go
@@ -0,0 +1,44 @@
+// Package testutil provides testing utilities including JWT key pairs for RS256 tests.
+package testutil
+
+// TestJWTPrivateKeyPEM is a PEM-encoded RSA private key (2048-bit) for testing only.
+// Do not use in production.
+const TestJWTPrivateKeyPEM = `-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDN1mf+Ae+ylztg
+L4FSdE3eTQAH/NyuOszOLXrDIQAh4Zppe+2509apbMPBwrdWFSuDFMVEpGaKJcNV
+2FwOQm7Rvk4CIpJvGgrBj45A5mGM6f6MYrlO0PXm4+2PFTtYud6AjbPqb46cFvFT
+Ev/MGH3LlXV4jREEmbQRs8rLZBIpki++M+/WLvhfq+mFBZXb44AdAsR5377AVDoV
+9w2pNIoLpAQpKvH+FtLBvo4g9Xsf/fmYsK5tv+sWLDP40ZR5qGW+7SSkxFEvAkDe
+kmOv8iZrD4Jb3pakia7v0t1xhNRneT83UIKdtrwqMyy8dBXFYYeNR6CoDl2r96eD
+1I88y6N9AgMBAAECggEACCYVTtp/xUe0a43l5kBBduwAdNB/Ygxk4EKvqfrr+Oto
+BAYKdsFarbFnHIwbWvaSluljF+EUSCLPlV3v4wahQX9xsibxOiHDTD9lJ8+XDA+V
+arRb1rFyErZySKhUBaKyGs/BUCYjdK1510qYwtkzXbRohqG7Cz4UgWDnRd8L0wZq
+21at4l+bDWKxa8vCIZAzvI3XMvWCs+wfvU416XYEC8kBNjEYOqESHwZw6NFA+iOv
+haciwkpWAVG1jWMG4jPPLzXEtz/BLjXDHp62gYtZ89dxdKzl2NcD/JFVulI3idTf
+GeWbc1lj8pgPmHomt/QJTEbFItY/GWM4fS8Pj51VoQKBgQDssb3AM4OAGhQzUwbG
+iFEJRKfa41NQoNguKSfqEoHP+7W+9qK6wy1FEr9MyKr1GVaAhI+Oa9640HVJz/cN
+EjdcZ1+dwswxqACpQCoikfIKjA7TVGBAQSYgw02n+VyvpnGs32CdNkq5zPX+uaYz
+TKyT/GoX8mhhq3pOaS4u07gYMQKBgQDeoF1l2XtsunF+/YjOs+QI81V16r4xfymX
+c6WgcF8zpMUTZhs+BCuKBfgCasaShLB8QIPztjCyCPY5boHMNDZwAao/S7KEqvoo
+0t30n1JmcmCDNT3arn2SdTVnoLc6tBA2QfZfwmldfNypWFO2KIMZIN4vGz2yO4/D
+In1Bm6e5DQKBgA36GPhmkldYMuUs+/NxTUe81CSq09qpBNsE9yRtX1kGxh62tblN
+mTjA+KbyGpZKnr8MFOYWHJrRRHvNWgtdjgNY316TiDdOcmuMLHDKKX7R8nYsP1rL
+/hJlNgq7QOvmakQJFM1zzUnXfpdCIzxYRMCgYSt01xEdbSWANIfzXKWhAoGBAMQT
+Z89BegRsPXQEZw7uv4PmlTly06qSfhZHI/QnpKG+mFiakJnRYGuDEElIs7XuKeZ1
+iAIJT+AuJna0zpsEzYFe5gwzZnqUgBmehyBhhlh2mmxVYzIMhsqMcsnfciHA35p6
+BD2Y4+YUB+EayzfffH+QREAm9PLapKbP5JP5PQKtAoGBAMjaHnQYPicw0lWjO6r0
+8xwDcbyZIEKAZKGNp1kiETwSjfILJUjuzrWsIBPiKRrIuvFmjjs8R5sL2bdzTb+Q
+xz3LbR46bN3fWjDqdmhlUplbqMdw/r69Nx0PiDKblwZQFuvSE8+hb+FJGSz3WirL
+BstKaGEUzkQp5SFKsepviqfS
+-----END PRIVATE KEY-----`
+
+// TestJWTPublicKeyPEM is the corresponding public key for TestJWTPrivateKeyPEM (testing only).
+const TestJWTPublicKeyPEM = `-----BEGIN PUBLIC KEY-----
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzdZn/gHvspc7YC+BUnRN
+3k0AB/zcrjrMzi16wyEAIeGaaXvtudPWqWzDwcK3VhUrgxTFRKRmiiXDVdhcDkJu
+0b5OAiKSbxoKwY+OQOZhjOn+jGK5TtD15uPtjxU7WLnegI2z6m+OnBbxUxL/zBh9
+y5V1eI0RBJm0EbPKy2QSKZIvvjPv1i74X6vphQWV2+OAHQLEed++wFQ6FfcNqTSK
+C6QEKSrx/hbSwb6OIPV7H/35mLCubb/rFiwz+NGUeahlvu0kpMRRLwJA3pJjr/Im
+aw+CW96WpImu79LdcYTUZ3k/N1CCnba8KjMsvHQVxWGHjUegqA5dq/eng9SPPMuj
+fQIDAQAB
+-----END PUBLIC KEY-----`
diff --git a/internal/testutil/registry.go b/internal/testutil/registry.go
index a89dd11..7947b9e 100644
--- a/internal/testutil/registry.go
+++ b/internal/testutil/registry.go
@@ -2,18 +2,19 @@
 package testutil
 
 import (
-	"database/sql"
-
+	"github.com/cmelgarejo/go-modulith-template/internal/audit"
 	"github.com/cmelgarejo/go-modulith-template/internal/config"
 	"github.com/cmelgarejo/go-modulith-template/internal/events"
 	"github.com/cmelgarejo/go-modulith-template/internal/registry"
+	"github.com/jackc/pgx/v5/pgxpool"
 )
 
 // TestRegistryBuilder helps build test registries with common configurations.
 type TestRegistryBuilder struct {
-	db      *sql.DB
+	db      *pgxpool.Pool
 	bus     *events.Bus
 	cfg     *config.AppConfig
+	audit   audit.Logger
 	modules []registry.Module
 }
 
@@ -25,7 +26,7 @@ func NewTestRegistryBuilder() *TestRegistryBuilder {
 }
 
 // WithDatabase sets the database for the registry.
-func (b *TestRegistryBuilder) WithDatabase(db *sql.DB) *TestRegistryBuilder {
+func (b *TestRegistryBuilder) WithDatabase(db *pgxpool.Pool) *TestRegistryBuilder {
 	b.db = db
 	return b
 }
@@ -59,9 +60,14 @@ func (b *TestRegistryBuilder) Build() *registry.Registry {
 		b.bus = events.NewBus()
 	}
 
+	if b.audit == nil {
+		b.audit = &audit.NoopLogger{}
+	}
+
 	opts := []registry.Option{
 		registry.WithConfig(b.cfg),
 		registry.WithEventBus(b.bus),
+		registry.WithAuditLogger(b.audit),
 	}
 
 	if b.db != nil {
diff --git a/internal/testutil/testcontainers.go b/internal/testutil/testcontainers.go
index 601b3d7..440f7bd 100644
--- a/internal/testutil/testcontainers.go
+++ b/internal/testutil/testcontainers.go
@@ -3,11 +3,11 @@ package testutil
 
 import (
 	"context"
-	"database/sql"
 	"fmt"
 	"testing"
 	"time"
 
+	"github.com/jackc/pgx/v5/pgxpool"
 	"github.com/testcontainers/testcontainers-go"
 	"github.com/testcontainers/testcontainers-go/modules/postgres"
 	"github.com/testcontainers/testcontainers-go/wait"
@@ -61,17 +61,17 @@ func (c *PostgresContainer) Close(ctx context.Context) error {
 	return nil
 }
 
-// DB returns a database connection to the test container.
-func (c *PostgresContainer) DB(ctx context.Context) (*sql.DB, error) {
-	db, err := sql.Open("pgx", c.DSN)
+// Pool returns a database connection pool to the test container.
+func (c *PostgresContainer) Pool(ctx context.Context) (*pgxpool.Pool, error) {
+	pool, err := pgxpool.New(ctx, c.DSN)
 	if err != nil {
-		return nil, fmt.Errorf("failed to open database: %w", err)
+		return nil, fmt.Errorf("failed to open database pool: %w", err)
 	}
 
-	if err := db.PingContext(ctx); err != nil {
-		_ = db.Close()
-		return nil, fmt.Errorf("failed to ping database: %w", err)
+	if err := pool.Ping(ctx); err != nil {
+		pool.Close()
+		return nil, fmt.Errorf("failed to ping database pool: %w", err)
 	}
 
-	return db, nil
+	return pool, nil
 }
diff --git a/internal/websocket/handler.go b/internal/websocket/handler.go
index 6b18470..7735cce 100644
--- a/internal/websocket/handler.go
+++ b/internal/websocket/handler.go
@@ -61,6 +61,7 @@ func createOriginChecker(allowedOrigins []string, env string) func(*http.Request
 
 		// If no origins configured in prod, deny all (fail secure)
 		if len(allowedOrigins) == 0 {
+			//nolint:gosec
 			slog.Warn("WebSocket connection rejected: no allowed origins configured",
 				"origin", r.Header.Get("Origin"))
 
@@ -100,6 +101,7 @@ func checkOriginMatch(origin string, allowedOrigins []string) bool {
 		}
 	}
 
+	//nolint:gosec
 	slog.Warn("WebSocket connection rejected: origin not allowed",
 		"origin", origin,
 		"allowed", allowedOrigins)
@@ -112,6 +114,7 @@ func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	// Authenticate and extract user ID
 	userID, err := h.authenticateRequest(r)
 	if err != nil {
+		//nolint:gosec
 		slog.Warn("WebSocket authentication failed",
 			"error", err,
 			"remote_addr", r.RemoteAddr)
@@ -137,6 +140,7 @@ func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	client := NewClient(h.hub, conn, userID)
 	h.hub.register <- client
 
+	//nolint:gosec
 	slog.Info("WebSocket connection established",
 		"user_id", userID,
 		"remote_addr", r.RemoteAddr)
diff --git a/justfile b/justfile
new file mode 100644
index 0000000..ba90a31
--- /dev/null
+++ b/justfile
@@ -0,0 +1,754 @@
+set dotenv-load
+set shell := ["bash", "-cu"]
+
+# Default values for environment variables
+HTTP_PORT := env_var_or_default("HTTP_PORT", "8000")
+WHATSAPP_ACCESS_TOKEN := env_var_or_default("WHATSAPP_ACCESS_TOKEN", "")
+WHATSAPP_PHONE_NUMBER_ID := env_var_or_default("WHATSAPP_PHONE_NUMBER_ID", "")
+WHATSAPP_APP_SECRET := env_var_or_default("WHATSAPP_APP_SECRET", "")
+WHATSAPP_VERIFY_TOKEN := env_var_or_default("WHATSAPP_VERIFY_TOKEN", "")
+TELEGRAM_BOT_TOKEN := env_var_or_default("TELEGRAM_BOT_TOKEN", "")
+
+# Default goal
+default: help
+
+# Show available commands
+help:
+    @just --list --unsorted
+
+# --- Aliases (Backward Compatibility) ---
+
+# Run development environment diagnostics
+doctor: be-doctor
+
+# Run complete setup process (install deps, start docker, run migrations)
+quickstart: be-quickstart
+
+# Install developer tools
+install-deps: be-install-deps
+
+# Run full docker-compose stack
+docker-up: be-docker-up
+
+# Run minimal docker-compose stack
+docker-up-minimal: be-docker-up-minimal
+
+# Stop docker-compose services
+docker-down: be-docker-down
+
+# Generate all code (sqlc + proto + mocks)
+generate-all: be-generate-all
+
+# Run unit tests with fresh mocks
+test-unit: be-test-unit
+
+# Run linter
+lint: be-lint
+
+# Run linter with auto-fix enabled
+lint-fix: be-lint-fix
+
+# Run pre-commit checks (format + lint + test-unit)
+pre-commit: be-pre-commit
+
+# Run all tests (unit + integration)
+test-all: be-test-all
+
+# Run E2E tests for parimutuel flow
+test-flow-e2e: be-test-e2e
+
+# Run E2E test for reschedule-refund flow
+test-e2e-reschedule: be-test-e2e-reschedule
+
+# Run E2E tests for no-winners settlement (redistribute + void policies)
+test-e2e-nowinners: be-test-e2e-nowinners
+
+# Generate code from SQL
+sqlc: be-sqlc
+
+# Generate code from Protobuf
+proto: be-proto
+
+# Format code
+format: be-format
+
+# Tidy dependencies
+tidy: be-tidy
+
+# Scaffold a new module
+new-module name: (be-new-module name)
+
+# Destroy a module
+destroy-module name: (be-destroy-module name)
+
+# --- GraphQL Aliases ---
+add-graphql: be-graphql-add
+graphql-init: be-graphql-init
+graphql-add: be-graphql-add
+graphql-generate: be-graphql-generate
+graphql-generate-all: be-graphql-generate-all
+graphql-generate-module name: (be-graphql-generate-module name)
+graphql-from-proto: be-graphql-from-proto
+
+# --- Build Aliases ---
+build-module name: (be-build-module name)
+build-worker: be-build-worker
+build-all: be-build-all
+
+# --- Docker Aliases ---
+docker-build: be-docker-build
+docker-build-module name: (be-docker-build-module name)
+
+# --- Dev Aliases ---
+dev-worker: be-dev-worker
+dev-module name: (be-dev-module name)
+
+# Run admin panel E2E tests
+
+# Run admin panel E2E tests in UI mode
+
+# Run the monolith with live reload in a multi-pane tmux session (backend, admin, app)
+dev:
+    @if ! command -v tmux > /dev/null; then \
+        echo "Error: tmux is not installed. Please install it first (e.g., brew install tmux)"; \
+        exit 1; \
+    fi
+    @if tmux has-session -t template 2>/dev/null; then \
+        echo "Session 'opos' already exists. Attaching..."; \
+        tmux attach-session -t template; \
+    else \
+        echo "Starting tmux session 'template' with 4 panes (FE/FE, Backend, Terminal)..."; \
+        echo "Starting tmux session 'template' (Backend, Terminal)..."; \
+        tmux new-session -d -s template -n services; \
+        tmux set-option -t template mouse on; \
+        tmux set-option -t template history-limit 50000; \
+        tmux split-window -v -t template:services.0 -p 50 -d; \
+        tmux send-keys -t template:services.0 "just be-dev" C-m; \
+        tmux select-pane -t template:services.1; \
+        tmux attach-session -t template; \
+    fi
+
+# Stop the tmux development session
+stop:
+    @if tmux has-session -t template 2>/dev/null; then \
+        echo "Stopping tmux session 'template'..."; \
+        tmux kill-session -t template; \
+        echo "✅ Dev environment stopped."; \
+    else \
+        echo "No active 'opos' tmux session found."; \
+    fi
+
+# Run tests
+test: be-test
+
+# Comprehensive ready-to-commit check (all lint, unit tests, web e2e, and build)
+check: lint-fix test-unit build
+
+# Fast check skipping interactive E2E tests
+check-short: lint-fix test-unit build
+
+# Full CI-like check including integration tests and all backend E2E (requires Docker)
+check-full: check be-test-integration be-test-e2e be-test-e2e-reschedule be-test-e2e-nowinners
+
+# Alias for migrate-up
+migrate: be-migrate
+
+# Run seed data for all modules
+seed: be-seed
+
+# Run seed data for test events
+seed-test-events: (be-db-module-seed "events")
+
+# Build the monolith binary
+build: be-build
+
+# Run the monolith server (without hot reload)
+run: be-run
+
+# Clean build artifacts
+clean: be-clean
+
+# Visualize module connections
+visualize: be-visualize
+
+# --- Backend: Setup & Diagnostics ---
+
+# Install developer tools
+be-install-deps:
+    go install -tags 'postgres' github.com/golang-migrate/migrate/v4/cmd/migrate@latest
+    go install github.com/sqlc-dev/sqlc/cmd/sqlc@latest
+    go install github.com/bufbuild/buf/cmd/buf@latest
+    go install github.com/air-verse/air@latest
+    go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest
+    go install github.com/99designs/gqlgen@latest
+    go install go.uber.org/mock/mockgen@latest
+
+# Install gomock for test mocking
+be-install-mocks:
+    go install go.uber.org/mock/mockgen@latest
+
+# Validate development environment setup
+be-validate-setup:
+    @./scripts/validate-setup.sh
+
+# Run complete setup process (install deps, start docker, run migrations)
+be-quickstart:
+    @./scripts/quickstart.sh
+
+# Run development environment diagnostics
+be-doctor:
+    @./scripts/doctor.sh
+
+# --- Backend: Code Generation ---
+
+# Generate type-safe Go code from SQL
+be-sqlc:
+    sqlc generate
+
+# Generate gRPC code from protobuf definitions
+be-proto:
+    @echo "Cleaning gen/ directory..."
+    rm -rf gen/
+    buf generate --path proto
+
+# Generate all code (sqlc + proto + mocks)
+be-generate-all: be-sqlc be-proto be-generate-mocks
+
+# Generate all mocks from interfaces
+be-generate-mocks:
+    @echo "Generating mocks..."
+    @go generate ./modules/...
+    @echo "Mocks generated successfully"
+
+# Create a new API version for a module
+be-proto-version-create module version:
+    @./scripts/proto-version-create.sh {{module}} {{version}}
+    @echo "✅ New version created. Run 'just be-proto' to generate code."
+
+# Check for breaking changes in proto files
+be-proto-breaking-check module="":
+    @if [ -z "{{module}}" ]; then \
+        ./scripts/proto-breaking-check.sh; \
+    else \
+        ./scripts/proto-breaking-check.sh {{module}}; \
+    fi
+
+# Lint all proto files
+be-proto-lint:
+    buf lint
+
+# --- Backend: Docker & Services ---
+
+# Run docker-compose
+be-docker-up:
+    docker-compose up -d
+
+# Run docker-compose with minimal services (db + valkey only)
+be-docker-up-minimal:
+    docker-compose -f docker-compose.minimal.yaml up -d
+
+# Stop docker-compose services
+be-docker-down:
+    docker-compose down
+
+# --- Backend: Testing ---
+
+# Run tests
+be-test:
+    go test -v -race -cover ./...
+
+# Run unit tests with fresh mocks
+be-test-unit: be-generate-mocks
+    go test -v -race -short ./...
+
+# Run integration tests (requires Docker)
+be-test-integration:
+    @echo "Running integration tests with testcontainers..."
+    go test -v -run Integration ./...
+
+# Run all tests (unit + integration)
+be-test-all: be-test-unit be-test-integration
+
+# Run all backend and frontend tests
+test-full: be-test-all
+    @echo "✅ All tests completed successfully!"
+
+# Run E2E tests for parimutuel flow
+be-test-e2e:
+    @echo "🚀 Running E2E: Setup..."
+    go run scripts/e2e/setup/main.go
+    @echo "🚀 Running E2E: Placing positions..."
+    go run scripts/e2e/positions/main.go
+    @echo "🚀 Running E2E: Resolving and settling event..."
+    go run scripts/e2e/resolve/main.go
+    @echo "✅ E2E flow completed successfully!"
+
+# Run E2E test for reschedule-refund flow (creator reschedules -> all positions refunded)
+be-test-e2e-reschedule:
+    @echo "🚀 Running E2E: Reschedule-Refund flow..."
+    go run scripts/e2e/reschedule/main.go
+    @echo "✅ E2E reschedule-refund flow completed successfully!"
+
+# Run E2E test for no-winners settlement (redistribute + void policies)
+be-test-e2e-nowinners:
+    @echo "🚀 Running E2E: No-Winners settlement flow..."
+    go run scripts/e2e/nowinners/main.go
+    @echo "✅ E2E no-winners flow completed successfully!"
+
+# Run tests with coverage report
+be-test-coverage:
+    go test -v -race -coverprofile=coverage.out ./...
+    go tool cover -html=coverage.out
+
+# Generate detailed coverage report
+be-coverage-report:
+    @echo "=== 📊 Coverage Total del Proyecto ==="
+    @echo ""
+    @go test ./... -coverprofile=coverage.out -covermode=atomic 2>&1 | grep "coverage:" | grep -v "0.0%" | grep -v "no test"
+    @echo ""
+    @echo "=== 📈 Resumen por Componente ==="
+    @go tool cover -func=coverage.out | grep -v "\.pb\.go" | grep -v "\.pb\.gw\.go" | grep -v "generated" | tail -20
+    @echo ""
+    @echo "=== 🎯 Coverage Total (sin código generado) ==="
+    @go tool cover -func=coverage.out | grep -v "\.pb\.go" | grep -v "\.pb\.gw\.go" | grep -v "generated" | grep -v "cmd/" | tail -1
+    @echo ""
+    @echo "💡 Para ver el reporte HTML completo: just be-test-coverage"
+
+# Open coverage report in browser
+be-coverage-html:
+    @go test ./... -coverprofile=coverage.out -covermode=atomic > /dev/null 2>&1
+    @go tool cover -html=coverage.out
+
+# --- Backend: Linting & Formatting ---
+
+# Run linter
+be-lint:
+    golangci-lint run
+
+# Run linter with auto-fix enabled
+be-lint-fix:
+    golangci-lint run --fix
+
+# Format code with gofmt (and goimports if available)
+be-format:
+    @echo "Formatting code with gofmt..."
+    @gofmt -w .
+    @if command -v goimports > /dev/null; then \
+        echo "Formatting imports with goimports..."; \
+        goimports -w .; \
+    else \
+        echo "💡 Tip: Install goimports for import formatting: go install golang.org/x/tools/cmd/goimports@latest"; \
+    fi
+    @echo "✅ Code formatted"
+
+# Tidy Go module dependencies
+be-tidy:
+    @echo "Tidying Go module dependencies..."
+    @rm go.sum
+    @go mod tidy
+    @echo "✅ Dependencies tidied"
+
+# Run pre-commit checks (format + lint + test-unit)
+be-pre-commit: be-format be-lint be-test-unit
+
+# --- Backend: Database & Migrations ---
+
+# Build the ops binary
+be-ops-build:
+    @echo "Building ops binary..."
+    go build -ldflags "{{LDFLAGS}}" -o bin/ops ./cmd/ops/main.go
+
+# Run all module migrations (uses lightweight ops binary)
+be-migrate-up: be-ops-build
+    @echo "🚀 Running migrations for all modules..."
+    ./bin/ops migrate
+
+# Alias for migrate-up
+be-migrate: be-migrate-up
+
+# Run seed data for all modules (uses lightweight ops binary)
+be-seed: be-ops-build
+    @echo "🌱 Running seed data for all modules..."
+    ./bin/ops seed
+
+# Run seed data for DEV environment
+be-seed-dev: be-ops-build
+    @echo "🌱 Running seed data for DEV..."
+    ENV=dev ./bin/ops seed
+
+# Run seed data for PROD environment
+be-seed-prod: be-ops-build
+    @echo "🌱 Running seed data for PROD..."
+    ENV=prod ./bin/ops seed
+
+# Run admin task (Server Admin)
+be-admin-task task:
+    @echo "🔧 Running admin task: {{task}}"
+    go run ./cmd/server admin {{task}}
+
+# Rollback last migration for a specific module
+be-migrate-down module: be-ops-build
+    @MIGRATIONS_DIR=modules/{{module}}/resources/db/migration; \
+    if [ ! -d "$$MIGRATIONS_DIR" ]; then \
+        echo "Error: Module '{{module}}' not found or has no migrations directory"; \
+        exit 1; \
+    fi; \
+    echo "⚠️  Rolling back last migration for module: {{module}}"; \
+    ./bin/ops migrate-down {{module}}
+
+# Create a new migration file for a module
+be-migrate-create module name:
+    @MIGRATIONS_DIR=modules/{{module}}/resources/db/migration; \
+    if [ ! -d "$$MIGRATIONS_DIR" ]; then \
+        echo "Error: Module '{{module}}' not found or has no migrations directory"; \
+        exit 1; \
+    fi; \
+    migrate create -ext sql -dir $$MIGRATIONS_DIR -seq {{name}}
+
+# Force migration version to clean dirty state
+be-migrate-force module version:
+    @MIGRATIONS_DIR=modules/{{module}}/resources/db/migration; \
+    if [ ! -d "$$MIGRATIONS_DIR" ]; then \
+        echo "Error: Module '{{module}}' not found or has no migrations directory"; \
+        exit 1; \
+    fi; \
+    echo "⚠️  Forcing migration version {{version}} for module {{module}} (clears dirty state)..."; \
+    if echo "$$DB_DSN" | grep -q "?"; then \
+        MODULE_DSN="$$DB_DSN&x-migrations-table={{module}}_schema_migrations"; \
+    else \
+        MODULE_DSN="$$DB_DSN?x-migrations-table={{module}}_schema_migrations"; \
+    fi; \
+    migrate -path $$MIGRATIONS_DIR -database "$$MODULE_DSN" force {{version}}
+
+# Rollback ALL migrations for all modules (drops all tables)
+be-db-down: be-ops-build
+    #!/usr/bin/env bash
+    echo "⚠️  WARNING: This will rollback ALL migrations for ALL modules (drops all tables)!"
+    read -p "Are you sure? Type 'yes' to confirm: " confirm
+    if [ "$confirm" == "yes" ]; then
+        echo "🔄 Rolling back all migrations for all modules..."
+        ./bin/ops migrate-down
+    else
+        echo "❌ Confirmation failed. Aborting."
+        exit 1
+    fi
+
+# FORCIBLY drop all module schemas (guaranteed clean state)
+be-db-nuke: be-ops-build
+    #!/usr/bin/env bash
+    echo "⚠️  WARNING: This will FORCIBLY DROP ALL SCHEMAS and ALL DATA for ALL modules!"
+    read -p "Are you sure? Type 'yes' to confirm: " confirm
+    if [ "$confirm" == "yes" ]; then
+        echo "🔥 Nuking all module schemas..."
+        ./bin/ops migrate-nuke
+    else
+        echo "❌ Confirmation failed. Aborting."
+        exit 1
+    fi
+
+# FORCIBLY drop a specific module schema
+be-db-module-nuke module: be-ops-build
+    #!/usr/bin/env bash
+    echo "⚠️  WARNING: This will FORCIBLY DROP SCHEMA and DATA for module '{{module}}'!"
+    read -p "Are you sure? Type 'yes' to confirm: " confirm
+    if [ "$confirm" == "yes" ]; then
+        echo "🔥 Nuking module '{{module}}' schema..."
+        ./bin/ops migrate-nuke-module {{module}}
+    else
+        echo "❌ Confirmation failed. Aborting."
+        exit 1
+    fi
+
+# Run migrations for a specific module
+be-db-module-migrate module: be-ops-build
+    @echo "🚀 Running migrations for module: {{module}}..."
+    ./bin/ops migrate-module {{module}}
+
+# Run seed data for a specific module
+be-db-module-seed module: be-ops-build
+    @echo "🌱 Running seed data for module: {{module}}..."
+    ./bin/ops seed-module {{module}}
+
+# Drop all module schemas and re-run all migrations (destructive, asks for confirmation)
+be-db-reset:
+    @./scripts/db-reset.sh
+
+# Alias for migrate-up
+be-db-migrate: be-migrate-up
+
+# Alias for seed
+be-db-seed:
+    @echo "🌱 Running seed data for all modules..."
+    just be-seed
+
+# Complete reset and re-initialization of the whole db
+be-db-reinit:
+    #!/usr/bin/env bash
+    set -e
+    echo "⚠️  WARNING: This will reset and re-initialize the whole db!"
+    read -p "Are you sure? Type 'yes' to confirm: " confirm
+    if [ "$confirm" == "yes" ]; then
+        echo "🔄 Nuking and re-initializing the whole db..."
+        # Pipe 'yes' to db-nuke which expects 'yes'
+        yes yes | just be-db-nuke
+        just be-db-migrate
+        just be-db-seed
+    else
+        echo "❌ Confirmation failed. Aborting."
+        exit 1
+    fi
+
+# --- Backend: Build ---
+
+VERSION := `git describe --tags --always --dirty 2>/dev/null || echo "dev"`
+COMMIT := `git rev-parse --short HEAD 2>/dev/null || echo "unknown"`
+BUILD_TIME := `date -u +"%Y-%m-%dT%H:%M:%SZ"`
+LDFLAGS := "-X github.com/LoopContext/go-modulith-template/internal/appversion.Version=" + VERSION + " " + \
+           "-X github.com/LoopContext/go-modulith-template/internal/appversion.Commit=" + COMMIT + " " + \
+           "-X github.com/LoopContext/go-modulith-template/internal/appversion.BuildTime=" + BUILD_TIME
+
+# Build the monolith binary
+be-build:
+    @mkdir -p bin
+    go build -ldflags "{{LDFLAGS}}" -o bin/server ./cmd/server
+
+# Build a specific module binary
+be-build-module module:
+    @if [ ! -d "cmd/{{module}}" ]; then echo "Error: Module '{{module}}' not found in cmd/"; exit 1; fi
+    @mkdir -p bin
+    @echo "Building module: {{module}}"
+    go build -ldflags "{{LDFLAGS}}" -o bin/{{module}} ./cmd/{{module}}/main.go
+
+# Build the worker binary
+be-build-worker:
+    @mkdir -p bin
+    go build -ldflags "{{LDFLAGS}}" -o bin/worker ./cmd/worker/main.go
+
+# Build all binaries (server + worker + all modules)
+be-build-all: be-build be-build-worker
+    @mkdir -p bin
+    @for dir in cmd/*/; do \
+        module=$$(basename $$dir); \
+        if [ "$$module" != "server" ] && [ "$$module" != "worker" ]; then \
+            echo "Building module: $$module"; \
+            go build -ldflags "{{LDFLAGS}}" -o bin/$$module ./cmd/$$module/main.go; \
+        fi \
+    done
+
+# Clean build artifacts
+be-clean:
+    rm -rf bin/
+
+# --- Backend: Development & Execution ---
+
+# Run the monolith server (without hot reload)
+be-run:
+    go run -ldflags "{{LDFLAGS}}" ./cmd/server/ || true
+
+# Run the monolith with live reload (requires Air)
+be-dev:
+    @./scripts/preflight-check.sh || exit 1
+    @if command -v air > /dev/null; then \
+        air -c .air.toml; \
+    else \
+        echo "Air is not installed. Please install it with: go install github.com/air-verse/air@latest"; \
+    fi
+
+# Run the worker with live reload (requires Air)
+be-dev-worker:
+    @./scripts/preflight-check.sh || exit 1
+    @if command -v air > /dev/null; then \
+        air -c .air.worker.toml; \
+    else \
+        echo "Air is not installed. Please install it with: go install github.com/air-verse/air@latest"; \
+    fi
+
+# Run a specific module with live reload
+be-dev-module module:
+    @if [ ! -f ".air.{{module}}.toml" ]; then echo "Error: Air config '.air.{{module}}.toml' not found"; exit 1; fi
+    @./scripts/preflight-check.sh || exit 1
+    @if command -v air > /dev/null; then \
+        echo "Starting module: {{module}} with hot reload..."; \
+        air -c .air.{{module}}.toml; \
+    else \
+        echo "Air is not installed. Please install it with: go install github.com/air-verse/air@latest"; \
+    fi
+
+# --- Backend: Docker Build ---
+
+# Build docker image for server
+be-docker-build:
+    docker build \
+        --build-arg TARGET=server \
+        --build-arg VERSION={{VERSION}} \
+        --build-arg COMMIT={{COMMIT}} \
+        --build-arg BUILD_TIME={{BUILD_TIME}} \
+        -t template-server:latest .
+
+# Build docker image for a specific module
+be-docker-build-module module:
+    @if [ ! -d "cmd/{{module}}" ]; then echo "Error: Module '{{module}}' not found in cmd/"; exit 1; fi
+    @echo "Building Docker image for module: {{module}}"
+    docker build \
+        --build-arg TARGET={{module}} \
+        --build-arg VERSION={{VERSION}} \
+        --build-arg COMMIT={{COMMIT}} \
+        --build-arg BUILD_TIME={{BUILD_TIME}} \
+        -t template-{{module}}:latest .
+
+# --- Backend: Modules ---
+
+# Scaffold a new module
+be-new-module module:
+    ./scripts/scaffold-module.sh {{module}}
+
+# Destroy a module completely
+be-destroy-module module:
+    ./scripts/destroy-module.sh {{module}}
+
+# --- Backend: GraphQL ---
+
+# Add optional GraphQL support using gqlgen (automatically generates code)
+be-graphql-add:
+    ./scripts/graphql-add-to-project.sh
+
+# Initialize GraphQL (alias for graphql-add)
+be-graphql-init: be-graphql-add
+
+# Generate GraphQL code for all modules
+be-graphql-generate: be-graphql-generate-all
+
+# Generate GraphQL code for a specific module
+be-graphql-generate-module module:
+    ./scripts/graphql-generate-module.sh {{module}}
+
+# Generate GraphQL code for all modules (auto-discovers modules with schemas)
+be-graphql-generate-all:
+    ./scripts/graphql-generate-all.sh
+
+# Generate GraphQL schemas from OpenAPI/Swagger files for all modules
+be-graphql-from-proto:
+    ./scripts/graphql-from-proto-all.sh
+
+# Validate GraphQL schema (dummy, following Makefile)
+be-graphql-validate:
+    @echo "GraphQL validation not implemented"
+
+# --- Backend: Visualization ---
+
+# Visualize module connections
+be-visualize format="html" serve="false":
+    @echo "🔍 Analyzing OPOS modulith architecture..."
+    @if [ "{{serve}}" = "true" ]; then \
+        go run ./cmd/visualize/main.go -format={{format}} -serve; \
+    else \
+        go run ./cmd/visualize/main.go -format={{format}}; \
+    fi
+
+# --- Backend: Messaging & Bot ---
+
+# Register a messaging provider (whatsapp or telegram)
+be-bot-register integration:
+    #!/usr/bin/env bash
+    if [ "{{integration}}" == "whatsapp" ]; then
+        echo "Registering WhatsApp provider..."
+        curl -X POST http://localhost:{{HTTP_PORT}}/v1/messaging/providers \
+            -H "Content-Type: application/json" \
+            -d '{ \
+                "name": "Local WhatsApp", \
+                "type": "PROVIDER_TYPE_WHATSAPP", \
+                "config": "{\"access_token\":\"{{WHATSAPP_ACCESS_TOKEN}}\", \"phone_number_id\":\"{{WHATSAPP_PHONE_NUMBER_ID}}\", \"app_secret\":\"{{WHATSAPP_APP_SECRET}}\"}", \
+                "webhook_verify_token": "{{WHATSAPP_VERIFY_TOKEN}}" \
+            }'
+    elif [ "{{integration}}" == "telegram" ]; then
+        echo "Registering Telegram provider..."
+        curl -X POST http://localhost:{{HTTP_PORT}}/v1/messaging/providers \
+            -H "Content-Type: application/json" \
+            -d '{ \
+                "name": "Local Telegram", \
+                "type": "PROVIDER_TYPE_TELEGRAM", \
+                "config": "{\"token\":\"{{TELEGRAM_BOT_TOKEN}}\"}" \
+            }'
+    else
+        echo "Unsupported integration: {{integration}}"
+        exit 1
+    fi
+
+# Simulate a WhatsApp message webhook
+be-bot-simulate-wa-msg provider_id contact_id text="hello":
+    @echo "Simulating WhatsApp message: {{text}}"
+    @curl -X POST http://localhost:{{HTTP_PORT}}/v1/messaging/webhook/{{provider_id}} \
+        -H "Content-Type: application/json" \
+        -H "X-Hub-Signature-256: sha256=MOCK_SIGNATURE" \
+        -d '{ \
+            "object": "whatsapp_business_account", \
+            "entry": [{ \
+                "changes": [{ \
+                    "field": "messages", \
+                    "value": { \
+                        "messages": [{ \
+                            "from": "{{contact_id}}", \
+                            "id": "wamid.MOCK_ID", \
+                            "text": { "body": "{{text}}" }, \
+                            "type": "text" \
+                        }] \
+                    } \
+                }] \
+            }] \
+        }'
+
+# Simulate a Telegram message webhook
+be-bot-simulate-tg-msg provider_id contact_id text="hello":
+    @echo "Simulating Telegram message: {{text}}"
+    @curl -X POST http://localhost:{{HTTP_PORT}}/v1/messaging/webhook/{{provider_id}} \
+        -H "Content-Type: application/json" \
+        -d '{ \
+            "update_id": 12345, \
+            "message": { \
+                "message_id": 1, \
+                "from": { "id": {{contact_id}}, "first_name": "TestUser" }, \
+                "chat": { "id": {{contact_id}}, "type": "private" }, \
+                "text": "{{text}}" \
+            } \
+        }'
+
+# Link a messaging contact to a user
+be-bot-link-user contact_id user_id:
+    @echo "Linking contact {{contact_id}} to user {{user_id}}..."
+    @curl -X POST http://localhost:{{HTTP_PORT}}/v1/messaging/contacts/{{contact_id}}/link \
+        -H "Content-Type: application/json" \
+        -d '{ \
+            "user_id": "{{user_id}}" \
+        }'
+
+# --- Documentation Site (MkDocs) ---
+
+# Install docs site dependencies in local venv
+docs-install:
+    @PYTHON_BIN="$(command -v python || command -v python3)"; \
+    if [ -z "$PYTHON_BIN" ]; then \
+        echo "❌ Python not found. Install python3 and retry."; \
+        exit 1; \
+    fi; \
+    "$PYTHON_BIN" -m venv .venv-docs
+    . .venv-docs/bin/activate && pip install -r docs/docs-site/requirements.txt
+
+# Serve docs site locally (default: http://127.0.0.1:8001)
+docs-serve port="8001":
+    @just docs-build
+    . .venv-docs/bin/activate && mkdocs serve -f docs/docs-site/mkdocs.yml -a 127.0.0.1:{{port}}
+
+# Build docs site static output into temp/docs-site
+docs-build:
+    @if [ ! -d ".venv-docs" ]; then just docs-install; fi
+    @./scripts/docs-i18n-check.sh
+    @./scripts/docs-sync-openapi.sh
+    . .venv-docs/bin/activate && mkdocs build -f docs/docs-site/mkdocs.yml
+
+# Validate ES/EN documentation parity map
+docs-i18n-check:
+    @./scripts/docs-i18n-check.sh
+
+# Sync generated backend OpenAPI specs into docs/api/openapi
+docs-openapi-sync:
+    @./scripts/docs-sync-openapi.sh
diff --git a/modules/auth/internal/db/query/auth.sql b/modules/auth/internal/db/query/auth.sql
index d59f74b..b731866 100644
--- a/modules/auth/internal/db/query/auth.sql
+++ b/modules/auth/internal/db/query/auth.sql
@@ -15,7 +15,30 @@ SELECT * FROM auth.users WHERE email = $1 LIMIT 1;
 SELECT * FROM auth.users WHERE phone = $1 LIMIT 1;
 
 -- name: UpdateUserProfile :exec
-UPDATE auth.users SET display_name = $2, avatar_url = $3, updated_at = CURRENT_TIMESTAMP WHERE id = $1;
+UPDATE auth.users SET display_name = $2, avatar_url = $3, timezone = $4, updated_at = CURRENT_TIMESTAMP WHERE id = $1;
+
+
+-- name: GetUserRole :one
+SELECT r.name
+FROM auth.roles r
+JOIN auth.user_roles ur ON r.id = ur.role_id
+WHERE ur.user_id = $1
+  AND r.deleted_at IS NULL
+LIMIT 1;
+
+-- name: AssignUserRole :exec
+INSERT INTO auth.user_roles (user_id, role_id, created_at, updated_at)
+VALUES ($1, (SELECT id FROM auth.roles WHERE LOWER(name) = LOWER(sqlc.arg(role_name)) AND deleted_at IS NULL), NOW(), NOW())
+ON CONFLICT (user_id, role_id) DO UPDATE SET updated_at = NOW();
+
+-- name: RemoveUserRoles :exec
+DELETE FROM auth.user_roles WHERE user_id = $1;
+
+-- name: MarkEmailVerified :exec
+UPDATE auth.users SET email_verified = TRUE, updated_at = NOW() WHERE id = $1;
+
+-- name: MarkPhoneVerified :exec
+UPDATE auth.users SET phone_verified = TRUE, updated_at = NOW() WHERE id = $1;
 
 -- ========================
 -- Magic Codes (Passwordless)
@@ -158,3 +181,22 @@ DELETE FROM auth.oauth_states WHERE state = $1;
 
 -- name: CleanupExpiredOAuthStates :exec
 DELETE FROM auth.oauth_states WHERE expires_at < CURRENT_TIMESTAMP;
+
+-- ========================
+-- Outbox
+-- ========================
+
+-- name: StoreOutbox :exec
+INSERT INTO auth.outbox (id, event_name, payload, created_at)
+VALUES ($1, $2, $3, NOW());
+
+-- name: GetUnpublishedOutbox :many
+SELECT * FROM auth.outbox
+WHERE published_at IS NULL
+ORDER BY created_at ASC
+LIMIT $1;
+
+-- name: MarkOutboxAsPublished :exec
+UPDATE auth.outbox
+SET published_at = NOW()
+WHERE id = ANY($1::varchar[]);
diff --git a/modules/auth/internal/db/store/auth.sql.go b/modules/auth/internal/db/store/auth.sql.go
index 41b2cc8..bf0566d 100644
--- a/modules/auth/internal/db/store/auth.sql.go
+++ b/modules/auth/internal/db/store/auth.sql.go
@@ -7,12 +7,26 @@ package store
 
 import (
 	"context"
-	"database/sql"
-	"time"
 
-	"github.com/sqlc-dev/pqtype"
+	"github.com/jackc/pgx/v5/pgtype"
 )
 
+const assignUserRole = `-- name: AssignUserRole :exec
+INSERT INTO auth.user_roles (user_id, role_id, created_at, updated_at)
+VALUES ($1, (SELECT id FROM auth.roles WHERE LOWER(name) = LOWER($2) AND deleted_at IS NULL), NOW(), NOW())
+ON CONFLICT (user_id, role_id) DO UPDATE SET updated_at = NOW()
+`
+
+type AssignUserRoleParams struct {
+	UserID   string `json:"user_id"`
+	RoleName string `json:"role_name"`
+}
+
+func (q *Queries) AssignUserRole(ctx context.Context, arg AssignUserRoleParams) error {
+	_, err := q.db.Exec(ctx, assignUserRole, arg.UserID, arg.RoleName)
+	return err
+}
+
 const blacklistToken = `-- name: BlacklistToken :exec
 
 INSERT INTO auth.token_blacklist (token_hash, user_id, expires_at, reason)
@@ -21,17 +35,17 @@ ON CONFLICT (token_hash) DO NOTHING
 `
 
 type BlacklistTokenParams struct {
-	TokenHash string         `json:"token_hash"`
-	UserID    string         `json:"user_id"`
-	ExpiresAt time.Time      `json:"expires_at"`
-	Reason    sql.NullString `json:"reason"`
+	TokenHash string             `json:"token_hash"`
+	UserID    string             `json:"user_id"`
+	ExpiresAt pgtype.Timestamptz `json:"expires_at"`
+	Reason    pgtype.Text        `json:"reason"`
 }
 
 // ========================
 // Token Blacklist
 // ========================
 func (q *Queries) BlacklistToken(ctx context.Context, arg BlacklistTokenParams) error {
-	_, err := q.db.ExecContext(ctx, blacklistToken,
+	_, err := q.db.Exec(ctx, blacklistToken,
 		arg.TokenHash,
 		arg.UserID,
 		arg.ExpiresAt,
@@ -45,7 +59,7 @@ DELETE FROM auth.token_blacklist WHERE expires_at < CURRENT_TIMESTAMP
 `
 
 func (q *Queries) CleanupExpiredBlacklistEntries(ctx context.Context) error {
-	_, err := q.db.ExecContext(ctx, cleanupExpiredBlacklistEntries)
+	_, err := q.db.Exec(ctx, cleanupExpiredBlacklistEntries)
 	return err
 }
 
@@ -54,7 +68,7 @@ DELETE FROM auth.magic_codes WHERE expires_at < CURRENT_TIMESTAMP
 `
 
 func (q *Queries) CleanupExpiredMagicCodes(ctx context.Context) error {
-	_, err := q.db.ExecContext(ctx, cleanupExpiredMagicCodes)
+	_, err := q.db.Exec(ctx, cleanupExpiredMagicCodes)
 	return err
 }
 
@@ -63,7 +77,7 @@ DELETE FROM auth.oauth_states WHERE expires_at < CURRENT_TIMESTAMP
 `
 
 func (q *Queries) CleanupExpiredOAuthStates(ctx context.Context) error {
-	_, err := q.db.ExecContext(ctx, cleanupExpiredOAuthStates)
+	_, err := q.db.Exec(ctx, cleanupExpiredOAuthStates)
 	return err
 }
 
@@ -72,7 +86,7 @@ DELETE FROM auth.sessions WHERE expires_at < CURRENT_TIMESTAMP - INTERVAL '7 day
 `
 
 func (q *Queries) CleanupExpiredSessions(ctx context.Context) error {
-	_, err := q.db.ExecContext(ctx, cleanupExpiredSessions)
+	_, err := q.db.Exec(ctx, cleanupExpiredSessions)
 	return err
 }
 
@@ -81,7 +95,7 @@ SELECT COUNT(*) FROM auth.user_external_accounts WHERE user_id = $1
 `
 
 func (q *Queries) CountExternalAccountsByUserID(ctx context.Context, userID string) (int64, error) {
-	row := q.db.QueryRowContext(ctx, countExternalAccountsByUserID, userID)
+	row := q.db.QueryRow(ctx, countExternalAccountsByUserID, userID)
 	var count int64
 	err := row.Scan(&count)
 	return count, err
@@ -94,24 +108,24 @@ VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)
 `
 
 type CreateExternalAccountParams struct {
-	ID             string                `json:"id"`
-	UserID         string                `json:"user_id"`
-	Provider       string                `json:"provider"`
-	ProviderUserID string                `json:"provider_user_id"`
-	Email          sql.NullString        `json:"email"`
-	Name           sql.NullString        `json:"name"`
-	AvatarUrl      sql.NullString        `json:"avatar_url"`
-	AccessToken    sql.NullString        `json:"access_token"`
-	RefreshToken   sql.NullString        `json:"refresh_token"`
-	TokenExpiresAt sql.NullTime          `json:"token_expires_at"`
-	RawData        pqtype.NullRawMessage `json:"raw_data"`
+	ID             string             `json:"id"`
+	UserID         string             `json:"user_id"`
+	Provider       string             `json:"provider"`
+	ProviderUserID string             `json:"provider_user_id"`
+	Email          pgtype.Text        `json:"email"`
+	Name           pgtype.Text        `json:"name"`
+	AvatarUrl      pgtype.Text        `json:"avatar_url"`
+	AccessToken    pgtype.Text        `json:"access_token"`
+	RefreshToken   pgtype.Text        `json:"refresh_token"`
+	TokenExpiresAt pgtype.Timestamptz `json:"token_expires_at"`
+	RawData        []byte             `json:"raw_data"`
 }
 
 // ========================
 // External OAuth Accounts
 // ========================
 func (q *Queries) CreateExternalAccount(ctx context.Context, arg CreateExternalAccountParams) error {
-	_, err := q.db.ExecContext(ctx, createExternalAccount,
+	_, err := q.db.Exec(ctx, createExternalAccount,
 		arg.ID,
 		arg.UserID,
 		arg.Provider,
@@ -133,17 +147,17 @@ INSERT INTO auth.magic_codes (code, user_email, user_phone, expires_at) VALUES (
 `
 
 type CreateMagicCodeParams struct {
-	Code      string         `json:"code"`
-	UserEmail sql.NullString `json:"user_email"`
-	UserPhone sql.NullString `json:"user_phone"`
-	ExpiresAt time.Time      `json:"expires_at"`
+	Code      string             `json:"code"`
+	UserEmail pgtype.Text        `json:"user_email"`
+	UserPhone pgtype.Text        `json:"user_phone"`
+	ExpiresAt pgtype.Timestamptz `json:"expires_at"`
 }
 
 // ========================
 // Magic Codes (Passwordless)
 // ========================
 func (q *Queries) CreateMagicCode(ctx context.Context, arg CreateMagicCodeParams) error {
-	_, err := q.db.ExecContext(ctx, createMagicCode,
+	_, err := q.db.Exec(ctx, createMagicCode,
 		arg.Code,
 		arg.UserEmail,
 		arg.UserPhone,
@@ -159,19 +173,19 @@ VALUES ($1, $2, $3, $4, $5, $6)
 `
 
 type CreateOAuthStateParams struct {
-	State       string         `json:"state"`
-	Provider    string         `json:"provider"`
-	RedirectUrl sql.NullString `json:"redirect_url"`
-	UserID      sql.NullString `json:"user_id"`
-	Action      string         `json:"action"`
-	ExpiresAt   time.Time      `json:"expires_at"`
+	State       string             `json:"state"`
+	Provider    string             `json:"provider"`
+	RedirectUrl pgtype.Text        `json:"redirect_url"`
+	UserID      pgtype.Text        `json:"user_id"`
+	Action      string             `json:"action"`
+	ExpiresAt   pgtype.Timestamptz `json:"expires_at"`
 }
 
 // ========================
 // OAuth State Tokens
 // ========================
 func (q *Queries) CreateOAuthState(ctx context.Context, arg CreateOAuthStateParams) error {
-	_, err := q.db.ExecContext(ctx, createOAuthState,
+	_, err := q.db.Exec(ctx, createOAuthState,
 		arg.State,
 		arg.Provider,
 		arg.RedirectUrl,
@@ -189,19 +203,19 @@ VALUES ($1, $2, $3, $4, $5, $6)
 `
 
 type CreatePendingContactChangeParams struct {
-	ID               string    `json:"id"`
-	UserID           string    `json:"user_id"`
-	ChangeType       string    `json:"change_type"`
-	NewValue         string    `json:"new_value"`
-	VerificationCode string    `json:"verification_code"`
-	ExpiresAt        time.Time `json:"expires_at"`
+	ID               string             `json:"id"`
+	UserID           string             `json:"user_id"`
+	ChangeType       string             `json:"change_type"`
+	NewValue         string             `json:"new_value"`
+	VerificationCode string             `json:"verification_code"`
+	ExpiresAt        pgtype.Timestamptz `json:"expires_at"`
 }
 
 // ========================
 // Pending Contact Changes
 // ========================
 func (q *Queries) CreatePendingContactChange(ctx context.Context, arg CreatePendingContactChangeParams) error {
-	_, err := q.db.ExecContext(ctx, createPendingContactChange,
+	_, err := q.db.Exec(ctx, createPendingContactChange,
 		arg.ID,
 		arg.UserID,
 		arg.ChangeType,
@@ -219,19 +233,19 @@ VALUES ($1, $2, $3, $4, $5, $6)
 `
 
 type CreateSessionParams struct {
-	ID               string         `json:"id"`
-	UserID           string         `json:"user_id"`
-	RefreshTokenHash string         `json:"refresh_token_hash"`
-	UserAgent        sql.NullString `json:"user_agent"`
-	IpAddress        sql.NullString `json:"ip_address"`
-	ExpiresAt        time.Time      `json:"expires_at"`
+	ID               string             `json:"id"`
+	UserID           string             `json:"user_id"`
+	RefreshTokenHash string             `json:"refresh_token_hash"`
+	UserAgent        pgtype.Text        `json:"user_agent"`
+	IpAddress        pgtype.Text        `json:"ip_address"`
+	ExpiresAt        pgtype.Timestamptz `json:"expires_at"`
 }
 
 // ========================
 // Sessions
 // ========================
 func (q *Queries) CreateSession(ctx context.Context, arg CreateSessionParams) error {
-	_, err := q.db.ExecContext(ctx, createSession,
+	_, err := q.db.Exec(ctx, createSession,
 		arg.ID,
 		arg.UserID,
 		arg.RefreshTokenHash,
@@ -248,16 +262,16 @@ INSERT INTO auth.users (id, email, phone) VALUES ($1, $2, $3)
 `
 
 type CreateUserParams struct {
-	ID    string         `json:"id"`
-	Email sql.NullString `json:"email"`
-	Phone sql.NullString `json:"phone"`
+	ID    string      `json:"id"`
+	Email pgtype.Text `json:"email"`
+	Phone pgtype.Text `json:"phone"`
 }
 
 // ========================
 // User Management
 // ========================
 func (q *Queries) CreateUser(ctx context.Context, arg CreateUserParams) error {
-	_, err := q.db.ExecContext(ctx, createUser, arg.ID, arg.Email, arg.Phone)
+	_, err := q.db.Exec(ctx, createUser, arg.ID, arg.Email, arg.Phone)
 	return err
 }
 
@@ -266,7 +280,7 @@ DELETE FROM auth.pending_contact_changes WHERE expires_at < CURRENT_TIMESTAMP
 `
 
 func (q *Queries) DeleteExpiredPendingContactChanges(ctx context.Context) error {
-	_, err := q.db.ExecContext(ctx, deleteExpiredPendingContactChanges)
+	_, err := q.db.Exec(ctx, deleteExpiredPendingContactChanges)
 	return err
 }
 
@@ -280,7 +294,7 @@ type DeleteExternalAccountParams struct {
 }
 
 func (q *Queries) DeleteExternalAccount(ctx context.Context, arg DeleteExternalAccountParams) error {
-	_, err := q.db.ExecContext(ctx, deleteExternalAccount, arg.ID, arg.UserID)
+	_, err := q.db.Exec(ctx, deleteExternalAccount, arg.ID, arg.UserID)
 	return err
 }
 
@@ -294,7 +308,7 @@ type DeleteExternalAccountByProviderParams struct {
 }
 
 func (q *Queries) DeleteExternalAccountByProvider(ctx context.Context, arg DeleteExternalAccountByProviderParams) error {
-	_, err := q.db.ExecContext(ctx, deleteExternalAccountByProvider, arg.UserID, arg.Provider)
+	_, err := q.db.Exec(ctx, deleteExternalAccountByProvider, arg.UserID, arg.Provider)
 	return err
 }
 
@@ -302,8 +316,8 @@ const deleteMagicCodesByEmail = `-- name: DeleteMagicCodesByEmail :exec
 DELETE FROM auth.magic_codes WHERE user_email = $1
 `
 
-func (q *Queries) DeleteMagicCodesByEmail(ctx context.Context, userEmail sql.NullString) error {
-	_, err := q.db.ExecContext(ctx, deleteMagicCodesByEmail, userEmail)
+func (q *Queries) DeleteMagicCodesByEmail(ctx context.Context, userEmail pgtype.Text) error {
+	_, err := q.db.Exec(ctx, deleteMagicCodesByEmail, userEmail)
 	return err
 }
 
@@ -311,8 +325,8 @@ const deleteMagicCodesByPhone = `-- name: DeleteMagicCodesByPhone :exec
 DELETE FROM auth.magic_codes WHERE user_phone = $1
 `
 
-func (q *Queries) DeleteMagicCodesByPhone(ctx context.Context, userPhone sql.NullString) error {
-	_, err := q.db.ExecContext(ctx, deleteMagicCodesByPhone, userPhone)
+func (q *Queries) DeleteMagicCodesByPhone(ctx context.Context, userPhone pgtype.Text) error {
+	_, err := q.db.Exec(ctx, deleteMagicCodesByPhone, userPhone)
 	return err
 }
 
@@ -321,7 +335,7 @@ DELETE FROM auth.oauth_states WHERE state = $1
 `
 
 func (q *Queries) DeleteOAuthState(ctx context.Context, state string) error {
-	_, err := q.db.ExecContext(ctx, deleteOAuthState, state)
+	_, err := q.db.Exec(ctx, deleteOAuthState, state)
 	return err
 }
 
@@ -330,7 +344,7 @@ DELETE FROM auth.pending_contact_changes WHERE id = $1
 `
 
 func (q *Queries) DeletePendingContactChange(ctx context.Context, id string) error {
-	_, err := q.db.ExecContext(ctx, deletePendingContactChange, id)
+	_, err := q.db.Exec(ctx, deletePendingContactChange, id)
 	return err
 }
 
@@ -339,12 +353,12 @@ SELECT id, user_id, provider, provider_user_id, email, name, avatar_url, access_
 `
 
 type GetExternalAccountByProviderAndEmailParams struct {
-	Provider string         `json:"provider"`
-	Email    sql.NullString `json:"email"`
+	Provider string      `json:"provider"`
+	Email    pgtype.Text `json:"email"`
 }
 
 func (q *Queries) GetExternalAccountByProviderAndEmail(ctx context.Context, arg GetExternalAccountByProviderAndEmailParams) (AuthUserExternalAccount, error) {
-	row := q.db.QueryRowContext(ctx, getExternalAccountByProviderAndEmail, arg.Provider, arg.Email)
+	row := q.db.QueryRow(ctx, getExternalAccountByProviderAndEmail, arg.Provider, arg.Email)
 	var i AuthUserExternalAccount
 	err := row.Scan(
 		&i.ID,
@@ -374,7 +388,7 @@ type GetExternalAccountByProviderAndUserIDParams struct {
 }
 
 func (q *Queries) GetExternalAccountByProviderAndUserID(ctx context.Context, arg GetExternalAccountByProviderAndUserIDParams) (AuthUserExternalAccount, error) {
-	row := q.db.QueryRowContext(ctx, getExternalAccountByProviderAndUserID, arg.Provider, arg.ProviderUserID)
+	row := q.db.QueryRow(ctx, getExternalAccountByProviderAndUserID, arg.Provider, arg.ProviderUserID)
 	var i AuthUserExternalAccount
 	err := row.Scan(
 		&i.ID,
@@ -399,7 +413,7 @@ SELECT id, user_id, provider, provider_user_id, email, name, avatar_url, access_
 `
 
 func (q *Queries) GetExternalAccountsByUserID(ctx context.Context, userID string) ([]AuthUserExternalAccount, error) {
-	rows, err := q.db.QueryContext(ctx, getExternalAccountsByUserID, userID)
+	rows, err := q.db.Query(ctx, getExternalAccountsByUserID, userID)
 	if err != nil {
 		return nil, err
 	}
@@ -426,9 +440,6 @@ func (q *Queries) GetExternalAccountsByUserID(ctx context.Context, userID string
 		}
 		items = append(items, i)
 	}
-	if err := rows.Close(); err != nil {
-		return nil, err
-	}
 	if err := rows.Err(); err != nil {
 		return nil, err
 	}
@@ -436,11 +447,11 @@ func (q *Queries) GetExternalAccountsByUserID(ctx context.Context, userID string
 }
 
 const getOAuthState = `-- name: GetOAuthState :one
-SELECT state, provider, redirect_url, user_id, action, created_at, expires_at FROM auth.oauth_states WHERE state = $1 AND expires_at > CURRENT_TIMESTAMP LIMIT 1
+SELECT state, provider, redirect_url, user_id, action, created_at, updated_at, expires_at FROM auth.oauth_states WHERE state = $1 AND expires_at > CURRENT_TIMESTAMP LIMIT 1
 `
 
 func (q *Queries) GetOAuthState(ctx context.Context, state string) (AuthOauthState, error) {
-	row := q.db.QueryRowContext(ctx, getOAuthState, state)
+	row := q.db.QueryRow(ctx, getOAuthState, state)
 	var i AuthOauthState
 	err := row.Scan(
 		&i.State,
@@ -449,13 +460,14 @@ func (q *Queries) GetOAuthState(ctx context.Context, state string) (AuthOauthSta
 		&i.UserID,
 		&i.Action,
 		&i.CreatedAt,
+		&i.UpdatedAt,
 		&i.ExpiresAt,
 	)
 	return i, err
 }
 
 const getPendingContactChange = `-- name: GetPendingContactChange :one
-SELECT id, user_id, change_type, new_value, verification_code, created_at, expires_at FROM auth.pending_contact_changes
+SELECT id, user_id, change_type, new_value, verification_code, created_at, updated_at, expires_at FROM auth.pending_contact_changes
 WHERE user_id = $1 AND change_type = $2 AND verification_code = $3 AND expires_at > CURRENT_TIMESTAMP
 LIMIT 1
 `
@@ -467,7 +479,7 @@ type GetPendingContactChangeParams struct {
 }
 
 func (q *Queries) GetPendingContactChange(ctx context.Context, arg GetPendingContactChangeParams) (AuthPendingContactChange, error) {
-	row := q.db.QueryRowContext(ctx, getPendingContactChange, arg.UserID, arg.ChangeType, arg.VerificationCode)
+	row := q.db.QueryRow(ctx, getPendingContactChange, arg.UserID, arg.ChangeType, arg.VerificationCode)
 	var i AuthPendingContactChange
 	err := row.Scan(
 		&i.ID,
@@ -476,17 +488,18 @@ func (q *Queries) GetPendingContactChange(ctx context.Context, arg GetPendingCon
 		&i.NewValue,
 		&i.VerificationCode,
 		&i.CreatedAt,
+		&i.UpdatedAt,
 		&i.ExpiresAt,
 	)
 	return i, err
 }
 
 const getSessionByID = `-- name: GetSessionByID :one
-SELECT id, user_id, refresh_token_hash, user_agent, ip_address, created_at, last_active_at, expires_at, revoked_at FROM auth.sessions WHERE id = $1 AND revoked_at IS NULL LIMIT 1
+SELECT id, user_id, refresh_token_hash, user_agent, ip_address, created_at, updated_at, last_active_at, expires_at, revoked_at FROM auth.sessions WHERE id = $1 AND revoked_at IS NULL LIMIT 1
 `
 
 func (q *Queries) GetSessionByID(ctx context.Context, id string) (AuthSession, error) {
-	row := q.db.QueryRowContext(ctx, getSessionByID, id)
+	row := q.db.QueryRow(ctx, getSessionByID, id)
 	var i AuthSession
 	err := row.Scan(
 		&i.ID,
@@ -495,6 +508,7 @@ func (q *Queries) GetSessionByID(ctx context.Context, id string) (AuthSession, e
 		&i.UserAgent,
 		&i.IpAddress,
 		&i.CreatedAt,
+		&i.UpdatedAt,
 		&i.LastActiveAt,
 		&i.ExpiresAt,
 		&i.RevokedAt,
@@ -503,11 +517,11 @@ func (q *Queries) GetSessionByID(ctx context.Context, id string) (AuthSession, e
 }
 
 const getSessionByRefreshTokenHash = `-- name: GetSessionByRefreshTokenHash :one
-SELECT id, user_id, refresh_token_hash, user_agent, ip_address, created_at, last_active_at, expires_at, revoked_at FROM auth.sessions WHERE refresh_token_hash = $1 AND revoked_at IS NULL AND expires_at > CURRENT_TIMESTAMP LIMIT 1
+SELECT id, user_id, refresh_token_hash, user_agent, ip_address, created_at, updated_at, last_active_at, expires_at, revoked_at FROM auth.sessions WHERE refresh_token_hash = $1 AND revoked_at IS NULL AND expires_at > CURRENT_TIMESTAMP LIMIT 1
 `
 
 func (q *Queries) GetSessionByRefreshTokenHash(ctx context.Context, refreshTokenHash string) (AuthSession, error) {
-	row := q.db.QueryRowContext(ctx, getSessionByRefreshTokenHash, refreshTokenHash)
+	row := q.db.QueryRow(ctx, getSessionByRefreshTokenHash, refreshTokenHash)
 	var i AuthSession
 	err := row.Scan(
 		&i.ID,
@@ -516,6 +530,7 @@ func (q *Queries) GetSessionByRefreshTokenHash(ctx context.Context, refreshToken
 		&i.UserAgent,
 		&i.IpAddress,
 		&i.CreatedAt,
+		&i.UpdatedAt,
 		&i.LastActiveAt,
 		&i.ExpiresAt,
 		&i.RevokedAt,
@@ -524,11 +539,11 @@ func (q *Queries) GetSessionByRefreshTokenHash(ctx context.Context, refreshToken
 }
 
 const getSessionsByUserID = `-- name: GetSessionsByUserID :many
-SELECT id, user_id, refresh_token_hash, user_agent, ip_address, created_at, last_active_at, expires_at, revoked_at FROM auth.sessions WHERE user_id = $1 AND revoked_at IS NULL AND expires_at > CURRENT_TIMESTAMP ORDER BY last_active_at DESC
+SELECT id, user_id, refresh_token_hash, user_agent, ip_address, created_at, updated_at, last_active_at, expires_at, revoked_at FROM auth.sessions WHERE user_id = $1 AND revoked_at IS NULL AND expires_at > CURRENT_TIMESTAMP ORDER BY last_active_at DESC
 `
 
 func (q *Queries) GetSessionsByUserID(ctx context.Context, userID string) ([]AuthSession, error) {
-	rows, err := q.db.QueryContext(ctx, getSessionsByUserID, userID)
+	rows, err := q.db.Query(ctx, getSessionsByUserID, userID)
 	if err != nil {
 		return nil, err
 	}
@@ -543,6 +558,7 @@ func (q *Queries) GetSessionsByUserID(ctx context.Context, userID string) ([]Aut
 			&i.UserAgent,
 			&i.IpAddress,
 			&i.CreatedAt,
+			&i.UpdatedAt,
 			&i.LastActiveAt,
 			&i.ExpiresAt,
 			&i.RevokedAt,
@@ -551,9 +567,40 @@ func (q *Queries) GetSessionsByUserID(ctx context.Context, userID string) ([]Aut
 		}
 		items = append(items, i)
 	}
-	if err := rows.Close(); err != nil {
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const getUnpublishedOutbox = `-- name: GetUnpublishedOutbox :many
+SELECT id, event_name, payload, created_at, updated_at, published_at FROM auth.outbox
+WHERE published_at IS NULL
+ORDER BY created_at ASC
+LIMIT $1
+`
+
+func (q *Queries) GetUnpublishedOutbox(ctx context.Context, limit int32) ([]AuthOutbox, error) {
+	rows, err := q.db.Query(ctx, getUnpublishedOutbox, limit)
+	if err != nil {
 		return nil, err
 	}
+	defer rows.Close()
+	var items []AuthOutbox
+	for rows.Next() {
+		var i AuthOutbox
+		if err := rows.Scan(
+			&i.ID,
+			&i.EventName,
+			&i.Payload,
+			&i.CreatedAt,
+			&i.UpdatedAt,
+			&i.PublishedAt,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
 	if err := rows.Err(); err != nil {
 		return nil, err
 	}
@@ -561,76 +608,104 @@ func (q *Queries) GetSessionsByUserID(ctx context.Context, userID string) ([]Aut
 }
 
 const getUserByEmail = `-- name: GetUserByEmail :one
-SELECT id, email, phone, created_at, updated_at, display_name, avatar_url FROM auth.users WHERE email = $1 LIMIT 1
+SELECT id, email, phone, display_name, avatar_url, status, email_verified, phone_verified, timezone, created_at, updated_at FROM auth.users WHERE email = $1 LIMIT 1
 `
 
-func (q *Queries) GetUserByEmail(ctx context.Context, email sql.NullString) (AuthUser, error) {
-	row := q.db.QueryRowContext(ctx, getUserByEmail, email)
+func (q *Queries) GetUserByEmail(ctx context.Context, email pgtype.Text) (AuthUser, error) {
+	row := q.db.QueryRow(ctx, getUserByEmail, email)
 	var i AuthUser
 	err := row.Scan(
 		&i.ID,
 		&i.Email,
 		&i.Phone,
-		&i.CreatedAt,
-		&i.UpdatedAt,
 		&i.DisplayName,
 		&i.AvatarUrl,
+		&i.Status,
+		&i.EmailVerified,
+		&i.PhoneVerified,
+		&i.Timezone,
+		&i.CreatedAt,
+		&i.UpdatedAt,
 	)
 	return i, err
 }
 
 const getUserByID = `-- name: GetUserByID :one
-SELECT id, email, phone, created_at, updated_at, display_name, avatar_url FROM auth.users WHERE id = $1 LIMIT 1
+SELECT id, email, phone, display_name, avatar_url, status, email_verified, phone_verified, timezone, created_at, updated_at FROM auth.users WHERE id = $1 LIMIT 1
 `
 
 func (q *Queries) GetUserByID(ctx context.Context, id string) (AuthUser, error) {
-	row := q.db.QueryRowContext(ctx, getUserByID, id)
+	row := q.db.QueryRow(ctx, getUserByID, id)
 	var i AuthUser
 	err := row.Scan(
 		&i.ID,
 		&i.Email,
 		&i.Phone,
-		&i.CreatedAt,
-		&i.UpdatedAt,
 		&i.DisplayName,
 		&i.AvatarUrl,
+		&i.Status,
+		&i.EmailVerified,
+		&i.PhoneVerified,
+		&i.Timezone,
+		&i.CreatedAt,
+		&i.UpdatedAt,
 	)
 	return i, err
 }
 
 const getUserByPhone = `-- name: GetUserByPhone :one
-SELECT id, email, phone, created_at, updated_at, display_name, avatar_url FROM auth.users WHERE phone = $1 LIMIT 1
+SELECT id, email, phone, display_name, avatar_url, status, email_verified, phone_verified, timezone, created_at, updated_at FROM auth.users WHERE phone = $1 LIMIT 1
 `
 
-func (q *Queries) GetUserByPhone(ctx context.Context, phone sql.NullString) (AuthUser, error) {
-	row := q.db.QueryRowContext(ctx, getUserByPhone, phone)
+func (q *Queries) GetUserByPhone(ctx context.Context, phone pgtype.Text) (AuthUser, error) {
+	row := q.db.QueryRow(ctx, getUserByPhone, phone)
 	var i AuthUser
 	err := row.Scan(
 		&i.ID,
 		&i.Email,
 		&i.Phone,
-		&i.CreatedAt,
-		&i.UpdatedAt,
 		&i.DisplayName,
 		&i.AvatarUrl,
+		&i.Status,
+		&i.EmailVerified,
+		&i.PhoneVerified,
+		&i.Timezone,
+		&i.CreatedAt,
+		&i.UpdatedAt,
 	)
 	return i, err
 }
 
+const getUserRole = `-- name: GetUserRole :one
+SELECT r.name
+FROM auth.roles r
+JOIN auth.user_roles ur ON r.id = ur.role_id
+WHERE ur.user_id = $1
+  AND r.deleted_at IS NULL
+LIMIT 1
+`
+
+func (q *Queries) GetUserRole(ctx context.Context, userID string) (string, error) {
+	row := q.db.QueryRow(ctx, getUserRole, userID)
+	var name string
+	err := row.Scan(&name)
+	return name, err
+}
+
 const getValidMagicCodeByEmail = `-- name: GetValidMagicCodeByEmail :one
-SELECT code, user_email, user_phone, expires_at, created_at FROM auth.magic_codes
+SELECT code, user_email, user_phone, expires_at, created_at, updated_at FROM auth.magic_codes
 WHERE user_email = $1 AND code = $2 AND expires_at > $3
 ORDER BY created_at DESC LIMIT 1
 `
 
 type GetValidMagicCodeByEmailParams struct {
-	UserEmail sql.NullString `json:"user_email"`
-	Code      string         `json:"code"`
-	ExpiresAt time.Time      `json:"expires_at"`
+	UserEmail pgtype.Text        `json:"user_email"`
+	Code      string             `json:"code"`
+	ExpiresAt pgtype.Timestamptz `json:"expires_at"`
 }
 
 func (q *Queries) GetValidMagicCodeByEmail(ctx context.Context, arg GetValidMagicCodeByEmailParams) (AuthMagicCode, error) {
-	row := q.db.QueryRowContext(ctx, getValidMagicCodeByEmail, arg.UserEmail, arg.Code, arg.ExpiresAt)
+	row := q.db.QueryRow(ctx, getValidMagicCodeByEmail, arg.UserEmail, arg.Code, arg.ExpiresAt)
 	var i AuthMagicCode
 	err := row.Scan(
 		&i.Code,
@@ -638,24 +713,25 @@ func (q *Queries) GetValidMagicCodeByEmail(ctx context.Context, arg GetValidMagi
 		&i.UserPhone,
 		&i.ExpiresAt,
 		&i.CreatedAt,
+		&i.UpdatedAt,
 	)
 	return i, err
 }
 
 const getValidMagicCodeByPhone = `-- name: GetValidMagicCodeByPhone :one
-SELECT code, user_email, user_phone, expires_at, created_at FROM auth.magic_codes
+SELECT code, user_email, user_phone, expires_at, created_at, updated_at FROM auth.magic_codes
 WHERE user_phone = $1 AND code = $2 AND expires_at > $3
 ORDER BY created_at DESC LIMIT 1
 `
 
 type GetValidMagicCodeByPhoneParams struct {
-	UserPhone sql.NullString `json:"user_phone"`
-	Code      string         `json:"code"`
-	ExpiresAt time.Time      `json:"expires_at"`
+	UserPhone pgtype.Text        `json:"user_phone"`
+	Code      string             `json:"code"`
+	ExpiresAt pgtype.Timestamptz `json:"expires_at"`
 }
 
 func (q *Queries) GetValidMagicCodeByPhone(ctx context.Context, arg GetValidMagicCodeByPhoneParams) (AuthMagicCode, error) {
-	row := q.db.QueryRowContext(ctx, getValidMagicCodeByPhone, arg.UserPhone, arg.Code, arg.ExpiresAt)
+	row := q.db.QueryRow(ctx, getValidMagicCodeByPhone, arg.UserPhone, arg.Code, arg.ExpiresAt)
 	var i AuthMagicCode
 	err := row.Scan(
 		&i.Code,
@@ -663,6 +739,7 @@ func (q *Queries) GetValidMagicCodeByPhone(ctx context.Context, arg GetValidMagi
 		&i.UserPhone,
 		&i.ExpiresAt,
 		&i.CreatedAt,
+		&i.UpdatedAt,
 	)
 	return i, err
 }
@@ -672,12 +749,50 @@ SELECT EXISTS(SELECT 1 FROM auth.token_blacklist WHERE token_hash = $1 AND expir
 `
 
 func (q *Queries) IsTokenBlacklisted(ctx context.Context, tokenHash string) (bool, error) {
-	row := q.db.QueryRowContext(ctx, isTokenBlacklisted, tokenHash)
+	row := q.db.QueryRow(ctx, isTokenBlacklisted, tokenHash)
 	var exists bool
 	err := row.Scan(&exists)
 	return exists, err
 }
 
+const markEmailVerified = `-- name: MarkEmailVerified :exec
+UPDATE auth.users SET email_verified = TRUE, updated_at = NOW() WHERE id = $1
+`
+
+func (q *Queries) MarkEmailVerified(ctx context.Context, id string) error {
+	_, err := q.db.Exec(ctx, markEmailVerified, id)
+	return err
+}
+
+const markOutboxAsPublished = `-- name: MarkOutboxAsPublished :exec
+UPDATE auth.outbox
+SET published_at = NOW()
+WHERE id = ANY($1::varchar[])
+`
+
+func (q *Queries) MarkOutboxAsPublished(ctx context.Context, dollar_1 []string) error {
+	_, err := q.db.Exec(ctx, markOutboxAsPublished, dollar_1)
+	return err
+}
+
+const markPhoneVerified = `-- name: MarkPhoneVerified :exec
+UPDATE auth.users SET phone_verified = TRUE, updated_at = NOW() WHERE id = $1
+`
+
+func (q *Queries) MarkPhoneVerified(ctx context.Context, id string) error {
+	_, err := q.db.Exec(ctx, markPhoneVerified, id)
+	return err
+}
+
+const removeUserRoles = `-- name: RemoveUserRoles :exec
+DELETE FROM auth.user_roles WHERE user_id = $1
+`
+
+func (q *Queries) RemoveUserRoles(ctx context.Context, userID string) error {
+	_, err := q.db.Exec(ctx, removeUserRoles, userID)
+	return err
+}
+
 const revokeAllUserSessions = `-- name: RevokeAllUserSessions :execrows
 UPDATE auth.sessions SET revoked_at = CURRENT_TIMESTAMP WHERE user_id = $1 AND revoked_at IS NULL AND ($2 = '' OR id != $2)
 `
@@ -688,11 +803,11 @@ type RevokeAllUserSessionsParams struct {
 }
 
 func (q *Queries) RevokeAllUserSessions(ctx context.Context, arg RevokeAllUserSessionsParams) (int64, error) {
-	result, err := q.db.ExecContext(ctx, revokeAllUserSessions, arg.UserID, arg.Column2)
+	result, err := q.db.Exec(ctx, revokeAllUserSessions, arg.UserID, arg.Column2)
 	if err != nil {
 		return 0, err
 	}
-	return result.RowsAffected()
+	return result.RowsAffected(), nil
 }
 
 const revokeSession = `-- name: RevokeSession :exec
@@ -700,7 +815,27 @@ UPDATE auth.sessions SET revoked_at = CURRENT_TIMESTAMP WHERE id = $1
 `
 
 func (q *Queries) RevokeSession(ctx context.Context, id string) error {
-	_, err := q.db.ExecContext(ctx, revokeSession, id)
+	_, err := q.db.Exec(ctx, revokeSession, id)
+	return err
+}
+
+const storeOutbox = `-- name: StoreOutbox :exec
+
+INSERT INTO auth.outbox (id, event_name, payload, created_at)
+VALUES ($1, $2, $3, NOW())
+`
+
+type StoreOutboxParams struct {
+	ID        string `json:"id"`
+	EventName string `json:"event_name"`
+	Payload   []byte `json:"payload"`
+}
+
+// ========================
+// Outbox
+// ========================
+func (q *Queries) StoreOutbox(ctx context.Context, arg StoreOutboxParams) error {
+	_, err := q.db.Exec(ctx, storeOutbox, arg.ID, arg.EventName, arg.Payload)
 	return err
 }
 
@@ -711,16 +846,16 @@ WHERE provider = $1 AND provider_user_id = $2
 `
 
 type UpdateExternalAccountProfileParams struct {
-	Provider       string                `json:"provider"`
-	ProviderUserID string                `json:"provider_user_id"`
-	Name           sql.NullString        `json:"name"`
-	AvatarUrl      sql.NullString        `json:"avatar_url"`
-	Email          sql.NullString        `json:"email"`
-	RawData        pqtype.NullRawMessage `json:"raw_data"`
+	Provider       string      `json:"provider"`
+	ProviderUserID string      `json:"provider_user_id"`
+	Name           pgtype.Text `json:"name"`
+	AvatarUrl      pgtype.Text `json:"avatar_url"`
+	Email          pgtype.Text `json:"email"`
+	RawData        []byte      `json:"raw_data"`
 }
 
 func (q *Queries) UpdateExternalAccountProfile(ctx context.Context, arg UpdateExternalAccountProfileParams) error {
-	_, err := q.db.ExecContext(ctx, updateExternalAccountProfile,
+	_, err := q.db.Exec(ctx, updateExternalAccountProfile,
 		arg.Provider,
 		arg.ProviderUserID,
 		arg.Name,
@@ -738,15 +873,15 @@ WHERE provider = $1 AND provider_user_id = $2
 `
 
 type UpdateExternalAccountTokensParams struct {
-	Provider       string         `json:"provider"`
-	ProviderUserID string         `json:"provider_user_id"`
-	AccessToken    sql.NullString `json:"access_token"`
-	RefreshToken   sql.NullString `json:"refresh_token"`
-	TokenExpiresAt sql.NullTime   `json:"token_expires_at"`
+	Provider       string             `json:"provider"`
+	ProviderUserID string             `json:"provider_user_id"`
+	AccessToken    pgtype.Text        `json:"access_token"`
+	RefreshToken   pgtype.Text        `json:"refresh_token"`
+	TokenExpiresAt pgtype.Timestamptz `json:"token_expires_at"`
 }
 
 func (q *Queries) UpdateExternalAccountTokens(ctx context.Context, arg UpdateExternalAccountTokensParams) error {
-	_, err := q.db.ExecContext(ctx, updateExternalAccountTokens,
+	_, err := q.db.Exec(ctx, updateExternalAccountTokens,
 		arg.Provider,
 		arg.ProviderUserID,
 		arg.AccessToken,
@@ -761,21 +896,27 @@ UPDATE auth.sessions SET last_active_at = CURRENT_TIMESTAMP WHERE id = $1
 `
 
 func (q *Queries) UpdateSessionActivity(ctx context.Context, id string) error {
-	_, err := q.db.ExecContext(ctx, updateSessionActivity, id)
+	_, err := q.db.Exec(ctx, updateSessionActivity, id)
 	return err
 }
 
 const updateUserProfile = `-- name: UpdateUserProfile :exec
-UPDATE auth.users SET display_name = $2, avatar_url = $3, updated_at = CURRENT_TIMESTAMP WHERE id = $1
+UPDATE auth.users SET display_name = $2, avatar_url = $3, timezone = $4, updated_at = CURRENT_TIMESTAMP WHERE id = $1
 `
 
 type UpdateUserProfileParams struct {
-	ID          string         `json:"id"`
-	DisplayName sql.NullString `json:"display_name"`
-	AvatarUrl   sql.NullString `json:"avatar_url"`
+	ID          string      `json:"id"`
+	DisplayName pgtype.Text `json:"display_name"`
+	AvatarUrl   pgtype.Text `json:"avatar_url"`
+	Timezone    pgtype.Text `json:"timezone"`
 }
 
 func (q *Queries) UpdateUserProfile(ctx context.Context, arg UpdateUserProfileParams) error {
-	_, err := q.db.ExecContext(ctx, updateUserProfile, arg.ID, arg.DisplayName, arg.AvatarUrl)
+	_, err := q.db.Exec(ctx, updateUserProfile,
+		arg.ID,
+		arg.DisplayName,
+		arg.AvatarUrl,
+		arg.Timezone,
+	)
 	return err
 }
diff --git a/modules/auth/internal/db/store/db.go b/modules/auth/internal/db/store/db.go
index 5131a7c..f4d7bbc 100644
--- a/modules/auth/internal/db/store/db.go
+++ b/modules/auth/internal/db/store/db.go
@@ -6,14 +6,15 @@ package store
 
 import (
 	"context"
-	"database/sql"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgconn"
 )
 
 type DBTX interface {
-	ExecContext(context.Context, string, ...interface{}) (sql.Result, error)
-	PrepareContext(context.Context, string) (*sql.Stmt, error)
-	QueryContext(context.Context, string, ...interface{}) (*sql.Rows, error)
-	QueryRowContext(context.Context, string, ...interface{}) *sql.Row
+	Exec(context.Context, string, ...interface{}) (pgconn.CommandTag, error)
+	Query(context.Context, string, ...interface{}) (pgx.Rows, error)
+	QueryRow(context.Context, string, ...interface{}) pgx.Row
 }
 
 func New(db DBTX) *Queries {
@@ -24,7 +25,7 @@ type Queries struct {
 	db DBTX
 }
 
-func (q *Queries) WithTx(tx *sql.Tx) *Queries {
+func (q *Queries) WithTx(tx pgx.Tx) *Queries {
 	return &Queries{
 		db: tx,
 	}
diff --git a/modules/auth/internal/db/store/models.go b/modules/auth/internal/db/store/models.go
index b540fb4..eafae95 100644
--- a/modules/auth/internal/db/store/models.go
+++ b/modules/auth/internal/db/store/models.go
@@ -5,104 +5,134 @@
 package store
 
 import (
-	"database/sql"
-	"time"
-
-	"github.com/sqlc-dev/pqtype"
+	"github.com/jackc/pgx/v5/pgtype"
 )
 
+type AuthAuthConfig struct {
+	Key       string             `json:"key"`
+	Value     string             `json:"value"`
+	UpdatedAt pgtype.Timestamptz `json:"updated_at"`
+}
+
 type AuthMagicCode struct {
-	Code      string         `json:"code"`
-	UserEmail sql.NullString `json:"user_email"`
-	UserPhone sql.NullString `json:"user_phone"`
-	ExpiresAt time.Time      `json:"expires_at"`
-	CreatedAt time.Time      `json:"created_at"`
+	Code      string             `json:"code"`
+	UserEmail pgtype.Text        `json:"user_email"`
+	UserPhone pgtype.Text        `json:"user_phone"`
+	ExpiresAt pgtype.Timestamptz `json:"expires_at"`
+	CreatedAt pgtype.Timestamptz `json:"created_at"`
+	UpdatedAt pgtype.Timestamptz `json:"updated_at"`
 }
 
 type AuthOauthState struct {
-	State       string         `json:"state"`
-	Provider    string         `json:"provider"`
-	RedirectUrl sql.NullString `json:"redirect_url"`
-	UserID      sql.NullString `json:"user_id"`
-	Action      string         `json:"action"`
-	CreatedAt   time.Time      `json:"created_at"`
-	ExpiresAt   time.Time      `json:"expires_at"`
+	State       string             `json:"state"`
+	Provider    string             `json:"provider"`
+	RedirectUrl pgtype.Text        `json:"redirect_url"`
+	UserID      pgtype.Text        `json:"user_id"`
+	Action      string             `json:"action"`
+	CreatedAt   pgtype.Timestamptz `json:"created_at"`
+	UpdatedAt   pgtype.Timestamptz `json:"updated_at"`
+	ExpiresAt   pgtype.Timestamptz `json:"expires_at"`
+}
+
+type AuthOutbox struct {
+	ID          string             `json:"id"`
+	EventName   string             `json:"event_name"`
+	Payload     []byte             `json:"payload"`
+	CreatedAt   pgtype.Timestamptz `json:"created_at"`
+	UpdatedAt   pgtype.Timestamptz `json:"updated_at"`
+	PublishedAt pgtype.Timestamptz `json:"published_at"`
 }
 
 type AuthPendingContactChange struct {
-	ID               string    `json:"id"`
-	UserID           string    `json:"user_id"`
-	ChangeType       string    `json:"change_type"`
-	NewValue         string    `json:"new_value"`
-	VerificationCode string    `json:"verification_code"`
-	CreatedAt        time.Time `json:"created_at"`
-	ExpiresAt        time.Time `json:"expires_at"`
+	ID               string             `json:"id"`
+	UserID           string             `json:"user_id"`
+	ChangeType       string             `json:"change_type"`
+	NewValue         string             `json:"new_value"`
+	VerificationCode string             `json:"verification_code"`
+	CreatedAt        pgtype.Timestamptz `json:"created_at"`
+	UpdatedAt        pgtype.Timestamptz `json:"updated_at"`
+	ExpiresAt        pgtype.Timestamptz `json:"expires_at"`
 }
 
 type AuthPermission struct {
-	ID       string `json:"id"`
-	Name     string `json:"name"`
-	Resource string `json:"resource"`
-	Action   string `json:"action"`
+	ID        string             `json:"id"`
+	Name      string             `json:"name"`
+	Resource  string             `json:"resource"`
+	Action    string             `json:"action"`
+	CreatedAt pgtype.Timestamptz `json:"created_at"`
+	UpdatedAt pgtype.Timestamptz `json:"updated_at"`
 }
 
 type AuthRole struct {
-	ID   string `json:"id"`
-	Name string `json:"name"`
+	ID        string             `json:"id"`
+	Name      string             `json:"name"`
+	DeletedAt pgtype.Timestamptz `json:"deleted_at"`
+	CreatedAt pgtype.Timestamptz `json:"created_at"`
+	UpdatedAt pgtype.Timestamptz `json:"updated_at"`
 }
 
 type AuthRolePermission struct {
-	RoleID       string `json:"role_id"`
-	PermissionID string `json:"permission_id"`
+	RoleID       string             `json:"role_id"`
+	PermissionID string             `json:"permission_id"`
+	CreatedAt    pgtype.Timestamptz `json:"created_at"`
+	UpdatedAt    pgtype.Timestamptz `json:"updated_at"`
 }
 
 type AuthSession struct {
-	ID               string         `json:"id"`
-	UserID           string         `json:"user_id"`
-	RefreshTokenHash string         `json:"refresh_token_hash"`
-	UserAgent        sql.NullString `json:"user_agent"`
-	IpAddress        sql.NullString `json:"ip_address"`
-	CreatedAt        time.Time      `json:"created_at"`
-	LastActiveAt     time.Time      `json:"last_active_at"`
-	ExpiresAt        time.Time      `json:"expires_at"`
-	RevokedAt        sql.NullTime   `json:"revoked_at"`
+	ID               string             `json:"id"`
+	UserID           string             `json:"user_id"`
+	RefreshTokenHash string             `json:"refresh_token_hash"`
+	UserAgent        pgtype.Text        `json:"user_agent"`
+	IpAddress        pgtype.Text        `json:"ip_address"`
+	CreatedAt        pgtype.Timestamptz `json:"created_at"`
+	UpdatedAt        pgtype.Timestamptz `json:"updated_at"`
+	LastActiveAt     pgtype.Timestamptz `json:"last_active_at"`
+	ExpiresAt        pgtype.Timestamptz `json:"expires_at"`
+	RevokedAt        pgtype.Timestamptz `json:"revoked_at"`
 }
 
 type AuthTokenBlacklist struct {
-	TokenHash string         `json:"token_hash"`
-	UserID    string         `json:"user_id"`
-	ExpiresAt time.Time      `json:"expires_at"`
-	RevokedAt time.Time      `json:"revoked_at"`
-	Reason    sql.NullString `json:"reason"`
+	TokenHash string             `json:"token_hash"`
+	UserID    string             `json:"user_id"`
+	ExpiresAt pgtype.Timestamptz `json:"expires_at"`
+	RevokedAt pgtype.Timestamptz `json:"revoked_at"`
+	UpdatedAt pgtype.Timestamptz `json:"updated_at"`
+	Reason    pgtype.Text        `json:"reason"`
 }
 
 type AuthUser struct {
-	ID          string         `json:"id"`
-	Email       sql.NullString `json:"email"`
-	Phone       sql.NullString `json:"phone"`
-	CreatedAt   time.Time      `json:"created_at"`
-	UpdatedAt   time.Time      `json:"updated_at"`
-	DisplayName sql.NullString `json:"display_name"`
-	AvatarUrl   sql.NullString `json:"avatar_url"`
+	ID            string             `json:"id"`
+	Email         pgtype.Text        `json:"email"`
+	Phone         pgtype.Text        `json:"phone"`
+	DisplayName   pgtype.Text        `json:"display_name"`
+	AvatarUrl     pgtype.Text        `json:"avatar_url"`
+	Status        string             `json:"status"`
+	EmailVerified bool               `json:"email_verified"`
+	PhoneVerified bool               `json:"phone_verified"`
+	Timezone      pgtype.Text        `json:"timezone"`
+	CreatedAt     pgtype.Timestamptz `json:"created_at"`
+	UpdatedAt     pgtype.Timestamptz `json:"updated_at"`
 }
 
 type AuthUserExternalAccount struct {
-	ID             string                `json:"id"`
-	UserID         string                `json:"user_id"`
-	Provider       string                `json:"provider"`
-	ProviderUserID string                `json:"provider_user_id"`
-	Email          sql.NullString        `json:"email"`
-	Name           sql.NullString        `json:"name"`
-	AvatarUrl      sql.NullString        `json:"avatar_url"`
-	AccessToken    sql.NullString        `json:"access_token"`
-	RefreshToken   sql.NullString        `json:"refresh_token"`
-	TokenExpiresAt sql.NullTime          `json:"token_expires_at"`
-	RawData        pqtype.NullRawMessage `json:"raw_data"`
-	CreatedAt      time.Time             `json:"created_at"`
-	UpdatedAt      time.Time             `json:"updated_at"`
+	ID             string             `json:"id"`
+	UserID         string             `json:"user_id"`
+	Provider       string             `json:"provider"`
+	ProviderUserID string             `json:"provider_user_id"`
+	Email          pgtype.Text        `json:"email"`
+	Name           pgtype.Text        `json:"name"`
+	AvatarUrl      pgtype.Text        `json:"avatar_url"`
+	AccessToken    pgtype.Text        `json:"access_token"`
+	RefreshToken   pgtype.Text        `json:"refresh_token"`
+	TokenExpiresAt pgtype.Timestamptz `json:"token_expires_at"`
+	RawData        []byte             `json:"raw_data"`
+	CreatedAt      pgtype.Timestamptz `json:"created_at"`
+	UpdatedAt      pgtype.Timestamptz `json:"updated_at"`
 }
 
 type AuthUserRole struct {
-	UserID string `json:"user_id"`
-	RoleID string `json:"role_id"`
+	UserID    string             `json:"user_id"`
+	RoleID    string             `json:"role_id"`
+	CreatedAt pgtype.Timestamptz `json:"created_at"`
+	UpdatedAt pgtype.Timestamptz `json:"updated_at"`
 }
diff --git a/modules/auth/internal/db/store/querier.go b/modules/auth/internal/db/store/querier.go
index a60cb37..2c9d5a1 100644
--- a/modules/auth/internal/db/store/querier.go
+++ b/modules/auth/internal/db/store/querier.go
@@ -6,10 +6,12 @@ package store
 
 import (
 	"context"
-	"database/sql"
+
+	"github.com/jackc/pgx/v5/pgtype"
 )
 
 type Querier interface {
+	AssignUserRole(ctx context.Context, arg AssignUserRoleParams) error
 	// ========================
 	// Token Blacklist
 	// ========================
@@ -46,8 +48,8 @@ type Querier interface {
 	DeleteExpiredPendingContactChanges(ctx context.Context) error
 	DeleteExternalAccount(ctx context.Context, arg DeleteExternalAccountParams) error
 	DeleteExternalAccountByProvider(ctx context.Context, arg DeleteExternalAccountByProviderParams) error
-	DeleteMagicCodesByEmail(ctx context.Context, userEmail sql.NullString) error
-	DeleteMagicCodesByPhone(ctx context.Context, userPhone sql.NullString) error
+	DeleteMagicCodesByEmail(ctx context.Context, userEmail pgtype.Text) error
+	DeleteMagicCodesByPhone(ctx context.Context, userPhone pgtype.Text) error
 	DeleteOAuthState(ctx context.Context, state string) error
 	DeletePendingContactChange(ctx context.Context, id string) error
 	GetExternalAccountByProviderAndEmail(ctx context.Context, arg GetExternalAccountByProviderAndEmailParams) (AuthUserExternalAccount, error)
@@ -58,14 +60,24 @@ type Querier interface {
 	GetSessionByID(ctx context.Context, id string) (AuthSession, error)
 	GetSessionByRefreshTokenHash(ctx context.Context, refreshTokenHash string) (AuthSession, error)
 	GetSessionsByUserID(ctx context.Context, userID string) ([]AuthSession, error)
-	GetUserByEmail(ctx context.Context, email sql.NullString) (AuthUser, error)
+	GetUnpublishedOutbox(ctx context.Context, limit int32) ([]AuthOutbox, error)
+	GetUserByEmail(ctx context.Context, email pgtype.Text) (AuthUser, error)
 	GetUserByID(ctx context.Context, id string) (AuthUser, error)
-	GetUserByPhone(ctx context.Context, phone sql.NullString) (AuthUser, error)
+	GetUserByPhone(ctx context.Context, phone pgtype.Text) (AuthUser, error)
+	GetUserRole(ctx context.Context, userID string) (string, error)
 	GetValidMagicCodeByEmail(ctx context.Context, arg GetValidMagicCodeByEmailParams) (AuthMagicCode, error)
 	GetValidMagicCodeByPhone(ctx context.Context, arg GetValidMagicCodeByPhoneParams) (AuthMagicCode, error)
 	IsTokenBlacklisted(ctx context.Context, tokenHash string) (bool, error)
+	MarkEmailVerified(ctx context.Context, id string) error
+	MarkOutboxAsPublished(ctx context.Context, dollar_1 []string) error
+	MarkPhoneVerified(ctx context.Context, id string) error
+	RemoveUserRoles(ctx context.Context, userID string) error
 	RevokeAllUserSessions(ctx context.Context, arg RevokeAllUserSessionsParams) (int64, error)
 	RevokeSession(ctx context.Context, id string) error
+	// ========================
+	// Outbox
+	// ========================
+	StoreOutbox(ctx context.Context, arg StoreOutboxParams) error
 	UpdateExternalAccountProfile(ctx context.Context, arg UpdateExternalAccountProfileParams) error
 	UpdateExternalAccountTokens(ctx context.Context, arg UpdateExternalAccountTokensParams) error
 	UpdateSessionActivity(ctx context.Context, id string) error
diff --git a/modules/auth/internal/repository/mocks/repository_mock.go b/modules/auth/internal/repository/mocks/repository_mock.go
index 49dd055..cf77dcc 100644
--- a/modules/auth/internal/repository/mocks/repository_mock.go
+++ b/modules/auth/internal/repository/mocks/repository_mock.go
@@ -43,6 +43,20 @@ func (m *MockRepository) EXPECT() *MockRepositoryMockRecorder {
 	return m.recorder
 }
 
+// AssignRole mocks base method.
+func (m *MockRepository) AssignRole(ctx context.Context, userID, roleName string) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "AssignRole", ctx, userID, roleName)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// AssignRole indicates an expected call of AssignRole.
+func (mr *MockRepositoryMockRecorder) AssignRole(ctx, userID, roleName any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "AssignRole", reflect.TypeOf((*MockRepository)(nil).AssignRole), ctx, userID, roleName)
+}
+
 // BlacklistToken mocks base method.
 func (m *MockRepository) BlacklistToken(ctx context.Context, tokenHash, userID, reason string, expiresAt time.Time) error {
 	m.ctrl.T.Helper()
@@ -435,6 +449,21 @@ func (mr *MockRepositoryMockRecorder) GetUserByPhone(ctx, phone any) *gomock.Cal
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetUserByPhone", reflect.TypeOf((*MockRepository)(nil).GetUserByPhone), ctx, phone)
 }
 
+// GetUserRole mocks base method.
+func (m *MockRepository) GetUserRole(ctx context.Context, id string) (string, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetUserRole", ctx, id)
+	ret0, _ := ret[0].(string)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetUserRole indicates an expected call of GetUserRole.
+func (mr *MockRepositoryMockRecorder) GetUserRole(ctx, id any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetUserRole", reflect.TypeOf((*MockRepository)(nil).GetUserRole), ctx, id)
+}
+
 // GetValidMagicCodeByEmail mocks base method.
 func (m *MockRepository) GetValidMagicCodeByEmail(ctx context.Context, email, code string) (*store.AuthMagicCode, error) {
 	m.ctrl.T.Helper()
@@ -494,6 +523,48 @@ func (mr *MockRepositoryMockRecorder) IsTokenBlacklisted(ctx, tokenHash any) *go
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "IsTokenBlacklisted", reflect.TypeOf((*MockRepository)(nil).IsTokenBlacklisted), ctx, tokenHash)
 }
 
+// MarkEmailVerified mocks base method.
+func (m *MockRepository) MarkEmailVerified(ctx context.Context, userID string) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "MarkEmailVerified", ctx, userID)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// MarkEmailVerified indicates an expected call of MarkEmailVerified.
+func (mr *MockRepositoryMockRecorder) MarkEmailVerified(ctx, userID any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "MarkEmailVerified", reflect.TypeOf((*MockRepository)(nil).MarkEmailVerified), ctx, userID)
+}
+
+// MarkPhoneVerified mocks base method.
+func (m *MockRepository) MarkPhoneVerified(ctx context.Context, userID string) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "MarkPhoneVerified", ctx, userID)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// MarkPhoneVerified indicates an expected call of MarkPhoneVerified.
+func (mr *MockRepositoryMockRecorder) MarkPhoneVerified(ctx, userID any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "MarkPhoneVerified", reflect.TypeOf((*MockRepository)(nil).MarkPhoneVerified), ctx, userID)
+}
+
+// RemoveUserRoles mocks base method.
+func (m *MockRepository) RemoveUserRoles(ctx context.Context, userID string) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "RemoveUserRoles", ctx, userID)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// RemoveUserRoles indicates an expected call of RemoveUserRoles.
+func (mr *MockRepositoryMockRecorder) RemoveUserRoles(ctx, userID any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RemoveUserRoles", reflect.TypeOf((*MockRepository)(nil).RemoveUserRoles), ctx, userID)
+}
+
 // RevokeAllUserSessions mocks base method.
 func (m *MockRepository) RevokeAllUserSessions(ctx context.Context, userID, exceptSessionID string) (int, error) {
 	m.ctrl.T.Helper()
@@ -523,6 +594,20 @@ func (mr *MockRepositoryMockRecorder) RevokeSession(ctx, id any) *gomock.Call {
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RevokeSession", reflect.TypeOf((*MockRepository)(nil).RevokeSession), ctx, id)
 }
 
+// StoreOutbox mocks base method.
+func (m *MockRepository) StoreOutbox(ctx context.Context, eventName string, payload any) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "StoreOutbox", ctx, eventName, payload)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// StoreOutbox indicates an expected call of StoreOutbox.
+func (mr *MockRepositoryMockRecorder) StoreOutbox(ctx, eventName, payload any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "StoreOutbox", reflect.TypeOf((*MockRepository)(nil).StoreOutbox), ctx, eventName, payload)
+}
+
 // UpdateExternalAccountProfile mocks base method.
 func (m *MockRepository) UpdateExternalAccountProfile(ctx context.Context, provider, providerUserID, name, avatarURL, email string, rawData map[string]any) error {
 	m.ctrl.T.Helper()
@@ -566,17 +651,17 @@ func (mr *MockRepositoryMockRecorder) UpdateSessionActivity(ctx, id any) *gomock
 }
 
 // UpdateUserProfile mocks base method.
-func (m *MockRepository) UpdateUserProfile(ctx context.Context, id, displayName, avatarURL string) error {
+func (m *MockRepository) UpdateUserProfile(ctx context.Context, id, displayName, avatarURL, timezone string) error {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "UpdateUserProfile", ctx, id, displayName, avatarURL)
+	ret := m.ctrl.Call(m, "UpdateUserProfile", ctx, id, displayName, avatarURL, timezone)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // UpdateUserProfile indicates an expected call of UpdateUserProfile.
-func (mr *MockRepositoryMockRecorder) UpdateUserProfile(ctx, id, displayName, avatarURL any) *gomock.Call {
+func (mr *MockRepositoryMockRecorder) UpdateUserProfile(ctx, id, displayName, avatarURL, timezone any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateUserProfile", reflect.TypeOf((*MockRepository)(nil).UpdateUserProfile), ctx, id, displayName, avatarURL)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateUserProfile", reflect.TypeOf((*MockRepository)(nil).UpdateUserProfile), ctx, id, displayName, avatarURL, timezone)
 }
 
 // WithTx mocks base method.
diff --git a/modules/auth/internal/repository/repository.go b/modules/auth/internal/repository/repository.go
index 3f75ab7..5df04c0 100644
--- a/modules/auth/internal/repository/repository.go
+++ b/modules/auth/internal/repository/repository.go
@@ -5,13 +5,17 @@ package repository
 
 import (
 	"context"
-	"database/sql"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"time"
 
+	"github.com/cmelgarejo/go-modulith-template/internal/outbox"
+	"github.com/cmelgarejo/go-modulith-template/internal/telemetry"
 	"github.com/cmelgarejo/go-modulith-template/modules/auth/internal/db/store"
-	"github.com/sqlc-dev/pqtype"
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgtype"
+	"github.com/jackc/pgx/v5/pgxpool"
 )
 
 // Repository defines the data access methods for the authentication module.
@@ -24,7 +28,10 @@ type Repository interface {
 	GetUserByID(ctx context.Context, id string) (*store.AuthUser, error)
 	GetUserByEmail(ctx context.Context, email string) (*store.AuthUser, error)
 	GetUserByPhone(ctx context.Context, phone string) (*store.AuthUser, error)
-	UpdateUserProfile(ctx context.Context, id, displayName, avatarURL string) error
+	GetUserRole(ctx context.Context, id string) (string, error)
+	AssignRole(ctx context.Context, userID, roleName string) error
+	RemoveUserRoles(ctx context.Context, userID string) error
+	UpdateUserProfile(ctx context.Context, id, displayName, avatarURL, timezone string) error
 
 	// Magic code (passwordless auth)
 	CreateMagicCode(ctx context.Context, code, email, phone string, expiresAt time.Time) error
@@ -69,6 +76,13 @@ type Repository interface {
 	GetOAuthState(ctx context.Context, state string) (*OAuthState, error)
 	DeleteOAuthState(ctx context.Context, state string) error
 	CleanupExpiredOAuthStates(ctx context.Context) error
+
+	// StoreOutbox stores an event in the outbox table within the current transaction.
+	StoreOutbox(ctx context.Context, eventName string, payload any) error
+
+	// Verification
+	MarkEmailVerified(ctx context.Context, userID string) error
+	MarkPhoneVerified(ctx context.Context, userID string) error
 }
 
 // Session represents a user session in the database.
@@ -104,7 +118,9 @@ type ExternalAccount struct {
 	Email          string
 	Name           string
 	AvatarURL      string
-	AccessToken    string // Encrypted
+	//nolint:gosec
+	AccessToken string // Encrypted
+	//nolint:gosec
 	RefreshToken   string // Encrypted
 	TokenExpiresAt *time.Time
 	RawData        map[string]interface{}
@@ -123,14 +139,14 @@ type OAuthState struct {
 	ExpiresAt   time.Time
 }
 
-// SQLRepository implements the Repository interface using a SQL database.
+// SQLRepository implements the Repository interface using pgx.
 type SQLRepository struct {
 	q  *store.Queries
-	db *sql.DB
+	db *pgxpool.Pool
 }
 
 // NewSQLRepository creates a new instance of SQLRepository.
-func NewSQLRepository(db *sql.DB) *SQLRepository {
+func NewSQLRepository(db *pgxpool.Pool) *SQLRepository {
 	return &SQLRepository{
 		q:  store.New(db),
 		db: db,
@@ -139,26 +155,15 @@ func NewSQLRepository(db *sql.DB) *SQLRepository {
 
 // WithTx executes the given function within a database transaction.
 func (r *SQLRepository) WithTx(ctx context.Context, fn func(Repository) error) error {
-	tx, err := r.db.BeginTx(ctx, nil)
-	if err != nil {
-		return fmt.Errorf("failed to begin transaction: %w", err)
-	}
-
-	defer func() {
-		_ = tx.Rollback()
-	}()
-
-	txRepo := &SQLRepository{
-		q:  r.q.WithTx(tx),
-		db: r.db,
-	}
-
-	if err := fn(txRepo); err != nil {
-		return err
-	}
+	if err := pgx.BeginFunc(ctx, r.db, func(tx pgx.Tx) error {
+		txRepo := &SQLRepository{
+			q:  r.q.WithTx(tx),
+			db: r.db,
+		}
 
-	if err := tx.Commit(); err != nil {
-		return fmt.Errorf("failed to commit transaction: %w", err)
+		return fn(txRepo)
+	}); err != nil {
+		return fmt.Errorf("transaction failed: %w", err)
 	}
 
 	return nil
@@ -166,10 +171,13 @@ func (r *SQLRepository) WithTx(ctx context.Context, fn func(Repository) error) e
 
 // CreateUser persists a new user record in the database.
 func (r *SQLRepository) CreateUser(ctx context.Context, id, email, phone string) error {
+	ctx, span := telemetry.RepositorySpan(ctx, "auth", "CreateUser", "user")
+	defer span.End()
+
 	if err := r.q.CreateUser(ctx, store.CreateUserParams{
 		ID:    id,
-		Email: sql.NullString{String: email, Valid: email != ""},
-		Phone: sql.NullString{String: phone, Valid: phone != ""},
+		Email: pgtype.Text{String: email, Valid: email != ""},
+		Phone: pgtype.Text{String: phone, Valid: phone != ""},
 	}); err != nil {
 		return fmt.Errorf("failed to create user: %w", err)
 	}
@@ -179,7 +187,10 @@ func (r *SQLRepository) CreateUser(ctx context.Context, id, email, phone string)
 
 // GetUserByEmail retrieves a user record by their email address.
 func (r *SQLRepository) GetUserByEmail(ctx context.Context, email string) (*store.AuthUser, error) {
-	u, err := r.q.GetUserByEmail(ctx, sql.NullString{String: email, Valid: true})
+	ctx, span := telemetry.RepositorySpan(ctx, "auth", "GetUserByEmail", "user")
+	defer span.End()
+
+	u, err := r.q.GetUserByEmail(ctx, pgtype.Text{String: email, Valid: true})
 	if err != nil {
 		return nil, fmt.Errorf("failed to get user by email: %w", err)
 	}
@@ -189,7 +200,10 @@ func (r *SQLRepository) GetUserByEmail(ctx context.Context, email string) (*stor
 
 // GetUserByPhone retrieves a user record by their phone number.
 func (r *SQLRepository) GetUserByPhone(ctx context.Context, phone string) (*store.AuthUser, error) {
-	u, err := r.q.GetUserByPhone(ctx, sql.NullString{String: phone, Valid: true})
+	ctx, span := telemetry.RepositorySpan(ctx, "auth", "GetUserByPhone", "user")
+	defer span.End()
+
+	u, err := r.q.GetUserByPhone(ctx, pgtype.Text{String: phone, Valid: true})
 	if err != nil {
 		return nil, fmt.Errorf("failed to get user by phone: %w", err)
 	}
@@ -199,11 +213,14 @@ func (r *SQLRepository) GetUserByPhone(ctx context.Context, phone string) (*stor
 
 // CreateMagicCode persists a new magic code for a user.
 func (r *SQLRepository) CreateMagicCode(ctx context.Context, code, email, phone string, expiresAt time.Time) error {
+	ctx, span := telemetry.RepositorySpan(ctx, "auth", "CreateMagicCode", "magic_code")
+	defer span.End()
+
 	if err := r.q.CreateMagicCode(ctx, store.CreateMagicCodeParams{
 		Code:      code,
-		UserEmail: sql.NullString{String: email, Valid: email != ""},
-		UserPhone: sql.NullString{String: phone, Valid: phone != ""},
-		ExpiresAt: expiresAt,
+		UserEmail: pgtype.Text{String: email, Valid: email != ""},
+		UserPhone: pgtype.Text{String: phone, Valid: phone != ""},
+		ExpiresAt: pgtype.Timestamptz{Time: expiresAt, Valid: true},
 	}); err != nil {
 		return fmt.Errorf("failed to create magic code: %w", err)
 	}
@@ -213,10 +230,13 @@ func (r *SQLRepository) CreateMagicCode(ctx context.Context, code, email, phone
 
 // GetValidMagicCodeByEmail retrieves a valid magic code by user email and code value.
 func (r *SQLRepository) GetValidMagicCodeByEmail(ctx context.Context, email, code string) (*store.AuthMagicCode, error) {
+	ctx, span := telemetry.RepositorySpan(ctx, "auth", "GetValidMagicCodeByEmail", "magic_code")
+	defer span.End()
+
 	mc, err := r.q.GetValidMagicCodeByEmail(ctx, store.GetValidMagicCodeByEmailParams{
-		UserEmail: sql.NullString{String: email, Valid: true},
+		UserEmail: pgtype.Text{String: email, Valid: true},
 		Code:      code,
-		ExpiresAt: time.Now(),
+		ExpiresAt: pgtype.Timestamptz{Time: time.Now(), Valid: true},
 	})
 	if err != nil {
 		return nil, fmt.Errorf("failed to get valid magic code by email: %w", err)
@@ -227,10 +247,13 @@ func (r *SQLRepository) GetValidMagicCodeByEmail(ctx context.Context, email, cod
 
 // GetValidMagicCodeByPhone retrieves a valid magic code by user phone and code value.
 func (r *SQLRepository) GetValidMagicCodeByPhone(ctx context.Context, phone, code string) (*store.AuthMagicCode, error) {
+	ctx, span := telemetry.RepositorySpan(ctx, "auth", "GetValidMagicCodeByPhone", "magic_code")
+	defer span.End()
+
 	mc, err := r.q.GetValidMagicCodeByPhone(ctx, store.GetValidMagicCodeByPhoneParams{
-		UserPhone: sql.NullString{String: phone, Valid: true},
+		UserPhone: pgtype.Text{String: phone, Valid: true},
 		Code:      code,
-		ExpiresAt: time.Now(),
+		ExpiresAt: pgtype.Timestamptz{Time: time.Now(), Valid: true},
 	})
 	if err != nil {
 		return nil, fmt.Errorf("failed to get valid magic code by phone: %w", err)
@@ -242,7 +265,7 @@ func (r *SQLRepository) GetValidMagicCodeByPhone(ctx context.Context, phone, cod
 // InvalidateMagicCodes deletes all magic codes associated with a user.
 func (r *SQLRepository) InvalidateMagicCodes(ctx context.Context, email, phone string) error {
 	if email != "" {
-		if err := r.q.DeleteMagicCodesByEmail(ctx, sql.NullString{String: email, Valid: true}); err != nil {
+		if err := r.q.DeleteMagicCodesByEmail(ctx, pgtype.Text{String: email, Valid: true}); err != nil {
 			return fmt.Errorf("failed to delete magic codes by email: %w", err)
 		}
 
@@ -250,7 +273,7 @@ func (r *SQLRepository) InvalidateMagicCodes(ctx context.Context, email, phone s
 	}
 
 	if phone != "" {
-		if err := r.q.DeleteMagicCodesByPhone(ctx, sql.NullString{String: phone, Valid: true}); err != nil {
+		if err := r.q.DeleteMagicCodesByPhone(ctx, pgtype.Text{String: phone, Valid: true}); err != nil {
 			return fmt.Errorf("failed to delete magic codes by phone: %w", err)
 		}
 
@@ -270,12 +293,48 @@ func (r *SQLRepository) GetUserByID(ctx context.Context, id string) (*store.Auth
 	return &u, nil
 }
 
-// UpdateUserProfile updates a user's display name and avatar URL.
-func (r *SQLRepository) UpdateUserProfile(ctx context.Context, id, displayName, avatarURL string) error {
+// GetUserRole retrieves the role name for a user.
+func (r *SQLRepository) GetUserRole(ctx context.Context, userID string) (string, error) {
+	role, err := r.q.GetUserRole(ctx, userID)
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return "user", nil
+		}
+
+		return "", fmt.Errorf("failed to get user role: %w", err)
+	}
+
+	return role, nil
+}
+
+// AssignRole assigns a role to a user.
+func (r *SQLRepository) AssignRole(ctx context.Context, userID, roleName string) error {
+	if err := r.q.AssignUserRole(ctx, store.AssignUserRoleParams{
+		UserID:   userID,
+		RoleName: roleName,
+	}); err != nil {
+		return fmt.Errorf("failed to assign role: %w", err)
+	}
+
+	return nil
+}
+
+// RemoveUserRoles removes all roles from a user.
+func (r *SQLRepository) RemoveUserRoles(ctx context.Context, userID string) error {
+	if err := r.q.RemoveUserRoles(ctx, userID); err != nil {
+		return fmt.Errorf("failed to remove user roles: %w", err)
+	}
+
+	return nil
+}
+
+// UpdateUserProfile updates a user's display name, avatar URL, and timezone.
+func (r *SQLRepository) UpdateUserProfile(ctx context.Context, id, displayName, avatarURL, timezone string) error {
 	if err := r.q.UpdateUserProfile(ctx, store.UpdateUserProfileParams{
 		ID:          id,
-		DisplayName: sql.NullString{String: displayName, Valid: displayName != ""},
-		AvatarUrl:   sql.NullString{String: avatarURL, Valid: avatarURL != ""},
+		DisplayName: pgtype.Text{String: displayName, Valid: displayName != ""},
+		AvatarUrl:   pgtype.Text{String: avatarURL, Valid: avatarURL != ""},
+		Timezone:    pgtype.Text{String: timezone, Valid: timezone != ""},
 	}); err != nil {
 		return fmt.Errorf("failed to update user profile: %w", err)
 	}
@@ -285,13 +344,16 @@ func (r *SQLRepository) UpdateUserProfile(ctx context.Context, id, displayName,
 
 // CreateSession creates a new user session.
 func (r *SQLRepository) CreateSession(ctx context.Context, session *Session) error {
+	ctx, span := telemetry.RepositorySpan(ctx, "auth", "CreateSession", "session")
+	defer span.End()
+
 	if err := r.q.CreateSession(ctx, store.CreateSessionParams{
 		ID:               session.ID,
 		UserID:           session.UserID,
 		RefreshTokenHash: session.RefreshTokenHash,
-		UserAgent:        sql.NullString{String: session.UserAgent, Valid: session.UserAgent != ""},
-		IpAddress:        sql.NullString{String: session.IPAddress, Valid: session.IPAddress != ""},
-		ExpiresAt:        session.ExpiresAt,
+		UserAgent:        pgtype.Text{String: session.UserAgent, Valid: session.UserAgent != ""},
+		IpAddress:        pgtype.Text{String: session.IPAddress, Valid: session.IPAddress != ""},
+		ExpiresAt:        pgtype.Timestamptz{Time: session.ExpiresAt, Valid: true},
 	}); err != nil {
 		return fmt.Errorf("failed to create session: %w", err)
 	}
@@ -370,8 +432,8 @@ func (r *SQLRepository) BlacklistToken(ctx context.Context, tokenHash, userID, r
 	if err := r.q.BlacklistToken(ctx, store.BlacklistTokenParams{
 		TokenHash: tokenHash,
 		UserID:    userID,
-		ExpiresAt: expiresAt,
-		Reason:    sql.NullString{String: reason, Valid: reason != ""},
+		ExpiresAt: pgtype.Timestamptz{Time: expiresAt, Valid: true},
+		Reason:    pgtype.Text{String: reason, Valid: reason != ""},
 	}); err != nil {
 		return fmt.Errorf("failed to blacklist token: %w", err)
 	}
@@ -406,7 +468,7 @@ func (r *SQLRepository) CreatePendingContactChange(ctx context.Context, id, user
 		ChangeType:       changeType,
 		NewValue:         newValue,
 		VerificationCode: code,
-		ExpiresAt:        expiresAt,
+		ExpiresAt:        pgtype.Timestamptz{Time: expiresAt, Valid: true},
 	}); err != nil {
 		return fmt.Errorf("failed to create pending contact change: %w", err)
 	}
@@ -431,8 +493,8 @@ func (r *SQLRepository) GetPendingContactChange(ctx context.Context, userID, cha
 		ChangeType:       pcc.ChangeType,
 		NewValue:         pcc.NewValue,
 		VerificationCode: pcc.VerificationCode,
-		CreatedAt:        pcc.CreatedAt,
-		ExpiresAt:        pcc.ExpiresAt,
+		CreatedAt:        pcc.CreatedAt.Time,
+		ExpiresAt:        pcc.ExpiresAt.Time,
 	}, nil
 }
 
@@ -451,9 +513,9 @@ func storeSessionToModel(s *store.AuthSession) *Session {
 		ID:               s.ID,
 		UserID:           s.UserID,
 		RefreshTokenHash: s.RefreshTokenHash,
-		CreatedAt:        s.CreatedAt,
-		LastActiveAt:     s.LastActiveAt,
-		ExpiresAt:        s.ExpiresAt,
+		CreatedAt:        s.CreatedAt.Time,
+		LastActiveAt:     s.LastActiveAt.Time,
+		ExpiresAt:        s.ExpiresAt.Time,
 	}
 
 	if s.UserAgent.Valid {
@@ -477,7 +539,7 @@ func storeSessionToModel(s *store.AuthSession) *Session {
 
 // CreateExternalAccount creates a new external OAuth account link.
 func (r *SQLRepository) CreateExternalAccount(ctx context.Context, account *ExternalAccount) error {
-	var rawData pqtype.NullRawMessage
+	var rawData []byte
 
 	if account.RawData != nil {
 		data, err := json.Marshal(account.RawData)
@@ -485,12 +547,12 @@ func (r *SQLRepository) CreateExternalAccount(ctx context.Context, account *Exte
 			return fmt.Errorf("failed to marshal raw data: %w", err)
 		}
 
-		rawData = pqtype.NullRawMessage{RawMessage: data, Valid: true}
+		rawData = data
 	}
 
-	var tokenExpiresAt sql.NullTime
+	var tokenExpiresAt pgtype.Timestamptz
 	if account.TokenExpiresAt != nil {
-		tokenExpiresAt = sql.NullTime{Time: *account.TokenExpiresAt, Valid: true}
+		tokenExpiresAt = pgtype.Timestamptz{Time: *account.TokenExpiresAt, Valid: true}
 	}
 
 	if err := r.q.CreateExternalAccount(ctx, store.CreateExternalAccountParams{
@@ -498,11 +560,11 @@ func (r *SQLRepository) CreateExternalAccount(ctx context.Context, account *Exte
 		UserID:         account.UserID,
 		Provider:       account.Provider,
 		ProviderUserID: account.ProviderUserID,
-		Email:          sql.NullString{String: account.Email, Valid: account.Email != ""},
-		Name:           sql.NullString{String: account.Name, Valid: account.Name != ""},
-		AvatarUrl:      sql.NullString{String: account.AvatarURL, Valid: account.AvatarURL != ""},
-		AccessToken:    sql.NullString{String: account.AccessToken, Valid: account.AccessToken != ""},
-		RefreshToken:   sql.NullString{String: account.RefreshToken, Valid: account.RefreshToken != ""},
+		Email:          pgtype.Text{String: account.Email, Valid: account.Email != ""},
+		Name:           pgtype.Text{String: account.Name, Valid: account.Name != ""},
+		AvatarUrl:      pgtype.Text{String: account.AvatarURL, Valid: account.AvatarURL != ""},
+		AccessToken:    pgtype.Text{String: account.AccessToken, Valid: account.AccessToken != ""},
+		RefreshToken:   pgtype.Text{String: account.RefreshToken, Valid: account.RefreshToken != ""},
 		TokenExpiresAt: tokenExpiresAt,
 		RawData:        rawData,
 	}); err != nil {
@@ -550,7 +612,7 @@ func (r *SQLRepository) GetExternalAccountsByUserID(ctx context.Context, userID
 func (r *SQLRepository) GetExternalAccountByProviderAndEmail(ctx context.Context, provider, email string) (*ExternalAccount, error) {
 	ea, err := r.q.GetExternalAccountByProviderAndEmail(ctx, store.GetExternalAccountByProviderAndEmailParams{
 		Provider: provider,
-		Email:    sql.NullString{String: email, Valid: true},
+		Email:    pgtype.Text{String: email, Valid: true},
 	})
 	if err != nil {
 		return nil, fmt.Errorf("failed to get external account by email: %w", err)
@@ -561,16 +623,16 @@ func (r *SQLRepository) GetExternalAccountByProviderAndEmail(ctx context.Context
 
 // UpdateExternalAccountTokens updates the OAuth tokens for an external account.
 func (r *SQLRepository) UpdateExternalAccountTokens(ctx context.Context, provider, providerUserID, accessToken, refreshToken string, expiresAt *time.Time) error {
-	var tokenExpiresAt sql.NullTime
+	var tokenExpiresAt pgtype.Timestamptz
 	if expiresAt != nil {
-		tokenExpiresAt = sql.NullTime{Time: *expiresAt, Valid: true}
+		tokenExpiresAt = pgtype.Timestamptz{Time: *expiresAt, Valid: true}
 	}
 
 	if err := r.q.UpdateExternalAccountTokens(ctx, store.UpdateExternalAccountTokensParams{
 		Provider:       provider,
 		ProviderUserID: providerUserID,
-		AccessToken:    sql.NullString{String: accessToken, Valid: accessToken != ""},
-		RefreshToken:   sql.NullString{String: refreshToken, Valid: refreshToken != ""},
+		AccessToken:    pgtype.Text{String: accessToken, Valid: accessToken != ""},
+		RefreshToken:   pgtype.Text{String: refreshToken, Valid: refreshToken != ""},
 		TokenExpiresAt: tokenExpiresAt,
 	}); err != nil {
 		return fmt.Errorf("failed to update external account tokens: %w", err)
@@ -581,7 +643,7 @@ func (r *SQLRepository) UpdateExternalAccountTokens(ctx context.Context, provide
 
 // UpdateExternalAccountProfile updates the profile info for an external account.
 func (r *SQLRepository) UpdateExternalAccountProfile(ctx context.Context, provider, providerUserID, name, avatarURL, email string, rawData map[string]interface{}) error {
-	var rawDataNullable pqtype.NullRawMessage
+	var rawDataNullable []byte
 
 	if rawData != nil {
 		data, err := json.Marshal(rawData)
@@ -589,15 +651,15 @@ func (r *SQLRepository) UpdateExternalAccountProfile(ctx context.Context, provid
 			return fmt.Errorf("failed to marshal raw data: %w", err)
 		}
 
-		rawDataNullable = pqtype.NullRawMessage{RawMessage: data, Valid: true}
+		rawDataNullable = data
 	}
 
 	if err := r.q.UpdateExternalAccountProfile(ctx, store.UpdateExternalAccountProfileParams{
 		Provider:       provider,
 		ProviderUserID: providerUserID,
-		Name:           sql.NullString{String: name, Valid: name != ""},
-		AvatarUrl:      sql.NullString{String: avatarURL, Valid: avatarURL != ""},
-		Email:          sql.NullString{String: email, Valid: email != ""},
+		Name:           pgtype.Text{String: name, Valid: name != ""},
+		AvatarUrl:      pgtype.Text{String: avatarURL, Valid: avatarURL != ""},
+		Email:          pgtype.Text{String: email, Valid: email != ""},
 		RawData:        rawDataNullable,
 	}); err != nil {
 		return fmt.Errorf("failed to update external account profile: %w", err)
@@ -647,8 +709,8 @@ func storeExternalAccountToModel(ea *store.AuthUserExternalAccount) (*ExternalAc
 		UserID:         ea.UserID,
 		Provider:       ea.Provider,
 		ProviderUserID: ea.ProviderUserID,
-		CreatedAt:      ea.CreatedAt,
-		UpdatedAt:      ea.UpdatedAt,
+		CreatedAt:      ea.CreatedAt.Time,
+		UpdatedAt:      ea.UpdatedAt.Time,
 	}
 
 	if ea.Email.Valid {
@@ -675,8 +737,8 @@ func storeExternalAccountToModel(ea *store.AuthUserExternalAccount) (*ExternalAc
 		account.TokenExpiresAt = &ea.TokenExpiresAt.Time
 	}
 
-	if ea.RawData.Valid && len(ea.RawData.RawMessage) > 0 {
-		if err := json.Unmarshal(ea.RawData.RawMessage, &account.RawData); err != nil {
+	if len(ea.RawData) > 0 {
+		if err := json.Unmarshal(ea.RawData, &account.RawData); err != nil {
 			return nil, fmt.Errorf("failed to unmarshal raw data: %w", err)
 		}
 	}
@@ -688,15 +750,15 @@ func storeExternalAccountToModel(ea *store.AuthUserExternalAccount) (*ExternalAc
 // OAuth State Tokens
 // =====================
 
-// CreateOAuthState creates a new OAuth state token.
+// CreateOAuthState creates a new OAuth state authtoken.
 func (r *SQLRepository) CreateOAuthState(ctx context.Context, state *OAuthState) error {
 	if err := r.q.CreateOAuthState(ctx, store.CreateOAuthStateParams{
 		State:       state.State,
 		Provider:    state.Provider,
-		RedirectUrl: sql.NullString{String: state.RedirectURL, Valid: state.RedirectURL != ""},
-		UserID:      sql.NullString{String: state.UserID, Valid: state.UserID != ""},
+		RedirectUrl: pgtype.Text{String: state.RedirectURL, Valid: state.RedirectURL != ""},
+		UserID:      pgtype.Text{String: state.UserID, Valid: state.UserID != ""},
 		Action:      state.Action,
-		ExpiresAt:   state.ExpiresAt,
+		ExpiresAt:   pgtype.Timestamptz{Time: state.ExpiresAt, Valid: true},
 	}); err != nil {
 		return fmt.Errorf("failed to create oauth state: %w", err)
 	}
@@ -704,7 +766,7 @@ func (r *SQLRepository) CreateOAuthState(ctx context.Context, state *OAuthState)
 	return nil
 }
 
-// GetOAuthState retrieves an OAuth state token.
+// GetOAuthState retrieves an OAuth state authtoken.
 func (r *SQLRepository) GetOAuthState(ctx context.Context, state string) (*OAuthState, error) {
 	s, err := r.q.GetOAuthState(ctx, state)
 	if err != nil {
@@ -715,8 +777,8 @@ func (r *SQLRepository) GetOAuthState(ctx context.Context, state string) (*OAuth
 		State:     s.State,
 		Provider:  s.Provider,
 		Action:    s.Action,
-		CreatedAt: s.CreatedAt,
-		ExpiresAt: s.ExpiresAt,
+		CreatedAt: s.CreatedAt.Time,
+		ExpiresAt: s.ExpiresAt.Time,
 	}
 
 	if s.RedirectUrl.Valid {
@@ -730,7 +792,7 @@ func (r *SQLRepository) GetOAuthState(ctx context.Context, state string) (*OAuth
 	return result, nil
 }
 
-// DeleteOAuthState deletes an OAuth state token.
+// DeleteOAuthState deletes an OAuth state authtoken.
 func (r *SQLRepository) DeleteOAuthState(ctx context.Context, state string) error {
 	if err := r.q.DeleteOAuthState(ctx, state); err != nil {
 		return fmt.Errorf("failed to delete oauth state: %w", err)
@@ -748,34 +810,97 @@ func (r *SQLRepository) CleanupExpiredOAuthStates(ctx context.Context) error {
 	return nil
 }
 
+// MarkEmailVerified marks a user's email as verified.
+func (r *SQLRepository) MarkEmailVerified(ctx context.Context, userID string) error {
+	if err := r.q.MarkEmailVerified(ctx, userID); err != nil {
+		return fmt.Errorf("failed to mark email verified: %w", err)
+	}
+
+	return nil
+}
+
+// MarkPhoneVerified marks a user's phone as verified.
+func (r *SQLRepository) MarkPhoneVerified(ctx context.Context, userID string) error {
+	if err := r.q.MarkPhoneVerified(ctx, userID); err != nil {
+		return fmt.Errorf("failed to mark phone verified: %w", err)
+	}
+
+	return nil
+}
+
 // CleanupExpiredSessions removes expired sessions (older than 7 days past expiration).
 // Returns the number of sessions deleted.
 func (r *SQLRepository) CleanupExpiredSessions(ctx context.Context) (int, error) {
-	result, err := r.db.ExecContext(ctx, "DELETE FROM sessions WHERE expires_at < CURRENT_TIMESTAMP - INTERVAL '7 days'")
+	tag, err := r.db.Exec(ctx, "DELETE FROM sessions WHERE expires_at < CURRENT_TIMESTAMP - INTERVAL '7 days'")
 	if err != nil {
 		return 0, fmt.Errorf("failed to cleanup expired sessions: %w", err)
 	}
 
-	count, err := result.RowsAffected()
-	if err != nil {
-		return 0, fmt.Errorf("failed to get rows affected: %w", err)
-	}
-
-	return int(count), nil
+	return int(tag.RowsAffected()), nil
 }
 
 // CleanupExpiredMagicCodes removes expired magic codes.
 // Returns the number of magic codes deleted.
 func (r *SQLRepository) CleanupExpiredMagicCodes(ctx context.Context) (int, error) {
-	result, err := r.db.ExecContext(ctx, "DELETE FROM magic_codes WHERE expires_at < CURRENT_TIMESTAMP")
+	tag, err := r.db.Exec(ctx, "DELETE FROM magic_codes WHERE expires_at < CURRENT_TIMESTAMP")
 	if err != nil {
 		return 0, fmt.Errorf("failed to cleanup expired magic codes: %w", err)
 	}
 
-	count, err := result.RowsAffected()
+	return int(tag.RowsAffected()), nil
+}
+
+// StoreOutbox stores an event in the outbox table.
+func (r *SQLRepository) StoreOutbox(ctx context.Context, eventName string, payload any) error {
+	payloadBytes, err := json.Marshal(payload)
 	if err != nil {
-		return 0, fmt.Errorf("failed to get rows affected: %w", err)
+		return fmt.Errorf("failed to marshal payload: %w", err)
 	}
 
-	return int(count), nil
+	id := fmt.Sprintf("outbox_%d", time.Now().UnixNano())
+
+	if err := r.q.StoreOutbox(ctx, store.StoreOutboxParams{
+		ID:        id,
+		EventName: eventName,
+		Payload:   payloadBytes,
+	}); err != nil {
+		return fmt.Errorf("failed to store outbox entry: %w", err)
+	}
+
+	return nil
+}
+
+// GetUnpublished retrieves unpublished events from the outbox.
+func (r *SQLRepository) GetUnpublished(ctx context.Context, limit int) ([]outbox.Entry, error) {
+	rows, err := r.q.GetUnpublishedOutbox(ctx, int32(limit)) // #nosec G115
+	if err != nil {
+		return nil, fmt.Errorf("failed to get unpublished outbox entries: %w", err)
+	}
+
+	entries := make([]outbox.Entry, len(rows))
+	for i, row := range rows {
+		entries[i] = outbox.Entry{
+			ID:        row.ID,
+			EventName: row.EventName,
+			Payload:   row.Payload,
+			CreatedAt: row.CreatedAt.Time,
+		}
+		if row.PublishedAt.Valid {
+			entries[i].PublishedAt = &row.PublishedAt.Time
+		}
+	}
+
+	return entries, nil
 }
+
+// MarkPublished marks events as published in the outbox.
+func (r *SQLRepository) MarkPublished(ctx context.Context, ids []string) error {
+	if err := r.q.MarkOutboxAsPublished(ctx, ids); err != nil {
+		return fmt.Errorf("failed to mark outbox entries as published: %w", err)
+	}
+
+	return nil
+}
+
+// Ensure SQLRepository implements outbox.PublisherRepository
+var _ outbox.PublisherRepository = (*SQLRepository)(nil)
diff --git a/modules/auth/internal/repository/repository_integration_test.go b/modules/auth/internal/repository/repository_integration_test.go
index c03c8c2..054c27e 100644
--- a/modules/auth/internal/repository/repository_integration_test.go
+++ b/modules/auth/internal/repository/repository_integration_test.go
@@ -2,11 +2,8 @@ package repository_test
 
 import (
 	"context"
-	"database/sql"
 	"testing"
 
-	_ "github.com/jackc/pgx/v5/stdlib" // pgx driver
-
 	"github.com/cmelgarejo/go-modulith-template/internal/config"
 	"github.com/cmelgarejo/go-modulith-template/internal/events"
 	"github.com/cmelgarejo/go-modulith-template/internal/migration"
@@ -14,6 +11,7 @@ import (
 	"github.com/cmelgarejo/go-modulith-template/internal/testutil"
 	"github.com/cmelgarejo/go-modulith-template/modules/auth"
 	"github.com/cmelgarejo/go-modulith-template/modules/auth/internal/repository"
+	"github.com/jackc/pgx/v5/pgxpool"
 )
 
 func TestIntegration_SQLRepository_CreateUser(t *testing.T) {
@@ -36,13 +34,9 @@ func TestIntegration_SQLRepository_CreateUser(t *testing.T) {
 	}()
 
 	// Get database connection and setup schema
-	db, repo := setupTestDB(ctx, t, container, container.DSN)
+	pool, repo := setupTestDB(ctx, t, container, container.DSN)
 
-	defer func() {
-		if err := db.Close(); err != nil {
-			t.Errorf("Failed to close database: %v", err)
-		}
-	}()
+	defer pool.Close()
 
 	// Test CreateUser
 	testEmail := "test@example.com"
@@ -55,29 +49,160 @@ func TestIntegration_SQLRepository_CreateUser(t *testing.T) {
 	}
 
 	// Verify user was created
-	verifyUserCreated(ctx, t, db, testID, testEmail)
+	verifyUserCreated(ctx, t, pool, testID, testEmail)
+}
+
+func TestIntegration_SQLRepository_GetUserRole_Platform(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping integration test")
+	}
+
+	ctx := context.Background()
+
+	// Start testcontainer
+	container, err := testutil.NewPostgresContainer(ctx, t)
+	if err != nil {
+		t.Fatalf("Failed to create postgres container: %v", err)
+	}
+
+	defer func() {
+		if err := container.Close(ctx); err != nil {
+			t.Errorf("Failed to close container: %v", err)
+		}
+	}()
+
+	// Get database connection and setup schema
+	pool, repo := setupTestDB(ctx, t, container, container.DSN)
+
+	defer pool.Close()
+
+	// 1. Create User
+	userID := "user_role_test"
+	if err := repo.CreateUser(ctx, userID, "role_test@example.com", ""); err != nil {
+		t.Fatalf("Failed to create user: %v", err)
+	}
+
+	// 2. Create Role
+	roleID := "role_platform"
+	roleName := "platform"
+
+	_, err = pool.Exec(ctx, "INSERT INTO auth.roles (id, name) VALUES ($1, $2)", roleID, roleName)
+	if err != nil {
+		t.Fatalf("Failed to create role: %v", err)
+	}
+
+	// 3. Assign Role
+	_, err = pool.Exec(ctx, "INSERT INTO auth.user_roles (user_id, role_id) VALUES ($1, $2)", userID, roleID)
+	if err != nil {
+		t.Fatalf("Failed to assign role: %v", err)
+	}
+
+	// 4. Test GetUserRole
+	role, err := repo.GetUserRole(ctx, userID)
+	if err != nil {
+		t.Errorf("GetUserRole() error = %v", err)
+	}
+
+	if role != roleName {
+		t.Errorf("GetUserRole() got = %v, want %v", role, roleName)
+	}
+}
+
+func TestIntegration_SQLRepository_GetUserRole_Default(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping integration test")
+	}
+
+	ctx := context.Background()
+
+	// Start testcontainer
+	container, err := testutil.NewPostgresContainer(ctx, t)
+	if err != nil {
+		t.Fatalf("Failed to create postgres container: %v", err)
+	}
+
+	defer func() {
+		if err := container.Close(ctx); err != nil {
+			t.Errorf("Failed to close container: %v", err)
+		}
+	}()
+
+	// Get database connection and setup schema
+	pool, repo := setupTestDB(ctx, t, container, container.DSN)
+
+	defer pool.Close()
+
+	// Test Default Role
+	userID2 := "user_no_role"
+	if err := repo.CreateUser(ctx, userID2, "no_role@example.com", ""); err != nil {
+		t.Fatalf("Failed to create user: %v", err)
+	}
+
+	role2, err := repo.GetUserRole(ctx, userID2)
+	if err != nil {
+		t.Errorf("GetUserRole() error = %v", err)
+	}
+
+	if role2 != "user" {
+		t.Errorf("GetUserRole() for user without role got = %v, want %v", role2, "user")
+	}
 }
 
-func setupTestDB(ctx context.Context, t *testing.T, container *testutil.PostgresContainer, dsn string) (*sql.DB, *repository.SQLRepository) {
+func setupTestDB(ctx context.Context, t *testing.T, container *testutil.PostgresContainer, dsn string) (*pgxpool.Pool, *repository.SQLRepository) {
 	t.Helper()
 
-	db, err := container.DB(ctx)
+	pool, err := container.Pool(ctx)
 	if err != nil {
 		t.Fatalf("Failed to connect to database: %v", err)
 	}
 
+	_ = setupIntegrationRegistry(ctx, t, pool, dsn)
+
+	repo := repository.NewSQLRepository(pool)
+
+	return pool, repo
+}
+
+func setupIntegrationRegistry(_ context.Context, t *testing.T, pool *pgxpool.Pool, dsn string) *registry.Registry {
+	t.Helper()
 	// Set up registry and run migrations
 	cfg := &config.AppConfig{
 		Env:      "test",
 		LogLevel: "debug",
 		Auth: config.AuthConfig{
-			JWTSecret: "test-secret-key-that-is-at-least-32-bytes-long-for-testing",
+			JWTPrivateKeyPEM: `-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCgKaue+zKl57/5
+QuzzKZIm0nQe5Jopmd10ie/fB8k3nAReUwQ0aiaVws9FmeT1fylKzuLrEN4Xh0wy
+ZYrEwV0xTaxBOu708yZikVCMz1bF16mhoODBrm2+cNE0bfpxzwoFt/zyP6AigxWJ
+5XHJzJHFoaDw3334oLvaG1lkcDjfFUEKMbIk+CN2hXCbI6BSJCo989y4RPoFkZBH
+eNgKiRiHZm5ypsNEdvjItlRGM7hwtAH81v+OtdlTeWp+mlz3SCUyCagEP1Gs3L0Y
+aeoYOEA1ylpmapaDhKnobk4oFb9ujF60CGkLt/eOjt63AvQQtmAKJLK4Y0EgS7hi
+3kh9ZxDJAgMBAAECggEACx+px3jR2Ggp0wspzGxynD1zCpXWlGIXDLOFB4JebTBp
+6A7JYXlbGBaq8T4ST7yjs3B+arrfefBDKgYXmh+5GoxqLmOd86d5kh0rZFEE/IIR
+SkqTbmnWpGq1SCtrpzQTRNKcMxgyxbYN+Zq7PIh3oJH5TN49o2/ibCNvId5epmh5
+Qyvy2FhYZGhtxg3K+WApQxfeTOq/o+BbNdSUrcQaLDeKe3PS3KFykCj+dno3EiFn
+dyEwLQcP63dSoUqW6ObR634DSIRR0CNWqRyeWD0SxRbjNV9bIk/bOjJ4FrPjEuRB
+gT/LhMsD1fthTMyAyNpryxDknc2mYCrHd/ix5nEakwKBgQDMdfe0CpSbfNqix9T6
+TAasGZaXVSBJ3n4GCwFOn5KaJfPhAB64n9x82YvliWOyl5u16SgxnBj3vKGLskCP
+DXSLvQWBheZBFoPxEKsGXp2ddEFXf7zVcjG4nYz8Z0Kn5JGImhjwajcQKIVJBCvR
+vTwCWl3/9spKARs0Zue6hBd0owKBgQDIiRzDJlonRL6TCS8bJT/LBdWGIn1Syz/A
+zbssfD9Qh89TL5i7zfPcGm4Yzk+Z4zbh1/67D33GvMPr1aKnzcbR4+4+xZiVaZjl
+m0tDONGFxrZAyvbdHLJiXZBujoRO96bGsjZtyEZ+hG+MV0s+FCX7fkFWJa1+vpyv
+aAkZcrjPowKBgQCK76bRC1eMiT0w3EYXh84I6KJyV4BHcg+FH7lVqg2+/gdJYAGA
+R/FWTaZI5iF/XJKM/NE5VO+KeP31pb1E+Em4I0w4hbq/hANIrqDpBSZptnQodz7k
+dGLhJv6FDc43tJRIlR5ZUHP2YPKheVolfkfm+W1i4Fr6CuJnq33QOq6NrQKBgFml
+Oa9fiLO/PnZah61Z5H+stvxElMObSn+1OHQ1gtRMMflc8Kkb82S0h/0c1WbUtOcW
++K/EyBQ8tFTL5u+exL91Zj63dHNuhkQ2PNnrH3bvEvA6C0tjFbd1XiieGzV17h8q
+8bv36NOL/pW9PEyfEy+vDCQnqbxcF40uM8slhsqDAoGBAMGCthWkf2eG0Y4Scksf
+r/gNlU+15OnndSq0UQt2xjiy+0XQ5CVHaIyyaLiFiYjsLYdaxfOckMMrvP3RqObE
+8b9897yqs3ENFV+lJA7z/gZntQFLmlfzQadbGRuVeZfh+u7NqM4j73SRNMubEBEd
+7mlsQJQ+USaHSReSju9xmzH8
+-----END PRIVATE KEY-----`,
 		},
 	}
-
 	reg := registry.New(
 		registry.WithConfig(cfg),
-		registry.WithDatabase(db),
+		registry.WithDatabase(pool),
 		registry.WithEventBus(events.NewBus()),
 	)
 
@@ -95,17 +220,15 @@ func setupTestDB(ctx context.Context, t *testing.T, container *testutil.Postgres
 		t.Fatalf("Failed to run migrations: %v", err)
 	}
 
-	repo := repository.NewSQLRepository(db)
-
-	return db, repo
+	return reg
 }
 
-func verifyUserCreated(ctx context.Context, t *testing.T, db *sql.DB, userID, expectedEmail string) {
+func verifyUserCreated(ctx context.Context, t *testing.T, pool *pgxpool.Pool, userID, expectedEmail string) {
 	t.Helper()
 
 	var email string
 
-	err := db.QueryRowContext(ctx, "SELECT email FROM auth.users WHERE id = $1", userID).Scan(&email)
+	err := pool.QueryRow(ctx, "SELECT email FROM auth.users WHERE id = $1", userID).Scan(&email)
 	if err != nil {
 		t.Errorf("Failed to query user: %v", err)
 	}
diff --git a/modules/auth/internal/service/oauth.go b/modules/auth/internal/service/oauth.go
index 09652cb..ab358a2 100644
--- a/modules/auth/internal/service/oauth.go
+++ b/modules/auth/internal/service/oauth.go
@@ -11,15 +11,15 @@ import (
 
 	"go.jetify.com/typeid"
 
+	"github.com/cmelgarejo/go-modulith-template/internal/authtoken"
 	"github.com/cmelgarejo/go-modulith-template/internal/oauth"
 	"github.com/cmelgarejo/go-modulith-template/modules/auth/internal/repository"
-	"github.com/cmelgarejo/go-modulith-template/modules/auth/internal/token"
 )
 
 // OAuthService handles OAuth-related business logic.
 type OAuthService struct {
 	repo           repository.Repository
-	tokenService   *token.Service
+	tokenService   *authtoken.Service
 	oauthRegistry  *oauth.Registry
 	tokenEncryptor TokenEncryptor
 	autoLinkEmail  bool
@@ -34,7 +34,7 @@ type TokenEncryptor interface {
 // NewOAuthService creates a new OAuthService.
 func NewOAuthService(
 	repo repository.Repository,
-	tokenService *token.Service,
+	tokenService *authtoken.Service,
 	oauthRegistry *oauth.Registry,
 	tokenEncryptor TokenEncryptor,
 	autoLinkEmail bool,
@@ -93,13 +93,13 @@ func (s *OAuthService) handleLogin(ctx context.Context, userInfo oauth.UserInfo)
 		}
 	}
 
-	// No existing account or user, create new user
-	userID, err := s.createNewUserFromOAuth(ctx, userInfo)
-	if err != nil {
-		return nil, err
-	}
+	// No existing account or user, blocked (security requirement)
+	slog.WarnContext(ctx, "OAuth login attempt for non-existent user blocked",
+		"provider", userInfo.Provider,
+		"email", userInfo.Email,
+	)
 
-	return s.generateTokensForUser(userID, true)
+	return nil, fmt.Errorf("account not found: %s", userInfo.Email)
 }
 
 // handleAccountLinking links an external account to an existing user.
@@ -128,35 +128,6 @@ func (s *OAuthService) handleAccountLinking(ctx context.Context, userInfo oauth.
 	return s.generateTokensForUser(userID, false)
 }
 
-// createNewUserFromOAuth creates a new user from OAuth info.
-func (s *OAuthService) createNewUserFromOAuth(ctx context.Context, userInfo oauth.UserInfo) (string, error) {
-	tid, err := typeid.WithPrefix("user")
-	if err != nil {
-		return "", fmt.Errorf("failed to generate user typeid: %w", err)
-	}
-
-	userID := tid.String()
-
-	// Create user with email from OAuth
-	if err := s.repo.CreateUser(ctx, userID, userInfo.Email, ""); err != nil {
-		return "", fmt.Errorf("failed to create user: %w", err)
-	}
-
-	// Update profile with OAuth info
-	if userInfo.Name != "" || userInfo.AvatarURL != "" {
-		if err := s.repo.UpdateUserProfile(ctx, userID, userInfo.Name, userInfo.AvatarURL); err != nil {
-			slog.WarnContext(ctx, "Failed to update user profile from OAuth", "error", err)
-		}
-	}
-
-	// Create external account
-	if err := s.createExternalAccount(ctx, userID, userInfo); err != nil {
-		return "", fmt.Errorf("failed to create external account: %w", err)
-	}
-
-	return userID, nil
-}
-
 // createExternalAccount creates a new external account link.
 func (s *OAuthService) createExternalAccount(ctx context.Context, userID string, userInfo oauth.UserInfo) error {
 	tid, err := typeid.WithPrefix("extacc")
@@ -236,12 +207,12 @@ func (s *OAuthService) updateExternalAccount(ctx context.Context, userInfo oauth
 
 // generateTokensForUser generates JWT tokens for a user.
 func (s *OAuthService) generateTokensForUser(userID string, isNewUser bool) (*oauth.Result, error) {
-	accessToken, err := s.tokenService.CreateToken(userID, "user", 1*time.Hour)
+	accessToken, _, err := s.tokenService.CreateToken(userID, "user", 1*time.Hour)
 	if err != nil {
 		return nil, fmt.Errorf("failed to create access token: %w", err)
 	}
 
-	refreshToken, err := s.tokenService.CreateToken(userID, "user", 24*time.Hour) //nolint:mnd
+	refreshToken, _, err := s.tokenService.CreateToken(userID, "user", 24*time.Hour) //nolint:mnd
 	if err != nil {
 		return nil, fmt.Errorf("failed to create refresh token: %w", err)
 	}
@@ -265,7 +236,7 @@ func NewRepositoryStateStore(repo repository.Repository) *RepositoryStateStore {
 	return &RepositoryStateStore{repo: repo}
 }
 
-// SaveState saves an OAuth state token.
+// SaveState saves an OAuth state authtoken.
 func (s *RepositoryStateStore) SaveState(ctx context.Context, data *oauth.StateData) error {
 	state := &repository.OAuthState{
 		State:       data.State,
@@ -283,7 +254,7 @@ func (s *RepositoryStateStore) SaveState(ctx context.Context, data *oauth.StateD
 	return nil
 }
 
-// GetState retrieves an OAuth state token.
+// GetState retrieves an OAuth state authtoken.
 func (s *RepositoryStateStore) GetState(ctx context.Context, state string) (*oauth.StateData, error) {
 	repoState, err := s.repo.GetOAuthState(ctx, state)
 	if err != nil {
@@ -300,7 +271,7 @@ func (s *RepositoryStateStore) GetState(ctx context.Context, state string) (*oau
 	}, nil
 }
 
-// DeleteState deletes an OAuth state token.
+// DeleteState deletes an OAuth state authtoken.
 func (s *RepositoryStateStore) DeleteState(ctx context.Context, state string) error {
 	if err := s.repo.DeleteOAuthState(ctx, state); err != nil {
 		return fmt.Errorf("failed to delete oauth state: %w", err)
diff --git a/modules/auth/internal/service/service.go b/modules/auth/internal/service/service.go
index f576539..9805c08 100644
--- a/modules/auth/internal/service/service.go
+++ b/modules/auth/internal/service/service.go
@@ -7,7 +7,6 @@ import (
 	"context"
 	"crypto/rand"
 	"crypto/sha256"
-	"database/sql"
 	"encoding/hex"
 	"errors"
 	"fmt"
@@ -15,50 +14,86 @@ import (
 	"math/big"
 	"time"
 
+	"net/http"
+	"strings"
+
 	authv1 "github.com/cmelgarejo/go-modulith-template/gen/go/proto/auth/v1"
+	"github.com/cmelgarejo/go-modulith-template/internal/audit"
 	"github.com/cmelgarejo/go-modulith-template/internal/authn"
+	"github.com/cmelgarejo/go-modulith-template/internal/authtoken"
 	"github.com/cmelgarejo/go-modulith-template/internal/events"
+	"github.com/cmelgarejo/go-modulith-template/internal/feature"
 	"github.com/cmelgarejo/go-modulith-template/internal/i18n"
 	"github.com/cmelgarejo/go-modulith-template/internal/notifier"
+	"github.com/cmelgarejo/go-modulith-template/internal/telemetry"
 	"github.com/cmelgarejo/go-modulith-template/modules/auth/internal/db/store"
 	"github.com/cmelgarejo/go-modulith-template/modules/auth/internal/repository"
-	"github.com/cmelgarejo/go-modulith-template/modules/auth/internal/token"
+	"github.com/jackc/pgx/v5"
 	"go.jetify.com/typeid"
+	"google.golang.org/grpc"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/metadata"
 	"google.golang.org/grpc/status"
+
 	"google.golang.org/protobuf/types/known/timestamppb"
 )
 
+// ModuleName is the name of the module.
+const ModuleName = "auth"
+
+// RoleAdmin is the admin role.
+const RoleAdmin = "admin"
+
+// RoleUser is the user role.
+const RoleUser = "user"
+
 // AuthService implements the authv1.AuthServiceServer interface
 type AuthService struct {
 	authv1.UnimplementedAuthServiceServer
 	repo         repository.Repository
-	tokenService *token.Service
+	tokenService *authtoken.Service
 	bus          *events.Bus
+	audit        audit.Logger
+	feature      feature.Manager
+	env          string // "dev", "staging", "prod", etc.
 }
 
 // NewAuthService creates a new instance of the AuthService
-func NewAuthService(repo repository.Repository, svc *token.Service, bus *events.Bus) *AuthService {
+func NewAuthService(repo repository.Repository, svc *authtoken.Service, bus *events.Bus, audit audit.Logger, feature feature.Manager, env string) *AuthService {
 	return &AuthService{
 		repo:         repo,
 		tokenService: svc,
 		bus:          bus,
+		audit:        audit,
+		feature:      feature,
+		env:          env,
 	}
 }
 
 // RequestLogin generates a magic code and emits an event to send it to the user.
-// Note: Field format validation (email format, phone pattern) and oneof requirement
-// are handled by the validation interceptor. This method handles business logic only.
-// Only sends codes to existing users (returns NotFound if user doesn't exist).
+// Note: This endpoint always returns success to prevent email enumeration attacks.
+// If the user doesn't exist, no code is sent but the response looks identical.
 func (s *AuthService) RequestLogin(ctx context.Context, req *authv1.RequestLoginRequest) (*authv1.RequestLoginResponse, error) {
+	ctx, span := telemetry.ServiceSpan(ctx, ModuleName, "RequestLogin")
+	defer span.End()
+
 	// With oneof, exactly one field will be set (validated by protovalidate)
 	email := req.GetEmail()
 	phone := req.GetPhone()
 
-	// Check if user exists before sending code
-	if err := s.verifyUserExists(ctx, email, phone); err != nil {
-		return nil, err
+	// Security: Always return success to prevent email enumeration.
+	// If user doesn't exist, we simply don't send a code but return the same response.
+	userExists := s.checkUserExists(ctx, email, phone)
+	if !userExists {
+		slog.InfoContext(ctx, "login request for non-existent user (silent fail)",
+			"email_hash", hashContactInfo(email),
+			"phone_hash", hashContactInfo(phone),
+		)
+		// Return success without sending a code
+		return &authv1.RequestLoginResponse{
+			Success: true,
+			Message: "If an account exists with this email, you will receive a verification code",
+		}, nil
 	}
 
 	// Generate 6 digit code
@@ -71,24 +106,42 @@ func (s *AuthService) RequestLogin(ctx context.Context, req *authv1.RequestLogin
 
 	expiresAt := time.Now().Add(15 * time.Minute)
 
-	err = s.repo.CreateMagicCode(ctx, code, email, phone, expiresAt)
+	err = s.repo.WithTx(ctx, func(txRepo repository.Repository) error {
+		if txErr := txRepo.CreateMagicCode(ctx, code, email, phone, expiresAt); txErr != nil {
+			return txErr
+		}
+
+		locale := i18n.LocaleFromContext(ctx)
+		if locale == "" {
+			locale = i18n.DetectLocale(ctx, "en")
+		}
+
+		if txErr := txRepo.StoreOutbox(ctx, notifier.EventMagicCodeRequested, map[string]interface{}{
+			"email":  email,
+			"phone":  phone,
+			"code":   code,
+			"locale": locale,
+		}); txErr != nil {
+			return txErr
+		}
+
+		return nil
+	})
 	if err != nil {
-		slog.ErrorContext(ctx, "failed to create magic code", "error", err)
+		slog.ErrorContext(ctx, "failed to create magic code or outbox event", "error", err)
 
 		return nil, status.Error(codes.Internal, "internal server error")
 	}
 
-	// Emit event for notification (decoupled/async)
-	s.publishMagicCodeEvent(ctx, email, phone, code)
-
 	return &authv1.RequestLoginResponse{
 		Success: true,
-		Message: "Magic code sent",
+		Message: "If an account exists with this email, you will receive a verification code",
 	}, nil
 }
 
-// verifyUserExists checks if a user exists by email or phone, returning NotFound if not found.
-func (s *AuthService) verifyUserExists(ctx context.Context, email, phone string) error {
+// checkUserExists checks if a user exists without returning an error.
+// This is used to silently check for user existence without revealing it to clients.
+func (s *AuthService) checkUserExists(ctx context.Context, email, phone string) bool {
 	var err error
 
 	if email != "" {
@@ -97,67 +150,163 @@ func (s *AuthService) verifyUserExists(ctx context.Context, email, phone string)
 		_, err = s.repo.GetUserByPhone(ctx, phone)
 	}
 
-	if err != nil {
-		// Check for sql.ErrNoRows (works with wrapped errors via %w)
-		if errors.Is(err, sql.ErrNoRows) {
-			slog.InfoContext(ctx, "user not found for login request",
-				"email", email,
-				"phone", phone,
-			)
+	return err == nil
+}
 
-			return status.Error(codes.NotFound, "user not found")
-		}
+// hashContactInfo creates a simple hash of contact info for secure logging.
+// This prevents PII from being logged while still allowing log correlation.
+func hashContactInfo(info string) string {
+	if info == "" {
+		return ""
+	}
 
-		slog.ErrorContext(ctx, "failed to lookup user", "error", err)
+	hash := sha256.Sum256([]byte(info))
 
-		return status.Error(codes.Internal, "internal server error")
+	return hex.EncodeToString(hash[:8]) // Only first 8 bytes for brevity
+}
+
+// CompleteLogin verifies the magic code and generates tokens for the user
+func (s *AuthService) CompleteLogin(ctx context.Context, req *authv1.CompleteLoginRequest) (*authv1.CompleteLoginResponse, error) {
+	ctx, span := telemetry.ServiceSpan(ctx, ModuleName, "CompleteLogin")
+	defer span.End()
+
+	if err := s.verifyLoginRequest(ctx, req); err != nil {
+		return nil, err
 	}
 
-	return nil
-}
+	// With oneof, exactly one field will be set (validated by protovalidate)
+	email := req.GetEmail()
+	phone := req.GetPhone()
+
+	user, err := s.getOrCreateUser(ctx, email, phone)
+	if err != nil {
+		return nil, err
+	}
+
+	// Clean up codes and publish login event within transaction
+	err = s.repo.WithTx(ctx, func(txRepo repository.Repository) error {
+		if txErr := txRepo.InvalidateMagicCodes(ctx, email, phone); txErr != nil {
+			slog.ErrorContext(ctx, "failed to invalidate magic codes", "error", txErr)
+		}
 
-// publishMagicCodeEvent publishes an event for magic code notification.
-func (s *AuthService) publishMagicCodeEvent(ctx context.Context, email, phone, code string) {
-	locale := i18n.LocaleFromContext(ctx)
-	if locale == "" {
-		// Detect locale if not already in context
-		locale = i18n.DetectLocale(ctx, "en")
+		return txRepo.StoreOutbox(ctx, events.EventAuthUserLoggedIn, map[string]interface{}{
+			"user_id":      user.ID,
+			"email":        email,
+			"phone":        phone,
+			"login_method": "magic_code",
+			"timestamp":    time.Now().UTC(),
+		})
+	})
+	if err != nil {
+		slog.ErrorContext(ctx, "failed to create outbox event for login", "error", err)
 	}
 
-	s.bus.Publish(ctx, events.Event{
-		Name: notifier.EventMagicCodeRequested,
-		Payload: map[string]interface{}{
+	// Audit Log
+	s.audit.Log(ctx, audit.LogParams{
+		UserID:   user.ID,
+		Action:   "LOGIN",
+		Resource: ModuleName,
+		Metadata: map[string]any{
+			"method": "magic_code",
 			"email":  email,
 			"phone":  phone,
-			"code":   code,
-			"locale": locale,
 		},
+		Success: true,
 	})
 
-	slog.InfoContext(ctx, "magic code event published")
-}
+	// Record business metrics
+	if telemetry.AuthLoginTotal != nil {
+		telemetry.AuthLoginTotal.Inc(ctx)
+	}
 
-// CompleteLogin verifies the magic code and generates tokens for the user
-func (s *AuthService) CompleteLogin(ctx context.Context, req *authv1.CompleteLoginRequest) (*authv1.CompleteLoginResponse, error) {
-	if err := s.verifyLoginRequest(ctx, req); err != nil {
+	resp, err := s.generateLoginResponse(ctx, user)
+	if err != nil {
 		return nil, err
 	}
+	// Set HttpOnly cookies for access and refresh tokens (web clients)
+	s.setAuthCookies(ctx, resp.AccessToken, resp.RefreshToken)
+
+	return resp, nil
+}
+
+// Register creates a new user account.
+//
+//nolint:funlen // Register logic is naturally sequential: check exists, create user/profile/role/event in tx, fetch, audit, return
+func (s *AuthService) Register(ctx context.Context, req *authv1.RegisterRequest) (*authv1.RegisterResponse, error) {
+	ctx, span := telemetry.ServiceSpan(ctx, ModuleName, "Register")
+	defer span.End()
 
-	// With oneof, exactly one field will be set (validated by protovalidate)
 	email := req.GetEmail()
 	phone := req.GetPhone()
+	displayName := req.GetDisplayName()
+	nationality := req.GetNationality()
+	docType := req.GetDocumentType()
+	docNumber := req.GetDocumentNumber()
 
-	user, err := s.getOrCreateUser(ctx, email, phone)
+	// Check if user already exists
+	if s.checkUserExists(ctx, email, phone) {
+		return nil, status.Error(codes.AlreadyExists, "user already exists")
+	}
+
+	// Generate new user ID
+	uid, err := typeid.WithPrefix("user")
 	if err != nil {
-		return nil, err
+		slog.ErrorContext(ctx, "failed to generate user id", "error", err)
+		return nil, status.Error(codes.Internal, "internal server error")
 	}
 
-	// Clean up codes
-	if err := s.repo.InvalidateMagicCodes(ctx, email, phone); err != nil {
-		slog.ErrorContext(ctx, "failed to invalidate magic codes", "error", err)
+	userID := uid.String()
+
+	// Use transaction to ensure user and role are created together
+	if err := s.repo.WithTx(ctx, func(tx repository.Repository) error {
+		if err := tx.CreateUser(ctx, userID, email, phone); err != nil {
+			return err
+		}
+
+		if err := tx.UpdateUserProfile(ctx, userID, displayName, "", ""); err != nil {
+			return err
+		}
+
+		if err := tx.AssignRole(ctx, userID, RoleUser); err != nil {
+			return err
+		}
+
+		// Publish registration event via outbox
+		return tx.StoreOutbox(ctx, events.EventAuthUserRegistered, events.NewUserRegisteredPayload(
+			userID, email, phone, displayName, nationality, docType, docNumber,
+		))
+	}); err != nil {
+		slog.ErrorContext(ctx, "failed to register user", "error", err)
+		return nil, status.Error(codes.Internal, "internal server error")
+	}
+
+	// Fetch created user
+	user, err := s.repo.GetUserByID(ctx, userID)
+	if err != nil {
+		slog.ErrorContext(ctx, "failed to fetch created user", "error", err)
+		return nil, status.Error(codes.Internal, "internal server error")
 	}
 
-	return s.generateLoginResponse(user)
+	// Audit Log
+	s.audit.Log(ctx, audit.LogParams{
+		UserID:   userID,
+		Action:   "REGISTER",
+		Resource: ModuleName,
+		Metadata: map[string]any{
+			"email":        email,
+			"phone":        phone,
+			"display_name": displayName,
+		},
+		Success: true,
+	})
+
+	slog.InfoContext(ctx, "Dummy verification email sent", "email", email)
+
+	return &authv1.RegisterResponse{
+		Success: true,
+		Message: "Account created successfully. Please log in to continue.",
+		User:    userToProto(user),
+	}, nil
 }
 
 // verifyLoginRequest validates the login request.
@@ -173,6 +322,13 @@ func (s *AuthService) verifyLoginRequest(ctx context.Context, req *authv1.Comple
 		return status.Error(codes.InvalidArgument, "either email or phone must be provided")
 	}
 
+	// Bypass magic code in development for automated testing with AI
+	// SECURITY: Only allowed in dev environment
+	if req.Code == "000000" && s.env == "dev" {
+		slog.WarnContext(ctx, "DEV ONLY: bypassing magic code check", "email", email, "phone", phone)
+		return nil
+	}
+
 	// With oneof, exactly one field will be set (validated by protovalidate)
 	if email != "" {
 		return s.verifyMagicCodeByEmail(ctx, email, req.Code)
@@ -184,7 +340,7 @@ func (s *AuthService) verifyLoginRequest(ctx context.Context, req *authv1.Comple
 func (s *AuthService) verifyMagicCodeByEmail(ctx context.Context, email, code string) error {
 	_, err := s.repo.GetValidMagicCodeByEmail(ctx, email, code)
 	if err != nil {
-		if errors.Is(err, sql.ErrNoRows) {
+		if errors.Is(err, pgx.ErrNoRows) {
 			slog.DebugContext(ctx, "magic code not found or expired",
 				"email", email,
 				"code", code,
@@ -204,7 +360,7 @@ func (s *AuthService) verifyMagicCodeByEmail(ctx context.Context, email, code st
 func (s *AuthService) verifyMagicCodeByPhone(ctx context.Context, phone, code string) error {
 	_, err := s.repo.GetValidMagicCodeByPhone(ctx, phone, code)
 	if err != nil {
-		if errors.Is(err, sql.ErrNoRows) {
+		if errors.Is(err, pgx.ErrNoRows) {
 			slog.DebugContext(ctx, "magic code not found or expired",
 				"phone", phone,
 				"code", code,
@@ -222,9 +378,10 @@ func (s *AuthService) verifyMagicCodeByPhone(ctx context.Context, phone, code st
 }
 
 func (s *AuthService) getOrCreateUser(ctx context.Context, email, phone string) (*store.AuthUser, error) {
-	var user *store.AuthUser
-
-	var err error
+	var (
+		user *store.AuthUser
+		err  error
+	)
 
 	if email != "" {
 		user, err = s.repo.GetUserByEmail(ctx, email)
@@ -236,57 +393,60 @@ func (s *AuthService) getOrCreateUser(ctx context.Context, email, phone string)
 		return user, nil
 	}
 
-	if !errors.Is(err, sql.ErrNoRows) {
-		slog.ErrorContext(ctx, "failed to lookup user", "error", err)
-		return nil, status.Error(codes.Internal, "internal server error")
-	}
-
-	return s.handleSignup(ctx, email, phone)
-}
-
-func (s *AuthService) handleSignup(ctx context.Context, email, phone string) (*store.AuthUser, error) {
-	tid, err := typeid.WithPrefix("user")
-	if err != nil {
-		slog.ErrorContext(ctx, "failed to generate user typeid", "error", err)
-		return nil, status.Error(codes.Internal, "internal server error")
-	}
+	if errors.Is(err, pgx.ErrNoRows) {
+		slog.WarnContext(ctx, "login attempt for non-existent user blocked",
+			"email_hash", hashContactInfo(email),
+			"phone_hash", hashContactInfo(phone),
+		)
 
-	userID := tid.String()
-	if err := s.repo.CreateUser(ctx, userID, email, phone); err != nil {
-		slog.ErrorContext(ctx, "failed to create user", "error", err)
-		return nil, status.Error(codes.Internal, "internal server error")
+		return nil, status.Error(codes.NotFound, "user not found")
 	}
 
-	if email != "" {
-		user, err := s.repo.GetUserByEmail(ctx, email)
-		if err != nil {
-			return nil, fmt.Errorf("failed to fetch user by email: %w", err)
-		}
+	slog.ErrorContext(ctx, "failed to lookup user", "error", err)
 
-		return user, nil
-	}
+	return nil, status.Error(codes.Internal, "internal server error")
+}
 
-	user, err := s.repo.GetUserByPhone(ctx, phone)
+func (s *AuthService) generateLoginResponse(ctx context.Context, user *store.AuthUser) (*authv1.CompleteLoginResponse, error) {
+	role, err := s.repo.GetUserRole(ctx, user.ID)
 	if err != nil {
-		return nil, fmt.Errorf("failed to fetch user by phone: %w", err)
-	}
+		slog.WarnContext(ctx, "failed to get user role, defaulting to user", "user_id", user.ID, "error", err)
 
-	return user, nil
-}
+		role = RoleUser
+	}
 
-func (s *AuthService) generateLoginResponse(user *store.AuthUser) (*authv1.CompleteLoginResponse, error) {
-	accessToken, err := s.tokenService.CreateToken(user.ID, "user", 1*time.Hour)
+	accessToken, _, err := s.tokenService.CreateToken(user.ID, role, 1*time.Hour)
 	if err != nil {
 		slog.Error("failed to create access token", "error", err)
 		return nil, status.Error(codes.Internal, "internal server error")
 	}
 
-	refreshToken, err := s.tokenService.CreateToken(user.ID, "user", 24*time.Hour)
+	refreshToken, jti, err := s.tokenService.CreateToken(user.ID, role, 24*time.Hour)
 	if err != nil {
 		slog.Error("failed to create refresh token", "error", err)
 		return nil, status.Error(codes.Internal, "internal server error")
 	}
 
+	// Create session in DB
+	err = s.repo.CreateSession(ctx, &repository.Session{
+		ID:               jti,
+		UserID:           user.ID,
+		RefreshTokenHash: hashToken(refreshToken),
+		UserAgent:        "", // Optional: Could extract from context if available
+		IPAddress:        "", // Optional: Could extract from context if available
+		CreatedAt:        time.Now(),
+		LastActiveAt:     time.Now(),
+		ExpiresAt:        time.Now().Add(24 * time.Hour),
+	})
+	if err != nil {
+		slog.Error("failed to create session", "error", err)
+		// Non-blocking for now? Or return error?
+		// Usually we want session creation to be mandatory for tracking.
+	}
+
+	// Set HttpOnly cookies in gRPC metadata (will be forwarded by gateway)
+	s.setAuthCookies(ctx, accessToken, refreshToken)
+
 	return &authv1.CompleteLoginResponse{
 		AccessToken:  accessToken,
 		RefreshToken: refreshToken,
@@ -326,6 +486,21 @@ func getUserIDFromContext(ctx context.Context) (string, error) {
 	return userID, nil
 }
 
+// getJTIFromContext extracts the JTI from the token in the context.
+func (s *AuthService) getJTIFromContext(ctx context.Context) string {
+	rawToken := getTokenFromContext(ctx)
+	if rawToken == "" {
+		return ""
+	}
+
+	claims, err := s.tokenService.VerifyToken(rawToken)
+	if err != nil {
+		return ""
+	}
+
+	return claims.ID
+}
+
 // getTokenFromContext extracts the raw token from the gRPC metadata.
 func getTokenFromContext(ctx context.Context) string {
 	md, ok := metadata.FromIncomingContext(ctx)
@@ -346,21 +521,124 @@ func getTokenFromContext(ctx context.Context) string {
 	return ""
 }
 
-// RefreshToken exchanges a refresh token for a new access token.
-func (s *AuthService) RefreshToken(ctx context.Context, req *authv1.RefreshTokenRequest) (*authv1.RefreshTokenResponse, error) {
-	if req.RefreshToken == "" {
-		return nil, status.Error(codes.InvalidArgument, "refresh_token is required")
+// setAuthCookies sends Set-Cookie via gRPC response metadata (HttpOnly, Secure, SameSite=Lax).
+func (s *AuthService) setAuthCookies(ctx context.Context, accessToken, refreshToken string) {
+	isSecure := s.env == "prod"
+
+	accessCookie := &http.Cookie{
+		Name:     authn.AccessTokenCookieName,
+		Value:    accessToken,
+		Path:     "/",
+		HttpOnly: true,
+		Secure:   true,
+		SameSite: http.SameSiteLaxMode,
+		MaxAge:   3600, // 1 hour
+	}
+	accessCookie.Secure = isSecure
+
+	refreshCookie := &http.Cookie{
+		Name:     authn.RefreshTokenCookieName,
+		Value:    refreshToken,
+		Path:     "/",
+		HttpOnly: true,
+		Secure:   true,
+		SameSite: http.SameSiteLaxMode,
+		MaxAge:   24 * 3600, // 24 hours
+	}
+	refreshCookie.Secure = isSecure
+
+	// Add both cookies to metadata
+	_ = grpc.SetHeader(ctx, metadata.Pairs(
+		"set-cookie", accessCookie.String(),
+		"set-cookie", refreshCookie.String(),
+	))
+}
+
+// clearAuthCookies sends Set-Cookie to clear auth cookies.
+func (s *AuthService) clearAuthCookies(ctx context.Context) {
+	isSecure := s.env == "prod"
+
+	accessCookie := &http.Cookie{
+		Name:     authn.AccessTokenCookieName,
+		Value:    "",
+		Path:     "/",
+		HttpOnly: true,
+		Secure:   true,
+		SameSite: http.SameSiteLaxMode,
+		MaxAge:   -1,
+	}
+	accessCookie.Secure = isSecure
+
+	refreshCookie := &http.Cookie{
+		Name:     authn.RefreshTokenCookieName,
+		Value:    "",
+		Path:     "/",
+		HttpOnly: true,
+		Secure:   true,
+		SameSite: http.SameSiteLaxMode,
+		MaxAge:   -1,
+	}
+	refreshCookie.Secure = isSecure
+
+	_ = grpc.SetHeader(ctx, metadata.Pairs(
+		"set-cookie", accessCookie.String(),
+		"set-cookie", refreshCookie.String(),
+	))
+}
+
+// getRefreshTokenFromCookie extracts refresh_token from the Cookie header in gRPC metadata.
+func getRefreshTokenFromCookie(ctx context.Context) string {
+	md, ok := metadata.FromIncomingContext(ctx)
+	if !ok {
+		return ""
+	}
+	// Gateway passes Cookie header; gRPC normalizes keys to lowercase
+	cookieHeaders := md.Get("cookie")
+	if len(cookieHeaders) == 0 {
+		return ""
+	}
+
+	prefix := authn.RefreshTokenCookieName + "="
+
+	for _, line := range cookieHeaders {
+		for _, part := range strings.Split(line, ";") {
+			part = strings.TrimSpace(part)
+			if strings.HasPrefix(part, prefix) {
+				val := strings.TrimPrefix(part, prefix)
+
+				return strings.TrimSpace(val)
+			}
+		}
+	}
+
+	return ""
+}
+
+// RefreshSession refreshes an expired session if the refresh token is valid.
+//
+//nolint:funlen // Security verifications inherently run long
+func (s *AuthService) RefreshSession(ctx context.Context, req *authv1.RefreshSessionRequest) (*authv1.RefreshSessionResponse, error) {
+	ctx, span := telemetry.ServiceSpan(ctx, ModuleName, "RefreshSession")
+	defer span.End()
+
+	refreshToken := getRefreshTokenFromCookie(ctx)
+	if refreshToken == "" {
+		refreshToken = req.RefreshToken
+	}
+
+	if refreshToken == "" {
+		return nil, status.Error(codes.InvalidArgument, "refresh_token is required (body or cookie)")
 	}
 
 	// Verify the refresh token
-	claims, err := s.tokenService.VerifyToken(req.RefreshToken)
+	claims, err := s.tokenService.VerifyToken(refreshToken)
 	if err != nil {
 		slog.DebugContext(ctx, "invalid refresh token", "error", err)
 		return nil, status.Error(codes.Unauthenticated, "invalid refresh token")
 	}
 
 	// Check if token is blacklisted
-	tokenHash := hashToken(req.RefreshToken)
+	tokenHash := hashToken(refreshToken)
 
 	blacklisted, err := s.repo.IsTokenBlacklisted(ctx, tokenHash)
 	if err != nil {
@@ -373,33 +651,50 @@ func (s *AuthService) RefreshToken(ctx context.Context, req *authv1.RefreshToken
 	}
 
 	// Generate new tokens
-	accessToken, err := s.tokenService.CreateToken(claims.Subject, claims.Role, 1*time.Hour) //nolint:mnd
+	accessToken, _, err := s.tokenService.CreateToken(claims.Subject, claims.Role, 1*time.Hour) //nolint:mnd
 	if err != nil {
 		slog.ErrorContext(ctx, "failed to create access token", "error", err)
 		return nil, status.Error(codes.Internal, "internal server error")
 	}
 
-	refreshToken, err := s.tokenService.CreateToken(claims.Subject, claims.Role, 24*time.Hour) //nolint:mnd
+	refreshToken, jti, err := s.tokenService.CreateToken(claims.Subject, claims.Role, 24*time.Hour) //nolint:mnd
 	if err != nil {
 		slog.ErrorContext(ctx, "failed to create refresh token", "error", err)
 		return nil, status.Error(codes.Internal, "internal server error")
 	}
 
+	// Create new session in DB
+	err = s.repo.CreateSession(ctx, &repository.Session{
+		ID:               jti,
+		UserID:           claims.Subject,
+		RefreshTokenHash: hashToken(refreshToken),
+		ExpiresAt:        time.Now().Add(24 * time.Hour),
+	})
+	if err != nil {
+		slog.ErrorContext(ctx, "failed to create session on refresh", "error", err)
+	}
+
 	// Blacklist the old refresh token
 	expiresAt := time.Unix(claims.ExpiresAt, 0)
 	if err := s.repo.BlacklistToken(ctx, tokenHash, claims.Subject, "refresh", expiresAt); err != nil {
 		slog.WarnContext(ctx, "failed to blacklist old refresh token", "error", err)
 	}
 
-	return &authv1.RefreshTokenResponse{
+	// Set new auth cookies for web clients
+	s.setAuthCookies(ctx, accessToken, refreshToken)
+
+	return &authv1.RefreshSessionResponse{
 		AccessToken:  accessToken,
 		RefreshToken: refreshToken,
 		ExpiresIn:    3600,
 	}, nil
 }
 
-// Logout invalidates the current session and blacklists the token.
+// Logout invalidates the current session and blacklists the authtoken.
 func (s *AuthService) Logout(ctx context.Context, req *authv1.LogoutRequest) (*authv1.LogoutResponse, error) {
+	ctx, span := telemetry.ServiceSpan(ctx, ModuleName, "Logout")
+	defer span.End()
+
 	userID, err := getUserIDFromContext(ctx)
 	if err != nil {
 		return nil, err
@@ -428,6 +723,20 @@ func (s *AuthService) Logout(ctx context.Context, req *authv1.LogoutRequest) (*a
 		}
 	}
 
+	// Audit Log
+	s.audit.Log(ctx, audit.LogParams{
+		UserID:   userID,
+		Action:   "LOGOUT",
+		Resource: ModuleName,
+		Metadata: map[string]any{
+			"revoke_all": req.RevokeAll,
+		},
+		Success: true,
+	})
+
+	// Clear auth cookies
+	s.clearAuthCookies(ctx)
+
 	return &authv1.LogoutResponse{
 		Success: true,
 		Message: "Successfully logged out",
@@ -436,6 +745,9 @@ func (s *AuthService) Logout(ctx context.Context, req *authv1.LogoutRequest) (*a
 
 // GetProfile returns the current user's profile.
 func (s *AuthService) GetProfile(ctx context.Context, _ *authv1.GetProfileRequest) (*authv1.GetProfileResponse, error) {
+	ctx, span := telemetry.ServiceSpan(ctx, ModuleName, "GetProfile")
+	defer span.End()
+
 	userID, err := getUserIDFromContext(ctx)
 	if err != nil {
 		return nil, err
@@ -443,7 +755,7 @@ func (s *AuthService) GetProfile(ctx context.Context, _ *authv1.GetProfileReques
 
 	user, err := s.repo.GetUserByID(ctx, userID)
 	if err != nil {
-		if errors.Is(err, sql.ErrNoRows) {
+		if errors.Is(err, pgx.ErrNoRows) {
 			return nil, status.Error(codes.NotFound, "user not found")
 		}
 
@@ -457,14 +769,79 @@ func (s *AuthService) GetProfile(ctx context.Context, _ *authv1.GetProfileReques
 	}, nil
 }
 
+// RequestEmailVerification initiates the email verification process.
+func (s *AuthService) RequestEmailVerification(ctx context.Context, _ *authv1.RequestEmailVerificationRequest) (*authv1.RequestEmailVerificationResponse, error) {
+	ctx, span := telemetry.ServiceSpan(ctx, ModuleName, "RequestEmailVerification")
+	defer span.End()
+
+	userID, err := getUserIDFromContext(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	user, err := s.repo.GetUserByID(ctx, userID)
+	if err != nil {
+		return nil, status.Error(codes.Internal, "internal server error")
+	}
+
+	if user.EmailVerified {
+		return &authv1.RequestEmailVerificationResponse{
+			Success: true,
+			Message: "Email already verified",
+		}, nil
+	}
+
+	// Publish event via outbox
+	if err := s.repo.StoreOutbox(ctx, events.EventAuthEmailVerificationRequested, map[string]any{
+		"user_id": userID,
+		"email":   user.Email.String,
+	}); err != nil {
+		slog.ErrorContext(ctx, "failed to store outbox event", "error", err)
+	}
+
+	return &authv1.RequestEmailVerificationResponse{
+		Success: true,
+		Message: "Verification email sent",
+	}, nil
+}
+
+// HandleEmailVerificationRequested handles the dummy verification process.
+func (s *AuthService) HandleEmailVerificationRequested(ctx context.Context, userID string) error {
+	slog.InfoContext(ctx, "Dummy verification: marking email as verified", "user_id", userID)
+
+	// Simulating async verification
+	time.Sleep(1 * time.Second)
+
+	if err := s.repo.MarkEmailVerified(ctx, userID); err != nil {
+		slog.ErrorContext(ctx, "failed to mark email as verified", "error", err, "user_id", userID)
+		return err
+	}
+
+	// Audit Log
+	s.audit.Log(ctx, audit.LogParams{
+		UserID:   userID,
+		Action:   "EMAIL_VERIFIED",
+		Resource: ModuleName,
+		Metadata: map[string]any{
+			"method": "dummy",
+		},
+		Success: true,
+	})
+
+	return nil
+}
+
 // UpdateProfile updates the current user's profile.
 func (s *AuthService) UpdateProfile(ctx context.Context, req *authv1.UpdateProfileRequest) (*authv1.UpdateProfileResponse, error) {
+	ctx, span := telemetry.ServiceSpan(ctx, ModuleName, "UpdateProfile")
+	defer span.End()
+
 	userID, err := getUserIDFromContext(ctx)
 	if err != nil {
 		return nil, err
 	}
 
-	if err := s.repo.UpdateUserProfile(ctx, userID, req.DisplayName, req.AvatarUrl); err != nil {
+	if err := s.repo.UpdateUserProfile(ctx, userID, req.DisplayName, req.AvatarUrl, req.Timezone); err != nil {
 		slog.ErrorContext(ctx, "failed to update profile", "error", err, "userID", userID)
 		return nil, status.Error(codes.Internal, "internal server error")
 	}
@@ -476,6 +853,19 @@ func (s *AuthService) UpdateProfile(ctx context.Context, req *authv1.UpdateProfi
 		return nil, status.Error(codes.Internal, "internal server error")
 	}
 
+	// Audit Log
+	s.audit.Log(ctx, audit.LogParams{
+		UserID:     userID,
+		Action:     events.EventAuthProfileUpdated,
+		Resource:   ModuleName,
+		ResourceID: userID,
+		Metadata: map[string]any{
+			"display_name": req.DisplayName,
+			"avatar_url":   req.AvatarUrl,
+		},
+		Success: true,
+	})
+
 	return &authv1.UpdateProfileResponse{
 		User: userToProto(user),
 	}, nil
@@ -507,18 +897,31 @@ func (s *AuthService) ChangeEmail(ctx context.Context, req *authv1.ChangeEmailRe
 
 	expiresAt := time.Now().Add(15 * time.Minute)
 
-	if err := s.repo.CreatePendingContactChange(ctx, changeID.String(), userID, "email", req.NewEmail, code, expiresAt); err != nil {
-		slog.ErrorContext(ctx, "failed to create pending email change", "error", err)
-		return nil, status.Error(codes.Internal, "internal server error")
-	}
+	err = s.repo.WithTx(ctx, func(txRepo repository.Repository) error {
+		if txErr := txRepo.CreatePendingContactChange(ctx, changeID.String(), userID, "email", req.NewEmail, code, expiresAt); txErr != nil {
+			return txErr
+		}
 
-	// Emit event for notification
-	s.bus.Publish(ctx, events.Event{
-		Name: notifier.EventMagicCodeRequested,
-		Payload: map[string]string{
+		return txRepo.StoreOutbox(ctx, notifier.EventMagicCodeRequested, map[string]string{
 			"email": req.NewEmail,
 			"code":  code,
+		})
+	})
+	if err != nil {
+		slog.ErrorContext(ctx, "failed to create pending email change or outbox event", "error", err)
+		return nil, status.Error(codes.Internal, "internal server error")
+	}
+
+	// Audit Log
+	s.audit.Log(ctx, audit.LogParams{
+		UserID:   userID,
+		Action:   "auth.contact_change_requested",
+		Resource: ModuleName,
+		Metadata: map[string]any{
+			"type":      "email",
+			"new_email": req.NewEmail,
 		},
+		Success: true,
 	})
 
 	return &authv1.ChangeEmailResponse{
@@ -553,18 +956,31 @@ func (s *AuthService) ChangePhone(ctx context.Context, req *authv1.ChangePhoneRe
 
 	expiresAt := time.Now().Add(15 * time.Minute)
 
-	if err := s.repo.CreatePendingContactChange(ctx, changeID.String(), userID, "phone", req.NewPhone, code, expiresAt); err != nil {
-		slog.ErrorContext(ctx, "failed to create pending phone change", "error", err)
-		return nil, status.Error(codes.Internal, "internal server error")
-	}
+	err = s.repo.WithTx(ctx, func(txRepo repository.Repository) error {
+		if txErr := txRepo.CreatePendingContactChange(ctx, changeID.String(), userID, "phone", req.NewPhone, code, expiresAt); txErr != nil {
+			return txErr
+		}
 
-	// Emit event for notification
-	s.bus.Publish(ctx, events.Event{
-		Name: notifier.EventMagicCodeRequested,
-		Payload: map[string]string{
+		return txRepo.StoreOutbox(ctx, notifier.EventMagicCodeRequested, map[string]string{
 			"phone": req.NewPhone,
 			"code":  code,
+		})
+	})
+	if err != nil {
+		slog.ErrorContext(ctx, "failed to create pending phone change or outbox event", "error", err)
+		return nil, status.Error(codes.Internal, "internal server error")
+	}
+
+	// Audit Log
+	s.audit.Log(ctx, audit.LogParams{
+		UserID:   userID,
+		Action:   "auth.contact_change_requested",
+		Resource: ModuleName,
+		Metadata: map[string]any{
+			"type":      "phone",
+			"new_phone": req.NewPhone,
 		},
+		Success: true,
 	})
 
 	return &authv1.ChangePhoneResponse{
@@ -580,6 +996,8 @@ func (s *AuthService) ListSessions(ctx context.Context, _ *authv1.ListSessionsRe
 		return nil, err
 	}
 
+	currentJTI := s.getJTIFromContext(ctx)
+
 	sessions, err := s.repo.GetSessionsByUserID(ctx, userID)
 	if err != nil {
 		slog.ErrorContext(ctx, "failed to get sessions", "error", err, "userID", userID)
@@ -594,7 +1012,7 @@ func (s *AuthService) ListSessions(ctx context.Context, _ *authv1.ListSessionsRe
 			IpAddress:    sess.IPAddress,
 			CreatedAt:    timestamppb.New(sess.CreatedAt),
 			LastActiveAt: timestamppb.New(sess.LastActiveAt),
-			IsCurrent:    false, // TODO: compare with current session
+			IsCurrent:    sess.ID == currentJTI,
 		}
 	}
 
@@ -617,7 +1035,7 @@ func (s *AuthService) RevokeSession(ctx context.Context, req *authv1.RevokeSessi
 	// Verify the session belongs to the user
 	session, err := s.repo.GetSessionByID(ctx, req.SessionId)
 	if err != nil {
-		if errors.Is(err, sql.ErrNoRows) {
+		if errors.Is(err, pgx.ErrNoRows) {
 			return nil, status.Error(codes.NotFound, "session not found")
 		}
 
@@ -635,6 +1053,15 @@ func (s *AuthService) RevokeSession(ctx context.Context, req *authv1.RevokeSessi
 		return nil, status.Error(codes.Internal, "internal server error")
 	}
 
+	// Audit Log
+	s.audit.Log(ctx, audit.LogParams{
+		UserID:     userID,
+		Action:     "REVOKE_SESSION",
+		Resource:   ModuleName,
+		ResourceID: req.SessionId,
+		Success:    true,
+	})
+
 	return &authv1.RevokeSessionResponse{
 		Success: true,
 	}, nil
@@ -649,8 +1076,7 @@ func (s *AuthService) RevokeAllSessions(ctx context.Context, req *authv1.RevokeA
 
 	exceptSessionID := ""
 	if !req.IncludeCurrent {
-		// TODO: get current session ID from context
-		exceptSessionID = ""
+		exceptSessionID = s.getJTIFromContext(ctx)
 	}
 
 	count, err := s.repo.RevokeAllUserSessions(ctx, userID, exceptSessionID)
@@ -668,8 +1094,8 @@ func (s *AuthService) RevokeAllSessions(ctx context.Context, req *authv1.RevokeA
 func userToProto(user *store.AuthUser) *authv1.User {
 	u := &authv1.User{
 		Id:        user.ID,
-		CreatedAt: timestamppb.New(user.CreatedAt),
-		UpdatedAt: timestamppb.New(user.UpdatedAt),
+		CreatedAt: timestamppb.New(user.CreatedAt.Time),
+		UpdatedAt: timestamppb.New(user.UpdatedAt.Time),
 	}
 
 	if user.Email.Valid {
@@ -688,6 +1114,13 @@ func userToProto(user *store.AuthUser) *authv1.User {
 		u.AvatarUrl = user.AvatarUrl.String
 	}
 
+	if user.Timezone.Valid {
+		u.Timezone = user.Timezone.String
+	}
+
+	u.EmailVerified = user.EmailVerified
+	u.PhoneVerified = user.PhoneVerified
+
 	return u
 }
 
@@ -759,7 +1192,7 @@ func (s *AuthService) UnlinkExternalAccount(ctx context.Context, req *authv1.Unl
 	}
 
 	if err := s.repo.DeleteExternalAccountByProvider(ctx, userID, req.Provider); err != nil {
-		if errors.Is(err, sql.ErrNoRows) {
+		if errors.Is(err, pgx.ErrNoRows) {
 			return nil, status.Error(codes.NotFound, "external account not found")
 		}
 
@@ -804,3 +1237,20 @@ func (s *AuthService) ListLinkedAccounts(ctx context.Context, _ *authv1.ListLink
 		Accounts: protoAccounts,
 	}, nil
 }
+
+// GetSystemConfig returns public system configurations and feature flags.
+func (s *AuthService) GetSystemConfig(ctx context.Context, _ *authv1.GetSystemConfigRequest) (*authv1.GetSystemConfigResponse, error) {
+	config := make(map[string]string)
+
+	// kyc_enabled is a public feature flag
+	kycEnabled := s.feature.IsEnabled(ctx, "kyc_enabled")
+	if kycEnabled {
+		config["kyc_enabled"] = "true"
+	} else {
+		config["kyc_enabled"] = "false"
+	}
+
+	return &authv1.GetSystemConfigResponse{
+		Configs: config,
+	}, nil
+}
diff --git a/modules/auth/internal/service/service_mock_test.go b/modules/auth/internal/service/service_mock_test.go
index cd62689..9103056 100644
--- a/modules/auth/internal/service/service_mock_test.go
+++ b/modules/auth/internal/service/service_mock_test.go
@@ -8,14 +8,48 @@ import (
 	"time"
 
 	authv1 "github.com/cmelgarejo/go-modulith-template/gen/go/proto/auth/v1"
+	"github.com/cmelgarejo/go-modulith-template/internal/audit"
+	"github.com/cmelgarejo/go-modulith-template/internal/authtoken"
 	"github.com/cmelgarejo/go-modulith-template/internal/events"
+	"github.com/cmelgarejo/go-modulith-template/internal/feature"
 	"github.com/cmelgarejo/go-modulith-template/modules/auth/internal/db/store"
+	"github.com/cmelgarejo/go-modulith-template/modules/auth/internal/repository"
 	"github.com/cmelgarejo/go-modulith-template/modules/auth/internal/repository/mocks"
 	"github.com/cmelgarejo/go-modulith-template/modules/auth/internal/service"
-	"github.com/cmelgarejo/go-modulith-template/modules/auth/internal/token"
+	"github.com/jackc/pgx/v5/pgtype"
 	"go.uber.org/mock/gomock"
 )
 
+// Real-looking dummy RSA private key for tests
+const testRSAPrivateKey = `-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCgKaue+zKl57/5
+QuzzKZIm0nQe5Jopmd10ie/fB8k3nAReUwQ0aiaVws9FmeT1fylKzuLrEN4Xh0wy
+ZYrEwV0xTaxBOu708yZikVCMz1bF16mhoODBrm2+cNE0bfpxzwoFt/zyP6AigxWJ
+5XHJzJHFoaDw3334oLvaG1lkcDjfFUEKMbIk+CN2hXCbI6BSJCo989y4RPoFkZBH
+eNgKiRiHZm5ypsNEdvjItlRGM7hwtAH81v+OtdlTeWp+mlz3SCUyCagEP1Gs3L0Y
+aeoYOEA1ylpmapaDhKnobk4oFb9ujF60CGkLt/eOjt63AvQQtmAKJLK4Y0EgS7hi
+3kh9ZxDJAgMBAAECggEACx+px3jR2Ggp0wspzGxynD1zCpXWlGIXDLOFB4JebTBp
+6A7JYXlbGBaq8T4ST7yjs3B+arrfefBDKgYXmh+5GoxqLmOd86d5kh0rZFEE/IIR
+SkqTbmnWpGq1SCtrpzQTRNKcMxgyxbYN+Zq7PIh3oJH5TN49o2/ibCNvId5epmh5
+Qyvy2FhYZGhtxg3K+WApQxfeTOq/o+BbNdSUrcQaLDeKe3PS3KFykCj+dno3EiFn
+dyEwLQcP63dSoUqW6ObR634DSIRR0CNWqRyeWD0SxRbjNV9bIk/bOjJ4FrPjEuRB
+gT/LhMsD1fthTMyAyNpryxDknc2mYCrHd/ix5nEakwKBgQDMdfe0CpSbfNqix9T6
+TAasGZaXVSBJ3n4GCwFOn5KaJfPhAB64n9x82YvliWOyl5u16SgxnBj3vKGLskCP
+DXSLvQWBheZBFoPxEKsGXp2ddEFXf7zVcjG4nYz8Z0Kn5JGImhjwajcQKIVJBCvR
+vTwCWl3/9spKARs0Zue6hBd0owKBgQDIiRzDJlonRL6TCS8bJT/LBdWGIn1Syz/A
+zbssfD9Qh89TL5i7zfPcGm4Yzk+Z4zbh1/67D33GvMPr1aKnzcbR4+4+xZiVaZjl
+m0tDONGFxrZAyvbdHLJiXZBujoRO96bGsjZtyEZ+hG+MV0s+FCX7fkFWJa1+vpyv
+aAkZcrjPowKBgQCK76bRC1eMiT0w3EYXh84I6KJyV4BHcg+FH7lVqg2+/gdJYAGA
+R/FWTaZI5iF/XJKM/NE5VO+KeP31pb1E+Em4I0w4hbq/hANIrqDpBSZptnQodz7k
+dGLhJv6FDc43tJRIlR5ZUHP2YPKheVolfkfm+W1i4Fr6CuJnq33QOq6NrQKBgFml
+Oa9fiLO/PnZah61Z5H+stvxElMObSn+1OHQ1gtRMMflc8Kkb82S0h/0c1WbUtOcW
++K/EyBQ8tFTL5u+exL91Zj63dHNuhkQ2PNnrH3bvEvA6C0tjFbd1XiieGzV17h8q
+8bv36NOL/pW9PEyfEy+vDCQnqbxcF40uM8slhsqDAoGBAMGCthWkf2eG0Y4Scksf
+r/gNlU+15OnndSq0UQt2xjiy+0XQ5CVHaIyyaLiFiYjsLYdaxfOckMMrvP3RqObE
+8b9897yqs3ENFV+lJA7z/gZntQFLmlfzQadbGRuVeZfh+u7NqM4j73SRNMubEBEd
+7mlsQJQ+USaHSReSju9xmzH8
+-----END PRIVATE KEY-----`
+
 // TestRequestLogin_WithMock demonstrates using gomock to test the RequestLogin method
 func TestRequestLogin_WithMock(t *testing.T) {
 	t.Parallel()
@@ -33,10 +67,17 @@ func TestRequestLogin_WithMock(t *testing.T) {
 			mockRepo := mocks.NewMockRepository(ctrl)
 			tt.setupMock(mockRepo)
 
+			// Helper to handle WithTx
+			mockRepo.EXPECT().WithTx(gomock.Any(), gomock.Any()).DoAndReturn(func(_ context.Context, f func(repository.Repository) error) error {
+				return f(mockRepo)
+			}).AnyTimes()
+
 			// Create service with mock repository
-			tokenSvc, _ := token.NewService("test-secret-key-with-at-least-32-bytes!")
+			tokenSvc, _ := authtoken.NewService(testRSAPrivateKey)
 			bus := events.NewBus()
-			authSvc := service.NewAuthService(mockRepo, tokenSvc, bus)
+			auditLog := &audit.NoopLogger{}
+			featureMgr := feature.NewInMemoryManager()
+			authSvc := service.NewAuthService(mockRepo, tokenSvc, bus, auditLog, featureMgr, "dev")
 
 			// Execute
 			ctx := context.Background()
@@ -49,6 +90,8 @@ func TestRequestLogin_WithMock(t *testing.T) {
 }
 
 // TestCompleteLogin_WithMock demonstrates testing CompleteLogin with mocks
+//
+//nolint:funlen // Complex login flow requires comprehensive test cases
 func TestCompleteLogin_WithMock(t *testing.T) {
 	t.Parallel()
 
@@ -66,8 +109,8 @@ func TestCompleteLogin_WithMock(t *testing.T) {
 		GetValidMagicCodeByEmail(gomock.Any(), email, code).
 		Return(&store.AuthMagicCode{
 			Code:      code,
-			UserEmail: sql.NullString{String: email, Valid: true},
-			ExpiresAt: time.Now().Add(5 * time.Minute),
+			UserEmail: pgtype.Text{String: email, Valid: true},
+			ExpiresAt: pgtype.Timestamptz{Time: time.Now().Add(5 * time.Minute), Valid: true},
 		}, nil).
 		Times(1)
 
@@ -75,19 +118,41 @@ func TestCompleteLogin_WithMock(t *testing.T) {
 		GetUserByEmail(gomock.Any(), email).
 		Return(&store.AuthUser{
 			ID:    userID,
-			Email: sql.NullString{String: email, Valid: true},
+			Email: pgtype.Text{String: email, Valid: true},
 		}, nil).
 		Times(1)
 
+	// Handle WithTx for CompleteLogin
+	mockRepo.EXPECT().WithTx(gomock.Any(), gomock.Any()).DoAndReturn(func(_ context.Context, f func(repository.Repository) error) error {
+		return f(mockRepo)
+	}).Times(1)
+
 	mockRepo.EXPECT().
 		InvalidateMagicCodes(gomock.Any(), email, "").
 		Return(nil).
 		Times(1)
 
+	mockRepo.EXPECT().
+		StoreOutbox(gomock.Any(), gomock.Any(), gomock.Any()).
+		Return(nil).
+		Times(1)
+
+	mockRepo.EXPECT().
+		GetUserRole(gomock.Any(), userID).
+		Return("user", nil).
+		Times(1)
+
+	mockRepo.EXPECT().
+		CreateSession(gomock.Any(), gomock.Any()).
+		Return(nil).
+		Times(1)
+
 	// Create service
-	tokenSvc, _ := token.NewService("test-secret-key-with-at-least-32-bytes!")
+	tokenSvc, _ := authtoken.NewService(testRSAPrivateKey)
 	bus := events.NewBus()
-	authSvc := service.NewAuthService(mockRepo, tokenSvc, bus)
+	auditLog := &audit.NoopLogger{}
+	featureMgr := feature.NewInMemoryManager()
+	authSvc := service.NewAuthService(mockRepo, tokenSvc, bus, auditLog, featureMgr, "dev")
 
 	// Execute
 	ctx := context.Background()
@@ -135,27 +200,26 @@ func getRequestLoginTestCases() []struct {
 			req:  &authv1.RequestLoginRequest{ContactInfo: &authv1.RequestLoginRequest_Email{Email: "test@example.com"}},
 			setupMock: func(m *mocks.MockRepository) {
 				m.EXPECT().GetUserByEmail(gomock.Any(), "test@example.com").Return(&store.AuthUser{ID: "user-123"}, nil).Times(1)
-				m.EXPECT().CreateMagicCode(gomock.Any(), gomock.Any(), "test@example.com", "", gomock.Any()).Return(nil).Times(1)
+				m.EXPECT().CreateMagicCode(gomock.Any(), gomock.Any(), "test@example.com", "", gomock.Any()).Return(nil).AnyTimes()
+				m.EXPECT().StoreOutbox(gomock.Any(), gomock.Any(), gomock.Any()).Return(nil).AnyTimes()
 			},
 			wantErr: false,
 		},
 		{
-			name: "user not found",
+			name: "user not found (silent success)",
 			req:  &authv1.RequestLoginRequest{ContactInfo: &authv1.RequestLoginRequest_Phone{Phone: "+1234567890"}},
 			setupMock: func(m *mocks.MockRepository) {
 				m.EXPECT().GetUserByPhone(gomock.Any(), "+1234567890").Return(nil, sql.ErrNoRows).Times(1)
 			},
-			wantErr:     true,
-			errContains: "user not found",
+			wantErr: false,
 		},
 		{
-			name: "repository error on user lookup",
+			name: "repository error on user lookup (silent success)",
 			req:  &authv1.RequestLoginRequest{ContactInfo: &authv1.RequestLoginRequest_Email{Email: "test@example.com"}},
 			setupMock: func(m *mocks.MockRepository) {
 				m.EXPECT().GetUserByEmail(gomock.Any(), "test@example.com").Return(nil, errors.New("database error")).Times(1)
 			},
-			wantErr:     true,
-			errContains: "internal server error",
+			wantErr: false,
 		},
 		{
 			name: "repository error on create magic code",
diff --git a/modules/auth/internal/service/service_test.go b/modules/auth/internal/service/service_test.go
index 1bb5401..014f231 100644
--- a/modules/auth/internal/service/service_test.go
+++ b/modules/auth/internal/service/service_test.go
@@ -1,783 +1,522 @@
 package service
 
+//nolint:goconst
 import (
 	"context"
-	"database/sql"
 	"errors"
 	"testing"
 	"time"
 
 	authv1 "github.com/cmelgarejo/go-modulith-template/gen/go/proto/auth/v1"
+	"github.com/cmelgarejo/go-modulith-template/internal/audit"
+	"github.com/cmelgarejo/go-modulith-template/internal/authn"
+	"github.com/cmelgarejo/go-modulith-template/internal/authtoken"
 	"github.com/cmelgarejo/go-modulith-template/internal/events"
+	"github.com/cmelgarejo/go-modulith-template/internal/feature"
+	"github.com/cmelgarejo/go-modulith-template/internal/testutil"
 	"github.com/cmelgarejo/go-modulith-template/modules/auth/internal/db/store"
+	"github.com/cmelgarejo/go-modulith-template/modules/auth/internal/repository/mocks"
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgtype"
+	"github.com/stretchr/testify/assert"
+	"go.uber.org/mock/gomock"
+	"google.golang.org/grpc/metadata"
+
 	"github.com/cmelgarejo/go-modulith-template/modules/auth/internal/repository"
-	"github.com/cmelgarejo/go-modulith-template/modules/auth/internal/token"
-	"google.golang.org/grpc/codes"
-	"google.golang.org/grpc/status"
 )
 
-type mockRepository struct {
-	createUserFunc               func(ctx context.Context, id, email, phone string) error
-	getUserByEmailFunc           func(ctx context.Context, email string) (*store.AuthUser, error)
-	getUserByPhoneFunc           func(ctx context.Context, phone string) (*store.AuthUser, error)
-	createMagicCodeFunc          func(ctx context.Context, code, email, phone string, expiresAt time.Time) error
-	getValidMagicCodeByEmailFunc func(ctx context.Context, email, code string) (*store.AuthMagicCode, error)
-	getValidMagicCodeByPhoneFunc func(ctx context.Context, phone, code string) (*store.AuthMagicCode, error)
-	invalidateMagicCodesFunc     func(ctx context.Context, email, phone string) error
-}
-
-func (m *mockRepository) WithTx(_ context.Context, fn func(repository.Repository) error) error {
-	return fn(m)
-}
-
-func (m *mockRepository) CreateUser(ctx context.Context, id, email, phone string) error {
-	if m.createUserFunc != nil {
-		return m.createUserFunc(ctx, id, email, phone)
-	}
-
-	return nil
-}
-
-func (m *mockRepository) GetUserByEmail(ctx context.Context, email string) (*store.AuthUser, error) {
-	if m.getUserByEmailFunc != nil {
-		return m.getUserByEmailFunc(ctx, email)
-	}
-
-	return &store.AuthUser{ID: "user-123", Email: sql.NullString{String: email, Valid: true}}, nil
-}
-
-func (m *mockRepository) GetUserByPhone(ctx context.Context, phone string) (*store.AuthUser, error) {
-	if m.getUserByPhoneFunc != nil {
-		return m.getUserByPhoneFunc(ctx, phone)
-	}
-
-	return &store.AuthUser{ID: "user-123", Phone: sql.NullString{String: phone, Valid: true}}, nil
-}
-
-func (m *mockRepository) CreateMagicCode(ctx context.Context, code, email, phone string, expiresAt time.Time) error {
-	if m.createMagicCodeFunc != nil {
-		return m.createMagicCodeFunc(ctx, code, email, phone, expiresAt)
-	}
-
-	return nil
-}
-
-func (m *mockRepository) GetValidMagicCodeByEmail(ctx context.Context, email, code string) (*store.AuthMagicCode, error) {
-	if m.getValidMagicCodeByEmailFunc != nil {
-		return m.getValidMagicCodeByEmailFunc(ctx, email, code)
-	}
-
-	return &store.AuthMagicCode{Code: code, UserEmail: sql.NullString{String: email, Valid: true}}, nil
-}
-
-func (m *mockRepository) GetValidMagicCodeByPhone(ctx context.Context, phone, code string) (*store.AuthMagicCode, error) {
-	if m.getValidMagicCodeByPhoneFunc != nil {
-		return m.getValidMagicCodeByPhoneFunc(ctx, phone, code)
-	}
-
-	return &store.AuthMagicCode{Code: code, UserPhone: sql.NullString{String: phone, Valid: true}}, nil
-}
-
-func (m *mockRepository) InvalidateMagicCodes(ctx context.Context, email, phone string) error {
-	if m.invalidateMagicCodesFunc != nil {
-		return m.invalidateMagicCodesFunc(ctx, email, phone)
-	}
-
-	return nil
-}
-
-func createTestService(t *testing.T, repo *mockRepository) *AuthService {
-	t.Helper()
-
-	tokenService, err := token.NewService("test-secret-key-that-is-at-least-32-bytes-long")
-	if err != nil {
-		t.Fatalf("failed to create token service: %v", err)
-	}
-
-	bus := events.NewBus()
-
-	return NewAuthService(repo, tokenService, bus)
-}
-
-func TestNewAuthService(t *testing.T) {
-	repo := &mockRepository{}
-	svc := createTestService(t, repo)
-
-	if svc == nil {
-		t.Fatal("expected service to not be nil")
-	}
-
-	if svc.repo == nil {
-		t.Error("expected service to have repository")
-	}
-}
-
-func TestRequestLogin_Success_Email(t *testing.T) {
-	repo := &mockRepository{}
-	svc := createTestService(t, repo)
-
-	req := &authv1.RequestLoginRequest{
-		ContactInfo: &authv1.RequestLoginRequest_Email{Email: "user@example.com"},
-	}
-
-	resp, err := svc.RequestLogin(context.Background(), req)
-	if err != nil {
-		t.Fatalf("expected no error, got %v", err)
-	}
-
-	if !resp.Success {
-		t.Error("expected success to be true")
-	}
-
-	if resp.Message != "Magic code sent" {
-		t.Errorf("expected message 'Magic code sent', got %s", resp.Message)
-	}
-}
-
-func TestRequestLogin_Success_Phone(t *testing.T) {
-	repo := &mockRepository{}
-	svc := createTestService(t, repo)
-
-	req := &authv1.RequestLoginRequest{
-		ContactInfo: &authv1.RequestLoginRequest_Phone{Phone: "+1234567890"},
-	}
-
-	resp, err := svc.RequestLogin(context.Background(), req)
-	if err != nil {
-		t.Fatalf("expected no error, got %v", err)
-	}
-
-	if !resp.Success {
-		t.Error("expected success to be true")
-	}
-}
-
-func TestRequestLogin_UserNotFound(t *testing.T) {
-	repo := &mockRepository{
-		getUserByEmailFunc: func(_ context.Context, _ string) (*store.AuthUser, error) {
-			return nil, sql.ErrNoRows
+const testUserID = "user_1"
+
+//nolint:funlen
+func TestAuthService_RequestLogin(t *testing.T) {
+	tests := []struct {
+		name          string
+		req           *authv1.RequestLoginRequest
+		setup         func(*mocks.MockRepository)
+		expectedError string
+		checkResponse func(*testing.T, *authv1.RequestLoginResponse)
+	}{
+		{
+			name: "Success Email",
+			req: &authv1.RequestLoginRequest{
+				ContactInfo: &authv1.RequestLoginRequest_Email{Email: "user@example.com"},
+			},
+			setup: func(mRepo *mocks.MockRepository) {
+				mRepo.EXPECT().GetUserByEmail(gomock.Any(), "user@example.com").Return(&store.AuthUser{ID: testUserID}, nil)
+				mRepo.EXPECT().CreateMagicCode(gomock.Any(), gomock.Any(), "user@example.com", "", gomock.Any()).Return(nil)
+			},
+			checkResponse: func(t *testing.T, resp *authv1.RequestLoginResponse) {
+				assert.True(t, resp.Success)
+				assert.Equal(t, "If an account exists with this email, you will receive a verification code", resp.Message)
+			},
 		},
-	}
-	svc := createTestService(t, repo)
-
-	req := &authv1.RequestLoginRequest{
-		ContactInfo: &authv1.RequestLoginRequest_Email{Email: "nonexistent@example.com"},
-	}
-
-	_, err := svc.RequestLogin(context.Background(), req)
-	if err == nil {
-		t.Fatal("expected error when user not found")
-	}
-
-	// Check that it's a NotFound error
-	st, ok := status.FromError(err)
-	if !ok {
-		t.Fatal("expected status error")
-	}
-
-	if st.Code() != codes.NotFound {
-		t.Errorf("expected NotFound error, got %v", st.Code())
-	}
-}
-
-func TestRequestLogin_CreateMagicCodeError(t *testing.T) {
-	repo := &mockRepository{
-		createMagicCodeFunc: func(_ context.Context, _, _, _ string, _ time.Time) error {
-			return errors.New("database error")
+		{
+			name: "Success Phone",
+			req: &authv1.RequestLoginRequest{
+				ContactInfo: &authv1.RequestLoginRequest_Phone{Phone: "+1234567890"},
+			},
+			setup: func(mRepo *mocks.MockRepository) {
+				mRepo.EXPECT().GetUserByPhone(gomock.Any(), "+1234567890").Return(&store.AuthUser{ID: testUserID}, nil)
+				mRepo.EXPECT().CreateMagicCode(gomock.Any(), gomock.Any(), "", "+1234567890", gomock.Any()).Return(nil)
+			},
+			checkResponse: func(t *testing.T, resp *authv1.RequestLoginResponse) {
+				assert.True(t, resp.Success)
+			},
 		},
-	}
-	svc := createTestService(t, repo)
-
-	req := &authv1.RequestLoginRequest{
-		ContactInfo: &authv1.RequestLoginRequest_Email{Email: "user@example.com"},
-	}
-
-	_, err := svc.RequestLogin(context.Background(), req)
-	if err == nil {
-		t.Fatal("expected error when create magic code fails")
-	}
-}
-
-func TestCompleteLogin_Success_ExistingUser(t *testing.T) {
-	repo := &mockRepository{
-		getValidMagicCodeByEmailFunc: func(_ context.Context, _, code string) (*store.AuthMagicCode, error) {
-			return &store.AuthMagicCode{Code: code}, nil
+		{
+			name: "User Not Found (Silent Success)",
+			req: &authv1.RequestLoginRequest{
+				ContactInfo: &authv1.RequestLoginRequest_Email{Email: "missing@example.com"},
+			},
+			setup: func(mRepo *mocks.MockRepository) {
+				mRepo.EXPECT().GetUserByEmail(gomock.Any(), "missing@example.com").Return(nil, pgx.ErrNoRows)
+				// CreateMagicCode should NOT be called
+			},
+			checkResponse: func(t *testing.T, resp *authv1.RequestLoginResponse) {
+				assert.True(t, resp.Success)
+			},
 		},
-		getUserByEmailFunc: func(_ context.Context, email string) (*store.AuthUser, error) {
-			return &store.AuthUser{
-				ID:    "user-123",
-				Email: sql.NullString{String: email, Valid: true},
-			}, nil
+		{
+			name: "DB Error on Create Magic Code",
+			req: &authv1.RequestLoginRequest{
+				ContactInfo: &authv1.RequestLoginRequest_Email{Email: "user@example.com"},
+			},
+			setup: func(mRepo *mocks.MockRepository) {
+				mRepo.EXPECT().GetUserByEmail(gomock.Any(), "user@example.com").Return(&store.AuthUser{ID: testUserID}, nil)
+				mRepo.EXPECT().CreateMagicCode(gomock.Any(), gomock.Any(), "user@example.com", "", gomock.Any()).Return(errors.New("db error"))
+			},
+			expectedError: "internal server error",
 		},
 	}
-	svc := createTestService(t, repo)
 
-	req := &authv1.CompleteLoginRequest{
-		ContactInfo: &authv1.CompleteLoginRequest_Email{Email: "user@example.com"},
-		Code:        "123456",
-	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ctrl := gomock.NewController(t)
+			defer ctrl.Finish()
 
-	resp, err := svc.CompleteLogin(context.Background(), req)
-	if err != nil {
-		t.Fatalf("expected no error, got %v", err)
-	}
+			mRepo := mocks.NewMockRepository(ctrl)
+			mRepo.EXPECT().WithTx(gomock.Any(), gomock.Any()).DoAndReturn(func(_ context.Context, fn func(repository.Repository) error) error {
+				return fn(mRepo)
+			}).AnyTimes()
+			mRepo.EXPECT().StoreOutbox(gomock.Any(), gomock.Any(), gomock.Any()).Return(nil).AnyTimes()
 
-	if resp.AccessToken == "" {
-		t.Error("expected access token to not be empty")
-	}
+			tokenSvc, _ := authtoken.NewService(testutil.TestJWTPrivateKeyPEM)
+			bus := events.NewBus()
+			auditLog := &audit.NoopLogger{}
+			flags := feature.NewInMemoryManager()
 
-	if resp.RefreshToken == "" {
-		t.Error("expected refresh token to not be empty")
-	}
-
-	if resp.ExpiresIn != 3600 {
-		t.Errorf("expected expires in 3600, got %d", resp.ExpiresIn)
-	}
-}
-
-func TestCompleteLogin_Success_NewUser(t *testing.T) {
-	var createdUserID string
-
-	repo := &mockRepository{
-		getValidMagicCodeByEmailFunc: func(_ context.Context, _, code string) (*store.AuthMagicCode, error) {
-			return &store.AuthMagicCode{Code: code}, nil
-		},
-		getUserByEmailFunc: func(_ context.Context, email string) (*store.AuthUser, error) {
-			// First call returns not found, simulating new user
-			if createdUserID == "" {
-				return nil, sql.ErrNoRows
+			if tt.setup != nil {
+				tt.setup(mRepo)
 			}
 
-			// After user creation, return the new user
-			return &store.AuthUser{
-				ID:    createdUserID,
-				Email: sql.NullString{String: email, Valid: true},
-			}, nil
-		},
-		createUserFunc: func(_ context.Context, id, _, _ string) error {
-			createdUserID = id
-			return nil
-		},
-	}
-	svc := createTestService(t, repo)
-
-	req := &authv1.CompleteLoginRequest{
-		ContactInfo: &authv1.CompleteLoginRequest_Email{Email: "newuser@example.com"},
-		Code:        "123456",
-	}
-
-	resp, err := svc.CompleteLogin(context.Background(), req)
-	if err != nil {
-		t.Fatalf("expected no error, got %v", err)
-	}
-
-	if resp.AccessToken == "" {
-		t.Error("expected access token to not be empty")
-	}
-
-	if createdUserID == "" {
-		t.Error("expected user to be created")
-	}
-}
+			svc := NewAuthService(mRepo, tokenSvc, bus, auditLog, flags, "dev")
 
-func TestCompleteLogin_MissingEmailAndPhone(t *testing.T) {
-	repo := &mockRepository{}
-	svc := createTestService(t, repo)
+			resp, err := svc.RequestLogin(context.Background(), tt.req)
 
-	req := &authv1.CompleteLoginRequest{
-		Code: "123456",
-	}
+			if tt.expectedError != "" {
+				assert.Error(t, err)
+				assert.Contains(t, err.Error(), tt.expectedError)
+			} else {
+				assert.NoError(t, err)
 
-	_, err := svc.CompleteLogin(context.Background(), req)
-	if err == nil {
-		t.Fatal("expected error when both email and phone are missing")
-	}
-}
-
-func TestCompleteLogin_InvalidMagicCode(t *testing.T) {
-	repo := &mockRepository{
-		getValidMagicCodeByEmailFunc: func(_ context.Context, _, _ string) (*store.AuthMagicCode, error) {
-			return nil, sql.ErrNoRows
+				if tt.checkResponse != nil {
+					tt.checkResponse(t, resp)
+				}
+			}
+		})
+	}
+}
+
+//nolint:funlen
+func TestAuthService_CompleteLogin(t *testing.T) {
+	tests := []struct {
+		name          string
+		req           *authv1.CompleteLoginRequest
+		setup         func(*mocks.MockRepository)
+		expectedError string
+	}{
+		{
+			name: "Success Existing User",
+			req: &authv1.CompleteLoginRequest{
+				ContactInfo: &authv1.CompleteLoginRequest_Email{Email: "user@example.com"},
+				Code:        "123456",
+			},
+			setup: func(mRepo *mocks.MockRepository) {
+				mRepo.EXPECT().GetValidMagicCodeByEmail(gomock.Any(), "user@example.com", "123456").
+					Return(&store.AuthMagicCode{Code: "123456"}, nil)
+
+				mRepo.EXPECT().GetUserByEmail(gomock.Any(), "user@example.com").
+					Return(&store.AuthUser{
+						ID:    testUserID,
+						Email: pgtype.Text{String: "user@example.com", Valid: true},
+					}, nil)
+
+				mRepo.EXPECT().GetUserRole(gomock.Any(), testUserID).Return("user", nil)
+
+				mRepo.EXPECT().InvalidateMagicCodes(gomock.Any(), "user@example.com", "").Return(nil)
+
+				mRepo.EXPECT().CreateSession(gomock.Any(), gomock.Any()).Return(nil)
+			},
 		},
-	}
-	svc := createTestService(t, repo)
-
-	req := &authv1.CompleteLoginRequest{
-		ContactInfo: &authv1.CompleteLoginRequest_Email{Email: "user@example.com"},
-		Code:        "wrong-code",
-	}
-
-	_, err := svc.CompleteLogin(context.Background(), req)
-	if err == nil {
-		t.Fatal("expected error for invalid magic code")
-	}
-}
-
-func TestCompleteLogin_WithPhone(t *testing.T) {
-	repo := &mockRepository{
-		getValidMagicCodeByPhoneFunc: func(_ context.Context, _, code string) (*store.AuthMagicCode, error) {
-			return &store.AuthMagicCode{Code: code}, nil
+		{
+			name: "New User (Blocked)",
+			req: &authv1.CompleteLoginRequest{
+				ContactInfo: &authv1.CompleteLoginRequest_Email{Email: "new@example.com"},
+				Code:        "123456",
+			},
+			setup: func(mRepo *mocks.MockRepository) {
+				mRepo.EXPECT().GetValidMagicCodeByEmail(gomock.Any(), "new@example.com", "123456").
+					Return(&store.AuthMagicCode{Code: "123456"}, nil)
+
+				// Check returns not found
+				mRepo.EXPECT().GetUserByEmail(gomock.Any(), "new@example.com").
+					Return(nil, pgx.ErrNoRows)
+			},
+			expectedError: "user not found",
 		},
-		getUserByPhoneFunc: func(_ context.Context, phone string) (*store.AuthUser, error) {
-			return &store.AuthUser{
-				ID:    "user-456",
-				Phone: sql.NullString{String: phone, Valid: true},
-			}, nil
+		{
+			name: "Invalid Code",
+			req: &authv1.CompleteLoginRequest{
+				ContactInfo: &authv1.CompleteLoginRequest_Email{Email: "user@example.com"},
+				Code:        "wrong",
+			},
+			setup: func(mRepo *mocks.MockRepository) {
+				mRepo.EXPECT().GetValidMagicCodeByEmail(gomock.Any(), "user@example.com", "wrong").
+					Return(nil, pgx.ErrNoRows)
+			},
+			expectedError: "invalid or expired code",
 		},
 	}
-	svc := createTestService(t, repo)
 
-	req := &authv1.CompleteLoginRequest{
-		ContactInfo: &authv1.CompleteLoginRequest_Phone{Phone: "+1234567890"},
-		Code:        "123456",
-	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ctrl := gomock.NewController(t)
+			defer ctrl.Finish()
 
-	resp, err := svc.CompleteLogin(context.Background(), req)
-	if err != nil {
-		t.Fatalf("expected no error, got %v", err)
-	}
+			mRepo := mocks.NewMockRepository(ctrl)
+			mRepo.EXPECT().WithTx(gomock.Any(), gomock.Any()).DoAndReturn(func(_ context.Context, fn func(repository.Repository) error) error {
+				return fn(mRepo)
+			}).AnyTimes()
+			mRepo.EXPECT().StoreOutbox(gomock.Any(), gomock.Any(), gomock.Any()).Return(nil).AnyTimes()
 
-	if resp.AccessToken == "" {
-		t.Error("expected access token to not be empty")
-	}
-}
-
-func TestGenerateRandomCode(t *testing.T) {
-	t.Run("generates 6 digit code", func(t *testing.T) {
-		testGenerateSixDigitCode(t)
-	})
-
-	t.Run("generates different codes", func(t *testing.T) {
-		testGeneratesDifferentCodes(t)
-	})
-
-	t.Run("generates different lengths", func(t *testing.T) {
-		testGeneratesDifferentLengths(t)
-	})
-}
-
-func testGenerateSixDigitCode(t *testing.T) {
-	t.Helper()
-
-	code, err := generateRandomCode(6)
-	if err != nil {
-		t.Fatalf("expected no error, got %v", err)
-	}
+			tokenSvc, _ := authtoken.NewService(testutil.TestJWTPrivateKeyPEM)
+			bus := events.NewBus()
+			auditLog := &audit.NoopLogger{}
+			flags := feature.NewInMemoryManager()
 
-	if len(code) != 6 {
-		t.Errorf("expected code length 6, got %d", len(code))
-	}
+			if tt.setup != nil {
+				tt.setup(mRepo)
+			}
 
-	// Verify all characters are digits
-	for _, c := range code {
-		if c < '0' || c > '9' {
-			t.Errorf("expected all digits, got character %c", c)
-		}
-	}
-}
+			svc := NewAuthService(mRepo, tokenSvc, bus, auditLog, flags, "dev")
 
-func testGeneratesDifferentCodes(t *testing.T) {
-	t.Helper()
+			resp, err := svc.CompleteLogin(context.Background(), tt.req)
 
-	code1, err := generateRandomCode(6)
-	if err != nil {
-		t.Fatalf("expected no error, got %v", err)
+			if tt.expectedError != "" {
+				assert.Error(t, err)
+				assert.Contains(t, err.Error(), tt.expectedError)
+			} else {
+				assert.NoError(t, err)
+				assert.NotEmpty(t, resp.AccessToken)
+			}
+		})
+	}
+}
+
+func TestAuthService_Logout(t *testing.T) {
+	tests := []struct {
+		name          string
+		token         string
+		setup         func(*mocks.MockRepository)
+		expectedError string
+	}{
+		{
+			name:  "Success",
+			token: "valid-token",
+			setup: func(mRepo *mocks.MockRepository) {
+				mRepo.EXPECT().BlacklistToken(gomock.Any(), gomock.Any(), gomock.Any(), "logout", gomock.Any()).Return(nil)
+			},
+		},
 	}
 
-	code2, err := generateRandomCode(6)
-	if err != nil {
-		t.Fatalf("expected no error, got %v", err)
-	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ctrl := gomock.NewController(t)
+			defer ctrl.Finish()
 
-	// While it's theoretically possible for two random codes to be the same,
-	// it's extremely unlikely (1 in 1,000,000 chance)
-	// We test this to ensure randomness is working
-	if code1 == code2 {
-		t.Log("Warning: generated identical codes (very unlikely but possible)")
-	}
-}
+			mRepo := mocks.NewMockRepository(ctrl)
+			mRepo.EXPECT().WithTx(gomock.Any(), gomock.Any()).DoAndReturn(func(_ context.Context, fn func(repository.Repository) error) error {
+				return fn(mRepo)
+			}).AnyTimes()
+			mRepo.EXPECT().StoreOutbox(gomock.Any(), gomock.Any(), gomock.Any()).Return(nil).AnyTimes()
 
-func testGeneratesDifferentLengths(t *testing.T) {
-	t.Helper()
+			tokenSvc, _ := authtoken.NewService(testutil.TestJWTPrivateKeyPEM)
+			bus := events.NewBus()
+			auditLog := &audit.NoopLogger{}
+			flags := feature.NewInMemoryManager()
 
-	for length := 1; length <= 10; length++ {
-		code, err := generateRandomCode(length)
-		if err != nil {
-			t.Fatalf("expected no error for length %d, got %v", length, err)
-		}
+			if tt.setup != nil {
+				tt.setup(mRepo)
+			}
 
-		if len(code) != length {
-			t.Errorf("expected code length %d, got %d", length, len(code))
-		}
-	}
-}
+			svc := NewAuthService(mRepo, tokenSvc, bus, auditLog, flags, "dev")
+
+			// Mock context with token
+			// We inject user claims via middleware usually, but Logout parses the token.
+			// Since we use a real token service, we can't easily generate a valid token that passes verification
+			// unless we generate one first.
+			// However, Logout logic parses token TO blacklist it.
+			// If verification fails, it proceeds to blacklist anyway (best effort) in some implementations,
+			// or fails.
+			// Looking at implementation:
+			// claims, err := s.tokenService.VerifyAccessToken(token)
+			// if err != nil { return ... }
+
+			// So we need a valid token.
+			validToken, _, err := tokenSvc.CreateToken(testUserID, "user", 1*time.Hour)
+			if err != nil {
+				t.Fatalf("failed to create token: %v", err)
+			}
 
-func TestCompleteLogin_DatabaseError(t *testing.T) {
-	repo := &mockRepository{
-		getValidMagicCodeByEmailFunc: func(_ context.Context, _, _ string) (*store.AuthMagicCode, error) {
-			return nil, errors.New("database connection error")
-		},
-	}
-	svc := createTestService(t, repo)
+			// Add metadata (token)
+			mdCtx := metadata.NewIncomingContext(context.Background(), metadata.New(map[string]string{"authorization": "Bearer " + validToken}))
+			// Add claims (user_id)
+			ctx := authn.ContextWithClaims(mdCtx, authn.Claims{UserID: testUserID, Role: "user"})
 
-	req := &authv1.CompleteLoginRequest{
-		ContactInfo: &authv1.CompleteLoginRequest_Email{Email: "user@example.com"},
-		Code:        "123456",
-	}
+			// Ensure token is valid (nbf)
+			time.Sleep(1 * time.Second)
 
-	_, err := svc.CompleteLogin(context.Background(), req)
-	if err == nil {
-		t.Fatal("expected error when database fails")
-	}
-}
+			_, err = svc.Logout(ctx, &authv1.LogoutRequest{})
 
-func TestCompleteLogin_GetUserError(t *testing.T) {
-	repo := &mockRepository{
-		getValidMagicCodeByEmailFunc: func(_ context.Context, _, code string) (*store.AuthMagicCode, error) {
-			return &store.AuthMagicCode{Code: code}, nil
+			if tt.expectedError != "" {
+				assert.Error(t, err)
+			} else {
+				assert.NoError(t, err)
+			}
+		})
+	}
+}
+
+func TestAuthService_GetProfile(t *testing.T) {
+	userID := testUserID //nolint:goconst
+	tests := []struct {
+		name          string
+		setup         func(*mocks.MockRepository)
+		ctx           context.Context
+		expectedError string
+	}{
+		{
+			name: "Success",
+			ctx:  authn.ContextWithClaims(context.Background(), authn.Claims{UserID: userID}),
+			setup: func(mRepo *mocks.MockRepository) {
+				mRepo.EXPECT().GetUserByID(gomock.Any(), userID).Return(&store.AuthUser{
+					ID:    userID,
+					Email: pgtype.Text{String: "test@example.com", Valid: true},
+				}, nil)
+			},
 		},
-		getUserByEmailFunc: func(_ context.Context, _ string) (*store.AuthUser, error) {
-			return nil, errors.New("database error fetching user")
+		{
+			name: "User Not Found",
+			ctx:  authn.ContextWithClaims(context.Background(), authn.Claims{UserID: userID}),
+			setup: func(mRepo *mocks.MockRepository) {
+				mRepo.EXPECT().GetUserByID(gomock.Any(), userID).Return(nil, pgx.ErrNoRows)
+			},
+			expectedError: "user not found", // or whatever implicit error map returns, checking status usually
 		},
 	}
-	svc := createTestService(t, repo)
 
-	req := &authv1.CompleteLoginRequest{
-		ContactInfo: &authv1.CompleteLoginRequest_Email{Email: "user@example.com"},
-		Code:        "123456",
-	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ctrl := gomock.NewController(t)
+			defer ctrl.Finish()
 
-	_, err := svc.CompleteLogin(context.Background(), req)
-	if err == nil {
-		t.Fatal("expected error when fetching user fails")
-	}
-}
+			mRepo := mocks.NewMockRepository(ctrl)
+			mRepo.EXPECT().WithTx(gomock.Any(), gomock.Any()).DoAndReturn(func(_ context.Context, fn func(repository.Repository) error) error {
+				return fn(mRepo)
+			}).AnyTimes()
+			mRepo.EXPECT().StoreOutbox(gomock.Any(), gomock.Any(), gomock.Any()).Return(nil).AnyTimes()
 
-func TestCompleteLogin_NewUser_WithPhone(t *testing.T) {
-	var createdUserID string
+			tokenSvc, _ := authtoken.NewService(testutil.TestJWTPrivateKeyPEM)
+			svc := NewAuthService(mRepo, tokenSvc, events.NewBus(), &audit.NoopLogger{}, feature.NewInMemoryManager(), "dev")
 
-	repo := &mockRepository{
-		getValidMagicCodeByPhoneFunc: func(_ context.Context, _, code string) (*store.AuthMagicCode, error) {
-			return &store.AuthMagicCode{Code: code}, nil
-		},
-		getUserByPhoneFunc: func(_ context.Context, phone string) (*store.AuthUser, error) {
-			if createdUserID == "" {
-				return nil, sql.ErrNoRows
+			if tt.setup != nil {
+				tt.setup(mRepo)
 			}
 
-			return &store.AuthUser{
-				ID:    createdUserID,
-				Phone: sql.NullString{String: phone, Valid: true},
-			}, nil
-		},
-		createUserFunc: func(_ context.Context, id, _, _ string) error {
-			createdUserID = id
-			return nil
-		},
-	}
-	svc := createTestService(t, repo)
-
-	req := &authv1.CompleteLoginRequest{
-		ContactInfo: &authv1.CompleteLoginRequest_Phone{Phone: "+1234567890"},
-		Code:        "123456",
-	}
+			resp, err := svc.GetProfile(tt.ctx, &authv1.GetProfileRequest{})
 
-	resp, err := svc.CompleteLogin(context.Background(), req)
-	if err != nil {
-		t.Fatalf("expected no error, got %v", err)
-	}
-
-	if resp.AccessToken == "" {
-		t.Error("expected access token to not be empty")
-	}
-
-	if createdUserID == "" {
-		t.Error("expected user to be created")
-	}
-}
-
-func TestCompleteLogin_CreateUserError(t *testing.T) {
-	repo := &mockRepository{
-		getValidMagicCodeByEmailFunc: func(_ context.Context, _, code string) (*store.AuthMagicCode, error) {
-			return &store.AuthMagicCode{Code: code}, nil
-		},
-		getUserByEmailFunc: func(_ context.Context, _ string) (*store.AuthUser, error) {
-			return nil, sql.ErrNoRows
+			if tt.expectedError != "" {
+				assert.Error(t, err)
+				// Basic check, might be status error
+			} else {
+				assert.NoError(t, err)
+				assert.Equal(t, userID, resp.User.Id)
+			}
+		})
+	}
+}
+
+//nolint:funlen
+func TestAuthService_UpdateProfile(t *testing.T) {
+	userID := testUserID
+	tests := []struct {
+		name          string
+		req           *authv1.UpdateProfileRequest
+		setup         func(*mocks.MockRepository)
+		ctx           context.Context
+		expectedError string
+	}{
+		{
+			name: "Success",
+			req: &authv1.UpdateProfileRequest{
+				DisplayName: "New Name",
+				AvatarUrl:   "http://avatar.com",
+			},
+			ctx: authn.ContextWithClaims(context.Background(), authn.Claims{UserID: userID}),
+			setup: func(mRepo *mocks.MockRepository) {
+				mRepo.EXPECT().UpdateUserProfile(gomock.Any(), userID, "New Name", "http://avatar.com", "").Return(nil)
+				mRepo.EXPECT().GetUserByID(gomock.Any(), userID).Return(&store.AuthUser{
+					ID:          userID,
+					DisplayName: pgtype.Text{String: "New Name", Valid: true},
+				}, nil)
+			},
 		},
-		createUserFunc: func(_ context.Context, _, _, _ string) error {
-			return errors.New("failed to create user")
+		{
+			name: "WithTimezone",
+			req: &authv1.UpdateProfileRequest{
+				DisplayName: "New Name",
+				Timezone:    "America/New_York",
+			},
+			ctx: authn.ContextWithClaims(context.Background(), authn.Claims{UserID: userID}),
+			setup: func(mRepo *mocks.MockRepository) {
+				mRepo.EXPECT().UpdateUserProfile(gomock.Any(), userID, "New Name", "", "America/New_York").Return(nil)
+				mRepo.EXPECT().GetUserByID(gomock.Any(), userID).Return(&store.AuthUser{
+					ID:          userID,
+					DisplayName: pgtype.Text{String: "New Name", Valid: true},
+					Timezone:    pgtype.Text{String: "America/New_York", Valid: true},
+				}, nil)
+			},
 		},
 	}
-	svc := createTestService(t, repo)
 
-	req := &authv1.CompleteLoginRequest{
-		ContactInfo: &authv1.CompleteLoginRequest_Email{Email: "newuser@example.com"},
-		Code:        "123456",
-	}
-
-	_, err := svc.CompleteLogin(context.Background(), req)
-	if err == nil {
-		t.Fatal("expected error when user creation fails")
-	}
-}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ctrl := gomock.NewController(t)
+			defer ctrl.Finish()
 
-func TestCompleteLogin_FetchUserAfterCreateError(t *testing.T) {
-	callCount := 0
+			mRepo := mocks.NewMockRepository(ctrl)
+			mRepo.EXPECT().WithTx(gomock.Any(), gomock.Any()).DoAndReturn(func(_ context.Context, fn func(repository.Repository) error) error {
+				return fn(mRepo)
+			}).AnyTimes()
+			mRepo.EXPECT().StoreOutbox(gomock.Any(), gomock.Any(), gomock.Any()).Return(nil).AnyTimes()
+			svc := NewAuthService(mRepo, nil, events.NewBus(), &audit.NoopLogger{}, nil, "dev")
 
-	repo := &mockRepository{
-		getValidMagicCodeByEmailFunc: func(_ context.Context, _, code string) (*store.AuthMagicCode, error) {
-			return &store.AuthMagicCode{Code: code}, nil
-		},
-		getUserByEmailFunc: func(_ context.Context, _ string) (*store.AuthUser, error) {
-			callCount++
-			if callCount == 1 {
-				return nil, sql.ErrNoRows
+			if tt.setup != nil {
+				tt.setup(mRepo)
 			}
 
-			return nil, errors.New("failed to fetch after create")
-		},
-		createUserFunc: func(_ context.Context, _, _, _ string) error {
-			return nil
-		},
-	}
-	svc := createTestService(t, repo)
-
-	req := &authv1.CompleteLoginRequest{
-		ContactInfo: &authv1.CompleteLoginRequest_Email{Email: "newuser@example.com"},
-		Code:        "123456",
-	}
-
-	_, err := svc.CompleteLogin(context.Background(), req)
-	if err == nil {
-		t.Fatal("expected error when fetching user after creation fails")
-	}
-}
+			resp, err := svc.UpdateProfile(tt.ctx, tt.req)
 
-func TestCompleteLogin_FetchUserByPhoneAfterCreateError(t *testing.T) {
-	callCount := 0
-
-	repo := &mockRepository{
-		getValidMagicCodeByPhoneFunc: func(_ context.Context, _, code string) (*store.AuthMagicCode, error) {
-			return &store.AuthMagicCode{Code: code}, nil
-		},
-		getUserByPhoneFunc: func(_ context.Context, _ string) (*store.AuthUser, error) {
-			callCount++
-			if callCount == 1 {
-				return nil, sql.ErrNoRows
+			if tt.expectedError != "" {
+				assert.Error(t, err)
+			} else {
+				assert.NoError(t, err)
+				assert.Equal(t, "New Name", resp.User.DisplayName)
 			}
-
-			return nil, errors.New("failed to fetch after create")
-		},
-		createUserFunc: func(_ context.Context, _, _, _ string) error {
-			return nil
+		})
+	}
+}
+
+func TestAuthService_ChangeEmail(t *testing.T) {
+	userID := testUserID
+	tests := []struct {
+		name          string
+		req           *authv1.ChangeEmailRequest
+		setup         func(*mocks.MockRepository)
+		ctx           context.Context
+		expectedError string
+	}{
+		{
+			name: "Success",
+			req:  &authv1.ChangeEmailRequest{NewEmail: "new@example.com"},
+			ctx:  authn.ContextWithClaims(context.Background(), authn.Claims{UserID: userID}),
+			setup: func(mRepo *mocks.MockRepository) {
+				mRepo.EXPECT().CreatePendingContactChange(gomock.Any(), gomock.Any(), userID, "email", "new@example.com", gomock.Any(), gomock.Any()).Return(nil)
+			},
 		},
 	}
-	svc := createTestService(t, repo)
 
-	req := &authv1.CompleteLoginRequest{
-		ContactInfo: &authv1.CompleteLoginRequest_Phone{Phone: "+1234567890"},
-		Code:        "123456",
-	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ctrl := gomock.NewController(t)
+			defer ctrl.Finish()
 
-	_, err := svc.CompleteLogin(context.Background(), req)
-	if err == nil {
-		t.Fatal("expected error when fetching user by phone after creation fails")
-	}
-}
+			mRepo := mocks.NewMockRepository(ctrl)
+			mRepo.EXPECT().WithTx(gomock.Any(), gomock.Any()).DoAndReturn(func(_ context.Context, fn func(repository.Repository) error) error {
+				return fn(mRepo)
+			}).AnyTimes()
+			mRepo.EXPECT().StoreOutbox(gomock.Any(), gomock.Any(), gomock.Any()).Return(nil).AnyTimes()
+			svc := NewAuthService(mRepo, nil, events.NewBus(), &audit.NoopLogger{}, nil, "dev")
 
-func TestCompleteLogin_InvalidateMagicCodesError(t *testing.T) {
-	repo := &mockRepository{
-		getValidMagicCodeByEmailFunc: func(_ context.Context, _, code string) (*store.AuthMagicCode, error) {
-			return &store.AuthMagicCode{Code: code}, nil
-		},
-		getUserByEmailFunc: func(_ context.Context, email string) (*store.AuthUser, error) {
-			return &store.AuthUser{
-				ID:    "user-123",
-				Email: sql.NullString{String: email, Valid: true},
-			}, nil
-		},
-		invalidateMagicCodesFunc: func(_ context.Context, _, _ string) error {
-			return errors.New("failed to invalidate codes")
-		},
-	}
-	svc := createTestService(t, repo)
-
-	req := &authv1.CompleteLoginRequest{
-		ContactInfo: &authv1.CompleteLoginRequest_Email{Email: "user@example.com"},
-		Code:        "123456",
-	}
-
-	// Should still succeed even if invalidation fails (it's logged but not fatal)
-	resp, err := svc.CompleteLogin(context.Background(), req)
-	if err != nil {
-		t.Fatalf("expected no error, got %v", err)
-	}
+			if tt.setup != nil {
+				tt.setup(mRepo)
+			}
 
-	if resp.AccessToken == "" {
-		t.Error("expected access token to not be empty")
-	}
-}
+			resp, err := svc.ChangeEmail(tt.ctx, tt.req)
 
-func TestVerifyMagicCodeByPhone_InvalidCode(t *testing.T) {
-	repo := &mockRepository{
-		getValidMagicCodeByPhoneFunc: func(_ context.Context, _, _ string) (*store.AuthMagicCode, error) {
-			return nil, sql.ErrNoRows
+			if tt.expectedError != "" {
+				assert.Error(t, err)
+			} else {
+				assert.NoError(t, err)
+				assert.True(t, resp.Success)
+			}
+		})
+	}
+}
+
+func TestAuthService_ChangePhone(t *testing.T) {
+	userID := testUserID
+	tests := []struct {
+		name          string
+		req           *authv1.ChangePhoneRequest
+		setup         func(*mocks.MockRepository)
+		ctx           context.Context
+		expectedError string
+	}{
+		{
+			name: "Success",
+			req:  &authv1.ChangePhoneRequest{NewPhone: "+1234567890"},
+			ctx:  authn.ContextWithClaims(context.Background(), authn.Claims{UserID: userID}),
+			setup: func(mRepo *mocks.MockRepository) {
+				mRepo.EXPECT().CreatePendingContactChange(gomock.Any(), gomock.Any(), userID, "phone", "+1234567890", gomock.Any(), gomock.Any()).Return(nil)
+			},
 		},
 	}
-	svc := createTestService(t, repo)
 
-	req := &authv1.CompleteLoginRequest{
-		ContactInfo: &authv1.CompleteLoginRequest_Phone{Phone: "+1234567890"},
-		Code:        "wrong-code",
-	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ctrl := gomock.NewController(t)
+			defer ctrl.Finish()
 
-	_, err := svc.CompleteLogin(context.Background(), req)
-	if err == nil {
-		t.Fatal("expected error for invalid magic code by phone")
-	}
-}
+			mRepo := mocks.NewMockRepository(ctrl)
+			mRepo.EXPECT().WithTx(gomock.Any(), gomock.Any()).DoAndReturn(func(_ context.Context, fn func(repository.Repository) error) error {
+				return fn(mRepo)
+			}).AnyTimes()
+			mRepo.EXPECT().StoreOutbox(gomock.Any(), gomock.Any(), gomock.Any()).Return(nil).AnyTimes()
+			svc := NewAuthService(mRepo, nil, events.NewBus(), &audit.NoopLogger{}, nil, "dev")
 
-func TestVerifyMagicCodeByPhone_DatabaseError(t *testing.T) {
-	repo := &mockRepository{
-		getValidMagicCodeByPhoneFunc: func(_ context.Context, _, _ string) (*store.AuthMagicCode, error) {
-			return nil, errors.New("database error")
-		},
-	}
-	svc := createTestService(t, repo)
+			if tt.setup != nil {
+				tt.setup(mRepo)
+			}
 
-	req := &authv1.CompleteLoginRequest{
-		ContactInfo: &authv1.CompleteLoginRequest_Phone{Phone: "+1234567890"},
-		Code:        "123456",
-	}
+			resp, err := svc.ChangePhone(tt.ctx, tt.req)
 
-	_, err := svc.CompleteLogin(context.Background(), req)
-	if err == nil {
-		t.Fatal("expected error when database fails for phone verification")
+			if tt.expectedError != "" {
+				assert.Error(t, err)
+			} else {
+				assert.NoError(t, err)
+				assert.True(t, resp.Success)
+			}
+		})
 	}
 }
-
-// Additional mock methods for the extended Repository interface
-
-func (m *mockRepository) GetUserByID(_ context.Context, id string) (*store.AuthUser, error) {
-	return &store.AuthUser{ID: id}, nil
-}
-
-func (m *mockRepository) UpdateUserProfile(_ context.Context, _, _, _ string) error {
-	return nil
-}
-
-func (m *mockRepository) CreateSession(_ context.Context, _ *repository.Session) error {
-	return nil
-}
-
-func (m *mockRepository) GetSessionByID(_ context.Context, id string) (*repository.Session, error) {
-	return &repository.Session{ID: id}, nil
-}
-
-func (m *mockRepository) GetSessionByRefreshTokenHash(_ context.Context, _ string) (*repository.Session, error) {
-	return &repository.Session{}, nil
-}
-
-func (m *mockRepository) GetSessionsByUserID(_ context.Context, _ string) ([]*repository.Session, error) {
-	return nil, nil
-}
-
-func (m *mockRepository) UpdateSessionActivity(_ context.Context, _ string) error {
-	return nil
-}
-
-func (m *mockRepository) RevokeSession(_ context.Context, _ string) error {
-	return nil
-}
-
-func (m *mockRepository) RevokeAllUserSessions(_ context.Context, _, _ string) (int, error) {
-	return 0, nil
-}
-
-func (m *mockRepository) BlacklistToken(_ context.Context, _, _, _ string, _ time.Time) error {
-	return nil
-}
-
-func (m *mockRepository) IsTokenBlacklisted(_ context.Context, _ string) (bool, error) {
-	return false, nil
-}
-
-func (m *mockRepository) CleanupExpiredBlacklistEntries(_ context.Context) error {
-	return nil
-}
-
-func (m *mockRepository) CreatePendingContactChange(_ context.Context, _, _, _, _, _ string, _ time.Time) error {
-	return nil
-}
-
-func (m *mockRepository) GetPendingContactChange(_ context.Context, _, _, _ string) (*repository.PendingContactChange, error) {
-	return nil, nil
-}
-
-func (m *mockRepository) DeletePendingContactChange(_ context.Context, _ string) error {
-	return nil
-}
-
-// External OAuth accounts mock methods
-
-func (m *mockRepository) CreateExternalAccount(_ context.Context, _ *repository.ExternalAccount) error {
-	return nil
-}
-
-func (m *mockRepository) GetExternalAccountByProviderUserID(_ context.Context, _, _ string) (*repository.ExternalAccount, error) {
-	return nil, nil
-}
-
-func (m *mockRepository) GetExternalAccountsByUserID(_ context.Context, _ string) ([]*repository.ExternalAccount, error) {
-	return nil, nil
-}
-
-func (m *mockRepository) GetExternalAccountByProviderAndEmail(_ context.Context, _, _ string) (*repository.ExternalAccount, error) {
-	return nil, nil
-}
-
-func (m *mockRepository) UpdateExternalAccountTokens(_ context.Context, _, _, _, _ string, _ *time.Time) error {
-	return nil
-}
-
-func (m *mockRepository) UpdateExternalAccountProfile(_ context.Context, _, _, _, _, _ string, _ map[string]interface{}) error {
-	return nil
-}
-
-func (m *mockRepository) DeleteExternalAccount(_ context.Context, _, _ string) error {
-	return nil
-}
-
-func (m *mockRepository) DeleteExternalAccountByProvider(_ context.Context, _, _ string) error {
-	return nil
-}
-
-func (m *mockRepository) CountExternalAccountsByUserID(_ context.Context, _ string) (int64, error) {
-	return 0, nil
-}
-
-// OAuth state mock methods
-
-func (m *mockRepository) CreateOAuthState(_ context.Context, _ *repository.OAuthState) error {
-	return nil
-}
-
-func (m *mockRepository) GetOAuthState(_ context.Context, _ string) (*repository.OAuthState, error) {
-	return nil, nil
-}
-
-func (m *mockRepository) DeleteOAuthState(_ context.Context, _ string) error {
-	return nil
-}
-
-func (m *mockRepository) CleanupExpiredOAuthStates(_ context.Context) error {
-	return nil
-}
-
-func (m *mockRepository) CleanupExpiredSessions(_ context.Context) (int, error) {
-	return 0, nil
-}
-
-func (m *mockRepository) CleanupExpiredMagicCodes(_ context.Context) (int, error) {
-	return 0, nil
-}
diff --git a/modules/auth/module.go b/modules/auth/module.go
index 493294d..b217409 100644
--- a/modules/auth/module.go
+++ b/modules/auth/module.go
@@ -3,19 +3,24 @@ package auth
 
 import (
 	"context"
-	"database/sql"
 	"fmt"
+	"time"
 
 	"github.com/grpc-ecosystem/grpc-gateway/v2/runtime"
 	"google.golang.org/grpc"
 
 	authv1 "github.com/cmelgarejo/go-modulith-template/gen/go/proto/auth/v1"
+	"github.com/cmelgarejo/go-modulith-template/internal/audit"
+	"github.com/cmelgarejo/go-modulith-template/internal/authtoken"
 	"github.com/cmelgarejo/go-modulith-template/internal/config"
-	"github.com/cmelgarejo/go-modulith-template/internal/events"
+	internalEvents "github.com/cmelgarejo/go-modulith-template/internal/events"
+	"github.com/cmelgarejo/go-modulith-template/internal/feature"
+	"github.com/cmelgarejo/go-modulith-template/internal/outbox"
 	"github.com/cmelgarejo/go-modulith-template/internal/registry"
 	"github.com/cmelgarejo/go-modulith-template/modules/auth/internal/repository"
 	"github.com/cmelgarejo/go-modulith-template/modules/auth/internal/service"
-	"github.com/cmelgarejo/go-modulith-template/modules/auth/internal/token"
+	authSeed "github.com/cmelgarejo/go-modulith-template/modules/auth/resources/db/seed"
+	"github.com/jackc/pgx/v5/pgxpool"
 )
 
 // Config is an alias for backwards compatibility.
@@ -25,7 +30,8 @@ type Config = config.AuthConfig
 
 // Module implements the registry.Module interface for auth.
 type Module struct {
-	svc *service.AuthService
+	svc    *service.AuthService
+	outbox *outbox.Publisher
 }
 
 // NewModule creates a new auth module instance.
@@ -33,6 +39,11 @@ func NewModule() *Module {
 	return &Module{}
 }
 
+// Service returns the auth service server interface for cross-module communication.
+func (m *Module) Service() authv1.AuthServiceServer {
+	return m.svc
+}
+
 // Name returns the module identifier.
 func (m *Module) Name() string {
 	return "auth"
@@ -45,17 +56,66 @@ func (m *Module) Initialize(r *registry.Registry) error {
 		return fmt.Errorf("invalid config type, expected *config.AppConfig")
 	}
 
-	if cfg.Auth.JWTSecret == "" {
-		return fmt.Errorf("JWT secret is empty, cannot initialize auth module")
+	if cfg.Auth.JWTPrivateKeyPEM == "" {
+		return fmt.Errorf("JWT private key (JWT_PRIVATE_KEY) is required to initialize auth module (RS256)")
 	}
 
-	tokenService, err := token.NewService(cfg.Auth.JWTSecret)
+	tokenService, err := authtoken.NewService(cfg.Auth.JWTPrivateKeyPEM)
 	if err != nil {
 		return fmt.Errorf("failed to init token service: %w", err)
 	}
 
 	repo := repository.NewSQLRepository(r.DB())
-	m.svc = service.NewAuthService(repo, tokenService, r.EventBus())
+	m.svc = service.NewAuthService(repo, tokenService, r.EventBus(), r.AuditLogger(), r.FlagManager(), cfg.Env)
+
+	m.outbox = outbox.NewPublisher(repo, func(ctx context.Context, name string, payload interface{}) {
+		r.EventBus().Publish(ctx, internalEvents.Event{Name: name, Payload: payload})
+	})
+
+	if cfg.OutboxPollInterval != "" {
+		if d, err := time.ParseDuration(cfg.OutboxPollInterval); err == nil {
+			m.outbox.SetPollInterval(d)
+		}
+	}
+
+	// Handle dummy email verification
+	r.EventBus().Subscribe(internalEvents.EventAuthEmailVerificationRequested, m.handleEmailVerificationRequested)
+
+	return nil
+}
+
+func (m *Module) handleEmailVerificationRequested(ctx context.Context, event internalEvents.Event) error {
+	payload, ok := event.Payload.(map[string]any)
+	if !ok {
+		return nil
+	}
+
+	userID, _ := payload["user_id"].(string)
+	if userID == "" {
+		return nil
+	}
+
+	if err := m.svc.HandleEmailVerificationRequested(ctx, userID); err != nil {
+		return fmt.Errorf("failed to handle email verification request: %w", err)
+	}
+
+	return nil
+}
+
+// OnStart starts the outbox publisher.
+func (m *Module) OnStart(ctx context.Context) error {
+	if m.outbox != nil {
+		go m.outbox.Start(ctx)
+	}
+
+	return nil
+}
+
+// OnStop stops the outbox publisher.
+func (m *Module) OnStop(_ context.Context) error {
+	if m.outbox != nil {
+		m.outbox.Stop()
+	}
 
 	return nil
 }
@@ -84,11 +144,36 @@ func (m *Module) SeedPath() string {
 	return "modules/auth/resources/db/seed"
 }
 
+// Seed runs programmatic seed data for the auth module.
+func (m *Module) Seed(ctx context.Context, r interface{}) error {
+	reg, ok := r.(*registry.Registry)
+	if !ok {
+		return fmt.Errorf("registry is not *registry.Registry")
+	}
+
+	cfg, ok := reg.Config().(*config.AppConfig)
+	if !ok {
+		return fmt.Errorf("config is not *config.AppConfig")
+	}
+
+	if err := authSeed.Seed(ctx, reg.DB(), cfg, reg.AuditLogger()); err != nil {
+		return fmt.Errorf("failed to seed auth module: %w", err)
+	}
+
+	return nil
+}
+
 // PublicEndpoints returns the list of public endpoints that don't require authentication.
 func (m *Module) PublicEndpoints() []string {
 	return []string{
 		"/auth.v1.AuthService/RequestLogin",
 		"/auth.v1.AuthService/CompleteLogin",
+		"/auth.v1.AuthService/Register",
+		"/auth.v1.AuthService/RefreshSession",
+		"/auth.v1.AuthService/GetOAuthProviders",
+		"/auth.v1.AuthService/InitiateOAuth",
+		"/auth.v1.AuthService/CompleteOAuth",
+		"/auth.v1.AuthService/GetSystemConfig",
 	}
 }
 
@@ -97,18 +182,18 @@ func (m *Module) PublicEndpoints() []string {
 // Initialize registers the Auth module with the gRPC server (legacy).
 //
 // Deprecated: Use Module.Initialize with Registry instead.
-func Initialize(db *sql.DB, grpcServer *grpc.Server, bus *events.Bus, cfg Config) error {
-	if cfg.JWTSecret == "" {
-		return fmt.Errorf("JWT secret is empty, cannot initialize auth module")
+func Initialize(db *pgxpool.Pool, grpcServer *grpc.Server, bus *internalEvents.Bus, cfg Config, auditLog audit.Logger, flagManager feature.Manager) error {
+	if cfg.JWTPrivateKeyPEM == "" {
+		return fmt.Errorf("JWT private key (JWT_PRIVATE_KEY) is required to initialize auth module (RS256)")
 	}
 
-	tokenService, err := token.NewService(cfg.JWTSecret)
+	tokenService, err := authtoken.NewService(cfg.JWTPrivateKeyPEM)
 	if err != nil {
 		return fmt.Errorf("failed to init token service: %w", err)
 	}
 
 	repo := repository.NewSQLRepository(db)
-	svc := service.NewAuthService(repo, tokenService, bus)
+	svc := service.NewAuthService(repo, tokenService, bus, auditLog, flagManager, "legacy")
 
 	authv1.RegisterAuthServiceServer(grpcServer, svc)
 
diff --git a/modules/auth/module_test.go b/modules/auth/module_test.go
index c3d9d8e..2f0d8ca 100644
--- a/modules/auth/module_test.go
+++ b/modules/auth/module_test.go
@@ -2,62 +2,65 @@ package auth
 
 import (
 	"context"
-	"database/sql"
 	"testing"
 
+	"github.com/cmelgarejo/go-modulith-template/internal/audit"
 	"github.com/cmelgarejo/go-modulith-template/internal/events"
+	"github.com/cmelgarejo/go-modulith-template/internal/feature"
+	"github.com/cmelgarejo/go-modulith-template/internal/testutil"
+	"github.com/jackc/pgx/v5/pgxpool"
 	"google.golang.org/grpc"
 )
 
-func TestInitialize_EmptyJWTSecret(t *testing.T) {
+func TestInitialize_EmptyJWTPrivateKey(t *testing.T) {
 	grpcServer := grpc.NewServer()
 	bus := events.NewBus()
 
 	cfg := Config{
-		JWTSecret: "",
+		JWTPrivateKeyPEM: "",
 	}
 
-	err := Initialize(nil, grpcServer, bus, cfg)
+	auditLog := &audit.NoopLogger{}
+	flagManager := feature.NewInMemoryManager()
+
+	err := Initialize(nil, grpcServer, bus, cfg, auditLog, flagManager)
 	if err == nil {
-		t.Fatal("expected error when JWT secret is empty")
+		t.Fatal("expected error when JWT private key is empty")
 	}
 }
 
-func TestInitialize_InvalidJWTSecret(t *testing.T) {
+func TestInitialize_InvalidJWTPrivateKey(t *testing.T) {
 	grpcServer := grpc.NewServer()
 	bus := events.NewBus()
 
-	// JWT secret that's too short (less than 32 bytes)
 	cfg := Config{
-		JWTSecret: "short",
+		JWTPrivateKeyPEM: "not-valid-pem",
 	}
 
-	err := Initialize(nil, grpcServer, bus, cfg)
+	auditLog := &audit.NoopLogger{}
+	flagManager := feature.NewInMemoryManager()
+
+	err := Initialize(nil, grpcServer, bus, cfg, auditLog, flagManager)
 	if err == nil {
-		t.Fatal("expected error when JWT secret is too short")
+		t.Fatal("expected error when JWT private key is invalid")
 	}
 }
 
 func TestInitialize_Success(t *testing.T) {
-	// Note: This test will fail in a real scenario without a DB connection
-	// In a real test, you'd use a test database or mock
-	// For now, we test the configuration validation part
 	grpcServer := grpc.NewServer()
 	bus := events.NewBus()
 
 	cfg := Config{
-		JWTSecret: "valid-secret-key-that-is-at-least-32-bytes-long",
+		JWTPrivateKeyPEM: testutil.TestJWTPrivateKeyPEM,
 	}
 
-	// This will fail because db is nil, but that's expected
-	// The important part is that it passes JWT secret validation
-	err := Initialize(nil, grpcServer, bus, cfg)
+	auditLog := &audit.NoopLogger{}
+	flagManager := feature.NewInMemoryManager()
 
-	// We expect it to fail, but not due to JWT secret validation
+	err := Initialize(nil, grpcServer, bus, cfg, auditLog, flagManager)
 	if err != nil {
-		// Check that it's not a JWT secret error
-		if err.Error() == "JWT secret is empty, cannot initialize auth module" {
-			t.Error("JWT secret validation failed incorrectly")
+		if err.Error() == "JWT private key (JWT_PRIVATE_KEY) is required to initialize auth module (RS256)" {
+			t.Error("JWT private key validation failed incorrectly")
 		}
 	}
 }
@@ -81,11 +84,16 @@ func TestRegisterGatewayWithConn_NilConn(t *testing.T) {
 // TestConfig verifies the Config structure
 func TestConfig(t *testing.T) {
 	cfg := Config{
-		JWTSecret: "test-secret",
+		JWTPrivateKeyPEM: testutil.TestJWTPrivateKeyPEM,
+		JWTPublicKeyPEM:  testutil.TestJWTPublicKeyPEM,
+	}
+
+	if cfg.JWTPrivateKeyPEM == "" {
+		t.Error("expected JWT private key to be set")
 	}
 
-	if cfg.JWTSecret != "test-secret" {
-		t.Errorf("expected JWT secret 'test-secret', got %s", cfg.JWTSecret)
+	if cfg.JWTPublicKeyPEM == "" {
+		t.Error("expected JWT public key to be set")
 	}
 }
 
@@ -95,13 +103,15 @@ func TestInitialize_NilDB(_ *testing.T) {
 	bus := events.NewBus()
 
 	cfg := Config{
-		JWTSecret: "valid-secret-key-that-is-at-least-32-bytes-long",
+		JWTPrivateKeyPEM: testutil.TestJWTPrivateKeyPEM,
 	}
 
-	var nilDB *sql.DB
+	var nilDB *pgxpool.Pool
 
+	auditLog := &audit.NoopLogger{}
+	flagManager := feature.NewInMemoryManager()
 	// Should not panic even with nil DB (repository creation should handle it)
-	_ = Initialize(nilDB, grpcServer, bus, cfg)
+	_ = Initialize(nilDB, grpcServer, bus, cfg, auditLog, flagManager)
 
 	// The function might return an error or not depending on implementation
 	// The important thing is it doesn't panic
@@ -119,7 +129,7 @@ func TestInitialize_NilBus(t *testing.T) {
 	grpcServer := grpc.NewServer()
 
 	cfg := Config{
-		JWTSecret: "valid-secret-key-that-is-at-least-32-bytes-long",
+		JWTPrivateKeyPEM: testutil.TestJWTPrivateKeyPEM,
 	}
 
 	// Should not panic even with nil bus
@@ -129,5 +139,7 @@ func TestInitialize_NilBus(t *testing.T) {
 		}
 	}()
 
-	_ = Initialize(nil, grpcServer, nil, cfg)
+	auditLog := &audit.NoopLogger{}
+	flagManager := feature.NewInMemoryManager()
+	_ = Initialize(nil, grpcServer, nil, cfg, auditLog, flagManager)
 }
diff --git a/modules/auth/resources/db/migration/000001_initial_schema.down.sql b/modules/auth/resources/db/migration/000001_initial_schema.down.sql
index 5d8dd39..17a04af 100644
--- a/modules/auth/resources/db/migration/000001_initial_schema.down.sql
+++ b/modules/auth/resources/db/migration/000001_initial_schema.down.sql
@@ -1,3 +1,22 @@
--- Drop schema (cascades to all tables and objects in the schema)
-DROP SCHEMA IF EXISTS auth CASCADE;
+-- Set search_path for subsequent statements in this migration
+SET search_path TO auth, public;
+
+DROP FUNCTION IF EXISTS auth.set_updated_at();
+
+DROP TABLE IF EXISTS oauth_states;
+DROP TABLE IF EXISTS user_external_accounts;
+DROP TABLE IF EXISTS pending_contact_changes;
+DROP TABLE IF EXISTS token_blacklist;
+DROP TABLE IF EXISTS sessions;
+DROP TABLE IF EXISTS magic_codes;
+DROP TABLE IF EXISTS user_roles;
+DROP TABLE IF EXISTS role_permissions;
+DROP TABLE IF EXISTS permissions;
+DROP TABLE IF EXISTS roles;
+DROP TABLE IF EXISTS users;
 
+-- Reset search_path to default
+SET search_path TO public;
+
+-- Drop schema
+DROP SCHEMA IF EXISTS auth CASCADE;
diff --git a/modules/auth/resources/db/migration/000001_initial_schema.up.sql b/modules/auth/resources/db/migration/000001_initial_schema.up.sql
index 9178ea5..6ccf084 100644
--- a/modules/auth/resources/db/migration/000001_initial_schema.up.sql
+++ b/modules/auth/resources/db/migration/000001_initial_schema.up.sql
@@ -4,29 +4,53 @@ CREATE SCHEMA IF NOT EXISTS auth;
 -- Set search_path for subsequent statements in this migration
 SET search_path TO auth, public;
 
+-- Function for automatic updated_at
+CREATE OR REPLACE FUNCTION auth.set_updated_at()
+RETURNS TRIGGER AS $$
+BEGIN
+    NEW.updated_at = NOW();
+    RETURN NEW;
+END;
+$$ language 'plpgsql';
+
 CREATE TABLE auth.users (
     id VARCHAR(64) PRIMARY KEY,
     email VARCHAR(255) UNIQUE,
     phone VARCHAR(50) UNIQUE,
-    created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    updated_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP
+    display_name VARCHAR(255),
+    avatar_url VARCHAR(512),
+    status VARCHAR(20) NOT NULL DEFAULT 'active',
+    email_verified BOOLEAN NOT NULL DEFAULT FALSE,
+    phone_verified BOOLEAN NOT NULL DEFAULT FALSE,
+    timezone VARCHAR(64),
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
 );
 
+CREATE INDEX idx_users_status ON auth.users(status);
+
 CREATE TABLE auth.roles (
     id VARCHAR(64) PRIMARY KEY,
-    name VARCHAR(50) NOT NULL UNIQUE
+    name VARCHAR(50) NOT NULL UNIQUE,
+    deleted_at TIMESTAMPTZ,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
 );
 
 CREATE TABLE auth.permissions (
     id VARCHAR(64) PRIMARY KEY,
     name VARCHAR(50) NOT NULL UNIQUE,
     resource VARCHAR(50) NOT NULL,
-    action VARCHAR(50) NOT NULL
+    action VARCHAR(50) NOT NULL,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
 );
 
 CREATE TABLE auth.role_permissions (
     role_id VARCHAR(64) NOT NULL,
     permission_id VARCHAR(64) NOT NULL,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
     PRIMARY KEY (role_id, permission_id),
     FOREIGN KEY (role_id) REFERENCES auth.roles(id) ON DELETE CASCADE,
     FOREIGN KEY (permission_id) REFERENCES auth.permissions(id) ON DELETE CASCADE
@@ -35,6 +59,8 @@ CREATE TABLE auth.role_permissions (
 CREATE TABLE auth.user_roles (
     user_id VARCHAR(64) NOT NULL,
     role_id VARCHAR(64) NOT NULL,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
     PRIMARY KEY (user_id, role_id),
     FOREIGN KEY (user_id) REFERENCES auth.users(id) ON DELETE CASCADE,
     FOREIGN KEY (role_id) REFERENCES auth.roles(id) ON DELETE CASCADE
@@ -44,12 +70,134 @@ CREATE TABLE auth.magic_codes (
     code VARCHAR(10) NOT NULL,
     user_email VARCHAR(255),
     user_phone VARCHAR(50),
-    expires_at TIMESTAMP NOT NULL,
-    created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP
+    expires_at TIMESTAMPTZ NOT NULL,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
 );
 
 CREATE INDEX idx_magic_codes_email ON auth.magic_codes(user_email);
 CREATE INDEX idx_magic_codes_phone ON auth.magic_codes(user_phone);
 
+-- Sessions table
+CREATE TABLE auth.sessions (
+    id VARCHAR(64) PRIMARY KEY,
+    user_id VARCHAR(64) NOT NULL,
+    refresh_token_hash VARCHAR(255) NOT NULL,
+    user_agent VARCHAR(512),
+    ip_address VARCHAR(45),
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    last_active_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    expires_at TIMESTAMPTZ NOT NULL,
+    revoked_at TIMESTAMPTZ,
+    FOREIGN KEY (user_id) REFERENCES auth.users(id) ON DELETE CASCADE
+);
+
+CREATE INDEX idx_sessions_user_id ON auth.sessions(user_id);
+CREATE INDEX idx_sessions_refresh_token_hash ON auth.sessions(refresh_token_hash);
+CREATE INDEX idx_sessions_expires_at ON auth.sessions(expires_at);
+
+-- Token blacklist
+CREATE TABLE auth.token_blacklist (
+    token_hash VARCHAR(255) PRIMARY KEY,
+    user_id VARCHAR(64) NOT NULL,
+    expires_at TIMESTAMPTZ NOT NULL,
+    revoked_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    reason VARCHAR(50),
+    FOREIGN KEY (user_id) REFERENCES auth.users(id) ON DELETE CASCADE
+);
+
+CREATE INDEX idx_token_blacklist_expires_at ON auth.token_blacklist(expires_at);
+
+-- Pending contact changes
+CREATE TABLE auth.pending_contact_changes (
+    id VARCHAR(64) PRIMARY KEY,
+    user_id VARCHAR(64) NOT NULL,
+    change_type VARCHAR(10) NOT NULL,
+    new_value VARCHAR(255) NOT NULL,
+    verification_code VARCHAR(10) NOT NULL,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    expires_at TIMESTAMPTZ NOT NULL,
+    FOREIGN KEY (user_id) REFERENCES auth.users(id) ON DELETE CASCADE
+);
+
+CREATE INDEX idx_pending_contact_changes_user_id ON auth.pending_contact_changes(user_id);
+CREATE INDEX idx_pending_contact_changes_expires_at ON auth.pending_contact_changes(expires_at);
+
+-- External Accounts
+CREATE TABLE auth.user_external_accounts (
+    id VARCHAR(64) PRIMARY KEY,
+    user_id VARCHAR(64) NOT NULL,
+    provider VARCHAR(50) NOT NULL,
+    provider_user_id VARCHAR(255) NOT NULL,
+    email VARCHAR(255),
+    name VARCHAR(255),
+    avatar_url VARCHAR(512),
+    access_token TEXT,
+    refresh_token TEXT,
+    token_expires_at TIMESTAMPTZ,
+    raw_data JSONB,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    FOREIGN KEY (user_id) REFERENCES auth.users(id) ON DELETE CASCADE,
+    UNIQUE (provider, provider_user_id)
+);
+
+CREATE INDEX idx_external_accounts_user_id ON auth.user_external_accounts(user_id);
+CREATE INDEX idx_external_accounts_provider_email ON auth.user_external_accounts(provider, email);
+
+-- OAuth States
+CREATE TABLE auth.oauth_states (
+    state VARCHAR(255) PRIMARY KEY,
+    provider VARCHAR(50) NOT NULL,
+    redirect_url VARCHAR(512),
+    user_id VARCHAR(64),
+    action VARCHAR(20) NOT NULL DEFAULT 'login',
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    expires_at TIMESTAMPTZ NOT NULL
+);
+
+CREATE INDEX idx_oauth_states_expires_at ON auth.oauth_states(expires_at);
+
+-- Outbox table for transactional messaging
+CREATE TABLE auth.outbox (
+    id VARCHAR(36) PRIMARY KEY,
+    event_name VARCHAR(255) NOT NULL,
+    payload JSONB NOT NULL,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    published_at TIMESTAMPTZ
+);
+
+CREATE INDEX idx_outbox_unpublished ON auth.outbox (created_at) WHERE published_at IS NULL;
+
+
+
+
+-- Auth Config
+CREATE TABLE IF NOT EXISTS auth.auth_config (
+    key TEXT PRIMARY KEY,
+    value TEXT NOT NULL,
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+-- triggers for automatic updated_at
+CREATE TRIGGER set_updated_at BEFORE UPDATE ON auth.users FOR EACH ROW EXECUTE FUNCTION auth.set_updated_at();
+CREATE TRIGGER set_updated_at BEFORE UPDATE ON auth.roles FOR EACH ROW EXECUTE FUNCTION auth.set_updated_at();
+CREATE TRIGGER set_updated_at BEFORE UPDATE ON auth.permissions FOR EACH ROW EXECUTE FUNCTION auth.set_updated_at();
+CREATE TRIGGER set_updated_at BEFORE UPDATE ON auth.role_permissions FOR EACH ROW EXECUTE FUNCTION auth.set_updated_at();
+CREATE TRIGGER set_updated_at BEFORE UPDATE ON auth.user_roles FOR EACH ROW EXECUTE FUNCTION auth.set_updated_at();
+CREATE TRIGGER set_updated_at BEFORE UPDATE ON auth.magic_codes FOR EACH ROW EXECUTE FUNCTION auth.set_updated_at();
+CREATE TRIGGER set_updated_at BEFORE UPDATE ON auth.sessions FOR EACH ROW EXECUTE FUNCTION auth.set_updated_at();
+CREATE TRIGGER set_updated_at BEFORE UPDATE ON auth.token_blacklist FOR EACH ROW EXECUTE FUNCTION auth.set_updated_at();
+CREATE TRIGGER set_updated_at BEFORE UPDATE ON auth.pending_contact_changes FOR EACH ROW EXECUTE FUNCTION auth.set_updated_at();
+CREATE TRIGGER set_updated_at BEFORE UPDATE ON auth.user_external_accounts FOR EACH ROW EXECUTE FUNCTION auth.set_updated_at();
+CREATE TRIGGER set_updated_at BEFORE UPDATE ON auth.oauth_states FOR EACH ROW EXECUTE FUNCTION auth.set_updated_at();
+CREATE TRIGGER set_updated_at BEFORE UPDATE ON auth.outbox FOR EACH ROW EXECUTE FUNCTION auth.set_updated_at();
+CREATE TRIGGER set_updated_at BEFORE UPDATE ON auth.auth_config FOR EACH ROW EXECUTE FUNCTION auth.set_updated_at();
+
 -- Reset search_path to default
 SET search_path TO public;
diff --git a/modules/auth/resources/db/migration/000002_sessions_and_profile.down.sql b/modules/auth/resources/db/migration/000002_sessions_and_profile.down.sql
deleted file mode 100644
index ec8698a..0000000
--- a/modules/auth/resources/db/migration/000002_sessions_and_profile.down.sql
+++ /dev/null
@@ -1,19 +0,0 @@
--- Set search_path for subsequent statements in this migration
-SET search_path TO auth, public;
-
--- Remove pending contact changes
-DROP TABLE IF EXISTS auth.pending_contact_changes;
-
--- Remove token blacklist
-DROP TABLE IF EXISTS auth.token_blacklist;
-
--- Remove sessions
-DROP TABLE IF EXISTS auth.sessions;
-
--- Remove profile fields from users
-ALTER TABLE auth.users DROP COLUMN IF EXISTS avatar_url;
-ALTER TABLE auth.users DROP COLUMN IF EXISTS display_name;
-
--- Reset search_path to default
-SET search_path TO public;
-
diff --git a/modules/auth/resources/db/migration/000002_sessions_and_profile.up.sql b/modules/auth/resources/db/migration/000002_sessions_and_profile.up.sql
deleted file mode 100644
index 11c5a25..0000000
--- a/modules/auth/resources/db/migration/000002_sessions_and_profile.up.sql
+++ /dev/null
@@ -1,56 +0,0 @@
--- Set search_path for subsequent statements in this migration
-SET search_path TO auth, public;
-
--- Add profile fields to users table
-ALTER TABLE auth.users ADD COLUMN display_name VARCHAR(255);
-ALTER TABLE auth.users ADD COLUMN avatar_url VARCHAR(512);
-
--- Sessions table for tracking user sessions and token management
-CREATE TABLE auth.sessions (
-    id VARCHAR(64) PRIMARY KEY,
-    user_id VARCHAR(64) NOT NULL,
-    refresh_token_hash VARCHAR(255) NOT NULL,
-    user_agent VARCHAR(512),
-    ip_address VARCHAR(45), -- IPv6 max length
-    created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    last_active_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    expires_at TIMESTAMP NOT NULL,
-    revoked_at TIMESTAMP,
-    FOREIGN KEY (user_id) REFERENCES auth.users(id) ON DELETE CASCADE
-);
-
-CREATE INDEX idx_sessions_user_id ON auth.sessions(user_id);
-CREATE INDEX idx_sessions_refresh_token_hash ON auth.sessions(refresh_token_hash);
-CREATE INDEX idx_sessions_expires_at ON auth.sessions(expires_at);
-
--- Token blacklist for revoked access tokens
--- Tokens are stored until they naturally expire, then can be cleaned up
-CREATE TABLE auth.token_blacklist (
-    token_hash VARCHAR(255) PRIMARY KEY,
-    user_id VARCHAR(64) NOT NULL,
-    expires_at TIMESTAMP NOT NULL,
-    revoked_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    reason VARCHAR(50), -- 'logout', 'password_change', 'admin_revoke', etc.
-    FOREIGN KEY (user_id) REFERENCES auth.users(id) ON DELETE CASCADE
-);
-
-CREATE INDEX idx_token_blacklist_expires_at ON auth.token_blacklist(expires_at);
-
--- Pending email/phone changes (verification required)
-CREATE TABLE auth.pending_contact_changes (
-    id VARCHAR(64) PRIMARY KEY,
-    user_id VARCHAR(64) NOT NULL,
-    change_type VARCHAR(10) NOT NULL, -- 'email' or 'phone'
-    new_value VARCHAR(255) NOT NULL,
-    verification_code VARCHAR(10) NOT NULL,
-    created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    expires_at TIMESTAMP NOT NULL,
-    FOREIGN KEY (user_id) REFERENCES auth.users(id) ON DELETE CASCADE
-);
-
-CREATE INDEX idx_pending_contact_changes_user_id ON auth.pending_contact_changes(user_id);
-CREATE INDEX idx_pending_contact_changes_expires_at ON auth.pending_contact_changes(expires_at);
-
--- Reset search_path to default
-SET search_path TO public;
-
diff --git a/modules/auth/resources/db/migration/000003_external_accounts.down.sql b/modules/auth/resources/db/migration/000003_external_accounts.down.sql
deleted file mode 100644
index f27ac7f..0000000
--- a/modules/auth/resources/db/migration/000003_external_accounts.down.sql
+++ /dev/null
@@ -1,12 +0,0 @@
--- Set search_path for subsequent statements in this migration
-SET search_path TO auth, public;
-
--- Drop OAuth state tokens table
-DROP TABLE IF EXISTS auth.oauth_states;
-
--- Drop external accounts table
-DROP TABLE IF EXISTS auth.user_external_accounts;
-
--- Reset search_path to default
-SET search_path TO public;
-
diff --git a/modules/auth/resources/db/migration/000003_external_accounts.up.sql b/modules/auth/resources/db/migration/000003_external_accounts.up.sql
deleted file mode 100644
index bcf278b..0000000
--- a/modules/auth/resources/db/migration/000003_external_accounts.up.sql
+++ /dev/null
@@ -1,47 +0,0 @@
--- Set search_path for subsequent statements in this migration
-SET search_path TO auth, public;
-
--- External OAuth Accounts
--- Links users to external OAuth providers (Google, Facebook, GitHub, etc.)
-
-CREATE TABLE auth.user_external_accounts (
-    id VARCHAR(64) PRIMARY KEY,
-    user_id VARCHAR(64) NOT NULL,
-    provider VARCHAR(50) NOT NULL,           -- google, facebook, github, apple, microsoft, twitter
-    provider_user_id VARCHAR(255) NOT NULL,  -- ID of the user in the external provider
-    email VARCHAR(255),                       -- Email from the provider (may differ from user's email)
-    name VARCHAR(255),                        -- Display name from the provider
-    avatar_url VARCHAR(512),                  -- Avatar/profile picture URL
-    access_token TEXT,                        -- Encrypted access token
-    refresh_token TEXT,                       -- Encrypted refresh token
-    token_expires_at TIMESTAMP,               -- When the access token expires
-    raw_data JSONB,                          -- Additional data from the provider
-    created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    updated_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    FOREIGN KEY (user_id) REFERENCES auth.users(id) ON DELETE CASCADE,
-    UNIQUE (provider, provider_user_id)
-);
-
--- Index for looking up accounts by user
-CREATE INDEX idx_external_accounts_user_id ON auth.user_external_accounts(user_id);
-
--- Index for looking up accounts by provider and email (for auto-linking)
-CREATE INDEX idx_external_accounts_provider_email ON auth.user_external_accounts(provider, email);
-
--- OAuth State tokens for CSRF protection
-CREATE TABLE auth.oauth_states (
-    state VARCHAR(255) PRIMARY KEY,
-    provider VARCHAR(50) NOT NULL,
-    redirect_url VARCHAR(512),
-    user_id VARCHAR(64),                      -- NULL for login, set for account linking
-    action VARCHAR(20) NOT NULL DEFAULT 'login', -- 'login' or 'link'
-    created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    expires_at TIMESTAMP NOT NULL
-);
-
--- Index for cleanup of expired states
-CREATE INDEX idx_oauth_states_expires_at ON auth.oauth_states(expires_at);
-
--- Reset search_path to default
-SET search_path TO public;
-
diff --git a/modules/auth/resources/db/migration/000004_seed_data.down.sql b/modules/auth/resources/db/migration/000004_seed_data.down.sql
deleted file mode 100644
index 96d4f45..0000000
--- a/modules/auth/resources/db/migration/000004_seed_data.down.sql
+++ /dev/null
@@ -1,13 +0,0 @@
--- Set search_path for subsequent statements in this migration
-SET search_path TO auth, public;
-
--- Remove test data
-DELETE FROM auth.user_roles;
-DELETE FROM auth.role_permissions;
-DELETE FROM auth.permissions;
-DELETE FROM auth.roles;
-DELETE FROM auth.users;
-
--- Reset search_path to default
-SET search_path TO public;
-
diff --git a/modules/auth/resources/db/migration/000004_seed_data.up.sql b/modules/auth/resources/db/migration/000004_seed_data.up.sql
deleted file mode 100644
index 73a1059..0000000
--- a/modules/auth/resources/db/migration/000004_seed_data.up.sql
+++ /dev/null
@@ -1,39 +0,0 @@
--- Set search_path for subsequent statements in this migration
-SET search_path TO auth, public;
-
--- Seed Roles
-INSERT INTO auth.roles (id, name) VALUES
-('role_01j6z1p3m7r2b8v8x0w1m4p2r1', 'admin'),
-('role_01j6z1p3m7r2b8v8x0w1m4p2r2', 'user')
-ON CONFLICT (id) DO NOTHING;
-
--- Seed Permissions
-INSERT INTO auth.permissions (id, name, resource, action) VALUES
-('perm_01j6z1p3m7r2b8v8x0w1m4p2rk', 'users:read', 'users', 'read'),
-('perm_01j6z1p3m7r2b8v8x0w1m4p2rm', 'users:write', 'users', 'write'),
-('perm_01j6z1p3m7r2b8v8x0w1m4p2rn', 'auth:debug', 'auth', 'debug')
-ON CONFLICT (id) DO NOTHING;
-
--- Link Roles and Permissions
-INSERT INTO auth.role_permissions (role_id, permission_id) VALUES
-('role_01j6z1p3m7r2b8v8x0w1m4p2r1', 'perm_01j6z1p3m7r2b8v8x0w1m4p2rk'),
-('role_01j6z1p3m7r2b8v8x0w1m4p2r1', 'perm_01j6z1p3m7r2b8v8x0w1m4p2rm'),
-('role_01j6z1p3m7r2b8v8x0w1m4p2r1', 'perm_01j6z1p3m7r2b8v8x0w1m4p2rn'),
-('role_01j6z1p3m7r2b8v8x0w1m4p2r2', 'perm_01j6z1p3m7r2b8v8x0w1m4p2rk')
-ON CONFLICT DO NOTHING;
-
--- Seed Test Users
-INSERT INTO auth.users (id, email, phone) VALUES
-('user_01j6z1p3m7r2b8v8x0w1m4p2tx', 'admin@example.com', '+10000000000'),
-('user_01j6z1p3m7r2b8v8x0w1m4p2tz', 'user@example.com', '+10000000001')
-ON CONFLICT (id) DO NOTHING;
-
--- Assign Roles to Users
-INSERT INTO auth.user_roles (user_id, role_id) VALUES
-('user_01j6z1p3m7r2b8v8x0w1m4p2tx', 'role_01j6z1p3m7r2b8v8x0w1m4p2r1'),
-('user_01j6z1p3m7r2b8v8x0w1m4p2tz', 'role_01j6z1p3m7r2b8v8x0w1m4p2r2')
-ON CONFLICT DO NOTHING;
-
--- Reset search_path to default
-SET search_path TO public;
-
diff --git a/modules/auth/resources/db/seed/auth_seed.go b/modules/auth/resources/db/seed/auth_seed.go
new file mode 100644
index 0000000..300f372
--- /dev/null
+++ b/modules/auth/resources/db/seed/auth_seed.go
@@ -0,0 +1,204 @@
+// Package seed provides programmatic seeding for the auth module.
+package seed
+
+import (
+	"context"
+	"fmt"
+	"log/slog"
+
+	"github.com/cmelgarejo/go-modulith-template/internal/audit"
+	"github.com/cmelgarejo/go-modulith-template/internal/config"
+	"github.com/cmelgarejo/go-modulith-template/modules/auth/internal/repository"
+	"github.com/jackc/pgx/v5/pgxpool"
+	"go.jetify.com/typeid"
+)
+
+// Seed runs programmatic seed data for the auth module.
+func Seed(ctx context.Context, dbPool *pgxpool.Pool, cfg *config.AppConfig, auditLogger audit.Logger) error {
+	repo := repository.NewSQLRepository(dbPool)
+
+	// 1. Seed Roles and Permissions
+	if err := seedRolesAndPermissions(ctx, dbPool); err != nil {
+		return fmt.Errorf("failed to seed roles and permissions: %w", err)
+	}
+
+	// 2. Seed Users
+	for _, u := range cfg.Seeds.Users {
+		if err := processUserSeed(ctx, dbPool, repo, auditLogger, u); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func seedRolesAndPermissions(ctx context.Context, db *pgxpool.Pool) error {
+	permIDs, err := seedPermissions(ctx, db)
+	if err != nil {
+		return err
+	}
+
+	roleIDs, err := seedRoles(ctx, db)
+	if err != nil {
+		return err
+	}
+
+	return assignRolePermissions(ctx, db, roleIDs, permIDs)
+}
+
+func seedPermissions(ctx context.Context, db *pgxpool.Pool) (map[string]string, error) {
+	perms := []struct {
+		Name     string
+		Resource string
+		Action   string
+	}{
+		{"users:read", "users", "read"},
+		{"users:write", "users", "write"},
+		{"auth:debug", "auth", "debug"},
+	}
+
+	permIDs := make(map[string]string)
+
+	for _, p := range perms {
+		var id string
+
+		err := db.QueryRow(ctx, "SELECT id FROM auth.permissions WHERE name = $1", p.Name).Scan(&id)
+		if err != nil {
+			tid, _ := typeid.WithPrefix("perm")
+			id = tid.String()
+
+			_, err = db.Exec(ctx, "INSERT INTO auth.permissions (id, name, resource, action) VALUES ($1, $2, $3, $4)", id, p.Name, p.Resource, p.Action)
+			if err != nil {
+				return nil, fmt.Errorf("failed to insert permission %s: %w", p.Name, err)
+			}
+		}
+
+		permIDs[p.Name] = id
+	}
+
+	return permIDs, nil
+}
+
+func seedRoles(ctx context.Context, db *pgxpool.Pool) (map[string]string, error) {
+	roles := []string{"user", "platform", "admin"}
+	roleIDs := make(map[string]string)
+
+	for _, r := range roles {
+		var id string
+
+		err := db.QueryRow(ctx, "SELECT id FROM auth.roles WHERE name = $1", r).Scan(&id)
+		if err != nil {
+			tid, _ := typeid.WithPrefix("role")
+			id = tid.String()
+
+			_, err = db.Exec(ctx, "INSERT INTO auth.roles (id, name) VALUES ($1, $2)", id, r)
+			if err != nil {
+				return nil, fmt.Errorf("failed to insert role %s: %w", r, err)
+			}
+		}
+
+		roleIDs[r] = id
+	}
+
+	return roleIDs, nil
+}
+
+func assignRolePermissions(ctx context.Context, db *pgxpool.Pool, roleIDs, permIDs map[string]string) error {
+	assignments := []struct {
+		Role string
+		Perm string
+	}{
+		{"user", "users:read"},
+		{"platform", "users:read"},
+		{"platform", "users:write"},
+		{"platform", "auth:debug"},
+		{"admin", "users:read"},
+		{"admin", "users:write"},
+		{"admin", "auth:debug"},
+	}
+
+	for _, a := range assignments {
+		_, err := db.Exec(ctx, "INSERT INTO auth.role_permissions (role_id, permission_id) VALUES ($1, $2) ON CONFLICT DO NOTHING", roleIDs[a.Role], permIDs[a.Perm])
+		if err != nil {
+			return fmt.Errorf("failed to assign permission %s to role %s: %w", a.Perm, a.Role, err)
+		}
+	}
+
+	return nil
+}
+
+func processUserSeed(ctx context.Context, dbPool *pgxpool.Pool, repo *repository.SQLRepository, al audit.Logger, u config.SeedUser) error {
+	// Check if user exists
+	existing, _ := repo.GetUserByEmail(ctx, u.Email)
+	if existing != nil {
+		return assignUserRole(ctx, dbPool, al, existing.ID, u.Email, u.Role)
+	}
+
+	tid, err := typeid.WithPrefix("user")
+	if err != nil {
+		return fmt.Errorf("failed to generate user id: %w", err)
+	}
+
+	userID := tid.String()
+	slog.Info("Seeding user", "email", u.Email, "id", userID)
+
+	if err := repo.CreateUser(ctx, userID, u.Email, u.Phone); err != nil {
+		return fmt.Errorf("failed to create user %s: %w", u.Email, err)
+	}
+
+	// Set default timezone for seeded users
+	if err := repo.UpdateUserProfile(ctx, userID, "", "", "America/Asuncion"); err != nil {
+		slog.Warn("failed to set default timezone for seeded user", "email", u.Email, "error", err)
+	}
+
+	// Audit Log: User Created
+	al.Log(ctx, audit.LogParams{
+		Action:     "user.created",
+		Resource:   "users",
+		ResourceID: userID,
+		ActorID:    "system",
+		Metadata: map[string]any{
+			"email":  u.Email,
+			"phone":  u.Phone,
+			"source": "seed",
+		},
+		Success: true,
+	})
+
+	return assignUserRole(ctx, dbPool, al, userID, u.Email, u.Role)
+}
+
+func assignUserRole(ctx context.Context, dbPool *pgxpool.Pool, al audit.Logger, userID, email, roleName string) error {
+	var roleID string
+
+	err := dbPool.QueryRow(ctx, "SELECT id FROM auth.roles WHERE name = $1", roleName).Scan(&roleID)
+	if err != nil {
+		return fmt.Errorf("failed to find role %s: %w", roleName, err)
+	}
+
+	// Clear existing roles to ensure configuration is the single source of truth
+	if _, err := dbPool.Exec(ctx, "DELETE FROM auth.user_roles WHERE user_id = $1", userID); err != nil {
+		return fmt.Errorf("failed to clear existing roles for user %s: %w", email, err)
+	}
+
+	_, err = dbPool.Exec(ctx, "INSERT INTO auth.user_roles (user_id, role_id) VALUES ($1, $2) ON CONFLICT DO NOTHING", userID, roleID)
+	if err != nil {
+		return fmt.Errorf("failed to assign role to user %s: %w", email, err)
+	}
+
+	// Audit Log: Role Assigned
+	al.Log(ctx, audit.LogParams{
+		Action:     "user.role_assigned",
+		Resource:   "users",
+		ResourceID: userID,
+		ActorID:    "system",
+		Metadata: map[string]any{
+			"role":    roleName,
+			"role_id": roleID,
+			"source":  "seed",
+		},
+		Success: true,
+	})
+
+	return nil
+}
diff --git a/proto/auth/v1/auth.proto b/proto/auth/v1/auth.proto
index 86d4c53..b9ffb93 100644
--- a/proto/auth/v1/auth.proto
+++ b/proto/auth/v1/auth.proto
@@ -25,8 +25,8 @@ service AuthService {
     };
   }
 
-  // RefreshToken exchanges a refresh token for a new access token
-  rpc RefreshToken(RefreshTokenRequest) returns (RefreshTokenResponse) {
+  // RefreshSession exchanges a refresh token for a new access token
+  rpc RefreshSession(RefreshSessionRequest) returns (RefreshSessionResponse) {
     option (google.api.http) = {
       post: "/v1/auth/token/refresh"
       body: "*"
@@ -140,6 +140,37 @@ service AuthService {
       get: "/v1/auth/oauth/accounts"
     };
   }
+
+  // Register creates a new user account
+  rpc Register(RegisterRequest) returns (RegisterResponse) {
+    option (google.api.http) = {
+      post: "/v1/auth/register"
+      body: "*"
+    };
+  }
+
+  // GetSystemConfig returns public system configurations and feature flags
+  rpc GetSystemConfig(GetSystemConfigRequest) returns (GetSystemConfigResponse) {
+    option (google.api.http) = {
+      get: "/v1/auth/config"
+    };
+  }
+
+  // RequestEmailVerification initiates the email verification process
+  rpc RequestEmailVerification(RequestEmailVerificationRequest) returns (RequestEmailVerificationResponse) {
+    option (google.api.http) = {
+      post: "/v1/auth/email/verify/request"
+      body: "*"
+    };
+  }
+}
+
+// --- System Configuration Messages ---
+
+message GetSystemConfigRequest {}
+
+message GetSystemConfigResponse {
+  map<string, string> configs = 1;
 }
 
 // --- Login Messages ---
@@ -184,15 +215,39 @@ message CompleteLoginResponse {
   int64 expires_in = 3; // Seconds
 }
 
-// --- Token Messages ---
+// --- Registration Messages ---
 
-message RefreshTokenRequest {
-  string refresh_token = 1 [(buf.validate.field).string = {
-    min_len: 1
+message RegisterRequest {
+  oneof contact_info {
+    option (buf.validate.oneof).required = true;
+    string email = 1 [(buf.validate.field).string.email = true];
+    string phone = 2 [(buf.validate.field).string.pattern = "^\\+?[1-9]\\d{1,14}$"];
+  }
+  string display_name = 3 [(buf.validate.field).string = {
+    min_len: 2,
+    max_len: 100
   }];
+  string nationality = 4 [(buf.validate.field).string = {
+    pattern: "^[A-Z]{2}$"
+  }];
+  string document_type = 5 [(buf.validate.field).string.min_len = 1];
+  string document_number = 6 [(buf.validate.field).string.min_len = 1];
+}
+
+message RegisterResponse {
+  bool success = 1;
+  string message = 2;
+  User user = 3;
 }
 
-message RefreshTokenResponse {
+// --- Token Messages ---
+
+// refresh_token may be empty when using HttpOnly cookie (cookie takes precedence).
+message RefreshSessionRequest {
+  string refresh_token = 1;
+}
+
+message RefreshSessionResponse {
   string access_token = 1;
   string refresh_token = 2;
   int64 expires_in = 3;
@@ -218,6 +273,9 @@ message User {
   string avatar_url = 5;
   google.protobuf.Timestamp created_at = 6;
   google.protobuf.Timestamp updated_at = 7;
+  bool email_verified = 8;
+  bool phone_verified = 9;
+  string timezone = 10;
 }
 
 message GetProfileRequest {}
@@ -230,6 +288,7 @@ message UpdateProfileRequest {
   // Optional fields - validation only applies when field is set
   string display_name = 1 [(buf.validate.field).string.max_len = 100];
   string avatar_url = 2 [(buf.validate.field).string.uri = true];
+  string timezone = 3 [(buf.validate.field).string.max_len = 64];
 }
 
 message UpdateProfileResponse {
@@ -383,3 +442,12 @@ message ListLinkedAccountsRequest {}
 message ListLinkedAccountsResponse {
   repeated ExternalAccount accounts = 1;
 }
+
+// --- Verification Messages ---
+
+message RequestEmailVerificationRequest {}
+
+message RequestEmailVerificationResponse {
+  bool success = 1;
+  string message = 2;
+}
diff --git a/scripts/coverage-report.sh b/scripts/coverage-report.sh
index 5daefad..36ac5b1 100755
--- a/scripts/coverage-report.sh
+++ b/scripts/coverage-report.sh
@@ -139,9 +139,9 @@ echo "╔═══════════════════════
 echo "║  💡 Comandos Útiles                                            ║"
 echo "╚════════════════════════════════════════════════════════════════╝"
 echo ""
-echo "  📊 Ver reporte HTML:     make test-coverage"
-echo "  🧪 Ejecutar tests:       make test"
-echo "  📈 Este reporte:         make coverage-report"
-echo "  🌐 Abrir en navegador:   make coverage-html"
+echo "  📊 Ver reporte HTML:     just test-coverage"
+echo "  🧪 Ejecutar tests:       just test"
+echo "  📈 Este reporte:         just coverage-report"
+echo "  🌐 Abrir en navegador:   just coverage-html"
 echo ""
 
diff --git a/scripts/db-reset.sh b/scripts/db-reset.sh
index 8934e3b..057eea2 100755
--- a/scripts/db-reset.sh
+++ b/scripts/db-reset.sh
@@ -62,10 +62,10 @@ echo ""
 echo "✅ All module schemas dropped"
 echo ""
 echo "🔄 Running migrations to recreate schemas..."
-if make migrate-up >/dev/null 2>&1; then
+if just migrate-up >/dev/null 2>&1; then
     echo "✅ Migrations completed successfully"
 else
-    echo "⚠️  Migration had errors (run 'make migrate-up' manually to see details)"
+    echo "⚠️  Migration had errors (run 'just migrate-up' manually to see details)"
     exit 1
 fi
 
diff --git a/scripts/destroy-module.sh b/scripts/destroy-module.sh
index 4216035..f0fb214 100755
--- a/scripts/destroy-module.sh
+++ b/scripts/destroy-module.sh
@@ -212,19 +212,19 @@ echo ""
 # Step 5: Regenerate code and tidy dependencies
 echo "🔄 Step 5: Regenerating code and tidying dependencies..."
 echo ""
-echo "  Running 'make generate-all'..."
-if make generate-all >/dev/null 2>&1; then
+echo "  Running 'just generate-all'..."
+if just generate-all >/dev/null 2>&1; then
     echo "  ✅ Code generation completed"
 else
-    echo "  ⚠️  Code generation had errors (run 'make generate-all' manually to see details)"
+    echo "  ⚠️  Code generation had errors (run 'just generate-all' manually to see details)"
 fi
 
 echo ""
-echo "  Running 'make tidy'..."
-if make tidy >/dev/null 2>&1; then
+echo "  Running 'just tidy'..."
+if just tidy >/dev/null 2>&1; then
     echo "  ✅ Dependencies tidied"
 else
-    echo "  ⚠️  Tidy had errors (run 'make tidy' manually to see details)"
+    echo "  ⚠️  Tidy had errors (run 'just tidy' manually to see details)"
 fi
 
 echo ""
diff --git a/scripts/docs-i18n-check.sh b/scripts/docs-i18n-check.sh
new file mode 100755
index 0000000..0ff228a
--- /dev/null
+++ b/scripts/docs-i18n-check.sh
@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "$0")/.." && pwd)"
+MAP_FILE="$ROOT_DIR/docs/docs-site/i18n-map.csv"
+
+if [[ ! -f "$MAP_FILE" ]]; then
+  echo "i18n map not found: $MAP_FILE"
+  exit 1
+fi
+
+missing=0
+while IFS=, read -r es_path en_path; do
+  [[ "$es_path" == "es_path" ]] && continue
+
+  if [[ ! -f "$ROOT_DIR/docs/$es_path" ]]; then
+    echo "Missing ES file: docs/$es_path"
+    missing=1
+  fi
+
+  if [[ ! -f "$ROOT_DIR/docs/$en_path" ]]; then
+    echo "Missing EN file: docs/$en_path"
+    missing=1
+  fi
+done < "$MAP_FILE"
+
+if [[ $missing -ne 0 ]]; then
+  exit 1
+fi
+
+echo "OK: ES/EN mapped files exist"
diff --git a/scripts/docs-sync-openapi.sh b/scripts/docs-sync-openapi.sh
new file mode 100755
index 0000000..6be876e
--- /dev/null
+++ b/scripts/docs-sync-openapi.sh
@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "$0")/.." && pwd)"
+SRC_DIR="$ROOT_DIR/gen/openapiv2/proto"
+DST_DIR="$ROOT_DIR/docs/api/openapi"
+
+if [[ ! -d "$SRC_DIR" ]]; then
+  echo "OpenAPI source directory not found: $SRC_DIR"
+  echo "Run 'just be-proto' first to generate swagger files."
+  exit 1
+fi
+
+mkdir -p "$DST_DIR"
+
+# Keep destination in sync with generated specs.
+rm -rf "$DST_DIR"/*
+cp -R "$SRC_DIR"/* "$DST_DIR"/
+
+echo "OK: OpenAPI specs synced to docs/api/openapi"
diff --git a/scripts/doctor.sh b/scripts/doctor.sh
index 1f98a71..8aa9cba 100755
--- a/scripts/doctor.sh
+++ b/scripts/doctor.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-# Development environment diagnostic script for Go Modulith Template
+# Development environment diagnostic script for OPOS
 # Comprehensive health check and diagnostics
 
 set -e
@@ -190,7 +190,7 @@ else
         echo "  Start Docker Desktop or docker service"
         ((ERRORS++))
     else
-        CONTAINERS=("modulith_db" "modulith_redis" "modulith_jaeger" "modulith_prometheus" "modulith_grafana")
+        CONTAINERS=("modulith_db" "modulith_redis" "template_jaeger" "template_prometheus" "template_grafana")
         for container in "${CONTAINERS[@]}"; do
             if docker ps --format '{{.Names}}' 2>/dev/null | grep -q "^${container}$"; then
                 STATUS=$(docker inspect --format='{{.State.Status}}' "$container" 2>/dev/null || echo "unknown")
@@ -225,10 +225,11 @@ echo ""
 check_port_detailed $(get_app_port_from_env "HTTP_PORT" "8000") "HTTP"
 check_port_detailed $(get_app_port_from_env "GRPC_PORT" "9000") "gRPC"
 check_container_port $(get_port_from_env "DB_PORT" "5432") "PostgreSQL" "modulith_db"
-check_container_port $(get_port_from_env "REDIS_PORT" "6379") "Redis" "modulith_redis"
-check_container_port $(get_port_from_env "JAEGER_UI_PORT" "16686") "Jaeger UI" "modulith_jaeger"
-check_container_port $(get_port_from_env "PROMETHEUS_PORT" "9090") "Prometheus" "modulith_prometheus"
-check_container_port $(get_port_from_env "GRAFANA_PORT" "3000") "Grafana" "modulith_grafana"
+check_container_port $(get_port_from_env "REDIS_PORT" "6379") "Valkey" "modulith_redis"
+check_container_port $(get_port_from_env "JAEGER_UI_PORT" "16686") "Jaeger UI" "template_jaeger"
+check_container_port $(get_port_from_env "PROMETHEUS_PORT" "9090") "Prometheus" "template_prometheus"
+check_container_port $(get_port_from_env "GRAFANA_PORT" "3000") "Grafana" "template_grafana"
+check_port_detailed $(get_app_port_from_env "VITE_PORT" "3001") "Admin Panel"
 
 echo ""
 
@@ -239,38 +240,36 @@ echo -e "${BLUE}━━━━━━━━━━━━━━━━━━━━━
 echo ""
 
 if docker ps --format '{{.Names}}' 2>/dev/null | grep -q "modulith_db"; then
-    echo -n "  PostgreSQL connection: "
+    echo -n "   - PostgreSQL Ready: "
     if docker exec modulith_db pg_isready -U postgres > /dev/null 2>&1; then
-        echo -e "${GREEN}✓${NC} connected"
-
-        # Try to query
-        echo -n "  Database query test: "
-        if docker exec modulith_db psql -U postgres -d postgres -c "SELECT 1" > /dev/null 2>&1; then
+        echo -e "${GREEN}✓${NC} YES"
+    else
+        echo -e "${RED}✗${NC} NO (Container running but not ready)"
+        ((ERRORS++))
+    fi
+    echo -n "   - Database 'postgres' accessible: "
+    if docker exec modulith_db psql -U postgres -d postgres -c "SELECT 1" > /dev/null 2>&1; then
             echo -e "${GREEN}✓${NC} working"
         else
             echo -e "${YELLOW}⚠${NC} connection issues"
             ((WARNINGS++))
         fi
-    else
-        echo -e "${RED}✗${NC} not ready"
-        ((ERRORS++))
-    fi
 else
     echo -e "${YELLOW}⚠${NC} Database container not running"
-    echo "  Start with: make docker-up"
+    echo "  Start with: just docker-up"
     ((WARNINGS++))
 fi
 
 echo ""
 
-# Section: Redis Connectivity
+# Section: Valkey Connectivity
 echo -e "${BLUE}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
-echo -e "${BLUE}Redis Connectivity${NC}"
+echo -e "${BLUE}Valkey Connectivity${NC}"
 echo -e "${BLUE}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
 echo ""
 
 if docker ps --format '{{.Names}}' 2>/dev/null | grep -q "modulith_redis"; then
-    echo -n "  Redis connection: "
+    echo -n "   - Valkey PING: "
     if docker exec modulith_redis redis-cli ping > /dev/null 2>&1; then
         echo -e "${GREEN}✓${NC} connected"
     else
@@ -278,7 +277,7 @@ if docker ps --format '{{.Names}}' 2>/dev/null | grep -q "modulith_redis"; then
         ((ERRORS++))
     fi
 else
-    echo -e "${YELLOW}⚠${NC} Redis container not running"
+    echo -e "${YELLOW}⚠${NC} Valkey container not running"
     ((WARNINGS++))
 fi
 
@@ -290,7 +289,7 @@ echo -e "${BLUE}Configuration Files${NC}"
 echo -e "${BLUE}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
 echo ""
 
-CONFIG_FILES=("configs/server.yaml" "go.mod" "go.sum" "docker-compose.yaml")
+CONFIG_FILES=("configs/server.yaml" "go.mod" "go.sum" "docker-compose.yaml" "web/admin/vite.config.ts")
 for file in "${CONFIG_FILES[@]}"; do
     if [ -f "$file" ]; then
         echo -e "${GREEN}✓${NC} $file"
diff --git a/scripts/graphql-add-to-project.sh b/scripts/graphql-add-to-project.sh
index b7a8e90..dc6e284 100755
--- a/scripts/graphql-add-to-project.sh
+++ b/scripts/graphql-add-to-project.sh
@@ -84,7 +84,7 @@ type Subscription {
 EOF
     echo "✅ Created root schema at ${SCHEMA_DIR}/schema.graphql"
     echo "   💡 Tip: Create schemas per module (e.g., auth.graphql, order.graphql, payment.graphql)"
-    echo "   💡 Tip: Use 'make new-module <name>' to scaffold a module with GraphQL schema"
+    echo "   💡 Tip: Use 'just new-module <name>' to scaffold a module with GraphQL schema"
 else
     echo "ℹ️  Schema already exists, skipping..."
 fi
@@ -95,7 +95,7 @@ echo "📝 Creating generated package stub..."
 mkdir -p "${GENERATED_DIR}"
 cat > "${GENERATED_DIR}/generated.go" <<'EOF'
 // Package generated contains generated GraphQL code.
-// This file is a stub - run 'make graphql-generate' to generate the actual code.
+// This file is a stub - run 'just graphql-generate' to generate the actual code.
 package generated
 
 // Config is the configuration for the GraphQL executable schema.
@@ -197,7 +197,7 @@ if [ ! -f "${RESOLVER_DIR}/resolver.go" ] || grep -q "This is a stub file" "${RE
     cat > "${RESOLVER_DIR}/resolver.go" <<'EOF'
 // Package resolver implements GraphQL resolvers.
 // This package provides the root resolver structure that will be used by gqlgen
-// when GraphQL is initialized via `make graphql-init`.
+// when GraphQL is initialized via `just graphql-init`.
 //
 // The resolver structure is ready to use and provides:
 // - Query resolver for read operations
@@ -337,10 +337,10 @@ echo ""
 
 echo "📚 Next steps:"
 echo "   1. Edit ${SCHEMA_DIR}/schema.graphql to add your queries/mutations"
-echo "   2. Run 'make graphql-generate-all' to regenerate code after schema changes"
-echo "   Or run 'make graphql-generate-module <module>' for a specific module"
+echo "   2. Run 'just graphql-generate-all' to regenerate code after schema changes"
+echo "   Or run 'just graphql-generate-module <module>' for a specific module"
 echo "   3. Implement resolvers in ${RESOLVER_DIR}/"
-echo "   4. Run 'make run' to start the server"
+echo "   4. Run 'just run' to start the server"
 echo "   5. Access playground at http://localhost:8080/graphql/playground (dev mode)"
 echo ""
 echo "   ✅ GraphQL is integrated and code has been generated"
diff --git a/scripts/graphql-from-proto-all.sh b/scripts/graphql-from-proto-all.sh
index 6a4cc9a..250c724 100755
--- a/scripts/graphql-from-proto-all.sh
+++ b/scripts/graphql-from-proto-all.sh
@@ -14,7 +14,7 @@ echo "🔄 Generating GraphQL schemas from OpenAPI definitions..."
 
 # Check if GraphQL is initialized
 if [ ! -d "${SCHEMA_DIR}" ]; then
-    echo "❌ GraphQL not initialized. Run: make graphql-init"
+    echo "❌ GraphQL not initialized. Run: just graphql-init"
     exit 1
 fi
 
@@ -38,7 +38,7 @@ for swagger_file in "${OPENAPI_DIR}"/*/v1/*.swagger.json; do
 done
 
 if [ ${#MODULES[@]} -eq 0 ]; then
-    echo "⚠️  No OpenAPI files found. Run 'make proto' first to generate OpenAPI definitions."
+    echo "⚠️  No OpenAPI files found. Run 'just proto' first to generate OpenAPI definitions."
     exit 0
 fi
 
@@ -71,7 +71,7 @@ if [ $GENERATED -gt 0 ]; then
     echo ""
     echo "📝 Next steps:"
     echo "   1. Review and customize the generated schemas in ${SCHEMA_DIR}/"
-    echo "   2. Run 'make graphql-generate-all' to generate resolver code"
+    echo "   2. Run 'just graphql-generate-all' to generate resolver code"
     echo "   3. Implement resolvers in internal/graphql/resolver/"
 else
     echo "⚠️  No schemas were generated"
diff --git a/scripts/graphql-from-proto/main.go b/scripts/graphql-from-proto/main.go
index 5cf67bc..2831349 100644
--- a/scripts/graphql-from-proto/main.go
+++ b/scripts/graphql-from-proto/main.go
@@ -153,7 +153,7 @@ func generateGraphQLSchema(openAPI OpenAPI2, _ string) string {
 	// Header (GraphQL uses # for comments, not //)
 	sb.WriteString("# Auto-generated GraphQL schema from OpenAPI/Swagger definition\n")
 	sb.WriteString("# DO NOT EDIT - This file is generated from proto definitions\n")
-	sb.WriteString("# Run 'make proto' and 'make graphql-from-proto' to regenerate\n\n")
+	sb.WriteString("# Run 'just proto' and 'just graphql-from-proto' to regenerate\n\n")
 
 	// Generate types from definitions
 	generateTypes(&sb, openAPI.Defs)
diff --git a/scripts/graphql-generate-all.sh b/scripts/graphql-generate-all.sh
index ddb075f..8ae555a 100755
--- a/scripts/graphql-generate-all.sh
+++ b/scripts/graphql-generate-all.sh
@@ -10,7 +10,7 @@ SCHEMA_DIR="${PROJECT_ROOT}/internal/graphql/schema"
 
 # Check if GraphQL is initialized
 if [ ! -f "${PROJECT_ROOT}/gqlgen.yml" ]; then
-    echo "❌ GraphQL not initialized. Run: make graphql-init"
+    echo "❌ GraphQL not initialized. Run: just graphql-init"
     exit 1
 fi
 
@@ -23,7 +23,7 @@ fi
 # Check if schema directory exists
 if [ ! -d "${SCHEMA_DIR}" ]; then
     echo "❌ GraphQL schema directory not found: ${SCHEMA_DIR}"
-    echo "   Run 'make graphql-init' to initialize GraphQL"
+    echo "   Run 'just graphql-init' to initialize GraphQL"
     exit 1
 fi
 
@@ -33,7 +33,7 @@ echo "🔍 Discovering modules with GraphQL schemas..."
 ROOT_SCHEMA="${SCHEMA_DIR}/schema.graphql"
 if [ ! -f "${ROOT_SCHEMA}" ]; then
     echo "❌ Root schema not found: ${ROOT_SCHEMA}"
-    echo "   Run 'make graphql-init' to initialize GraphQL"
+    echo "   Run 'just graphql-init' to initialize GraphQL"
     exit 1
 fi
 
diff --git a/scripts/graphql-generate-module.sh b/scripts/graphql-generate-module.sh
index 715088f..2d861f5 100755
--- a/scripts/graphql-generate-module.sh
+++ b/scripts/graphql-generate-module.sh
@@ -17,7 +17,7 @@ MODULE_SCHEMA="${SCHEMA_DIR}/${MODULE_NAME}.graphql"
 
 # Check if GraphQL is initialized
 if [ ! -f "${PROJECT_ROOT}/gqlgen.yml" ]; then
-    echo "❌ GraphQL not initialized. Run: make graphql-init"
+    echo "❌ GraphQL not initialized. Run: just graphql-init"
     exit 1
 fi
 
@@ -50,8 +50,8 @@ if [ ! -f "${MODULE_SCHEMA}" ]; then
     # Check if OpenAPI file exists
     if [ ! -f "${OPENAPI_FILE}" ]; then
         echo "❌ OpenAPI file not found: ${OPENAPI_FILE}"
-        echo "   Run 'make proto' first to generate OpenAPI definitions,"
-        echo "   or run 'make new-module ${MODULE_NAME}' to create the schema manually."
+        echo "   Run 'just proto' first to generate OpenAPI definitions,"
+        echo "   or run 'just new-module ${MODULE_NAME}' to create the schema manually."
         exit 1
     fi
 
diff --git a/scripts/preflight-check.sh b/scripts/preflight-check.sh
index f98e2df..45a4a25 100755
--- a/scripts/preflight-check.sh
+++ b/scripts/preflight-check.sh
@@ -28,7 +28,7 @@ fi
 # Check if database container is running
 if ! docker ps --format '{{.Names}}' 2>/dev/null | grep -q "modulith_db"; then
     echo -e "${RED}Error: Database container is not running${NC}"
-    echo "  Start it with: make docker-up"
+    echo "  Start it with: just docker-up"
     exit 1
 fi
 
diff --git a/scripts/proto-version-create.sh b/scripts/proto-version-create.sh
index 7ec1f1f..d56c072 100755
--- a/scripts/proto-version-create.sh
+++ b/scripts/proto-version-create.sh
@@ -129,7 +129,7 @@ echo "📝 Next steps:"
 echo "   1. Review and modify $NEW_VERSION_DIR/$PROTO_FILENAME"
 echo "   2. Update REST paths from /${LATEST_VERSION#v}/ to /${VERSION#v}/ if needed"
 echo "   3. Make your breaking changes"
-echo "   4. Run 'make proto' to generate code"
+echo "   4. Run 'just proto' to generate code"
 echo "   5. Implement service handlers for the new version"
 echo ""
 
diff --git a/scripts/quickstart.sh b/scripts/quickstart.sh
index 1ba5adc..deb176e 100755
--- a/scripts/quickstart.sh
+++ b/scripts/quickstart.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-# Quickstart script for Go Modulith Template
+# Quickstart script for OPOS
 # Automates the complete setup process
 
 set -e
@@ -15,8 +15,8 @@ NC='\033[0m' # No Color
 PROJECT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 cd "$PROJECT_ROOT"
 
-echo -e "${BLUE}╔══════════════════════════════════════════════════════╗${NC}"
-echo -e "${BLUE}║  Go Modulith Template - Quickstart Setup            ║${NC}"
+echo -e "${BLUE}╔═════════════════════════════════════════════════════╗${NC}"
+echo -e "${BLUE}║  Opos - Quickstart Setup                            ║${NC}"
 echo -e "${BLUE}╚══════════════════════════════════════════════════════╝${NC}"
 echo ""
 
@@ -46,11 +46,11 @@ if [ ${#MISSING_TOOLS[@]} -gt 0 ]; then
     read -r response
     if [[ "$response" =~ ^([yY][eE][sS]|[yY])$ ]]; then
         echo "Installing development tools..."
-        make install-deps
+        just install-deps
         echo -e "${GREEN}✓ Tools installed${NC}"
     else
         echo -e "${YELLOW}⚠ Skipping tool installation${NC}"
-        echo "You can install them later with: make install-deps"
+        echo "You can install them later with: just install-deps"
     fi
 else
     echo -e "${GREEN}✓ All development tools are installed${NC}"
@@ -85,6 +85,7 @@ MAX_WAIT=60
 WAIT_COUNT=0
 
 while [ $WAIT_COUNT -lt $MAX_WAIT ]; do
+    echo -n "Waiting for database to be ready... "
     if docker ps --format '{{.Names}}' 2>/dev/null | grep -q "modulith_db"; then
         if docker exec modulith_db pg_isready -U postgres > /dev/null 2>&1; then
             echo -e "${GREEN}✓ Database is ready${NC}"
@@ -93,7 +94,6 @@ while [ $WAIT_COUNT -lt $MAX_WAIT ]; do
     fi
     sleep 1
     WAIT_COUNT=$((WAIT_COUNT + 1))
-    echo -n "."
 done
 echo ""
 
@@ -103,8 +103,8 @@ if [ $WAIT_COUNT -eq $MAX_WAIT ]; then
     exit 1
 fi
 
-# Wait a bit more for Redis
-sleep 2
+# Check Redis
+echo -n "Checking Redis connection... "
 if docker ps --format '{{.Names}}' 2>/dev/null | grep -q "modulith_redis"; then
     if docker exec modulith_redis redis-cli ping > /dev/null 2>&1; then
         echo -e "${GREEN}✓ Redis is ready${NC}"
@@ -114,7 +114,7 @@ echo ""
 
 # Step 4: Run migrations
 echo -e "${BLUE}Step 4/5:${NC} Running database migrations..."
-if make migrate 2>&1 | grep -q "no change"; then
+if just migrate 2>&1 | grep -q "no change"; then
     echo -e "${GREEN}✓ Database is up to date${NC}"
 else
     echo -e "${GREEN}✓ Migrations completed${NC}"
@@ -127,11 +127,11 @@ echo -n "Run seed data? [y/N] "
 read -r response
 if [[ "$response" =~ ^([yY][eE][sS]|[yY])$ ]]; then
     echo "Running seed data..."
-    make seed
+    just seed
     echo -e "${GREEN}✓ Seed data completed${NC}"
 else
     echo -e "${YELLOW}⚠ Skipping seed data${NC}"
-    echo "You can run it later with: make seed"
+    echo "You can run it later with: just seed"
 fi
 echo ""
 
@@ -143,10 +143,10 @@ echo ""
 echo "Next steps:"
 echo ""
 echo "  1. Start the development server:"
-echo -e "     ${GREEN}make dev${NC}"
+echo -e "     ${GREEN}just dev${NC}"
 echo ""
 echo "  2. Or run a specific module:"
-echo -e "     ${GREEN}make dev-module auth${NC}"
+echo -e "     ${GREEN}just dev-module auth${NC}"
 echo ""
 echo "  3. Check health endpoints:"
 echo "     curl http://localhost:8000/readyz"
@@ -157,6 +157,6 @@ echo "     - Prometheus: http://localhost:9090"
 echo "     - Grafana: http://localhost:3000 (admin/admin)"
 echo ""
 echo "  5. Run diagnostics:"
-echo -e "     ${GREEN}make doctor${NC}"
+echo -e "     ${GREEN}just doctor${NC}"
 echo ""
 
diff --git a/scripts/scaffold-module.sh b/scripts/scaffold-module.sh
index bf85eee..3507c4b 100755
--- a/scripts/scaffold-module.sh
+++ b/scripts/scaffold-module.sh
@@ -7,7 +7,7 @@ if [ -z "$1" ]; then
 fi
 
 MODULE_NAME=$1
-PROJECT_NAME="github.com/cmelgarejo/go-modulith-template"
+PROJECT_NAME="github.com/LoopContext/go-modulith-template"
 
 # Capitalize first letter
 MODULE_NAME_CAPITALIZED="$(tr '[:lower:]' '[:upper:]' <<< ${MODULE_NAME:0:1})${MODULE_NAME:1}"
@@ -112,8 +112,8 @@ if [ -d "${GRAPHQL_SCHEMA_DIR}" ]; then
         process_template "templates/module/graphql/schema.graphql.tmpl" "${GRAPHQL_SCHEMA_FILE}"
         echo "  ✅ Created ${GRAPHQL_SCHEMA_FILE}"
         echo ""
-        echo "  💡 Tip: After defining your proto file and running 'make proto',"
-        echo "     run 'make graphql-generate-module MODULE_NAME=${MODULE_NAME}'"
+        echo "  💡 Tip: After defining your proto file and running 'just proto',"
+        echo "     run 'just graphql-generate-module MODULE_NAME=${MODULE_NAME}'"
         echo "     which will auto-generate the schema from proto if missing"
     else
         echo "  ℹ️  ${GRAPHQL_SCHEMA_FILE} already exists, skipping..."
@@ -128,7 +128,7 @@ if [ -d "${GRAPHQL_SCHEMA_DIR}" ]; then
     fi
 else
     echo "  ℹ️  GraphQL not initialized - skipping GraphQL files"
-    echo "     Run 'make graphql-init' to enable GraphQL support"
+    echo "     Run 'just graphql-init' to enable GraphQL support"
 fi
 
 # Update sqlc.yaml
@@ -151,7 +151,7 @@ fi
 # Register module in registry.go
 register_module_in_registry() {
     local registry_file="cmd/server/setup/registry.go"
-    local import_path="github.com/cmelgarejo/go-modulith-template/modules/${MODULE_NAME}"
+    local import_path="github.com/LoopContext/go-modulith-template/modules/${MODULE_NAME}"
 
     if [ ! -f "$registry_file" ]; then
         echo "⚠️  Warning: ${registry_file} not found, skipping auto-registration"
@@ -260,14 +260,14 @@ echo "🔧 Registering module in registry..."
 register_module_in_registry
 
 echo ""
-echo "⚙️  Running code generation (make generate-all)..."
-if make generate-all; then
+echo "⚙️  Running code generation (just generate-all)..."
+if just generate-all; then
     echo ""
     echo "  ✅ Code generation completed successfully"
 else
     echo ""
     echo "  ❌ Error: Code generation failed!"
-    echo "     Please run 'make generate-all' manually to see the errors"
+    echo "     Please run 'just generate-all' manually to see the errors"
     exit 1
 fi
 
@@ -292,15 +292,15 @@ echo "✅ Module setup complete! Next steps:"
 if [ -d "${GRAPHQL_SCHEMA_DIR}" ]; then
     echo ""
     echo "1. Edit ${GRAPHQL_SCHEMA_FILE} to define your GraphQL schema."
-    echo "2. Run 'make graphql-generate-module MODULE_NAME=${MODULE_NAME}' to generate GraphQL code for this module."
-    echo "   Or run 'make graphql-generate-all' to generate for all modules."
+    echo "2. Run 'just graphql-generate-module MODULE_NAME=${MODULE_NAME}' to generate GraphQL code for this module."
+    echo "   Or run 'just graphql-generate-all' to generate for all modules."
     echo "3. Implement resolvers in ${GRAPHQL_RESOLVER_FILE}."
-    echo "4. Run 'make dev-module ${MODULE_NAME}' for hot-reload development."
-    echo "   Or run 'make build-module ${MODULE_NAME}' to build standalone binary."
+    echo "4. Run 'just dev-module ${MODULE_NAME}' for hot-reload development."
+    echo "   Or run 'just build-module ${MODULE_NAME}' to build standalone binary."
 else
     echo ""
-    echo "1. Run 'make dev-module ${MODULE_NAME}' for hot-reload development."
-    echo "   Or run 'make build-module ${MODULE_NAME}' to build standalone binary."
+    echo "1. Run 'just dev-module ${MODULE_NAME}' for hot-reload development."
+    echo "   Or run 'just build-module ${MODULE_NAME}' to build standalone binary."
     echo ""
-    echo "💡 Tip: Run 'make graphql-init' to enable GraphQL support for future modules."
+    echo "💡 Tip: Run 'just graphql-init' to enable GraphQL support for future modules."
 fi
diff --git a/scripts/validate-setup.sh b/scripts/validate-setup.sh
index 91f9b63..5de0ab4 100755
--- a/scripts/validate-setup.sh
+++ b/scripts/validate-setup.sh
@@ -208,7 +208,7 @@ check_database() {
     # Check if docker containers are running
     if ! docker ps --format '{{.Names}}' 2>/dev/null | grep -q "modulith_db"; then
         echo -e "${YELLOW}⚠${NC} (containers not running)"
-        echo "  Info: Database container is not running. Run 'make docker-up' to start it."
+        echo "  Info: Database container is not running. Run 'just docker-up' to start it."
         return 0  # Not an error, just informational
     fi
 
@@ -233,11 +233,11 @@ check_docker_compose
 
 echo ""
 echo "Checking development tools..."
-check_tool "sqlc" "make install-deps"
-check_tool "buf" "make install-deps"
-check_tool "migrate" "make install-deps"
-check_tool "air" "make install-deps"
-check_tool "golangci-lint" "make install-deps"
+check_tool "sqlc" "just install-deps"
+check_tool "buf" "just install-deps"
+check_tool "migrate" "just install-deps"
+check_tool "air" "just install-deps"
+check_tool "golangci-lint" "just install-deps"
 
 echo ""
 echo "Checking port availability..."
diff --git a/sqlc.yaml b/sqlc.yaml
index fe40392..02e2a2b 100644
--- a/sqlc.yaml
+++ b/sqlc.yaml
@@ -2,14 +2,12 @@ version: "2"
 sql:
   - engine: "postgresql"
     queries: "modules/auth/internal/db/query/"
-    schema:
-      - "modules/auth/resources/db/migration/000001_initial_schema.up.sql"
-      - "modules/auth/resources/db/migration/000002_sessions_and_profile.up.sql"
-      - "modules/auth/resources/db/migration/000003_external_accounts.up.sql"
+    schema: "modules/auth/resources/db/migration"
     gen:
       go:
         package: "store"
         out: "modules/auth/internal/db/store"
-        sql_package: "database/sql"
+        sql_package: "pgx/v5"
         emit_interface: true
         emit_json_tags: true
+
diff --git a/templates/module/graphql/resolver.go.tmpl b/templates/module/graphql/resolver.go.tmpl
index 0b1dbbc..d6679ee 100644
--- a/templates/module/graphql/resolver.go.tmpl
+++ b/templates/module/graphql/resolver.go.tmpl
@@ -11,7 +11,7 @@ import (
 
 // {{.MODULE_NAME_CAPITALIZED}} module resolvers
 // These methods are added to queryResolver, mutationResolver, and subscriptionResolver
-// in schema.resolvers.go after running 'make graphql-generate'
+// in schema.resolvers.go after running 'just graphql-generate'
 //
 // Note: gqlgen generates resolver structs that embed *Resolver:
 //   type queryResolver struct{ *Resolver }
@@ -28,7 +28,7 @@ import (
 // Then access it in resolvers via: r.{{.MODULE_NAME}}Client
 
 // Query resolvers for {{.MODULE_NAME}} module
-// TODO: Implement after running 'make graphql-generate'
+// TODO: Implement after running 'just graphql-generate'
 // Example:
 // func (r *queryResolver) Get{{.MODULE_STRUCT_NAME}}(ctx context.Context, id string) (*generated.{{.MODULE_STRUCT_NAME}}, error) {
 //     // Access service client via embedded Resolver
@@ -49,7 +49,7 @@ import (
 // }
 
 // Mutation resolvers for {{.MODULE_NAME}} module
-// TODO: Implement after running 'make graphql-generate'
+// TODO: Implement after running 'just graphql-generate'
 // Example:
 // func (r *mutationResolver) Create{{.MODULE_STRUCT_NAME}}(ctx context.Context, input generated.Create{{.MODULE_STRUCT_NAME}}Input) (*generated.{{.MODULE_STRUCT_NAME}}, error) {
 //     req := &{{.MODULE_NAME}}v1.Create{{.MODULE_STRUCT_NAME}}Request{
@@ -68,7 +68,7 @@ import (
 // }
 
 // Subscription resolvers for {{.MODULE_NAME}} module
-// TODO: Implement after running 'make graphql-generate'
+// TODO: Implement after running 'just graphql-generate'
 // Example:
 // func (r *subscriptionResolver) {{.MODULE_NAME_CAPITALIZED}}Events(ctx context.Context) (<-chan *generated.{{.MODULE_STRUCT_NAME}}Event, error) {
 //     ch := make(chan *generated.{{.MODULE_STRUCT_NAME}}Event)
diff --git a/templates/module/resources/db/seed/001_example_data.sql.tmpl b/templates/module/resources/db/seed/001_example_data.sql.tmpl
index 005e28b..cadb6b1 100644
--- a/templates/module/resources/db/seed/001_example_data.sql.tmpl
+++ b/templates/module/resources/db/seed/001_example_data.sql.tmpl
@@ -1,5 +1,5 @@
 -- Example seed data for {{.MODULE_NAME}} module
--- This file will be executed in alphabetical order when running: make seed
+-- This file will be executed in alphabetical order when running: just seed
 --
 -- You can create multiple seed files numbered in order (001_, 002_, etc.)
 -- Each file should contain INSERT statements for your module's tables