diff --git a/apps/server/package.json b/apps/server/package.json
index 8d734e02..b57086a4 100644
--- a/apps/server/package.json
+++ b/apps/server/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@erp/factuges-server",
-  "version": "0.7.6",
+  "version": "0.7.8",
   "private": true,
   "scripts": {
     "build": "tsup src/index.ts --config tsup.config.ts",
@@ -39,6 +39,7 @@
     "@erp/catalogs": "workspace:*",
     "@erp/customer-invoices": "workspace:*",
     "@erp/customers": "workspace:*",
+    "@erp/identity": "workspace:*",
     "@erp/factuges": "workspace:*",
     "@repo/rdx-logger": "workspace:*",
     "@repo/rdx-utils": "workspace:*",
diff --git a/apps/server/src/register-modules.ts b/apps/server/src/register-modules.ts
index b66b77b4..df47f97f 100644
--- a/apps/server/src/register-modules.ts
+++ b/apps/server/src/register-modules.ts
@@ -2,6 +2,7 @@ import catalogsAPIModule from "@erp/catalogs/api";
 import customerInvoicesAPIModule from "@erp/customer-invoices/api";
 import customersAPIModule from "@erp/customers/api";
 import factuGESAPIModule from "@erp/factuges/api";
+import identityAPIModule from "@erp/identity/api";
 
 //import suppliersAPIModule from "@erp/suppliers/api";
 
@@ -13,7 +14,7 @@ import { registerModule } from "./lib";
 // las rutas, los modelos y los servicios
 // públicos de ese módulo.
 export const registerModules = () => {
-  //registerModule(authAPIModule);
+  registerModule(identityAPIModule);
   registerModule(catalogsAPIModule);
   registerModule(customersAPIModule);
   registerModule(customerInvoicesAPIModule);
diff --git a/apps/web/package.json b/apps/web/package.json
index d4dcc716..f2f8626d 100644
--- a/apps/web/package.json
+++ b/apps/web/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@erp/factuges-web",
   "private": true,
-  "version": "0.7.6",
+  "version": "0.7.8",
   "type": "module",
   "scripts": {
     "typecheck": "tsc -p tsconfig.json --noEmit",
diff --git a/modules/auth/package.json b/modules/auth/package.json
index 60f027fa..e280de97 100644
--- a/modules/auth/package.json
+++ b/modules/auth/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@erp/auth",
-  "version": "0.7.6",
+  "version": "0.7.8",
   "private": true,
   "type": "module",
   "sideEffects": false,
diff --git a/modules/catalogs/package.json b/modules/catalogs/package.json
index 1193561d..18accab3 100644
--- a/modules/catalogs/package.json
+++ b/modules/catalogs/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@erp/catalogs",
   "description": "Catalogs module",
-  "version": "0.7.6",
+  "version": "0.7.8",
   "private": true,
   "type": "module",
   "sideEffects": false,
diff --git a/modules/core/package.json b/modules/core/package.json
index 5acf47ad..ee7a9af3 100644
--- a/modules/core/package.json
+++ b/modules/core/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@erp/core",
-  "version": "0.7.6",
+  "version": "0.7.8",
   "private": true,
   "type": "module",
   "sideEffects": false,
diff --git a/modules/core/src/common/types/index.ts b/modules/core/src/common/types/index.ts
index f36c9945..d28bb26d 100644
--- a/modules/core/src/common/types/index.ts
+++ b/modules/core/src/common/types/index.ts
@@ -1,2 +1,3 @@
 export * from "./dto.d";
 export * from "./module-metadata.d";
+export * from "./permissions";
diff --git a/modules/core/src/common/types/permissions.ts b/modules/core/src/common/types/permissions.ts
new file mode 100644
index 00000000..e43b4a28
--- /dev/null
+++ b/modules/core/src/common/types/permissions.ts
@@ -0,0 +1,7 @@
+export type PermissionCode = string;
+
+export type PermissionDefinition = {
+  code: PermissionCode;
+  module: string;
+  description: string;
+};
diff --git a/modules/customer-invoices/package.json b/modules/customer-invoices/package.json
index 4e417bf3..b1f14cae 100644
--- a/modules/customer-invoices/package.json
+++ b/modules/customer-invoices/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@erp/customer-invoices",
-  "version": "0.7.6",
+  "version": "0.7.8",
   "private": true,
   "type": "module",
   "sideEffects": false,
diff --git a/modules/customer-invoices/src/api/domain/common/value-objects/index.ts b/modules/customer-invoices/src/api/domain/common/value-objects/index.ts
index d69995a8..3c80d4b5 100644
--- a/modules/customer-invoices/src/api/domain/common/value-objects/index.ts
+++ b/modules/customer-invoices/src/api/domain/common/value-objects/index.ts
@@ -1,9 +1,6 @@
-export * from "../entities/invoice-tax-regime.entity";
-
 export * from "./invoice-address-type.vo";
 export * from "./invoice-amount.vo";
 export * from "./invoice-number.vo";
-export * from "./invoice-recipient/invoice-recipient.vo";
 export * from "./invoice-serie.vo";
 export * from "./invoice-status.vo";
 export * from "./item-amount.vo";
diff --git a/modules/customer-invoices/src/api/domain/common/value-objects/invoice-recipient/index.ts b/modules/customer-invoices/src/api/domain/common/value-objects/invoice-recipient/index.ts
deleted file mode 100644
index d7a9b283..00000000
--- a/modules/customer-invoices/src/api/domain/common/value-objects/invoice-recipient/index.ts
+++ /dev/null
@@ -1 +0,0 @@
-export * from "./invoice-recipient.vo";
diff --git a/modules/customer-invoices/src/api/domain/issued-invoices/aggregates/issued-invoice.aggregate.ts b/modules/customer-invoices/src/api/domain/issued-invoices/aggregates/issued-invoice.aggregate.ts
index f23856ba..5f97614d 100644
--- a/modules/customer-invoices/src/api/domain/issued-invoices/aggregates/issued-invoice.aggregate.ts
+++ b/modules/customer-invoices/src/api/domain/issued-invoices/aggregates/issued-invoice.aggregate.ts
@@ -15,7 +15,6 @@ import type {
   InvoiceAmount,
   InvoiceNumber,
   InvoicePaymentMethod,
-  InvoiceRecipient,
   InvoiceSerie,
   InvoiceStatus,
 } from "../../common";
@@ -27,6 +26,7 @@ import {
   type VerifactuRecord,
 } from "../entities";
 import { IssuedInvoiceItemMismatch } from "../errors";
+import type { IssuedInvoiceRecipient } from "../value-objects";
 
 export interface IIssuedInvoiceCreateProps {
   companyId: UniqueID;
@@ -41,7 +41,7 @@ export interface IIssuedInvoiceCreateProps {
   operationDate: Maybe<UtcDate>;
 
   customerId: UniqueID;
-  recipient: InvoiceRecipient;
+  recipient: IssuedInvoiceRecipient;
 
   reference: Maybe<string>;
   description: string;
@@ -214,7 +214,7 @@ export class IssuedInvoice
     return this.props.notes;
   }
 
-  public get recipient(): InvoiceRecipient {
+  public get recipient(): IssuedInvoiceRecipient {
     return this.props.recipient;
   }
 
diff --git a/modules/customer-invoices/src/api/domain/issued-invoices/value-objects/index.ts b/modules/customer-invoices/src/api/domain/issued-invoices/value-objects/index.ts
index 9b42f37f..4e79622a 100644
--- a/modules/customer-invoices/src/api/domain/issued-invoices/value-objects/index.ts
+++ b/modules/customer-invoices/src/api/domain/issued-invoices/value-objects/index.ts
@@ -1,2 +1,3 @@
+export * from "./issued-invoice-recipient.vo";
 export * from "./issued-invoice-tax-group.vo";
 export * from "./verifactu-status.vo";
diff --git a/modules/customer-invoices/src/api/domain/issued-invoices/value-objects/issued-invoice-recipient.vo.ts b/modules/customer-invoices/src/api/domain/issued-invoices/value-objects/issued-invoice-recipient.vo.ts
new file mode 100644
index 00000000..7d70a030
--- /dev/null
+++ b/modules/customer-invoices/src/api/domain/issued-invoices/value-objects/issued-invoice-recipient.vo.ts
@@ -0,0 +1,103 @@
+import {
+  type City,
+  type Country,
+  type Name,
+  type PostalCode,
+  type Province,
+  type Street,
+  type TINNumber,
+  ValueObject,
+  maybeToNullable,
+} from "@repo/rdx-ddd";
+import { type Maybe, Result } from "@repo/rdx-utils";
+
+export type IssuedInvoiceRecipientProps = {
+  name: Name;
+  tin: TINNumber;
+  street: Maybe<Street>;
+  street2: Maybe<Street>;
+  city: Maybe<City>;
+  postalCode: Maybe<PostalCode>;
+  province: Maybe<Province>;
+  country: Maybe<Country>;
+};
+
+export class IssuedInvoiceRecipient extends ValueObject<IssuedInvoiceRecipientProps> {
+  protected static validate(values: IssuedInvoiceRecipientProps) {
+    return Result.ok(values);
+  }
+
+  static create(values: IssuedInvoiceRecipientProps): Result<IssuedInvoiceRecipient, Error> {
+    const valueIsValid = IssuedInvoiceRecipient.validate(values);
+
+    if (valueIsValid.isFailure) {
+      return Result.fail(valueIsValid.error);
+    }
+
+    return Result.ok(new IssuedInvoiceRecipient(values));
+  }
+
+  public update(
+    partial: Partial<IssuedInvoiceRecipientProps>
+  ): Result<IssuedInvoiceRecipient, Error> {
+    const updatedProps = {
+      ...this.props,
+      ...partial,
+    } as IssuedInvoiceRecipientProps;
+
+    return IssuedInvoiceRecipient.create(updatedProps);
+  }
+
+  public get name(): Name {
+    return this.props.name;
+  }
+
+  public get tin(): TINNumber {
+    return this.props.tin;
+  }
+
+  get street(): Maybe<Street> {
+    return this.props.street;
+  }
+
+  get street2(): Maybe<Street> {
+    return this.props.street2;
+  }
+
+  get city(): Maybe<City> {
+    return this.props.city;
+  }
+
+  get postalCode(): Maybe<PostalCode> {
+    return this.props.postalCode;
+  }
+
+  get province(): Maybe<Province> {
+    return this.props.province;
+  }
+
+  get country(): Maybe<Country> {
+    return this.props.country;
+  }
+
+  getProps(): IssuedInvoiceRecipientProps {
+    return this.props;
+  }
+
+  toPrimitive() {
+    return this.getProps();
+  }
+
+  toObjectString() {
+    return {
+      tin: this.tin.toString(),
+      name: this.name.toString(),
+      street: maybeToNullable(this.street, (value) => value.toString()),
+      street2: maybeToNullable(this.street2, (value) => value.toString()),
+      city: maybeToNullable(this.city, (value) => value.toString()),
+      postal_code: maybeToNullable(this.postalCode, (value) => value.toString()),
+      province: maybeToNullable(this.province, (value) => value.toString()),
+      country: maybeToNullable(this.country, (value) => value.toString()),
+    };
+  }
+}
diff --git a/modules/customer-invoices/src/api/domain/proformas/aggregates/proforma.aggregate.ts b/modules/customer-invoices/src/api/domain/proformas/aggregates/proforma.aggregate.ts
index dc96198f..fac4a7c4 100644
--- a/modules/customer-invoices/src/api/domain/proformas/aggregates/proforma.aggregate.ts
+++ b/modules/customer-invoices/src/api/domain/proformas/aggregates/proforma.aggregate.ts
@@ -15,7 +15,6 @@ import {
   INVOICE_STATUS,
   InvoiceAmount,
   type InvoiceNumber,
-  type InvoiceRecipient,
   type InvoiceSerie,
   InvoiceStatus,
   type ItemAmount,
@@ -30,7 +29,7 @@ import {
 import { InvalidProformaTransitionError, ProformaItemMismatch } from "../errors";
 import type { IProformaTaxTotals, ProformaCalculationContext } from "../services";
 import { canManuallyTransitionProformaStatus } from "../services";
-import { ProformaItemTaxes } from "../value-objects";
+import { ProformaItemTaxes, type ProformaRecipient } from "../value-objects";
 
 export interface IProformaCreateProps {
   companyId: UniqueID;
@@ -43,7 +42,7 @@ export interface IProformaCreateProps {
   operationDate: Maybe<UtcDate>;
 
   customerId: UniqueID;
-  recipient: Maybe<InvoiceRecipient>;
+  recipient: Maybe<ProformaRecipient>;
 
   reference: Maybe<string>;
   description: Maybe<string>;
@@ -93,7 +92,7 @@ export interface IProforma {
   operationDate: Maybe<UtcDate>;
 
   customerId: UniqueID;
-  recipient: Maybe<InvoiceRecipient>;
+  recipient: Maybe<ProformaRecipient>;
 
   reference: Maybe<string>;
   description: Maybe<string>;
@@ -258,7 +257,7 @@ export class Proforma extends AggregateRoot<ProformaInternalProps> implements IP
     return this.props.notes;
   }
 
-  public get recipient(): Maybe<InvoiceRecipient> {
+  public get recipient(): Maybe<ProformaRecipient> {
     return this.props.recipient;
   }
 
diff --git a/modules/customer-invoices/src/api/domain/proformas/value-objects/index.ts b/modules/customer-invoices/src/api/domain/proformas/value-objects/index.ts
index d3a820d4..3dabc5d4 100644
--- a/modules/customer-invoices/src/api/domain/proformas/value-objects/index.ts
+++ b/modules/customer-invoices/src/api/domain/proformas/value-objects/index.ts
@@ -1 +1,2 @@
 export * from "./proforma-item-taxes.vo";
+export * from "./proforma-recipient.vo";
diff --git a/modules/customer-invoices/src/api/domain/common/value-objects/invoice-recipient/invoice-recipient.vo.ts b/modules/customer-invoices/src/api/domain/proformas/value-objects/proforma-recipient.vo.ts
similarity index 75%
rename from modules/customer-invoices/src/api/domain/common/value-objects/invoice-recipient/invoice-recipient.vo.ts
rename to modules/customer-invoices/src/api/domain/proformas/value-objects/proforma-recipient.vo.ts
index e41054d0..34726cbb 100644
--- a/modules/customer-invoices/src/api/domain/common/value-objects/invoice-recipient/invoice-recipient.vo.ts
+++ b/modules/customer-invoices/src/api/domain/proformas/value-objects/proforma-recipient.vo.ts
@@ -11,7 +11,7 @@ import {
 } from "@repo/rdx-ddd";
 import { type Maybe, Result } from "@repo/rdx-utils";
 
-export type InvoiceRecipientProps = {
+export type ProformaRecipientProps = {
   name: Name;
   tin: Maybe<TINNumber>;
   street: Maybe<Street>;
@@ -22,28 +22,28 @@ export type InvoiceRecipientProps = {
   country: Maybe<Country>;
 };
 
-export class InvoiceRecipient extends ValueObject<InvoiceRecipientProps> {
-  protected static validate(values: InvoiceRecipientProps) {
+export class ProformaRecipient extends ValueObject<ProformaRecipientProps> {
+  protected static validate(values: ProformaRecipientProps) {
     return Result.ok(values);
   }
 
-  static create(values: InvoiceRecipientProps): Result<InvoiceRecipient, Error> {
-    const valueIsValid = InvoiceRecipient.validate(values);
+  static create(values: ProformaRecipientProps): Result<ProformaRecipient, Error> {
+    const valueIsValid = ProformaRecipient.validate(values);
 
     if (valueIsValid.isFailure) {
       return Result.fail(valueIsValid.error);
     }
 
-    return Result.ok(new InvoiceRecipient(values));
+    return Result.ok(new ProformaRecipient(values));
   }
 
-  public update(partial: Partial<InvoiceRecipientProps>): Result<InvoiceRecipient, Error> {
+  public update(partial: Partial<ProformaRecipientProps>): Result<ProformaRecipient, Error> {
     const updatedProps = {
       ...this.props,
       ...partial,
-    } as InvoiceRecipientProps;
+    } as ProformaRecipientProps;
 
-    return InvoiceRecipient.create(updatedProps);
+    return ProformaRecipient.create(updatedProps);
   }
 
   public get name(): Name {
@@ -78,7 +78,7 @@ export class InvoiceRecipient extends ValueObject<InvoiceRecipientProps> {
     return this.props.country;
   }
 
-  getProps(): InvoiceRecipientProps {
+  getProps(): ProformaRecipientProps {
     return this.props;
   }
 
diff --git a/modules/customer-invoices/src/api/infrastructure/issued-invoices/persistence/sequelize/mappers/domain/sequelize-issued-invoice-recipient-domain.mapper.ts b/modules/customer-invoices/src/api/infrastructure/issued-invoices/persistence/sequelize/mappers/domain/sequelize-issued-invoice-recipient-domain.mapper.ts
index 9b461410..d64d815d 100644
--- a/modules/customer-invoices/src/api/infrastructure/issued-invoices/persistence/sequelize/mappers/domain/sequelize-issued-invoice-recipient-domain.mapper.ts
+++ b/modules/customer-invoices/src/api/infrastructure/issued-invoices/persistence/sequelize/mappers/domain/sequelize-issued-invoice-recipient-domain.mapper.ts
@@ -15,14 +15,14 @@ import {
 } from "@repo/rdx-ddd";
 import { Result } from "@repo/rdx-utils";
 
-import { type IIssuedInvoiceCreateProps, InvoiceRecipient } from "../../../../../../domain";
+import { type IIssuedInvoiceCreateProps, IssuedInvoiceRecipient } from "../../../../../../domain";
 import type { CustomerInvoiceModel } from "../../../../../common";
 
 export class SequelizeIssuedInvoiceRecipientDomainMapper {
   public mapToDomain(
     source: CustomerInvoiceModel,
     params?: MapperParamsType
-  ): Result<InvoiceRecipient, Error> {
+  ): Result<IssuedInvoiceRecipient, Error> {
     /**
      * - Issued invoice -> snapshot de los datos (campos customer_*)
      */
@@ -45,11 +45,7 @@ export class SequelizeIssuedInvoiceRecipientDomainMapper {
     const customerName = extractOrPushError(Name.create(_name!), "customer_name", errors);
 
     //const customerTin = extractOrPushError(TINNumber.create(_tin!), "customer_tin", errors);
-    const customerTin = extractOrPushError(
-      maybeFromNullableResult(_tin, (value) => TINNumber.create(value)),
-      "customer_tin",
-      errors
-    );
+    const customerTin = extractOrPushError(TINNumber.create(_tin), "customer_tin", errors);
 
     const customerStreet = extractOrPushError(
       maybeFromNullableResult(_street, (value) => Street.create(value)),
@@ -87,7 +83,7 @@ export class SequelizeIssuedInvoiceRecipientDomainMapper {
       errors
     );
 
-    const createResult = InvoiceRecipient.create({
+    const createResult = IssuedInvoiceRecipient.create({
       name: customerName!,
       tin: customerTin!,
       street: customerStreet!,
@@ -118,7 +114,7 @@ export class SequelizeIssuedInvoiceRecipientDomainMapper {
    *  - Si la factura no es proforma (`isProforma === false`), debe existir `recipient`.
    *    En caso contrario, se agrega un error de validación.
    */
-  mapToPersistence(source: InvoiceRecipient, params?: MapperParamsType) {
+  mapToPersistence(source: IssuedInvoiceRecipient, params?: MapperParamsType) {
     /*const { errors, parent } = params as {
       parent: IssuedInvoice;
       errors: ValidationErrorDetail[];
@@ -127,7 +123,7 @@ export class SequelizeIssuedInvoiceRecipientDomainMapper {
     const recipient = source;
 
     return {
-      customer_tin: maybeToNullable(recipient.tin, (value) => value.toString()),
+      customer_tin: recipient.tin.toString(),
       customer_name: recipient.name.toPrimitive(),
       customer_street: maybeToNullable(recipient.street, (v) => v.toPrimitive()),
       customer_street2: maybeToNullable(recipient.street2, (v) => v.toPrimitive()),
diff --git a/modules/customer-invoices/src/api/infrastructure/issued-invoices/persistence/sequelize/mappers/summary/sequelize-issued-invoice-recipient-summary.mapper.ts b/modules/customer-invoices/src/api/infrastructure/issued-invoices/persistence/sequelize/mappers/summary/sequelize-issued-invoice-recipient-summary.mapper.ts
index 07f3b567..effd2116 100644
--- a/modules/customer-invoices/src/api/infrastructure/issued-invoices/persistence/sequelize/mappers/summary/sequelize-issued-invoice-recipient-summary.mapper.ts
+++ b/modules/customer-invoices/src/api/infrastructure/issued-invoices/persistence/sequelize/mappers/summary/sequelize-issued-invoice-recipient-summary.mapper.ts
@@ -15,17 +15,17 @@ import {
 import { Result } from "@repo/rdx-utils";
 
 import type { IssuedInvoiceSummary } from "../../../../../../application";
-import { InvoiceRecipient } from "../../../../../../domain";
+import { IssuedInvoiceRecipient } from "../../../../../../domain";
 import type { CustomerInvoiceModel } from "../../../../../common";
 
 export class SequelizeIssuedInvoiceRecipientListMapper extends SequelizeQueryMapper<
   CustomerInvoiceModel,
-  InvoiceRecipient
+  IssuedInvoiceRecipient
 > {
   public mapToReadModel(
     raw: CustomerInvoiceModel,
     params?: MapperParamsType
-  ): Result<InvoiceRecipient, Error> {
+  ): Result<IssuedInvoiceRecipient, Error> {
     /**
      * - Issued invoice =>  snapshot de los datos (campos customer_*)
      */
@@ -94,7 +94,7 @@ export class SequelizeIssuedInvoiceRecipientListMapper extends SequelizeQueryMap
       errors
     );
 
-    const createResult = InvoiceRecipient.create({
+    const createResult = IssuedInvoiceRecipient.create({
       name: customerName!,
       tin: customerTin!,
       street: customerStreet!,
diff --git a/modules/customer-invoices/src/api/infrastructure/proformas/persistence/sequelize/mappers/domain/sequelize-proforma-recipient-domain.mapper.ts b/modules/customer-invoices/src/api/infrastructure/proformas/persistence/sequelize/mappers/domain/sequelize-proforma-recipient-domain.mapper.ts
index e7f68d9f..53dc08e7 100644
--- a/modules/customer-invoices/src/api/infrastructure/proformas/persistence/sequelize/mappers/domain/sequelize-proforma-recipient-domain.mapper.ts
+++ b/modules/customer-invoices/src/api/infrastructure/proformas/persistence/sequelize/mappers/domain/sequelize-proforma-recipient-domain.mapper.ts
@@ -14,14 +14,14 @@ import {
 } from "@repo/rdx-ddd";
 import { Maybe, Result } from "@repo/rdx-utils";
 
-import { type IProformaCreateProps, InvoiceRecipient } from "../../../../../../domain";
+import { type IProformaCreateProps, ProformaRecipient } from "../../../../../../domain";
 import type { CustomerInvoiceModel } from "../../../../../common";
 
 export class SequelizeProformaRecipientDomainMapper {
   public mapToDomain(
     source: CustomerInvoiceModel,
     params?: MapperParamsType
-  ): Result<Maybe<InvoiceRecipient>, Error> {
+  ): Result<Maybe<ProformaRecipient>, Error> {
     /**
      * En proforma -> datos de "current_customer"
      */
@@ -85,7 +85,7 @@ export class SequelizeProformaRecipientDomainMapper {
       errors
     );
 
-    const createResult = InvoiceRecipient.create({
+    const createResult = ProformaRecipient.create({
       name: customerName!,
       tin: customerTin!,
       street: customerStreet!,
@@ -110,7 +110,7 @@ export class SequelizeProformaRecipientDomainMapper {
   /**
    * Para una proforma, el recipient no se persiste (todos los campos son null).
    */
-  mapToPersistence(source: Maybe<InvoiceRecipient>, params?: MapperParamsType) {
+  mapToPersistence(source: Maybe<ProformaRecipient>, params?: MapperParamsType) {
     return {
       customer_tin: null,
       customer_name: null,
diff --git a/modules/customer-invoices/src/api/infrastructure/proformas/persistence/sequelize/mappers/summary/sequelize-proforma-recipient-summary.mapper.ts b/modules/customer-invoices/src/api/infrastructure/proformas/persistence/sequelize/mappers/summary/sequelize-proforma-recipient-summary.mapper.ts
index 5568ea18..96c49792 100644
--- a/modules/customer-invoices/src/api/infrastructure/proformas/persistence/sequelize/mappers/summary/sequelize-proforma-recipient-summary.mapper.ts
+++ b/modules/customer-invoices/src/api/infrastructure/proformas/persistence/sequelize/mappers/summary/sequelize-proforma-recipient-summary.mapper.ts
@@ -15,17 +15,17 @@ import {
 import { Result } from "@repo/rdx-utils";
 
 import type { ProformaSummary } from "../../../../../../application";
-import { InvoiceRecipient } from "../../../../../../domain";
+import { ProformaRecipient } from "../../../../../../domain";
 import type { CustomerInvoiceModel } from "../../../../../common";
 
 export class SequelizeInvoiceRecipientSummaryMapper extends SequelizeQueryMapper<
   CustomerInvoiceModel,
-  InvoiceRecipient
+  ProformaRecipient
 > {
   public mapToReadModel(
     raw: CustomerInvoiceModel,
     params?: MapperParamsType
-  ): Result<InvoiceRecipient, Error> {
+  ): Result<ProformaRecipient, Error> {
     /**
      * En proforma -> datos de "current_customer"
      */
@@ -43,6 +43,7 @@ export class SequelizeInvoiceRecipientSummaryMapper extends SequelizeQueryMapper
         message: "Current customer not included in query (SequelizeInvoiceRecipientListMapper)",
       });
     }
+
     const _name = raw.current_customer!.name;
     const _tin = raw.current_customer!.tin;
     const _street = raw.current_customer!.street;
@@ -98,7 +99,7 @@ export class SequelizeInvoiceRecipientSummaryMapper extends SequelizeQueryMapper
       errors
     );
 
-    const createResult = InvoiceRecipient.create({
+    const createResult = ProformaRecipient.create({
       name: customerName!,
       tin: customerTin!,
       street: customerStreet!,
diff --git a/modules/customer-invoices/src/web/issued-invoices/list/ui/pages/list-issued-invoices-page.tsx b/modules/customer-invoices/src/web/issued-invoices/list/ui/pages/list-issued-invoices-page.tsx
index cde08e4b..7d64c4dd 100644
--- a/modules/customer-invoices/src/web/issued-invoices/list/ui/pages/list-issued-invoices-page.tsx
+++ b/modules/customer-invoices/src/web/issued-invoices/list/ui/pages/list-issued-invoices-page.tsx
@@ -1,5 +1,5 @@
 import { ErrorAlert, PageHeader, SimpleSearchInput } from "@erp/core/components";
-import { AppContent, AppHeader, BackHistoryButton, LogoVerifactu } from "@repo/rdx-ui/components";
+import { AppContent, BackHistoryButton, LogoVerifactu } from "@repo/rdx-ui/components";
 import {
   Alert,
   AlertDescription,
@@ -57,25 +57,23 @@ export const ListIssuedInvoicesPage = () => {
   }
 
   return (
-    <section>
-      <AppHeader>
-        <PageHeader
-          description={t("pages.issued_invoices.list.description")}
-          rightSlot={
-            <Button
-              aria-label={t("pages.issued_invoices.create.title")}
-              className="hidden"
-              onClick={() => navigate("/issued-invoices/create")}
-            >
-              <PlusIcon aria-hidden className="mr-2 size-4" />
-              {t("pages.issued_invoices.create.title")}
-            </Button>
-          }
-          title={t("pages.issued_invoices.list.title")}
-        />
-      </AppHeader>
+    <div className="p-6 space-y-6">
+      <PageHeader
+        description={t("pages.issued_invoices.list.description")}
+        rightSlot={
+          <Button
+            aria-label={t("pages.issued_invoices.create.title")}
+            className="hidden"
+            onClick={() => navigate("/issued-invoices/create")}
+          >
+            <PlusIcon aria-hidden className="mr-2 size-4" />
+            {t("pages.issued_invoices.create.title")}
+          </Button>
+        }
+        title={t("pages.issued_invoices.list.title")}
+      />
 
-      <AppContent className="space-y-6">
+      <div className="mx-auto w-full space-y-4">
         <Alert className="bg-green-50 text-green-800 flex items-center justify-between gap-6">
           <div>
             <AlertTitle className="font-semibold text-green-800">¡Atención!</AlertTitle>
@@ -154,7 +152,7 @@ export const ListIssuedInvoicesPage = () => {
             </div>
           </>
         )}
-      </AppContent>
-    </section>
+      </div>
+    </div>
   );
 };
diff --git a/modules/customer-invoices/src/web/proformas/pages/index.ts b/modules/customer-invoices/src/web/proformas/pages/index.ts
deleted file mode 100644
index 491ccf0c..00000000
--- a/modules/customer-invoices/src/web/proformas/pages/index.ts
+++ /dev/null
@@ -1 +0,0 @@
-export * from "./list";
diff --git a/modules/customer-invoices/src/web/proformas/pages/update/context/index.ts b/modules/customer-invoices/src/web/proformas/pages/update/context/index.ts
deleted file mode 100644
index 1608c32d..00000000
--- a/modules/customer-invoices/src/web/proformas/pages/update/context/index.ts
+++ /dev/null
@@ -1 +0,0 @@
-export * from "./proforma-context";
diff --git a/modules/customer-invoices/src/web/proformas/pages/update/context/proforma-context.tsx b/modules/customer-invoices/src/web/proformas/pages/update/context/proforma-context.tsx
deleted file mode 100644
index c02dea28..00000000
--- a/modules/customer-invoices/src/web/proformas/pages/update/context/proforma-context.tsx
+++ /dev/null
@@ -1,118 +0,0 @@
-import type { TaxCatalogProvider } from "@erp/core";
-import type { ModuleTFunction } from "@repo/rdx-ui/locales/i18n.js";
-import {
-  type PropsWithChildren,
-  createContext,
-  useCallback,
-  useContext,
-  useMemo,
-  useState,
-} from "react";
-
-import { useTranslation } from "../../../../i18n";
-
-export type ProformaContextValue = {
-  company_id: string;
-  proforma_id: string;
-  status: string;
-  currency_code: string;
-  language_code: string;
-  is_proforma: boolean;
-
-  readOnly: boolean;
-  taxCatalog: TaxCatalogProvider;
-
-  t: ModuleTFunction;
-
-  changeLanguage: (lang: string) => void;
-  changeCurrency: (currency: string) => void;
-  changeIsProforma: (value: boolean) => void;
-};
-
-const ProformaContext = createContext<ProformaContextValue | null>(null);
-
-export interface ProformaProviderParams {
-  taxCatalog: TaxCatalogProvider;
-  proforma_id: string;
-  company_id: string;
-  status: string; // default "draft"
-  language_code?: string; // default "es"
-  currency_code?: string; // default "EUR"
-  is_proforma?: boolean; // default 'true'
-  readOnly?: boolean; // default 'false'
-
-  children: React.ReactNode;
-}
-
-export const ProformaProvider = ({
-  taxCatalog: initialTaxCatalog,
-  proforma_id,
-  company_id,
-  status: initialStatus = "draft",
-  language_code: initialLang = "es",
-  currency_code: initialCurrency = "EUR",
-  readOnly: initialReadOnly = false,
-  is_proforma: initialProforma = true,
-  children,
-}: PropsWithChildren<ProformaProviderParams>) => {
-  const { t } = useTranslation();
-
-  // Estado interno local para campos dinámicos
-  const [language_code, setLanguage] = useState(initialLang);
-  const [currency_code, setCurrency] = useState(initialCurrency);
-  const [is_proforma, setIsProforma] = useState(initialProforma);
-  const [readOnly, setReadOnly] = useState(initialReadOnly);
-  const [status] = useState(initialStatus);
-  const [taxCatalog] = useState(initialTaxCatalog);
-
-  // Callbacks memoizados
-  const setLanguageMemo = useCallback((language_code: string) => setLanguage(language_code), []);
-  const setCurrencyMemo = useCallback((currency_code: string) => setCurrency(currency_code), []);
-  const setIsProformaMemo = useCallback((is_proforma: boolean) => setIsProforma(is_proforma), []);
-  const setReadOnlyMemo = useCallback((readOnly: boolean) => setReadOnly(readOnly), []);
-
-  const value = useMemo<ProformaContextValue>(() => {
-    return {
-      t,
-
-      proforma_id,
-      company_id,
-      status,
-      language_code,
-      currency_code,
-      is_proforma,
-
-      taxCatalog,
-      readOnly,
-
-      changeLanguage: setLanguageMemo,
-      changeCurrency: setCurrencyMemo,
-      changeIsProforma: setIsProformaMemo,
-      setReadOnly: setReadOnlyMemo,
-    };
-  }, [
-    t,
-    readOnly,
-    company_id,
-    proforma_id,
-    status,
-    language_code,
-    currency_code,
-    is_proforma,
-    taxCatalog,
-    setLanguageMemo,
-    setCurrencyMemo,
-    setIsProformaMemo,
-    setReadOnlyMemo,
-  ]);
-
-  return <ProformaContext.Provider value={value}>{children}</ProformaContext.Provider>;
-};
-
-export function useProformaContext(): ProformaContextValue {
-  const context = useContext(ProformaContext);
-  if (!context) {
-    throw new Error("useProformaContext must be used within <ProformaProvider>");
-  }
-  return context;
-}
diff --git a/modules/customer-invoices/src/web/proformas/pages/update/index.ts b/modules/customer-invoices/src/web/proformas/pages/update/index.ts
deleted file mode 100644
index ff0a0125..00000000
--- a/modules/customer-invoices/src/web/proformas/pages/update/index.ts
+++ /dev/null
@@ -1 +0,0 @@
-export * from "./proforma-update-page";
diff --git a/modules/customer-invoices/src/web/proformas/pages/update/ui/blocks/index.ts b/modules/customer-invoices/src/web/proformas/pages/update/ui/blocks/index.ts
deleted file mode 100644
index b4cd11db..00000000
--- a/modules/customer-invoices/src/web/proformas/pages/update/ui/blocks/index.ts
+++ /dev/null
@@ -1,2 +0,0 @@
-export * from "./proforma-basic-info-fields";
-export * from "./proforma-totals";
diff --git a/modules/customer-invoices/src/web/proformas/pages/update/ui/blocks/proforma-basic-info-fields.tsx b/modules/customer-invoices/src/web/proformas/pages/update/ui/blocks/proforma-basic-info-fields.tsx
deleted file mode 100644
index 8c623f50..00000000
--- a/modules/customer-invoices/src/web/proformas/pages/update/ui/blocks/proforma-basic-info-fields.tsx
+++ /dev/null
@@ -1,75 +0,0 @@
-import { DatePickerInputField, TextField } from "@repo/rdx-ui/components";
-import { FieldDescription, FieldGroup, FieldLegend, FieldSet } from "@repo/shadcn-ui/components";
-import type { ComponentProps } from "react";
-import { useFormContext } from "react-hook-form";
-
-import { useTranslation } from "../../../../../i18n";
-import type { ProformaFormData } from "../../../../types";
-
-export const ProformaBasicInfoFields = (props: ComponentProps<"fieldset">) => {
-  const { t } = useTranslation();
-  const { control } = useFormContext<ProformaFormData>();
-
-  return (
-    <FieldSet {...props}>
-      <FieldLegend className="hidden text-foreground" variant="label">
-        {t("form_groups.basic_info.title")}
-      </FieldLegend>
-      <FieldDescription className="hidden">
-        {t("form_groups.basic_info.description")}
-      </FieldDescription>
-
-      <FieldGroup className="flex flex-row flex-wrap gap-6 xl:flex-nowrap">
-        <DatePickerInputField
-          className="min-w-44 flex-1 sm:max-w-44"
-          control={control}
-          description={t("form_fields.invoice_date.description")}
-          label={t("form_fields.invoice_date.label")}
-          name="invoice_date"
-          numberOfMonths={2}
-          placeholder={t("form_fields.invoice_date.placeholder")}
-          required
-        />
-
-        <DatePickerInputField
-          className="min-w-44 flex-1 sm:max-w-44"
-          control={control}
-          description={t("form_fields.operation_date.description")}
-          label={t("form_fields.operation_date.label")}
-          name="operation_date"
-          numberOfMonths={2}
-          placeholder={t("form_fields.operation_date.placeholder")}
-        />
-
-        <TextField
-          className="min-w-16 flex-1 sm:max-w-16"
-          control={control}
-          description={t("form_fields.series.description")}
-          label={t("form_fields.series.label")}
-          name="series"
-          placeholder={t("form_fields.series.placeholder")}
-        />
-
-        <TextField
-          className="min-w-32 flex-1 sm:max-w-44"
-          control={control}
-          description={t("form_fields.reference.description")}
-          label={t("form_fields.reference.label")}
-          maxLength={256}
-          name="reference"
-          placeholder={t("form_fields.reference.placeholder")}
-        />
-
-        <TextField
-          className="min-w-32 flex-1 xs:max-w-full"
-          control={control}
-          description={t("form_fields.description.description")}
-          label={t("form_fields.description.label")}
-          maxLength={256}
-          name="description"
-          placeholder={t("form_fields.description.placeholder")}
-        />
-      </FieldGroup>
-    </FieldSet>
-  );
-};
diff --git a/modules/customer-invoices/src/web/proformas/pages/update/ui/blocks/proforma-totals.tsx b/modules/customer-invoices/src/web/proformas/pages/update/ui/blocks/proforma-totals.tsx
deleted file mode 100644
index b3b6f5f3..00000000
--- a/modules/customer-invoices/src/web/proformas/pages/update/ui/blocks/proforma-totals.tsx
+++ /dev/null
@@ -1,153 +0,0 @@
-import {
-  FieldDescription,
-  FieldGroup,
-  FieldLegend,
-  FieldSet,
-  Separator,
-} from "@repo/shadcn-ui/components";
-import { cn } from "@repo/shadcn-ui/lib/utils";
-import { ReceiptIcon } from "lucide-react";
-import type { ComponentProps } from "react";
-import { useFormContext, useWatch } from "react-hook-form";
-
-import { useTranslation } from "../../../../../i18n";
-import { useProformaContext } from "../../context";
-import { PercentageInputField } from "../components";
-
-export const ProformaTotals = (props: ComponentProps<"fieldset">) => {
-  const { t } = useTranslation();
-  const { control } = useFormContext<ProformaFormData>();
-  const { currency_code, language_code, readOnly, taxCatalog } = useProformaContext();
-
-  const displayTaxes = useWatch({ control, name: "taxes", defaultValue: [] });
-  const subtotal_amount = useWatch({ control, name: "subtotal_amount", defaultValue: 0 });
-  const items_discount_amount = useWatch({
-    control,
-    name: "items_discount_amount",
-    defaultValue: 0,
-  });
-  const discount_amount = useWatch({ control, name: "discount_amount", defaultValue: 0 });
-  const taxable_amount = useWatch({ control, name: "taxable_amount", defaultValue: 0 });
-  const taxes_amount = useWatch({ control, name: "taxes_amount", defaultValue: 0 });
-  const total_amount = useWatch({ control, name: "total_amount", defaultValue: 0 });
-
-  return (
-    <FieldSet {...props}>
-      <FieldLegend className="hidden">
-        <ReceiptIcon className="size-6 text-muted-foreground" />
-        {t("form_groups.totals.title")}
-      </FieldLegend>
-
-      <FieldDescription className="hidden">{t("form_groups.totals.description")}</FieldDescription>
-      <FieldGroup className="grid grid-cols-1 border rounded-lg bg-muted/10 p-4 gap-4">
-        <div className="space-y-1.5">
-          {/* Sección: Subtotal y Descuentos */}
-          <div className="flex justify-between text-sm">
-            <span className="text-muted-foreground">Subtotal sin descuentos</span>
-            <span className="font-medium tabular-nums text-muted-foreground">
-              {formatCurrency(subtotal_amount, 2, currency_code, language_code)}
-            </span>
-          </div>
-
-          <div className="flex justify-between text-sm">
-            <div className="flex items-center gap-3">
-              <span className="text-muted-foreground">Descuento en líneas</span>
-            </div>
-            <span className="font-medium text-destructive tabular-nums">
-              -{formatCurrency(items_discount_amount, 2, currency_code, language_code)}
-            </span>
-          </div>
-
-          <div className="flex justify-between text-sm">
-            <div className="flex items-center gap-3">
-              <span className="text-muted-foreground">Descuento global</span>
-              <PercentageInputField
-                className={cn(
-                  "w-20 text-right tabular-nums bg-background",
-                  "border-input border text-sm shadow-xs"
-                )}
-                control={control}
-                inputId={"discount-percentage"}
-                name={"discount_percentage"}
-                readOnly={readOnly}
-                showSuffix={true}
-              />
-            </div>
-            <span className="font-medium text-destructive tabular-nums">
-              -{formatCurrency(discount_amount, 2, currency_code, language_code)}
-            </span>
-          </div>
-
-          {/* Sección: Base Imponible */}
-          <div className="flex justify-between text-sm">
-            <span className="text-foreground">Base imponible</span>
-            <span className="font-medium tabular-nums">
-              {formatCurrency(taxable_amount, 2, currency_code, language_code)}
-            </span>
-          </div>
-        </div>
-
-        <Separator />
-
-        {/* Sección: Impuestos */}
-        <div className="space-y-1.5">
-          <h3 className="text-xs font-semibold text-muted-foreground uppercase tracking-wide">
-            Impuestos y retenciones
-          </h3>
-
-          {taxCatalog.groups().map((group) => {
-            // Filtra impuestos de ese grupo
-            const taxesInGroup = displayTaxes?.filter((item) => {
-              const tax = taxCatalog.findByCode(item.tax_code).match(
-                (t) => t,
-                () => undefined
-              );
-              return tax?.group === group;
-            });
-
-            // Si el grupo no tiene impuestos, no renderiza nada
-            if (taxesInGroup?.length === 0) return null;
-
-            return (
-              <div className="space-y-1.5 leading-3" key={`tax-group-${group}`}>
-                {taxesInGroup?.map((item) => {
-                  const tax = taxCatalog.findByCode(item.tax_code).match(
-                    (t) => t,
-                    () => undefined
-                  );
-                  return (
-                    <div
-                      className="flex items-center justify-between text-sm"
-                      key={`${group}:${item.tax_code}`}
-                    >
-                      <span className="text-muted-foreground text-sm">{tax?.name}</span>
-                      <span className="font-medium tabular-nums text-sm text-muted-foreground">
-                        {formatCurrency(item.taxes_amount, 2, currency_code, language_code)}
-                      </span>
-                    </div>
-                  );
-                })}
-              </div>
-            );
-          })}
-
-          <div className="flex justify-between text-sm mt-3">
-            <span className="text-foreground">Total de impuestos</span>
-            <span className="font-medium tabular-nums">
-              {formatCurrency(taxes_amount, 2, currency_code, language_code)}
-            </span>
-          </div>
-        </div>
-
-        <Separator />
-
-        <div className="flex justify-between text-sm ">
-          <span className="font-bold text-foreground">Total de la factura</span>
-          <span className="font-bold tabular-nums">
-            {formatCurrency(total_amount, 2, currency_code, language_code)}
-          </span>
-        </div>
-      </FieldGroup>
-    </FieldSet>
-  );
-};
diff --git a/modules/customer-invoices/src/web/proformas/pages/update/ui/components/index.ts b/modules/customer-invoices/src/web/proformas/pages/update/ui/components/index.ts
deleted file mode 100644
index 6dd28b1a..00000000
--- a/modules/customer-invoices/src/web/proformas/pages/update/ui/components/index.ts
+++ /dev/null
@@ -1,2 +0,0 @@
-export * from "./items-editor";
-export * from "./proforma-editor-skeleton";
diff --git a/modules/customer-invoices/src/web/proformas/pages/update/ui/components/proforma-editor-skeleton.tsx b/modules/customer-invoices/src/web/proformas/pages/update/ui/components/proforma-editor-skeleton.tsx
deleted file mode 100644
index 660afc63..00000000
--- a/modules/customer-invoices/src/web/proformas/pages/update/ui/components/proforma-editor-skeleton.tsx
+++ /dev/null
@@ -1,31 +0,0 @@
-// components/CustomerSkeleton.tsx
-import { AppContent, BackHistoryButton } from "@repo/rdx-ui/components";
-import { Button } from "@repo/shadcn-ui/components";
-
-import { useTranslation } from "../../../../../i18n";
-
-export const ProformaEditorSkeleton = () => {
-  const { t } = useTranslation();
-  return (
-    <AppContent>
-      <div className="flex items-center justify-between">
-        <div aria-hidden="true" className="space-y-2">
-          <div className="h-7 w-64 rounded-md bg-muted animate-pulse" />
-          <div className="h-5 w-96 rounded-md bg-muted animate-pulse" />
-        </div>
-        <div className="flex items-center gap-2">
-          <BackHistoryButton />
-          <Button aria-busy disabled>
-            {t("pages.update.submit")}
-          </Button>
-        </div>
-      </div>
-      <div aria-hidden="true" className="mt-6 grid gap-4">
-        <div className="h-10 w-full rounded-md bg-muted animate-pulse" />
-        <div className="h-10 w-full rounded-md bg-muted animate-pulse" />
-        <div className="h-28 w-full rounded-md bg-muted animate-pulse" />
-      </div>
-      <span className="sr-only">{t("pages.update.loading", "Cargando factura de cliente...")}</span>
-    </AppContent>
-  );
-};
diff --git a/modules/customer-invoices/src/web/proformas/pages/update/ui/index.ts b/modules/customer-invoices/src/web/proformas/pages/update/ui/index.ts
deleted file mode 100644
index 697f498b..00000000
--- a/modules/customer-invoices/src/web/proformas/pages/update/ui/index.ts
+++ /dev/null
@@ -1,2 +0,0 @@
-export * from "./blocks";
-export * from "./components";
diff --git a/modules/customers/package.json b/modules/customers/package.json
index 8dae79fb..5fba0e18 100644
--- a/modules/customers/package.json
+++ b/modules/customers/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@erp/customers",
   "description": "Customers",
-  "version": "0.7.6",
+  "version": "0.7.8",
   "private": true,
   "type": "module",
   "sideEffects": false,
diff --git a/modules/factuges/package.json b/modules/factuges/package.json
index 0a56467d..9e85eef1 100644
--- a/modules/factuges/package.json
+++ b/modules/factuges/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@erp/factuges",
-  "version": "0.7.6",
+  "version": "0.7.8",
   "private": true,
   "type": "module",
   "sideEffects": false,
diff --git a/modules/identity/README.md b/modules/identity/README.md
new file mode 100644
index 00000000..d18fa902
--- /dev/null
+++ b/modules/identity/README.md
@@ -0,0 +1,14 @@
+# Identity Module
+
+`identity` convivirá temporalmente con `@erp/auth`.
+
+`@erp/auth` sigue siendo el runtime de autenticación actual.
+
+`identity` incorporará progresivamente la implementación V1 aprobada:
+- `email/password`
+- `access token`
+- `refresh token` persistido hasheado
+- tenant activo mediante `X-Company-Id`
+- roles y permisos company-scoped
+
+No se deben registrar middlewares ni reemplazar dependencias de `@erp/auth` hasta que `identity` tenga implementación funcional validada.
diff --git a/modules/identity/package.json b/modules/identity/package.json
new file mode 100644
index 00000000..08a2db5c
--- /dev/null
+++ b/modules/identity/package.json
@@ -0,0 +1,46 @@
+{
+  "name": "@erp/identity",
+  "description": "Identity module",
+  "version": "0.7.8",
+  "private": true,
+  "type": "module",
+  "sideEffects": false,
+  "scripts": {
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "check": "biome check .",
+    "lint": "biome lint .",
+    "clean": "rimraf .turbo node_modules dist"
+  },
+  "exports": {
+    ".": "./src/common/index.ts",
+    "./common": "./src/common/index.ts",
+    "./api": "./src/api/index.ts"
+  },
+  "dependencies": {
+    "@erp/core": "workspace:*",
+    "@repo/rdx-criteria": "workspace:*",
+    "@repo/rdx-ddd": "workspace:*",
+    "@repo/rdx-logger": "workspace:*",
+    "@repo/rdx-ui": "workspace:*",
+    "@repo/rdx-utils": "workspace:*",
+    "@repo/shadcn-ui": "workspace:*",
+    "@tanstack/react-query": "^5.98.0",
+    "bcrypt": "^6.0.0",
+    "express": "^4.22.1",
+    "jsonwebtoken": "^9.0.3",
+    "react-i18next": "^17.0.2",
+    "react-router-dom": "^7.14.0",
+    "sequelize": "^6.37.8",
+    "zod": "^4.3.6"
+  },
+  "devDependencies": {
+    "@types/express": "^4.17.21",
+    "@types/react": "^19.2.14",
+    "@types/react-dom": "^19.2.3",
+    "@types/react-router-dom": "^5.3.3",
+    "react": "^19.2.5",
+    "react-dom": "^19.2.5",
+    "rimraf": "^6.1.3",
+    "typescript": "^6.0.2"
+  }
+}
\ No newline at end of file
diff --git a/modules/identity/src/api/application/accounts/contracts/account-repository.interface.ts b/modules/identity/src/api/application/accounts/contracts/account-repository.interface.ts
new file mode 100644
index 00000000..6d241c08
--- /dev/null
+++ b/modules/identity/src/api/application/accounts/contracts/account-repository.interface.ts
@@ -0,0 +1,14 @@
+import type { EmailAddress } from "@repo/rdx-ddd";
+import type { Maybe, Result } from "@repo/rdx-utils";
+
+import type { Account } from "../../../domain";
+
+export interface IAccountRepository {
+  save(account: Account, transaction?: unknown): Promise<Result<void, Error>>;
+  update(account: Account, transaction?: unknown): Promise<Result<void, Error>>;
+  findById(id: Account["id"], transaction?: unknown): Promise<Result<Maybe<Account>, Error>>;
+  findByEmail(
+    email: EmailAddress,
+    transaction?: unknown
+  ): Promise<Result<Maybe<Account>, Error>>;
+}
diff --git a/modules/identity/src/api/application/accounts/contracts/index.ts b/modules/identity/src/api/application/accounts/contracts/index.ts
new file mode 100644
index 00000000..f0804e69
--- /dev/null
+++ b/modules/identity/src/api/application/accounts/contracts/index.ts
@@ -0,0 +1 @@
+export * from "./account-repository.interface";
diff --git a/modules/identity/src/api/application/accounts/index.ts b/modules/identity/src/api/application/accounts/index.ts
new file mode 100644
index 00000000..14371ab4
--- /dev/null
+++ b/modules/identity/src/api/application/accounts/index.ts
@@ -0,0 +1 @@
+export * from "./contracts";
diff --git a/modules/identity/src/api/application/authentication/contracts/access-token-issuer.interface.ts b/modules/identity/src/api/application/authentication/contracts/access-token-issuer.interface.ts
new file mode 100644
index 00000000..3438b87d
--- /dev/null
+++ b/modules/identity/src/api/application/authentication/contracts/access-token-issuer.interface.ts
@@ -0,0 +1,10 @@
+import type { Result } from "@repo/rdx-utils";
+
+export type AccessTokenPayload = {
+  accountId: string;
+  email: string;
+};
+
+export interface IAccessTokenIssuer {
+  issue(payload: AccessTokenPayload): Promise<Result<string, Error>>;
+}
diff --git a/modules/identity/src/api/application/authentication/contracts/access-token-verifier.interface.ts b/modules/identity/src/api/application/authentication/contracts/access-token-verifier.interface.ts
new file mode 100644
index 00000000..641509d7
--- /dev/null
+++ b/modules/identity/src/api/application/authentication/contracts/access-token-verifier.interface.ts
@@ -0,0 +1,10 @@
+import type { Result } from "@repo/rdx-utils";
+
+export type VerifiedAccessTokenPayload = {
+  accountId: string;
+  email: string;
+};
+
+export interface IAccessTokenVerifier {
+  verify(token: string): Promise<Result<VerifiedAccessTokenPayload, Error>>;
+}
diff --git a/modules/identity/src/api/application/authentication/contracts/index.ts b/modules/identity/src/api/application/authentication/contracts/index.ts
new file mode 100644
index 00000000..64f8c4d5
--- /dev/null
+++ b/modules/identity/src/api/application/authentication/contracts/index.ts
@@ -0,0 +1,6 @@
+export * from "./access-token-issuer.interface";
+export * from "./access-token-verifier.interface";
+export * from "./password-hasher.interface";
+export * from "./refresh-token-generator.interface";
+export * from "./refresh-token-repository.interface";
+export * from "./refresh-token-hasher.interface";
diff --git a/modules/identity/src/api/application/authentication/contracts/password-hasher.interface.ts b/modules/identity/src/api/application/authentication/contracts/password-hasher.interface.ts
new file mode 100644
index 00000000..419a1c0d
--- /dev/null
+++ b/modules/identity/src/api/application/authentication/contracts/password-hasher.interface.ts
@@ -0,0 +1,12 @@
+import type { Result } from "@repo/rdx-utils";
+
+import type { PasswordHash } from "../../../domain";
+
+export interface IPasswordHasher {
+  hash(password: string): Promise<Result<PasswordHash, Error>>;
+
+  verify(params: {
+    plainPassword: string;
+    passwordHash: PasswordHash;
+  }): Promise<Result<boolean, Error>>;
+}
diff --git a/modules/identity/src/api/application/authentication/contracts/refresh-token-generator.interface.ts b/modules/identity/src/api/application/authentication/contracts/refresh-token-generator.interface.ts
new file mode 100644
index 00000000..67c0c076
--- /dev/null
+++ b/modules/identity/src/api/application/authentication/contracts/refresh-token-generator.interface.ts
@@ -0,0 +1,5 @@
+import type { Result } from "@repo/rdx-utils";
+
+export interface IRefreshTokenGenerator {
+  generate(): Result<string, Error>;
+}
diff --git a/modules/identity/src/api/application/authentication/contracts/refresh-token-hasher.interface.ts b/modules/identity/src/api/application/authentication/contracts/refresh-token-hasher.interface.ts
new file mode 100644
index 00000000..1ab5a6d0
--- /dev/null
+++ b/modules/identity/src/api/application/authentication/contracts/refresh-token-hasher.interface.ts
@@ -0,0 +1,7 @@
+import type { Result } from "@repo/rdx-utils";
+
+import type { RefreshTokenHash } from "../../../domain";
+
+export interface IRefreshTokenHasher {
+  hash(token: string): Result<RefreshTokenHash, Error>;
+}
diff --git a/modules/identity/src/api/application/authentication/contracts/refresh-token-repository.interface.ts b/modules/identity/src/api/application/authentication/contracts/refresh-token-repository.interface.ts
new file mode 100644
index 00000000..bf459a1c
--- /dev/null
+++ b/modules/identity/src/api/application/authentication/contracts/refresh-token-repository.interface.ts
@@ -0,0 +1,18 @@
+import type { UniqueID, UtcDateTime } from "@repo/rdx-ddd";
+import type { Maybe, Result } from "@repo/rdx-utils";
+
+import type { RefreshToken, RefreshTokenHash } from "../../../domain";
+
+export interface IRefreshTokenRepository {
+  save(refreshToken: RefreshToken, transaction?: unknown): Promise<Result<void, Error>>;
+  update(refreshToken: RefreshToken, transaction?: unknown): Promise<Result<void, Error>>;
+  findByHash(
+    tokenHash: RefreshTokenHash,
+    transaction?: unknown
+  ): Promise<Result<Maybe<RefreshToken>, Error>>;
+  revokeAllByAccountId(params: {
+    accountId: UniqueID;
+    revokedAt: UtcDateTime;
+    transaction?: unknown;
+  }): Promise<Result<number, Error>>;
+}
diff --git a/modules/identity/src/api/application/authentication/index.ts b/modules/identity/src/api/application/authentication/index.ts
new file mode 100644
index 00000000..a6bb5e6d
--- /dev/null
+++ b/modules/identity/src/api/application/authentication/index.ts
@@ -0,0 +1,3 @@
+export * from "./contracts";
+export * from "./services";
+export * from "./use-cases";
diff --git a/modules/identity/src/api/application/authentication/services/account-authenticator.ts b/modules/identity/src/api/application/authentication/services/account-authenticator.ts
new file mode 100644
index 00000000..8c2ccf4c
--- /dev/null
+++ b/modules/identity/src/api/application/authentication/services/account-authenticator.ts
@@ -0,0 +1,70 @@
+import type { EmailAddress } from "@repo/rdx-ddd";
+import { Result } from "@repo/rdx-utils";
+
+import type { Account } from "../../../domain";
+import type { IAccountRepository } from "../../accounts";
+import type { IPasswordHasher } from "../contracts";
+
+import { AccountDisabledError } from "./account-disabled.error";
+import { AccountNotFoundError } from "./account-not-found.error";
+import { InvalidCredentialsError } from "./invalid-credentials.error";
+
+export type AuthenticateAccountWithPasswordParams = {
+  email: EmailAddress;
+  password: string;
+  transaction?: unknown;
+};
+
+export class AccountAuthenticator {
+  public constructor(
+    private readonly deps: {
+      accountRepository: IAccountRepository;
+      passwordHasher: IPasswordHasher;
+    }
+  ) {}
+
+  public async authenticateWithPassword(
+    params: AuthenticateAccountWithPasswordParams
+  ): Promise<Result<Account, Error>> {
+    const accountResult = await this.deps.accountRepository.findByEmail(
+      params.email,
+      params.transaction
+    );
+
+    if (accountResult.isFailure) {
+      return Result.fail(accountResult.error);
+    }
+
+    if (accountResult.data.isNone()) {
+      return Result.fail(
+        new AccountNotFoundError(`Account not found for email "${params.email.toPrimitive()}".`)
+      );
+    }
+
+    const account = accountResult.data.unwrap();
+
+    const authenticationResult = account.canAuthenticate();
+    if (authenticationResult.isFailure) {
+      return Result.fail(
+        new AccountDisabledError("Account cannot authenticate in its current state.", {
+          cause: authenticationResult.error,
+        })
+      );
+    }
+
+    const passwordVerificationResult = await this.deps.passwordHasher.verify({
+      plainPassword: params.password,
+      passwordHash: account.passwordHash,
+    });
+
+    if (passwordVerificationResult.isFailure) {
+      return Result.fail(passwordVerificationResult.error);
+    }
+
+    if (!passwordVerificationResult.data) {
+      return Result.fail(new InvalidCredentialsError("Invalid credentials."));
+    }
+
+    return Result.ok(account);
+  }
+}
diff --git a/modules/identity/src/api/application/authentication/services/account-disabled.error.ts b/modules/identity/src/api/application/authentication/services/account-disabled.error.ts
new file mode 100644
index 00000000..e9753731
--- /dev/null
+++ b/modules/identity/src/api/application/authentication/services/account-disabled.error.ts
@@ -0,0 +1,6 @@
+export class AccountDisabledError extends Error {
+  public constructor(message = "Account is disabled.", options?: ErrorOptions) {
+    super(message, options);
+    this.name = "AccountDisabledError";
+  }
+}
diff --git a/modules/identity/src/api/application/authentication/services/account-not-found.error.ts b/modules/identity/src/api/application/authentication/services/account-not-found.error.ts
new file mode 100644
index 00000000..bdb04569
--- /dev/null
+++ b/modules/identity/src/api/application/authentication/services/account-not-found.error.ts
@@ -0,0 +1,6 @@
+export class AccountNotFoundError extends Error {
+  public constructor(message = "Account not found.", options?: ErrorOptions) {
+    super(message, options);
+    this.name = "AccountNotFoundError";
+  }
+}
diff --git a/modules/identity/src/api/application/authentication/services/index.ts b/modules/identity/src/api/application/authentication/services/index.ts
new file mode 100644
index 00000000..ce5f3391
--- /dev/null
+++ b/modules/identity/src/api/application/authentication/services/index.ts
@@ -0,0 +1,9 @@
+export * from "./account-authenticator";
+export * from "./account-disabled.error";
+export * from "./account-not-found.error";
+export * from "./invalid-credentials.error";
+export * from "./issued-session";
+export * from "./logout-requires-refresh-token.error";
+export * from "./refresh-token-account-mismatch.error";
+export * from "./refresh-token-not-found.error";
+export * from "./session-issuer";
diff --git a/modules/identity/src/api/application/authentication/services/invalid-credentials.error.ts b/modules/identity/src/api/application/authentication/services/invalid-credentials.error.ts
new file mode 100644
index 00000000..fdf70f11
--- /dev/null
+++ b/modules/identity/src/api/application/authentication/services/invalid-credentials.error.ts
@@ -0,0 +1,6 @@
+export class InvalidCredentialsError extends Error {
+  public constructor(message = "Invalid credentials.", options?: ErrorOptions) {
+    super(message, options);
+    this.name = "InvalidCredentialsError";
+  }
+}
diff --git a/modules/identity/src/api/application/authentication/services/issued-session.ts b/modules/identity/src/api/application/authentication/services/issued-session.ts
new file mode 100644
index 00000000..783c3c25
--- /dev/null
+++ b/modules/identity/src/api/application/authentication/services/issued-session.ts
@@ -0,0 +1,5 @@
+export type IssuedSession = {
+  accessToken: string;
+  refreshToken: string;
+  refreshTokenId: string;
+};
diff --git a/modules/identity/src/api/application/authentication/services/logout-requires-refresh-token.error.ts b/modules/identity/src/api/application/authentication/services/logout-requires-refresh-token.error.ts
new file mode 100644
index 00000000..585e327f
--- /dev/null
+++ b/modules/identity/src/api/application/authentication/services/logout-requires-refresh-token.error.ts
@@ -0,0 +1,9 @@
+export class LogoutRequiresRefreshTokenError extends Error {
+  public constructor(
+    message = "Logout requires a refresh token or allSessions=true.",
+    options?: ErrorOptions
+  ) {
+    super(message, options);
+    this.name = "LogoutRequiresRefreshTokenError";
+  }
+}
diff --git a/modules/identity/src/api/application/authentication/services/refresh-token-account-mismatch.error.ts b/modules/identity/src/api/application/authentication/services/refresh-token-account-mismatch.error.ts
new file mode 100644
index 00000000..e65d3c90
--- /dev/null
+++ b/modules/identity/src/api/application/authentication/services/refresh-token-account-mismatch.error.ts
@@ -0,0 +1,6 @@
+export class RefreshTokenAccountMismatchError extends Error {
+  public constructor(message = "Refresh token does not belong to the requested account.") {
+    super(message);
+    this.name = "RefreshTokenAccountMismatchError";
+  }
+}
diff --git a/modules/identity/src/api/application/authentication/services/refresh-token-not-found.error.ts b/modules/identity/src/api/application/authentication/services/refresh-token-not-found.error.ts
new file mode 100644
index 00000000..69b46c89
--- /dev/null
+++ b/modules/identity/src/api/application/authentication/services/refresh-token-not-found.error.ts
@@ -0,0 +1,6 @@
+export class RefreshTokenNotFoundError extends Error {
+  public constructor(message = "Refresh token not found.", options?: ErrorOptions) {
+    super(message, options);
+    this.name = "RefreshTokenNotFoundError";
+  }
+}
diff --git a/modules/identity/src/api/application/authentication/services/session-issuer.ts b/modules/identity/src/api/application/authentication/services/session-issuer.ts
new file mode 100644
index 00000000..bbfcbf45
--- /dev/null
+++ b/modules/identity/src/api/application/authentication/services/session-issuer.ts
@@ -0,0 +1,83 @@
+import { UniqueID, type UtcDateTime } from "@repo/rdx-ddd";
+import { Maybe, Result } from "@repo/rdx-utils";
+
+import { type Account, RefreshToken } from "../../../domain";
+import type {
+  IAccessTokenIssuer,
+  IRefreshTokenGenerator,
+  IRefreshTokenHasher,
+  IRefreshTokenRepository,
+} from "../contracts";
+
+import type { IssuedSession } from "./issued-session";
+
+export type IssueSessionParams = {
+  account: Account;
+  refreshTokenExpiresAt: UtcDateTime;
+  now: UtcDateTime;
+  transaction?: unknown;
+};
+
+export class SessionIssuer {
+  public constructor(
+    private readonly deps: {
+      accessTokenIssuer: IAccessTokenIssuer;
+      refreshTokenGenerator: IRefreshTokenGenerator;
+      refreshTokenHasher: IRefreshTokenHasher;
+      refreshTokenRepository: IRefreshTokenRepository;
+    }
+  ) {}
+
+  public async issue(params: IssueSessionParams): Promise<Result<IssuedSession, Error>> {
+    const accessTokenResult = await this.deps.accessTokenIssuer.issue({
+      accountId: params.account.id.toPrimitive(),
+      email: params.account.email.toPrimitive(),
+    });
+
+    if (accessTokenResult.isFailure) {
+      return Result.fail(accessTokenResult.error);
+    }
+
+    const plainRefreshTokenResult = this.deps.refreshTokenGenerator.generate();
+    if (plainRefreshTokenResult.isFailure) {
+      return Result.fail(plainRefreshTokenResult.error);
+    }
+
+    const refreshTokenHashResult = this.deps.refreshTokenHasher.hash(plainRefreshTokenResult.data);
+    if (refreshTokenHashResult.isFailure) {
+      return Result.fail(refreshTokenHashResult.error);
+    }
+
+    const refreshTokenId = UniqueID.generateNewID();
+    const refreshTokenCreateResult = RefreshToken.create(
+      {
+        accountId: params.account.id,
+        tokenHash: refreshTokenHashResult.data,
+        expiresAt: params.refreshTokenExpiresAt,
+        revokedAt: Maybe.none(),
+        replacedByTokenId: Maybe.none(),
+        createdAt: params.now,
+      },
+      refreshTokenId
+    );
+
+    if (refreshTokenCreateResult.isFailure) {
+      return Result.fail(refreshTokenCreateResult.error);
+    }
+
+    const saveResult = await this.deps.refreshTokenRepository.save(
+      refreshTokenCreateResult.data,
+      params.transaction
+    );
+
+    if (saveResult.isFailure) {
+      return Result.fail(saveResult.error);
+    }
+
+    return Result.ok({
+      accessToken: accessTokenResult.data,
+      refreshToken: plainRefreshTokenResult.data,
+      refreshTokenId: refreshTokenId.toPrimitive(),
+    });
+  }
+}
diff --git a/modules/identity/src/api/application/authentication/use-cases/get-current-session.use-case.ts b/modules/identity/src/api/application/authentication/use-cases/get-current-session.use-case.ts
new file mode 100644
index 00000000..2d2deb85
--- /dev/null
+++ b/modules/identity/src/api/application/authentication/use-cases/get-current-session.use-case.ts
@@ -0,0 +1,70 @@
+import { Result } from "@repo/rdx-utils";
+import type { UniqueID } from "@repo/rdx-ddd";
+
+import type { IAccountRepository } from "../../accounts";
+import { AccountDisabledError, AccountNotFoundError } from "../services";
+
+export type GetCurrentSessionInput = {
+  accountId: UniqueID;
+};
+
+export type GetCurrentSessionOutput = {
+  account: {
+    id: string;
+    email: string;
+    name: string;
+    avatarUrl: string | null;
+    languageCode: string;
+  };
+};
+
+export class GetCurrentSessionUseCase {
+  public constructor(
+    private readonly deps: {
+      accountRepository: IAccountRepository;
+    }
+  ) {}
+
+  public async execute(
+    input: GetCurrentSessionInput
+  ): Promise<Result<GetCurrentSessionOutput, Error>> {
+    try {
+      const accountResult = await this.deps.accountRepository.findById(input.accountId);
+      if (accountResult.isFailure) {
+        return Result.fail(accountResult.error);
+      }
+
+      if (accountResult.data.isNone()) {
+        return Result.fail(
+          new AccountNotFoundError(`Account not found for id "${input.accountId.toPrimitive()}".`)
+        );
+      }
+
+      const account = accountResult.data.unwrap();
+
+      const canAuthenticateResult = account.canAuthenticate();
+      if (canAuthenticateResult.isFailure) {
+        return Result.fail(
+          new AccountDisabledError("Account cannot authenticate in its current state.", {
+            cause: canAuthenticateResult.error,
+          })
+        );
+      }
+
+      return Result.ok({
+        account: {
+          id: account.id.toPrimitive(),
+          email: account.email.toPrimitive(),
+          name: account.name.toPrimitive(),
+          avatarUrl: account.avatarUrl.match(
+            (avatarUrl) => avatarUrl.toPrimitive(),
+            () => null
+          ),
+          languageCode: account.languageCode.toPrimitive(),
+        },
+      });
+    } catch (error: unknown) {
+      return Result.fail(error as Error);
+    }
+  }
+}
diff --git a/modules/identity/src/api/application/authentication/use-cases/index.ts b/modules/identity/src/api/application/authentication/use-cases/index.ts
new file mode 100644
index 00000000..104d79d5
--- /dev/null
+++ b/modules/identity/src/api/application/authentication/use-cases/index.ts
@@ -0,0 +1,4 @@
+export * from "./get-current-session.use-case";
+export * from "./login-with-password.use-case";
+export * from "./logout.use-case";
+export * from "./refresh-session.use-case";
diff --git a/modules/identity/src/api/application/authentication/use-cases/login-with-password.use-case.ts b/modules/identity/src/api/application/authentication/use-cases/login-with-password.use-case.ts
new file mode 100644
index 00000000..e22830bf
--- /dev/null
+++ b/modules/identity/src/api/application/authentication/use-cases/login-with-password.use-case.ts
@@ -0,0 +1,85 @@
+import type { ITransactionManager } from "@erp/core/api";
+import { EmailAddress, type UtcDateTime } from "@repo/rdx-ddd";
+import { Result } from "@repo/rdx-utils";
+
+import type { AccountAuthenticator, SessionIssuer } from "../services";
+
+export type LoginWithPasswordInput = {
+  email: string;
+  password: string;
+  now: UtcDateTime;
+  refreshTokenExpiresAt: UtcDateTime;
+};
+
+export type LoginWithPasswordOutput = {
+  accessToken: string;
+  refreshToken: string;
+  account: {
+    id: string;
+    email: string;
+    name: string;
+    avatarUrl: string | null;
+    languageCode: string;
+  };
+};
+
+export class LoginWithPasswordUseCase {
+  public constructor(
+    private readonly deps: {
+      accountAuthenticator: AccountAuthenticator;
+      sessionIssuer: SessionIssuer;
+      transactionManager: ITransactionManager;
+    }
+  ) {}
+
+  public async execute(
+    input: LoginWithPasswordInput
+  ): Promise<Result<LoginWithPasswordOutput, Error>> {
+    const emailResult = EmailAddress.create(input.email);
+    if (emailResult.isFailure) {
+      return Result.fail(emailResult.error);
+    }
+
+    return this.deps.transactionManager.complete(async (transaction: unknown) => {
+      try {
+        const accountResult = await this.deps.accountAuthenticator.authenticateWithPassword({
+          email: emailResult.data,
+          password: input.password,
+          transaction,
+        });
+
+        if (accountResult.isFailure) {
+          return Result.fail(accountResult.error);
+        }
+
+        const sessionResult = await this.deps.sessionIssuer.issue({
+          account: accountResult.data,
+          refreshTokenExpiresAt: input.refreshTokenExpiresAt,
+          now: input.now,
+          transaction,
+        });
+
+        if (sessionResult.isFailure) {
+          return Result.fail(sessionResult.error);
+        }
+
+        return Result.ok({
+          accessToken: sessionResult.data.accessToken,
+          refreshToken: sessionResult.data.refreshToken,
+          account: {
+            id: accountResult.data.id.toPrimitive(),
+            email: accountResult.data.email.toPrimitive(),
+            name: accountResult.data.name.toPrimitive(),
+            avatarUrl: accountResult.data.avatarUrl.match(
+              (avatarUrl) => avatarUrl.toPrimitive(),
+              () => null
+            ),
+            languageCode: accountResult.data.languageCode.toPrimitive(),
+          },
+        });
+      } catch (error: unknown) {
+        return Result.fail(error as Error);
+      }
+    });
+  }
+}
diff --git a/modules/identity/src/api/application/authentication/use-cases/logout.use-case.ts b/modules/identity/src/api/application/authentication/use-cases/logout.use-case.ts
new file mode 100644
index 00000000..88cc15ae
--- /dev/null
+++ b/modules/identity/src/api/application/authentication/use-cases/logout.use-case.ts
@@ -0,0 +1,97 @@
+import type { ITransactionManager } from "@erp/core/api";
+import type { UniqueID, UtcDateTime } from "@repo/rdx-ddd";
+import { Maybe, Result } from "@repo/rdx-utils";
+
+import type { IRefreshTokenHasher, IRefreshTokenRepository } from "../contracts";
+import {
+  LogoutRequiresRefreshTokenError,
+  RefreshTokenAccountMismatchError,
+  RefreshTokenNotFoundError,
+} from "../services";
+
+export type LogoutInput = {
+  accountId: UniqueID;
+  refreshToken?: string;
+  allSessions?: boolean;
+  now: UtcDateTime;
+};
+
+export type LogoutOutput = {
+  success: true;
+};
+
+export class LogoutUseCase {
+  public constructor(
+    private readonly deps: {
+      refreshTokenHasher: IRefreshTokenHasher;
+      refreshTokenRepository: IRefreshTokenRepository;
+      transactionManager: ITransactionManager;
+    }
+  ) {}
+
+  public async execute(input: LogoutInput): Promise<Result<LogoutOutput, Error>> {
+    return this.deps.transactionManager.complete(async (transaction: unknown) => {
+      try {
+        if (input.allSessions === true) {
+          const revokeAllResult = await this.deps.refreshTokenRepository.revokeAllByAccountId({
+            accountId: input.accountId,
+            revokedAt: input.now,
+            transaction,
+          });
+
+          if (revokeAllResult.isFailure) {
+            return Result.fail(revokeAllResult.error);
+          }
+
+          return Result.ok({ success: true as const });
+        }
+
+        if (!input.refreshToken) {
+          return Result.fail(new LogoutRequiresRefreshTokenError());
+        }
+
+        const refreshTokenHashResult = this.deps.refreshTokenHasher.hash(input.refreshToken);
+        if (refreshTokenHashResult.isFailure) {
+          return Result.fail(refreshTokenHashResult.error);
+        }
+
+        const persistedRefreshTokenResult = await this.deps.refreshTokenRepository.findByHash(
+          refreshTokenHashResult.data,
+          transaction
+        );
+        if (persistedRefreshTokenResult.isFailure) {
+          return Result.fail(persistedRefreshTokenResult.error);
+        }
+
+        if (persistedRefreshTokenResult.data.isNone()) {
+          return Result.fail(new RefreshTokenNotFoundError());
+        }
+
+        const persistedRefreshToken = persistedRefreshTokenResult.data.unwrap();
+        if (persistedRefreshToken.accountId.toPrimitive() !== input.accountId.toPrimitive()) {
+          return Result.fail(new RefreshTokenAccountMismatchError());
+        }
+
+        const revokeResult = persistedRefreshToken.revoke({
+          revokedAt: input.now,
+          replacedByTokenId: Maybe.none(),
+        });
+        if (revokeResult.isFailure) {
+          return Result.fail(revokeResult.error);
+        }
+
+        const updateResult = await this.deps.refreshTokenRepository.update(
+          persistedRefreshToken,
+          transaction
+        );
+        if (updateResult.isFailure) {
+          return Result.fail(updateResult.error);
+        }
+
+        return Result.ok({ success: true as const });
+      } catch (error: unknown) {
+        return Result.fail(error as Error);
+      }
+    });
+  }
+}
diff --git a/modules/identity/src/api/application/authentication/use-cases/refresh-session.use-case.ts b/modules/identity/src/api/application/authentication/use-cases/refresh-session.use-case.ts
new file mode 100644
index 00000000..86a43e27
--- /dev/null
+++ b/modules/identity/src/api/application/authentication/use-cases/refresh-session.use-case.ts
@@ -0,0 +1,126 @@
+import type { ITransactionManager } from "@erp/core/api";
+import { UniqueID, type UtcDateTime } from "@repo/rdx-ddd";
+import { Result } from "@repo/rdx-utils";
+
+import type { IAccountRepository } from "../../accounts";
+import type { IRefreshTokenHasher, IRefreshTokenRepository } from "../contracts";
+import type { SessionIssuer } from "../services";
+import { AccountDisabledError, AccountNotFoundError, RefreshTokenNotFoundError } from "../services";
+
+export type RefreshSessionInput = {
+  refreshToken: string;
+  now: UtcDateTime;
+  refreshTokenExpiresAt: UtcDateTime;
+};
+
+export type RefreshSessionOutput = {
+  accessToken: string;
+  refreshToken: string;
+};
+
+export class RefreshSessionUseCase {
+  public constructor(
+    private readonly deps: {
+      refreshTokenHasher: IRefreshTokenHasher;
+      refreshTokenRepository: IRefreshTokenRepository;
+      accountRepository: IAccountRepository;
+      sessionIssuer: SessionIssuer;
+      transactionManager: ITransactionManager;
+    }
+  ) {}
+
+  public async execute(input: RefreshSessionInput): Promise<Result<RefreshSessionOutput, Error>> {
+    return this.deps.transactionManager.complete(async (transaction: unknown) => {
+      try {
+        const refreshTokenHashResult = this.deps.refreshTokenHasher.hash(input.refreshToken);
+        if (refreshTokenHashResult.isFailure) {
+          return Result.fail(refreshTokenHashResult.error);
+        }
+
+        const persistedRefreshTokenResult = await this.deps.refreshTokenRepository.findByHash(
+          refreshTokenHashResult.data,
+          transaction
+        );
+        if (persistedRefreshTokenResult.isFailure) {
+          return Result.fail(persistedRefreshTokenResult.error);
+        }
+
+        if (persistedRefreshTokenResult.data.isNone()) {
+          return Result.fail(new RefreshTokenNotFoundError());
+        }
+
+        const persistedRefreshToken = persistedRefreshTokenResult.data.unwrap();
+
+        const canBeUsedResult = persistedRefreshToken.canBeUsed(input.now);
+        if (canBeUsedResult.isFailure) {
+          return Result.fail(canBeUsedResult.error);
+        }
+
+        const accountResult = await this.deps.accountRepository.findById(
+          persistedRefreshToken.accountId,
+          transaction
+        );
+        if (accountResult.isFailure) {
+          return Result.fail(accountResult.error);
+        }
+
+        if (accountResult.data.isNone()) {
+          return Result.fail(
+            new AccountNotFoundError(
+              `Account not found for id "${persistedRefreshToken.accountId.toPrimitive()}".`
+            )
+          );
+        }
+
+        const account = accountResult.data.unwrap();
+        const canAuthenticateResult = account.canAuthenticate();
+        if (canAuthenticateResult.isFailure) {
+          return Result.fail(
+            new AccountDisabledError("Account cannot authenticate in its current state.", {
+              cause: canAuthenticateResult.error,
+            })
+          );
+        }
+
+        const newSessionResult = await this.deps.sessionIssuer.issue({
+          account,
+          refreshTokenExpiresAt: input.refreshTokenExpiresAt,
+          now: input.now,
+          transaction,
+        });
+        if (newSessionResult.isFailure) {
+          return Result.fail(newSessionResult.error);
+        }
+
+        const rotatedTokenIdResult = UniqueID.create(newSessionResult.data.refreshTokenId);
+        if (rotatedTokenIdResult.isFailure) {
+          return Result.fail(rotatedTokenIdResult.error);
+        }
+
+        const rotateResult = persistedRefreshToken.rotate({
+          revokedAt: input.now,
+          replacedByTokenId: rotatedTokenIdResult.data,
+          now: input.now,
+        });
+        if (rotateResult.isFailure) {
+          return Result.fail(rotateResult.error);
+        }
+
+        const updateResult = await this.deps.refreshTokenRepository.update(
+          persistedRefreshToken,
+          transaction
+        );
+        if (updateResult.isFailure) {
+          return Result.fail(updateResult.error);
+        }
+
+        return Result.ok({
+          accessToken: newSessionResult.data.accessToken,
+          refreshToken: newSessionResult.data.refreshToken,
+        });
+      } catch (error: unknown) {
+        return Result.fail(error as Error);
+      }
+    });
+  }
+}
diff --git a/modules/identity/src/api/application/companies/contracts/company-repository.interface.ts b/modules/identity/src/api/application/companies/contracts/company-repository.interface.ts
new file mode 100644
index 00000000..3280a9fa
--- /dev/null
+++ b/modules/identity/src/api/application/companies/contracts/company-repository.interface.ts
@@ -0,0 +1,9 @@
+import type { Maybe, Result } from "@repo/rdx-utils";
+
+import type { Company } from "../../../domain";
+
+export interface ICompanyRepository {
+  save(company: Company, transaction?: unknown): Promise<Result<void, Error>>;
+  update(company: Company, transaction?: unknown): Promise<Result<void, Error>>;
+  findById(id: Company["id"], transaction?: unknown): Promise<Result<Maybe<Company>, Error>>;
+}
diff --git a/modules/identity/src/api/application/companies/contracts/index.ts b/modules/identity/src/api/application/companies/contracts/index.ts
new file mode 100644
index 00000000..4a2beff9
--- /dev/null
+++ b/modules/identity/src/api/application/companies/contracts/index.ts
@@ -0,0 +1 @@
+export * from "./company-repository.interface";
diff --git a/modules/identity/src/api/application/companies/index.ts b/modules/identity/src/api/application/companies/index.ts
new file mode 100644
index 00000000..14371ab4
--- /dev/null
+++ b/modules/identity/src/api/application/companies/index.ts
@@ -0,0 +1 @@
+export * from "./contracts";
diff --git a/modules/identity/src/api/application/company-memberships/contracts/company-membership-repository.interface.ts b/modules/identity/src/api/application/company-memberships/contracts/company-membership-repository.interface.ts
new file mode 100644
index 00000000..29efb403
--- /dev/null
+++ b/modules/identity/src/api/application/company-memberships/contracts/company-membership-repository.interface.ts
@@ -0,0 +1,21 @@
+import type { Collection, Maybe, Result } from "@repo/rdx-utils";
+
+import type { CompanyMembership } from "../../../domain";
+
+export interface ICompanyMembershipRepository {
+  save(membership: CompanyMembership, transaction?: unknown): Promise<Result<void, Error>>;
+  update(membership: CompanyMembership, transaction?: unknown): Promise<Result<void, Error>>;
+  findByAccountIdAndCompanyId(params: {
+    accountId: CompanyMembership["accountId"];
+    companyId: CompanyMembership["companyId"];
+    transaction?: unknown;
+  }): Promise<Result<Maybe<CompanyMembership>, Error>>;
+  findByCompanyId(params: {
+    companyId: CompanyMembership["companyId"];
+    transaction?: unknown;
+  }): Promise<Result<Collection<CompanyMembership>, Error>>;
+  findByAccountId(params: {
+    accountId: CompanyMembership["accountId"];
+    transaction?: unknown;
+  }): Promise<Result<Collection<CompanyMembership>, Error>>;
+}
diff --git a/modules/identity/src/api/application/company-memberships/contracts/index.ts b/modules/identity/src/api/application/company-memberships/contracts/index.ts
new file mode 100644
index 00000000..e21a455b
--- /dev/null
+++ b/modules/identity/src/api/application/company-memberships/contracts/index.ts
@@ -0,0 +1 @@
+export * from "./company-membership-repository.interface";
diff --git a/modules/identity/src/api/application/company-memberships/index.ts b/modules/identity/src/api/application/company-memberships/index.ts
new file mode 100644
index 00000000..14371ab4
--- /dev/null
+++ b/modules/identity/src/api/application/company-memberships/index.ts
@@ -0,0 +1 @@
+export * from "./contracts";
diff --git a/modules/identity/src/api/application/index.ts b/modules/identity/src/api/application/index.ts
new file mode 100644
index 00000000..ed2ba9b4
--- /dev/null
+++ b/modules/identity/src/api/application/index.ts
@@ -0,0 +1,6 @@
+export * from "./accounts";
+export * from "./authentication";
+export * from "./companies";
+export * from "./company-memberships";
+export * from "./permissions";
+export * from "./roles";
diff --git a/modules/identity/src/api/application/permissions/contracts/index.ts b/modules/identity/src/api/application/permissions/contracts/index.ts
new file mode 100644
index 00000000..f1de3e45
--- /dev/null
+++ b/modules/identity/src/api/application/permissions/contracts/index.ts
@@ -0,0 +1 @@
+export * from "./permission-catalog.interface";
diff --git a/modules/identity/src/api/application/permissions/contracts/permission-catalog.interface.ts b/modules/identity/src/api/application/permissions/contracts/permission-catalog.interface.ts
new file mode 100644
index 00000000..b1c39fe8
--- /dev/null
+++ b/modules/identity/src/api/application/permissions/contracts/permission-catalog.interface.ts
@@ -0,0 +1,10 @@
+import type { PermissionCode, PermissionDefinition } from "@erp/core";
+import type { Collection, Maybe, Result } from "@repo/rdx-utils";
+
+export interface IPermissionCatalog {
+  findAll(): Result<Collection<PermissionDefinition>, Error>;
+
+  exists(permissionCode: PermissionCode): Result<boolean, Error>;
+
+  findByCode(permissionCode: PermissionCode): Result<Maybe<PermissionDefinition>, Error>;
+}
diff --git a/modules/identity/src/api/application/permissions/index.ts b/modules/identity/src/api/application/permissions/index.ts
new file mode 100644
index 00000000..14371ab4
--- /dev/null
+++ b/modules/identity/src/api/application/permissions/index.ts
@@ -0,0 +1 @@
+export * from "./contracts";
diff --git a/modules/identity/src/api/application/roles/contracts/index.ts b/modules/identity/src/api/application/roles/contracts/index.ts
new file mode 100644
index 00000000..04e3a83f
--- /dev/null
+++ b/modules/identity/src/api/application/roles/contracts/index.ts
@@ -0,0 +1,2 @@
+export * from "./role-repository.interface";
+export * from "./role-permission-validator.interface";
diff --git a/modules/identity/src/api/application/roles/contracts/role-permission-validator.interface.ts b/modules/identity/src/api/application/roles/contracts/role-permission-validator.interface.ts
new file mode 100644
index 00000000..ec7ea064
--- /dev/null
+++ b/modules/identity/src/api/application/roles/contracts/role-permission-validator.interface.ts
@@ -0,0 +1,6 @@
+import type { PermissionCode } from "@erp/core";
+import type { Result } from "@repo/rdx-utils";
+
+export interface IRolePermissionValidator {
+  validate(permissionCodes: PermissionCode[]): Result<void, Error>;
+}
diff --git a/modules/identity/src/api/application/roles/contracts/role-repository.interface.ts b/modules/identity/src/api/application/roles/contracts/role-repository.interface.ts
new file mode 100644
index 00000000..b3c5ceb6
--- /dev/null
+++ b/modules/identity/src/api/application/roles/contracts/role-repository.interface.ts
@@ -0,0 +1,24 @@
+import type { UniqueID } from "@repo/rdx-ddd";
+import type { Collection, Maybe, Result } from "@repo/rdx-utils";
+
+import type { Role } from "../../../domain";
+
+export interface IRoleRepository {
+  save(role: Role, transaction?: unknown): Promise<Result<void, Error>>;
+  update(role: Role, transaction?: unknown): Promise<Result<void, Error>>;
+  delete(role: Role, transaction?: unknown): Promise<Result<void, Error>>;
+  findByIdInCompany(params: {
+    roleId: UniqueID;
+    companyId: Role["companyId"];
+    transaction?: unknown;
+  }): Promise<Result<Maybe<Role>, Error>>;
+  findByIdsInCompany(params: {
+    roleIds: UniqueID[];
+    companyId: Role["companyId"];
+    transaction?: unknown;
+  }): Promise<Result<Collection<Role>, Error>>;
+  findByCompanyId(params: {
+    companyId: Role["companyId"];
+    transaction?: unknown;
+  }): Promise<Result<Collection<Role>, Error>>;
+}
diff --git a/modules/identity/src/api/application/roles/index.ts b/modules/identity/src/api/application/roles/index.ts
new file mode 100644
index 00000000..18e9e8cc
--- /dev/null
+++ b/modules/identity/src/api/application/roles/index.ts
@@ -0,0 +1,2 @@
+export * from "./contracts";
+export * from "./services";
diff --git a/modules/identity/src/api/application/roles/services/index.ts b/modules/identity/src/api/application/roles/services/index.ts
new file mode 100644
index 00000000..0024cdad
--- /dev/null
+++ b/modules/identity/src/api/application/roles/services/index.ts
@@ -0,0 +1,2 @@
+export * from "./role-permission-validator";
+export * from "./unknown-permission-code.error";
diff --git a/modules/identity/src/api/application/roles/services/role-permission-validator.ts b/modules/identity/src/api/application/roles/services/role-permission-validator.ts
new file mode 100644
index 00000000..a1107c4e
--- /dev/null
+++ b/modules/identity/src/api/application/roles/services/role-permission-validator.ts
@@ -0,0 +1,27 @@
+import type { PermissionCode } from "@erp/core";
+import { Result } from "@repo/rdx-utils";
+
+import type { IPermissionCatalog } from "../../permissions";
+import type { IRolePermissionValidator } from "../contracts";
+
+import { UnknownPermissionCodeError } from "./unknown-permission-code.error";
+
+export class RolePermissionValidator implements IRolePermissionValidator {
+  public constructor(private readonly permissionCatalog: IPermissionCatalog) {}
+
+  public validate(permissionCodes: PermissionCode[]): Result<void, Error> {
+    for (const permissionCode of permissionCodes) {
+      const existsResult = this.permissionCatalog.exists(permissionCode);
+
+      if (existsResult.isFailure) {
+        return Result.fail(existsResult.error);
+      }
+
+      if (!existsResult.data) {
+        return Result.fail(new UnknownPermissionCodeError(permissionCode));
+      }
+    }
+
+    return Result.ok(undefined);
+  }
+}
diff --git a/modules/identity/src/api/application/roles/services/unknown-permission-code.error.ts b/modules/identity/src/api/application/roles/services/unknown-permission-code.error.ts
new file mode 100644
index 00000000..73ed0dae
--- /dev/null
+++ b/modules/identity/src/api/application/roles/services/unknown-permission-code.error.ts
@@ -0,0 +1,10 @@
+import type { PermissionCode } from "@erp/core";
+import { DomainError } from "@repo/rdx-ddd";
+
+export class UnknownPermissionCodeError extends DomainError {
+  public readonly code = "IDENTITY_UNKNOWN_PERMISSION_CODE" as const;
+
+  public constructor(public readonly permissionCode: PermissionCode) {
+    super(`Unknown permission code: ${permissionCode}`);
+  }
+}
diff --git a/modules/identity/src/api/domain/accounts/account-status.vo.ts b/modules/identity/src/api/domain/accounts/account-status.vo.ts
new file mode 100644
index 00000000..09d74c12
--- /dev/null
+++ b/modules/identity/src/api/domain/accounts/account-status.vo.ts
@@ -0,0 +1,66 @@
+import { DomainValidationError, ValueObject } from "@repo/rdx-ddd";
+import { Result } from "@repo/rdx-utils";
+
+interface AccountStatusProps {
+  value: string;
+}
+
+export enum ACCOUNT_STATUS {
+  ACTIVE = "active",
+  DISABLED = "disabled",
+  PENDING_VERIFICATION = "pending_verification",
+}
+
+export class AccountStatus extends ValueObject<AccountStatusProps> {
+  private static readonly ALLOWED_STATUSES = [
+    ACCOUNT_STATUS.ACTIVE,
+    ACCOUNT_STATUS.DISABLED,
+    ACCOUNT_STATUS.PENDING_VERIFICATION,
+  ] as const;
+
+  static create(value: string): Result<AccountStatus, Error> {
+    if (!AccountStatus.ALLOWED_STATUSES.includes(value as (typeof AccountStatus.ALLOWED_STATUSES)[number])) {
+      return Result.fail(
+        new DomainValidationError("INVALID_ACCOUNT_STATUS", "status", `Status value not valid: ${value}`)
+      );
+    }
+
+    return Result.ok(new AccountStatus({ value }));
+  }
+
+  static createActive(): AccountStatus {
+    return new AccountStatus({ value: ACCOUNT_STATUS.ACTIVE });
+  }
+
+  static createDisabled(): AccountStatus {
+    return new AccountStatus({ value: ACCOUNT_STATUS.DISABLED });
+  }
+
+  static createPendingVerification(): AccountStatus {
+    return new AccountStatus({ value: ACCOUNT_STATUS.PENDING_VERIFICATION });
+  }
+
+  isActive(): boolean {
+    return this.props.value === ACCOUNT_STATUS.ACTIVE;
+  }
+
+  isDisabled(): boolean {
+    return this.props.value === ACCOUNT_STATUS.DISABLED;
+  }
+
+  isPendingVerification(): boolean {
+    return this.props.value === ACCOUNT_STATUS.PENDING_VERIFICATION;
+  }
+
+  getProps(): string {
+    return this.props.value;
+  }
+
+  toPrimitive(): string {
+    return this.getProps();
+  }
+
+  toString(): string {
+    return String(this.props.value);
+  }
+}
diff --git a/modules/identity/src/api/domain/accounts/account.aggregate.ts b/modules/identity/src/api/domain/accounts/account.aggregate.ts
new file mode 100644
index 00000000..c7140486
--- /dev/null
+++ b/modules/identity/src/api/domain/accounts/account.aggregate.ts
@@ -0,0 +1,210 @@
+import {
+  AggregateRoot,
+  type EmailAddress,
+  type LanguageCode,
+  type Name,
+  type URLAddress,
+  type UniqueID,
+  type UtcDate,
+} from "@repo/rdx-ddd";
+import { type Maybe, Result } from "@repo/rdx-utils";
+
+import { AccountStatus } from "./account-status.vo";
+import { AccountCannotAuthenticateError, AccountCannotBeUpdatedError } from "./errors";
+import type { PasswordHash } from "./password-hash";
+
+export interface IAccountCreateProps {
+  email: EmailAddress;
+  passwordHash: PasswordHash;
+  name: Name;
+  avatarUrl: Maybe<URLAddress>;
+  languageCode: LanguageCode;
+  status: AccountStatus;
+  createdAt: UtcDate;
+  updatedAt: UtcDate;
+}
+
+export type AccountProfilePatchProps = Partial<{
+  name: Name;
+  avatarUrl: Maybe<URLAddress>;
+  languageCode: LanguageCode;
+}> & {
+  updatedAt: UtcDate;
+};
+
+export type AccountInternalProps = IAccountCreateProps;
+
+export class Account extends AggregateRoot<AccountInternalProps> {
+  protected constructor(props: AccountInternalProps, id?: UniqueID) {
+    super(props, id);
+  }
+
+  static create(props: IAccountCreateProps, id?: UniqueID): Result<Account, Error> {
+    const validationResult = Account.validateCreateProps(props);
+    if (validationResult.isFailure) {
+      return Result.fail(validationResult.error);
+    }
+
+    return Result.ok(new Account(props, id));
+  }
+
+  static rehydrate(props: AccountInternalProps, id: UniqueID): Account {
+    return new Account(props, id);
+  }
+
+  private static validateCreateProps(props: IAccountCreateProps): Result<void, Error> {
+    if (!props.email) {
+      return Result.fail(new Error("Account email is required."));
+    }
+
+    if (!props.passwordHash) {
+      return Result.fail(new Error("Account password hash is required."));
+    }
+
+    if (!props.name) {
+      return Result.fail(new Error("Account name is required."));
+    }
+
+    if (!props.languageCode) {
+      return Result.fail(new Error("Account language code is required."));
+    }
+
+    if (!props.status) {
+      return Result.fail(new Error("Account status is required."));
+    }
+
+    if (!(props.createdAt && props.updatedAt)) {
+      return Result.fail(new Error("Account timestamps are required."));
+    }
+
+    return Result.ok();
+  }
+
+  public get email(): EmailAddress {
+    return this.props.email;
+  }
+
+  public get passwordHash(): PasswordHash {
+    return this.props.passwordHash;
+  }
+
+  public get name(): Name {
+    return this.props.name;
+  }
+
+  public get avatarUrl(): Maybe<URLAddress> {
+    return this.props.avatarUrl;
+  }
+
+  public get languageCode(): LanguageCode {
+    return this.props.languageCode;
+  }
+
+  public get status(): AccountStatus {
+    return this.props.status;
+  }
+
+  public get createdAt(): UtcDate {
+    return this.props.createdAt;
+  }
+
+  public get updatedAt(): UtcDate {
+    return this.props.updatedAt;
+  }
+
+  public updateProfile(patch: AccountProfilePatchProps): Result<boolean, Error> {
+    if (this.status.isDisabled()) {
+      return Result.fail(new AccountCannotBeUpdatedError("Disabled accounts cannot be updated."));
+    }
+
+    let hasChanges = false;
+
+    if (patch.name && !this.props.name.equals(patch.name)) {
+      this.props.name = patch.name;
+      hasChanges = true;
+    }
+
+    if (
+      patch.avatarUrl !== undefined &&
+      !Account.sameMaybeValueObject(this.props.avatarUrl, patch.avatarUrl)
+    ) {
+      this.props.avatarUrl = patch.avatarUrl;
+      hasChanges = true;
+    }
+
+    if (patch.languageCode && !this.props.languageCode.equals(patch.languageCode)) {
+      this.props.languageCode = patch.languageCode;
+      hasChanges = true;
+    }
+
+    if (!hasChanges) {
+      return Result.ok(false);
+    }
+
+    this.props.updatedAt = patch.updatedAt;
+    return Result.ok(true);
+  }
+
+  public changePasswordHash(params: {
+    passwordHash: PasswordHash;
+    updatedAt: UtcDate;
+  }): Result<boolean, Error> {
+    if (this.status.isDisabled()) {
+      return Result.fail(new AccountCannotBeUpdatedError("Disabled accounts cannot be updated."));
+    }
+
+    if (this.props.passwordHash.equals(params.passwordHash)) {
+      return Result.ok(false);
+    }
+
+    this.props.passwordHash = params.passwordHash;
+    this.props.updatedAt = params.updatedAt;
+    return Result.ok(true);
+  }
+
+  public disable(updatedAt: UtcDate): Result<boolean, Error> {
+    if (this.status.isDisabled()) {
+      return Result.ok(false);
+    }
+
+    this.props.status = AccountStatus.createDisabled();
+    this.props.updatedAt = updatedAt;
+    return Result.ok(true);
+  }
+
+  public enable(updatedAt: UtcDate): Result<boolean, Error> {
+    if (this.status.isActive()) {
+      return Result.ok(false);
+    }
+
+    this.props.status = AccountStatus.createActive();
+    this.props.updatedAt = updatedAt;
+    return Result.ok(true);
+  }
+
+  public canAuthenticate(): Result<boolean, Error> {
+    if (!this.status.isActive()) {
+      return Result.fail(
+        new AccountCannotAuthenticateError(
+          `Account cannot authenticate while status is "${this.status.toPrimitive()}".`
+        )
+      );
+    }
+
+    return Result.ok(true);
+  }
+
+  private static sameMaybeValueObject<T extends { equals(other: T): boolean }>(
+    current: Maybe<T>,
+    next: Maybe<T>
+  ): boolean {
+    return current.match(
+      (currentValue) =>
+        next.match(
+          (nextValue) => currentValue.equals(nextValue),
+          () => false
+        ),
+      () => next.isNone()
+    );
+  }
+}
diff --git a/modules/identity/src/api/domain/accounts/errors.ts b/modules/identity/src/api/domain/accounts/errors.ts
new file mode 100644
index 00000000..bb5a8b34
--- /dev/null
+++ b/modules/identity/src/api/domain/accounts/errors.ts
@@ -0,0 +1,13 @@
+import { DomainError } from "@repo/rdx-ddd";
+
+export class InvalidPasswordHashError extends DomainError {
+  public readonly code = "IDENTITY_INVALID_PASSWORD_HASH" as const;
+}
+
+export class AccountCannotAuthenticateError extends DomainError {
+  public readonly code = "IDENTITY_ACCOUNT_CANNOT_AUTHENTICATE" as const;
+}
+
+export class AccountCannotBeUpdatedError extends DomainError {
+  public readonly code = "IDENTITY_ACCOUNT_CANNOT_BE_UPDATED" as const;
+}
diff --git a/modules/identity/src/api/domain/accounts/index.ts b/modules/identity/src/api/domain/accounts/index.ts
new file mode 100644
index 00000000..ed0331a1
--- /dev/null
+++ b/modules/identity/src/api/domain/accounts/index.ts
@@ -0,0 +1,4 @@
+export * from "./account.aggregate";
+export * from "./account-status.vo";
+export * from "./errors";
+export * from "./password-hash";
diff --git a/modules/identity/src/api/domain/accounts/password-hash.ts b/modules/identity/src/api/domain/accounts/password-hash.ts
new file mode 100644
index 00000000..6e1387b6
--- /dev/null
+++ b/modules/identity/src/api/domain/accounts/password-hash.ts
@@ -0,0 +1,55 @@
+import { DomainValidationError, ValueObject } from "@repo/rdx-ddd";
+import { Result } from "@repo/rdx-utils";
+
+import { InvalidPasswordHashError } from "./errors";
+
+interface PasswordHashProps {
+  value: string;
+}
+
+export class PasswordHash extends ValueObject<PasswordHashProps> {
+  private static readonly MIN_LENGTH = 20;
+  private static readonly MAX_LENGTH = 512;
+
+  static create(value: string): Result<PasswordHash, Error> {
+    const normalized = value.trim();
+
+    if (!normalized) {
+      return Result.fail(new InvalidPasswordHashError("Password hash is required."));
+    }
+
+    if (normalized.length < PasswordHash.MIN_LENGTH) {
+      return Result.fail(
+        new DomainValidationError(
+          "INVALID_PASSWORD_HASH",
+          "passwordHash",
+          `Password hash must be at least ${PasswordHash.MIN_LENGTH} characters long.`
+        )
+      );
+    }
+
+    if (normalized.length > PasswordHash.MAX_LENGTH) {
+      return Result.fail(
+        new DomainValidationError(
+          "INVALID_PASSWORD_HASH",
+          "passwordHash",
+          `Password hash must be at most ${PasswordHash.MAX_LENGTH} characters long.`
+        )
+      );
+    }
+
+    return Result.ok(new PasswordHash({ value: normalized }));
+  }
+
+  getProps(): string {
+    return this.props.value;
+  }
+
+  toPrimitive(): string {
+    return this.getProps();
+  }
+
+  toString(): string {
+    return String(this.props.value);
+  }
+}
diff --git a/modules/identity/src/api/domain/authentication/errors.ts b/modules/identity/src/api/domain/authentication/errors.ts
new file mode 100644
index 00000000..a5c361df
--- /dev/null
+++ b/modules/identity/src/api/domain/authentication/errors.ts
@@ -0,0 +1,17 @@
+import { DomainError } from "@repo/rdx-ddd";
+
+export class InvalidRefreshTokenHashError extends DomainError {
+  public readonly code = "IDENTITY_INVALID_REFRESH_TOKEN_HASH" as const;
+}
+
+export class RefreshTokenExpiredError extends DomainError {
+  public readonly code = "IDENTITY_REFRESH_TOKEN_EXPIRED" as const;
+}
+
+export class RefreshTokenRevokedError extends DomainError {
+  public readonly code = "IDENTITY_REFRESH_TOKEN_REVOKED" as const;
+}
+
+export class RefreshTokenCannotBeRotatedError extends DomainError {
+  public readonly code = "IDENTITY_REFRESH_TOKEN_CANNOT_BE_ROTATED" as const;
+}
diff --git a/modules/identity/src/api/domain/authentication/index.ts b/modules/identity/src/api/domain/authentication/index.ts
new file mode 100644
index 00000000..93574cec
--- /dev/null
+++ b/modules/identity/src/api/domain/authentication/index.ts
@@ -0,0 +1,3 @@
+export * from "./errors";
+export * from "./refresh-token.aggregate";
+export * from "./refresh-token-hash";
diff --git a/modules/identity/src/api/domain/authentication/refresh-token-hash.ts b/modules/identity/src/api/domain/authentication/refresh-token-hash.ts
new file mode 100644
index 00000000..f307044c
--- /dev/null
+++ b/modules/identity/src/api/domain/authentication/refresh-token-hash.ts
@@ -0,0 +1,55 @@
+import { DomainValidationError, ValueObject } from "@repo/rdx-ddd";
+import { Result } from "@repo/rdx-utils";
+
+import { InvalidRefreshTokenHashError } from "./errors";
+
+interface RefreshTokenHashProps {
+  value: string;
+}
+
+export class RefreshTokenHash extends ValueObject<RefreshTokenHashProps> {
+  private static readonly MIN_LENGTH = 20;
+  private static readonly MAX_LENGTH = 512;
+
+  static create(value: string): Result<RefreshTokenHash, Error> {
+    const normalized = value.trim();
+
+    if (!normalized) {
+      return Result.fail(new InvalidRefreshTokenHashError("Refresh token hash is required."));
+    }
+
+    if (normalized.length < RefreshTokenHash.MIN_LENGTH) {
+      return Result.fail(
+        new DomainValidationError(
+          "INVALID_REFRESH_TOKEN_HASH",
+          "tokenHash",
+          `Refresh token hash must be at least ${RefreshTokenHash.MIN_LENGTH} characters long.`
+        )
+      );
+    }
+
+    if (normalized.length > RefreshTokenHash.MAX_LENGTH) {
+      return Result.fail(
+        new DomainValidationError(
+          "INVALID_REFRESH_TOKEN_HASH",
+          "tokenHash",
+          `Refresh token hash must be at most ${RefreshTokenHash.MAX_LENGTH} characters long.`
+        )
+      );
+    }
+
+    return Result.ok(new RefreshTokenHash({ value: normalized }));
+  }
+
+  getProps(): string {
+    return this.props.value;
+  }
+
+  toPrimitive(): string {
+    return this.getProps();
+  }
+
+  toString(): string {
+    return String(this.props.value);
+  }
+}
diff --git a/modules/identity/src/api/domain/authentication/refresh-token.aggregate.ts b/modules/identity/src/api/domain/authentication/refresh-token.aggregate.ts
new file mode 100644
index 00000000..e5f6e011
--- /dev/null
+++ b/modules/identity/src/api/domain/authentication/refresh-token.aggregate.ts
@@ -0,0 +1,133 @@
+import { AggregateRoot, type UniqueID, type UtcDateTime } from "@repo/rdx-ddd";
+import { Maybe, type Maybe as MaybeType, Result } from "@repo/rdx-utils";
+
+import {
+  RefreshTokenCannotBeRotatedError,
+  RefreshTokenExpiredError,
+  RefreshTokenRevokedError,
+} from "./errors";
+import type { RefreshTokenHash } from "./refresh-token-hash";
+
+export interface IRefreshTokenCreateProps {
+  accountId: UniqueID;
+  tokenHash: RefreshTokenHash;
+  expiresAt: UtcDateTime;
+  revokedAt: MaybeType<UtcDateTime>;
+  replacedByTokenId: MaybeType<UniqueID>;
+  createdAt: UtcDateTime;
+}
+
+export type RefreshTokenInternalProps = IRefreshTokenCreateProps;
+
+export class RefreshToken extends AggregateRoot<RefreshTokenInternalProps> {
+  protected constructor(props: RefreshTokenInternalProps, id?: UniqueID) {
+    super(props, id);
+  }
+
+  static create(props: IRefreshTokenCreateProps, id?: UniqueID): Result<RefreshToken, Error> {
+    const validationResult = RefreshToken.validateCreateProps(props);
+    if (validationResult.isFailure) {
+      return Result.fail(validationResult.error);
+    }
+
+    return Result.ok(new RefreshToken(props, id));
+  }
+
+  static rehydrate(props: RefreshTokenInternalProps, id: UniqueID): RefreshToken {
+    return new RefreshToken(props, id);
+  }
+
+  private static validateCreateProps(props: IRefreshTokenCreateProps): Result<void, Error> {
+    if (!props.accountId) {
+      return Result.fail(new Error("Refresh token account ID is required."));
+    }
+
+    if (!props.tokenHash) {
+      return Result.fail(new Error("Refresh token hash is required."));
+    }
+
+    if (!(props.expiresAt && props.createdAt)) {
+      return Result.fail(new Error("Refresh token timestamps are required."));
+    }
+
+    if (
+      RefreshToken.toEpochMillis(props.expiresAt) <= RefreshToken.toEpochMillis(props.createdAt)
+    ) {
+      return Result.fail(new Error("Refresh token expiration must be later than creation."));
+    }
+
+    return Result.ok();
+  }
+
+  public get accountId(): UniqueID {
+    return this.props.accountId;
+  }
+
+  public get tokenHash(): RefreshTokenHash {
+    return this.props.tokenHash;
+  }
+
+  public get expiresAt(): UtcDateTime {
+    return this.props.expiresAt;
+  }
+
+  public get revokedAt(): Maybe<UtcDateTime> {
+    return this.props.revokedAt;
+  }
+
+  public get replacedByTokenId(): MaybeType<UniqueID> {
+    return this.props.replacedByTokenId;
+  }
+
+  public get createdAt(): UtcDateTime {
+    return this.props.createdAt;
+  }
+
+  public revoke(params: {
+    revokedAt: UtcDateTime;
+    replacedByTokenId?: Maybe<UniqueID>;
+  }): Result<boolean, Error> {
+    if (this.props.revokedAt.isSome()) {
+      return Result.ok(false);
+    }
+
+    this.props.revokedAt = Maybe.some(params.revokedAt);
+    this.props.replacedByTokenId = params.replacedByTokenId ?? Maybe.none<UniqueID>();
+    return Result.ok(true);
+  }
+
+  public rotate(params: {
+    revokedAt: UtcDateTime;
+    replacedByTokenId: UniqueID;
+    now: UtcDateTime;
+  }): Result<boolean, Error> {
+    const usableResult = this.canBeUsed(params.now);
+    if (usableResult.isFailure) {
+      return Result.fail(
+        new RefreshTokenCannotBeRotatedError("Refresh token cannot be rotated.", {
+          cause: usableResult.error,
+        })
+      );
+    }
+
+    this.props.revokedAt = Maybe.some(params.revokedAt);
+    this.props.replacedByTokenId = Maybe.some(params.replacedByTokenId);
+    return Result.ok(true);
+  }
+
+  public canBeUsed(now: UtcDateTime): Result<boolean, Error> {
+    if (this.props.revokedAt.isSome()) {
+      return Result.fail(new RefreshTokenRevokedError("Refresh token has been revoked."));
+    }
+
+    if (RefreshToken.toEpochMillis(this.props.expiresAt) <= RefreshToken.toEpochMillis(now)) {
+      return Result.fail(new RefreshTokenExpiredError("Refresh token has expired."));
+    }
+
+    return Result.ok(true);
+  }
+
+  private static toEpochMillis(value: UtcDateTime): number {
+    return new Date(value.toISOString()).getTime();
+  }
+}
diff --git a/modules/identity/src/api/domain/companies/company-status.vo.ts b/modules/identity/src/api/domain/companies/company-status.vo.ts
new file mode 100644
index 00000000..f9cf90fc
--- /dev/null
+++ b/modules/identity/src/api/domain/companies/company-status.vo.ts
@@ -0,0 +1,53 @@
+import { DomainValidationError, ValueObject } from "@repo/rdx-ddd";
+import { Result } from "@repo/rdx-utils";
+
+interface CompanyStatusProps {
+  value: string;
+}
+
+export enum COMPANY_STATUS {
+  ACTIVE = "active",
+  DISABLED = "disabled",
+}
+
+export class CompanyStatus extends ValueObject<CompanyStatusProps> {
+  private static readonly ALLOWED_STATUSES = [COMPANY_STATUS.ACTIVE, COMPANY_STATUS.DISABLED] as const;
+
+  static create(value: string): Result<CompanyStatus, Error> {
+    if (!CompanyStatus.ALLOWED_STATUSES.includes(value as (typeof CompanyStatus.ALLOWED_STATUSES)[number])) {
+      return Result.fail(
+        new DomainValidationError("INVALID_COMPANY_STATUS", "status", `Status value not valid: ${value}`)
+      );
+    }
+
+    return Result.ok(new CompanyStatus({ value }));
+  }
+
+  static createActive(): CompanyStatus {
+    return new CompanyStatus({ value: COMPANY_STATUS.ACTIVE });
+  }
+
+  static createDisabled(): CompanyStatus {
+    return new CompanyStatus({ value: COMPANY_STATUS.DISABLED });
+  }
+
+  isActive(): boolean {
+    return this.props.value === COMPANY_STATUS.ACTIVE;
+  }
+
+  isDisabled(): boolean {
+    return this.props.value === COMPANY_STATUS.DISABLED;
+  }
+
+  getProps(): string {
+    return this.props.value;
+  }
+
+  toPrimitive(): string {
+    return this.getProps();
+  }
+
+  toString(): string {
+    return String(this.props.value);
+  }
+}
diff --git a/modules/identity/src/api/domain/companies/company.aggregate.ts b/modules/identity/src/api/domain/companies/company.aggregate.ts
new file mode 100644
index 00000000..54c85fa1
--- /dev/null
+++ b/modules/identity/src/api/domain/companies/company.aggregate.ts
@@ -0,0 +1,169 @@
+import {
+  AggregateRoot,
+  type Name,
+  type TextValue,
+  type UniqueID,
+  type UtcDate,
+} from "@repo/rdx-ddd";
+import { type Maybe, Result } from "@repo/rdx-utils";
+
+import { CompanyStatus } from "./company-status.vo";
+import { CompanyCannotBeUpdatedError } from "./errors";
+
+export interface ICompanyCreateProps {
+  ownerAccountId: UniqueID;
+  legalName: Name;
+  tradeName: Maybe<Name>;
+  tin: Maybe<TextValue>;
+  status: CompanyStatus;
+  createdAt: UtcDate;
+  updatedAt: UtcDate;
+}
+
+export type CompanyPatchProps = Partial<{
+  legalName: Name;
+  tradeName: Maybe<Name>;
+  tin: Maybe<TextValue>;
+}> & {
+  updatedAt: UtcDate;
+};
+
+export type CompanyInternalProps = ICompanyCreateProps;
+
+export class Company extends AggregateRoot<CompanyInternalProps> {
+  protected constructor(props: CompanyInternalProps, id?: UniqueID) {
+    super(props, id);
+  }
+
+  static create(props: ICompanyCreateProps, id?: UniqueID): Result<Company, Error> {
+    const validationResult = Company.validateCreateProps(props);
+    if (validationResult.isFailure) {
+      return Result.fail(validationResult.error);
+    }
+
+    return Result.ok(new Company(props, id));
+  }
+
+  static rehydrate(props: CompanyInternalProps, id: UniqueID): Company {
+    return new Company(props, id);
+  }
+
+  private static validateCreateProps(props: ICompanyCreateProps): Result<void, Error> {
+    if (!props.ownerAccountId) {
+      return Result.fail(new Error("Company owner account ID is required."));
+    }
+
+    if (!props.legalName) {
+      return Result.fail(new Error("Company legal name is required."));
+    }
+
+    if (!props.status) {
+      return Result.fail(new Error("Company status is required."));
+    }
+
+    if (!(props.createdAt && props.updatedAt)) {
+      return Result.fail(new Error("Company timestamps are required."));
+    }
+
+    return Result.ok();
+  }
+
+  public get ownerAccountId(): UniqueID {
+    return this.props.ownerAccountId;
+  }
+
+  public get legalName(): Name {
+    return this.props.legalName;
+  }
+
+  public get tradeName(): Maybe<Name> {
+    return this.props.tradeName;
+  }
+
+  public get tin(): Maybe<TextValue> {
+    return this.props.tin;
+  }
+
+  public get status(): CompanyStatus {
+    return this.props.status;
+  }
+
+  public get createdAt(): UtcDate {
+    return this.props.createdAt;
+  }
+
+  public get updatedAt(): UtcDate {
+    return this.props.updatedAt;
+  }
+
+  public update(patch: CompanyPatchProps): Result<boolean, Error> {
+    if (this.status.isDisabled()) {
+      return Result.fail(new CompanyCannotBeUpdatedError("Disabled companies cannot be updated."));
+    }
+
+    let hasChanges = false;
+
+    if (patch.legalName && !this.props.legalName.equals(patch.legalName)) {
+      this.props.legalName = patch.legalName;
+      hasChanges = true;
+    }
+
+    if (
+      patch.tradeName !== undefined &&
+      !Company.sameMaybeValueObject(this.props.tradeName, patch.tradeName)
+    ) {
+      this.props.tradeName = patch.tradeName;
+      hasChanges = true;
+    }
+
+    if (patch.tin !== undefined && !Company.sameMaybeValueObject(this.props.tin, patch.tin)) {
+      this.props.tin = patch.tin;
+      hasChanges = true;
+    }
+
+    if (!hasChanges) {
+      return Result.ok(false);
+    }
+
+    this.props.updatedAt = patch.updatedAt;
+    return Result.ok(true);
+  }
+
+  public disable(updatedAt: UtcDate): Result<boolean, Error> {
+    if (this.status.isDisabled()) {
+      return Result.ok(false);
+    }
+
+    this.props.status = CompanyStatus.createDisabled();
+    this.props.updatedAt = updatedAt;
+    return Result.ok(true);
+  }
+
+  public enable(updatedAt: UtcDate): Result<boolean, Error> {
+    if (this.status.isActive()) {
+      return Result.ok(false);
+    }
+
+    this.props.status = CompanyStatus.createActive();
+    this.props.updatedAt = updatedAt;
+    return Result.ok(true);
+  }
+
+  public isActive(): boolean {
+    return this.status.isActive();
+  }
+
+  private static sameMaybeValueObject<T extends { equals(other: T): boolean }>(
+    current: Maybe<T>,
+    next: Maybe<T>
+  ): boolean {
+    return current.match(
+      (currentValue) =>
+        next.match(
+          (nextValue) => currentValue.equals(nextValue),
+          () => false
+        ),
+      () => next.isNone()
+    );
+  }
+}
diff --git a/modules/identity/src/api/domain/companies/errors.ts b/modules/identity/src/api/domain/companies/errors.ts
new file mode 100644
index 00000000..94ac8dd9
--- /dev/null
+++ b/modules/identity/src/api/domain/companies/errors.ts
@@ -0,0 +1,5 @@
+import { DomainError } from "@repo/rdx-ddd";
+
+export class CompanyCannotBeUpdatedError extends DomainError {
+  public readonly code = "IDENTITY_COMPANY_CANNOT_BE_UPDATED" as const;
+}
diff --git a/modules/identity/src/api/domain/companies/index.ts b/modules/identity/src/api/domain/companies/index.ts
new file mode 100644
index 00000000..0b0889ce
--- /dev/null
+++ b/modules/identity/src/api/domain/companies/index.ts
@@ -0,0 +1,3 @@
+export * from "./company.aggregate";
+export * from "./company-status.vo";
+export * from "./errors";
diff --git a/modules/identity/src/api/domain/company-memberships/company-membership-status.vo.ts b/modules/identity/src/api/domain/company-memberships/company-membership-status.vo.ts
new file mode 100644
index 00000000..7f7b14e0
--- /dev/null
+++ b/modules/identity/src/api/domain/company-memberships/company-membership-status.vo.ts
@@ -0,0 +1,74 @@
+import { DomainValidationError, ValueObject } from "@repo/rdx-ddd";
+import { Result } from "@repo/rdx-utils";
+
+interface CompanyMembershipStatusProps {
+  value: string;
+}
+
+export enum COMPANY_MEMBERSHIP_STATUS {
+  ACTIVE = "active",
+  DISABLED = "disabled",
+  INVITED = "invited",
+}
+
+export class CompanyMembershipStatus extends ValueObject<CompanyMembershipStatusProps> {
+  private static readonly ALLOWED_STATUSES = [
+    COMPANY_MEMBERSHIP_STATUS.ACTIVE,
+    COMPANY_MEMBERSHIP_STATUS.DISABLED,
+    COMPANY_MEMBERSHIP_STATUS.INVITED,
+  ] as const;
+
+  static create(value: string): Result<CompanyMembershipStatus, Error> {
+    if (
+      !CompanyMembershipStatus.ALLOWED_STATUSES.includes(
+        value as (typeof CompanyMembershipStatus.ALLOWED_STATUSES)[number]
+      )
+    ) {
+      return Result.fail(
+        new DomainValidationError(
+          "INVALID_COMPANY_MEMBERSHIP_STATUS",
+          "status",
+          `Status value not valid: ${value}`
+        )
+      );
+    }
+
+    return Result.ok(new CompanyMembershipStatus({ value }));
+  }
+
+  static createActive(): CompanyMembershipStatus {
+    return new CompanyMembershipStatus({ value: COMPANY_MEMBERSHIP_STATUS.ACTIVE });
+  }
+
+  static createDisabled(): CompanyMembershipStatus {
+    return new CompanyMembershipStatus({ value: COMPANY_MEMBERSHIP_STATUS.DISABLED });
+  }
+
+  static createInvited(): CompanyMembershipStatus {
+    return new CompanyMembershipStatus({ value: COMPANY_MEMBERSHIP_STATUS.INVITED });
+  }
+
+  isActive(): boolean {
+    return this.props.value === COMPANY_MEMBERSHIP_STATUS.ACTIVE;
+  }
+
+  isDisabled(): boolean {
+    return this.props.value === COMPANY_MEMBERSHIP_STATUS.DISABLED;
+  }
+
+  isInvited(): boolean {
+    return this.props.value === COMPANY_MEMBERSHIP_STATUS.INVITED;
+  }
+
+  getProps(): string {
+    return this.props.value;
+  }
+
+  toPrimitive(): string {
+    return this.getProps();
+  }
+
+  toString(): string {
+    return String(this.props.value);
+  }
+}
diff --git a/modules/identity/src/api/domain/company-memberships/company-membership.aggregate.ts b/modules/identity/src/api/domain/company-memberships/company-membership.aggregate.ts
new file mode 100644
index 00000000..fdae3d62
--- /dev/null
+++ b/modules/identity/src/api/domain/company-memberships/company-membership.aggregate.ts
@@ -0,0 +1,194 @@
+import { AggregateRoot, type UniqueID, type UtcDate } from "@repo/rdx-ddd";
+import { Result } from "@repo/rdx-utils";
+
+import { CompanyMembershipStatus } from "./company-membership-status.vo";
+import {
+  CompanyMembershipCannotAccessCompanyError,
+  CompanyMembershipDuplicatedRoleError,
+  CompanyMembershipWithoutRolesError,
+} from "./errors";
+
+export interface ICompanyMembershipCreateProps {
+  accountId: UniqueID;
+  companyId: UniqueID;
+  roleIds: UniqueID[];
+  status: CompanyMembershipStatus;
+  createdAt: UtcDate;
+  updatedAt: UtcDate;
+}
+
+export type CompanyMembershipInternalProps = ICompanyMembershipCreateProps;
+
+export class CompanyMembership extends AggregateRoot<CompanyMembershipInternalProps> {
+  protected constructor(props: CompanyMembershipInternalProps, id?: UniqueID) {
+    super(props, id);
+  }
+
+  static create(
+    props: ICompanyMembershipCreateProps,
+    id?: UniqueID
+  ): Result<CompanyMembership, Error> {
+    const validationResult = CompanyMembership.validateState(props.status, props.roleIds);
+    if (validationResult.isFailure) {
+      return Result.fail(validationResult.error);
+    }
+
+    if (!(props.accountId && props.companyId)) {
+      return Result.fail(new Error("Company membership accountId and companyId are required."));
+    }
+
+    if (!(props.createdAt && props.updatedAt)) {
+      return Result.fail(new Error("Company membership timestamps are required."));
+    }
+
+    return Result.ok(new CompanyMembership(props, id));
+  }
+
+  static rehydrate(props: CompanyMembershipInternalProps, id: UniqueID): CompanyMembership {
+    return new CompanyMembership(props, id);
+  }
+
+  public get accountId(): UniqueID {
+    return this.props.accountId;
+  }
+
+  public get companyId(): UniqueID {
+    return this.props.companyId;
+  }
+
+  public get roleIds(): UniqueID[] {
+    return [...this.props.roleIds];
+  }
+
+  public get status(): CompanyMembershipStatus {
+    return this.props.status;
+  }
+
+  public get createdAt(): UtcDate {
+    return this.props.createdAt;
+  }
+
+  public get updatedAt(): UtcDate {
+    return this.props.updatedAt;
+  }
+
+  public replaceRoles(params: { roleIds: UniqueID[]; updatedAt: UtcDate }): Result<boolean, Error> {
+    const validationResult = CompanyMembership.validateRoleIds(params.roleIds);
+    if (validationResult.isFailure) {
+      return Result.fail(validationResult.error);
+    }
+
+    if (CompanyMembership.sameRoleIds(this.props.roleIds, params.roleIds)) {
+      return Result.ok(false);
+    }
+
+    this.props.roleIds = [...params.roleIds];
+    this.props.updatedAt = params.updatedAt;
+    return Result.ok(true);
+  }
+
+  public disable(updatedAt: UtcDate): Result<boolean, Error> {
+    if (this.status.isDisabled()) {
+      return Result.ok(false);
+    }
+
+    this.props.status = CompanyMembershipStatus.createDisabled();
+    this.props.updatedAt = updatedAt;
+    return Result.ok(true);
+  }
+
+  public enable(updatedAt: UtcDate): Result<boolean, Error> {
+    const validationResult = CompanyMembership.validateRoleIds(this.props.roleIds);
+    if (validationResult.isFailure) {
+      return Result.fail(validationResult.error);
+    }
+
+    if (this.status.isActive()) {
+      return Result.ok(false);
+    }
+
+    this.props.status = CompanyMembershipStatus.createActive();
+    this.props.updatedAt = updatedAt;
+    return Result.ok(true);
+  }
+
+  public acceptInvitation(params: {
+    updatedAt: UtcDate;
+    roleIds?: UniqueID[];
+  }): Result<boolean, Error> {
+    const nextRoleIds = params.roleIds ? [...params.roleIds] : [...this.props.roleIds];
+    const validationResult = CompanyMembership.validateRoleIds(nextRoleIds);
+    if (validationResult.isFailure) {
+      return Result.fail(validationResult.error);
+    }
+
+    const sameStatus = this.status.isActive();
+    const sameRoles = CompanyMembership.sameRoleIds(this.props.roleIds, nextRoleIds);
+
+    if (sameStatus && sameRoles) {
+      return Result.ok(false);
+    }
+
+    this.props.roleIds = nextRoleIds;
+    this.props.status = CompanyMembershipStatus.createActive();
+    this.props.updatedAt = params.updatedAt;
+    return Result.ok(true);
+  }
+
+  public canAccessCompany(): Result<boolean, Error> {
+    const validationResult = CompanyMembership.validateState(this.status, this.props.roleIds);
+    if (validationResult.isFailure) {
+      return Result.fail(validationResult.error);
+    }
+
+    if (!this.status.isActive()) {
+      return Result.fail(
+        new CompanyMembershipCannotAccessCompanyError(
+          `Membership cannot access company while status is "${this.status.toPrimitive()}".`
+        )
+      );
+    }
+
+    return Result.ok(true);
+  }
+
+  private static validateState(
+    status: CompanyMembershipStatus,
+    roleIds: UniqueID[]
+  ): Result<void, Error> {
+    const rolesValidation = CompanyMembership.validateRoleIds(roleIds, !status.isActive());
+    if (rolesValidation.isFailure) {
+      return Result.fail(rolesValidation.error);
+    }
+
+    return Result.ok();
+  }
+
+  private static validateRoleIds(roleIds: UniqueID[], allowEmpty = false): Result<void, Error> {
+    if (!allowEmpty && (!roleIds || roleIds.length === 0)) {
+      return Result.fail(
+        new CompanyMembershipWithoutRolesError("Active memberships must have at least one role.")
+      );
+    }
+
+    const uniqueCount = new Set((roleIds ?? []).map((roleId) => roleId.toPrimitive())).size;
+    if ((roleIds ?? []).length !== uniqueCount) {
+      return Result.fail(
+        new CompanyMembershipDuplicatedRoleError("Membership role IDs cannot contain duplicates.")
+      );
+    }
+
+    return Result.ok();
+  }
+
+  private static sameRoleIds(current: UniqueID[], next: UniqueID[]): boolean {
+    if (current.length !== next.length) {
+      return false;
+    }
+
+    const currentValues = current.map((roleId) => roleId.toPrimitive()).sort();
+    const nextValues = next.map((roleId) => roleId.toPrimitive()).sort();
+
+    return currentValues.every((value, index) => value === nextValues[index]);
+  }
+}
diff --git a/modules/identity/src/api/domain/company-memberships/errors.ts b/modules/identity/src/api/domain/company-memberships/errors.ts
new file mode 100644
index 00000000..4c350322
--- /dev/null
+++ b/modules/identity/src/api/domain/company-memberships/errors.ts
@@ -0,0 +1,13 @@
+import { DomainError } from "@repo/rdx-ddd";
+
+export class CompanyMembershipWithoutRolesError extends DomainError {
+  public readonly code = "IDENTITY_COMPANY_MEMBERSHIP_WITHOUT_ROLES" as const;
+}
+
+export class CompanyMembershipDuplicatedRoleError extends DomainError {
+  public readonly code = "IDENTITY_COMPANY_MEMBERSHIP_DUPLICATED_ROLE" as const;
+}
+
+export class CompanyMembershipCannotAccessCompanyError extends DomainError {
+  public readonly code = "IDENTITY_COMPANY_MEMBERSHIP_CANNOT_ACCESS_COMPANY" as const;
+}
diff --git a/modules/identity/src/api/domain/company-memberships/index.ts b/modules/identity/src/api/domain/company-memberships/index.ts
new file mode 100644
index 00000000..0d41569b
--- /dev/null
+++ b/modules/identity/src/api/domain/company-memberships/index.ts
@@ -0,0 +1,3 @@
+export * from "./company-membership.aggregate";
+export * from "./company-membership-status.vo";
+export * from "./errors";
diff --git a/modules/identity/src/api/domain/index.ts b/modules/identity/src/api/domain/index.ts
new file mode 100644
index 00000000..2e4581d5
--- /dev/null
+++ b/modules/identity/src/api/domain/index.ts
@@ -0,0 +1,5 @@
+export * from "./accounts";
+export * from "./authentication";
+export * from "./companies";
+export * from "./company-memberships";
+export * from "./roles";
diff --git a/modules/identity/src/api/domain/roles/errors.ts b/modules/identity/src/api/domain/roles/errors.ts
new file mode 100644
index 00000000..00fd7e2f
--- /dev/null
+++ b/modules/identity/src/api/domain/roles/errors.ts
@@ -0,0 +1,25 @@
+import { DomainError } from "@repo/rdx-ddd";
+
+export class InvalidRoleCodeError extends DomainError {
+  public readonly code = "IDENTITY_INVALID_ROLE_CODE" as const;
+}
+
+export class InvalidPermissionCodeError extends DomainError {
+  public readonly code = "IDENTITY_INVALID_PERMISSION_CODE" as const;
+}
+
+export class RoleWithoutPermissionsError extends DomainError {
+  public readonly code = "IDENTITY_ROLE_WITHOUT_PERMISSIONS" as const;
+}
+
+export class RoleDuplicatedPermissionError extends DomainError {
+  public readonly code = "IDENTITY_ROLE_DUPLICATED_PERMISSION" as const;
+}
+
+export class RoleCannotBeUpdatedError extends DomainError {
+  public readonly code = "IDENTITY_ROLE_CANNOT_BE_UPDATED" as const;
+}
+
+export class RoleCannotBeDeletedError extends DomainError {
+  public readonly code = "IDENTITY_ROLE_CANNOT_BE_DELETED" as const;
+}
diff --git a/modules/identity/src/api/domain/roles/index.ts b/modules/identity/src/api/domain/roles/index.ts
new file mode 100644
index 00000000..e97618eb
--- /dev/null
+++ b/modules/identity/src/api/domain/roles/index.ts
@@ -0,0 +1,3 @@
+export * from "./errors";
+export * from "./role.aggregate";
+export * from "./role-code";
diff --git a/modules/identity/src/api/domain/roles/role-code.ts b/modules/identity/src/api/domain/roles/role-code.ts
new file mode 100644
index 00000000..0487694c
--- /dev/null
+++ b/modules/identity/src/api/domain/roles/role-code.ts
@@ -0,0 +1,53 @@
+import { ValueObject, translateZodValidationError } from "@repo/rdx-ddd";
+import { Result } from "@repo/rdx-utils";
+import { z } from "zod/v4";
+
+import { InvalidRoleCodeError } from "./errors";
+
+interface RoleCodeProps {
+  value: string;
+}
+
+export class RoleCode extends ValueObject<RoleCodeProps> {
+  private static readonly MIN_LENGTH = 2;
+  private static readonly MAX_LENGTH = 100;
+
+  static create(value: string): Result<RoleCode, Error> {
+    const normalized = value.trim();
+    if (!normalized) {
+      return Result.fail(new InvalidRoleCodeError("Role code is required."));
+    }
+
+    const schema = z
+      .string()
+      .trim()
+      .regex(/^[a-z0-9-]+$/, {
+        message: "Role code must contain only lowercase letters, numbers, and hyphens.",
+      })
+      .min(RoleCode.MIN_LENGTH, {
+        message: `Role code must be at least ${RoleCode.MIN_LENGTH} characters long.`,
+      })
+      .max(RoleCode.MAX_LENGTH, {
+        message: `Role code must be at most ${RoleCode.MAX_LENGTH} characters long.`,
+      });
+
+    const result = schema.safeParse(normalized);
+    if (!result.success) {
+      return Result.fail(translateZodValidationError("RoleCode creation failed", result.error));
+    }
+
+    return Result.ok(new RoleCode({ value: result.data }));
+  }
+
+  getProps(): string {
+    return this.props.value;
+  }
+
+  toPrimitive(): string {
+    return this.getProps();
+  }
+
+  toString(): string {
+    return String(this.props.value);
+  }
+}
diff --git a/modules/identity/src/api/domain/roles/role.aggregate.ts b/modules/identity/src/api/domain/roles/role.aggregate.ts
new file mode 100644
index 00000000..7a09af6b
--- /dev/null
+++ b/modules/identity/src/api/domain/roles/role.aggregate.ts
@@ -0,0 +1,210 @@
+import type { PermissionCode } from "@erp/core";
+import { AggregateRoot, type Name, type UniqueID, type UtcDate } from "@repo/rdx-ddd";
+import { Result } from "@repo/rdx-utils";
+
+import {
+  InvalidPermissionCodeError,
+  RoleCannotBeDeletedError,
+  RoleCannotBeUpdatedError,
+  RoleDuplicatedPermissionError,
+  RoleWithoutPermissionsError,
+} from "./errors";
+import type { RoleCode } from "./role-code";
+
+export interface IRoleCreateProps {
+  companyId: UniqueID;
+  code: RoleCode;
+  name: Name;
+  permissionCodes: PermissionCode[];
+  isSystem: boolean;
+  createdAt: UtcDate;
+  updatedAt: UtcDate;
+}
+
+export type RolePatchProps = Partial<{
+  name: Name;
+  permissionCodes: PermissionCode[];
+}> & {
+  updatedAt: UtcDate;
+};
+
+export type RoleInternalProps = IRoleCreateProps;
+
+export class Role extends AggregateRoot<RoleInternalProps> {
+  protected constructor(props: RoleInternalProps, id?: UniqueID) {
+    super(props, id);
+  }
+
+  static create(props: IRoleCreateProps, id?: UniqueID): Result<Role, Error> {
+    const validationResult = Role.validateCreateProps(props);
+    if (validationResult.isFailure) {
+      return Result.fail(validationResult.error);
+    }
+
+    return Result.ok(new Role({ ...props, permissionCodes: [...props.permissionCodes] }, id));
+  }
+
+  static rehydrate(props: RoleInternalProps, id: UniqueID): Role {
+    return new Role({ ...props, permissionCodes: [...props.permissionCodes] }, id);
+  }
+
+  private static validateCreateProps(props: IRoleCreateProps): Result<void, Error> {
+    if (!props.companyId) {
+      return Result.fail(new Error("Role company ID is required."));
+    }
+
+    if (!props.code) {
+      return Result.fail(new Error("Role code is required."));
+    }
+
+    if (!props.name) {
+      return Result.fail(new Error("Role name is required."));
+    }
+
+    return Role.validatePermissionCodes(props.permissionCodes);
+  }
+
+  private static validatePermissionCodes(permissionCodes: PermissionCode[]): Result<void, Error> {
+    if (!permissionCodes || permissionCodes.length === 0) {
+      return Result.fail(
+        new RoleWithoutPermissionsError("Roles must contain at least one permission code.")
+      );
+    }
+
+    const uniqueCount = new Set(permissionCodes).size;
+    if (uniqueCount !== permissionCodes.length) {
+      return Result.fail(
+        new RoleDuplicatedPermissionError("Role permission codes cannot contain duplicates.")
+      );
+    }
+
+    for (const permissionCode of permissionCodes) {
+      if (!Role.isValidPermissionCode(permissionCode)) {
+        return Result.fail(
+          new InvalidPermissionCodeError(`Invalid permission code: "${permissionCode}".`)
+        );
+      }
+    }
+
+    return Result.ok();
+  }
+
+  private static isValidPermissionCode(permissionCode: PermissionCode): boolean {
+    return /^[a-z0-9]+(?::[a-z0-9-]+)+$/.test(permissionCode);
+  }
+
+  public get companyId(): UniqueID {
+    return this.props.companyId;
+  }
+
+  public get code(): RoleCode {
+    return this.props.code;
+  }
+
+  public get name(): Name {
+    return this.props.name;
+  }
+
+  public get permissionCodes(): PermissionCode[] {
+    return [...this.props.permissionCodes];
+  }
+
+  public get isSystem(): boolean {
+    return this.props.isSystem;
+  }
+
+  public get createdAt(): UtcDate {
+    return this.props.createdAt;
+  }
+
+  public get updatedAt(): UtcDate {
+    return this.props.updatedAt;
+  }
+
+  public update(patch: RolePatchProps): Result<boolean, Error> {
+    const canUpdate = this.assertCanBeUpdated();
+    if (canUpdate.isFailure) {
+      return Result.fail(canUpdate.error);
+    }
+
+    let hasChanges = false;
+
+    if (patch.name && !this.props.name.equals(patch.name)) {
+      this.props.name = patch.name;
+      hasChanges = true;
+    }
+
+    if (patch.permissionCodes !== undefined) {
+      const replaceResult = this.replacePermissions({
+        permissionCodes: patch.permissionCodes,
+        updatedAt: patch.updatedAt,
+      });
+      if (replaceResult.isFailure) {
+        return Result.fail(replaceResult.error);
+      }
+      if (replaceResult.data) {
+        hasChanges = true;
+      }
+    }
+
+    if (!hasChanges) {
+      return Result.ok(false);
+    }
+
+    if (patch.permissionCodes === undefined) {
+      this.props.updatedAt = patch.updatedAt;
+    }
+
+    return Result.ok(true);
+  }
+
+  public replacePermissions(params: {
+    permissionCodes: PermissionCode[];
+    updatedAt: UtcDate;
+  }): Result<boolean, Error> {
+    const canUpdate = this.assertCanBeUpdated();
+    if (canUpdate.isFailure) {
+      return Result.fail(canUpdate.error);
+    }
+
+    const validationResult = Role.validatePermissionCodes(params.permissionCodes);
+    if (validationResult.isFailure) {
+      return Result.fail(validationResult.error);
+    }
+
+    if (Role.samePermissionCodes(this.props.permissionCodes, params.permissionCodes)) {
+      return Result.ok(false);
+    }
+
+    this.props.permissionCodes = [...params.permissionCodes];
+    this.props.updatedAt = params.updatedAt;
+    return Result.ok(true);
+  }
+
+  public assertCanBeUpdated(): Result<void, Error> {
+    if (this.isSystem) {
+      return Result.fail(new RoleCannotBeUpdatedError("System roles cannot be updated."));
+    }
+
+    return Result.ok();
+  }
+
+  public assertCanBeDeleted(): Result<void, Error> {
+    if (this.isSystem) {
+      return Result.fail(new RoleCannotBeDeletedError("System roles cannot be deleted."));
+    }
+
+    return Result.ok();
+  }
+
+  private static samePermissionCodes(current: PermissionCode[], next: PermissionCode[]): boolean {
+    if (current.length !== next.length) {
+      return false;
+    }
+
+    const currentValues = [...current].sort();
+    const nextValues = [...next].sort();
+
+    return currentValues.every((value, index) => value === nextValues[index]);
+  }
+}
diff --git a/modules/identity/src/api/index.ts b/modules/identity/src/api/index.ts
new file mode 100644
index 00000000..5bccaf84
--- /dev/null
+++ b/modules/identity/src/api/index.ts
@@ -0,0 +1,62 @@
+import type { IModuleServer } from "@erp/core/api";
+
+export * from "./application";
+export * from "./domain";
+export * from "./infrastructure";
+
+import { identityAuthRouter, models } from "./infrastructure";
+import { buildIdentityDependencies } from "./infrastructure/di";
+
+export * from "./infrastructure/persistence/sequelize";
+
+export const identityAPIModule: IModuleServer = {
+  name: "identity",
+  version: "1.0.0",
+  dependencies: [],
+
+  /**
+   * Fase de SETUP
+   * ----------------
+   * - Construye el dominio (una sola vez)
+   * - Define qué expone el módulo
+   * - NO conecta infraestructura
+   */
+  async setup(params) {
+    const { env: ENV, app, database, baseRoutePath: API_BASE_PATH, logger } = params;
+
+    // 1) Dominio interno
+    const internal = buildIdentityDependencies(params);
+
+    // 2) Servicios públicos (Application Services)
+    const identityServices = {};
+    //const identityServices: IIdentityPublicServices = {}; //buildIdentityPublicServices(params, internal);
+
+    logger.info("🚀 Identity module dependencies registered", {
+      label: this.name,
+    });
+
+    return {
+      // Modelos Sequelize del módulo
+      models,
+
+      // Servicios expuestos a otros módulos
+      services: {
+        general: identityServices, // 'identity:general'
+      },
+
+      // Implementación privada del módulo
+      internal,
+    };
+
+    /*return {
+      models,
+      internal: buildIdentityDependencies(params),
+    };*/
+  },
+
+  async start(params) {
+    identityAuthRouter(params);
+  },
+};
+
+export default identityAPIModule;
diff --git a/modules/identity/src/api/infrastructure/di/identity.di.ts b/modules/identity/src/api/infrastructure/di/identity.di.ts
new file mode 100644
index 00000000..f5881cf2
--- /dev/null
+++ b/modules/identity/src/api/infrastructure/di/identity.di.ts
@@ -0,0 +1,114 @@
+import { type ModuleParams, buildTransactionManager } from "@erp/core/api";
+
+import {
+  AccountAuthenticator,
+  type GetCurrentSessionUseCase,
+  GetCurrentSessionUseCase as GetCurrentSessionUseCaseImpl,
+  type LoginWithPasswordUseCase,
+  LoginWithPasswordUseCase as LoginWithPasswordUseCaseImpl,
+  type LogoutUseCase,
+  LogoutUseCase as LogoutUseCaseImpl,
+  type RefreshSessionUseCase,
+  RefreshSessionUseCase as RefreshSessionUseCaseImpl,
+  SessionIssuer,
+} from "../../application/authentication";
+import { identityAuthenticateRequest } from "../express/middlewares";
+import {
+  SequelizeAccountDomainMapper,
+  SequelizeAccountRepository,
+  SequelizeRefreshTokenDomainMapper,
+  SequelizeRefreshTokenRepository,
+} from "../persistence";
+import {
+  BcryptPasswordHasher,
+  CryptoRefreshTokenGenerator,
+  JsonWebTokenAccessTokenIssuer,
+  JsonWebTokenAccessTokenVerifier,
+  Sha256RefreshTokenHasher,
+} from "../security";
+
+export type IdentityInternalDeps = {
+  auth: {
+    refreshTokenExpiration: string;
+    authenticateRequest: ReturnType<typeof identityAuthenticateRequest>;
+    useCases: {
+      loginWithPassword: () => LoginWithPasswordUseCase;
+      refreshSession: () => RefreshSessionUseCase;
+      logout: () => LogoutUseCase;
+      getCurrentSession: () => GetCurrentSessionUseCase;
+    };
+  };
+};
+
+export const buildIdentityDependencies = (params: ModuleParams): IdentityInternalDeps => {
+  const { database, config } = params;
+
+  const transactionManager = buildTransactionManager(database);
+
+  const accountRepository = new SequelizeAccountRepository(
+    new SequelizeAccountDomainMapper(),
+    database
+  );
+  const refreshTokenRepository = new SequelizeRefreshTokenRepository(
+    new SequelizeRefreshTokenDomainMapper(),
+    database
+  );
+
+  const passwordHasher = new BcryptPasswordHasher({ rounds: 10 });
+  const accessTokenIssuer = new JsonWebTokenAccessTokenIssuer({
+    secret: config.auth.jwt.secret,
+    expiresIn: config.auth.jwt.accessExpiration,
+  });
+  const accessTokenVerifier = new JsonWebTokenAccessTokenVerifier({
+    secret: config.auth.jwt.secret,
+  });
+  const refreshTokenGenerator = new CryptoRefreshTokenGenerator({ sizeInBytes: 32 });
+  const refreshTokenHasher = new Sha256RefreshTokenHasher();
+
+  const accountAuthenticator = new AccountAuthenticator({
+    accountRepository,
+    passwordHasher,
+  });
+  const sessionIssuer = new SessionIssuer({
+    accessTokenIssuer,
+    refreshTokenGenerator,
+    refreshTokenHasher,
+    refreshTokenRepository,
+  });
+
+  return {
+    auth: {
+      refreshTokenExpiration: config.auth.jwt.refreshExpiration,
+      authenticateRequest: identityAuthenticateRequest({
+        accessTokenVerifier,
+        accountRepository,
+      }),
+      useCases: {
+        loginWithPassword: () =>
+          new LoginWithPasswordUseCaseImpl({
+            accountAuthenticator,
+            sessionIssuer,
+            transactionManager,
+          }),
+        refreshSession: () =>
+          new RefreshSessionUseCaseImpl({
+            refreshTokenHasher,
+            refreshTokenRepository,
+            accountRepository,
+            sessionIssuer,
+            transactionManager,
+          }),
+        logout: () =>
+          new LogoutUseCaseImpl({
+            refreshTokenHasher,
+            refreshTokenRepository,
+            transactionManager,
+          }),
+        getCurrentSession: () =>
+          new GetCurrentSessionUseCaseImpl({
+            accountRepository,
+          }),
+      },
+    },
+  };
+};
diff --git a/modules/identity/src/api/infrastructure/di/index.ts b/modules/identity/src/api/infrastructure/di/index.ts
new file mode 100644
index 00000000..28482fa9
--- /dev/null
+++ b/modules/identity/src/api/infrastructure/di/index.ts
@@ -0,0 +1 @@
+export * from "./identity.di";
diff --git a/modules/identity/src/api/infrastructure/express/controllers/get-current-session.controller.ts b/modules/identity/src/api/infrastructure/express/controllers/get-current-session.controller.ts
new file mode 100644
index 00000000..5ebc79cc
--- /dev/null
+++ b/modules/identity/src/api/infrastructure/express/controllers/get-current-session.controller.ts
@@ -0,0 +1,38 @@
+import { ExpressController, requireAuthenticatedGuard } from "@erp/core/api";
+
+import type { CurrentSessionResponseDTO } from "../../../../common";
+import type { GetCurrentSessionUseCase } from "../../../application";
+import { identityAuthApiErrorMapper } from "../identity-auth-api-error-mapper";
+
+export class GetCurrentSessionController extends ExpressController {
+  public constructor(private readonly useCase: GetCurrentSessionUseCase) {
+    super();
+    this.errorMapper = identityAuthApiErrorMapper;
+    this.registerGuards(requireAuthenticatedGuard());
+  }
+
+  protected async executeImpl() {
+    const user = this.getUser();
+    if (!user?.userId) {
+      return this.unauthorizedError("Unauthorized");
+    }
+
+    const result = await this.useCase.execute({
+      accountId: user.userId,
+    });
+
+    return result.match(
+      (data) =>
+        this.ok<CurrentSessionResponseDTO>({
+          account: {
+            id: data.account.id,
+            email: data.account.email,
+            name: data.account.name,
+            avatar_url: data.account.avatarUrl,
+            language_code: data.account.languageCode,
+          },
+        }),
+      (err) => this.handleError(err)
+    );
+  }
+}
diff --git a/modules/identity/src/api/infrastructure/express/controllers/index.ts b/modules/identity/src/api/infrastructure/express/controllers/index.ts
new file mode 100644
index 00000000..5f03061c
--- /dev/null
+++ b/modules/identity/src/api/infrastructure/express/controllers/index.ts
@@ -0,0 +1,4 @@
+export * from "./get-current-session.controller";
+export * from "./login-with-password.controller";
+export * from "./logout.controller";
+export * from "./refresh-session.controller";
diff --git a/modules/identity/src/api/infrastructure/express/controllers/login-with-password.controller.ts b/modules/identity/src/api/infrastructure/express/controllers/login-with-password.controller.ts
new file mode 100644
index 00000000..5f5b15c4
--- /dev/null
+++ b/modules/identity/src/api/infrastructure/express/controllers/login-with-password.controller.ts
@@ -0,0 +1,52 @@
+import { ExpressController } from "@erp/core/api";
+import type { UtcDateTime } from "@repo/rdx-ddd";
+import type { Result } from "@repo/rdx-utils";
+
+import type { LoginWithPasswordRequestDTO, LoginWithPasswordResponseDTO } from "../../../../common";
+import type { LoginWithPasswordUseCase } from "../../../application";
+import { identityAuthApiErrorMapper } from "../identity-auth-api-error-mapper";
+
+export class LoginWithPasswordController extends ExpressController {
+  public constructor(
+    private readonly useCase: LoginWithPasswordUseCase,
+    private readonly nowFactory: () => UtcDateTime,
+    private readonly refreshTokenExpirationFactory: (now: UtcDateTime) => Result<UtcDateTime, Error>
+  ) {
+    super();
+    this.errorMapper = identityAuthApiErrorMapper;
+  }
+
+  protected async executeImpl() {
+    const dto = this.req.body as LoginWithPasswordRequestDTO;
+
+    const now = this.nowFactory();
+
+    const refreshTokenExpiresAtResult = this.refreshTokenExpirationFactory(now);
+    if (refreshTokenExpiresAtResult.isFailure) {
+      return this.handleError(refreshTokenExpiresAtResult.error);
+    }
+
+    const result = await this.useCase.execute({
+      email: dto.email,
+      password: dto.password,
+      now,
+      refreshTokenExpiresAt: refreshTokenExpiresAtResult.data,
+    });
+
+    return result.match(
+      (data) =>
+        this.ok<LoginWithPasswordResponseDTO>({
+          access_token: data.accessToken,
+          refresh_token: data.refreshToken,
+          account: {
+            id: data.account.id,
+            email: data.account.email,
+            name: data.account.name,
+            avatar_url: data.account.avatarUrl,
+            language_code: data.account.languageCode,
+          },
+        }),
+      (err) => this.handleError(err)
+    );
+  }
+}
diff --git a/modules/identity/src/api/infrastructure/express/controllers/logout.controller.ts b/modules/identity/src/api/infrastructure/express/controllers/logout.controller.ts
new file mode 100644
index 00000000..15f7a8fe
--- /dev/null
+++ b/modules/identity/src/api/infrastructure/express/controllers/logout.controller.ts
@@ -0,0 +1,43 @@
+import { ExpressController, requireAuthenticatedGuard } from "@erp/core/api";
+import type { UtcDateTime } from "@repo/rdx-ddd";
+
+import type { LogoutRequestDTO, LogoutResponseDTO } from "../../../../common";
+import type { LogoutUseCase } from "../../../application";
+import { identityAuthApiErrorMapper } from "../identity-auth-api-error-mapper";
+
+export class LogoutController extends ExpressController {
+  public constructor(
+    private readonly useCase: LogoutUseCase,
+    private readonly nowFactory: () => UtcDateTime
+  ) {
+    super();
+    this.errorMapper = identityAuthApiErrorMapper;
+    this.registerGuards(requireAuthenticatedGuard());
+  }
+
+  protected async executeImpl() {
+    const user = this.getUser();
+    if (!user?.userId) {
+      return this.unauthorizedError("Unauthorized");
+    }
+
+    const dto = this.req.body as LogoutRequestDTO;
+
+    const now = this.nowFactory();
+
+    const result = await this.useCase.execute({
+      accountId: user.userId,
+      refreshToken: dto.refresh_token,
+      allSessions: dto.all_sessions,
+      now,
+    });
+
+    return result.match(
+      () =>
+        this.ok<LogoutResponseDTO>({
+          success: true,
+        }),
+      (err) => this.handleError(err)
+    );
+  }
+}
diff --git a/modules/identity/src/api/infrastructure/express/controllers/refresh-session.controller.ts b/modules/identity/src/api/infrastructure/express/controllers/refresh-session.controller.ts
new file mode 100644
index 00000000..4ad44511
--- /dev/null
+++ b/modules/identity/src/api/infrastructure/express/controllers/refresh-session.controller.ts
@@ -0,0 +1,44 @@
+import { ExpressController } from "@erp/core/api";
+import type { UtcDateTime } from "@repo/rdx-ddd";
+import type { Result } from "@repo/rdx-utils";
+
+import type { RefreshSessionRequestDTO, RefreshSessionResponseDTO } from "../../../../common";
+import type { RefreshSessionUseCase } from "../../../application";
+import { identityAuthApiErrorMapper } from "../identity-auth-api-error-mapper";
+
+export class RefreshSessionController extends ExpressController {
+  public constructor(
+    private readonly useCase: RefreshSessionUseCase,
+    private readonly nowFactory: () => UtcDateTime,
+    private readonly refreshTokenExpirationFactory: (now: UtcDateTime) => Result<UtcDateTime, Error>
+  ) {
+    super();
+    this.errorMapper = identityAuthApiErrorMapper;
+  }
+
+  protected async executeImpl() {
+    const dto = this.req.body as RefreshSessionRequestDTO;
+
+    const now = this.nowFactory();
+
+    const refreshTokenExpiresAtResult = this.refreshTokenExpirationFactory(now);
+    if (refreshTokenExpiresAtResult.isFailure) {
+      return this.handleError(refreshTokenExpiresAtResult.error);
+    }
+
+    const result = await this.useCase.execute({
+      refreshToken: dto.refresh_token,
+      now,
+      refreshTokenExpiresAt: refreshTokenExpiresAtResult.data,
+    });
+
+    return result.match(
+      (data) =>
+        this.ok<RefreshSessionResponseDTO>({
+          access_token: data.accessToken,
+          refresh_token: data.refreshToken,
+        }),
+      (err) => this.handleError(err)
+    );
+  }
+}
diff --git a/modules/identity/src/api/infrastructure/express/identity-auth-api-error-mapper.ts b/modules/identity/src/api/infrastructure/express/identity-auth-api-error-mapper.ts
new file mode 100644
index 00000000..7ec64316
--- /dev/null
+++ b/modules/identity/src/api/infrastructure/express/identity-auth-api-error-mapper.ts
@@ -0,0 +1,50 @@
+import {
+  ApiErrorMapper,
+  type ErrorToApiRule,
+  ForbiddenApiError,
+  UnauthorizedApiError,
+  ValidationApiError,
+} from "@erp/core/api";
+
+import {
+  AccountDisabledError,
+  AccountNotFoundError,
+  InvalidCredentialsError,
+  LogoutRequiresRefreshTokenError,
+  RefreshTokenAccountMismatchError,
+  RefreshTokenNotFoundError,
+} from "../../application";
+import {
+  RefreshTokenExpiredError,
+  RefreshTokenRevokedError,
+} from "../../domain";
+
+const invalidCredentialsRule: ErrorToApiRule = {
+  priority: 120,
+  matches: (error) =>
+    error instanceof AccountNotFoundError ||
+    error instanceof InvalidCredentialsError ||
+    error instanceof AccountDisabledError ||
+    error instanceof RefreshTokenNotFoundError ||
+    error instanceof RefreshTokenExpiredError ||
+    error instanceof RefreshTokenRevokedError,
+  build: (error) => new UnauthorizedApiError((error as Error).message || "Unauthorized"),
+};
+
+const refreshTokenAccountMismatchRule: ErrorToApiRule = {
+  priority: 110,
+  matches: (error) => error instanceof RefreshTokenAccountMismatchError,
+  build: (error) =>
+    new ForbiddenApiError((error as Error).message || "Refresh token does not belong to account"),
+};
+
+const logoutValidationRule: ErrorToApiRule = {
+  priority: 110,
+  matches: (error) => error instanceof LogoutRequiresRefreshTokenError,
+  build: (error) => new ValidationApiError((error as Error).message),
+};
+
+export const identityAuthApiErrorMapper = ApiErrorMapper.default()
+  .register(logoutValidationRule)
+  .register(refreshTokenAccountMismatchRule)
+  .register(invalidCredentialsRule);
diff --git a/modules/identity/src/api/infrastructure/express/identity-auth.routes.ts b/modules/identity/src/api/infrastructure/express/identity-auth.routes.ts
new file mode 100644
index 00000000..56b5bfd8
--- /dev/null
+++ b/modules/identity/src/api/infrastructure/express/identity-auth.routes.ts
@@ -0,0 +1,75 @@
+import { type StartParams, validateRequest } from "@erp/core/api";
+import { type NextFunction, type Request, type Response, Router } from "express";
+
+import {
+  LoginWithPasswordRequestSchema,
+  LogoutRequestSchema,
+  RefreshSessionRequestSchema,
+} from "../../../common";
+import type { IdentityInternalDeps } from "../di";
+
+import {
+  GetCurrentSessionController,
+  LoginWithPasswordController,
+  LogoutController,
+  RefreshSessionController,
+} from "./controllers";
+import { buildRefreshTokenExpiresAt, buildUtcNow } from "./utils";
+
+export const identityAuthRouter = (params: StartParams) => {
+  const { app, config, getInternal } = params;
+
+  // Recuperamos el dominio interno del módulo
+  const deps = getInternal<IdentityInternalDeps>("identity").auth;
+
+  const router = Router({ mergeParams: true });
+
+  // ----------------------------------------------
+
+  router.post(
+    "/login",
+    validateRequest(LoginWithPasswordRequestSchema, "body"),
+    (req: Request, res: Response, next: NextFunction) => {
+      const controller = new LoginWithPasswordController(
+        deps.useCases.loginWithPassword(),
+        () => buildUtcNow(),
+        (now) => buildRefreshTokenExpiresAt(now, deps.refreshTokenExpiration)
+      );
+      return controller.execute(req, res, next);
+    }
+  );
+
+  router.post(
+    "/refresh",
+    validateRequest(RefreshSessionRequestSchema, "body"),
+    (req: Request, res: Response, next: NextFunction) => {
+      const controller = new RefreshSessionController(
+        deps.useCases.refreshSession(),
+        () => buildUtcNow(),
+        (now) => buildRefreshTokenExpiresAt(now, deps.refreshTokenExpiration)
+      );
+      return controller.execute(req, res, next);
+    }
+  );
+
+  router.post(
+    "/logout",
+    deps.authenticateRequest,
+    validateRequest(LogoutRequestSchema, "body"),
+    (req: Request, res: Response, next: NextFunction) => {
+      const controller = new LogoutController(deps.useCases.logout(), () => buildUtcNow());
+      return controller.execute(req, res, next);
+    }
+  );
+
+  router.get(
+    "/session",
+    deps.authenticateRequest,
+    (req: Request, res: Response, next: NextFunction) => {
+      const controller = new GetCurrentSessionController(deps.useCases.getCurrentSession());
+      return controller.execute(req, res, next);
+    }
+  );
+
+  app.use(`${config.server.apiBasePath}/identity/auth`, router);
+};
diff --git a/modules/identity/src/api/infrastructure/express/index.ts b/modules/identity/src/api/infrastructure/express/index.ts
new file mode 100644
index 00000000..99dc45c1
--- /dev/null
+++ b/modules/identity/src/api/infrastructure/express/index.ts
@@ -0,0 +1,5 @@
+export * from "./controllers";
+export * from "./identity-auth.routes";
+export * from "./identity-auth-api-error-mapper";
+export * from "./middlewares";
+export * from "./utils";
diff --git a/modules/identity/src/api/infrastructure/express/middlewares/identity-authenticate-request.ts b/modules/identity/src/api/infrastructure/express/middlewares/identity-authenticate-request.ts
new file mode 100644
index 00000000..f03f23bc
--- /dev/null
+++ b/modules/identity/src/api/infrastructure/express/middlewares/identity-authenticate-request.ts
@@ -0,0 +1,69 @@
+import { ExpressController, type RequestWithAuth, UnauthorizedApiError } from "@erp/core/api";
+import { EmailAddress, UniqueID } from "@repo/rdx-ddd";
+import type { NextFunction, Request, Response } from "express";
+
+import type { IAccessTokenVerifier, IAccountRepository } from "../../../application";
+
+function parseBearerToken(authorization?: string): string | undefined {
+  if (!authorization) {
+    return undefined;
+  }
+
+  const [scheme, token] = authorization.split(" ");
+  if (scheme?.toLowerCase() !== "bearer") {
+    return undefined;
+  }
+
+  return token?.trim() || undefined;
+}
+
+export function identityAuthenticateRequest(params: {
+  accessTokenVerifier: IAccessTokenVerifier;
+  accountRepository: IAccountRepository;
+}) {
+  return async (req: Request, res: Response, next: NextFunction) => {
+    try {
+      const authorization = req.get("authorization");
+      const token = parseBearerToken(authorization);
+
+      if (!token) {
+        return ExpressController.errorResponse(new UnauthorizedApiError("Unauthorized"), req, res);
+      }
+
+      const verifiedTokenResult = await params.accessTokenVerifier.verify(token);
+      if (verifiedTokenResult.isFailure) {
+        return ExpressController.errorResponse(new UnauthorizedApiError("Unauthorized"), req, res);
+      }
+
+      const accountIdResult = UniqueID.create(verifiedTokenResult.data.accountId);
+      if (accountIdResult.isFailure) {
+        return ExpressController.errorResponse(new UnauthorizedApiError("Unauthorized"), req, res);
+      }
+
+      const accountResult = await params.accountRepository.findById(accountIdResult.data);
+      if (accountResult.isFailure || accountResult.data.isNone()) {
+        return ExpressController.errorResponse(new UnauthorizedApiError("Unauthorized"), req, res);
+      }
+
+      const account = accountResult.data.unwrap();
+      const canAuthenticateResult = account.canAuthenticate();
+      if (canAuthenticateResult.isFailure) {
+        return ExpressController.errorResponse(new UnauthorizedApiError("Unauthorized"), req, res);
+      }
+
+      const emailResult = EmailAddress.create(verifiedTokenResult.data.email);
+      if (emailResult.isFailure) {
+        return ExpressController.errorResponse(new UnauthorizedApiError("Unauthorized"), req, res);
+      }
+
+      (req as RequestWithAuth).user = {
+        userId: account.id,
+        email: emailResult.data,
+      };
+
+      return next();
+    } catch {
+      return ExpressController.errorResponse(new UnauthorizedApiError("Unauthorized"), req, res);
+    }
+  };
+}
diff --git a/modules/identity/src/api/infrastructure/express/middlewares/index.ts b/modules/identity/src/api/infrastructure/express/middlewares/index.ts
new file mode 100644
index 00000000..6fa48eea
--- /dev/null
+++ b/modules/identity/src/api/infrastructure/express/middlewares/index.ts
@@ -0,0 +1 @@
+export * from "./identity-authenticate-request";
diff --git a/modules/identity/src/api/infrastructure/express/utils/index.ts b/modules/identity/src/api/infrastructure/express/utils/index.ts
new file mode 100644
index 00000000..c43c92e3
--- /dev/null
+++ b/modules/identity/src/api/infrastructure/express/utils/index.ts
@@ -0,0 +1,2 @@
+export * from "./refresh-token-expiration";
+export * from "./utc-date-now";
diff --git a/modules/identity/src/api/infrastructure/express/utils/refresh-token-expiration.ts b/modules/identity/src/api/infrastructure/express/utils/refresh-token-expiration.ts
new file mode 100644
index 00000000..399a08e2
--- /dev/null
+++ b/modules/identity/src/api/infrastructure/express/utils/refresh-token-expiration.ts
@@ -0,0 +1,46 @@
+import { UtcDateTime } from "@repo/rdx-ddd";
+import { Result } from "@repo/rdx-utils";
+
+const DURATION_PATTERN = /^(\d+)(ms|s|m|h|d|w)$/i;
+const SECONDS_PATTERN = /^\d+$/;
+
+function parseDurationToMilliseconds(duration: string): Result<number, Error> {
+  const normalized = duration.trim();
+
+  if (SECONDS_PATTERN.test(normalized)) {
+    return Result.ok(Number(normalized) * 1000);
+  }
+
+  const match = DURATION_PATTERN.exec(normalized);
+  if (!match) {
+    return Result.fail(new Error(`Unsupported refresh token expiration format: ${duration}`));
+  }
+
+  const [, amountRaw, unitRaw] = match;
+  const amount = Number(amountRaw);
+  const unit = unitRaw.toLowerCase();
+
+  const multipliers: Record<string, number> = {
+    ms: 1,
+    s: 1000,
+    m: 60_000,
+    h: 3_600_000,
+    d: 86_400_000,
+    w: 604_800_000,
+  };
+
+  return Result.ok(amount * multipliers[unit]);
+}
+
+export function buildRefreshTokenExpiresAt(
+  now: UtcDateTime,
+  refreshTokenExpiration: string
+): Result<UtcDateTime, Error> {
+  const durationResult = parseDurationToMilliseconds(refreshTokenExpiration);
+  if (durationResult.isFailure) {
+    return Result.fail(durationResult.error);
+  }
+
+  const expiresAt = new Date(new Date(now.toISOString()).getTime() + durationResult.data);
+  return UtcDateTime.createFromISO(expiresAt.toISOString());
+}
diff --git a/modules/identity/src/api/infrastructure/express/utils/utc-date-now.ts b/modules/identity/src/api/infrastructure/express/utils/utc-date-now.ts
new file mode 100644
index 00000000..80c2cb6c
--- /dev/null
+++ b/modules/identity/src/api/infrastructure/express/utils/utc-date-now.ts
@@ -0,0 +1,5 @@
+import { UtcDateTime } from "@repo/rdx-ddd";
+
+export function buildUtcNow() {
+  return UtcDateTime.now();
+}
diff --git a/modules/identity/src/api/infrastructure/index.ts b/modules/identity/src/api/infrastructure/index.ts
new file mode 100644
index 00000000..24d619fc
--- /dev/null
+++ b/modules/identity/src/api/infrastructure/index.ts
@@ -0,0 +1,4 @@
+export * from "./di";
+export * from "./express";
+export * from "./persistence";
+export * from "./security";
diff --git a/modules/identity/src/api/infrastructure/persistence/index.ts b/modules/identity/src/api/infrastructure/persistence/index.ts
new file mode 100644
index 00000000..62f8ac11
--- /dev/null
+++ b/modules/identity/src/api/infrastructure/persistence/index.ts
@@ -0,0 +1 @@
+export * from "./sequelize";
diff --git a/modules/identity/src/api/infrastructure/persistence/sequelize/index.ts b/modules/identity/src/api/infrastructure/persistence/sequelize/index.ts
new file mode 100644
index 00000000..3cd45b80
--- /dev/null
+++ b/modules/identity/src/api/infrastructure/persistence/sequelize/index.ts
@@ -0,0 +1,8 @@
+import accountModelInit from "./models/sequelize-account.model";
+import refreshTokenModelInit from "./models/sequelize-refresh-token.model";
+
+export * from "./mappers";
+export * from "./models";
+export * from "./repositories";
+
+export const models = [accountModelInit, refreshTokenModelInit];
diff --git a/modules/identity/src/api/infrastructure/persistence/sequelize/mappers/index.ts b/modules/identity/src/api/infrastructure/persistence/sequelize/mappers/index.ts
new file mode 100644
index 00000000..3076edec
--- /dev/null
+++ b/modules/identity/src/api/infrastructure/persistence/sequelize/mappers/index.ts
@@ -0,0 +1,2 @@
+export * from "./sequelize-account-domain.mapper";
+export * from "./sequelize-refresh-token-domain.mapper";
diff --git a/modules/identity/src/api/infrastructure/persistence/sequelize/mappers/sequelize-account-domain.mapper.ts b/modules/identity/src/api/infrastructure/persistence/sequelize/mappers/sequelize-account-domain.mapper.ts
new file mode 100644
index 00000000..3a81437d
--- /dev/null
+++ b/modules/identity/src/api/infrastructure/persistence/sequelize/mappers/sequelize-account-domain.mapper.ts
@@ -0,0 +1,109 @@
+import { type MapperParamsType, SequelizeDomainMapper } from "@erp/core/api";
+import {
+  EmailAddress,
+  LanguageCode,
+  Name,
+  type URLAddress,
+  URLAddress as URLAddressValue,
+  UniqueID,
+  UtcDate,
+  ValidationErrorCollection,
+  type ValidationErrorDetail,
+  extractOrPushError,
+  maybeFromNullableResult,
+  maybeToNullable,
+} from "@repo/rdx-ddd";
+import { Result } from "@repo/rdx-utils";
+
+import {
+  Account,
+  AccountStatus,
+  type AccountInternalProps,
+  PasswordHash,
+} from "../../../../domain";
+import type { AccountCreationAttributes, AccountModel } from "../models";
+
+function toUtcIsoString(value: Date | string): string {
+  return value instanceof Date ? value.toISOString() : value;
+}
+
+export class SequelizeAccountDomainMapper extends SequelizeDomainMapper<
+  AccountModel,
+  AccountCreationAttributes,
+  Account
+> {
+  public mapToDomain(
+    source: AccountModel,
+    _params?: MapperParamsType
+  ): Result<Account, Error> {
+    try {
+      const errors: ValidationErrorDetail[] = [];
+
+      const id = extractOrPushError(UniqueID.create(source.id), "id", errors);
+      const email = extractOrPushError(EmailAddress.create(source.email), "email", errors);
+      const passwordHash = extractOrPushError(
+        PasswordHash.create(source.password_hash),
+        "password_hash",
+        errors
+      );
+      const name = extractOrPushError(Name.create(source.name), "name", errors);
+      const avatarUrl = extractOrPushError(
+        maybeFromNullableResult(source.avatar_url, (value) => URLAddressValue.create(value)),
+        "avatar_url",
+        errors
+      );
+      const languageCode = extractOrPushError(
+        LanguageCode.create(source.language_code),
+        "language_code",
+        errors
+      );
+      const status = extractOrPushError(AccountStatus.create(source.status), "status", errors);
+      const createdAt = extractOrPushError(
+        UtcDate.createFromISO(toUtcIsoString(source.created_at)),
+        "created_at",
+        errors
+      );
+      const updatedAt = extractOrPushError(
+        UtcDate.createFromISO(toUtcIsoString(source.updated_at)),
+        "updated_at",
+        errors
+      );
+
+      if (errors.length > 0) {
+        return Result.fail(new ValidationErrorCollection("Account props mapping failed", errors));
+      }
+
+      const accountProps: AccountInternalProps = {
+        email: email!,
+        passwordHash: passwordHash!,
+        name: name!,
+        avatarUrl: avatarUrl!,
+        languageCode: languageCode!,
+        status: status!,
+        createdAt: createdAt!,
+        updatedAt: updatedAt!,
+      };
+
+      return Result.ok(Account.rehydrate(accountProps, id!));
+    } catch (error: unknown) {
+      return Result.fail(error as Error);
+    }
+  }
+
+  public mapToPersistence(
+    source: Account,
+    _params?: MapperParamsType
+  ): Result<AccountCreationAttributes, Error> {
+    return Result.ok<AccountCreationAttributes>({
+      id: source.id.toPrimitive(),
+      email: source.email.toPrimitive(),
+      password_hash: source.passwordHash.toPrimitive(),
+      name: source.name.toPrimitive(),
+      avatar_url: maybeToNullable(source.avatarUrl, (avatarUrl: URLAddress) => avatarUrl.toPrimitive()),
+      language_code: source.languageCode.toPrimitive(),
+      status: source.status.toPrimitive(),
+      created_at: source.createdAt.toISOString(),
+      updated_at: source.updatedAt.toISOString(),
+    });
+  }
+}
diff --git a/modules/identity/src/api/infrastructure/persistence/sequelize/mappers/sequelize-refresh-token-domain.mapper.ts b/modules/identity/src/api/infrastructure/persistence/sequelize/mappers/sequelize-refresh-token-domain.mapper.ts
new file mode 100644
index 00000000..6ea2e1bc
--- /dev/null
+++ b/modules/identity/src/api/infrastructure/persistence/sequelize/mappers/sequelize-refresh-token-domain.mapper.ts
@@ -0,0 +1,105 @@
+import { type MapperParamsType, SequelizeDomainMapper } from "@erp/core/api";
+import {
+  UniqueID,
+  UtcDate,
+  ValidationErrorCollection,
+  type ValidationErrorDetail,
+  extractOrPushError,
+  maybeFromNullableResult,
+  maybeToNullable,
+} from "@repo/rdx-ddd";
+import { Result } from "@repo/rdx-utils";
+
+import {
+  RefreshToken,
+  RefreshTokenHash,
+  type RefreshTokenInternalProps,
+} from "../../../../domain";
+import type { RefreshTokenCreationAttributes, RefreshTokenModel } from "../models";
+
+function toUtcIsoString(value: Date | string): string {
+  return value instanceof Date ? value.toISOString() : value;
+}
+
+export class SequelizeRefreshTokenDomainMapper extends SequelizeDomainMapper<
+  RefreshTokenModel,
+  RefreshTokenCreationAttributes,
+  RefreshToken
+> {
+  public mapToDomain(
+    source: RefreshTokenModel,
+    _params?: MapperParamsType
+  ): Result<RefreshToken, Error> {
+    try {
+      const errors: ValidationErrorDetail[] = [];
+
+      const id = extractOrPushError(UniqueID.create(source.id), "id", errors);
+      const accountId = extractOrPushError(
+        UniqueID.create(source.account_id),
+        "account_id",
+        errors
+      );
+      const tokenHash = extractOrPushError(
+        RefreshTokenHash.create(source.token_hash),
+        "token_hash",
+        errors
+      );
+      const expiresAt = extractOrPushError(
+        UtcDate.createFromISO(toUtcIsoString(source.expires_at)),
+        "expires_at",
+        errors
+      );
+      const revokedAt = extractOrPushError(
+        maybeFromNullableResult(source.revoked_at, (value) =>
+          UtcDate.createFromISO(toUtcIsoString(value))
+        ),
+        "revoked_at",
+        errors
+      );
+      const replacedByTokenId = extractOrPushError(
+        maybeFromNullableResult(source.replaced_by_token_id, (value) => UniqueID.create(value)),
+        "replaced_by_token_id",
+        errors
+      );
+      const createdAt = extractOrPushError(
+        UtcDate.createFromISO(toUtcIsoString(source.created_at)),
+        "created_at",
+        errors
+      );
+
+      if (errors.length > 0) {
+        return Result.fail(
+          new ValidationErrorCollection("Refresh token props mapping failed", errors)
+        );
+      }
+
+      const refreshTokenProps: RefreshTokenInternalProps = {
+        accountId: accountId!,
+        tokenHash: tokenHash!,
+        expiresAt: expiresAt!,
+        revokedAt: revokedAt!,
+        replacedByTokenId: replacedByTokenId!,
+        createdAt: createdAt!,
+      };
+
+      return Result.ok(RefreshToken.rehydrate(refreshTokenProps, id!));
+    } catch (error: unknown) {
+      return Result.fail(error as Error);
+    }
+  }
+
+  public mapToPersistence(
+    source: RefreshToken,
+    _params?: MapperParamsType
+  ): Result<RefreshTokenCreationAttributes, Error> {
+    return Result.ok<RefreshTokenCreationAttributes>({
+      id: source.id.toPrimitive(),
+      account_id: source.accountId.toPrimitive(),
+      token_hash: source.tokenHash.toPrimitive(),
+      expires_at: source.expiresAt.toISOString(),
+      revoked_at: maybeToNullable(source.revokedAt, (revokedAt) => revokedAt.toISOString()),
+      replaced_by_token_id: maybeToNullable(source.replacedByTokenId, (value) => value.toPrimitive()),
+      created_at: source.createdAt.toISOString(),
+    });
+  }
+}
diff --git a/modules/identity/src/api/infrastructure/persistence/sequelize/models/index.ts b/modules/identity/src/api/infrastructure/persistence/sequelize/models/index.ts
new file mode 100644
index 00000000..05015406
--- /dev/null
+++ b/modules/identity/src/api/infrastructure/persistence/sequelize/models/index.ts
@@ -0,0 +1,2 @@
+export * from "./sequelize-account.model";
+export * from "./sequelize-refresh-token.model";
diff --git a/modules/identity/src/api/infrastructure/persistence/sequelize/models/sequelize-account.model.ts b/modules/identity/src/api/infrastructure/persistence/sequelize/models/sequelize-account.model.ts
new file mode 100644
index 00000000..1bcffb59
--- /dev/null
+++ b/modules/identity/src/api/infrastructure/persistence/sequelize/models/sequelize-account.model.ts
@@ -0,0 +1,98 @@
+import {
+  DataTypes,
+  type InferAttributes,
+  type InferCreationAttributes,
+  Model,
+  type Sequelize,
+} from "sequelize";
+
+export type AccountCreationAttributes = InferCreationAttributes<AccountModel, {}>;
+
+export class AccountModel extends Model<
+  InferAttributes<AccountModel>,
+  InferCreationAttributes<AccountModel>
+> {
+  declare id: string;
+  declare email: string;
+  declare password_hash: string;
+  declare name: string;
+  declare avatar_url: string | null;
+  declare language_code: string;
+  declare status: string;
+  declare created_at: string;
+  declare updated_at: string;
+
+  static associate(_database: Sequelize) {}
+
+  static hooks(_database: Sequelize) {}
+}
+
+export default (database: Sequelize) => {
+  AccountModel.init(
+    {
+      id: {
+        type: DataTypes.UUID,
+        primaryKey: true,
+      },
+      email: {
+        type: DataTypes.STRING,
+        allowNull: false,
+        unique: true,
+        validate: {
+          isEmail: true,
+        },
+      },
+      password_hash: {
+        type: DataTypes.STRING(512),
+        allowNull: false,
+      },
+      name: {
+        type: DataTypes.STRING,
+        allowNull: false,
+      },
+      avatar_url: {
+        type: DataTypes.STRING,
+        allowNull: true,
+        defaultValue: null,
+      },
+      language_code: {
+        type: DataTypes.STRING(2),
+        allowNull: false,
+      },
+      status: {
+        type: DataTypes.STRING,
+        allowNull: false,
+      },
+      created_at: {
+        type: DataTypes.DATE,
+        allowNull: false,
+      },
+      updated_at: {
+        type: DataTypes.DATE,
+        allowNull: false,
+      },
+    },
+    {
+      sequelize: database,
+      modelName: "AccountModel",
+      tableName: "identity_accounts",
+      underscored: true,
+      timestamps: false,
+      indexes: [
+        {
+          name: "uq_identity_accounts_email",
+          fields: ["email"],
+          unique: true,
+        },
+        {
+          name: "idx_identity_accounts_status",
+          fields: ["status"],
+        },
+      ],
+      defaultScope: {},
+      scopes: {},
+    }
+  );
+
+  return AccountModel;
+};
diff --git a/modules/identity/src/api/infrastructure/persistence/sequelize/models/sequelize-refresh-token.model.ts b/modules/identity/src/api/infrastructure/persistence/sequelize/models/sequelize-refresh-token.model.ts
new file mode 100644
index 00000000..591e83dd
--- /dev/null
+++ b/modules/identity/src/api/infrastructure/persistence/sequelize/models/sequelize-refresh-token.model.ts
@@ -0,0 +1,140 @@
+import {
+  DataTypes,
+  type InferAttributes,
+  type InferCreationAttributes,
+  Model,
+  type NonAttribute,
+  type Sequelize,
+} from "sequelize";
+
+import type { AccountModel } from "./sequelize-account.model";
+
+export type RefreshTokenCreationAttributes = InferCreationAttributes<
+  RefreshTokenModel,
+  { omit: "account" | "replaced_by_token" }
+>;
+
+export class RefreshTokenModel extends Model<
+  InferAttributes<RefreshTokenModel>,
+  InferCreationAttributes<RefreshTokenModel, { omit: "account" | "replaced_by_token" }>
+> {
+  declare id: string;
+  declare account_id: string;
+  declare token_hash: string;
+  declare expires_at: string;
+  declare revoked_at: string | null;
+  declare replaced_by_token_id: string | null;
+  declare created_at: string;
+
+  declare account?: NonAttribute<AccountModel>;
+  declare replaced_by_token?: NonAttribute<RefreshTokenModel | null>;
+
+  static associate(database: Sequelize) {
+    const models = database.models;
+    const requiredModels = ["AccountModel", "RefreshTokenModel"];
+
+    for (const name of requiredModels) {
+      if (!models[name]) {
+        throw new Error(`[RefreshTokenModel.associate] Missing model: ${name}`);
+      }
+    }
+
+    const { AccountModel, RefreshTokenModel } = models;
+
+    RefreshTokenModel.belongsTo(AccountModel, {
+      as: "account",
+      foreignKey: "account_id",
+      targetKey: "id",
+      constraints: true,
+      onDelete: "CASCADE",
+      onUpdate: "CASCADE",
+    });
+
+    RefreshTokenModel.belongsTo(RefreshTokenModel, {
+      as: "replaced_by_token",
+      foreignKey: "replaced_by_token_id",
+      targetKey: "id",
+      constraints: true,
+      onDelete: "SET NULL",
+      onUpdate: "CASCADE",
+    });
+  }
+
+  static hooks(_database: Sequelize) {}
+}
+
+export default (database: Sequelize) => {
+  RefreshTokenModel.init(
+    {
+      id: {
+        type: DataTypes.UUID,
+        primaryKey: true,
+      },
+      account_id: {
+        type: DataTypes.UUID,
+        allowNull: false,
+        references: {
+          model: "identity_accounts",
+          key: "id",
+        },
+      },
+      token_hash: {
+        type: DataTypes.STRING(512),
+        allowNull: false,
+        unique: true,
+      },
+      expires_at: {
+        type: DataTypes.DATE,
+        allowNull: false,
+      },
+      revoked_at: {
+        type: DataTypes.DATE,
+        allowNull: true,
+        defaultValue: null,
+      },
+      replaced_by_token_id: {
+        type: DataTypes.UUID,
+        allowNull: true,
+        defaultValue: null,
+        references: {
+          model: "identity_refresh_tokens",
+          key: "id",
+        },
+      },
+      created_at: {
+        type: DataTypes.DATE,
+        allowNull: false,
+      },
+    },
+    {
+      sequelize: database,
+      modelName: "RefreshTokenModel",
+      tableName: "identity_refresh_tokens",
+      underscored: true,
+      timestamps: false,
+      indexes: [
+        {
+          name: "uq_identity_refresh_tokens_hash",
+          fields: ["token_hash"],
+          unique: true,
+        },
+        {
+          name: "idx_identity_refresh_tokens_account_id",
+          fields: ["account_id"],
+        },
+        {
+          name: "idx_identity_refresh_tokens_expires_at",
+          fields: ["expires_at"],
+        },
+        {
+          name: "idx_identity_refresh_tokens_revoked_at",
+          fields: ["revoked_at"],
+        },
+      ],
+      defaultScope: {},
+      scopes: {},
+    }
+  );
+
+  return RefreshTokenModel;
+};
diff --git a/modules/identity/src/api/infrastructure/persistence/sequelize/repositories/index.ts b/modules/identity/src/api/infrastructure/persistence/sequelize/repositories/index.ts
new file mode 100644
index 00000000..69f8cc03
--- /dev/null
+++ b/modules/identity/src/api/infrastructure/persistence/sequelize/repositories/index.ts
@@ -0,0 +1,2 @@
+export * from "./sequelize-account.repository";
+export * from "./sequelize-refresh-token.repository";
diff --git a/modules/identity/src/api/infrastructure/persistence/sequelize/repositories/sequelize-account.repository.ts b/modules/identity/src/api/infrastructure/persistence/sequelize/repositories/sequelize-account.repository.ts
new file mode 100644
index 00000000..dd586e33
--- /dev/null
+++ b/modules/identity/src/api/infrastructure/persistence/sequelize/repositories/sequelize-account.repository.ts
@@ -0,0 +1,114 @@
+import { SequelizeRepository, translateSequelizeError } from "@erp/core/api";
+import { Maybe, Result } from "@repo/rdx-utils";
+import type { Transaction } from "sequelize";
+import type { Sequelize } from "sequelize";
+
+import type { IAccountRepository } from "../../../../application";
+import type { Account } from "../../../../domain";
+import type { SequelizeAccountDomainMapper } from "../mappers";
+import { AccountModel } from "../models";
+
+function asTransaction(transaction?: unknown): Transaction | undefined {
+  return transaction as Transaction | undefined;
+}
+
+export class SequelizeAccountRepository
+  extends SequelizeRepository<Account>
+  implements IAccountRepository
+{
+  public constructor(
+    private readonly domainMapper: SequelizeAccountDomainMapper,
+    database: Sequelize
+  ) {
+    super({ database });
+  }
+
+  public async save(account: Account, transaction?: unknown): Promise<Result<void, Error>> {
+    try {
+      const persistenceResult = this.domainMapper.mapToPersistence(account);
+      if (persistenceResult.isFailure) {
+        return Result.fail(persistenceResult.error);
+      }
+
+      await AccountModel.create(persistenceResult.data, {
+        transaction: asTransaction(transaction),
+      });
+
+      return Result.ok();
+    } catch (error: unknown) {
+      return Result.fail(translateSequelizeError(error));
+    }
+  }
+
+  public async update(account: Account, transaction?: unknown): Promise<Result<void, Error>> {
+    try {
+      const persistenceResult = this.domainMapper.mapToPersistence(account);
+      if (persistenceResult.isFailure) {
+        return Result.fail(persistenceResult.error);
+      }
+
+      const { id, ...payload } = persistenceResult.data;
+      const [affectedRows] = await AccountModel.update(payload, {
+        where: { id },
+        transaction: asTransaction(transaction),
+      });
+
+      if (affectedRows === 0) {
+        return Result.fail(new Error("Account not found for update."));
+      }
+
+      return Result.ok();
+    } catch (error: unknown) {
+      return Result.fail(translateSequelizeError(error));
+    }
+  }
+
+  public async findById(
+    id: Account["id"],
+    transaction?: unknown
+  ): Promise<Result<Maybe<Account>, Error>> {
+    try {
+      const row = await AccountModel.findByPk(id.toPrimitive(), {
+        transaction: asTransaction(transaction),
+      });
+
+      if (!row) {
+        return Result.ok(Maybe.none<Account>());
+      }
+
+      const accountResult = this.domainMapper.mapToDomain(row);
+      if (accountResult.isFailure) {
+        return Result.fail(accountResult.error);
+      }
+
+      return Result.ok(Maybe.some(accountResult.data));
+    } catch (error: unknown) {
+      return Result.fail(translateSequelizeError(error));
+    }
+  }
+
+  public async findByEmail(
+    email: Account["email"],
+    transaction?: unknown
+  ): Promise<Result<Maybe<Account>, Error>> {
+    try {
+      const row = await AccountModel.findOne({
+        where: { email: email.toPrimitive() },
+        transaction: asTransaction(transaction),
+      });
+
+      if (!row) {
+        return Result.ok(Maybe.none<Account>());
+      }
+
+      const accountResult = this.domainMapper.mapToDomain(row);
+      if (accountResult.isFailure) {
+        return Result.fail(accountResult.error);
+      }
+
+      return Result.ok(Maybe.some(accountResult.data));
+    } catch (error: unknown) {
+      return Result.fail(translateSequelizeError(error));
+    }
+  }
+}
diff --git a/modules/identity/src/api/infrastructure/persistence/sequelize/repositories/sequelize-refresh-token.repository.ts b/modules/identity/src/api/infrastructure/persistence/sequelize/repositories/sequelize-refresh-token.repository.ts
new file mode 100644
index 00000000..edad3f55
--- /dev/null
+++ b/modules/identity/src/api/infrastructure/persistence/sequelize/repositories/sequelize-refresh-token.repository.ts
@@ -0,0 +1,120 @@
+import { SequelizeRepository, translateSequelizeError } from "@erp/core/api";
+import { Maybe, Result } from "@repo/rdx-utils";
+import { type Sequelize, type Transaction } from "sequelize";
+
+import type { IRefreshTokenRepository } from "../../../../application";
+import type { RefreshToken } from "../../../../domain";
+import type { SequelizeRefreshTokenDomainMapper } from "../mappers";
+import { RefreshTokenModel } from "../models";
+
+function asTransaction(transaction?: unknown): Transaction | undefined {
+  return transaction as Transaction | undefined;
+}
+
+export class SequelizeRefreshTokenRepository
+  extends SequelizeRepository<RefreshToken>
+  implements IRefreshTokenRepository
+{
+  public constructor(
+    private readonly domainMapper: SequelizeRefreshTokenDomainMapper,
+    database: Sequelize
+  ) {
+    super({ database });
+  }
+
+  public async save(
+    refreshToken: RefreshToken,
+    transaction?: unknown
+  ): Promise<Result<void, Error>> {
+    try {
+      const persistenceResult = this.domainMapper.mapToPersistence(refreshToken);
+      if (persistenceResult.isFailure) {
+        return Result.fail(persistenceResult.error);
+      }
+
+      await RefreshTokenModel.create(persistenceResult.data, {
+        transaction: asTransaction(transaction),
+      });
+
+      return Result.ok();
+    } catch (error: unknown) {
+      return Result.fail(translateSequelizeError(error));
+    }
+  }
+
+  public async update(
+    refreshToken: RefreshToken,
+    transaction?: unknown
+  ): Promise<Result<void, Error>> {
+    try {
+      const persistenceResult = this.domainMapper.mapToPersistence(refreshToken);
+      if (persistenceResult.isFailure) {
+        return Result.fail(persistenceResult.error);
+      }
+
+      const { id, ...payload } = persistenceResult.data;
+      const [affectedRows] = await RefreshTokenModel.update(payload, {
+        where: { id },
+        transaction: asTransaction(transaction),
+      });
+
+      if (affectedRows === 0) {
+        return Result.fail(new Error("Refresh token not found for update."));
+      }
+
+      return Result.ok();
+    } catch (error: unknown) {
+      return Result.fail(translateSequelizeError(error));
+    }
+  }
+
+  public async findByHash(
+    tokenHash: RefreshToken["tokenHash"],
+    transaction?: unknown
+  ): Promise<Result<Maybe<RefreshToken>, Error>> {
+    try {
+      const row = await RefreshTokenModel.findOne({
+        where: { token_hash: tokenHash.toPrimitive() },
+        transaction: asTransaction(transaction),
+      });
+
+      if (!row) {
+        return Result.ok(Maybe.none<RefreshToken>());
+      }
+
+      const refreshTokenResult = this.domainMapper.mapToDomain(row);
+      if (refreshTokenResult.isFailure) {
+        return Result.fail(refreshTokenResult.error);
+      }
+
+      return Result.ok(Maybe.some(refreshTokenResult.data));
+    } catch (error: unknown) {
+      return Result.fail(translateSequelizeError(error));
+    }
+  }
+
+  public async revokeAllByAccountId(params: {
+    accountId: RefreshToken["accountId"];
+    revokedAt: RefreshToken["expiresAt"];
+    transaction?: unknown;
+  }): Promise<Result<number, Error>> {
+    try {
+      const [affectedRows] = await RefreshTokenModel.update(
+        {
+          revoked_at: params.revokedAt.toISOString(),
+        },
+        {
+          where: {
+            account_id: params.accountId.toPrimitive(),
+            revoked_at: null,
+          },
+          transaction: asTransaction(params.transaction),
+        }
+      );
+
+      return Result.ok(affectedRows);
+    } catch (error: unknown) {
+      return Result.fail(translateSequelizeError(error));
+    }
+  }
+}
diff --git a/modules/identity/src/api/infrastructure/security/bcrypt-password-hasher.ts b/modules/identity/src/api/infrastructure/security/bcrypt-password-hasher.ts
new file mode 100644
index 00000000..0d714e8e
--- /dev/null
+++ b/modules/identity/src/api/infrastructure/security/bcrypt-password-hasher.ts
@@ -0,0 +1,49 @@
+import bcrypt from "bcrypt";
+import { Result } from "@repo/rdx-utils";
+
+import type { IPasswordHasher } from "../../application";
+import { PasswordHash } from "../../domain";
+
+import { PasswordHashingError, PasswordVerificationError } from "./errors";
+
+export type BcryptPasswordHasherConfig = {
+  rounds: number;
+};
+
+export class BcryptPasswordHasher implements IPasswordHasher {
+  private readonly rounds: number;
+
+  public constructor(config: BcryptPasswordHasherConfig) {
+    this.rounds = config.rounds;
+  }
+
+  public async hash(password: string): Promise<Result<PasswordHash, Error>> {
+    try {
+      const hashedPassword = await bcrypt.hash(password, this.rounds);
+      return PasswordHash.create(hashedPassword);
+    } catch (error: unknown) {
+      return Result.fail(
+        new PasswordHashingError("Password hashing failed.", { cause: error as Error })
+      );
+    }
+  }
+
+  public async verify(params: {
+    plainPassword: string;
+    passwordHash: PasswordHash;
+  }): Promise<Result<boolean, Error>> {
+    try {
+      const matches = await bcrypt.compare(
+        params.plainPassword,
+        params.passwordHash.toPrimitive()
+      );
+      return Result.ok(matches);
+    } catch (error: unknown) {
+      return Result.fail(
+        new PasswordVerificationError("Password verification failed.", {
+          cause: error as Error,
+        })
+      );
+    }
+  }
+}
diff --git a/modules/identity/src/api/infrastructure/security/crypto-refresh-token-generator.ts b/modules/identity/src/api/infrastructure/security/crypto-refresh-token-generator.ts
new file mode 100644
index 00000000..b8966fb3
--- /dev/null
+++ b/modules/identity/src/api/infrastructure/security/crypto-refresh-token-generator.ts
@@ -0,0 +1,32 @@
+import { randomBytes } from "node:crypto";
+
+import { Result } from "@repo/rdx-utils";
+
+import type { IRefreshTokenGenerator } from "../../application";
+
+import { RefreshTokenGenerationError } from "./errors";
+
+export type CryptoRefreshTokenGeneratorConfig = {
+  sizeInBytes?: number;
+};
+
+export class CryptoRefreshTokenGenerator implements IRefreshTokenGenerator {
+  private readonly sizeInBytes: number;
+
+  public constructor(config: CryptoRefreshTokenGeneratorConfig = {}) {
+    this.sizeInBytes = config.sizeInBytes ?? 32;
+  }
+
+  public generate(): Result<string, Error> {
+    try {
+      const token = randomBytes(this.sizeInBytes).toString("base64url");
+      return Result.ok(token);
+    } catch (error: unknown) {
+      return Result.fail(
+        new RefreshTokenGenerationError("Refresh token generation failed.", {
+          cause: error as Error,
+        })
+      );
+    }
+  }
+}
diff --git a/modules/identity/src/api/infrastructure/security/errors.ts b/modules/identity/src/api/infrastructure/security/errors.ts
new file mode 100644
index 00000000..c0d5b7ee
--- /dev/null
+++ b/modules/identity/src/api/infrastructure/security/errors.ts
@@ -0,0 +1,41 @@
+export class PasswordHashingError extends Error {
+  public constructor(message = "Password hashing failed.", options?: ErrorOptions) {
+    super(message, options);
+    this.name = "PasswordHashingError";
+  }
+}
+
+export class PasswordVerificationError extends Error {
+  public constructor(message = "Password verification failed.", options?: ErrorOptions) {
+    super(message, options);
+    this.name = "PasswordVerificationError";
+  }
+}
+
+export class AccessTokenIssueError extends Error {
+  public constructor(message = "Access token issue failed.", options?: ErrorOptions) {
+    super(message, options);
+    this.name = "AccessTokenIssueError";
+  }
+}
+
+export class AccessTokenVerificationError extends Error {
+  public constructor(message = "Access token verification failed.", options?: ErrorOptions) {
+    super(message, options);
+    this.name = "AccessTokenVerificationError";
+  }
+}
+
+export class RefreshTokenGenerationError extends Error {
+  public constructor(message = "Refresh token generation failed.", options?: ErrorOptions) {
+    super(message, options);
+    this.name = "RefreshTokenGenerationError";
+  }
+}
+
+export class RefreshTokenHashingError extends Error {
+  public constructor(message = "Refresh token hashing failed.", options?: ErrorOptions) {
+    super(message, options);
+    this.name = "RefreshTokenHashingError";
+  }
+}
diff --git a/modules/identity/src/api/infrastructure/security/index.ts b/modules/identity/src/api/infrastructure/security/index.ts
new file mode 100644
index 00000000..4a52da6b
--- /dev/null
+++ b/modules/identity/src/api/infrastructure/security/index.ts
@@ -0,0 +1,7 @@
+export * from "./bcrypt-password-hasher";
+export * from "./crypto-refresh-token-generator";
+export * from "./errors";
+export * from "./jwt-access-token-config";
+export * from "./jsonwebtoken-access-token-issuer";
+export * from "./jsonwebtoken-access-token-verifier";
+export * from "./sha256-refresh-token-hasher";
diff --git a/modules/identity/src/api/infrastructure/security/jsonwebtoken-access-token-issuer.ts b/modules/identity/src/api/infrastructure/security/jsonwebtoken-access-token-issuer.ts
new file mode 100644
index 00000000..74bf07b1
--- /dev/null
+++ b/modules/identity/src/api/infrastructure/security/jsonwebtoken-access-token-issuer.ts
@@ -0,0 +1,35 @@
+import jwt from "jsonwebtoken";
+import { Result } from "@repo/rdx-utils";
+
+import type { AccessTokenPayload, IAccessTokenIssuer } from "../../application";
+
+import { AccessTokenIssueError } from "./errors";
+import type { JwtAccessTokenConfig } from "./jwt-access-token-config";
+
+export class JsonWebTokenAccessTokenIssuer implements IAccessTokenIssuer {
+  public constructor(private readonly config: JwtAccessTokenConfig) {}
+
+  public async issue(payload: AccessTokenPayload): Promise<Result<string, Error>> {
+    try {
+      const token = jwt.sign(
+        {
+          accountId: payload.accountId,
+          email: payload.email,
+        },
+        this.config.secret,
+        {
+          expiresIn: this.config.expiresIn as jwt.SignOptions["expiresIn"],
+          subject: payload.accountId,
+        }
+      );
+
+      return Result.ok(token);
+    } catch (error: unknown) {
+      return Result.fail(
+        new AccessTokenIssueError("Access token issue failed.", {
+          cause: error as Error,
+        })
+      );
+    }
+  }
+}
diff --git a/modules/identity/src/api/infrastructure/security/jsonwebtoken-access-token-verifier.ts b/modules/identity/src/api/infrastructure/security/jsonwebtoken-access-token-verifier.ts
new file mode 100644
index 00000000..7a9a0c0a
--- /dev/null
+++ b/modules/identity/src/api/infrastructure/security/jsonwebtoken-access-token-verifier.ts
@@ -0,0 +1,40 @@
+import jwt from "jsonwebtoken";
+import { Result } from "@repo/rdx-utils";
+import { z } from "zod/v4";
+
+import type { IAccessTokenVerifier, VerifiedAccessTokenPayload } from "../../application";
+
+import { AccessTokenVerificationError } from "./errors";
+import type { JwtAccessTokenConfig } from "./jwt-access-token-config";
+
+const VerifiedAccessTokenPayloadSchema = z.object({
+  accountId: z.string().uuid(),
+  email: z.email(),
+});
+
+export class JsonWebTokenAccessTokenVerifier implements IAccessTokenVerifier {
+  public constructor(private readonly config: Pick<JwtAccessTokenConfig, "secret">) {}
+
+  public async verify(token: string): Promise<Result<VerifiedAccessTokenPayload, Error>> {
+    try {
+      const decoded = jwt.verify(token, this.config.secret);
+
+      const parsedPayload = VerifiedAccessTokenPayloadSchema.safeParse(decoded);
+      if (!parsedPayload.success) {
+        return Result.fail(
+          new AccessTokenVerificationError("Access token payload is invalid.", {
+            cause: parsedPayload.error,
+          })
+        );
+      }
+
+      return Result.ok(parsedPayload.data);
+    } catch (error: unknown) {
+      return Result.fail(
+        new AccessTokenVerificationError("Access token verification failed.", {
+          cause: error as Error,
+        })
+      );
+    }
+  }
+}
diff --git a/modules/identity/src/api/infrastructure/security/jwt-access-token-config.ts b/modules/identity/src/api/infrastructure/security/jwt-access-token-config.ts
new file mode 100644
index 00000000..d51b931a
--- /dev/null
+++ b/modules/identity/src/api/infrastructure/security/jwt-access-token-config.ts
@@ -0,0 +1,4 @@
+export type JwtAccessTokenConfig = {
+  secret: string;
+  expiresIn: string;
+};
diff --git a/modules/identity/src/api/infrastructure/security/sha256-refresh-token-hasher.ts b/modules/identity/src/api/infrastructure/security/sha256-refresh-token-hasher.ts
new file mode 100644
index 00000000..965dfec1
--- /dev/null
+++ b/modules/identity/src/api/infrastructure/security/sha256-refresh-token-hasher.ts
@@ -0,0 +1,23 @@
+import { createHash } from "node:crypto";
+
+import { Result } from "@repo/rdx-utils";
+
+import type { IRefreshTokenHasher } from "../../application";
+import { RefreshTokenHash } from "../../domain";
+
+import { RefreshTokenHashingError } from "./errors";
+
+export class Sha256RefreshTokenHasher implements IRefreshTokenHasher {
+  public hash(token: string): Result<RefreshTokenHash, Error> {
+    try {
+      const tokenHash = createHash("sha256").update(token, "utf8").digest("hex");
+      return RefreshTokenHash.create(tokenHash);
+    } catch (error: unknown) {
+      return Result.fail(
+        new RefreshTokenHashingError("Refresh token hashing failed.", {
+          cause: error as Error,
+        })
+      );
+    }
+  }
+}
diff --git a/modules/identity/src/common/dto/account/index.ts b/modules/identity/src/common/dto/account/index.ts
new file mode 100644
index 00000000..32497d2a
--- /dev/null
+++ b/modules/identity/src/common/dto/account/index.ts
@@ -0,0 +1,3 @@
+export * from "./request";
+export * from "./response";
+export * from "./shared";
diff --git a/modules/identity/src/common/dto/account/request/change-account-password.request.dto.ts b/modules/identity/src/common/dto/account/request/change-account-password.request.dto.ts
new file mode 100644
index 00000000..00fab506
--- /dev/null
+++ b/modules/identity/src/common/dto/account/request/change-account-password.request.dto.ts
@@ -0,0 +1,8 @@
+import { z } from "zod/v4";
+
+export const ChangeAccountPasswordRequestSchema = z.object({
+  current_password: z.string().min(1),
+  new_password: z.string().min(12),
+});
+
+export type ChangeAccountPasswordRequestDTO = z.infer<typeof ChangeAccountPasswordRequestSchema>;
diff --git a/modules/identity/src/common/dto/account/request/index.ts b/modules/identity/src/common/dto/account/request/index.ts
new file mode 100644
index 00000000..771fee0b
--- /dev/null
+++ b/modules/identity/src/common/dto/account/request/index.ts
@@ -0,0 +1,2 @@
+export * from "./change-account-password.request.dto";
+export * from "./update-account-profile.request.dto";
diff --git a/modules/identity/src/common/dto/account/request/update-account-profile.request.dto.ts b/modules/identity/src/common/dto/account/request/update-account-profile.request.dto.ts
new file mode 100644
index 00000000..57cfac60
--- /dev/null
+++ b/modules/identity/src/common/dto/account/request/update-account-profile.request.dto.ts
@@ -0,0 +1,10 @@
+import { LanguageCodeSchema, URLSchema } from "@erp/core";
+import { z } from "zod/v4";
+
+export const UpdateAccountProfileRequestSchema = z.object({
+  name: z.string().min(1).optional(),
+  avatar_url: URLSchema.nullable().optional(),
+  language_code: LanguageCodeSchema.optional(),
+});
+
+export type UpdateAccountProfileRequestDTO = z.infer<typeof UpdateAccountProfileRequestSchema>;
diff --git a/modules/identity/src/common/dto/account/response/change-account-password.response.dto.ts b/modules/identity/src/common/dto/account/response/change-account-password.response.dto.ts
new file mode 100644
index 00000000..816e3c46
--- /dev/null
+++ b/modules/identity/src/common/dto/account/response/change-account-password.response.dto.ts
@@ -0,0 +1,9 @@
+import { z } from "zod/v4";
+
+export const ChangeAccountPasswordResponseSchema = z.object({
+  success: z.literal(true),
+});
+
+export type ChangeAccountPasswordResponseDTO = z.infer<
+  typeof ChangeAccountPasswordResponseSchema
+>;
diff --git a/modules/identity/src/common/dto/account/response/get-account-profile.response.dto.ts b/modules/identity/src/common/dto/account/response/get-account-profile.response.dto.ts
new file mode 100644
index 00000000..f45dfa0e
--- /dev/null
+++ b/modules/identity/src/common/dto/account/response/get-account-profile.response.dto.ts
@@ -0,0 +1,9 @@
+import { z } from "zod/v4";
+
+import { AccountProfileSchema } from "../shared";
+
+export const GetAccountProfileResponseSchema = z.object({
+  account: AccountProfileSchema,
+});
+
+export type GetAccountProfileResponseDTO = z.infer<typeof GetAccountProfileResponseSchema>;
diff --git a/modules/identity/src/common/dto/account/response/index.ts b/modules/identity/src/common/dto/account/response/index.ts
new file mode 100644
index 00000000..4d5b8430
--- /dev/null
+++ b/modules/identity/src/common/dto/account/response/index.ts
@@ -0,0 +1,3 @@
+export * from "./change-account-password.response.dto";
+export * from "./get-account-profile.response.dto";
+export * from "./update-account-profile.response.dto";
diff --git a/modules/identity/src/common/dto/account/response/update-account-profile.response.dto.ts b/modules/identity/src/common/dto/account/response/update-account-profile.response.dto.ts
new file mode 100644
index 00000000..679824d4
--- /dev/null
+++ b/modules/identity/src/common/dto/account/response/update-account-profile.response.dto.ts
@@ -0,0 +1,11 @@
+import { z } from "zod/v4";
+
+import { AccountProfileSchema } from "../shared";
+
+export const UpdateAccountProfileResponseSchema = z.object({
+  account: AccountProfileSchema,
+});
+
+export type UpdateAccountProfileResponseDTO = z.infer<
+  typeof UpdateAccountProfileResponseSchema
+>;
diff --git a/modules/identity/src/common/dto/account/shared/account-profile.dto.ts b/modules/identity/src/common/dto/account/shared/account-profile.dto.ts
new file mode 100644
index 00000000..b684138c
--- /dev/null
+++ b/modules/identity/src/common/dto/account/shared/account-profile.dto.ts
@@ -0,0 +1,15 @@
+import { EmailSchema, LanguageCodeSchema, OffsetDateTimeSchema, URLSchema } from "@erp/core";
+import { z } from "zod/v4";
+
+export const AccountProfileSchema = z.object({
+  id: z.uuid(),
+  email: EmailSchema,
+  name: z.string(),
+  avatar_url: URLSchema.nullable(),
+  language_code: LanguageCodeSchema,
+  status: z.enum(["active", "disabled", "pending_verification"]),
+  created_at: OffsetDateTimeSchema,
+  updated_at: OffsetDateTimeSchema,
+});
+
+export type AccountProfileDTO = z.infer<typeof AccountProfileSchema>;
diff --git a/modules/identity/src/common/dto/account/shared/index.ts b/modules/identity/src/common/dto/account/shared/index.ts
new file mode 100644
index 00000000..1106332a
--- /dev/null
+++ b/modules/identity/src/common/dto/account/shared/index.ts
@@ -0,0 +1 @@
+export * from "./account-profile.dto";
diff --git a/modules/identity/src/common/dto/auth/index.ts b/modules/identity/src/common/dto/auth/index.ts
new file mode 100644
index 00000000..32497d2a
--- /dev/null
+++ b/modules/identity/src/common/dto/auth/index.ts
@@ -0,0 +1,3 @@
+export * from "./request";
+export * from "./response";
+export * from "./shared";
diff --git a/modules/identity/src/common/dto/auth/request/index.ts b/modules/identity/src/common/dto/auth/request/index.ts
new file mode 100644
index 00000000..b2b75e9c
--- /dev/null
+++ b/modules/identity/src/common/dto/auth/request/index.ts
@@ -0,0 +1,3 @@
+export * from "./login-with-password.request.dto";
+export * from "./logout.request.dto";
+export * from "./refresh-session.request.dto";
diff --git a/modules/identity/src/common/dto/auth/request/login-with-password.request.dto.ts b/modules/identity/src/common/dto/auth/request/login-with-password.request.dto.ts
new file mode 100644
index 00000000..989a79df
--- /dev/null
+++ b/modules/identity/src/common/dto/auth/request/login-with-password.request.dto.ts
@@ -0,0 +1,9 @@
+import { EmailSchema } from "@erp/core";
+import { z } from "zod/v4";
+
+export const LoginWithPasswordRequestSchema = z.object({
+  email: EmailSchema,
+  password: z.string().min(1),
+});
+
+export type LoginWithPasswordRequestDTO = z.infer<typeof LoginWithPasswordRequestSchema>;
diff --git a/modules/identity/src/common/dto/auth/request/logout.request.dto.ts b/modules/identity/src/common/dto/auth/request/logout.request.dto.ts
new file mode 100644
index 00000000..bbddd63e
--- /dev/null
+++ b/modules/identity/src/common/dto/auth/request/logout.request.dto.ts
@@ -0,0 +1,8 @@
+import { z } from "zod/v4";
+
+export const LogoutRequestSchema = z.object({
+  refresh_token: z.string().min(1).optional(),
+  all_sessions: z.boolean().optional(),
+});
+
+export type LogoutRequestDTO = z.infer<typeof LogoutRequestSchema>;
diff --git a/modules/identity/src/common/dto/auth/request/refresh-session.request.dto.ts b/modules/identity/src/common/dto/auth/request/refresh-session.request.dto.ts
new file mode 100644
index 00000000..3f6c2f71
--- /dev/null
+++ b/modules/identity/src/common/dto/auth/request/refresh-session.request.dto.ts
@@ -0,0 +1,7 @@
+import { z } from "zod/v4";
+
+export const RefreshSessionRequestSchema = z.object({
+  refresh_token: z.string().min(1),
+});
+
+export type RefreshSessionRequestDTO = z.infer<typeof RefreshSessionRequestSchema>;
diff --git a/modules/identity/src/common/dto/auth/response/current-session.response.dto.ts b/modules/identity/src/common/dto/auth/response/current-session.response.dto.ts
new file mode 100644
index 00000000..1a1f8271
--- /dev/null
+++ b/modules/identity/src/common/dto/auth/response/current-session.response.dto.ts
@@ -0,0 +1,9 @@
+import { z } from "zod/v4";
+
+import { AuthenticatedAccountSchema } from "../shared";
+
+export const CurrentSessionResponseSchema = z.object({
+  account: AuthenticatedAccountSchema,
+});
+
+export type CurrentSessionResponseDTO = z.infer<typeof CurrentSessionResponseSchema>;
diff --git a/modules/identity/src/common/dto/auth/response/index.ts b/modules/identity/src/common/dto/auth/response/index.ts
new file mode 100644
index 00000000..6a7491a1
--- /dev/null
+++ b/modules/identity/src/common/dto/auth/response/index.ts
@@ -0,0 +1,4 @@
+export * from "./current-session.response.dto";
+export * from "./login-with-password.response.dto";
+export * from "./logout.response.dto";
+export * from "./refresh-session.response.dto";
diff --git a/modules/identity/src/common/dto/auth/response/login-with-password.response.dto.ts b/modules/identity/src/common/dto/auth/response/login-with-password.response.dto.ts
new file mode 100644
index 00000000..eb48ffaa
--- /dev/null
+++ b/modules/identity/src/common/dto/auth/response/login-with-password.response.dto.ts
@@ -0,0 +1,11 @@
+import { z } from "zod/v4";
+
+import { AuthenticatedAccountSchema } from "../shared";
+
+export const LoginWithPasswordResponseSchema = z.object({
+  access_token: z.string(),
+  refresh_token: z.string(),
+  account: AuthenticatedAccountSchema,
+});
+
+export type LoginWithPasswordResponseDTO = z.infer<typeof LoginWithPasswordResponseSchema>;
diff --git a/modules/identity/src/common/dto/auth/response/logout.response.dto.ts b/modules/identity/src/common/dto/auth/response/logout.response.dto.ts
new file mode 100644
index 00000000..833a570a
--- /dev/null
+++ b/modules/identity/src/common/dto/auth/response/logout.response.dto.ts
@@ -0,0 +1,7 @@
+import { z } from "zod/v4";
+
+export const LogoutResponseSchema = z.object({
+  success: z.literal(true),
+});
+
+export type LogoutResponseDTO = z.infer<typeof LogoutResponseSchema>;
diff --git a/modules/identity/src/common/dto/auth/response/refresh-session.response.dto.ts b/modules/identity/src/common/dto/auth/response/refresh-session.response.dto.ts
new file mode 100644
index 00000000..00c28d97
--- /dev/null
+++ b/modules/identity/src/common/dto/auth/response/refresh-session.response.dto.ts
@@ -0,0 +1,8 @@
+import { z } from "zod/v4";
+
+export const RefreshSessionResponseSchema = z.object({
+  access_token: z.string(),
+  refresh_token: z.string(),
+});
+
+export type RefreshSessionResponseDTO = z.infer<typeof RefreshSessionResponseSchema>;
diff --git a/modules/identity/src/common/dto/auth/shared/auth-company-summary.dto.ts b/modules/identity/src/common/dto/auth/shared/auth-company-summary.dto.ts
new file mode 100644
index 00000000..9abbd9ff
--- /dev/null
+++ b/modules/identity/src/common/dto/auth/shared/auth-company-summary.dto.ts
@@ -0,0 +1,9 @@
+import { z } from "zod/v4";
+
+export const AuthCompanySummarySchema = z.object({
+  id: z.uuid(),
+  name: z.string(),
+  role_codes: z.array(z.string()),
+});
+
+export type AuthCompanySummaryDTO = z.infer<typeof AuthCompanySummarySchema>;
diff --git a/modules/identity/src/common/dto/auth/shared/authenticated-account.dto.ts b/modules/identity/src/common/dto/auth/shared/authenticated-account.dto.ts
new file mode 100644
index 00000000..3b8f99bb
--- /dev/null
+++ b/modules/identity/src/common/dto/auth/shared/authenticated-account.dto.ts
@@ -0,0 +1,12 @@
+import { EmailSchema, LanguageCodeSchema, URLSchema } from "@erp/core";
+import { z } from "zod/v4";
+
+export const AuthenticatedAccountSchema = z.object({
+  id: z.uuid(),
+  email: EmailSchema,
+  name: z.string(),
+  avatar_url: URLSchema.nullable(),
+  language_code: LanguageCodeSchema,
+});
+
+export type AuthenticatedAccountDTO = z.infer<typeof AuthenticatedAccountSchema>;
diff --git a/modules/identity/src/common/dto/auth/shared/index.ts b/modules/identity/src/common/dto/auth/shared/index.ts
new file mode 100644
index 00000000..7edbfb40
--- /dev/null
+++ b/modules/identity/src/common/dto/auth/shared/index.ts
@@ -0,0 +1,2 @@
+export * from "./auth-company-summary.dto";
+export * from "./authenticated-account.dto";
diff --git a/modules/identity/src/common/dto/companies/index.ts b/modules/identity/src/common/dto/companies/index.ts
new file mode 100644
index 00000000..32497d2a
--- /dev/null
+++ b/modules/identity/src/common/dto/companies/index.ts
@@ -0,0 +1,3 @@
+export * from "./request";
+export * from "./response";
+export * from "./shared";
diff --git a/modules/identity/src/common/dto/companies/request/create-company.request.dto.ts b/modules/identity/src/common/dto/companies/request/create-company.request.dto.ts
new file mode 100644
index 00000000..b6ea5a83
--- /dev/null
+++ b/modules/identity/src/common/dto/companies/request/create-company.request.dto.ts
@@ -0,0 +1,9 @@
+import { z } from "zod/v4";
+
+export const CreateCompanyRequestSchema = z.object({
+  legal_name: z.string().min(1),
+  trade_name: z.string().min(1).optional(),
+  tin: z.string().min(1).optional(),
+});
+
+export type CreateCompanyRequestDTO = z.infer<typeof CreateCompanyRequestSchema>;
diff --git a/modules/identity/src/common/dto/companies/request/index.ts b/modules/identity/src/common/dto/companies/request/index.ts
new file mode 100644
index 00000000..97be7597
--- /dev/null
+++ b/modules/identity/src/common/dto/companies/request/index.ts
@@ -0,0 +1,2 @@
+export * from "./create-company.request.dto";
+export * from "./update-current-company.request.dto";
diff --git a/modules/identity/src/common/dto/companies/request/update-current-company.request.dto.ts b/modules/identity/src/common/dto/companies/request/update-current-company.request.dto.ts
new file mode 100644
index 00000000..7bd0b3b4
--- /dev/null
+++ b/modules/identity/src/common/dto/companies/request/update-current-company.request.dto.ts
@@ -0,0 +1,9 @@
+import { z } from "zod/v4";
+
+export const UpdateCurrentCompanyRequestSchema = z.object({
+  legal_name: z.string().min(1).optional(),
+  trade_name: z.string().min(1).nullable().optional(),
+  tin: z.string().min(1).nullable().optional(),
+});
+
+export type UpdateCurrentCompanyRequestDTO = z.infer<typeof UpdateCurrentCompanyRequestSchema>;
diff --git a/modules/identity/src/common/dto/companies/response/create-company.response.dto.ts b/modules/identity/src/common/dto/companies/response/create-company.response.dto.ts
new file mode 100644
index 00000000..410a1924
--- /dev/null
+++ b/modules/identity/src/common/dto/companies/response/create-company.response.dto.ts
@@ -0,0 +1,9 @@
+import { z } from "zod/v4";
+
+import { CompanyDetailSchema } from "../shared";
+
+export const CreateCompanyResponseSchema = z.object({
+  company: CompanyDetailSchema,
+});
+
+export type CreateCompanyResponseDTO = z.infer<typeof CreateCompanyResponseSchema>;
diff --git a/modules/identity/src/common/dto/companies/response/get-current-company.response.dto.ts b/modules/identity/src/common/dto/companies/response/get-current-company.response.dto.ts
new file mode 100644
index 00000000..f0a0cd01
--- /dev/null
+++ b/modules/identity/src/common/dto/companies/response/get-current-company.response.dto.ts
@@ -0,0 +1,9 @@
+import { z } from "zod/v4";
+
+import { CompanyDetailSchema } from "../shared";
+
+export const GetCurrentCompanyResponseSchema = z.object({
+  company: CompanyDetailSchema,
+});
+
+export type GetCurrentCompanyResponseDTO = z.infer<typeof GetCurrentCompanyResponseSchema>;
diff --git a/modules/identity/src/common/dto/companies/response/index.ts b/modules/identity/src/common/dto/companies/response/index.ts
new file mode 100644
index 00000000..d073f1c5
--- /dev/null
+++ b/modules/identity/src/common/dto/companies/response/index.ts
@@ -0,0 +1,4 @@
+export * from "./create-company.response.dto";
+export * from "./get-current-company.response.dto";
+export * from "./list-accessible-companies.response.dto";
+export * from "./update-current-company.response.dto";
diff --git a/modules/identity/src/common/dto/companies/response/list-accessible-companies.response.dto.ts b/modules/identity/src/common/dto/companies/response/list-accessible-companies.response.dto.ts
new file mode 100644
index 00000000..e4bd59ce
--- /dev/null
+++ b/modules/identity/src/common/dto/companies/response/list-accessible-companies.response.dto.ts
@@ -0,0 +1,11 @@
+import { z } from "zod/v4";
+
+import { CompanySummarySchema } from "../shared";
+
+export const ListAccessibleCompaniesResponseSchema = z.object({
+  companies: z.array(CompanySummarySchema),
+});
+
+export type ListAccessibleCompaniesResponseDTO = z.infer<
+  typeof ListAccessibleCompaniesResponseSchema
+>;
diff --git a/modules/identity/src/common/dto/companies/response/update-current-company.response.dto.ts b/modules/identity/src/common/dto/companies/response/update-current-company.response.dto.ts
new file mode 100644
index 00000000..a718501d
--- /dev/null
+++ b/modules/identity/src/common/dto/companies/response/update-current-company.response.dto.ts
@@ -0,0 +1,11 @@
+import { z } from "zod/v4";
+
+import { CompanyDetailSchema } from "../shared";
+
+export const UpdateCurrentCompanyResponseSchema = z.object({
+  company: CompanyDetailSchema,
+});
+
+export type UpdateCurrentCompanyResponseDTO = z.infer<
+  typeof UpdateCurrentCompanyResponseSchema
+>;
diff --git a/modules/identity/src/common/dto/companies/shared/company-detail.dto.ts b/modules/identity/src/common/dto/companies/shared/company-detail.dto.ts
new file mode 100644
index 00000000..7d7f402d
--- /dev/null
+++ b/modules/identity/src/common/dto/companies/shared/company-detail.dto.ts
@@ -0,0 +1,14 @@
+import { OffsetDateTimeSchema } from "@erp/core";
+import { z } from "zod/v4";
+
+export const CompanyDetailSchema = z.object({
+  id: z.uuid(),
+  legal_name: z.string(),
+  trade_name: z.string().nullable(),
+  tin: z.string().nullable(),
+  status: z.enum(["active", "disabled"]),
+  created_at: OffsetDateTimeSchema,
+  updated_at: OffsetDateTimeSchema,
+});
+
+export type CompanyDetailDTO = z.infer<typeof CompanyDetailSchema>;
diff --git a/modules/identity/src/common/dto/companies/shared/company-summary.dto.ts b/modules/identity/src/common/dto/companies/shared/company-summary.dto.ts
new file mode 100644
index 00000000..9b708dd6
--- /dev/null
+++ b/modules/identity/src/common/dto/companies/shared/company-summary.dto.ts
@@ -0,0 +1,10 @@
+import { z } from "zod/v4";
+
+export const CompanySummarySchema = z.object({
+  id: z.uuid(),
+  name: z.string(),
+  role_codes: z.array(z.string()),
+  membership_status: z.enum(["active", "disabled", "invited"]),
+});
+
+export type CompanySummaryDTO = z.infer<typeof CompanySummarySchema>;
diff --git a/modules/identity/src/common/dto/companies/shared/index.ts b/modules/identity/src/common/dto/companies/shared/index.ts
new file mode 100644
index 00000000..85aeb783
--- /dev/null
+++ b/modules/identity/src/common/dto/companies/shared/index.ts
@@ -0,0 +1,2 @@
+export * from "./company-detail.dto";
+export * from "./company-summary.dto";
diff --git a/modules/identity/src/common/dto/company-users/index.ts b/modules/identity/src/common/dto/company-users/index.ts
new file mode 100644
index 00000000..32497d2a
--- /dev/null
+++ b/modules/identity/src/common/dto/company-users/index.ts
@@ -0,0 +1,3 @@
+export * from "./request";
+export * from "./response";
+export * from "./shared";
diff --git a/modules/identity/src/common/dto/company-users/request/disable-company-user.request.dto.ts b/modules/identity/src/common/dto/company-users/request/disable-company-user.request.dto.ts
new file mode 100644
index 00000000..020b65ea
--- /dev/null
+++ b/modules/identity/src/common/dto/company-users/request/disable-company-user.request.dto.ts
@@ -0,0 +1,7 @@
+import { z } from "zod/v4";
+
+export const DisableCompanyUserParamsSchema = z.object({
+  account_id: z.uuid(),
+});
+
+export type DisableCompanyUserParamsDTO = z.infer<typeof DisableCompanyUserParamsSchema>;
diff --git a/modules/identity/src/common/dto/company-users/request/enable-company-user.request.dto.ts b/modules/identity/src/common/dto/company-users/request/enable-company-user.request.dto.ts
new file mode 100644
index 00000000..f08e2a6e
--- /dev/null
+++ b/modules/identity/src/common/dto/company-users/request/enable-company-user.request.dto.ts
@@ -0,0 +1,7 @@
+import { z } from "zod/v4";
+
+export const EnableCompanyUserParamsSchema = z.object({
+  account_id: z.uuid(),
+});
+
+export type EnableCompanyUserParamsDTO = z.infer<typeof EnableCompanyUserParamsSchema>;
diff --git a/modules/identity/src/common/dto/company-users/request/index.ts b/modules/identity/src/common/dto/company-users/request/index.ts
new file mode 100644
index 00000000..53b65c1d
--- /dev/null
+++ b/modules/identity/src/common/dto/company-users/request/index.ts
@@ -0,0 +1,3 @@
+export * from "./disable-company-user.request.dto";
+export * from "./enable-company-user.request.dto";
+export * from "./update-company-user-roles.request.dto";
diff --git a/modules/identity/src/common/dto/company-users/request/update-company-user-roles.request.dto.ts b/modules/identity/src/common/dto/company-users/request/update-company-user-roles.request.dto.ts
new file mode 100644
index 00000000..e71afb63
--- /dev/null
+++ b/modules/identity/src/common/dto/company-users/request/update-company-user-roles.request.dto.ts
@@ -0,0 +1,14 @@
+import { z } from "zod/v4";
+
+export const UpdateCompanyUserRolesParamsSchema = z.object({
+  account_id: z.uuid(),
+});
+
+export const UpdateCompanyUserRolesBodySchema = z.object({
+  role_ids: z.array(z.uuid()).min(1),
+});
+
+export type UpdateCompanyUserRolesParamsDTO = z.infer<
+  typeof UpdateCompanyUserRolesParamsSchema
+>;
+export type UpdateCompanyUserRolesBodyDTO = z.infer<typeof UpdateCompanyUserRolesBodySchema>;
diff --git a/modules/identity/src/common/dto/company-users/response/disable-company-user.response.dto.ts b/modules/identity/src/common/dto/company-users/response/disable-company-user.response.dto.ts
new file mode 100644
index 00000000..c56a87a3
--- /dev/null
+++ b/modules/identity/src/common/dto/company-users/response/disable-company-user.response.dto.ts
@@ -0,0 +1,9 @@
+import { z } from "zod/v4";
+
+import { CompanyUserSummarySchema } from "../shared";
+
+export const DisableCompanyUserResponseSchema = z.object({
+  user: CompanyUserSummarySchema,
+});
+
+export type DisableCompanyUserResponseDTO = z.infer<typeof DisableCompanyUserResponseSchema>;
diff --git a/modules/identity/src/common/dto/company-users/response/enable-company-user.response.dto.ts b/modules/identity/src/common/dto/company-users/response/enable-company-user.response.dto.ts
new file mode 100644
index 00000000..7c9987c0
--- /dev/null
+++ b/modules/identity/src/common/dto/company-users/response/enable-company-user.response.dto.ts
@@ -0,0 +1,9 @@
+import { z } from "zod/v4";
+
+import { CompanyUserSummarySchema } from "../shared";
+
+export const EnableCompanyUserResponseSchema = z.object({
+  user: CompanyUserSummarySchema,
+});
+
+export type EnableCompanyUserResponseDTO = z.infer<typeof EnableCompanyUserResponseSchema>;
diff --git a/modules/identity/src/common/dto/company-users/response/index.ts b/modules/identity/src/common/dto/company-users/response/index.ts
new file mode 100644
index 00000000..999f5619
--- /dev/null
+++ b/modules/identity/src/common/dto/company-users/response/index.ts
@@ -0,0 +1,4 @@
+export * from "./disable-company-user.response.dto";
+export * from "./enable-company-user.response.dto";
+export * from "./list-company-users.response.dto";
+export * from "./update-company-user-roles.response.dto";
diff --git a/modules/identity/src/common/dto/company-users/response/list-company-users.response.dto.ts b/modules/identity/src/common/dto/company-users/response/list-company-users.response.dto.ts
new file mode 100644
index 00000000..87b9dfdc
--- /dev/null
+++ b/modules/identity/src/common/dto/company-users/response/list-company-users.response.dto.ts
@@ -0,0 +1,9 @@
+import { z } from "zod/v4";
+
+import { CompanyUserSummarySchema } from "../shared";
+
+export const ListCompanyUsersResponseSchema = z.object({
+  users: z.array(CompanyUserSummarySchema),
+});
+
+export type ListCompanyUsersResponseDTO = z.infer<typeof ListCompanyUsersResponseSchema>;
diff --git a/modules/identity/src/common/dto/company-users/response/update-company-user-roles.response.dto.ts b/modules/identity/src/common/dto/company-users/response/update-company-user-roles.response.dto.ts
new file mode 100644
index 00000000..ec1bb1fd
--- /dev/null
+++ b/modules/identity/src/common/dto/company-users/response/update-company-user-roles.response.dto.ts
@@ -0,0 +1,11 @@
+import { z } from "zod/v4";
+
+import { CompanyUserSummarySchema } from "../shared";
+
+export const UpdateCompanyUserRolesResponseSchema = z.object({
+  user: CompanyUserSummarySchema,
+});
+
+export type UpdateCompanyUserRolesResponseDTO = z.infer<
+  typeof UpdateCompanyUserRolesResponseSchema
+>;
diff --git a/modules/identity/src/common/dto/company-users/shared/company-user-summary.dto.ts b/modules/identity/src/common/dto/company-users/shared/company-user-summary.dto.ts
new file mode 100644
index 00000000..b5468e1a
--- /dev/null
+++ b/modules/identity/src/common/dto/company-users/shared/company-user-summary.dto.ts
@@ -0,0 +1,16 @@
+import { EmailSchema, OffsetDateTimeSchema, URLSchema } from "@erp/core";
+import { z } from "zod/v4";
+
+export const CompanyUserSummarySchema = z.object({
+  account_id: z.uuid(),
+  email: EmailSchema,
+  name: z.string(),
+  avatar_url: URLSchema.nullable(),
+  membership_status: z.enum(["active", "disabled", "invited"]),
+  role_ids: z.array(z.uuid()),
+  role_codes: z.array(z.string()),
+  created_at: OffsetDateTimeSchema,
+  updated_at: OffsetDateTimeSchema,
+});
+
+export type CompanyUserSummaryDTO = z.infer<typeof CompanyUserSummarySchema>;
diff --git a/modules/identity/src/common/dto/company-users/shared/index.ts b/modules/identity/src/common/dto/company-users/shared/index.ts
new file mode 100644
index 00000000..9fc1667c
--- /dev/null
+++ b/modules/identity/src/common/dto/company-users/shared/index.ts
@@ -0,0 +1 @@
+export * from "./company-user-summary.dto";
diff --git a/modules/identity/src/common/dto/index.ts b/modules/identity/src/common/dto/index.ts
new file mode 100644
index 00000000..07954546
--- /dev/null
+++ b/modules/identity/src/common/dto/index.ts
@@ -0,0 +1,6 @@
+export * from "./account";
+export * from "./auth";
+export * from "./companies";
+export * from "./company-users";
+export * from "./permissions";
+export * from "./roles";
diff --git a/modules/identity/src/common/dto/permissions/index.ts b/modules/identity/src/common/dto/permissions/index.ts
new file mode 100644
index 00000000..fab6c07b
--- /dev/null
+++ b/modules/identity/src/common/dto/permissions/index.ts
@@ -0,0 +1,2 @@
+export * from "./response";
+export * from "./shared";
diff --git a/modules/identity/src/common/dto/permissions/response/index.ts b/modules/identity/src/common/dto/permissions/response/index.ts
new file mode 100644
index 00000000..f7472ca2
--- /dev/null
+++ b/modules/identity/src/common/dto/permissions/response/index.ts
@@ -0,0 +1,2 @@
+export * from "./list-current-user-permissions.response.dto";
+export * from "./list-permissions.response.dto";
diff --git a/modules/identity/src/common/dto/permissions/response/list-current-user-permissions.response.dto.ts b/modules/identity/src/common/dto/permissions/response/list-current-user-permissions.response.dto.ts
new file mode 100644
index 00000000..95a092b6
--- /dev/null
+++ b/modules/identity/src/common/dto/permissions/response/list-current-user-permissions.response.dto.ts
@@ -0,0 +1,9 @@
+import { z } from "zod/v4";
+
+export const ListCurrentUserPermissionsResponseSchema = z.object({
+  permission_codes: z.array(z.string()),
+});
+
+export type ListCurrentUserPermissionsResponseDTO = z.infer<
+  typeof ListCurrentUserPermissionsResponseSchema
+>;
diff --git a/modules/identity/src/common/dto/permissions/response/list-permissions.response.dto.ts b/modules/identity/src/common/dto/permissions/response/list-permissions.response.dto.ts
new file mode 100644
index 00000000..594a2d78
--- /dev/null
+++ b/modules/identity/src/common/dto/permissions/response/list-permissions.response.dto.ts
@@ -0,0 +1,9 @@
+import { z } from "zod/v4";
+
+import { PermissionDefinitionSchema } from "../shared";
+
+export const ListPermissionsResponseSchema = z.object({
+  permissions: z.array(PermissionDefinitionSchema),
+});
+
+export type ListPermissionsResponseDTO = z.infer<typeof ListPermissionsResponseSchema>;
diff --git a/modules/identity/src/common/dto/permissions/shared/index.ts b/modules/identity/src/common/dto/permissions/shared/index.ts
new file mode 100644
index 00000000..8c9c6cce
--- /dev/null
+++ b/modules/identity/src/common/dto/permissions/shared/index.ts
@@ -0,0 +1 @@
+export * from "./permission-definition.dto";
diff --git a/modules/identity/src/common/dto/permissions/shared/permission-definition.dto.ts b/modules/identity/src/common/dto/permissions/shared/permission-definition.dto.ts
new file mode 100644
index 00000000..7bf3ad0c
--- /dev/null
+++ b/modules/identity/src/common/dto/permissions/shared/permission-definition.dto.ts
@@ -0,0 +1,9 @@
+import { z } from "zod/v4";
+
+export const PermissionDefinitionSchema = z.object({
+  code: z.string(),
+  module: z.string(),
+  description: z.string(),
+});
+
+export type PermissionDefinitionDTO = z.infer<typeof PermissionDefinitionSchema>;
diff --git a/modules/identity/src/common/dto/roles/index.ts b/modules/identity/src/common/dto/roles/index.ts
new file mode 100644
index 00000000..32497d2a
--- /dev/null
+++ b/modules/identity/src/common/dto/roles/index.ts
@@ -0,0 +1,3 @@
+export * from "./request";
+export * from "./response";
+export * from "./shared";
diff --git a/modules/identity/src/common/dto/roles/request/create-company-role.request.dto.ts b/modules/identity/src/common/dto/roles/request/create-company-role.request.dto.ts
new file mode 100644
index 00000000..9ba3ea88
--- /dev/null
+++ b/modules/identity/src/common/dto/roles/request/create-company-role.request.dto.ts
@@ -0,0 +1,11 @@
+import { z } from "zod/v4";
+
+import { PermissionCodeSchema } from "../shared";
+
+export const CreateCompanyRoleRequestSchema = z.object({
+  code: z.string().min(1),
+  name: z.string().min(1),
+  permission_codes: z.array(PermissionCodeSchema).min(1),
+});
+
+export type CreateCompanyRoleRequestDTO = z.infer<typeof CreateCompanyRoleRequestSchema>;
diff --git a/modules/identity/src/common/dto/roles/request/delete-company-role-by-id.request.dto.ts b/modules/identity/src/common/dto/roles/request/delete-company-role-by-id.request.dto.ts
new file mode 100644
index 00000000..4b1a2823
--- /dev/null
+++ b/modules/identity/src/common/dto/roles/request/delete-company-role-by-id.request.dto.ts
@@ -0,0 +1,9 @@
+import { z } from "zod/v4";
+
+export const DeleteCompanyRoleByIdRequestSchema = z.object({
+  role_id: z.uuid(),
+});
+
+export type DeleteCompanyRoleByIdRequestDTO = z.infer<
+  typeof DeleteCompanyRoleByIdRequestSchema
+>;
diff --git a/modules/identity/src/common/dto/roles/request/get-company-role-by-id.request.dto.ts b/modules/identity/src/common/dto/roles/request/get-company-role-by-id.request.dto.ts
new file mode 100644
index 00000000..5c9d9c2c
--- /dev/null
+++ b/modules/identity/src/common/dto/roles/request/get-company-role-by-id.request.dto.ts
@@ -0,0 +1,7 @@
+import { z } from "zod/v4";
+
+export const GetCompanyRoleByIdRequestSchema = z.object({
+  role_id: z.uuid(),
+});
+
+export type GetCompanyRoleByIdRequestDTO = z.infer<typeof GetCompanyRoleByIdRequestSchema>;
diff --git a/modules/identity/src/common/dto/roles/request/index.ts b/modules/identity/src/common/dto/roles/request/index.ts
new file mode 100644
index 00000000..7e015781
--- /dev/null
+++ b/modules/identity/src/common/dto/roles/request/index.ts
@@ -0,0 +1,4 @@
+export * from "./create-company-role.request.dto";
+export * from "./delete-company-role-by-id.request.dto";
+export * from "./get-company-role-by-id.request.dto";
+export * from "./update-company-role-by-id.request.dto";
diff --git a/modules/identity/src/common/dto/roles/request/update-company-role-by-id.request.dto.ts b/modules/identity/src/common/dto/roles/request/update-company-role-by-id.request.dto.ts
new file mode 100644
index 00000000..c9df3de7
--- /dev/null
+++ b/modules/identity/src/common/dto/roles/request/update-company-role-by-id.request.dto.ts
@@ -0,0 +1,15 @@
+import { z } from "zod/v4";
+
+import { PermissionCodeSchema } from "../shared";
+
+export const UpdateCompanyRoleByIdParamsSchema = z.object({
+  role_id: z.uuid(),
+});
+
+export const UpdateCompanyRoleByIdBodySchema = z.object({
+  name: z.string().min(1).optional(),
+  permission_codes: z.array(PermissionCodeSchema).min(1).optional(),
+});
+
+export type UpdateCompanyRoleByIdParamsDTO = z.infer<typeof UpdateCompanyRoleByIdParamsSchema>;
+export type UpdateCompanyRoleByIdBodyDTO = z.infer<typeof UpdateCompanyRoleByIdBodySchema>;
diff --git a/modules/identity/src/common/dto/roles/response/create-company-role.response.dto.ts b/modules/identity/src/common/dto/roles/response/create-company-role.response.dto.ts
new file mode 100644
index 00000000..a6ceb12a
--- /dev/null
+++ b/modules/identity/src/common/dto/roles/response/create-company-role.response.dto.ts
@@ -0,0 +1,9 @@
+import { z } from "zod/v4";
+
+import { RoleDetailSchema } from "../shared";
+
+export const CreateCompanyRoleResponseSchema = z.object({
+  role: RoleDetailSchema,
+});
+
+export type CreateCompanyRoleResponseDTO = z.infer<typeof CreateCompanyRoleResponseSchema>;
diff --git a/modules/identity/src/common/dto/roles/response/delete-company-role-by-id.response.dto.ts b/modules/identity/src/common/dto/roles/response/delete-company-role-by-id.response.dto.ts
new file mode 100644
index 00000000..f2eb7f96
--- /dev/null
+++ b/modules/identity/src/common/dto/roles/response/delete-company-role-by-id.response.dto.ts
@@ -0,0 +1,9 @@
+import { z } from "zod/v4";
+
+export const DeleteCompanyRoleByIdResponseSchema = z.object({
+  success: z.literal(true),
+});
+
+export type DeleteCompanyRoleByIdResponseDTO = z.infer<
+  typeof DeleteCompanyRoleByIdResponseSchema
+>;
diff --git a/modules/identity/src/common/dto/roles/response/get-company-role-by-id.response.dto.ts b/modules/identity/src/common/dto/roles/response/get-company-role-by-id.response.dto.ts
new file mode 100644
index 00000000..ccd09694
--- /dev/null
+++ b/modules/identity/src/common/dto/roles/response/get-company-role-by-id.response.dto.ts
@@ -0,0 +1,9 @@
+import { z } from "zod/v4";
+
+import { RoleDetailSchema } from "../shared";
+
+export const GetCompanyRoleByIdResponseSchema = z.object({
+  role: RoleDetailSchema,
+});
+
+export type GetCompanyRoleByIdResponseDTO = z.infer<typeof GetCompanyRoleByIdResponseSchema>;
diff --git a/modules/identity/src/common/dto/roles/response/index.ts b/modules/identity/src/common/dto/roles/response/index.ts
new file mode 100644
index 00000000..404fa392
--- /dev/null
+++ b/modules/identity/src/common/dto/roles/response/index.ts
@@ -0,0 +1,5 @@
+export * from "./create-company-role.response.dto";
+export * from "./delete-company-role-by-id.response.dto";
+export * from "./get-company-role-by-id.response.dto";
+export * from "./list-company-roles.response.dto";
+export * from "./update-company-role-by-id.response.dto";
diff --git a/modules/identity/src/common/dto/roles/response/list-company-roles.response.dto.ts b/modules/identity/src/common/dto/roles/response/list-company-roles.response.dto.ts
new file mode 100644
index 00000000..977285d2
--- /dev/null
+++ b/modules/identity/src/common/dto/roles/response/list-company-roles.response.dto.ts
@@ -0,0 +1,9 @@
+import { z } from "zod/v4";
+
+import { RoleSummarySchema } from "../shared";
+
+export const ListCompanyRolesResponseSchema = z.object({
+  roles: z.array(RoleSummarySchema),
+});
+
+export type ListCompanyRolesResponseDTO = z.infer<typeof ListCompanyRolesResponseSchema>;
diff --git a/modules/identity/src/common/dto/roles/response/update-company-role-by-id.response.dto.ts b/modules/identity/src/common/dto/roles/response/update-company-role-by-id.response.dto.ts
new file mode 100644
index 00000000..98ccbd3b
--- /dev/null
+++ b/modules/identity/src/common/dto/roles/response/update-company-role-by-id.response.dto.ts
@@ -0,0 +1,11 @@
+import { z } from "zod/v4";
+
+import { RoleDetailSchema } from "../shared";
+
+export const UpdateCompanyRoleByIdResponseSchema = z.object({
+  role: RoleDetailSchema,
+});
+
+export type UpdateCompanyRoleByIdResponseDTO = z.infer<
+  typeof UpdateCompanyRoleByIdResponseSchema
+>;
diff --git a/modules/identity/src/common/dto/roles/shared/index.ts b/modules/identity/src/common/dto/roles/shared/index.ts
new file mode 100644
index 00000000..9c582816
--- /dev/null
+++ b/modules/identity/src/common/dto/roles/shared/index.ts
@@ -0,0 +1,2 @@
+export * from "./permission-code.dto";
+export * from "./role-summary.dto";
diff --git a/modules/identity/src/common/dto/roles/shared/permission-code.dto.ts b/modules/identity/src/common/dto/roles/shared/permission-code.dto.ts
new file mode 100644
index 00000000..6444128e
--- /dev/null
+++ b/modules/identity/src/common/dto/roles/shared/permission-code.dto.ts
@@ -0,0 +1,5 @@
+import { z } from "zod/v4";
+
+export const PermissionCodeSchema = z.string().min(1);
+
+export type PermissionCodeDTO = z.infer<typeof PermissionCodeSchema>;
diff --git a/modules/identity/src/common/dto/roles/shared/role-summary.dto.ts b/modules/identity/src/common/dto/roles/shared/role-summary.dto.ts
new file mode 100644
index 00000000..f5994c4e
--- /dev/null
+++ b/modules/identity/src/common/dto/roles/shared/role-summary.dto.ts
@@ -0,0 +1,19 @@
+import { OffsetDateTimeSchema } from "@erp/core";
+import { z } from "zod/v4";
+
+import { PermissionCodeSchema } from "./permission-code.dto";
+
+export const RoleSummarySchema = z.object({
+  id: z.uuid(),
+  code: z.string(),
+  name: z.string(),
+  permission_codes: z.array(PermissionCodeSchema),
+  is_system: z.boolean(),
+  created_at: OffsetDateTimeSchema,
+  updated_at: OffsetDateTimeSchema,
+});
+
+export const RoleDetailSchema = RoleSummarySchema;
+
+export type RoleSummaryDTO = z.infer<typeof RoleSummarySchema>;
+export type RoleDetailDTO = z.infer<typeof RoleDetailSchema>;
diff --git a/modules/identity/src/common/index.ts b/modules/identity/src/common/index.ts
new file mode 100644
index 00000000..8f46be8f
--- /dev/null
+++ b/modules/identity/src/common/index.ts
@@ -0,0 +1,2 @@
+export * from "./dto";
+export * from "./permissions";
diff --git a/modules/identity/src/common/permissions/index.ts b/modules/identity/src/common/permissions/index.ts
new file mode 100644
index 00000000..60fd25bd
--- /dev/null
+++ b/modules/identity/src/common/permissions/index.ts
@@ -0,0 +1 @@
+export * from "./permission-codes";
diff --git a/modules/identity/src/common/permissions/permission-codes.ts b/modules/identity/src/common/permissions/permission-codes.ts
new file mode 100644
index 00000000..7712f036
--- /dev/null
+++ b/modules/identity/src/common/permissions/permission-codes.ts
@@ -0,0 +1,70 @@
+import type { PermissionDefinition } from "@erp/core";
+
+export const IdentityPermissionCodes = {
+  CompaniesUpdate: "identity:companies:update",
+  RolesRead: "identity:roles:read",
+  RolesCreate: "identity:roles:create",
+  RolesUpdate: "identity:roles:update",
+  RolesDelete: "identity:roles:delete",
+  CompanyUsersRead: "identity:company-users:read",
+  CompanyUsersUpdateRoles: "identity:company-users:update-roles",
+  CompanyUsersDisable: "identity:company-users:disable",
+  CompanyUsersEnable: "identity:company-users:enable",
+  PermissionsRead: "identity:permissions:read",
+} as const;
+
+export type IdentityPermissionCode =
+  (typeof IdentityPermissionCodes)[keyof typeof IdentityPermissionCodes];
+
+export const identityPermissionDefinitions = [
+  {
+    code: IdentityPermissionCodes.CompaniesUpdate,
+    module: "identity",
+    description: "Update current company settings.",
+  },
+  {
+    code: IdentityPermissionCodes.RolesRead,
+    module: "identity",
+    description: "Read company roles.",
+  },
+  {
+    code: IdentityPermissionCodes.RolesCreate,
+    module: "identity",
+    description: "Create company roles.",
+  },
+  {
+    code: IdentityPermissionCodes.RolesUpdate,
+    module: "identity",
+    description: "Update company roles.",
+  },
+  {
+    code: IdentityPermissionCodes.RolesDelete,
+    module: "identity",
+    description: "Delete company roles.",
+  },
+  {
+    code: IdentityPermissionCodes.CompanyUsersRead,
+    module: "identity",
+    description: "Read company users.",
+  },
+  {
+    code: IdentityPermissionCodes.CompanyUsersUpdateRoles,
+    module: "identity",
+    description: "Replace company user roles.",
+  },
+  {
+    code: IdentityPermissionCodes.CompanyUsersDisable,
+    module: "identity",
+    description: "Disable company users.",
+  },
+  {
+    code: IdentityPermissionCodes.CompanyUsersEnable,
+    module: "identity",
+    description: "Enable company users.",
+  },
+  {
+    code: IdentityPermissionCodes.PermissionsRead,
+    module: "identity",
+    description: "Read registered permission definitions.",
+  },
+] satisfies PermissionDefinition[];
diff --git a/modules/identity/tsconfig.json b/modules/identity/tsconfig.json
new file mode 100644
index 00000000..4a12a119
--- /dev/null
+++ b/modules/identity/tsconfig.json
@@ -0,0 +1,26 @@
+{
+  "extends": "../../tsconfig.json",
+  "compilerOptions": {
+    "paths": {
+      "@erp/identity/*": ["./src/*"]
+    },
+    "tsBuildInfoFile": "./node_modules/.tmp/tsconfig.app.tsbuildinfo",
+    "target": "ES2022",
+    "useDefineForClassFields": true,
+    "lib": ["ES2022"],
+    "module": "ESNext",
+    "skipLibCheck": true,
+    "moduleResolution": "bundler",
+    "allowImportingTsExtensions": true,
+    "isolatedModules": true,
+    "moduleDetection": "force",
+    "noEmit": true,
+    "strict": true,
+    "noUnusedLocals": true,
+    "noUnusedParameters": true,
+    "noFallthroughCasesInSwitch": true,
+    "noUncheckedSideEffectImports": true
+  },
+  "include": ["src"],
+  "exclude": ["node_modules"]
+}
diff --git a/modules/supplier-invoices/package.json b/modules/supplier-invoices/package.json
index 04f6ea7a..6cc9b7dc 100644
--- a/modules/supplier-invoices/package.json
+++ b/modules/supplier-invoices/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@erp/supplier-invoices",
   "description": "Supplier invoices",
-  "version": "0.7.6",
+  "version": "0.7.8",
   "private": true,
   "type": "module",
   "sideEffects": false,
diff --git a/modules/supplier/package.json b/modules/supplier/package.json
index 9ac6bd06..ee35ecec 100644
--- a/modules/supplier/package.json
+++ b/modules/supplier/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@erp/suppliers",
   "description": "Suppliers",
-  "version": "0.7.6",
+  "version": "0.7.8",
   "private": true,
   "type": "module",
   "sideEffects": false,
diff --git a/package.json b/package.json
index 66f83ead..09627dc2 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "uecko-erp-2025",
   "private": true,
-  "version": "0.7.6",
+  "version": "0.7.8",
   "workspaces": [
     "apps/*",
     "modules/*",
diff --git a/packages/i18n/package.json b/packages/i18n/package.json
index da4e29c3..15f3c997 100644
--- a/packages/i18n/package.json
+++ b/packages/i18n/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@repo/i18next",
-    "version": "0.7.6",
+    "version": "0.7.8",
     "private": true,
     "type": "module",
     "scripts": {
diff --git a/packages/rdx-criteria/package.json b/packages/rdx-criteria/package.json
index 42d1ab6f..13ae4c51 100644
--- a/packages/rdx-criteria/package.json
+++ b/packages/rdx-criteria/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@repo/rdx-criteria",
-  "version": "0.7.6",
+  "version": "0.7.8",
   "private": true,
   "type": "module",
   "sideEffects": false,
diff --git a/packages/rdx-ddd/package.json b/packages/rdx-ddd/package.json
index e775ce04..1dc774dd 100644
--- a/packages/rdx-ddd/package.json
+++ b/packages/rdx-ddd/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@repo/rdx-ddd",
-  "version": "0.7.6",
+  "version": "0.7.8",
   "private": true,
   "type": "module",
   "sideEffects": false,
diff --git a/packages/rdx-ddd/src/value-objects/index.ts b/packages/rdx-ddd/src/value-objects/index.ts
index 8e6520fc..694dfffa 100644
--- a/packages/rdx-ddd/src/value-objects/index.ts
+++ b/packages/rdx-ddd/src/value-objects/index.ts
@@ -21,4 +21,5 @@ export * from "./tin-number";
 export * from "./unique-id";
 export * from "./url-address";
 export * from "./utc-date";
+export * from "./utc-date-time";
 export * from "./value-object";
diff --git a/packages/rdx-ddd/src/value-objects/language-code.ts b/packages/rdx-ddd/src/value-objects/language-code.ts
index 8f34e388..afdea0a6 100644
--- a/packages/rdx-ddd/src/value-objects/language-code.ts
+++ b/packages/rdx-ddd/src/value-objects/language-code.ts
@@ -1,6 +1,8 @@
 import { Result } from "@repo/rdx-utils";
 import { z } from "zod/v4";
+
 import { translateZodValidationError } from "../helpers";
+
 import { ValueObject } from "./value-object";
 
 interface LanguageCodeProps {
diff --git a/packages/rdx-ddd/src/value-objects/utc-date-time.ts b/packages/rdx-ddd/src/value-objects/utc-date-time.ts
new file mode 100644
index 00000000..ce7f5478
--- /dev/null
+++ b/packages/rdx-ddd/src/value-objects/utc-date-time.ts
@@ -0,0 +1,142 @@
+import { Result } from "@repo/rdx-utils";
+import { z } from "zod/v4";
+
+import { translateZodValidationError } from "../helpers";
+
+import { UtcDate } from "./utc-date";
+import { ValueObject } from "./value-object";
+
+interface UtcDateTimeProps {
+  value: string;
+}
+
+const UTC_DATE_TIME_REGEX = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{3})?Z$/;
+
+export class UtcDateTime extends ValueObject<UtcDateTimeProps> {
+  private readonly timestamp: number;
+
+  private constructor(props: UtcDateTimeProps) {
+    super(props);
+    this.timestamp = Date.parse(props.value);
+  }
+
+  static create(dateTimeString: string): Result<UtcDateTime, Error> {
+    const validation = UtcDateTime.validate(dateTimeString);
+
+    if (!validation.success) {
+      return Result.fail(
+        translateZodValidationError("UtcDateTime creation failed", validation.error)
+      );
+    }
+
+    return Result.ok(new UtcDateTime({ value: validation.data }));
+  }
+
+  static createFromISO(dateTimeString: string): Result<UtcDateTime, Error> {
+    return UtcDateTime.create(dateTimeString);
+  }
+
+  static now(): UtcDateTime {
+    return new UtcDateTime({
+      value: new Date().toISOString(),
+    });
+  }
+
+  static validate(dateTimeString: string) {
+    return z
+      .string()
+      .regex(UTC_DATE_TIME_REGEX, "Invalid UTC ISO 8601 datetime format")
+      .transform((value) => UtcDateTime.normalize(value))
+      .superRefine((value, ctx) => {
+        if (!UtcDateTime.isValidUtcDateTime(value)) {
+          ctx.addIssue({
+            code: "custom",
+            message: "Invalid UTC datetime",
+          });
+        }
+      })
+      .safeParse(dateTimeString);
+  }
+
+  private static normalize(value: string): string {
+    if (value.endsWith(".000Z")) {
+      return value;
+    }
+
+    if (/\.\d{3}Z$/.test(value)) {
+      return value;
+    }
+
+    return value.replace("Z", ".000Z");
+  }
+
+  private static isValidUtcDateTime(value: string): boolean {
+    const date = new Date(value);
+
+    if (Number.isNaN(date.getTime())) {
+      return false;
+    }
+
+    return date.toISOString() === value;
+  }
+
+  getProps(): UtcDateTimeProps {
+    return this.props;
+  }
+
+  toPrimitive(): string {
+    return this.props.value;
+  }
+
+  toISOString(): string {
+    return this.props.value;
+  }
+
+  toString(): string {
+    return this.toISOString();
+  }
+
+  toDate(): Date {
+    return new Date(this.timestamp);
+  }
+
+  toDateString(): string {
+    return this.props.value.slice(0, 10);
+  }
+
+  toEuropeanDateString(): string {
+    const [year, month, day] = this.toDateString().split("-");
+
+    return `${day}/${month}/${year}`;
+  }
+
+  equals(other: UtcDateTime): boolean {
+    return this.timestamp === other.timestamp;
+  }
+
+  isFuture(currentDateTime: UtcDateTime = UtcDateTime.now()): boolean {
+    return this.timestamp > currentDateTime.timestamp;
+  }
+
+  isPast(currentDateTime: UtcDateTime = UtcDateTime.now()): boolean {
+    return this.timestamp < currentDateTime.timestamp;
+  }
+
+  isBefore(other: UtcDateTime): boolean {
+    return this.timestamp < other.timestamp;
+  }
+
+  isAfter(other: UtcDateTime): boolean {
+    return this.timestamp > other.timestamp;
+  }
+
+  toUtcDate(): UtcDate {
+    const dateResult = UtcDate.create(this.toDateString());
+
+    if (dateResult.isFailure) {
+      throw dateResult.error;
+    }
+
+    return dateResult.data;
+  }
+}
diff --git a/packages/rdx-ddd/src/value-objects/utc-date.ts b/packages/rdx-ddd/src/value-objects/utc-date.ts
index 0d92e431..52da5748 100644
--- a/packages/rdx-ddd/src/value-objects/utc-date.ts
+++ b/packages/rdx-ddd/src/value-objects/utc-date.ts
@@ -9,109 +9,134 @@ interface UtcDateProps {
   value: string;
 }
 
+const UTC_DATE_REGEX = /^\d{4}-\d{2}-\d{2}$/;
+
 export class UtcDate extends ValueObject<UtcDateProps> {
-  private readonly date!: Date;
+  private readonly timestamp: number;
 
   private constructor(props: UtcDateProps) {
     super(props);
-    const { value: dateString } = props;
-    this.date = Object.freeze(new Date(dateString));
+    this.timestamp = UtcDate.toTimestamp(props.value);
+  }
+
+  static create(dateString: string): Result<UtcDate, Error> {
+    const validation = UtcDate.validate(dateString);
+
+    if (!validation.success) {
+      return Result.fail(translateZodValidationError("UtcDate creation failed", validation.error));
+    }
+
+    return Result.ok(new UtcDate({ value: validation.data }));
+  }
+
+  static createFromISO(dateString: string): Result<UtcDate, Error> {
+    return UtcDate.create(dateString);
+  }
+
+  static today(): UtcDate {
+    const now = new Date();
+
+    const year = now.getUTCFullYear();
+    const month = String(now.getUTCMonth() + 1).padStart(2, "0");
+    const day = String(now.getUTCDate()).padStart(2, "0");
+
+    return new UtcDate({
+      value: `${year}-${month}-${day}`,
+    });
   }
 
   static validate(dateString: string) {
-    const dateStr = z.union([
-      z.string().regex(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}Z$/, "Invalid ISO 8601 format"),
-      z.string().regex(/^\d{4}-\d{2}-\d{2}$/, "Invalid YYYY-MM-DD format"),
-    ]);
-
-    const dateStrToDate = dateStr.pipe(z.coerce.date());
-
-    return dateStrToDate.safeParse(dateString);
+    return z
+      .string()
+      .regex(UTC_DATE_REGEX, "Invalid YYYY-MM-DD format")
+      .superRefine((value, ctx) => {
+        if (!UtcDate.isValidCalendarDate(value)) {
+          ctx.addIssue({
+            code: "custom",
+            message: "Invalid calendar date",
+          });
+        }
+      })
+      .safeParse(dateString);
   }
 
-  /**
-   * Crea una instancia de UtcDate a partir de un string en formato UTC ISO 8601.
-   * @param isoDateString Fecha en formato UTC (con o sin hora YYYY-MM-DD)
-   * @returns UtcDate si es válida, Error en caso contrario.
-   */
-  static createFromISO(isoDateString: string): Result<UtcDate, Error> {
-    const dateIsValid = UtcDate.validate(isoDateString);
+  private static isValidCalendarDate(value: string): boolean {
+    const [yearRaw, monthRaw, dayRaw] = value.split("-");
 
-    if (!dateIsValid.success) {
-      return Result.fail(translateZodValidationError("UtcDate creation failed", dateIsValid.error));
-    }
+    const year = Number(yearRaw);
+    const month = Number(monthRaw);
+    const day = Number(dayRaw);
 
-    return Result.ok(new UtcDate({ value: isoDateString }));
+    const date = new Date(Date.UTC(year, month - 1, day));
+
+    return (
+      date.getUTCFullYear() === year &&
+      date.getUTCMonth() === month - 1 &&
+      date.getUTCDate() === day
+    );
   }
 
-  /**
-   * Creador estático: devuelve la fecha de HOY en UTC a medianoche (00:00:00Z).
-   * - Evita ambigüedades de zona horaria construyendo el ISO explícitamente.
-   */
-  static today(): UtcDate {
-    const now = new Date();
-    const y = now.getUTCFullYear();
-    const m = String(now.getUTCMonth() + 1).padStart(2, "0");
-    const d = String(now.getUTCDate()).padStart(2, "0");
-    const iso = `${y}-${m}-${d}T00:00:00Z`;
-    return new UtcDate({ value: iso });
+  private static toTimestamp(value: string): number {
+    const [yearRaw, monthRaw, dayRaw] = value.split("-");
+
+    const year = Number(yearRaw);
+    const month = Number(monthRaw);
+    const day = Number(dayRaw);
+
+    return Date.UTC(year, month - 1, day, 0, 0, 0, 0);
   }
 
-  getProps(): string {
+  getProps(): UtcDateProps {
+    return this.props;
+  }
+
+  toPrimitive(): string {
     return this.props.value;
   }
 
-  /**
-   * Devuelve la fecha completa en formato UTC con hora (ISO 8601). Ejemplo: 2025-12-31T23:59:59Z.
-   */
-  toPrimitive() {
-    return this.toISOString();
-  }
-
-  /**
-   * Devuelve la fecha en formato UTC sin hora (YYYY-MM-DD).
-   */
   toDateString(): string {
-    return this.date.toISOString().split("T")[0] ?? "";
+    return this.props.value;
   }
 
-  toString() {
+  toString(): string {
     return this.toDateString();
   }
 
-  /**
-   * Devuelve la fecha en formato UTC con hora (ISO 8601). Ejemplo: 2025-12-31T23:59:59Z.
-   */
   toISOString(): string {
-    return this.date.toISOString();
+    return `${this.props.value}T00:00:00.000Z`;
+  }
+
+  toDate(): Date {
+    return new Date(this.timestamp);
   }
 
-  /**
-   * Devuelve la fecha en formato dd/mm/yyyy (formato europeo).
-   */
   toEuropeanString(): string {
-    const day = String(this.date.getUTCDate()).padStart(2, "0");
-    const month = String(this.date.getUTCMonth() + 1).padStart(2, "0"); // Los meses en JS empiezan en 0
-    const year = this.date.getUTCFullYear();
+    const [year, month, day] = this.props.value.split("-");
 
     return `${day}/${month}/${year}`;
   }
 
-  /**
-   * Compara si dos instancias de UtcDate son iguales.
-   */
   equals(other: UtcDate): boolean {
-    return this.toISOString() === other.toISOString();
+    return this.props.value === other.props.value;
   }
 
-  /**
-   * Determina si la fecha representada
-   * es una fecha futura en comparación con la fecha actual.
-   * @returns
-   */
+  isFuture(currentDate: UtcDate = UtcDate.today()): boolean {
+    return this.timestamp > currentDate.timestamp;
+  }
 
-  isFuture(currentDate?: UtcDate): boolean {
-    const now = currentDate ? currentDate : UtcDate.today();
-    return this.date.getTime() > now.getTime();
+  isPast(currentDate: UtcDate = UtcDate.today()): boolean {
+    return this.timestamp < currentDate.timestamp;
+  }
+
+  isToday(): boolean {
+    return this.equals(UtcDate.today());
+  }
+
+  isBefore(other: UtcDate): boolean {
+    return this.timestamp < other.timestamp;
+  }
+
+  isAfter(other: UtcDate): boolean {
+    return this.timestamp > other.timestamp;
   }
 }
diff --git a/packages/rdx-logger/package.json b/packages/rdx-logger/package.json
index 7101fb43..93603497 100644
--- a/packages/rdx-logger/package.json
+++ b/packages/rdx-logger/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@repo/rdx-logger",
-  "version": "0.7.6",
+  "version": "0.7.8",
   "private": true,
   "type": "module",
   "sideEffects": false,
diff --git a/packages/rdx-ui/package.json b/packages/rdx-ui/package.json
index c471dde1..11dd5f0f 100644
--- a/packages/rdx-ui/package.json
+++ b/packages/rdx-ui/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@repo/rdx-ui",
-  "version": "0.7.6",
+  "version": "0.7.8",
   "private": true,
   "type": "module",
   "sideEffects": false,
diff --git a/packages/rdx-utils/package.json b/packages/rdx-utils/package.json
index af7f2e91..2424d9bc 100644
--- a/packages/rdx-utils/package.json
+++ b/packages/rdx-utils/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@repo/rdx-utils",
-  "version": "0.7.6",
+  "version": "0.7.8",
   "private": true,
   "type": "module",
   "sideEffects": false,
diff --git a/packages/shadcn-ui/package.json b/packages/shadcn-ui/package.json
index f57d0ab7..894b53d4 100644
--- a/packages/shadcn-ui/package.json
+++ b/packages/shadcn-ui/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@repo/shadcn-ui",
-  "version": "0.7.6",
+  "version": "0.7.8",
   "type": "module",
   "private": true,
   "exports": {
diff --git a/packages/typescript-config/package.json b/packages/typescript-config/package.json
index fd265c03..5a55a18a 100644
--- a/packages/typescript-config/package.json
+++ b/packages/typescript-config/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@repo/typescript-config",
-  "version": "0.7.6",
+  "version": "0.7.8",
   "private": true,
   "publishConfig": {
     "access": "public"
diff --git a/packages/typescript-config/root.json b/packages/typescript-config/root.json
index 94c9f329..7ad35c18 100644
--- a/packages/typescript-config/root.json
+++ b/packages/typescript-config/root.json
@@ -9,6 +9,9 @@
       "@erp/auth/*": [
         "modules/auth/src/*"
       ],
+      "@erp/identity/*": [
+        "modules/identity/src/*"
+      ],
       "@erp/catalogs/*": [
         "modules/catalogs/src/*"
       ],
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 5e400eb5..6c4a2184 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -71,6 +71,9 @@ importers:
       '@erp/factuges':
         specifier: workspace:*
         version: link:../../modules/factuges
+      '@erp/identity':
+        specifier: workspace:*
+        version: link:../../modules/identity
       '@repo/rdx-logger':
         specifier: workspace:*
         version: link:../../packages/rdx-logger
@@ -827,6 +830,79 @@ importers:
         specifier: ^6.0.2
         version: 6.0.2
 
+  modules/identity:
+    dependencies:
+      '@erp/core':
+        specifier: workspace:*
+        version: link:../core
+      '@repo/rdx-criteria':
+        specifier: workspace:*
+        version: link:../../packages/rdx-criteria
+      '@repo/rdx-ddd':
+        specifier: workspace:*
+        version: link:../../packages/rdx-ddd
+      '@repo/rdx-logger':
+        specifier: workspace:*
+        version: link:../../packages/rdx-logger
+      '@repo/rdx-ui':
+        specifier: workspace:*
+        version: link:../../packages/rdx-ui
+      '@repo/rdx-utils':
+        specifier: workspace:*
+        version: link:../../packages/rdx-utils
+      '@repo/shadcn-ui':
+        specifier: workspace:*
+        version: link:../../packages/shadcn-ui
+      '@tanstack/react-query':
+        specifier: ^5.98.0
+        version: 5.100.14(react@19.2.6)
+      bcrypt:
+        specifier: ^6.0.0
+        version: 6.0.0
+      express:
+        specifier: ^4.22.1
+        version: 4.22.2
+      jsonwebtoken:
+        specifier: ^9.0.3
+        version: 9.0.3
+      react-i18next:
+        specifier: ^17.0.2
+        version: 17.0.8(i18next@26.0.4(typescript@6.0.2))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(typescript@6.0.2)
+      react-router-dom:
+        specifier: ^7.14.0
+        version: 7.15.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      sequelize:
+        specifier: ^6.37.8
+        version: 6.37.8(mysql2@3.22.3(@types/node@25.9.1))(pg-hstore@2.3.4)
+      zod:
+        specifier: ^4.3.6
+        version: 4.4.3
+    devDependencies:
+      '@types/express':
+        specifier: ^4.17.21
+        version: 4.17.25
+      '@types/react':
+        specifier: ^19.2.14
+        version: 19.2.15
+      '@types/react-dom':
+        specifier: ^19.2.3
+        version: 19.2.3(@types/react@19.2.15)
+      '@types/react-router-dom':
+        specifier: ^5.3.3
+        version: 5.3.3
+      react:
+        specifier: ^19.2.5
+        version: 19.2.6
+      react-dom:
+        specifier: ^19.2.5
+        version: 19.2.6(react@19.2.6)
+      rimraf:
+        specifier: ^6.1.3
+        version: 6.1.3
+      typescript:
+        specifier: ^6.0.2
+        version: 6.0.2
+
   modules/supplier:
     dependencies:
       '@erp/auth':
diff --git a/tools/fastreportcli-net-core-skia/FastReportCliGenerator/publish/linux/FastReportCliGenerator b/tools/fastreportcli-net-core-skia/FastReportCliGenerator/publish/linux/FastReportCliGenerator
index c64715f6..1175f514 100755
Binary files a/tools/fastreportcli-net-core-skia/FastReportCliGenerator/publish/linux/FastReportCliGenerator and b/tools/fastreportcli-net-core-skia/FastReportCliGenerator/publish/linux/FastReportCliGenerator differ
diff --git a/tools/fastreportcli-net-core-skia/FastReportCliGenerator/publish/windows/FastReportCliGenerator.exe b/tools/fastreportcli-net-core-skia/FastReportCliGenerator/publish/windows/FastReportCliGenerator.exe
index 05b42230..673d584e 100755
Binary files a/tools/fastreportcli-net-core-skia/FastReportCliGenerator/publish/windows/FastReportCliGenerator.exe and b/tools/fastreportcli-net-core-skia/FastReportCliGenerator/publish/windows/FastReportCliGenerator.exe differ