diff --git a/Makefile b/Makefile
new file mode 100644
index 0000000..e52b97b
--- /dev/null
+++ b/Makefile
@@ -0,0 +1,65 @@
+.PHONY: all init generate build build-wasm test test-cover lint fmt vet clean tidy help
+
+MODULE := enclave
+BINARY := enclave
+BUILD_DIR := build
+
+all: generate build
+
+generate:
+	@sqlc generate
+
+build:
+	@mkdir -p $(BUILD_DIR)
+	@go build -o $(BUILD_DIR)/$(BINARY) ./...
+
+build-wasm:
+	@mkdir -p $(BUILD_DIR)
+	@GOOS=js GOARCH=wasm go build -o $(BUILD_DIR)/$(BINARY).wasm ./...
+
+test:
+	@go test -v ./...
+
+test-cover:
+	@go test -coverprofile=coverage.out ./...
+	@go tool cover -html=coverage.out -o coverage.html
+
+lint:
+	@golangci-lint run ./...
+
+fmt:
+	@go fmt ./...
+	@gofumpt -w .
+
+vet:
+	@go vet ./...
+
+clean:
+	@rm -rf $(BUILD_DIR)
+	@rm -f coverage.out coverage.html
+
+tidy:
+	@go mod tidy
+
+deps:
+	@go install github.com/sqlc-dev/sqlc/cmd/sqlc@latest
+	@go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest
+	@go install mvdan.cc/gofumpt@latest
+
+verify: fmt vet lint test
+
+help:
+	@echo "Available targets:"
+	@echo "  init        - Initialize Go module"
+	@echo "  generate    - Run sqlc to generate Go code"
+	@echo "  build       - Build binary"
+	@echo "  build-wasm  - Build WASM binary"
+	@echo "  test        - Run tests"
+	@echo "  test-cover  - Run tests with coverage"
+	@echo "  lint        - Run golangci-lint"
+	@echo "  fmt         - Format code"
+	@echo "  vet         - Run go vet"
+	@echo "  clean       - Remove build artifacts"
+	@echo "  tidy        - Run go mod tidy"
+	@echo "  deps        - Install development dependencies"
+	@echo "  verify      - Run fmt, vet, lint, and test"
diff --git a/go.mod b/go.mod
new file mode 100644
index 0000000..2c713f3
--- /dev/null
+++ b/go.mod
@@ -0,0 +1,3 @@
+module enclave
+
+go 1.25.5
diff --git a/sqlc.yaml b/sqlc.yaml
new file mode 100644
index 0000000..1265ca6
--- /dev/null
+++ b/sqlc.yaml
@@ -0,0 +1,36 @@
+version: "2"
+sql:
+  - engine: "sqlite"
+    queries: "db/query.sql"
+    schema: "db/schema.sql"
+    gen:
+      go:
+        package: "db"
+        out: "db"
+        emit_json_tags: true
+        emit_empty_slices: true
+        emit_pointers_for_null_types: true
+        emit_interface: true
+        emit_exact_table_names: false
+        json_tags_case_style: "snake"
+        overrides:
+          - column: "did_documents.document"
+            go_type: "encoding/json.RawMessage"
+          - column: "credentials.transports"
+            go_type: "encoding/json.RawMessage"
+          - column: "ucan_tokens.capabilities"
+            go_type: "encoding/json.RawMessage"
+          - column: "ucan_tokens.proof_chain"
+            go_type: "encoding/json.RawMessage"
+          - column: "ucan_tokens.facts"
+            go_type: "encoding/json.RawMessage"
+          - column: "sessions.device_info"
+            go_type: "encoding/json.RawMessage"
+          - column: "services.metadata"
+            go_type: "encoding/json.RawMessage"
+          - column: "grants.scopes"
+            go_type: "encoding/json.RawMessage"
+          - column: "grants.accounts"
+            go_type: "encoding/json.RawMessage"
+          - column: "delegations.caveats"
+            go_type: "encoding/json.RawMessage"