diff --git a/crates/manager-core/tests/expected_schema.txt b/crates/manager-core/tests/expected_schema.txt
index 91b2591..c9a3ce0 100644
--- a/crates/manager-core/tests/expected_schema.txt
+++ b/crates/manager-core/tests/expected_schema.txt
@@ -60,9 +60,11 @@ table: app_members
 
 table: app_secrets
   app_id: uuid NOT NULL
-  realtime_signing_key: bytea NOT NULL
+  realtime_signing_key: bytea NULL
   created_at: timestamp with time zone NOT NULL default=now()
   updated_at: timestamp with time zone NOT NULL default=now()
+  realtime_signing_key_encrypted: bytea NULL
+  realtime_signing_key_nonce: bytea NULL
 
 table: app_slug_history
   slug: text NOT NULL
@@ -119,6 +121,11 @@ table: docs_trigger_details
   collection_glob: text NOT NULL
   ops: ARRAY NOT NULL
 
+table: email_trigger_details
+  trigger_id: uuid NOT NULL
+  inbound_secret_encrypted: bytea NULL
+  inbound_secret_nonce: bytea NULL
+
 table: execution_logs
   id: uuid NOT NULL default=gen_random_uuid()
   script_id: uuid NOT NULL
@@ -217,6 +224,14 @@ table: scripts
   app_id: uuid NOT NULL
   kind: text NOT NULL default='endpoint'::text
 
+table: secrets
+  app_id: uuid NOT NULL
+  name: text NOT NULL
+  encrypted_value: bytea NOT NULL
+  nonce: bytea NOT NULL
+  created_at: timestamp with time zone NOT NULL default=now()
+  updated_at: timestamp with time zone NOT NULL default=now()
+
 table: topics
   app_id: uuid NOT NULL
   name: text NOT NULL
@@ -300,6 +315,9 @@ indexes on docs:
 indexes on docs_trigger_details:
   docs_trigger_details_pkey: public.docs_trigger_details USING btree (trigger_id)
 
+indexes on email_trigger_details:
+  email_trigger_details_pkey: public.email_trigger_details USING btree (trigger_id)
+
 indexes on execution_logs:
   execution_logs_app_id_created_at_idx: public.execution_logs USING btree (app_id, created_at DESC)
   execution_logs_pkey: public.execution_logs USING btree (id)
@@ -345,6 +363,10 @@ indexes on scripts:
   scripts_name_uidx: public.scripts USING btree (app_id, lower(name))
   scripts_pkey: public.scripts USING btree (id)
 
+indexes on secrets:
+  idx_secrets_app: public.secrets USING btree (app_id)
+  secrets_pkey: public.secrets USING btree (app_id, name)
+
 indexes on topics:
   topics_pkey: public.topics USING btree (app_id, name)
 
@@ -419,6 +441,10 @@ constraints on docs_trigger_details:
   [FOREIGN KEY] docs_trigger_details_trigger_id_fkey: FOREIGN KEY (trigger_id) REFERENCES triggers(id) ON DELETE CASCADE
   [PRIMARY KEY] docs_trigger_details_pkey: PRIMARY KEY (trigger_id)
 
+constraints on email_trigger_details:
+  [FOREIGN KEY] email_trigger_details_trigger_id_fkey: FOREIGN KEY (trigger_id) REFERENCES triggers(id) ON DELETE CASCADE
+  [PRIMARY KEY] email_trigger_details_pkey: PRIMARY KEY (trigger_id)
+
 constraints on execution_logs:
   [CHECK] execution_logs_status_check: CHECK ((status = ANY (ARRAY['success'::text, 'error'::text, 'timeout'::text, 'budget_exceeded'::text])))
   [FOREIGN KEY] execution_logs_app_id_fk: FOREIGN KEY (app_id) REFERENCES apps(id) ON DELETE CASCADE
@@ -442,7 +468,7 @@ constraints on kv_trigger_details:
   [PRIMARY KEY] kv_trigger_details_pkey: PRIMARY KEY (trigger_id)
 
 constraints on outbox:
-  [CHECK] outbox_source_kind_check: CHECK ((source_kind = ANY (ARRAY['http'::text, 'kv'::text, 'dead_letter'::text, 'docs'::text, 'cron'::text, 'files'::text, 'pubsub'::text])))
+  [CHECK] outbox_source_kind_check: CHECK ((source_kind = ANY (ARRAY['http'::text, 'kv'::text, 'dead_letter'::text, 'docs'::text, 'cron'::text, 'files'::text, 'pubsub'::text, 'email'::text])))
   [FOREIGN KEY] outbox_app_id_fkey: FOREIGN KEY (app_id) REFERENCES apps(id) ON DELETE CASCADE
   [PRIMARY KEY] outbox_pkey: PRIMARY KEY (id)
 
@@ -472,6 +498,10 @@ constraints on scripts:
   [FOREIGN KEY] scripts_app_id_fk: FOREIGN KEY (app_id) REFERENCES apps(id) ON DELETE RESTRICT
   [PRIMARY KEY] scripts_pkey: PRIMARY KEY (id)
 
+constraints on secrets:
+  [FOREIGN KEY] secrets_app_id_fkey: FOREIGN KEY (app_id) REFERENCES apps(id) ON DELETE CASCADE
+  [PRIMARY KEY] secrets_pkey: PRIMARY KEY (app_id, name)
+
 constraints on topics:
   [CHECK] topics_auth_mode_check: CHECK ((auth_mode = ANY (ARRAY['public'::text, 'token'::text])))
   [FOREIGN KEY] topics_app_id_fkey: FOREIGN KEY (app_id) REFERENCES apps(id) ON DELETE CASCADE
@@ -479,7 +509,7 @@ constraints on topics:
 
 constraints on triggers:
   [CHECK] triggers_dispatch_mode_check: CHECK ((dispatch_mode = ANY (ARRAY['sync'::text, 'async'::text])))
-  [CHECK] triggers_kind_check: CHECK ((kind = ANY (ARRAY['kv'::text, 'dead_letter'::text, 'docs'::text, 'cron'::text, 'files'::text, 'pubsub'::text])))
+  [CHECK] triggers_kind_check: CHECK ((kind = ANY (ARRAY['kv'::text, 'dead_letter'::text, 'docs'::text, 'cron'::text, 'files'::text, 'pubsub'::text, 'email'::text])))
   [CHECK] triggers_retry_backoff_check: CHECK ((retry_backoff = ANY (ARRAY['exponential'::text, 'linear'::text, 'constant'::text])))
   [FOREIGN KEY] triggers_app_id_fkey: FOREIGN KEY (app_id) REFERENCES apps(id) ON DELETE CASCADE
   [FOREIGN KEY] triggers_registered_by_principal_fkey: FOREIGN KEY (registered_by_principal) REFERENCES admin_users(id) ON DELETE CASCADE
@@ -509,3 +539,6 @@ constraints on triggers:
   0020: pubsub triggers
   0021: topics
   0022: app secrets
+  0023: secrets
+  0024: email triggers
+  0025: encrypt realtime keys