@cosmicdrift/kumiko-framework 0.293.0 → 0.294.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.293.0",
+  "version": "0.294.1",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -198,8 +198,8 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-http": "0.293.0",
-    "@cosmicdrift/kumiko-types": "0.293.0",
+    "@cosmicdrift/kumiko-http": "0.294.1",
+    "@cosmicdrift/kumiko-types": "0.294.1",
     "bullmq": "^5.76.7",
     "bun-types": "^1.3.13",
     "hono": "^4.13.1",
@@ -215,7 +215,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.293.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.294.1",
     "bun-types": "^1.3.13",
     "pino-pretty": "^13.1.3"
   },

package/src/__tests__/schema-cli-rebuild.integration.test.ts

@@ -18,7 +18,6 @@ import { buildEntityTable } from "../db/table-builder";
 import { createTenantDb, type TenantDb } from "../db/tenant-db";
 import { createEntity, createTextField, defineApply, defineFeature } from "../engine";
 import type { ProjectionDefinition } from "../engine/types";
-import { createEventsTable } from "../event-store";
 import { createProjectionStateTable } from "../pipeline";
 import { runSchemaCli, type SchemaCliOut } from "../schema-cli";
 import {
@@ -101,7 +100,6 @@ beforeAll(async () => {
   await ensureTemporalPolyfill();
   testDb = await createTestDb();
   await unsafeCreateEntityTable(testDb.db, itemEntity, "apply-item");
-  await createEventsTable(testDb.db);
   await createProjectionStateTable(testDb.db);
   await unsafePushTables(testDb.db, { applyItemsPerGroup: counterTable });
   tdb = createTenantDb(testDb.db, admin.tenantId);

package/src/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.294.1",
+    "type": "fix",
+    "title": "Fix parseEnv for refined env schemas with ciphertext-only Key Manager slots",
+    "detail": "Relaxing a `kms` slot that is present only as `<NAME>_CIPHERTEXT` used `schema.extend`, which Zod 4 rejects for object schemas carrying refinements (\"Cannot overwrite keys on object schemas containing refinements\"). An app whose composed env schema ends in `.superRefine(...)` therefore failed at boot as soon as its slots were delivered as ciphertext. The relaxation now uses `safeExtend`, which keeps the refinements running."
+  },
+  {
+    "version": "0.294.0",
+    "type": "improvement",
+    "title": "Declare Key Manager ciphertext slots in the env schema",
+    "detail": "An env field can carry `.meta({ kumiko: { kms: true } })` to be deliverable as `<NAME>_CIPHERTEXT`. `runProdApp` now decrypts the schema-declared slots once at boot (`kmsSlotsOf(schema)` → `resolvePlatformKeks({ slots })`) and hands the resolved env to the boot-time master-key probe (`ValidateBootOptions.env`) and to the master-key keyring, so a ciphertext-only `KUMIKO_SECRETS_MASTER_KEY_V<n>` boots. `parseEnv` treats a `kms` slot as satisfied by its ciphertext twin. `composeEnvSchema` declares the `<NAME>_CIPHERTEXT` twin of every `kms` field itself (an already declared twin is kept), so a versioned family needs one declaration per version. `KUMIKO_SECRETS_MASTER_KEY_V1` of the secrets feature is such a slot. `runWorkerApp` takes the same slots as `kmsSlots` (it parses no schema). A deployment missing `KUMIKO_SECRETS_MASTER_KEY_V1` but carrying its `_CIPHERTEXT` twin now passes `parseEnv` and fails at the master-key probe if the decrypt yields nothing, instead of failing in `parseEnv`. `resolvePlatformKeks` without `slots` keeps resolving the three platform slots until consumers declare theirs."
+  },
   {
     "version": "0.293.0",
     "type": "improvement",

package/src/crypto/__tests__/kek-source.test.ts

@@ -356,4 +356,86 @@ describe("resolvePlatformKeks", () => {
     expect(result.KUMIKO_BLIND_INDEX_KEY).toBe("blind-index-plaintext");
     expect(calls.length).toBe(2);
   });
+
+  describe("with schema-declared slots", () => {
+    const KEY_MANAGER = { PLATFORM_KEK_KMS_KEY_ID: "key-1", PLATFORM_KEK_KMS_TOKEN: TOKEN };
+
+    test("resolves a versioned master-key family without the framework knowing the versions", async () => {
+      const { fetch, calls } = trackedFetch([
+        jsonResponse(200, { plaintext: "v1-plaintext" }),
+        jsonResponse(200, { plaintext: "v2-plaintext" }),
+      ]);
+      const env: KekSourceEnv = {
+        KUMIKO_SECRETS_MASTER_KEY_V1_CIPHERTEXT: CIPHERTEXT_A,
+        KUMIKO_SECRETS_MASTER_KEY_V2_CIPHERTEXT: CIPHERTEXT_B,
+        ...KEY_MANAGER,
+      };
+
+      const result = await resolvePlatformKeks(env, {
+        fetch,
+        slots: ["KUMIKO_SECRETS_MASTER_KEY_V1", "KUMIKO_SECRETS_MASTER_KEY_V2"],
+      });
+
+      expect(result["KUMIKO_SECRETS_MASTER_KEY_V1"]).toBe("v1-plaintext");
+      expect(result["KUMIKO_SECRETS_MASTER_KEY_V2"]).toBe("v2-plaintext");
+      expect(calls.length).toBe(2);
+    });
+
+    test("a plaintext beats its ciphertext per slot, the other slot still resolves", async () => {
+      const { fetch, calls } = trackedFetch([jsonResponse(200, { plaintext: "v2-plaintext" })]);
+      const env: KekSourceEnv = {
+        KUMIKO_SECRETS_MASTER_KEY_V1: "v1-plaintext",
+        KUMIKO_SECRETS_MASTER_KEY_V1_CIPHERTEXT: CIPHERTEXT_A,
+        KUMIKO_SECRETS_MASTER_KEY_V2_CIPHERTEXT: CIPHERTEXT_B,
+        ...KEY_MANAGER,
+      };
+
+      const result = await resolvePlatformKeks(env, {
+        fetch,
+        slots: ["KUMIKO_SECRETS_MASTER_KEY_V1", "KUMIKO_SECRETS_MASTER_KEY_V2"],
+      });
+
+      expect(result["KUMIKO_SECRETS_MASTER_KEY_V1"]).toBe("v1-plaintext");
+      expect(result["KUMIKO_SECRETS_MASTER_KEY_V2"]).toBe("v2-plaintext");
+      expect(calls.length).toBe(1);
+    });
+
+    test("does not touch the platform slots that the caller did not name", async () => {
+      const { fetch, calls } = trackedFetch([]);
+      const env: KekSourceEnv = { PLATFORM_KEK_CIPHERTEXT: CIPHERTEXT_A, ...KEY_MANAGER };
+
+      const result = await resolvePlatformKeks(env, { fetch, slots: [] });
+
+      expect(result).toBe(env);
+      expect(calls.length).toBe(0);
+    });
+
+    test("logs the source line for a declared slot", async () => {
+      const { fetch } = trackedFetch([jsonResponse(200, { plaintext: "v1-plaintext" })]);
+      const lines: string[] = [];
+      const env: KekSourceEnv = {
+        KUMIKO_SECRETS_MASTER_KEY_V1_CIPHERTEXT: CIPHERTEXT_A,
+        ...KEY_MANAGER,
+      };
+
+      await resolvePlatformKeks(env, {
+        fetch,
+        slots: ["KUMIKO_SECRETS_MASTER_KEY_V1"],
+        log: (line) => lines.push(line),
+      });
+
+      expect(lines).toEqual([
+        "KUMIKO_SECRETS_MASTER_KEY_V1 source=key-manager keyId=key-1 region=fr-par",
+      ]);
+    });
+
+    test("still rejects a previous KEK without its version when that slot is declared", async () => {
+      const { fetch } = trackedFetch([jsonResponse(200, { plaintext: "previous-plaintext" })]);
+      const env: KekSourceEnv = { PLATFORM_KEK_PREVIOUS_CIPHERTEXT: CIPHERTEXT_B, ...KEY_MANAGER };
+
+      await expect(
+        resolvePlatformKeks(env, { fetch, slots: ["PLATFORM_KEK_PREVIOUS"] }),
+      ).rejects.toThrow(/PLATFORM_KEK_PREVIOUS_VERSION must be set/);
+    });
+  });
 });

package/src/crypto/kek-source.ts

@@ -1,20 +1,16 @@
-// Resolves an allowlisted set of secrets (RESOLVABLE_SLOTS) from a Key
-// Manager ciphertext when no plaintext is set, so they need not sit in the
-// pod env in the clear. A slot's plaintext always wins over its ciphertext
-// sibling, with no request made at all. Any other `*_CIPHERTEXT` in the env
-// is outside the allowlist and is ignored — a foreign ciphertext must never
-// fail boot.
+// Resolves a caller-named set of secret slots from a Key Manager ciphertext
+// when no plaintext is set, so they need not sit in the pod env in the clear.
+// A slot's plaintext always wins over its ciphertext sibling, with no request
+// made at all. Any `*_CIPHERTEXT` in the env that names no requested slot is
+// ignored — a foreign ciphertext must never fail boot.
 
 const SCALEWAY_KEY_MANAGER_API_VERSION = "v1alpha1";
 const DEFAULT_REGION = "fr-par";
 const DECRYPT_TIMEOUT_MS = 5_000;
 const RETRY_DELAYS_MS = [200, 800];
-const RESOLVABLE_SLOTS = [
-  "PLATFORM_KEK",
-  "PLATFORM_KEK_PREVIOUS",
-  "KUMIKO_BLIND_INDEX_KEY",
-] as const;
-type ResolvableSlot = (typeof RESOLVABLE_SLOTS)[number];
+// Used when the caller names no slots. Apps that predate `kms` schema meta
+// rely on it; drop once every consumer declares its slots in the env schema.
+const LEGACY_SLOTS = ["PLATFORM_KEK", "PLATFORM_KEK_PREVIOUS", "KUMIKO_BLIND_INDEX_KEY"] as const;
 
 export type KekSourceEnv = {
   readonly PLATFORM_KEK?: string | undefined;
@@ -35,6 +31,9 @@ export type KekSourceOptions = {
   readonly logPrefix?: string;
   /** Where the boot line naming the KEK source goes. Defaults to `console.info`. */
   readonly log?: (message: string) => void;
+  /** Env names to resolve, e.g. `kmsSlotsOf(schema)`. Defaults to the three
+   *  platform slots. */
+  readonly slots?: readonly string[];
 };
 
 function isRetryableStatus(status: number): boolean {
@@ -107,7 +106,7 @@ async function decryptCiphertext(
 }
 
 async function resolveSlot(
-  name: ResolvableSlot,
+  name: string,
   env: KekSourceEnv,
   options: KekSourceOptions,
   fetchImpl: typeof globalThis.fetch,
@@ -132,7 +131,7 @@ async function resolveSlot(
 // A leftover plaintext beside a ciphertext boots green while nothing was
 // migrated, which is indistinguishable from a finished cutover unless the
 // boot says which source won. Never carries a key value, only its origin.
-function describeKekSource(name: ResolvableSlot, env: KekSourceEnv): string | undefined {
+function describeKekSource(name: string, env: KekSourceEnv): string | undefined {
   const plaintext = env[name];
   const ciphertext = env[`${name}_CIPHERTEXT`];
   if (plaintext) {
@@ -154,26 +153,27 @@ export async function resolvePlatformKeks(
 ): Promise<KekSourceEnv> {
   const fetchImpl = options.fetch ?? globalThis.fetch;
 
-  const resolved: Partial<Record<ResolvableSlot, string | undefined>> = {};
-  for (const name of RESOLVABLE_SLOTS) {
+  const slots = options.slots ?? LEGACY_SLOTS;
+  const resolved: Record<string, string | undefined> = {};
+  for (const name of slots) {
     resolved[name] = await resolveSlot(name, env, options, fetchImpl);
   }
 
   const prefix = options.logPrefix ? `${options.logPrefix} ` : "";
   // biome-ignore lint/suspicious/noConsole: ops-visible fallback when no logger is wired
   const log = options.log ?? console.info;
-  for (const name of RESOLVABLE_SLOTS) {
+  for (const name of slots) {
     const line = describeKekSource(name, env);
     if (line) log(`${prefix}${line}`);
   }
 
-  if (resolved.PLATFORM_KEK_PREVIOUS && !env.PLATFORM_KEK_PREVIOUS_VERSION) {
+  if (resolved["PLATFORM_KEK_PREVIOUS"] && !env.PLATFORM_KEK_PREVIOUS_VERSION) {
     throw new Error(
       `${prefix}PLATFORM_KEK_PREVIOUS_VERSION must be set when PLATFORM_KEK_PREVIOUS is set.`,
     );
   }
 
-  const changed = RESOLVABLE_SLOTS.some((name) => resolved[name] !== env[name]);
+  const changed = slots.some((name) => resolved[name] !== env[name]);
   if (!changed) return env;
 
   return { ...env, ...resolved };

package/src/db/__tests__/apply-entity-event-tenant.integration.test.ts

@@ -21,7 +21,6 @@ import { asRawClient, selectMany } from "../../db/query";
 import { createEntity, createTextField } from "../../engine/factories";
 import type { TenantId } from "../../engine/types";
 import type { StoredEvent } from "../../event-store";
-import { createEventsTable } from "../../event-store";
 import { ensureTemporalPolyfill } from "../../time/polyfill";
 import { applyEntityEvent } from "../apply-entity-event";
 import { buildEntityTable } from "../table-builder";
@@ -39,7 +38,6 @@ let testDb: BunTestDb;
 beforeAll(async () => {
   await ensureTemporalPolyfill();
   testDb = await createTestDb();
-  await createEventsTable(testDb.db);
   await asRawClient(testDb.db).unsafe(`
     CREATE TABLE read_apply_tenant_check (
       id uuid PRIMARY KEY,

package/src/db/__tests__/assert-no-unreachable-live-rows.integration.test.ts

@@ -14,7 +14,7 @@ import { type BunTestDb, createTestDb } from "../../bun-db/__tests__/bun-test-db
 import { asRawClient, insertOne, selectMany } from "../../db/query";
 import { createBooleanField, createEntity, createTextField, defineFeature } from "../../engine";
 import { createRegistry } from "../../engine/registry";
-import { archiveStream, createArchivedStreamsTable, createEventsTable } from "../../event-store";
+import { archiveStream, createArchivedStreamsTable } from "../../event-store";
 import { rebuildProjection } from "../../pipeline";
 import { createProjectionStateTable } from "../../pipeline/projection-state";
 import { TestUsers, unsafeCreateEntityTable } from "../../stack";
@@ -49,7 +49,6 @@ beforeAll(async () => {
   await ensureTemporalPolyfill();
   testDb = await createTestDb();
   await unsafeCreateEntityTable(testDb.db, userEntity, "user");
-  await createEventsTable(testDb.db);
   await createArchivedStreamsTable(testDb.db);
   await createProjectionStateTable(testDb.db);
   tdb = createTenantDb(testDb.db, adminUser.tenantId);

package/src/db/__tests__/blind-index.integration.test.ts

@@ -20,7 +20,6 @@ import {
 import { defineFeature } from "../../engine/define-feature";
 import { createEntity, createTextField } from "../../engine/factories";
 import { createRegistry } from "../../engine/registry";
-import { createEventsTable } from "../../event-store";
 import { rebuildProjection } from "../../pipeline";
 import { createProjectionStateTable } from "../../pipeline/projection-state";
 import { createTestDb, type TestDb, TestUsers, unsafeCreateEntityTable } from "../../stack";
@@ -65,7 +64,6 @@ const adminUser = TestUsers.admin;
 beforeAll(async () => {
   testDb = await createTestDb();
   await unsafeCreateEntityTable(testDb.db, personEntity, "person");
-  await createEventsTable(testDb.db);
   await createProjectionStateTable(testDb.db);
   tdb = createTenantDb(testDb.db, adminUser.tenantId);
 });

package/src/db/__tests__/entity-field-encryption.test.ts

@@ -5,6 +5,7 @@ import {
   collectEncryptedFieldNames,
   decryptEntityFieldValues,
   encryptEntityFieldValues,
+  validateEntityFieldEncryptionAvailable,
 } from "../entity-field-encryption";
 
 const TEST_KEY = Buffer.from("a]bJm#kP9xQ2@wN!vL$hR5yT8eU0iO3f").toString("base64");
@@ -43,3 +44,31 @@ describe("entity-field-encryption", () => {
     expect(stored["secretNote"]).not.toBe("note");
   });
 });
+
+describe("validateEntityFieldEncryptionAvailable", () => {
+  test("accepts a keyring made only of the env it is handed", () => {
+    expect(() =>
+      validateEntityFieldEncryptionAvailable({ KUMIKO_SECRETS_MASTER_KEY_V1: TEST_KEY }),
+    ).not.toThrow();
+  });
+
+  test("rejects a handed env without any master key, whatever process.env holds", () => {
+    const previous = process.env["KUMIKO_SECRETS_MASTER_KEY_V1"];
+    process.env["KUMIKO_SECRETS_MASTER_KEY_V1"] = TEST_KEY;
+    try {
+      expect(() => validateEntityFieldEncryptionAvailable({})).toThrow(/no usable master key/);
+    } finally {
+      if (previous === undefined) delete process.env["KUMIKO_SECRETS_MASTER_KEY_V1"];
+      else process.env["KUMIKO_SECRETS_MASTER_KEY_V1"] = previous;
+    }
+  });
+
+  test("a pinned CURRENT_VERSION without that version's key still fails", () => {
+    expect(() =>
+      validateEntityFieldEncryptionAvailable({
+        KUMIKO_SECRETS_MASTER_KEY_V1: TEST_KEY,
+        KUMIKO_SECRETS_MASTER_KEY_CURRENT_VERSION: "2",
+      }),
+    ).toThrow(/no usable master key/);
+  });
+});

package/src/db/__tests__/event-store-executor-list.integration.test.ts

@@ -15,7 +15,6 @@ import {
   SYSTEM_TENANT_ID,
 } from "../../engine";
 import { UnprocessableError } from "../../errors";
-import { createEventsTable } from "../../event-store";
 import { TestUsers, unsafeCreateEntityTable } from "../../stack";
 import { ensureTemporalPolyfill } from "../../time/polyfill";
 import { encodeCursor } from "../cursor";
@@ -46,7 +45,6 @@ beforeAll(async () => {
   await ensureTemporalPolyfill();
   testDb = await createTestDb();
   await unsafeCreateEntityTable(testDb.db, entity, "pagerItem");
-  await createEventsTable(testDb.db);
   tdb = createTenantDb(testDb.db, admin.tenantId);
 });
 

package/src/db/__tests__/event-store-executor-money-rehydrate.integration.test.ts

@@ -9,7 +9,6 @@ import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:tes
 import { type BunTestDb, createTestDb } from "../../bun-db/__tests__/bun-test-db";
 import { asRawClient } from "../../db/query";
 import { createEntity, createMoneyField, createTextField, from } from "../../engine";
-import { createEventsTable } from "../../event-store";
 import { TestUsers, unsafeCreateEntityTable } from "../../stack";
 import { createTestEnvelopeCipher } from "../../testing";
 import { ensureTemporalPolyfill } from "../../time/polyfill";
@@ -59,7 +58,6 @@ beforeAll(async () => {
   await ensureTemporalPolyfill();
   testDb = await createTestDb();
   await unsafeCreateEntityTable(testDb.db, entity, "moneyOrder");
-  await createEventsTable(testDb.db);
   tdb = createTenantDb(testDb.db, admin.tenantId);
   configureEntityFieldEncryption(cipher);
 });

package/src/db/__tests__/event-store-executor-reference-search.integration.test.ts

@@ -11,7 +11,6 @@ import { type BunTestDb, createTestDb } from "../../bun-db/__tests__/bun-test-db
 import { asRawClient } from "../../db/query";
 import { createEntity, createTextField, from } from "../../engine";
 import type { EntityDefinition } from "../../engine/types";
-import { createEventsTable } from "../../event-store";
 import { createInMemorySearchAdapter } from "../../search";
 import { TestUsers, unsafeCreateEntityTable } from "../../stack";
 import { seedRows } from "../../testing";
@@ -156,7 +155,6 @@ beforeAll(async () => {
   await unsafeCreateEntityTable(testDb.db, piiCustomerEntity, "refSearchPiiCustomer");
   await unsafeCreateEntityTable(testDb.db, piiOrderEntity, "refSearchPiiOrder");
   await unsafeCreateEntityTable(testDb.db, tenantMetaEntity, "tenant");
-  await createEventsTable(testDb.db);
   tdbA = createTenantDb(testDb.db, admin.tenantId);
   tdbB = createTenantDb(testDb.db, otherTenantAdmin.tenantId);
 });

package/src/db/__tests__/event-store-executor-reference-sort.integration.test.ts

@@ -9,7 +9,6 @@ import { type BunTestDb, createTestDb } from "../../bun-db/__tests__/bun-test-db
 import { asRawClient } from "../../db/query";
 import { createEntity, createTextField } from "../../engine";
 import type { EntityDefinition } from "../../engine/types";
-import { createEventsTable } from "../../event-store";
 import { TestUsers, unsafeCreateEntityTable } from "../../stack";
 import { seedRows } from "../../testing";
 import { ensureTemporalPolyfill } from "../../time/polyfill";
@@ -107,7 +106,6 @@ beforeAll(async () => {
   await unsafeCreateEntityTable(testDb.db, customerEntity, "refSortCustomer");
   await unsafeCreateEntityTable(testDb.db, orderEntity, "refSortOrder");
   await unsafeCreateEntityTable(testDb.db, restrictedOrderEntity, "refSortRestrictedOrder");
-  await createEventsTable(testDb.db);
   tdbA = createTenantDb(testDb.db, admin.tenantId);
 });
 

package/src/db/__tests__/event-store-executor-write-verbs.integration.test.ts

@@ -9,7 +9,6 @@ import { asRawClient, transaction } from "../../db/query";
 import { createEntity, createTextField } from "../../engine";
 import { from } from "../../engine/ownership";
 import { createSystemUser } from "../../engine/system-user";
-import { createEventsTable } from "../../event-store";
 import type { EntityCache } from "../../pipeline/entity-cache";
 import {
   createTestDb,
@@ -29,7 +28,6 @@ const nonAdmin = TestUsers.user;
 
 beforeAll(async () => {
   testDb = await createTestDb();
-  await createEventsTable(testDb.db);
   tdb = createTenantDb(testDb.db, admin.tenantId);
 });
 

package/src/db/__tests__/event-store-executor.integration.test.ts

@@ -2,7 +2,7 @@ import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:tes
 import { InMemoryKmsAdapter, PII_CIPHERTEXT_PREFIX, PII_ERASED_SENTINEL } from "../../crypto";
 import { asRawClient } from "../../db/query";
 import { createBooleanField, createEntity, createTextField } from "../../engine";
-import { append, createEventsTable, loadEventsAfterVersion } from "../../event-store";
+import { append, loadEventsAfterVersion } from "../../event-store";
 import type { EntityCache } from "../../pipeline/entity-cache";
 import {
   createTestDb,
@@ -41,7 +41,6 @@ const adminUser = TestUsers.admin;
 beforeAll(async () => {
   testDb = await createTestDb();
   await unsafeCreateEntityTable(testDb.db, entity, "esExecUser");
-  await createEventsTable(testDb.db);
   tdb = createTenantDb(testDb.db, adminUser.tenantId);
 });
 

package/src/db/__tests__/implicit-projection-equivalence.integration.test.ts

@@ -19,7 +19,6 @@ import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, test } fr
 import { type BunTestDb, createTestDb } from "../../bun-db/__tests__/bun-test-db";
 import { createBooleanField, createEntity, createTextField, defineFeature } from "../../engine";
 import { createRegistry } from "../../engine/registry";
-import { createEventsTable } from "../../event-store";
 import { rebuildProjection } from "../../pipeline";
 import { createProjectionStateTable } from "../../pipeline/projection-state";
 import { TestUsers, unsafeCreateEntityTable } from "../../stack";
@@ -52,7 +51,6 @@ beforeAll(async () => {
   await ensureTemporalPolyfill();
   testDb = await createTestDb();
   await unsafeCreateEntityTable(testDb.db, userEntity, "user");
-  await createEventsTable(testDb.db);
   await createProjectionStateTable(testDb.db);
   tdb = createTenantDb(testDb.db, adminUser.tenantId);
 });

package/src/db/__tests__/unique-violation-mapping.integration.test.ts

@@ -17,7 +17,6 @@ import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:tes
 import { type BunTestDb, createTestDb } from "../../bun-db/__tests__/bun-test-db";
 import { asRawClient, selectMany, transaction } from "../../db/query";
 import { createEntity, createTextField } from "../../engine";
-import { createEventsTable } from "../../event-store";
 import { TestUsers, unsafeCreateEntityTable } from "../../stack";
 import { ensureTemporalPolyfill } from "../../time/polyfill";
 import { createEventStoreExecutor } from "../event-store-executor";
@@ -52,7 +51,6 @@ beforeAll(async () => {
   await ensureTemporalPolyfill();
   testDb = await createTestDb();
   await unsafeCreateEntityTable(testDb.db, userEntity, "unique-user");
-  await createEventsTable(testDb.db);
   tdb = createTenantDb(testDb.db, admin.tenantId);
 });
 

package/src/db/entity-field-encryption.ts

@@ -134,15 +134,17 @@ export function resetEntityFieldEncryptionCacheForTests(): void {
 // surfaces missing AND malformed keys (wrong length, bad base64) at boot
 // instead of on the first encrypted read in prod. validateBoot runs before
 // configureEntityFieldEncryption, so the env probe is the common path.
-export function validateEntityFieldEncryptionAvailable(): void {
+export function validateEntityFieldEncryptionAvailable(
+  env: Readonly<Record<string, string | undefined>> = process.env,
+): void {
   // skip: an injected cipher (test seam / custom KMS) satisfies availability
   if (injectedCipher) return;
   try {
     createEnvMasterKeyProvider({
       env: {
-        ...process.env,
+        ...env,
         KUMIKO_SECRETS_MASTER_KEY_CURRENT_VERSION:
-          process.env["KUMIKO_SECRETS_MASTER_KEY_CURRENT_VERSION"] ?? "1",
+          env["KUMIKO_SECRETS_MASTER_KEY_CURRENT_VERSION"] ?? "1",
       },
     });
   } catch (err) {

package/src/db/queries/__tests__/event-store-idempotency-index.integration.test.ts

@@ -1,6 +1,5 @@
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { type BunTestDb, createTestDb } from "../../../bun-db/__tests__/bun-test-db";
-import { createEventsTable } from "../../../event-store/events-schema";
 import { asRawClient } from "../../query";
 import { ensureIdempotencyKeyIndex } from "../event-store";
 
@@ -8,7 +7,6 @@ let testDb: BunTestDb;
 
 beforeAll(async () => {
   testDb = await createTestDb();
-  await createEventsTable(testDb.db);
 });
 
 afterAll(async () => {

package/src/engine/boot-validator/index.ts

@@ -100,6 +100,10 @@ export type ValidateBootOptions = {
    *  screen is reachable another way (e.g. as a sub-page of a generated
    *  settings hub). Suppresses the navAllowlist warning for these QNs. */
   readonly navAllowlistExempt?: ReadonlySet<string>;
+  /** Env the encrypted-field master-key probe reads. Defaults to
+   *  `process.env`; runners pass their resolved env so a ciphertext-only
+   *  key (already decrypted at boot) is visible to the probe. */
+  readonly env?: Readonly<Record<string, string | undefined>>;
 };
 
 /**
@@ -276,7 +280,7 @@ export function validateBoot(
     // catches malformed keys (wrong length, bad base64) at boot instead of
     // on the first encrypted read in prod. An injected cipher (test seam,
     // custom KMS provider) satisfies the requirement without env keys.
-    validateEntityFieldEncryptionAvailable();
+    validateEntityFieldEncryptionAvailable(options?.env);
   }
 
   if (hasFileFields && !process.env[FILE_STORAGE_PROVIDER_ENV]) {

package/src/entrypoint/__tests__/entrypoint-attach-dispatcher.integration.test.ts

@@ -14,7 +14,7 @@ import { z } from "zod";
 import { type BunTestDb, createTestDb } from "../../bun-db/__tests__/bun-test-db";
 import { asRawClient } from "../../db/query";
 import { createRegistry, defineFeature } from "../../engine";
-import { createArchivedStreamsTable, createEventsTable } from "../../event-store";
+import { createArchivedStreamsTable } from "../../event-store";
 import { createJobRunner } from "../../jobs/job-runner";
 import { createEventConsumerStateTable } from "../../pipeline";
 import { createTestRedis, type TestRedis } from "../../stack";
@@ -63,7 +63,6 @@ let testRedis: TestRedis;
 
 beforeAll(async () => {
   [testDb, testRedis] = await Promise.all([createTestDb(), createTestRedis()]);
-  await createEventsTable(testDb.db);
   await createArchivedStreamsTable(testDb.db);
   await createEventConsumerStateTable(testDb.db);
 });

package/src/entrypoint/__tests__/entrypoint-job-wiring.integration.test.ts

@@ -16,7 +16,7 @@ import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { z } from "zod";
 import { type BunTestDb, createTestDb } from "../../bun-db/__tests__/bun-test-db";
 import { createRegistry, defineFeature } from "../../engine";
-import { createArchivedStreamsTable, createEventsTable } from "../../event-store";
+import { createArchivedStreamsTable } from "../../event-store";
 import { createNoopProvider, createPrometheusMeter } from "../../observability";
 import { createEventConsumerStateTable } from "../../pipeline";
 import { createTestRedis, type TestRedis, TestUsers } from "../../stack";
@@ -79,7 +79,6 @@ let testRedis: TestRedis;
 
 beforeAll(async () => {
   [testDb, testRedis] = await Promise.all([createTestDb(), createTestRedis()]);
-  await createEventsTable(testDb.db);
   await createArchivedStreamsTable(testDb.db);
   await createEventConsumerStateTable(testDb.db);
 });

package/src/entrypoint/__tests__/split-deploy.integration.test.ts

@@ -17,7 +17,7 @@ import { z } from "zod";
 import { type BunTestDb, createTestDb } from "../../bun-db/__tests__/bun-test-db";
 import { asRawClient } from "../../db/query";
 import { createRegistry, defineFeature } from "../../engine";
-import { createArchivedStreamsTable, createEventsTable } from "../../event-store";
+import { createArchivedStreamsTable } from "../../event-store";
 import { createEventConsumerStateTable } from "../../pipeline";
 import { createTestRedis, type TestRedis, TestUsers } from "../../stack";
 import { createAllInOneEntrypoint, createApiEntrypoint, createWorkerEntrypoint } from "../index";
@@ -125,7 +125,6 @@ let testRedis: TestRedis;
 
 beforeAll(async () => {
   [testDb, testRedis] = await Promise.all([createTestDb(), createTestRedis()]);
-  await createEventsTable(testDb.db);
   await createArchivedStreamsTable(testDb.db);
   await createEventConsumerStateTable(testDb.db);
 });

package/src/env/__tests__/compose-env-schema.test.ts

@@ -1,7 +1,15 @@
 import { describe, expect, it } from "bun:test";
 import { z } from "zod";
 import { defineFeature } from "../../engine/define-feature";
-import { camelCase, composeEnvSchema, KumikoBootError, parseEnv, pulumiConfigKey } from "../index";
+import {
+  camelCase,
+  composeEnvSchema,
+  KumikoBootError,
+  kmsSlotsOf,
+  parseEnv,
+  pulumiConfigKey,
+  readKumikoMeta,
+} from "../index";
 
 describe("composeEnvSchema", () => {
   it("merges per-feature schemas and tags sources", () => {
@@ -295,3 +303,108 @@ describe("pulumiConfigKey + camelCase", () => {
     expect(pulumiConfigKey("JWT_SECRET", undefined, undefined)).toBe("jwtSecret");
   });
 });
+
+describe("kms env slots", () => {
+  const schema = z.object({
+    MASTER_KEY: z
+      .string()
+      .min(1)
+      .meta({ kumiko: { kms: true } }),
+    MASTER_KEY_CIPHERTEXT: z.string().min(1).optional(),
+    PLAIN: z.string().min(1).optional(),
+  });
+
+  it("kmsSlotsOf lists exactly the fields declaring kms", () => {
+    expect(kmsSlotsOf(schema)).toEqual(["MASTER_KEY"]);
+  });
+
+  it("rejects a non-true kms value in the meta", () => {
+    const bad = z.string().meta({ kumiko: { kms: "yes" } });
+    expect(readKumikoMeta(bad)).toEqual({});
+  });
+
+  it("parseEnv accepts a required kms slot that is present only as ciphertext", () => {
+    expect(() => parseEnv(schema, { MASTER_KEY_CIPHERTEXT: "abc" })).not.toThrow();
+  });
+
+  it("parseEnv still requires a kms slot when no ciphertext twin is set", () => {
+    expect(() => parseEnv(schema, {})).toThrow(KumikoBootError);
+  });
+
+  it("parseEnv still validates a kms slot that is set", () => {
+    expect(() => parseEnv(schema, { MASTER_KEY: "" })).toThrow(KumikoBootError);
+  });
+
+  describe("schema carrying a refinement", () => {
+    const refined = schema.superRefine((value, ctx) => {
+      if (value.PLAIN === "forbidden") {
+        ctx.addIssue({ code: "custom", path: ["PLAIN"], message: "PLAIN is forbidden" });
+      }
+    });
+
+    it("parseEnv relaxes a ciphertext-only slot without dropping the refinement", () => {
+      expect(parseEnv(refined, { MASTER_KEY_CIPHERTEXT: "abc" })["MASTER_KEY_CIPHERTEXT"]).toBe(
+        "abc",
+      );
+      expect(() => parseEnv(refined, { MASTER_KEY_CIPHERTEXT: "abc", PLAIN: "forbidden" })).toThrow(
+        KumikoBootError,
+      );
+    });
+  });
+});
+
+describe("composeEnvSchema kms twins", () => {
+  const kmsField = z
+    .string()
+    .min(1)
+    .meta({ kumiko: { kms: true } });
+
+  it("declares the ciphertext twin of every kms field, owned by the same source", () => {
+    const secrets = defineFeature("secrets", (r) => {
+      r.envSchema(z.object({ KEY_V1: kmsField }));
+    });
+    const { schema, sources } = composeEnvSchema({
+      features: [secrets],
+      extend: z.object({ KEY_V2: kmsField }),
+    });
+
+    expect(Object.keys(schema.shape).sort()).toEqual([
+      "KEY_V1",
+      "KEY_V1_CIPHERTEXT",
+      "KEY_V2",
+      "KEY_V2_CIPHERTEXT",
+    ]);
+    expect(sources["KEY_V1_CIPHERTEXT"]).toBe("secrets");
+    expect(sources["KEY_V2_CIPHERTEXT"]).toBe("app");
+    expect(() => parseEnv(schema, {})).toThrow(KumikoBootError);
+    expect(() =>
+      parseEnv(schema, { KEY_V1_CIPHERTEXT: "a", KEY_V2_CIPHERTEXT: "b" }),
+    ).not.toThrow();
+  });
+
+  it("keeps a twin the app already declared instead of conflicting", () => {
+    const declared = z.string().min(1).optional().describe("hand-written twin");
+    const { schema } = composeEnvSchema({
+      features: [],
+      extend: z.object({ KEY: kmsField, KEY_CIPHERTEXT: declared }),
+    });
+
+    expect(schema.shape["KEY_CIPHERTEXT"]).toBe(declared);
+  });
+
+  it("adds the twin for a kms field of an optional feature too", () => {
+    const secrets = defineFeature("secrets", (r) => {
+      r.envSchema(z.object({ KEY: kmsField }));
+    });
+    const { schema } = composeEnvSchema({ features: [secrets], optionalFeatures: ["secrets"] });
+
+    expect(Object.keys(schema.shape).sort()).toEqual(["KEY", "KEY_CIPHERTEXT"]);
+    expect(kmsSlotsOf(schema)).toEqual(["KEY"]);
+  });
+
+  it("adds nothing for a schema without kms fields", () => {
+    const { schema } = composeEnvSchema({ features: [], extend: z.object({ PLAIN: z.string() }) });
+
+    expect(Object.keys(schema.shape)).toEqual(["PLAIN"]);
+  });
+});

package/src/env/index.ts

@@ -34,12 +34,18 @@ export type KumikoEnvMeta = {
     /** Force the `--secret` flag in `pulumi config set`. Default false. */
     readonly secret?: boolean;
   };
+  /** The value may be delivered as a Scaleway Key Manager ciphertext in
+   *  `<NAME>_CIPHERTEXT`. `runProdApp` decrypts it at boot when `<NAME>` itself
+   *  is unset; a set plaintext always wins. A flag, not an object: every slot
+   *  uses the same `_CIPHERTEXT` twin and one shared key (`PLATFORM_KEK_KMS_*`). */
+  readonly kms?: true;
 };
 
 function isKumikoMeta(value: unknown): value is KumikoEnvMeta {
   if (value === null || typeof value !== "object") return false;
   // @cast-boundary schema-walk — runtime-shape narrowing of zod-meta payload
-  const v = value as { pulumi?: unknown };
+  const v = value as { pulumi?: unknown; kms?: unknown };
+  if (v.kms !== undefined && v.kms !== true) return false;
   if (v.pulumi === undefined) return true;
   if (v.pulumi === null || typeof v.pulumi !== "object") return false;
   // @cast-boundary schema-walk
@@ -60,6 +66,32 @@ export function readKumikoMeta(field: z.ZodType): KumikoEnvMeta {
   return {};
 }
 
+/** Env names whose schema field declares `kms: true` — the slots
+ *  `resolvePlatformKeks` resolves from a ciphertext. */
+export function kmsSlotsOf(schema: z.ZodObject<z.ZodRawShape>): readonly string[] {
+  return Object.entries(zodShape(schema))
+    .filter(([, field]) => readKumikoMeta(field).kms === true)
+    .map(([name]) => name);
+}
+
+// A ciphertext-only slot is satisfied by its `_CIPHERTEXT` twin: the plaintext
+// only exists after the boot-time decrypt, so requiring it here would reject
+// exactly the deployment this meta enables. safeExtend, not extend: Zod 4 throws
+// on extend for schemas carrying refinements (app-level superRefine).
+function relaxCiphertextOnlySlots<S extends z.ZodObject<z.ZodRawShape>>(
+  schema: S,
+  env: Readonly<Record<string, string>>,
+): z.ZodObject<z.ZodRawShape> {
+  const shape = zodShape(schema);
+  const relaxed: Record<string, z.ZodType> = {};
+  for (const name of kmsSlotsOf(schema)) {
+    const field = shape[name];
+    if (field && env[name] === undefined && env[`${name}_CIPHERTEXT`])
+      relaxed[name] = field.optional();
+  }
+  return Object.keys(relaxed).length === 0 ? schema : schema.safeExtend(relaxed);
+}
+
 // --- Field-classification helpers (Zod v4 introspection) ---
 
 export type EnvFieldClass = "required" | "optional" | "withDefault";
@@ -144,10 +176,23 @@ export type ComposedEnvSchema = {
   readonly sources: Readonly<Record<string, string>>;
 };
 
+// `.optional()` returns a new Zod instance that drops `.meta()`, which would
+// hide the slot from `kmsSlotsOf` on the composed schema.
+function optionalKeepingKmsMeta(field: z.ZodType): z.ZodType {
+  const optional = field.optional();
+  return readKumikoMeta(field).kms === true
+    ? optional.meta({ kumiko: readKumikoMeta(field) })
+    : optional;
+}
+
 export function composeEnvSchema(options: ComposeEnvSchemaOptions): ComposedEnvSchema {
   const optionalSet = new Set(options.optionalFeatures ?? []);
   const merged: Record<string, z.ZodType> = {};
   const sources: Record<string, string> = {};
+  const kmsFields: { readonly name: string; readonly source: string }[] = [];
+  const noteKms = (name: string, field: z.ZodType, source: string): void => {
+    if (readKumikoMeta(field).kms === true) kmsFields.push({ name, source });
+  };
 
   // Framework-core first so a feature that accidentally declares the same
   // var (e.g. PORT) gets a clear conflict error citing "framework-core"
@@ -159,6 +204,7 @@ export function composeEnvSchema(options: ComposeEnvSchemaOptions): ComposedEnvS
     for (const [key, field] of Object.entries(zodShape(options.core))) {
       merged[key] = field;
       sources[key] = "framework-core";
+      noteKms(key, field, "framework-core");
     }
   }
 
@@ -178,8 +224,9 @@ export function composeEnvSchema(options: ComposeEnvSchemaOptions): ComposedEnvS
           },
         ]);
       }
-      merged[key] = wrap ? field.optional() : field;
+      merged[key] = wrap ? optionalKeepingKmsMeta(field) : field;
       sources[key] = feature.name;
+      noteKms(key, field, feature.name);
     }
   }
 
@@ -198,9 +245,23 @@ export function composeEnvSchema(options: ComposeEnvSchemaOptions): ComposedEnvS
       }
       merged[key] = field;
       sources[key] = "app";
+      noteKms(key, field, "app");
     }
   }
 
+  // The twin follows from the slot, so a versioned family (`…_V2`) needs no
+  // second declaration. An already declared twin (apps that predate this) stays.
+  for (const { name, source } of kmsFields) {
+    const twin = `${name}_CIPHERTEXT`;
+    if (merged[twin] !== undefined) continue;
+    merged[twin] = z
+      .string()
+      .min(1)
+      .optional()
+      .describe(`Key-Manager ciphertext of ${name}; used when ${name} is unset.`);
+    sources[twin] = source;
+  }
+
   return {
     schema: z.object(merged),
     sources,
@@ -282,7 +343,7 @@ export function parseEnv<S extends z.ZodObject<z.ZodRawShape>>(
     if (v !== undefined) cleaned[k] = v;
   }
 
-  const result = schema.safeParse(cleaned);
+  const result = relaxCiphertextOnlySlots(schema, cleaned).safeParse(cleaned);
   if (result.success) {
     // @cast-boundary schema-walk — z.infer<S> erasure across safeParse result
     return result.data as z.infer<S>;

package/src/es-ops/__tests__/context.integration.test.ts

@@ -21,7 +21,6 @@ import { join } from "node:path";
 import { type BunTestDb, createTestDb } from "../../bun-db/__tests__/bun-test-db";
 import { asRawClient, selectMany } from "../../db/query";
 import { createRegistry } from "../../engine";
-import { createEventsTable } from "../../event-store";
 import { createDispatcher, type Dispatcher } from "../../pipeline";
 import { ensureTemporalPolyfill } from "../../time/polyfill";
 import { createSeedMigrationContext } from "../context";
@@ -38,7 +37,6 @@ let dispatcher: Dispatcher;
 beforeAll(async () => {
   await ensureTemporalPolyfill();
   testDb = await createTestDb();
-  await createEventsTable(testDb.db);
   await createEsOperationsTable(testDb.db);
 
   const registry = createRegistry([]);

package/src/es-ops/__tests__/runner.integration.test.ts

@@ -29,7 +29,6 @@ import {
   SYSTEM_TENANT_ID,
 } from "../../engine";
 import { VersionConflictError } from "../../errors";
-import { createEventsTable } from "../../event-store";
 import { createDispatcher, type Dispatcher } from "../../pipeline";
 import { createTestDb, type TestDb, unsafeCreateEntityTable } from "../../stack";
 import { ensureTemporalPolyfill } from "../../time/polyfill";
@@ -89,7 +88,6 @@ let registry: ReturnType<typeof createRegistry>;
 beforeAll(async () => {
   await ensureTemporalPolyfill();
   testDb = await createTestDb();
-  await createEventsTable(testDb.db);
   await createEsOperationsTable(testDb.db);
   await unsafeCreateEntityTable(testDb.db, probeEntity, "esops-probe");
   registry = createRegistry([seedTestFeature]);

package/src/event-store/__tests__/admin-api.integration.test.ts

@@ -17,7 +17,7 @@ import { generateId as uuid } from "../../utils";
 import { appendRaw, appendRawBatch, type RawEventToAppend } from "../admin-api";
 import { IdempotentAppendConflictError, VersionConflictError } from "../errors";
 import { append, loadAggregate } from "../event-store";
-import { createEventsTable, eventsTable } from "../events-schema";
+import { eventsTable } from "../events-schema";
 
 // Test-only spy: wrap a DbConnection's `.unsafe()` to capture the SQL
 // string of every query the framework runs. Used to assert batching
@@ -47,7 +47,6 @@ const legacyUser = "legacy-user-42";
 
 beforeAll(async () => {
   testDb = await createTestDb();
-  await createEventsTable(testDb.db);
 });
 
 afterAll(async () => {

package/src/event-store/__tests__/backfill-pii.integration.test.ts

@@ -34,7 +34,6 @@ import type { Registry, TenantId } from "../../engine/types";
 import { createTestDb, type TestDb, unsafeCreateEntityTable } from "../../stack";
 import { generateId } from "../../utils";
 import { append, loadAggregate } from "../event-store";
-import { createEventsTable } from "../events-schema";
 
 const TENANT = "00000000-0000-4000-8000-000000000001" as TenantId;
 const BIDX_KEY = Buffer.alloc(32, 5).toString("base64");
@@ -145,7 +144,6 @@ beforeAll(async () => {
     surveyFeature,
     signalsFeature,
   ]);
-  await createEventsTable(testDb.db);
   await unsafeCreateEntityTable(testDb.db, contactEntity, "contact");
   await unsafeCreateEntityTable(testDb.db, noteEntity, "note");
   await unsafeCreateEntityTable(testDb.db, surveyEntity, "survey");

package/src/event-store/__tests__/event-store.integration.test.ts

@@ -5,7 +5,6 @@ import { ensureTemporalPolyfill } from "../../time/polyfill";
 import { generateId as uuid } from "../../utils";
 import {
   append,
-  createEventsTable,
   IdempotentAppendConflictError,
   loadAggregate,
   loadAggregateAsOf,
@@ -25,7 +24,6 @@ const userA = uuid();
 beforeAll(async () => {
   await ensureTemporalPolyfill();
   testDb = await createTestDb();
-  await createEventsTable(testDb.db);
 });
 
 afterAll(async () => {

package/src/event-store/__tests__/get-stream-version-perf.integration.test.ts

@@ -15,7 +15,7 @@ import { insertMany } from "../../bun-db/query";
 import type { TenantId } from "../../engine/types";
 import { ensureTemporalPolyfill } from "../../time/polyfill";
 import { generateId as uuid } from "../../utils";
-import { createEventsTable, eventsTable, getStreamVersion } from "../index";
+import { eventsTable, getStreamVersion } from "../index";
 
 let testDb: BunTestDb;
 const tenantId: TenantId = uuid();
@@ -24,7 +24,6 @@ const userId = uuid();
 beforeAll(async () => {
   await ensureTemporalPolyfill();
   testDb = await createTestDb();
-  await createEventsTable(testDb.db);
 });
 
 afterAll(async () => {

package/src/event-store/__tests__/perf.integration.test.ts

@@ -24,13 +24,7 @@ import { asRawClient } from "../../db/query";
 import type { TenantId } from "../../engine/types";
 import { ensureTemporalPolyfill } from "../../time/polyfill";
 import { generateId as uuid } from "../../utils";
-import {
-  append,
-  createEventsTable,
-  loadAggregate,
-  loadAggregateWithSnapshot,
-  saveSnapshot,
-} from "../index";
+import { append, loadAggregate, loadAggregateWithSnapshot, saveSnapshot } from "../index";
 
 let testDb: BunTestDb;
 const tenantId = uuid() as TenantId;
@@ -39,7 +33,6 @@ const userId = uuid();
 beforeAll(async () => {
   await ensureTemporalPolyfill();
   testDb = await createTestDb();
-  await createEventsTable(testDb.db);
 });
 
 afterAll(async () => {

package/src/event-store/__tests__/provenance-append.integration.test.ts

@@ -5,7 +5,7 @@ import { createTenantDb, type TenantDb } from "../../db/tenant-db";
 import { AccessDeniedError, InternalError } from "../../errors";
 import { ensureTemporalPolyfill } from "../../time/polyfill";
 import { generateId as uuid } from "../../utils";
-import { createEventsTable, loadAggregate, VersionConflictError } from "../index";
+import { loadAggregate, VersionConflictError } from "../index";
 import { appendProvenanceEvent, type ProvenanceEventInput } from "../provenance-append";
 
 let testDb: BunTestDb;
@@ -37,7 +37,6 @@ function provenanceEvent(overrides: Partial<ProvenanceEventInput>): ProvenanceEv
 beforeAll(async () => {
   await ensureTemporalPolyfill();
   testDb = await createTestDb();
-  await createEventsTable(testDb.db);
   tdb = createTenantDb(testDb.db, tenantA);
 });
 

package/src/event-store/__tests__/snapshot.integration.test.ts

@@ -22,7 +22,6 @@ import { generateId as uuid } from "../../utils";
 import {
   append,
   archiveStream,
-  createEventsTable,
   loadAggregate,
   loadAggregateWithSnapshot,
   loadLatestSnapshot,
@@ -56,7 +55,6 @@ const reducer: SnapshotReducer<CounterState> = (state, event) => {
 beforeAll(async () => {
   await ensureTemporalPolyfill();
   bun = await createTestDb();
-  await createEventsTable(bun.db);
 });
 
 afterAll(async () => {

package/src/event-store/__tests__/upcaster-dead-letter.integration.test.ts

@@ -11,7 +11,7 @@ import { type BunTestDb, createTestDb } from "../../bun-db/__tests__/bun-test-db
 import { asRawClient, insertOne, selectMany } from "../../db/query";
 import { ensureTemporalPolyfill } from "../../time/polyfill";
 import type { StoredEvent } from "../event-store";
-import { createEventsTable, eventsTable } from "../events-schema";
+import { eventsTable } from "../events-schema";
 import { type EventUpcasters, makeUpcastCtx, upcastStoredEvents } from "../upcaster";
 import {
   createUpcasterDeadLetterTable,
@@ -81,7 +81,6 @@ const passthroughUpcasters: EventUpcasters = new Map([
 beforeAll(async () => {
   await ensureTemporalPolyfill();
   testDb = await createTestDb();
-  await createEventsTable(testDb.db);
   await createUpcasterDeadLetterTable(testDb.db);
 });
 

package/src/event-store/__tests__/upcaster.integration.test.ts

@@ -25,7 +25,7 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "../../stack";
-import { append, createEventsTable } from "../index";
+import { append } from "../index";
 import { upcastStoredEvent } from "../upcaster";
 
 // --- Fixture entity + projection table ---
@@ -113,7 +113,6 @@ const orderExecutor = createEventStoreExecutor(orderTable, orderEntity, {
 beforeAll(async () => {
   testDb = await createTestDb();
   await unsafeCreateEntityTable(testDb.db, orderEntity, "upcast-order");
-  await createEventsTable(testDb.db);
   const { createProjectionStateTable } = await import("../../pipeline");
   await createProjectionStateTable(testDb.db);
   await unsafePushTables(testDb.db, { upcastOrderSummary: orderSummaryTable });

package/src/files/__tests__/files.integration.test.ts

@@ -14,7 +14,7 @@ import {
   defineFeature,
   type SessionUser,
 } from "../../engine";
-import { createEventsTable, loadAggregate } from "../../event-store";
+import { loadAggregate } from "../../event-store";
 import {
   createTestDb,
   createTestUser,
@@ -79,7 +79,6 @@ beforeAll(async () => {
   await unsafeCreateEntityTable(testDb.db, testTenantEntity);
   // Event-store table: the upload route appends files:event:uploaded in the
   // same tx as the FileRef insert. Without events, upload would 500.
-  await createEventsTable(testDb.db);
 
   const registry = createRegistry([tenantFeature]);
   const storageProvider = createLocalProvider(storagePath);

package/src/jobs/__tests__/job-write-as.integration.test.ts

@@ -21,7 +21,7 @@ import {
   type WriteResult,
 } from "../../engine";
 import { createWorkerEntrypoint } from "../../entrypoint";
-import { createArchivedStreamsTable, createEventsTable } from "../../event-store";
+import { createArchivedStreamsTable } from "../../event-store";
 import { createEventConsumerStateTable } from "../../pipeline";
 import { createTestRedis, type TestRedis } from "../../stack";
 import { waitFor } from "../../testing";
@@ -110,7 +110,6 @@ let testRedis: TestRedis;
 
 beforeAll(async () => {
   [testDb, testRedis] = await Promise.all([createTestDb(), createTestRedis()]);
-  await createEventsTable(testDb.db);
   await createArchivedStreamsTable(testDb.db);
   await createEventConsumerStateTable(testDb.db);
 });

package/src/migrations/__tests__/pending-rebuilds.integration.test.ts

@@ -20,7 +20,6 @@ import {
   defineFeature,
   type ProjectionDefinition,
 } from "../../engine";
-import { createEventsTable } from "../../event-store";
 import type { JobRunner } from "../../jobs/job-runner";
 import { createProjectionStateTable } from "../../pipeline";
 import {
@@ -97,7 +96,6 @@ let markerDir: string;
 beforeAll(async () => {
   testDb = await createTestDb();
   await unsafeCreateEntityTable(testDb.db, itemEntity, "pending-item");
-  await createEventsTable(testDb.db);
   await createProjectionStateTable(testDb.db);
   await unsafePushTables(testDb.db, {
     readPendingCounts: countsTable,

package/src/pipeline/__tests__/blind-index-rebuild-guard.integration.test.ts

@@ -10,7 +10,6 @@ import { asRawClient } from "../../db/query";
 import { buildEntityTable } from "../../db/table-builder";
 import { createTenantDb, type TenantDb } from "../../db/tenant-db";
 import { createEntity, createRegistry, createTextField, defineFeature } from "../../engine";
-import { createEventsTable } from "../../event-store";
 import { createProjectionStateTable, rebuildProjection } from "../../pipeline";
 import { createTestDb, type TestDb, TestUsers, unsafeCreateEntityTable } from "../../stack";
 
@@ -38,7 +37,6 @@ const crud = createEventStoreExecutor(personTable, personEntity, { entityName: "
 beforeAll(async () => {
   testDb = await createTestDb();
   await unsafeCreateEntityTable(testDb.db, personEntity, "person");
-  await createEventsTable(testDb.db);
   await createProjectionStateTable(testDb.db);
   tdb = createTenantDb(testDb.db, admin.tenantId);
 });

package/src/pipeline/__tests__/cascade-handler.integration.test.ts

@@ -11,7 +11,6 @@ import {
   defineFeature,
   type Registry,
 } from "../../engine";
-import { createEventsTable } from "../../event-store";
 import { TestUsers, unsafeCreateEntityTable } from "../../stack";
 import { ensureTemporalPolyfill } from "../../time/polyfill";
 import { createCascadeDeleteHook } from "../cascade-handler";
@@ -96,7 +95,6 @@ const memberEntity = createEntity({
 beforeAll(async () => {
   await ensureTemporalPolyfill();
   testDb = await createTestDb();
-  await createEventsTable(testDb.db);
   tdb = createTenantDb(testDb.db, admin.tenantId);
 
   await unsafeCreateEntityTable(testDb.db, departmentEntity);

package/src/pipeline/__tests__/perf-rebuild.integration.test.ts

@@ -16,7 +16,6 @@ import { integer, table as pgTable, uuid as pgUuid } from "../../db/dialect";
 import { asRawClient } from "../../db/query";
 import { createEntity, createRegistry, createTextField, defineFeature } from "../../engine";
 import type { ProjectionDefinition } from "../../engine/types";
-import { createEventsTable } from "../../event-store";
 import { createProjectionStateTable, rebuildProjection } from "../../pipeline";
 import { TestUsers, unsafePushTables } from "../../stack";
 import { ensureTemporalPolyfill } from "../../time/polyfill";
@@ -68,7 +67,6 @@ const qualifiedProjectionName = "perfrebuild:projection:task-count";
 beforeAll(async () => {
   await ensureTemporalPolyfill();
   testDb = await createTestDb();
-  await createEventsTable(testDb.db);
   await createProjectionStateTable(testDb.db);
   await unsafePushTables(testDb.db, { perf_rebuild_task_count: taskCountTable });
 });

package/src/pipeline/__tests__/projection-rebuild.integration.test.ts

@@ -26,7 +26,7 @@ import {
   defineFeature,
 } from "../../engine";
 import type { ProjectionDefinition } from "../../engine/types";
-import { archiveStream, createEventsTable } from "../../event-store";
+import { archiveStream } from "../../event-store";
 import {
   createProjectionStateTable,
   getAllProjectionProgress,
@@ -104,7 +104,6 @@ const executor = createEventStoreExecutor(itemTable, itemEntity, { entityName: "
 beforeAll(async () => {
   testDb = await createTestDb();
   await unsafeCreateEntityTable(testDb.db, itemEntity, "rebuild-item");
-  await createEventsTable(testDb.db);
   await createProjectionStateTable(testDb.db);
   await unsafePushTables(testDb.db, { rebuildItemsPerGroup: itemsPerGroupTable });
   tdb = createTenantDb(testDb.db, admin.tenantId);

package/src/pipeline/__tests__/rebuild-poison-quarantine.integration.test.ts

@@ -23,7 +23,7 @@ import { buildEntityTable } from "../../db/table-builder";
 import { createTenantDb, type TenantDb } from "../../db/tenant-db";
 import { createEntity, createTextField, defineApply, defineFeature } from "../../engine";
 import type { ProjectionDefinition } from "../../engine/types";
-import { append, createEventsTable } from "../../event-store";
+import { append } from "../../event-store";
 import { listRebuildDeadLetters } from "../../event-store/rebuild-dead-letter";
 import {
   createProjectionStateTable,
@@ -140,7 +140,6 @@ const executor = createEventStoreExecutor(itemTable, itemEntity, { entityName: "
 beforeAll(async () => {
   stack = await setupTestStack({ features: [feature] });
   await unsafeCreateEntityTable(stack.db, itemEntity, "poison-item");
-  await createEventsTable(stack.db);
   await createProjectionStateTable(stack.db);
   await unsafePushTables(stack.db, {
     poisonCounter: counterTable,

package/src/search/__tests__/reindex-entity.integration.test.ts

@@ -17,7 +17,6 @@ import {
   createTenantDb,
 } from "@cosmicdrift/kumiko-framework/db";
 import { createEntity, createTextField, defineFeature } from "@cosmicdrift/kumiko-framework/engine";
-import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import { reindexEntity } from "@cosmicdrift/kumiko-framework/search";
 import {
   setupTestStack,
@@ -67,7 +66,6 @@ beforeAll(async () => {
   stack = await setupTestStack({ features: [widgetFeature, contactFeature] });
   await unsafeCreateEntityTable(stack.db, widgetEntity);
   await unsafeCreateEntityTable(stack.db, contactEntity, "contact");
-  await createEventsTable(stack.db);
   // Shared across both pii tests below (not per-test) — reindexEntity scans
   // the whole tenant table regardless of which test created which row, so a
   // fresh KMS instance per test would make earlier rows' subject keys

package/src/search/__tests__/search-pii-derived-index.integration.test.ts

@@ -11,7 +11,6 @@ import {
 } from "../../crypto";
 import { asRawClient, buildEntityTable, createEventStoreExecutor, createTenantDb } from "../../db";
 import { createEntity, createRegistry, createTextField, defineFeature } from "../../engine";
-import { createEventsTable } from "../../event-store";
 import { setupTestStack, type TestStack, TestUsers, unsafeCreateEntityTable } from "../../stack";
 import { purgeSearchDocumentsForSubject } from "../purge-subject";
 
@@ -53,7 +52,6 @@ const admin = TestUsers.admin;
 beforeAll(async () => {
   stack = await setupTestStack({ features: [contactFeature] });
   await unsafeCreateEntityTable(stack.db, contactEntity, "contact");
-  await createEventsTable(stack.db);
 });
 
 afterAll(async () => {