provekit 0.1.0__py3-none-any.whl

provekit/migrations/versions/49e8ab812556_baseline_schema.py

@@ -0,0 +1,241 @@
+"""baseline schema
+
+Revision ID: 49e8ab812556
+Revises: 
+Create Date: 2026-07-16 23:49:32.276669
+"""
+from alembic import op
+import sqlalchemy as sa
+import provekit.models
+
+
+revision = '49e8ab812556'
+down_revision = None
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    # ### commands auto generated by Alembic - please adjust! ###
+    op.create_table('users',
+    sa.Column('id', sa.Integer(), nullable=False),
+    sa.Column('email', sa.String(length=255), nullable=False),
+    sa.Column('name', sa.String(length=160), nullable=False),
+    sa.Column('password_hash', sa.String(length=255), nullable=False),
+    sa.Column('auth_provider', sa.String(length=32), nullable=False),
+    sa.Column('created_at', sa.DateTime(), nullable=False),
+    sa.PrimaryKeyConstraint('id', name=op.f('pk_users')),
+    sa.UniqueConstraint('email', name=op.f('uq_users_email'))
+    )
+    op.create_table('workspaces',
+    sa.Column('id', sa.Integer(), nullable=False),
+    sa.Column('name', sa.String(length=160), nullable=False),
+    sa.Column('owner_user_id', sa.Integer(), nullable=False),
+    sa.Column('created_at', sa.DateTime(), nullable=False),
+    sa.ForeignKeyConstraint(['owner_user_id'], ['users.id'], name=op.f('fk_workspaces_owner_user_id_users')),
+    sa.PrimaryKeyConstraint('id', name=op.f('pk_workspaces'))
+    )
+    with op.batch_alter_table('workspaces', schema=None) as batch_op:
+        batch_op.create_index(batch_op.f('ix_workspaces_owner_user_id'), ['owner_user_id'], unique=False)
+
+    op.create_table('collections',
+    sa.Column('id', sa.Integer(), nullable=False),
+    sa.Column('workspace_id', sa.Integer(), nullable=True),
+    sa.Column('name', sa.String(length=120), nullable=False),
+    sa.Column('created_at', sa.DateTime(), nullable=False),
+    sa.ForeignKeyConstraint(['workspace_id'], ['workspaces.id'], name=op.f('fk_collections_workspace_id_workspaces')),
+    sa.PrimaryKeyConstraint('id', name=op.f('pk_collections'))
+    )
+    with op.batch_alter_table('collections', schema=None) as batch_op:
+        batch_op.create_index(batch_op.f('ix_collections_workspace_id'), ['workspace_id'], unique=False)
+
+    op.create_table('connections',
+    sa.Column('id', sa.Integer(), nullable=False),
+    sa.Column('workspace_id', sa.Integer(), nullable=True),
+    sa.Column('name', sa.String(length=120), nullable=False),
+    sa.Column('kind', sa.String(length=16), nullable=False),
+    sa.Column('config', provekit.models.SealedJSON(), nullable=False),
+    sa.Column('created_at', sa.DateTime(), nullable=False),
+    sa.ForeignKeyConstraint(['workspace_id'], ['workspaces.id'], name=op.f('fk_connections_workspace_id_workspaces')),
+    sa.PrimaryKeyConstraint('id', name=op.f('pk_connections'))
+    )
+    with op.batch_alter_table('connections', schema=None) as batch_op:
+        batch_op.create_index(batch_op.f('ix_connections_workspace_id'), ['workspace_id'], unique=False)
+
+    op.create_table('datasets',
+    sa.Column('id', sa.Integer(), nullable=False),
+    sa.Column('workspace_id', sa.Integer(), nullable=True),
+    sa.Column('name', sa.String(length=160), nullable=False),
+    sa.Column('rows', sa.JSON(), nullable=False),
+    sa.Column('created_at', sa.DateTime(), nullable=False),
+    sa.ForeignKeyConstraint(['workspace_id'], ['workspaces.id'], name=op.f('fk_datasets_workspace_id_workspaces')),
+    sa.PrimaryKeyConstraint('id', name=op.f('pk_datasets'))
+    )
+    with op.batch_alter_table('datasets', schema=None) as batch_op:
+        batch_op.create_index(batch_op.f('ix_datasets_workspace_id'), ['workspace_id'], unique=False)
+
+    op.create_table('environments',
+    sa.Column('id', sa.Integer(), nullable=False),
+    sa.Column('workspace_id', sa.Integer(), nullable=True),
+    sa.Column('name', sa.String(length=120), nullable=False),
+    sa.Column('variables', sa.JSON(), nullable=False),
+    sa.Column('is_active', sa.Boolean(), nullable=False),
+    sa.ForeignKeyConstraint(['workspace_id'], ['workspaces.id'], name=op.f('fk_environments_workspace_id_workspaces')),
+    sa.PrimaryKeyConstraint('id', name=op.f('pk_environments'))
+    )
+    with op.batch_alter_table('environments', schema=None) as batch_op:
+        batch_op.create_index(batch_op.f('ix_environments_workspace_id'), ['workspace_id'], unique=False)
+
+    op.create_table('flows',
+    sa.Column('id', sa.Integer(), nullable=False),
+    sa.Column('workspace_id', sa.Integer(), nullable=True),
+    sa.Column('name', sa.String(length=160), nullable=False),
+    sa.Column('description', sa.Text(), nullable=False),
+    sa.Column('nodes', sa.JSON(), nullable=False),
+    sa.Column('edges', sa.JSON(), nullable=False),
+    sa.Column('updated_at', sa.DateTime(), nullable=False),
+    sa.ForeignKeyConstraint(['workspace_id'], ['workspaces.id'], name=op.f('fk_flows_workspace_id_workspaces')),
+    sa.PrimaryKeyConstraint('id', name=op.f('pk_flows'))
+    )
+    with op.batch_alter_table('flows', schema=None) as batch_op:
+        batch_op.create_index(batch_op.f('ix_flows_workspace_id'), ['workspace_id'], unique=False)
+
+    op.create_table('prompts',
+    sa.Column('id', sa.Integer(), nullable=False),
+    sa.Column('workspace_id', sa.Integer(), nullable=True),
+    sa.Column('key', sa.String(length=80), nullable=False),
+    sa.Column('name', sa.String(length=160), nullable=False),
+    sa.Column('description', sa.Text(), nullable=False),
+    sa.Column('content', sa.Text(), nullable=False),
+    sa.Column('updated_at', sa.DateTime(), nullable=False),
+    sa.ForeignKeyConstraint(['workspace_id'], ['workspaces.id'], name=op.f('fk_prompts_workspace_id_workspaces')),
+    sa.PrimaryKeyConstraint('id', name=op.f('pk_prompts')),
+    sa.UniqueConstraint('workspace_id', 'key', name='uq_prompt_key')
+    )
+    with op.batch_alter_table('prompts', schema=None) as batch_op:
+        batch_op.create_index(batch_op.f('ix_prompts_workspace_id'), ['workspace_id'], unique=False)
+
+    op.create_table('workspace_members',
+    sa.Column('id', sa.Integer(), nullable=False),
+    sa.Column('workspace_id', sa.Integer(), nullable=False),
+    sa.Column('user_id', sa.Integer(), nullable=False),
+    sa.Column('role', sa.String(length=16), nullable=False),
+    sa.ForeignKeyConstraint(['user_id'], ['users.id'], name=op.f('fk_workspace_members_user_id_users')),
+    sa.ForeignKeyConstraint(['workspace_id'], ['workspaces.id'], name=op.f('fk_workspace_members_workspace_id_workspaces')),
+    sa.PrimaryKeyConstraint('id', name=op.f('pk_workspace_members')),
+    sa.UniqueConstraint('workspace_id', 'user_id', name='uq_member')
+    )
+    with op.batch_alter_table('workspace_members', schema=None) as batch_op:
+        batch_op.create_index(batch_op.f('ix_workspace_members_user_id'), ['user_id'], unique=False)
+        batch_op.create_index(batch_op.f('ix_workspace_members_workspace_id'), ['workspace_id'], unique=False)
+
+    op.create_table('deployments',
+    sa.Column('id', sa.Integer(), nullable=False),
+    sa.Column('workspace_id', sa.Integer(), nullable=True),
+    sa.Column('flow_id', sa.Integer(), nullable=True),
+    sa.Column('slug', sa.String(length=80), nullable=False),
+    sa.Column('version', sa.Integer(), nullable=False),
+    sa.Column('name', sa.String(length=160), nullable=False),
+    sa.Column('snapshot', sa.JSON(), nullable=False),
+    sa.Column('api_key_hash', sa.String(length=128), nullable=False),
+    sa.Column('active', sa.Boolean(), nullable=False),
+    sa.Column('created_at', sa.DateTime(), nullable=False),
+    sa.ForeignKeyConstraint(['flow_id'], ['flows.id'], name=op.f('fk_deployments_flow_id_flows')),
+    sa.ForeignKeyConstraint(['workspace_id'], ['workspaces.id'], name=op.f('fk_deployments_workspace_id_workspaces')),
+    sa.PrimaryKeyConstraint('id', name=op.f('pk_deployments'))
+    )
+    with op.batch_alter_table('deployments', schema=None) as batch_op:
+        batch_op.create_index(batch_op.f('ix_deployments_active'), ['active'], unique=False)
+        batch_op.create_index(batch_op.f('ix_deployments_slug'), ['slug'], unique=False)
+        batch_op.create_index(batch_op.f('ix_deployments_workspace_id'), ['workspace_id'], unique=False)
+
+    op.create_table('requests',
+    sa.Column('id', sa.Integer(), nullable=False),
+    sa.Column('workspace_id', sa.Integer(), nullable=True),
+    sa.Column('collection_id', sa.Integer(), nullable=True),
+    sa.Column('name', sa.String(length=160), nullable=False),
+    sa.Column('type', sa.String(length=16), nullable=False),
+    sa.Column('payload', sa.JSON(), nullable=False),
+    sa.Column('updated_at', sa.DateTime(), nullable=False),
+    sa.ForeignKeyConstraint(['collection_id'], ['collections.id'], name=op.f('fk_requests_collection_id_collections')),
+    sa.ForeignKeyConstraint(['workspace_id'], ['workspaces.id'], name=op.f('fk_requests_workspace_id_workspaces')),
+    sa.PrimaryKeyConstraint('id', name=op.f('pk_requests'))
+    )
+    with op.batch_alter_table('requests', schema=None) as batch_op:
+        batch_op.create_index(batch_op.f('ix_requests_workspace_id'), ['workspace_id'], unique=False)
+
+    op.create_table('runs',
+    sa.Column('id', sa.Integer(), nullable=False),
+    sa.Column('workspace_id', sa.Integer(), nullable=True),
+    sa.Column('deployment_id', sa.Integer(), nullable=True),
+    sa.Column('type', sa.String(length=16), nullable=False),
+    sa.Column('label', sa.String(length=200), nullable=False),
+    sa.Column('request', sa.JSON(), nullable=False),
+    sa.Column('result', sa.JSON(), nullable=False),
+    sa.Column('status', sa.String(length=16), nullable=False),
+    sa.Column('duration_ms', sa.Integer(), nullable=False),
+    sa.Column('error', sa.Text(), nullable=False),
+    sa.Column('created_at', sa.DateTime(), nullable=False),
+    sa.ForeignKeyConstraint(['deployment_id'], ['deployments.id'], name=op.f('fk_runs_deployment_id_deployments')),
+    sa.ForeignKeyConstraint(['workspace_id'], ['workspaces.id'], name=op.f('fk_runs_workspace_id_workspaces')),
+    sa.PrimaryKeyConstraint('id', name=op.f('pk_runs'))
+    )
+    with op.batch_alter_table('runs', schema=None) as batch_op:
+        batch_op.create_index(batch_op.f('ix_runs_deployment_id'), ['deployment_id'], unique=False)
+        batch_op.create_index(batch_op.f('ix_runs_workspace_id'), ['workspace_id'], unique=False)
+
+    # ### end Alembic commands ###
+
+
+def downgrade() -> None:
+    # ### commands auto generated by Alembic - please adjust! ###
+    with op.batch_alter_table('runs', schema=None) as batch_op:
+        batch_op.drop_index(batch_op.f('ix_runs_workspace_id'))
+        batch_op.drop_index(batch_op.f('ix_runs_deployment_id'))
+
+    op.drop_table('runs')
+    with op.batch_alter_table('requests', schema=None) as batch_op:
+        batch_op.drop_index(batch_op.f('ix_requests_workspace_id'))
+
+    op.drop_table('requests')
+    with op.batch_alter_table('deployments', schema=None) as batch_op:
+        batch_op.drop_index(batch_op.f('ix_deployments_workspace_id'))
+        batch_op.drop_index(batch_op.f('ix_deployments_slug'))
+        batch_op.drop_index(batch_op.f('ix_deployments_active'))
+
+    op.drop_table('deployments')
+    with op.batch_alter_table('workspace_members', schema=None) as batch_op:
+        batch_op.drop_index(batch_op.f('ix_workspace_members_workspace_id'))
+        batch_op.drop_index(batch_op.f('ix_workspace_members_user_id'))
+
+    op.drop_table('workspace_members')
+    with op.batch_alter_table('prompts', schema=None) as batch_op:
+        batch_op.drop_index(batch_op.f('ix_prompts_workspace_id'))
+
+    op.drop_table('prompts')
+    with op.batch_alter_table('flows', schema=None) as batch_op:
+        batch_op.drop_index(batch_op.f('ix_flows_workspace_id'))
+
+    op.drop_table('flows')
+    with op.batch_alter_table('environments', schema=None) as batch_op:
+        batch_op.drop_index(batch_op.f('ix_environments_workspace_id'))
+
+    op.drop_table('environments')
+    with op.batch_alter_table('datasets', schema=None) as batch_op:
+        batch_op.drop_index(batch_op.f('ix_datasets_workspace_id'))
+
+    op.drop_table('datasets')
+    with op.batch_alter_table('connections', schema=None) as batch_op:
+        batch_op.drop_index(batch_op.f('ix_connections_workspace_id'))
+
+    op.drop_table('connections')
+    with op.batch_alter_table('collections', schema=None) as batch_op:
+        batch_op.drop_index(batch_op.f('ix_collections_workspace_id'))
+
+    op.drop_table('collections')
+    with op.batch_alter_table('workspaces', schema=None) as batch_op:
+        batch_op.drop_index(batch_op.f('ix_workspaces_owner_user_id'))
+
+    op.drop_table('workspaces')
+    op.drop_table('users')
+    # ### end Alembic commands ###

provekit/migrations/versions/819ed5ff183e_workspace_ingest_key.py

@@ -0,0 +1,35 @@
+"""workspace ingest key
+
+Revision ID: 819ed5ff183e
+Revises: 49e8ab812556
+Create Date: 2026-07-17 00:25:59.721254
+"""
+from alembic import op
+import sqlalchemy as sa
+
+
+revision = '819ed5ff183e'
+down_revision = '49e8ab812556'
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    # ### commands auto generated by Alembic - please adjust! ###
+    with op.batch_alter_table('workspaces', schema=None) as batch_op:
+        # server_default="" so adding this NOT NULL column succeeds on databases that
+        # already have workspace rows (otherwise the ALTER fails at upgrade time).
+        batch_op.add_column(sa.Column('ingest_key_hash', sa.String(length=128), nullable=False,
+                                      server_default=''))
+        batch_op.create_index(batch_op.f('ix_workspaces_ingest_key_hash'), ['ingest_key_hash'], unique=False)
+
+    # ### end Alembic commands ###
+
+
+def downgrade() -> None:
+    # ### commands auto generated by Alembic - please adjust! ###
+    with op.batch_alter_table('workspaces', schema=None) as batch_op:
+        batch_op.drop_index(batch_op.f('ix_workspaces_ingest_key_hash'))
+        batch_op.drop_column('ingest_key_hash')
+
+    # ### end Alembic commands ###

provekit/migrations/versions/a1b2c3d4e5f6_user_token_version.py

@@ -0,0 +1,27 @@
+"""user token_version
+
+Revision ID: a1b2c3d4e5f6
+Revises: 323eb73d463c
+Create Date: 2026-07-17 06:10:00.000000
+"""
+from alembic import op
+import sqlalchemy as sa
+
+
+revision = 'a1b2c3d4e5f6'
+down_revision = '323eb73d463c'
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    with op.batch_alter_table('users', schema=None) as batch_op:
+        # server_default="0" so the NOT NULL column populates on existing rows; all current
+        # sessions carry v=0 (or no v, read as 0) and stay valid until the next reset.
+        batch_op.add_column(sa.Column('token_version', sa.Integer(), nullable=False,
+                                      server_default='0'))
+
+
+def downgrade() -> None:
+    with op.batch_alter_table('users', schema=None) as batch_op:
+        batch_op.drop_column('token_version')

provekit/models.py

@@ -0,0 +1,191 @@
+"""ProveKit data model. Everything the console persists: connections (providers),
+collections + saved requests, environments (variables), and run history."""
+from datetime import datetime, timezone
+
+from sqlalchemy import JSON, DateTime, ForeignKey, Integer, String, Text, TypeDecorator, UniqueConstraint
+from sqlalchemy.orm import Mapped, mapped_column
+
+from .database import Base
+
+
+def _ws_fk() -> Mapped[int]:
+    """Workspace FK shared by every tenant-scoped table (indexed for per-workspace queries)."""
+    return mapped_column(ForeignKey("workspaces.id"), index=True, nullable=True)
+
+
+def _now() -> datetime:
+    return datetime.now(timezone.utc)
+
+
+def iso_utc(dt: datetime | None) -> str | None:
+    """Serialize a stored timestamp as ISO-8601 with an explicit UTC offset. Timestamps
+    are written in UTC (_now), but SQLite hands them back naive — without the offset the
+    browser would parse them as local time."""
+    if dt is None:
+        return None
+    if dt.tzinfo is None:
+        dt = dt.replace(tzinfo=timezone.utc)
+    return dt.isoformat()
+
+
+class SealedJSON(TypeDecorator):
+    """JSON column whose secret fields (api_key, auth headers) are encrypted at rest.
+    Application code always sees plaintext; the database file never does."""
+    impl = JSON
+    cache_ok = True
+
+    def process_bind_param(self, value, dialect):
+        from .services.sealing import seal_config
+        return seal_config(value) if isinstance(value, dict) else value
+
+    def process_result_value(self, value, dialect):
+        from .services.sealing import unseal_config
+        return unseal_config(value) if isinstance(value, dict) else value
+
+
+class User(Base):
+    """An account. password_hash is null for OAuth-only users."""
+    __tablename__ = "users"
+    id: Mapped[int] = mapped_column(primary_key=True)
+    email: Mapped[str] = mapped_column(String(255), unique=True)
+    name: Mapped[str] = mapped_column(String(160), default="")
+    password_hash: Mapped[str] = mapped_column(String(255), default="")
+    auth_provider: Mapped[str] = mapped_column(String(32), default="password")  # password | github | local
+    email_verified: Mapped[bool] = mapped_column(default=False)
+    # Bumped on password reset to revoke every previously-issued token (sessions + the
+    # just-used reset link): tokens embed the version and are rejected once it moves on.
+    token_version: Mapped[int] = mapped_column(default=0)
+    created_at: Mapped[datetime] = mapped_column(DateTime, default=_now)
+
+
+class Workspace(Base):
+    """A tenant boundary. Every user gets a default workspace; teams share one later."""
+    __tablename__ = "workspaces"
+    id: Mapped[int] = mapped_column(primary_key=True)
+    name: Mapped[str] = mapped_column(String(160), default="My workspace")
+    owner_user_id: Mapped[int] = mapped_column(ForeignKey("users.id"), index=True)
+    # Bearer token for unattended OTLP trace ingest (exporters can't send cookies).
+    ingest_key_hash: Mapped[str] = mapped_column(String(128), default="", index=True)
+    created_at: Mapped[datetime] = mapped_column(DateTime, default=_now)
+
+
+class WorkspaceMember(Base):
+    __tablename__ = "workspace_members"
+    id: Mapped[int] = mapped_column(primary_key=True)
+    workspace_id: Mapped[int] = mapped_column(ForeignKey("workspaces.id"), index=True)
+    user_id: Mapped[int] = mapped_column(ForeignKey("users.id"), index=True)
+    role: Mapped[str] = mapped_column(String(16), default="member")  # owner | member
+    __table_args__ = (UniqueConstraint("workspace_id", "user_id", name="uq_member"),)
+
+
+class Connection(Base):
+    """A provider you can run against. kind = llm | mcp | agent."""
+    __tablename__ = "connections"
+    id: Mapped[int] = mapped_column(primary_key=True)
+    workspace_id: Mapped[int] = _ws_fk()
+    name: Mapped[str] = mapped_column(String(120))
+    kind: Mapped[str] = mapped_column(String(16))  # llm | mcp | agent
+    # config shape by kind:
+    #   llm   -> {provider: openai|anthropic|compatible, base_url, api_key, models: [str]}
+    #   mcp   -> {url}
+    #   agent -> {base_url, headers: {}}
+    config: Mapped[dict] = mapped_column(SealedJSON, default=dict)
+    created_at: Mapped[datetime] = mapped_column(DateTime, default=_now)
+
+
+class Collection(Base):
+    __tablename__ = "collections"
+    id: Mapped[int] = mapped_column(primary_key=True)
+    workspace_id: Mapped[int] = _ws_fk()
+    name: Mapped[str] = mapped_column(String(120))
+    created_at: Mapped[datetime] = mapped_column(DateTime, default=_now)
+
+
+class Request(Base):
+    """A saved request. type = prompt | tool | agent. payload holds the type-specific body."""
+    __tablename__ = "requests"
+    id: Mapped[int] = mapped_column(primary_key=True)
+    workspace_id: Mapped[int] = _ws_fk()
+    collection_id: Mapped[int | None] = mapped_column(ForeignKey("collections.id"), nullable=True)
+    name: Mapped[str] = mapped_column(String(160))
+    type: Mapped[str] = mapped_column(String(16))
+    payload: Mapped[dict] = mapped_column(JSON, default=dict)
+    updated_at: Mapped[datetime] = mapped_column(DateTime, default=_now, onupdate=_now)
+
+
+class Environment(Base):
+    __tablename__ = "environments"
+    id: Mapped[int] = mapped_column(primary_key=True)
+    workspace_id: Mapped[int] = _ws_fk()
+    name: Mapped[str] = mapped_column(String(120))
+    variables: Mapped[dict] = mapped_column(JSON, default=dict)
+    is_active: Mapped[bool] = mapped_column(default=False)
+
+
+class Prompt(Base):
+    """A managed, reusable prompt (the generic Prompt Registry)."""
+    __tablename__ = "prompts"
+    id: Mapped[int] = mapped_column(primary_key=True)
+    workspace_id: Mapped[int] = _ws_fk()
+    key: Mapped[str] = mapped_column(String(80))
+    name: Mapped[str] = mapped_column(String(160))
+    description: Mapped[str] = mapped_column(Text, default="")
+    content: Mapped[str] = mapped_column(Text, default="")
+    updated_at: Mapped[datetime] = mapped_column(DateTime, default=_now, onupdate=_now)
+    __table_args__ = (UniqueConstraint("workspace_id", "key", name="uq_prompt_key"),)
+
+
+class Flow(Base):
+    """A visual agent workflow: a graph of nodes + edges executed by the flow engine."""
+    __tablename__ = "flows"
+    id: Mapped[int] = mapped_column(primary_key=True)
+    workspace_id: Mapped[int] = _ws_fk()
+    name: Mapped[str] = mapped_column(String(160))
+    description: Mapped[str] = mapped_column(Text, default="")
+    nodes: Mapped[list] = mapped_column(JSON, default=list)
+    edges: Mapped[list] = mapped_column(JSON, default=list)
+    updated_at: Mapped[datetime] = mapped_column(DateTime, default=_now, onupdate=_now)
+
+
+class Dataset(Base):
+    """A reusable, named set of input rows — run any request over it. rows =
+    [{name, variables}]. Decoupled from requests, like a shared data file."""
+    __tablename__ = "datasets"
+    id: Mapped[int] = mapped_column(primary_key=True)
+    workspace_id: Mapped[int] = _ws_fk()
+    name: Mapped[str] = mapped_column(String(160))
+    rows: Mapped[list] = mapped_column(JSON, default=list)
+    created_at: Mapped[datetime] = mapped_column(DateTime, default=_now)
+
+
+class Deployment(Base):
+    """A published flow snapshot, callable as a hosted endpoint. Rows share a `slug`
+    across versions; exactly one version per slug is active. The graph is frozen in
+    `snapshot` at deploy time so editing the flow never changes production."""
+    __tablename__ = "deployments"
+    id: Mapped[int] = mapped_column(primary_key=True)
+    workspace_id: Mapped[int] = _ws_fk()
+    flow_id: Mapped[int | None] = mapped_column(ForeignKey("flows.id"), nullable=True)
+    slug: Mapped[str] = mapped_column(String(80), index=True)
+    version: Mapped[int] = mapped_column(Integer, default=1)
+    name: Mapped[str] = mapped_column(String(160), default="")
+    snapshot: Mapped[dict] = mapped_column(JSON, default=dict)  # {nodes, edges}
+    api_key_hash: Mapped[str] = mapped_column(String(128))
+    active: Mapped[bool] = mapped_column(default=True, index=True)
+    created_at: Mapped[datetime] = mapped_column(DateTime, default=_now)
+
+
+class Run(Base):
+    """A single execution + its result (for history/replay)."""
+    __tablename__ = "runs"
+    id: Mapped[int] = mapped_column(primary_key=True)
+    workspace_id: Mapped[int] = _ws_fk()
+    deployment_id: Mapped[int | None] = mapped_column(ForeignKey("deployments.id"), index=True, nullable=True)
+    type: Mapped[str] = mapped_column(String(16))
+    label: Mapped[str] = mapped_column(String(200), default="")
+    request: Mapped[dict] = mapped_column(JSON, default=dict)   # the sent request
+    result: Mapped[dict] = mapped_column(JSON, default=dict)    # {output, meta, events?}
+    status: Mapped[str] = mapped_column(String(16), default="completed")
+    duration_ms: Mapped[int] = mapped_column(Integer, default=0)
+    error: Mapped[str] = mapped_column(Text, default="")
+    created_at: Mapped[datetime] = mapped_column(DateTime, default=_now)

provekit/observability.py

@@ -0,0 +1,154 @@
+"""Observability: request IDs, structured JSON logs (hosted), optional Sentry, /healthz.
+
+Logs never include prompt/response bodies or secrets — only run lifecycle metadata.
+"""
+from __future__ import annotations
+
+import json
+import logging
+import uuid
+from contextvars import ContextVar
+
+from fastapi import Request
+from fastapi.responses import JSONResponse
+from sqlalchemy import text
+from starlette.middleware.base import BaseHTTPMiddleware
+
+from .config import get_settings
+from .database import SessionLocal
+
+request_id: ContextVar[str] = ContextVar("request_id", default="-")
+
+
+class _JSONFormatter(logging.Formatter):
+    def format(self, record: logging.LogRecord) -> str:
+        payload = {"level": record.levelname, "logger": record.name,
+                   "msg": record.getMessage(), "request_id": request_id.get()}
+        if record.exc_info:
+            payload["exc"] = self.formatException(record.exc_info)
+        return json.dumps(payload)
+
+
+def setup_logging() -> None:
+    s = get_settings()
+    root = logging.getLogger()
+    root.setLevel(logging.INFO)
+    if s.hosted:  # machine-parseable logs in production
+        for h in root.handlers:
+            h.setFormatter(_JSONFormatter())
+
+
+def init_sentry() -> None:
+    dsn = get_settings().sentry_dsn
+    if not dsn:
+        return
+    try:
+        import sentry_sdk
+        sentry_sdk.init(dsn=dsn, traces_sample_rate=0.1)
+        logging.getLogger("provekit").info("sentry enabled")
+    except ImportError:
+        logging.getLogger("provekit").warning("SENTRY_DSN set but sentry-sdk not installed")
+
+
+class RequestIDMiddleware(BaseHTTPMiddleware):
+    """Assign/propagate X-Request-ID and bind it to logs for the duration of the request."""
+    async def dispatch(self, request: Request, call_next):
+        rid = request.headers.get("x-request-id") or uuid.uuid4().hex[:16]
+        token = request_id.set(rid)
+        try:
+            response = await call_next(request)
+        finally:
+            request_id.reset(token)
+        response.headers["X-Request-ID"] = rid
+        return response
+
+
+class SecurityHeadersMiddleware(BaseHTTPMiddleware):
+    """Baseline hardening headers on every response; HSTS only in hosted (TLS) mode."""
+    async def dispatch(self, request: Request, call_next):
+        response = await call_next(request)
+        response.headers.setdefault("X-Content-Type-Options", "nosniff")
+        response.headers.setdefault("X-Frame-Options", "DENY")
+        response.headers.setdefault("Referrer-Policy", "strict-origin-when-cross-origin")
+        if get_settings().hosted:
+            response.headers.setdefault("Strict-Transport-Security",
+                                        "max-age=31536000; includeSubDomains")
+        return response
+
+
+class BodySizeLimitMiddleware:
+    """Reject oversized request bodies with 413. Pure ASGI so the cap holds for chunked /
+    Content-Length-less requests too: the body is buffered up to the limit and then replayed
+    to the app (this API takes small JSON bodies, so buffering is cheap)."""
+    def __init__(self, app):
+        self.app = app
+
+    async def __call__(self, scope, receive, send):
+        if scope["type"] != "http":
+            return await self.app(scope, receive, send)
+        max_bytes = get_settings().max_body_bytes
+        headers = dict(scope.get("headers") or [])
+        cl = headers.get(b"content-length")
+        if cl is not None and cl.isdigit() and int(cl) > max_bytes:
+            return await self._reject(send)
+        body = bytearray()
+        while True:
+            message = await receive()
+            if message["type"] == "http.disconnect":
+                # The client vanished mid-upload. Returning bare would satisfy a pure-ASGI
+                # parent, but this runs inside BaseHTTPMiddleware (RequestID/SecurityHeaders),
+                # whose call_next raises "No response returned." if nothing is sent — turning
+                # every cancelled upload into a 500 + Sentry event. Nobody reads this response.
+                return await self._respond(send, 499, "Client disconnected")
+            body.extend(message.get("body", b""))
+            if len(body) > max_bytes:
+                return await self._reject(send)
+            if not message.get("more_body", False):
+                break
+        buffered = bytes(body)
+        done = False
+
+        async def replay():
+            nonlocal done
+            if not done:
+                done = True
+                return {"type": "http.request", "body": buffered, "more_body": False}
+            # Delegate later reads to the real channel so a StreamingResponse's disconnect
+            # listener gets genuine http.disconnect events (returning a fake one truncates SSE).
+            return await receive()
+
+        await self.app(scope, replay, send)
+
+    @classmethod
+    async def _reject(cls, send):
+        return await cls._respond(send, 413, "Request body too large")
+
+    @staticmethod
+    async def _respond(send, status: int, detail: str):
+        body = json.dumps({"detail": detail}).encode()
+        await send({"type": "http.response.start", "status": status,
+                    "headers": [(b"content-type", b"application/json"),
+                                (b"content-length", str(len(body)).encode())]})
+        await send({"type": "http.response.body", "body": body})
+
+
+def healthz() -> JSONResponse:
+    """Liveness+readiness: DB reachable, and Redis if configured."""
+    checks = {"db": False, "redis": None}
+    try:
+        db = SessionLocal()
+        db.execute(text("SELECT 1"))
+        db.close()
+        checks["db"] = True
+    except Exception:
+        pass
+    if get_settings().redis_url:
+        checks["redis"] = False
+        try:
+            from .services.runstore import _store
+            _store()._r.ping()
+            checks["redis"] = True
+        except Exception:
+            pass
+    ok = checks["db"] and (checks["redis"] is not False)
+    return JSONResponse({"ok": ok, "checks": checks}, status_code=200 if ok else 503)