provekit 0.1.0__tar.gz → 0.5.0__tar.gz

provekit-0.5.0/PKG-INFO

@@ -0,0 +1,117 @@
+Metadata-Version: 2.4
+Name: provekit
+Version: 0.5.0
+Summary: Drop-in agent tracing — add one decorator, get a project key, review every run your agent makes.
+Author: ProveKit contributors
+License: MIT
+Project-URL: Homepage, https://github.com/MobirizerServices/ProveKit
+Project-URL: Repository, https://github.com/MobirizerServices/ProveKit
+Project-URL: Issues, https://github.com/MobirizerServices/ProveKit/issues
+Keywords: agent,llm,tracing,observability,opentelemetry,openai,anthropic,otel
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: System :: Monitoring
+Classifier: Topic :: Scientific/Engineering :: Artificial Intelligence
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+Requires-Dist: httpx<1,>=0.28
+Provides-Extra: server
+Requires-Dist: fastapi<1,>=0.115; extra == "server"
+Requires-Dist: uvicorn[standard]<1,>=0.34; extra == "server"
+Requires-Dist: sqlalchemy<3,>=2.0; extra == "server"
+Requires-Dist: pydantic<3,>=2.10; extra == "server"
+Requires-Dist: pydantic-settings<3,>=2.7; extra == "server"
+Requires-Dist: cryptography<50,>=42; extra == "server"
+Requires-Dist: anyio<5,>=4; extra == "server"
+Requires-Dist: alembic<2,>=1.18; extra == "server"
+Requires-Dist: psycopg[binary]<4,>=3.3; extra == "server"
+Requires-Dist: email-validator<3,>=2.2; extra == "server"
+Requires-Dist: redis<6,>=5.2; extra == "server"
+Requires-Dist: sentry-sdk[fastapi]<3,>=2.20; extra == "server"
+Provides-Extra: trace
+Requires-Dist: opentelemetry-api<2,>=1.20; extra == "trace"
+Requires-Dist: opentelemetry-sdk<2,>=1.20; extra == "trace"
+Requires-Dist: openinference-instrumentation-openai>=0.1; extra == "trace"
+Requires-Dist: openinference-instrumentation-anthropic>=0.1; extra == "trace"
+Provides-Extra: http
+Requires-Dist: opentelemetry-instrumentation-httpx>=0.40b0; extra == "http"
+Requires-Dist: opentelemetry-instrumentation-requests>=0.40b0; extra == "http"
+Requires-Dist: opentelemetry-instrumentation-urllib>=0.40b0; extra == "http"
+Provides-Extra: trace-all
+Requires-Dist: opentelemetry-api<2,>=1.20; extra == "trace-all"
+Requires-Dist: opentelemetry-sdk<2,>=1.20; extra == "trace-all"
+Requires-Dist: openinference-instrumentation-openai>=0.1; extra == "trace-all"
+Requires-Dist: openinference-instrumentation-anthropic>=0.1; extra == "trace-all"
+Requires-Dist: openinference-instrumentation-langchain>=0.1; extra == "trace-all"
+Requires-Dist: openinference-instrumentation-llama-index>=0.1; extra == "trace-all"
+Requires-Dist: openinference-instrumentation-crewai>=0.1; extra == "trace-all"
+Requires-Dist: openinference-instrumentation-bedrock>=0.1; extra == "trace-all"
+Requires-Dist: openinference-instrumentation-litellm>=0.1; extra == "trace-all"
+Requires-Dist: openinference-instrumentation-groq>=0.1; extra == "trace-all"
+Requires-Dist: openinference-instrumentation-mistralai>=0.1; extra == "trace-all"
+Requires-Dist: openinference-instrumentation-dspy>=0.1; extra == "trace-all"
+Requires-Dist: openinference-instrumentation-haystack>=0.1; extra == "trace-all"
+Requires-Dist: opentelemetry-instrumentation-httpx>=0.40b0; extra == "trace-all"
+Requires-Dist: opentelemetry-instrumentation-requests>=0.40b0; extra == "trace-all"
+Requires-Dist: opentelemetry-instrumentation-urllib>=0.40b0; extra == "trace-all"
+Provides-Extra: mcp
+Requires-Dist: mcp>=1.2; extra == "mcp"
+Provides-Extra: dev
+Requires-Dist: pytest==9.1.1; extra == "dev"
+Requires-Dist: pytest-cov==6.0.0; extra == "dev"
+Requires-Dist: ruff==0.9.2; extra == "dev"
+
+# ProveKit
+
+**One decorator. The whole agent flow.** Add one `@pk.trace` at your agent's entrypoint and
+review every run — the model calls, tools, and steps — as a nested flow in your ProveKit
+portal. OpenAI/Anthropic calls capture themselves. Open source, self-hostable, no framework
+lock-in.
+
+## Install
+
+```bash
+pip install "provekit[trace]"
+```
+
+## Use
+
+```python
+import provekit.trace as pk
+
+# .env
+#   PROVEKIT_API_KEY=pk_...        (create a project + key in the portal)
+#   PROVEKIT_ENDPOINT=https://your-provekit-host
+
+@pk.trace(name="support-agent")
+def run_agent(question: str) -> str:
+    docs = retrieve(question)          # wrap sub-steps with `with pk.span("retrieve"):`
+    return chat(question, docs)        # the OpenAI/Anthropic call captures itself
+```
+
+Run your agent, open **Traces** in the portal, and every run shows up as a nested waterfall
+with per-span input, output, and token usage.
+
+It's OpenTelemetry under the hood, so your data is portable and nothing is locked in — but
+you never have to touch OTel. Fail-open by design: if the key/endpoint are unset or the
+portal is unreachable, your app runs completely unaffected.
+
+## Run the portal (self-host)
+
+The web app + ingest server ship in the same package:
+
+```bash
+pip install "provekit[server]"
+uvicorn provekit.main:app --port 8100
+```
+
+See the [repo](https://github.com/MobirizerServices/ProveKit) for Docker/compose and the
+full [tracing guide](https://github.com/MobirizerServices/ProveKit/blob/main/docs/TRACING.md).
+
+- Repository: https://github.com/MobirizerServices/ProveKit
+- License: MIT

provekit-0.5.0/README.md

@@ -0,0 +1,49 @@
+# ProveKit
+
+**One decorator. The whole agent flow.** Add one `@pk.trace` at your agent's entrypoint and
+review every run — the model calls, tools, and steps — as a nested flow in your ProveKit
+portal. OpenAI/Anthropic calls capture themselves. Open source, self-hostable, no framework
+lock-in.
+
+## Install
+
+```bash
+pip install "provekit[trace]"
+```
+
+## Use
+
+```python
+import provekit.trace as pk
+
+# .env
+#   PROVEKIT_API_KEY=pk_...        (create a project + key in the portal)
+#   PROVEKIT_ENDPOINT=https://your-provekit-host
+
+@pk.trace(name="support-agent")
+def run_agent(question: str) -> str:
+    docs = retrieve(question)          # wrap sub-steps with `with pk.span("retrieve"):`
+    return chat(question, docs)        # the OpenAI/Anthropic call captures itself
+```
+
+Run your agent, open **Traces** in the portal, and every run shows up as a nested waterfall
+with per-span input, output, and token usage.
+
+It's OpenTelemetry under the hood, so your data is portable and nothing is locked in — but
+you never have to touch OTel. Fail-open by design: if the key/endpoint are unset or the
+portal is unreachable, your app runs completely unaffected.
+
+## Run the portal (self-host)
+
+The web app + ingest server ship in the same package:
+
+```bash
+pip install "provekit[server]"
+uvicorn provekit.main:app --port 8100
+```
+
+See the [repo](https://github.com/MobirizerServices/ProveKit) for Docker/compose and the
+full [tracing guide](https://github.com/MobirizerServices/ProveKit/blob/main/docs/TRACING.md).
+
+- Repository: https://github.com/MobirizerServices/ProveKit
+- License: MIT

provekit-0.5.0/provekit/__init__.py

@@ -0,0 +1,18 @@
+"""ProveKit — drop-in agent tracing. One SDK on the client captures the whole flow.
+
+    import provekit.trace as pk          # the canonical import
+    pk.init()                            # or, zero-code: import provekit.auto
+
+    @pk.trace(name="my-agent")           # optional: group one run under a named root
+    def run(q): ...
+
+Everything beneath your code — LLM providers, agent frameworks, outbound HTTP — is
+captured automatically. `init`, `configure`, and `span` are also re-exported here for
+`import provekit as pk` convenience; the `trace` decorator lives on the `provekit.trace`
+submodule (a same-named top-level export would shadow that module).
+"""
+from provekit import scorers
+from provekit.eval import evaluate
+from provekit.trace import configure, init, span
+
+__all__ = ["init", "configure", "span", "evaluate", "scorers"]

provekit-0.5.0/provekit/auto.py

@@ -0,0 +1,11 @@
+"""Zero-code activation: `import provekit.auto` turns tracing on with no other calls.
+
+    import provekit.auto      # reads PROVEKIT_API_KEY / PROVEKIT_ENDPOINT and instruments
+
+Put this once at your program's entrypoint (before the libraries you want traced do their
+work). Everything instrumented below it is then captured automatically. Fail-open: if the
+env vars are unset or OpenTelemetry isn't installed, this is a silent no-op.
+"""
+from provekit.trace import init
+
+init()

provekit-0.5.0/provekit/config.py

@@ -0,0 +1,68 @@
+"""ProveKit configuration."""
+from functools import lru_cache
+
+from pydantic_settings import BaseSettings, SettingsConfigDict
+
+
+class Settings(BaseSettings):
+    model_config = SettingsConfigDict(env_file=".env", extra="ignore")
+
+    database_url: str = "sqlite:///./provekit.db"
+    cors_origins: str = "http://localhost:3001,http://localhost:3000"
+
+    # Hosted mode: a login wall, secure cookies, and stricter outbound-URL guarding.
+    hosted: bool = False
+
+    # Signs session/reset/verify tokens (any string → a Fernet key). Optional for local
+    # SQLite (a key file is auto-generated); required for any other database.
+    secret_key: str = ""
+
+    # Optional OTLP/HTTP collector to mirror captured runs to another backend.
+    otel_export_url: str = ""
+
+    # Optional Sentry DSN for error reporting (off when unset).
+    sentry_dsn: str = ""
+
+    # Web app base URL (for links in emails).
+    web_base_url: str = "http://localhost:3001"
+
+    # Email (account recovery / verification). No SMTP host → links are logged, not sent.
+    smtp_host: str = ""
+    smtp_port: int = 587
+    smtp_user: str = ""
+    smtp_password: str = ""
+    smtp_from: str = ""
+    smtp_starttls: bool = True
+    require_email_verification: bool = False
+
+    # Optional Redis (shared rate-limit windows across workers). Unset → in-memory.
+    redis_url: str = ""
+
+    thread_pool_size: int = 200
+
+    # Mask PII (emails, cards, SSNs, phones, common secret keys) in captured span
+    # input/output/error before it's stored. Off by default; a safety net for hosted use.
+    redact_pii: bool = False
+
+    # Bootstrap platform operators: any account whose email is in this comma-list is treated
+    # as a superuser (admin console), even before the DB flag is set. e.g. "you@co.com".
+    superuser_emails: str = ""
+
+    @property
+    def superuser_email_list(self) -> list[str]:
+        return [e.strip().lower() for e in self.superuser_emails.split(",") if e.strip()]
+
+    # Quotas (protect shared infra). 0 disables a given limit.
+    ingest_rate_per_min: int = 600     # trace-ingest requests per project per minute
+    login_attempts_per_min: int = 10   # login attempts per email+IP per minute
+    runs_retention: int = 10000        # keep last N spans per project (older ones pruned)
+    max_body_bytes: int = 2_000_000    # reject request bodies larger than this
+
+    @property
+    def cors_origin_list(self) -> list[str]:
+        return [o.strip() for o in self.cors_origins.split(",") if o.strip()]
+
+
+@lru_cache
+def get_settings() -> Settings:
+    return Settings()

{provekit-0.1.0 → provekit-0.5.0}/provekit/database.py

@@ -62,16 +62,6 @@ def init_db() -> None:
         _run_migrations()
 
 
-# Revision that first introduced each column, newest first — used to adopt a pre-migration
-# database (built by the old create_all path) at the revision matching its actual columns.
-_ADOPT_BY_COLUMN = [
-    ("users", "token_version", "a1b2c3d4e5f6"),
-    ("users", "email_verified", "323eb73d463c"),
-    ("workspaces", "ingest_key_hash", "819ed5ff183e"),
-]
-_BASELINE_REVISION = "49e8ab812556"
-
-
 # Postgres advisory-lock key ("AGMN") used to serialize migrations across uvicorn workers.
 _MIGRATION_LOCK_ID = 0x4147_4D4E
 
@@ -113,20 +103,4 @@ def _run_migrations() -> None:
 
 def _migrate_to_head(cfg) -> None:
     from alembic import command
-    from alembic.runtime.migration import MigrationContext
-    from sqlalchemy import inspect
-
-    insp = inspect(engine)
-    with engine.connect() as conn:
-        current = MigrationContext.configure(conn).get_current_revision()
-    if current is None and insp.has_table("users"):
-        # A database created by create_all before migrations existed has the tables but no
-        # alembic version. Stamp it at the revision matching its columns so `upgrade` applies
-        # only what's genuinely missing instead of trying to re-create existing tables.
-        stamp_at = _BASELINE_REVISION
-        for table, column, revision in _ADOPT_BY_COLUMN:
-            if any(c["name"] == column for c in insp.get_columns(table)):
-                stamp_at = revision
-                break
-        command.stamp(cfg, stamp_at)
     command.upgrade(cfg, "head")

provekit-0.5.0/provekit/eval.py

@@ -0,0 +1,74 @@
+"""Offline evaluation from the client: run a target over a dataset, score each output, and
+record it as an experiment in your portal — the basis of a CI regression gate.
+
+    import provekit as pk
+
+    def target(question: str) -> str:
+        return my_agent(question)
+
+    summary = pk.evaluate("qa-golden", target, scorers=["exact_match", "contains"])
+    assert summary["mean_score"] >= 0.8       # fail the build on a regression
+
+`scorers` are names from provekit.scorers (exact_match/contains/regex_match/json_valid) or
+your own `fn(output, expected) -> float`. The dataset is a name or id from your portal.
+"""
+from __future__ import annotations
+
+import json
+
+import httpx
+
+from . import scorers as _scorers
+from . import trace as _trace
+
+_TIMEOUT = 60
+
+
+def _get(endpoint, headers, path):
+    r = httpx.get(f"{endpoint}{path}", headers=headers, timeout=_TIMEOUT, follow_redirects=False)
+    r.raise_for_status()
+    return r.json()
+
+
+def _post(endpoint, headers, path, body):
+    r = httpx.post(f"{endpoint}{path}", headers=headers, json=body, timeout=_TIMEOUT, follow_redirects=False)
+    r.raise_for_status()
+    return r.json()
+
+
+def _resolve_dataset_id(endpoint, headers, dataset) -> int:
+    if isinstance(dataset, int):
+        return dataset
+    for d in _get(endpoint, headers, "/v1/datasets"):
+        if d.get("name") == dataset:
+            return d["id"]
+    raise ValueError(f"dataset {dataset!r} not found")
+
+
+def evaluate(dataset, target, scorers, *, name: str = "experiment") -> dict:
+    """Run `target(input)` over every item in `dataset`, score each output with `scorers`,
+    post the results as a new experiment, and return its summary (id, result_count,
+    scorer_means, mean_score). Raises if ProveKit isn't configured."""
+    if not _trace.configure():
+        raise RuntimeError("ProveKit not configured: set PROVEKIT_API_KEY and PROVEKIT_ENDPOINT")
+    endpoint, headers = _trace._endpoint, {"Authorization": f"Bearer {_trace._api_key}"}
+
+    dsid = _resolve_dataset_id(endpoint, headers, dataset)
+    items = _get(endpoint, headers, f"/v1/datasets/{dsid}/items")
+    exp = _post(endpoint, headers, "/v1/experiments", {"name": name, "dataset_id": dsid})
+    eid = exp["id"]
+
+    for it in items:
+        try:
+            output = target(it["input"])
+        except Exception as exc:   # a target failure is a data point, not a crash
+            output = f"ERROR: {exc}"
+        if not isinstance(output, str):
+            output = json.dumps(output, default=str)
+        expected = it.get("expected", "")
+        scores = _scorers.run_scorers(scorers, output, expected)
+        _post(endpoint, headers, f"/v1/experiments/{eid}/results",
+              {"item_id": it.get("id"), "input": it["input"], "output": output,
+               "expected": expected, "scores": scores})
+
+    return _get(endpoint, headers, f"/v1/experiments/{eid}")

{provekit-0.1.0 → provekit-0.5.0}/provekit/main.py

@@ -1,5 +1,5 @@
-"""ProveKit — a generic "Postman for agents": create, run, and debug prompts, MCP tools,
-and agent endpoints across any provider."""
+"""ProveKit — drop-in agent tracing. Add one decorator, get a project key, and review
+every run your agent makes. No connections to configure, no SDK to swap."""
 import logging
 from contextlib import asynccontextmanager
 
@@ -7,8 +7,7 @@ from fastapi import FastAPI
 from fastapi.middleware.cors import CORSMiddleware
 
 from .config import get_settings
-from .database import SessionLocal, init_db
-from .models import Connection
+from .database import init_db
 from .observability import (
     BodySizeLimitMiddleware,
     RequestIDMiddleware,
@@ -17,7 +16,7 @@ from .observability import (
     init_sentry,
     setup_logging,
 )
-from .routers import auth, connections, deployments, flows, library, prompts, run, runtime, traces, usage
+from .routers import admin, alerts, apikeys, auth, datasets, experiments, metrics, projects, traces
 
 logging.basicConfig(level=logging.INFO)
 settings = get_settings()
@@ -25,16 +24,6 @@ setup_logging()
 init_sentry()
 
 
-def _reseal_connections(db) -> None:
-    """Upgrade plaintext secrets from older databases to encrypted-at-rest: force each
-    config back through SealedJSON's bind processor (flag_modified beats SQLAlchemy's
-    equal-value change suppression). Idempotent — already-sealed values stay sealed."""
-    from sqlalchemy.orm.attributes import flag_modified
-    for c in db.query(Connection).all():
-        flag_modified(c, "config")
-    db.commit()
-
-
 _WEAK_KEYS = {"", "dev-only-change-me", "change-me", "changeme", "secret"}
 
 
@@ -67,11 +56,6 @@ async def lifespan(app: FastAPI):
     except Exception:
         pass
     init_db()
-    db = SessionLocal()
-    try:
-        _reseal_connections(db)  # per-workspace seeding happens on first workspace access
-    finally:
-        db.close()
     yield
 
 
@@ -93,16 +77,18 @@ app.add_middleware(
 )
 
 app.include_router(auth.router)
-app.include_router(connections.router)
-app.include_router(library.router)
-app.include_router(prompts.router)
-app.include_router(flows.router)
-app.include_router(run.router)
+app.include_router(apikeys.router)
 app.include_router(traces.router)
 app.include_router(traces.ws_router)
-app.include_router(deployments.router)
-app.include_router(runtime.router)
-app.include_router(usage.router)
+app.include_router(traces.runs_router)
+app.include_router(datasets.router)
+app.include_router(datasets.key_router)
+app.include_router(experiments.router)
+app.include_router(experiments.key_router)
+app.include_router(metrics.router)
+app.include_router(alerts.router)
+app.include_router(projects.router)
+app.include_router(admin.router)
 
 
 @app.get("/")

provekit-0.5.0/provekit/mcp.py

@@ -0,0 +1,83 @@
+"""ProveKit MCP server — debug your traces from any MCP client (Claude Desktop, Cursor, …).
+
+This is a *debug channel*, not a second client SDK: your agent still installs only the one
+`provekit` tracing SDK. This server runs wherever you like (your laptop, CI) and reads the
+already-captured traces from your portal over HTTP, authenticated by the same project key.
+
+    pip install "provekit[mcp]"
+    export PROVEKIT_API_KEY=pk_...        # your project key
+    export PROVEKIT_ENDPOINT=https://provekit.your-co.com
+    provekit-mcp                          # speaks MCP over stdio
+
+Then point an MCP client at the `provekit-mcp` command. It exposes tools to list recent
+traces, surface failures, and pull a full span tree — so the assistant can reason over an
+agent run and tell you what broke, with no code added to the traced app.
+"""
+from __future__ import annotations
+
+import os
+
+import httpx
+
+_TIMEOUT = 15
+
+
+def _base() -> tuple[str, dict]:
+    """Resolve the portal URL + auth header from the environment, or raise a clear error."""
+    key = os.environ.get("PROVEKIT_API_KEY")
+    endpoint = os.environ.get("PROVEKIT_ENDPOINT")
+    if not key or not endpoint:
+        raise RuntimeError(
+            "Set PROVEKIT_API_KEY (your pk_ project key) and PROVEKIT_ENDPOINT "
+            "(your portal URL) before starting the ProveKit MCP server."
+        )
+    return endpoint.rstrip("/"), {"Authorization": f"Bearer {key}"}
+
+
+def _get(path: str, **params):
+    url, headers = _base()
+    r = httpx.get(f"{url}/v1{path}", headers=headers, params=params, timeout=_TIMEOUT,
+                  follow_redirects=False)
+    r.raise_for_status()
+    return r.json()
+
+
+# ---- the callable data layer (import-safe; used by the MCP tools and by tests) ----
+def list_traces(limit: int = 20, status: str | None = None) -> list[dict]:
+    """Recent traces, newest first. Pass status='failed' to see only failed runs."""
+    return _get("/traces", limit=limit, **({"status": status} if status else {}))
+
+
+def list_failures(limit: int = 20) -> list[dict]:
+    """Just the traces that ended in a failure — the ones worth debugging first."""
+    return list_traces(limit=limit, status="failed")
+
+
+def get_trace(trace_id: str) -> list[dict]:
+    """Every span of one trace (the full nested flow), in start order."""
+    return _get(f"/traces/{trace_id}")
+
+
+def build_server():  # pragma: no cover - needs the optional `mcp` dep; glue over the tested data layer
+    """Construct the FastMCP server with the trace tools registered. Imported lazily so the
+    module stays importable (and testable) without the optional `mcp` dependency. The three
+    data-layer functions above are registered directly as MCP tools."""
+    from mcp.server.fastmcp import FastMCP
+
+    server = FastMCP("provekit")
+    server.add_tool(list_traces, name="provekit_list_traces",
+                    description="List recent ProveKit traces (agent runs). status='failed' filters to failures.")
+    server.add_tool(list_failures, name="provekit_list_failures",
+                    description="List recent traces that ended in a failure — start debugging here.")
+    server.add_tool(get_trace, name="provekit_get_trace",
+                    description="Fetch the full span tree of one trace by trace_id to inspect what happened.")
+    return server
+
+
+def main() -> None:  # pragma: no cover - blocks serving MCP over stdio; exercised by hand
+    """Console-script entrypoint: `provekit-mcp`. Speaks MCP over stdio."""
+    build_server().run()
+
+
+if __name__ == "__main__":  # pragma: no cover
+    main()

provekit-0.5.0/provekit/migrations/versions/9d2c06bfa4e6_baseline.py

@@ -0,0 +1,121 @@
+"""baseline
+
+Revision ID: 9d2c06bfa4e6
+Revises: 
+Create Date: 2026-07-18 22:58:47.035691
+"""
+from alembic import op
+import sqlalchemy as sa
+
+
+revision = '9d2c06bfa4e6'
+down_revision = None
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    # ### commands auto generated by Alembic - please adjust! ###
+    op.create_table('users',
+    sa.Column('id', sa.Integer(), nullable=False),
+    sa.Column('email', sa.String(length=255), nullable=False),
+    sa.Column('name', sa.String(length=160), nullable=False),
+    sa.Column('password_hash', sa.String(length=255), nullable=False),
+    sa.Column('auth_provider', sa.String(length=32), nullable=False),
+    sa.Column('email_verified', sa.Boolean(), nullable=False),
+    sa.Column('token_version', sa.Integer(), nullable=False),
+    sa.Column('created_at', sa.DateTime(), nullable=False),
+    sa.PrimaryKeyConstraint('id', name=op.f('pk_users')),
+    sa.UniqueConstraint('email', name=op.f('uq_users_email'))
+    )
+    op.create_table('workspaces',
+    sa.Column('id', sa.Integer(), nullable=False),
+    sa.Column('name', sa.String(length=160), nullable=False),
+    sa.Column('owner_user_id', sa.Integer(), nullable=False),
+    sa.Column('ingest_key_hash', sa.String(length=128), nullable=False),
+    sa.Column('created_at', sa.DateTime(), nullable=False),
+    sa.ForeignKeyConstraint(['owner_user_id'], ['users.id'], name=op.f('fk_workspaces_owner_user_id_users')),
+    sa.PrimaryKeyConstraint('id', name=op.f('pk_workspaces'))
+    )
+    with op.batch_alter_table('workspaces', schema=None) as batch_op:
+        batch_op.create_index(batch_op.f('ix_workspaces_ingest_key_hash'), ['ingest_key_hash'], unique=False)
+        batch_op.create_index(batch_op.f('ix_workspaces_owner_user_id'), ['owner_user_id'], unique=False)
+
+    op.create_table('api_keys',
+    sa.Column('id', sa.Integer(), nullable=False),
+    sa.Column('workspace_id', sa.Integer(), nullable=True),
+    sa.Column('name', sa.String(length=120), nullable=False),
+    sa.Column('prefix', sa.String(length=16), nullable=False),
+    sa.Column('key_hash', sa.String(length=128), nullable=False),
+    sa.Column('last_used_at', sa.DateTime(), nullable=True),
+    sa.Column('revoked', sa.Boolean(), nullable=False),
+    sa.Column('created_at', sa.DateTime(), nullable=False),
+    sa.ForeignKeyConstraint(['workspace_id'], ['workspaces.id'], name=op.f('fk_api_keys_workspace_id_workspaces')),
+    sa.PrimaryKeyConstraint('id', name=op.f('pk_api_keys'))
+    )
+    with op.batch_alter_table('api_keys', schema=None) as batch_op:
+        batch_op.create_index(batch_op.f('ix_api_keys_key_hash'), ['key_hash'], unique=False)
+        batch_op.create_index(batch_op.f('ix_api_keys_workspace_id'), ['workspace_id'], unique=False)
+
+    op.create_table('runs',
+    sa.Column('id', sa.Integer(), nullable=False),
+    sa.Column('workspace_id', sa.Integer(), nullable=True),
+    sa.Column('type', sa.String(length=16), nullable=False),
+    sa.Column('label', sa.String(length=200), nullable=False),
+    sa.Column('request', sa.JSON(), nullable=False),
+    sa.Column('result', sa.JSON(), nullable=False),
+    sa.Column('status', sa.String(length=16), nullable=False),
+    sa.Column('duration_ms', sa.Integer(), nullable=False),
+    sa.Column('error', sa.Text(), nullable=False),
+    sa.Column('trace_id', sa.String(length=32), nullable=False),
+    sa.Column('span_id', sa.String(length=16), nullable=False),
+    sa.Column('parent_span_id', sa.String(length=16), nullable=False),
+    sa.Column('created_at', sa.DateTime(), nullable=False),
+    sa.ForeignKeyConstraint(['workspace_id'], ['workspaces.id'], name=op.f('fk_runs_workspace_id_workspaces')),
+    sa.PrimaryKeyConstraint('id', name=op.f('pk_runs'))
+    )
+    with op.batch_alter_table('runs', schema=None) as batch_op:
+        batch_op.create_index(batch_op.f('ix_runs_trace_id'), ['trace_id'], unique=False)
+        batch_op.create_index(batch_op.f('ix_runs_workspace_id'), ['workspace_id'], unique=False)
+
+    op.create_table('workspace_members',
+    sa.Column('id', sa.Integer(), nullable=False),
+    sa.Column('workspace_id', sa.Integer(), nullable=False),
+    sa.Column('user_id', sa.Integer(), nullable=False),
+    sa.Column('role', sa.String(length=16), nullable=False),
+    sa.ForeignKeyConstraint(['user_id'], ['users.id'], name=op.f('fk_workspace_members_user_id_users')),
+    sa.ForeignKeyConstraint(['workspace_id'], ['workspaces.id'], name=op.f('fk_workspace_members_workspace_id_workspaces')),
+    sa.PrimaryKeyConstraint('id', name=op.f('pk_workspace_members')),
+    sa.UniqueConstraint('workspace_id', 'user_id', name='uq_member')
+    )
+    with op.batch_alter_table('workspace_members', schema=None) as batch_op:
+        batch_op.create_index(batch_op.f('ix_workspace_members_user_id'), ['user_id'], unique=False)
+        batch_op.create_index(batch_op.f('ix_workspace_members_workspace_id'), ['workspace_id'], unique=False)
+
+    # ### end Alembic commands ###
+
+
+def downgrade() -> None:
+    # ### commands auto generated by Alembic - please adjust! ###
+    with op.batch_alter_table('workspace_members', schema=None) as batch_op:
+        batch_op.drop_index(batch_op.f('ix_workspace_members_workspace_id'))
+        batch_op.drop_index(batch_op.f('ix_workspace_members_user_id'))
+
+    op.drop_table('workspace_members')
+    with op.batch_alter_table('runs', schema=None) as batch_op:
+        batch_op.drop_index(batch_op.f('ix_runs_workspace_id'))
+        batch_op.drop_index(batch_op.f('ix_runs_trace_id'))
+
+    op.drop_table('runs')
+    with op.batch_alter_table('api_keys', schema=None) as batch_op:
+        batch_op.drop_index(batch_op.f('ix_api_keys_workspace_id'))
+        batch_op.drop_index(batch_op.f('ix_api_keys_key_hash'))
+
+    op.drop_table('api_keys')
+    with op.batch_alter_table('workspaces', schema=None) as batch_op:
+        batch_op.drop_index(batch_op.f('ix_workspaces_owner_user_id'))
+        batch_op.drop_index(batch_op.f('ix_workspaces_ingest_key_hash'))
+
+    op.drop_table('workspaces')
+    op.drop_table('users')
+    # ### end Alembic commands ###