fastapi-m8 4.2.2__tar.gz → 4.3.0__tar.gz

fastapi_m8-4.3.0/.markdownlint.yaml

@@ -0,0 +1,43 @@
+---
+# markdownlint configuration, also consumed by Codacy's markdownlint engine when
+# the repository is set to use its own configuration files.
+#
+# Scope note: a config file supplies markdownlint's *defaults* for every rule it
+# does not mention, so this file deliberately restates the rules this repository
+# already does not enforce. Without them, adding this file would turn one
+# reported rule into five and ~534 findings across README.md + CHANGELOG.md.
+
+# MD024/no-duplicate-heading — restrict to sibling headings.
+#
+# CHANGELOG.md follows Keep a Changelog, where every release section repeats the
+# same subsection names (### Added / ### Changed / ### Security / ### Docs …).
+# Under the default setting that makes each release after the first a stack of
+# duplicate-heading errors — 28 of them at 4.2.2, purely as a function of how
+# many releases the file records, and growing by ~3 with every release. The
+# duplication is the format, not a defect, and renaming the sections to be
+# unique would break the convention every reader of this changelog relies on.
+#
+# siblings_only flags a duplicate only when it shares a parent heading, so
+# "### Added" under [4.3.0] and "### Added" under [4.2.0] both pass, while two
+# "### Added" blocks inside one release — a real editing mistake — still fail.
+MD024:
+  siblings_only: true
+
+# MD013/line-length — off. README.md and CHANGELOG.md wrap prose for readability
+# rather than to a fixed column, and carry long table rows, URLs and code lines
+# that cannot be wrapped at all (328 findings). Python line length is enforced
+# separately and for real, by ruff (line-length = 88 in pyproject.toml).
+MD013: false
+
+# MD060/table-column-style — off. The documentation tables use compact pipes
+# (194 findings); this is a presentation preference with no effect on rendering.
+MD060: false
+
+# The three below are off to preserve the status quo, NOT because they are
+# wrong — each flags something worth fixing, and the count is small enough to
+# fix in one pass: MD031 blanks-around-fences (7), MD040 fenced-code-language
+# (3), MD028 no-blanks-blockquote (2). Left as a follow-up rather than folded
+# into an unrelated release commit; re-enable once those 12 spots are cleaned.
+MD031: false
+MD040: false
+MD028: false

{fastapi_m8-4.2.2 → fastapi_m8-4.3.0}/CHANGELOG.md

@@ -5,6 +5,99 @@ Format: [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) · Versioning:
 
 ---
 
+## [4.3.0] — 2026-08-14 · Complete the SDK re-export surface
+
+Adds the five `auth-sdk-m8` primitives the consumer fleet still imports
+directly, so a consumer service can depend on `fastapi-m8` alone and reach
+**zero** `auth_sdk_m8` imports. Additive only: no existing export, signature or
+behavior changes, and no new `auth-sdk-m8` API is required.
+
+Until this release the boundary was literally unsatisfiable — five of the twelve
+symbols the fleet imports had no `fastapi_m8` re-export, so every consumer had
+to keep a direct SDK import or invent a local shim.
+
+### Added
+
+- **`has_minimum_role`** (from `auth_sdk_m8.authorization`) — the canonical
+  role-ordering predicate. One implementation of the hierarchy, re-exported
+  rather than re-derived at a call site.
+- **`RoleType`** (from `auth_sdk_m8.schemas.base`) — the role enum those
+  thresholds are expressed in, and the argument type of
+  `AuthDeps.require_role()`.
+- **`ValidationConstants`** (from `auth_sdk_m8.schemas.shared`) — the shared
+  field-length/format constants consumer schemas validate against.
+- **`make_scrape_credential_guard`** (from `auth_sdk_m8.security.guards`) — the
+  `/metrics` scrape-credential guard factory.
+- **`REGISTRY`** (from `auth_sdk_m8.observability.metrics`) — the shared
+  Prometheus collector registry that `render_metrics` (already re-exported)
+  renders.
+
+All five are documented in the module docstring's *Reusable SDK primitives*
+block and listed in `__all__`; `has_superuser_privileges`, `BaseController`,
+`ResponseModelBase`, `ResponseMessage`, `TimestampMixin`, `UserModel`,
+`find_dotenv` and `render_metrics` were already re-exported and are unchanged.
+
+### Changed
+
+- `COMPAT_MATRIX` gains its `"4.3"` row (`auth-sdk-m8 >=3.1.2,<4.0.0`). Without
+  it `_assert_compat()` would find no requirement for the new minor and silently
+  skip the startup check. The floor is stated as `>=3.1.2` — the floor
+  `pyproject.toml` already declares — rather than `4.2`'s looser `>=3.1.0`.
+
+### Documentation
+
+- `README.md` gains a **Reusable SDK Primitives** section listing every
+  re-exported symbol, its SDK origin and its purpose, and states the boundary
+  rule: a consumer service imports these from `fastapi-m8`, never from
+  `auth-sdk-m8`. The database example now imports `TimestampMixin` from
+  `fastapi_m8` accordingly, and the compatibility table gains the `4.3.0` row.
+
+### Tests
+
+- `tests/test_public_typing.py` type-checks all twelve re-exported primitives
+  through the public surface and asserts each one **is** the SDK object it
+  claims to re-export (identity, not just importability).
+- `tests/test_packaging.py`'s clean-install probe imports the five new names
+  from the built wheel, which is the acceptance condition for this release.
+
+---
+
+## [4.2.2] — 2026-07-31 · Dependency maintenance
+
+Reconstructed from Git history (`ed259a1`, `0c3123b`) — the release shipped
+without a changelog entry.
+
+### Changed
+
+- `auth-sdk-m8` floor raised to `>=3.1.2,<4.0.0` in `pyproject.toml` and pinned
+  to `3.1.2` in the compiled constraints files. No source change.
+
+---
+
+## [4.2.1] — 2026-07-31 · Re-exports, Python floor, docs
+
+Reconstructed from Git history (`86830ee` and the commits it bumped for:
+`b105e01`, `23020fe`, `be5c382`, `a57811c`) — the release shipped without a
+changelog entry.
+
+### Added
+
+- Re-export of the reusable `auth-sdk-m8` primitives (`has_superuser_privileges`,
+  `BaseController`, `ResponseModelBase`, `ResponseMessage`, `TimestampMixin`,
+  `UserModel`, `find_dotenv`, `render_metrics`) — the first half of the surface
+  `4.3.0` completes.
+
+### Changed
+
+- Python floor raised to `>=3.12`; truncated lockfiles regenerated.
+
+### Documentation
+
+- Documented hybrid mode's expiry-bounded revocation contract; reformatted the
+  embedded Python snippets in `CHANGELOG.md`/`README.md`.
+
+---
+
 ## [4.2.0] — 2026-07-23 · Role-capability demonstration surface (Phase 7)
 
 Adds a centralized `require_role(required_role: RoleType)` JWT dependency

{fastapi_m8-4.2.2 → fastapi_m8-4.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: fastapi-m8
-Version: 4.2.2
+Version: 4.3.0
 Summary: FastAPI application framework for m8 consumer microservices.
 Author-email: Eli Serra <e.serra173@gmail.com>
 License:                                  Apache License
@@ -284,6 +284,7 @@ boilerplate from every consumer service.
    - [build_auth_deps()](#build_auth_deps)
    - [create_db_engine()](#create_db_engine)
    - [Health Checks](#health-checks)
+   - [Reusable SDK Primitives](#reusable-sdk-primitives)
 7. [Authentication](#authentication)
    - [Token Modes](#token-modes)
    - [Role System](#role-system)
@@ -1162,6 +1163,53 @@ class RedisCheck:
 | `LENIENT` (default) | Any check is `fail` |
 | `STRICT` | Any check is `fail` or `unknown` |
 
+### Reusable SDK Primitives
+
+`fastapi-m8` already depends on `auth-sdk-m8` and pins its major range, so it
+re-exports the SDK primitives a consumer service actually needs. **Import them
+from `fastapi_m8`, never from `auth_sdk_m8`.** A consumer service that imports
+the SDK directly takes on a second dependency whose major range it does not
+control, and can be broken by an SDK change `fastapi-m8` has already absorbed.
+
+| Re-export | SDK origin | Purpose |
+|---|---|---|
+| `has_superuser_privileges` | `auth_sdk_m8` | Dual-evidence superuser predicate (`role == SUPERADMIN` **and** `is_superuser`) |
+| `has_minimum_role` | `auth_sdk_m8.authorization` | Canonical role-ordering predicate — the single implementation of the hierarchy |
+| `RoleType` | `auth_sdk_m8.schemas.base` | Role enum; the argument type of `AuthDeps.require_role()` |
+| `BaseController` | `auth_sdk_m8.controllers.base` | CRUD controller base class |
+| `ResponseModelBase` | `auth_sdk_m8.schemas.base` | Base response schema |
+| `ResponseMessage` | `auth_sdk_m8.schemas.base` | Simple `{"message": ...}` response schema |
+| `ValidationConstants` | `auth_sdk_m8.schemas.shared` | Shared field length/format constants for consumer schemas |
+| `TimestampMixin` | `auth_sdk_m8.models.shared` | `created_at` / `updated_at` UTC columns for SQLModel tables |
+| `UserModel` | `auth_sdk_m8.schemas.user` | The authenticated principal every JWT dependency resolves to |
+| `find_dotenv` | `auth_sdk_m8.utils.paths` | Locate the service `.env` file |
+| `render_metrics` | `auth_sdk_m8.observability.metrics` | Render the Prometheus exposition payload |
+| `REGISTRY` | `auth_sdk_m8.observability.metrics` | The shared Prometheus collector registry `render_metrics` renders |
+| `make_scrape_credential_guard` | `auth_sdk_m8.security.guards` | Build the `/metrics` scrape-credential guard |
+
+```python
+from fastapi_m8 import (
+    REGISTRY,
+    BaseController,
+    ResponseMessage,
+    ResponseModelBase,
+    RoleType,
+    TimestampMixin,
+    UserModel,
+    ValidationConstants,
+    find_dotenv,
+    has_minimum_role,
+    has_superuser_privileges,
+    make_scrape_credential_guard,
+    render_metrics,
+)
+```
+
+Every name above is the SDK object itself, not a wrapper — `fastapi_m8.RoleType
+is auth_sdk_m8.schemas.base.RoleType` — so rerouting an import changes nothing
+at runtime, including SQLModel/SQLAlchemy table metadata built on
+`TimestampMixin`.
+
 ---
 
 ## Authentication
@@ -1420,13 +1468,15 @@ TABLES_PREFIX=app
 `SQLALCHEMY_DATABASE_URI` is assembled automatically. You can also set it directly
 to override the assembly.
 
-Define models with `TimestampMixin` from `auth-sdk-m8` (adds `created_at` /
-`updated_at` UTC columns):
+Define models with `TimestampMixin` (adds `created_at` / `updated_at` UTC
+columns). It originates in `auth-sdk-m8` and is
+[re-exported by `fastapi-m8`](#reusable-sdk-primitives) — import it from here,
+not from the SDK:
 
 ```python
 import uuid
 from sqlmodel import SQLModel, Field
-from auth_sdk_m8.models.shared import TimestampMixin
+from fastapi_m8 import TimestampMixin
 
 
 class Item(TimestampMixin, SQLModel, table=True):
@@ -1636,6 +1686,7 @@ async def test_health(client):
 
 | `fastapi-m8` | `auth-sdk-m8` | Python |
 |---|---|---|
+| `4.3.0` | `>=3.1.2, <4.0.0` | 3.12, 3.13, 3.14 |
 | `4.2.0` | `>=3.1.0, <4.0.0` | 3.12, 3.13, 3.14 |
 | `4.1.0` | `>=3.1.0, <4.0.0` | 3.11, 3.12, 3.13, 3.14 |
 | `4.0.0` | `>=3.0.0, <4.0.0` | 3.11, 3.12, 3.13, 3.14 |

{fastapi_m8-4.2.2 → fastapi_m8-4.3.0}/README.md

@@ -27,6 +27,7 @@ boilerplate from every consumer service.
    - [build_auth_deps()](#build_auth_deps)
    - [create_db_engine()](#create_db_engine)
    - [Health Checks](#health-checks)
+   - [Reusable SDK Primitives](#reusable-sdk-primitives)
 7. [Authentication](#authentication)
    - [Token Modes](#token-modes)
    - [Role System](#role-system)
@@ -905,6 +906,53 @@ class RedisCheck:
 | `LENIENT` (default) | Any check is `fail` |
 | `STRICT` | Any check is `fail` or `unknown` |
 
+### Reusable SDK Primitives
+
+`fastapi-m8` already depends on `auth-sdk-m8` and pins its major range, so it
+re-exports the SDK primitives a consumer service actually needs. **Import them
+from `fastapi_m8`, never from `auth_sdk_m8`.** A consumer service that imports
+the SDK directly takes on a second dependency whose major range it does not
+control, and can be broken by an SDK change `fastapi-m8` has already absorbed.
+
+| Re-export | SDK origin | Purpose |
+|---|---|---|
+| `has_superuser_privileges` | `auth_sdk_m8` | Dual-evidence superuser predicate (`role == SUPERADMIN` **and** `is_superuser`) |
+| `has_minimum_role` | `auth_sdk_m8.authorization` | Canonical role-ordering predicate — the single implementation of the hierarchy |
+| `RoleType` | `auth_sdk_m8.schemas.base` | Role enum; the argument type of `AuthDeps.require_role()` |
+| `BaseController` | `auth_sdk_m8.controllers.base` | CRUD controller base class |
+| `ResponseModelBase` | `auth_sdk_m8.schemas.base` | Base response schema |
+| `ResponseMessage` | `auth_sdk_m8.schemas.base` | Simple `{"message": ...}` response schema |
+| `ValidationConstants` | `auth_sdk_m8.schemas.shared` | Shared field length/format constants for consumer schemas |
+| `TimestampMixin` | `auth_sdk_m8.models.shared` | `created_at` / `updated_at` UTC columns for SQLModel tables |
+| `UserModel` | `auth_sdk_m8.schemas.user` | The authenticated principal every JWT dependency resolves to |
+| `find_dotenv` | `auth_sdk_m8.utils.paths` | Locate the service `.env` file |
+| `render_metrics` | `auth_sdk_m8.observability.metrics` | Render the Prometheus exposition payload |
+| `REGISTRY` | `auth_sdk_m8.observability.metrics` | The shared Prometheus collector registry `render_metrics` renders |
+| `make_scrape_credential_guard` | `auth_sdk_m8.security.guards` | Build the `/metrics` scrape-credential guard |
+
+```python
+from fastapi_m8 import (
+    REGISTRY,
+    BaseController,
+    ResponseMessage,
+    ResponseModelBase,
+    RoleType,
+    TimestampMixin,
+    UserModel,
+    ValidationConstants,
+    find_dotenv,
+    has_minimum_role,
+    has_superuser_privileges,
+    make_scrape_credential_guard,
+    render_metrics,
+)
+```
+
+Every name above is the SDK object itself, not a wrapper — `fastapi_m8.RoleType
+is auth_sdk_m8.schemas.base.RoleType` — so rerouting an import changes nothing
+at runtime, including SQLModel/SQLAlchemy table metadata built on
+`TimestampMixin`.
+
 ---
 
 ## Authentication
@@ -1163,13 +1211,15 @@ TABLES_PREFIX=app
 `SQLALCHEMY_DATABASE_URI` is assembled automatically. You can also set it directly
 to override the assembly.
 
-Define models with `TimestampMixin` from `auth-sdk-m8` (adds `created_at` /
-`updated_at` UTC columns):
+Define models with `TimestampMixin` (adds `created_at` / `updated_at` UTC
+columns). It originates in `auth-sdk-m8` and is
+[re-exported by `fastapi-m8`](#reusable-sdk-primitives) — import it from here,
+not from the SDK:
 
 ```python
 import uuid
 from sqlmodel import SQLModel, Field
-from auth_sdk_m8.models.shared import TimestampMixin
+from fastapi_m8 import TimestampMixin
 
 
 class Item(TimestampMixin, SQLModel, table=True):
@@ -1379,6 +1429,7 @@ async def test_health(client):
 
 | `fastapi-m8` | `auth-sdk-m8` | Python |
 |---|---|---|
+| `4.3.0` | `>=3.1.2, <4.0.0` | 3.12, 3.13, 3.14 |
 | `4.2.0` | `>=3.1.0, <4.0.0` | 3.12, 3.13, 3.14 |
 | `4.1.0` | `>=3.1.0, <4.0.0` | 3.11, 3.12, 3.13, 3.14 |
 | `4.0.0` | `>=3.0.0, <4.0.0` | 3.11, 3.12, 3.13, 3.14 |

{fastapi_m8-4.2.2 → fastapi_m8-4.3.0}/fastapi_m8/__init__.py

@@ -27,11 +27,14 @@ Tier 2 — health building blocks::
     )
 
 Reusable SDK primitives (re-exported from auth-sdk-m8, so consumers depend
-only on fastapi-m8)::
+only on fastapi-m8 — a consumer service must never import ``auth_sdk_m8``
+directly)::
 
-    from fastapi_m8 import has_superuser_privileges
+    from fastapi_m8 import has_superuser_privileges, has_minimum_role, RoleType
     from fastapi_m8 import BaseController, ResponseModelBase, ResponseMessage
-    from fastapi_m8 import TimestampMixin, UserModel, find_dotenv, render_metrics
+    from fastapi_m8 import TimestampMixin, UserModel, ValidationConstants
+    from fastapi_m8 import find_dotenv, render_metrics, REGISTRY
+    from fastapi_m8 import make_scrape_credential_guard
 
 Tier 3 — informational / future::
 
@@ -43,11 +46,15 @@ Tier 3 — informational / future::
 # Reusable SDK primitives — re-exported so consumers only need fastapi-m8,
 # never a direct auth-sdk-m8 dependency.
 from auth_sdk_m8 import has_superuser_privileges
+from auth_sdk_m8.authorization import has_minimum_role
 from auth_sdk_m8.controllers.base import BaseController
 from auth_sdk_m8.models.shared import TimestampMixin
+from auth_sdk_m8.observability.metrics import REGISTRY
 from auth_sdk_m8.observability.metrics import render as render_metrics
-from auth_sdk_m8.schemas.base import ResponseMessage, ResponseModelBase
+from auth_sdk_m8.schemas.base import ResponseMessage, ResponseModelBase, RoleType
+from auth_sdk_m8.schemas.shared import ValidationConstants
 from auth_sdk_m8.schemas.user import UserModel
+from auth_sdk_m8.security.guards import make_scrape_credential_guard
 from auth_sdk_m8.utils.paths import find_dotenv
 
 from fastapi_m8._api_key import (
@@ -127,13 +134,18 @@ __all__ = [
     "HealthAggregatePolicy",
     # Reusable SDK primitives (from auth-sdk-m8)
     "has_superuser_privileges",
+    "has_minimum_role",
+    "RoleType",
     "BaseController",
     "ResponseModelBase",
     "ResponseMessage",
     "TimestampMixin",
     "UserModel",
+    "ValidationConstants",
     "find_dotenv",
     "render_metrics",
+    "REGISTRY",
+    "make_scrape_credential_guard",
     # Tier 3
     "create_async_app",
     "CAPABILITIES",

{fastapi_m8-4.2.2 → fastapi_m8-4.3.0}/fastapi_m8/_compat.py

@@ -105,6 +105,14 @@ COMPAT_MATRIX: dict[str, dict[str, str]] = {
     # change. The SDK floor remains >=3.1.0,<4.0.0 (no new SDK API required).
     # See CHANGELOG and Phase 7 (role-gated examples and privileged-action audit).
     "4.2": {"auth-sdk-m8": ">=3.1.0,<4.0.0"},
+    # 4.3 (MINOR) completes the SDK re-export surface so a consumer service can
+    # reach zero direct auth_sdk_m8 imports: has_minimum_role, RoleType,
+    # ValidationConstants, make_scrape_credential_guard and REGISTRY join the
+    # Tier-1 "Reusable SDK primitives" block in __init__.py. Additive only — no
+    # new SDK API is required, but the floor is stated as >=3.1.2 because that
+    # is the floor pyproject.toml actually declares and the version whose
+    # module layout these five names are re-exported from. See CHANGELOG.
+    "4.3": {"auth-sdk-m8": ">=3.1.2,<4.0.0"},
 }
 
 _EXTRAS = "[config,security,fastapi,observability]"

{fastapi_m8-4.2.2 → fastapi_m8-4.3.0}/fastapi_m8/_version.py

@@ -1,3 +1,3 @@
 """Single source of truth for the package version."""
 
-__version__ = "4.2.2"
+__version__ = "4.3.0"

{fastapi_m8-4.2.2 → fastapi_m8-4.3.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "fastapi-m8"
-version = "4.2.2"
+version = "4.3.0"
 description = "FastAPI application framework for m8 consumer microservices."
 readme = "README.md"
 license = { file = "LICENSE" }

{fastapi_m8-4.2.2 → fastapi_m8-4.3.0}/tests/test_packaging.py

@@ -80,6 +80,11 @@ class TestInstalledWheelImports:
         API-key route, and prove ``audit_api_key_routes`` flags it — the same
         behavior asserted against the source tree in test_route_audit.py, now
         proven against the packaged artifact.
+
+        Also imports the reusable SDK primitives from the built wheel. A
+        consumer service depends on ``fastapi-m8`` alone, so "the re-export
+        exists in the source tree" is not the guarantee it needs — "the
+        re-export ships in the artifact" is.
         """
         install_dir = tmp_path / "site"
         install_dir.mkdir()
@@ -141,7 +146,22 @@ settings = fm8.ConsumerServiceSettings(
 auth = fm8.build_auth_deps(settings)
 assert auth.get_current_api_key_principal is not None
 
-from auth_sdk_m8.schemas.base import RoleType
+from fastapi_m8 import (
+    REGISTRY,
+    RoleType,
+    ValidationConstants,
+    has_minimum_role,
+    make_scrape_credential_guard,
+)
+import auth_sdk_m8.observability.metrics as _sdk_metrics
+import auth_sdk_m8.schemas.base as _sdk_base
+
+assert has_minimum_role(RoleType.WRITER, RoleType.READER) is True
+assert has_minimum_role(RoleType.USER, RoleType.READER) is False
+assert RoleType is _sdk_base.RoleType
+assert REGISTRY is _sdk_metrics.REGISTRY
+assert ValidationConstants.KEY_REGEX.match("probe-key") is not None
+assert callable(make_scrape_credential_guard(None))
 
 assert callable(auth.get_current_active_reader)
 assert callable(auth.require_role)

{fastapi_m8-4.2.2 → fastapi_m8-4.3.0}/tests/test_public_typing.py

@@ -11,10 +11,13 @@ consumer's own mypy run.
 
 from __future__ import annotations
 
+import importlib
 import subprocess
 import sys
 from pathlib import Path
 
+import pytest
+
 import fastapi_m8
 
 REPO_ROOT = Path(__file__).resolve().parents[1]
@@ -24,11 +27,14 @@ REPO_ROOT = Path(__file__).resolve().parents[1]
 _TYPING_SNIPPET = '''
 from __future__ import annotations
 
-from fastapi import Depends, FastAPI
+from pathlib import Path
+
+from fastapi import Depends, FastAPI, Response
 
 from fastapi_m8 import (
     API_KEY_HEADER,
     CAPABILITIES,
+    REGISTRY,
     ApiKeyIntrospectionError,
     ApiKeyQuotaExceededError,
     AppLifecycle,
@@ -36,6 +42,7 @@ from fastapi_m8 import (
     AuthEventStreamClient,
     AuthStreamEvent,
     BareApiKeyDependency,
+    BaseController,
     COMPAT_MATRIX,
     ConsumerServiceSettings,
     DbEngine,
@@ -45,7 +52,13 @@ from fastapi_m8 import (
     HealthConfig,
     HealthStatus,
     InternalAuthProvider,
+    ResponseMessage,
+    ResponseModelBase,
+    RoleType,
     ServiceTokenInternalAuth,
+    TimestampMixin,
+    UserModel,
+    ValidationConstants,
     __version__,
     audit_api_key_routes,
     build_auth_deps,
@@ -58,10 +71,13 @@ from fastapi_m8 import (
     derive_api_key_introspection_url,
     derive_service_token_url,
     derive_stream_url,
+    find_dotenv,
+    has_minimum_role,
+    has_superuser_privileges,
+    make_scrape_credential_guard,
+    render_metrics,
 )
 from auth_sdk_m8.schemas.api_key import ApiKeyPrincipal
-from auth_sdk_m8.schemas.base import RoleType
-from auth_sdk_m8.schemas.user import UserModel
 
 
 def build(settings: ConsumerServiceSettings) -> AuthDeps:
@@ -111,6 +127,38 @@ def audit(app: FastAPI, auth: AuthDeps) -> list[BareApiKeyDependency]:
     if bare_dep is None:
         return []
     return audit_api_key_routes(app, bare_dependency=bare_dep)
+
+
+def use_role_predicates(user: UserModel) -> bool:
+    """The re-exported authorization predicates keep their SDK signatures."""
+    if has_superuser_privileges(user.role, user.is_superuser):
+        return True
+    return has_minimum_role(user.role, RoleType.WRITER)
+
+
+def use_metrics_surface(app: FastAPI, credential: str | None) -> None:
+    """render_metrics / REGISTRY / the scrape guard stay typed through the
+    re-export."""
+    guard = make_scrape_credential_guard(credential)
+
+    @app.get("/metrics", dependencies=[Depends(guard)])
+    def metrics() -> Response:
+        payload, content_type = render_metrics()
+        return Response(content=payload, media_type=content_type)
+
+    list(REGISTRY.collect())
+
+
+def use_schema_and_model_primitives() -> tuple[str, bool]:
+    """The schema/controller/model/constant primitives are real types, not Any."""
+    dotenv: Path = find_dotenv()
+    message: ResponseMessage = ResponseMessage(success=True, msg="ok")
+    wrapper: ResponseModelBase = ResponseModelBase(success=True, data=None)
+    controller: type[BaseController] = BaseController
+    mixin: type[TimestampMixin] = TimestampMixin
+    matched = ValidationConstants.KEY_REGEX.match(message.msg) is not None
+    assert controller is not None and mixin is not None and wrapper.success
+    return str(dotenv), matched
 '''
 
 
@@ -134,3 +182,43 @@ def test_all_exports_resolve_to_real_objects() -> None:
         assert hasattr(fastapi_m8, name), (
             f"{name!r} is listed in fastapi_m8.__all__ but is not importable"
         )
+
+
+# Every reusable SDK primitive fastapi-m8 re-exports, mapped to the module it
+# must come from. A consumer service imports these from fastapi_m8 and never
+# from auth_sdk_m8, so a re-export that silently becomes a local wrapper — or
+# quietly disappears — has to fail here rather than in three consumer repos.
+_SDK_REEXPORTS: dict[str, str] = {
+    "has_superuser_privileges": "auth_sdk_m8.authorization",
+    "has_minimum_role": "auth_sdk_m8.authorization",
+    "RoleType": "auth_sdk_m8.schemas.base",
+    "BaseController": "auth_sdk_m8.controllers.base",
+    "ResponseModelBase": "auth_sdk_m8.schemas.base",
+    "ResponseMessage": "auth_sdk_m8.schemas.base",
+    "ValidationConstants": "auth_sdk_m8.schemas.shared",
+    "TimestampMixin": "auth_sdk_m8.models.shared",
+    "UserModel": "auth_sdk_m8.schemas.user",
+    "find_dotenv": "auth_sdk_m8.utils.paths",
+    "REGISTRY": "auth_sdk_m8.observability.metrics",
+    "make_scrape_credential_guard": "auth_sdk_m8.security.guards",
+}
+
+
+@pytest.mark.parametrize(("name", "module_path"), sorted(_SDK_REEXPORTS.items()))
+def test_sdk_primitive_is_the_sdk_object_not_a_wrapper(
+    name: str, module_path: str
+) -> None:
+    """Each re-export *is* the SDK object, so rerouting an import is a no-op."""
+    module = importlib.import_module(module_path)
+    assert getattr(fastapi_m8, name) is getattr(module, name), (
+        f"fastapi_m8.{name} is not {module_path}.{name}"
+    )
+    assert name in fastapi_m8.__all__
+
+
+def test_render_metrics_is_the_sdk_render_function() -> None:
+    """The one re-export that is renamed still points at the SDK function."""
+    from auth_sdk_m8.observability import metrics
+
+    assert fastapi_m8.render_metrics is metrics.render
+    assert fastapi_m8.REGISTRY is metrics.REGISTRY