spaps-server-quickstart 0.3.0__tar.gz → 0.5.0__tar.gz

{spaps_server_quickstart-0.3.0 → spaps_server_quickstart-0.5.0}/.gitignore

@@ -6,6 +6,8 @@ yarn-debug.log*
 yarn-error.log*
 lerna-debug.log*
 
+sweet-potato-threat-model.md
+
 # Python
 **/__pycache__/
 *.py[cod]
@@ -24,6 +26,9 @@ coverage-*/
 **/.mypy_cache/
 **/.ruff_cache/
 **/.hypothesis/
+**/.testmondata
+**/.testmondata-shm
+**/.testmondata-wal
 *.lcov
 **/lcov.info
 **/lcov-report/
@@ -45,6 +50,7 @@ storybook-static/
 .env
 .env.*
 *.env
+*.env.draft
 **/.env
 **/.env.*
 .env.development
@@ -72,6 +78,7 @@ storybook-static/
 # IDE
 .vscode/
 .idea/
+.claude/settings.local.json
 *.swp
 *.swo
 *.swn
@@ -135,6 +142,15 @@ mcp-sweetpotato-docs/.next/
 *.sqlite3
 *.db
 
+# Supabase production backups (contain real user data)
+schema.sql
+roles.sql
+data.sql
+backup-feb8.sql
+
+# Stripe CLI
+.stripe-listen.pid
+
 # OS files
 Thumbs.db
 Desktop.ini
@@ -153,3 +169,5 @@ playwright/.cache/
 # (keep package-lock.json for applications)
 # yarn.lock
 # pnpm-lock.yaml*.tgz
+
+**/coverage.xml

spaps_server_quickstart-0.5.0/.python-version

@@ -0,0 +1 @@
+3.12.5

spaps_server_quickstart-0.5.0/CHANGELOG.md

@@ -0,0 +1,116 @@
+# Changelog
+
+All notable changes to this project are documented in this file.
+
+The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+- No changes yet.
+
+## [0.4.0] - 2026-02-11
+
+### Added
+
+- Full domain rewrite covering auth, sessions, users, wallets, payments, entitlements, dayrate, agent approvals, affiliate referrals, email templates, and related operational domains.
+- Approval capability gates and governance health endpoint.
+
+### Changed
+
+- Production cutover to Python SPAPS stack (CI/CD, Docker Compose, deploy scripts).
+- Consolidated SPAPS integration patterns into published packages.
+
+### Security
+
+- Rate limiting by client IP.
+- PII encryption startup checks.
+- Webhook authentication hardening.
+- Row-level locking on refresh tokens.
+- Fail-closed settings defaults.
+
+## [0.3.0] - 2026-02-08
+
+### Added
+
+- Contract tests and shared testing module.
+- Health endpoint enhancements.
+
+### Changed
+
+- Expanded coverage across settings, middleware, database, Celery, and auth helpers.
+
+## [0.2.3] - 2026-01-12
+
+### Fixed
+
+- `SpapsAuthMiddleware` now skips execution when `authenticated_user` is already populated.
+
+## [0.2.2] - 2026-01-11
+
+### Added
+
+- `fnmatch` glob support for `spaps_auth_exempt_paths`.
+- Set-password endpoint support for authenticated users.
+- Stripe webhook admin tooling for entitlement workflows.
+- Tier 3 templates: seeds, tests, domain examples, docs.
+- Startup validation, Alembic templates, and CI/CD workflow scaffolding.
+
+## [0.2.1] - 2025-12-01
+
+### Added
+
+- Shared pgvector dev scripts: `start-db.sh`, `stop-db.sh`, `await_db.py`.
+- Dynamic DNS resolver support for Docker reverse-proxy setups.
+
+### Fixed
+
+- nginx DNS caching behavior.
+- HTMA rate-limiting exemption handling.
+
+## [0.2.0] - 2025-10-15
+
+### Added
+
+- Local auth bypass mode with pre-configured admin/user personas.
+- Deployment check scripts (`pre-deploy`, `post-deploy`).
+- Database caching workflow for local debug loops.
+- Operational templates (Makefile, GHCR deploy, compose/reverse-proxy stubs).
+
+### Security
+
+- Production guardrails for local-auth bypass mode.
+
+## [0.1.2] - 2025-10-15
+
+### Fixed
+
+- CI pipeline trigger scoping and quickstart build stability.
+
+## [0.1.1] - 2025-10-14
+
+### Changed
+
+- Maintenance release to unblock automated PyPI publishing workflow.
+
+## [0.1.0] - 2025-10-14
+
+### Added
+
+- FastAPI lifespan handling for SPAPS auth cleanup.
+- Migration and upgrading guidance for downstream services.
+- Shared refresh-cookie configuration and browser helper exports.
+- Expanded package exports for auth helpers and operational templates.
+- RBAC role helpers and sample domain routers.
+- Comprehensive unit tests across settings, middleware, DB, Celery, and auth helpers.
+
+## [0.0.2] - 2025-10-12
+
+### Added
+
+- Declared the `spaps` Python client dependency for downstream installs and CI runs.
+
+## [0.0.1] - 2025-10-14
+
+### Added
+
+- Initial `spaps-server-quickstart` scaffold with shared FastAPI/Celery/database utilities.

spaps_server_quickstart-0.5.0/PKG-INFO

@@ -0,0 +1,299 @@
+Metadata-Version: 2.4
+Name: spaps-server-quickstart
+Version: 0.5.0
+Summary: Shared FastAPI/Celery scaffolding for Sweet Potato service backends.
+Project-URL: Homepage, https://api.sweetpotato.dev
+Project-URL: Repository, https://github.com/sweet-potato/spaps
+Author-email: buildooor <buildooor@gmail.com>
+License: MIT
+Keywords: celery,fastapi,quickstart,spaps,sweet-potato
+Classifier: Framework :: FastAPI
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Internet :: WWW/HTTP
+Requires-Python: >=3.12
+Requires-Dist: alembic<2.0,>=1.13.1
+Requires-Dist: asyncpg<0.31,>=0.30.0
+Requires-Dist: bcrypt<6.0,>=4.0.0
+Requires-Dist: celery<6.0,>=5.5.3
+Requires-Dist: cryptography<45.0,>=42.0.0
+Requires-Dist: email-validator<3.0,>=2.1.0
+Requires-Dist: eth-account<1.0,>=0.13.0
+Requires-Dist: fastapi<0.119,>=0.118.0
+Requires-Dist: greenlet<4.0,>=3.0.3
+Requires-Dist: httpx<0.29,>=0.28.1
+Requires-Dist: pgvector<0.5,>=0.4.1
+Requires-Dist: psycopg[binary]<3.3,>=3.2.10
+Requires-Dist: pydantic-settings<3.0,>=2.3.0
+Requires-Dist: pydantic<3.0,>=2.8.0
+Requires-Dist: pyjwt<3.0,>=2.8.0
+Requires-Dist: python-dotenv<2.0,>=1.0.1
+Requires-Dist: redis<7.0,>=6.4.0
+Requires-Dist: slowapi<1.0,>=0.1.9
+Requires-Dist: solders<1.0,>=0.21.0
+Requires-Dist: spaps>=0.1.2
+Requires-Dist: sqlalchemy<3.0,>=2.0.30
+Requires-Dist: stripe<12.0,>=8.0.0
+Requires-Dist: structlog<26.0,>=25.4.0
+Requires-Dist: uvicorn[standard]<0.38,>=0.37.0
+Provides-Extra: dev
+Requires-Dist: anyio<5.0,>=4.4.0; extra == 'dev'
+Requires-Dist: bcrypt<6.0,>=4.0.0; extra == 'dev'
+Requires-Dist: coverage<8.0,>=7.4.0; extra == 'dev'
+Requires-Dist: docker<8.0,>=7.0.0; extra == 'dev'
+Requires-Dist: filelock<4.0,>=3.12.0; extra == 'dev'
+Requires-Dist: httpx<0.29,>=0.28.1; extra == 'dev'
+Requires-Dist: mypy<1.12,>=1.10.0; extra == 'dev'
+Requires-Dist: pytest-asyncio<0.24,>=0.23.0; extra == 'dev'
+Requires-Dist: pytest-cov<6.0,>=5.0.0; extra == 'dev'
+Requires-Dist: pytest-testmon<3.0,>=2.1.0; extra == 'dev'
+Requires-Dist: pytest-xdist<4.0,>=3.6.1; extra == 'dev'
+Requires-Dist: pytest<9.0,>=8.2.0; extra == 'dev'
+Requires-Dist: respx<0.23,>=0.22.0; extra == 'dev'
+Requires-Dist: ruff<0.5,>=0.4.1; extra == 'dev'
+Requires-Dist: testcontainers[postgres]<5.0,>=4.0.0; extra == 'dev'
+Requires-Dist: types-pyyaml<7.0,>=6.0.0; extra == 'dev'
+Provides-Extra: release
+Requires-Dist: build<2.0,>=1.2.1; extra == 'release'
+Requires-Dist: twine<6.0,>=5.0.0; extra == 'release'
+Provides-Extra: testing
+Requires-Dist: docker<8.0,>=7.0.0; extra == 'testing'
+Requires-Dist: filelock<4.0,>=3.12.0; extra == 'testing'
+Requires-Dist: httpx<0.29,>=0.28.1; extra == 'testing'
+Requires-Dist: pytest-asyncio<0.24,>=0.23.0; extra == 'testing'
+Requires-Dist: pytest-testmon<3.0,>=2.1.0; extra == 'testing'
+Requires-Dist: pytest-xdist<4.0,>=3.6.1; extra == 'testing'
+Requires-Dist: pytest<9.0,>=8.2.0; extra == 'testing'
+Requires-Dist: respx<0.23,>=0.22.0; extra == 'testing'
+Requires-Dist: testcontainers[postgres]<5.0,>=4.0.0; extra == 'testing'
+Description-Content-Type: text/markdown
+
+# SPAPS Server Quickstart
+
+Reusable FastAPI, SQLAlchemy, Celery, auth, and operational scaffolding for Sweet Potato service backends. This is the active backend package in the repository and the shared foundation for SPAPS-aligned Python services.
+
+```bash
+pip install spaps-server-quickstart
+```
+
+## TL;DR
+
+**The Problem**: new FastAPI services keep re-solving the same problems around app factories, auth middleware, RBAC, async database wiring, Celery bootstrapping, and deployment guardrails.
+
+**The Solution**: `spaps-server-quickstart` packages the shared SPAPS backend conventions into one installable Python package so new services start from a tested baseline instead of ad hoc scaffolding.
+
+### Why Use `spaps-server-quickstart`?
+
+| Feature | What it gives you |
+| --- | --- |
+| App factory and startup checks | `create_app`, settings loaders, and environment validation |
+| Shared auth + RBAC | SPAPS auth middleware, auth channels, trusted-service middleware, and role dependencies |
+| Async data layer | SQLAlchemy 2.0 async helpers, migration runner, and session dependencies |
+| Operational templates | Deployment scripts, compose stubs, dev DB helpers, and packaging patterns |
+
+## Metadata
+
+- `package_name`: `spaps-server-quickstart`
+- `latest_version`: `0.4.0`
+- `minimum_runtime`: `Python >=3.12`
+- `api_base_url`: `https://api.sweetpotato.dev`
+
+## Quick Start
+
+```python
+from fastapi import APIRouter
+
+from spaps_server_quickstart import create_app
+from spaps_server_quickstart.settings import BaseServiceSettings
+
+
+def load_settings() -> BaseServiceSettings:
+    return BaseServiceSettings(env="test", app_name="README Quickstart")
+
+
+router = APIRouter()
+
+
+@router.get("/hello")
+async def hello() -> dict[str, str]:
+    return {"message": "Hello from SPAPS"}
+
+
+app = create_app(settings_loader=load_settings, api_router=router)
+```
+
+## Design Principles
+
+1. Start from a real service baseline, not a toy template.
+2. Keep auth, middleware, and operational guardrails reusable across services.
+3. Prefer explicit service composition through settings loaders and dependency injection.
+4. Keep the local-development path close to production behavior.
+5. Make the happy path easy without hiding the underlying FastAPI and SQLAlchemy primitives.
+
+## What the Package Includes
+
+| Area | Highlights |
+| --- | --- |
+| App lifecycle | `create_app`, startup checks, environment validation, logging |
+| Auth | `SpapsAuthMiddleware`, auth cookies, auth channel service, local auth mode |
+| Routing and RBAC | Base router builder, role helpers, authenticated-user dependencies |
+| Database | Async sessionmaker factory, migration runner, Alembic helpers |
+| Tasks | Celery app factory plus notification and ping task helpers |
+| Service SDK helpers | Admin token cache, server-side SPAPS clients, feature evaluation, trusted-service middleware |
+| Templates | Domain examples, operations bundle, env examples, and local dev helpers |
+
+## Local Development Mode
+
+Set `DEVELOPMENT_ENVIRONMENT=local` to enable the local-auth bypass workflow used in development and tests.
+
+```python
+from spaps_server_quickstart.local_mode import (
+    LocalAuthMiddleware,
+    get_default_registry,
+)
+from spaps_server_quickstart.settings import BaseServiceSettings
+
+settings = BaseServiceSettings(development_environment="local")
+
+if settings.is_local_development:
+    app.add_middleware(LocalAuthMiddleware, registry=get_default_registry())
+```
+
+Default personas:
+
+| Persona | Token | Roles |
+| --- | --- | --- |
+| Admin | `local-admin` | `admin`, `user` |
+| User | `local-user` | `user` |
+
+## Configuration
+
+Key settings exposed through `BaseServiceSettings` and related SPAPS settings:
+
+| Setting | Purpose |
+| --- | --- |
+| `development_environment` | Enables local bypass mode when set to `local` |
+| `spaps_auth_exempt_paths` | Comma-separated paths that skip SPAPS auth |
+| `cors_allow_origins` | Shared CORS configuration |
+| `secure_messages_enabled` | Toggles secure-messaging gateway support |
+| `secure_messages_timeout` | HTTP timeout for secure-messaging calls |
+
+Example environment:
+
+```bash
+DEVELOPMENT_ENVIRONMENT=local
+SPAPS_AUTH_EXEMPT_PATHS=/health,/docs
+CORS_ALLOW_ORIGINS=http://localhost:3000,http://localhost:5173
+```
+
+## Operational Templates
+
+The package ships with templates and scripts for the workflows the real SPAPS services use:
+
+- Docker Compose and reverse-proxy stubs
+- Deploy scripts with preflight and post-deploy checks
+- Database backup, restore, and migration helpers
+- Shared dev DB helpers and local debug-loop support
+- Example domains and tests for bootstrapping new services
+
+## Architecture
+
+```text
+FastAPI service
+  |
+  +--> create_app + settings loader
+  |
+  +--> auth middleware / RBAC / dependencies
+  |
+  +--> async DB session + Alembic helpers
+  |
+  +--> Celery tasks + service SDK helpers
+  |
+  +--> shared operational templates
+          |
+          v
+    SPAPS-aligned production service
+```
+
+## Validation and Development
+
+When working in this repository, the root `Makefile` is the canonical workflow:
+
+```bash
+make install
+make pytest
+make lint
+make typecheck
+make test
+make local-up
+```
+
+Useful additional commands:
+
+```bash
+make pytest-full
+make pytest-cov
+make migrate
+make new-migration MSG="add_example_table"
+```
+
+## Troubleshooting
+
+### `make pytest` reports no affected tests
+
+That is expected when testmon sees no impacted tests. Use `make pytest-full` when you need a full run.
+
+### Local auth bypass is not active
+
+Confirm `DEVELOPMENT_ENVIRONMENT=local` is set before application startup.
+
+### Unauthenticated routes still require auth
+
+Check `spaps_auth_exempt_paths` and make sure the configured paths match the actual router paths.
+
+### Startup fails on environment validation
+
+Review the required settings and any environment-safety checks triggered during startup validation.
+
+### I need a new service quickly
+
+Start from the included templates and keep the repo-root validation path intact while adapting the service-specific settings.
+
+## Limitations
+
+- This package is a scaffold, not a complete application by itself.
+- Downstream services still need their own domain routers, schemas, repositories, and deployment configuration.
+- Some operational templates intentionally require environment-specific edits before production use.
+
+## FAQ
+
+### Is this the active SPAPS backend in this repo?
+
+Yes. This package replaces the old Node/Express stack as the active backend surface.
+
+### Does it include local auth bypass support?
+
+Yes. Set `DEVELOPMENT_ENVIRONMENT=local` and wire in the local-mode helpers.
+
+### Can I use it without Celery?
+
+Yes. Celery helpers are included, but you can compose only the pieces your service needs.
+
+### Does it include RBAC helpers?
+
+Yes. Use `require_roles`, `has_required_roles`, and the authenticated-user dependencies.
+
+### What is the recommended validation path here?
+
+From the repository root: `make pytest`, `make lint`, `make typecheck`, and `make test`.
+
+## About Contributions
+
+> *About Contributions:* Please don't take this the wrong way, but I do not accept outside contributions for any of my projects. I simply don't have the mental bandwidth to review anything, and it's my name on the thing, so I'm responsible for any problems it causes; thus, the risk-reward is highly asymmetric from my perspective. I'd also have to worry about other "stakeholders," which seems unwise for tools I mostly make for myself for free. Feel free to submit issues, and even PRs if you want to illustrate a proposed fix, but know I won't merge them directly. Instead, I'll have Claude or Codex review submissions via `gh` and independently decide whether and how to address them. Bug reports in particular are welcome. Sorry if this offends, but I want to avoid wasted time and hurt feelings. I understand this isn't in sync with the prevailing open-source ethos that seeks community contributions, but it's the only way I can move at this velocity and keep my sanity.
+
+## License
+
+MIT

spaps_server_quickstart-0.5.0/README.md

@@ -0,0 +1,226 @@
+# SPAPS Server Quickstart
+
+Reusable FastAPI, SQLAlchemy, Celery, auth, and operational scaffolding for Sweet Potato service backends. This is the active backend package in the repository and the shared foundation for SPAPS-aligned Python services.
+
+```bash
+pip install spaps-server-quickstart
+```
+
+## TL;DR
+
+**The Problem**: new FastAPI services keep re-solving the same problems around app factories, auth middleware, RBAC, async database wiring, Celery bootstrapping, and deployment guardrails.
+
+**The Solution**: `spaps-server-quickstart` packages the shared SPAPS backend conventions into one installable Python package so new services start from a tested baseline instead of ad hoc scaffolding.
+
+### Why Use `spaps-server-quickstart`?
+
+| Feature | What it gives you |
+| --- | --- |
+| App factory and startup checks | `create_app`, settings loaders, and environment validation |
+| Shared auth + RBAC | SPAPS auth middleware, auth channels, trusted-service middleware, and role dependencies |
+| Async data layer | SQLAlchemy 2.0 async helpers, migration runner, and session dependencies |
+| Operational templates | Deployment scripts, compose stubs, dev DB helpers, and packaging patterns |
+
+## Metadata
+
+- `package_name`: `spaps-server-quickstart`
+- `latest_version`: `0.4.0`
+- `minimum_runtime`: `Python >=3.12`
+- `api_base_url`: `https://api.sweetpotato.dev`
+
+## Quick Start
+
+```python
+from fastapi import APIRouter
+
+from spaps_server_quickstart import create_app
+from spaps_server_quickstart.settings import BaseServiceSettings
+
+
+def load_settings() -> BaseServiceSettings:
+    return BaseServiceSettings(env="test", app_name="README Quickstart")
+
+
+router = APIRouter()
+
+
+@router.get("/hello")
+async def hello() -> dict[str, str]:
+    return {"message": "Hello from SPAPS"}
+
+
+app = create_app(settings_loader=load_settings, api_router=router)
+```
+
+## Design Principles
+
+1. Start from a real service baseline, not a toy template.
+2. Keep auth, middleware, and operational guardrails reusable across services.
+3. Prefer explicit service composition through settings loaders and dependency injection.
+4. Keep the local-development path close to production behavior.
+5. Make the happy path easy without hiding the underlying FastAPI and SQLAlchemy primitives.
+
+## What the Package Includes
+
+| Area | Highlights |
+| --- | --- |
+| App lifecycle | `create_app`, startup checks, environment validation, logging |
+| Auth | `SpapsAuthMiddleware`, auth cookies, auth channel service, local auth mode |
+| Routing and RBAC | Base router builder, role helpers, authenticated-user dependencies |
+| Database | Async sessionmaker factory, migration runner, Alembic helpers |
+| Tasks | Celery app factory plus notification and ping task helpers |
+| Service SDK helpers | Admin token cache, server-side SPAPS clients, feature evaluation, trusted-service middleware |
+| Templates | Domain examples, operations bundle, env examples, and local dev helpers |
+
+## Local Development Mode
+
+Set `DEVELOPMENT_ENVIRONMENT=local` to enable the local-auth bypass workflow used in development and tests.
+
+```python
+from spaps_server_quickstart.local_mode import (
+    LocalAuthMiddleware,
+    get_default_registry,
+)
+from spaps_server_quickstart.settings import BaseServiceSettings
+
+settings = BaseServiceSettings(development_environment="local")
+
+if settings.is_local_development:
+    app.add_middleware(LocalAuthMiddleware, registry=get_default_registry())
+```
+
+Default personas:
+
+| Persona | Token | Roles |
+| --- | --- | --- |
+| Admin | `local-admin` | `admin`, `user` |
+| User | `local-user` | `user` |
+
+## Configuration
+
+Key settings exposed through `BaseServiceSettings` and related SPAPS settings:
+
+| Setting | Purpose |
+| --- | --- |
+| `development_environment` | Enables local bypass mode when set to `local` |
+| `spaps_auth_exempt_paths` | Comma-separated paths that skip SPAPS auth |
+| `cors_allow_origins` | Shared CORS configuration |
+| `secure_messages_enabled` | Toggles secure-messaging gateway support |
+| `secure_messages_timeout` | HTTP timeout for secure-messaging calls |
+
+Example environment:
+
+```bash
+DEVELOPMENT_ENVIRONMENT=local
+SPAPS_AUTH_EXEMPT_PATHS=/health,/docs
+CORS_ALLOW_ORIGINS=http://localhost:3000,http://localhost:5173
+```
+
+## Operational Templates
+
+The package ships with templates and scripts for the workflows the real SPAPS services use:
+
+- Docker Compose and reverse-proxy stubs
+- Deploy scripts with preflight and post-deploy checks
+- Database backup, restore, and migration helpers
+- Shared dev DB helpers and local debug-loop support
+- Example domains and tests for bootstrapping new services
+
+## Architecture
+
+```text
+FastAPI service
+  |
+  +--> create_app + settings loader
+  |
+  +--> auth middleware / RBAC / dependencies
+  |
+  +--> async DB session + Alembic helpers
+  |
+  +--> Celery tasks + service SDK helpers
+  |
+  +--> shared operational templates
+          |
+          v
+    SPAPS-aligned production service
+```
+
+## Validation and Development
+
+When working in this repository, the root `Makefile` is the canonical workflow:
+
+```bash
+make install
+make pytest
+make lint
+make typecheck
+make test
+make local-up
+```
+
+Useful additional commands:
+
+```bash
+make pytest-full
+make pytest-cov
+make migrate
+make new-migration MSG="add_example_table"
+```
+
+## Troubleshooting
+
+### `make pytest` reports no affected tests
+
+That is expected when testmon sees no impacted tests. Use `make pytest-full` when you need a full run.
+
+### Local auth bypass is not active
+
+Confirm `DEVELOPMENT_ENVIRONMENT=local` is set before application startup.
+
+### Unauthenticated routes still require auth
+
+Check `spaps_auth_exempt_paths` and make sure the configured paths match the actual router paths.
+
+### Startup fails on environment validation
+
+Review the required settings and any environment-safety checks triggered during startup validation.
+
+### I need a new service quickly
+
+Start from the included templates and keep the repo-root validation path intact while adapting the service-specific settings.
+
+## Limitations
+
+- This package is a scaffold, not a complete application by itself.
+- Downstream services still need their own domain routers, schemas, repositories, and deployment configuration.
+- Some operational templates intentionally require environment-specific edits before production use.
+
+## FAQ
+
+### Is this the active SPAPS backend in this repo?
+
+Yes. This package replaces the old Node/Express stack as the active backend surface.
+
+### Does it include local auth bypass support?
+
+Yes. Set `DEVELOPMENT_ENVIRONMENT=local` and wire in the local-mode helpers.
+
+### Can I use it without Celery?
+
+Yes. Celery helpers are included, but you can compose only the pieces your service needs.
+
+### Does it include RBAC helpers?
+
+Yes. Use `require_roles`, `has_required_roles`, and the authenticated-user dependencies.
+
+### What is the recommended validation path here?
+
+From the repository root: `make pytest`, `make lint`, `make typecheck`, and `make test`.
+
+## About Contributions
+
+> *About Contributions:* Please don't take this the wrong way, but I do not accept outside contributions for any of my projects. I simply don't have the mental bandwidth to review anything, and it's my name on the thing, so I'm responsible for any problems it causes; thus, the risk-reward is highly asymmetric from my perspective. I'd also have to worry about other "stakeholders," which seems unwise for tools I mostly make for myself for free. Feel free to submit issues, and even PRs if you want to illustrate a proposed fix, but know I won't merge them directly. Instead, I'll have Claude or Codex review submissions via `gh` and independently decide whether and how to address them. Bug reports in particular are welcome. Sorry if this offends, but I want to avoid wasted time and hurt feelings. I understand this isn't in sync with the prevailing open-source ethos that seeks community contributions, but it's the only way I can move at this velocity and keep my sanity.
+
+## License
+
+MIT