sweatstack 0.94.0__tar.gz → 0.95.0__tar.gz

{sweatstack-0.94.0 → sweatstack-0.95.0}/CHANGELOG.md

@@ -11,6 +11,83 @@ for a coding agent, are in `UPGRADING.md` next to this file and at
 https://docs.sweatstack.no/learn/python/upgrading/.
 
 
+## [0.95.0] - 2026-10-13
+
+Scopes are categories now. Request what your app uses. Breaking: the default scopes change
+without an error, and the metabolic map and capability names move; see **Upgrading** below, or
+hand the migration prompt to your coding agent.
+
+### Changed
+
+- The default scope of `Client.login()`, `client.oauth.authorization_url()`, the FastAPI plugin and
+  the Streamlit helper is one constant, `sweatstack.constants.DEFAULT_SCOPE`:
+  `openid profile email activities:read offline_access`. Add `wellness:read`,
+  `reproductive_health:read`, `workouts:write` or `sharing:read` when your app uses them.
+- `client.teams.authorize()` grants `activities:read` by default; only the delegable scopes are
+  ever granted.
+- `client.oauth.userinfo()` needs the `openid` scope; the name claims need `profile`, the email
+  needs `email`.
+- `client.profile.status()` needs no scope.
+- `Application.default_scopes` and `Application.purposes` replace `capabilities` on
+  `client.applications` (the old field is still accepted and translated).
+- The metabolic map responses are the markers themselves: no `inputs`, no `markers` wrapper; the
+  VO2 map has `vo2max_relative`.
+- The `dailies` capability and its issue codes are `wellness`, `wellness_not_granted` and
+  `wellness_no_source`.
+
+### Added
+
+- `sweatstack.__version__` is the installed version.
+
+### Fixed
+
+- Token calls from the FastAPI and Streamlit integrations (login, refresh and delegated tokens)
+  now send the `python-sweatstack/<version>` User-Agent, like every other request the SDK
+  makes. Before, they identified themselves as plain httpx.
+
+<!-- --8<-- [start:upgrading-0-95] -->
+### Upgrading
+
+| 0.94 | 0.95 |
+|---|---|
+| `scope="data:read data:write profile offline_access"`, or no `scope=` at all | **Silent:** the default is `DEFAULT_SCOPE` (`openid profile email activities:read offline_access`). Add the categories you use: `wellness`, `reproductive_health`, `workouts` and `sharing`, each as `:read` or `:write` |
+| `Scope.data_read` in `teams.authorize(scopes=...)`, or no `scopes=` | **Silent:** `"activities:read"` is the default, and only the delegable categories are granted; anything else is dropped |
+| `userinfo()` with `profile` | `userinfo()` with `openid profile email`; without `openid` it raises `SweatStackAuthError` |
+| `response.markers.fatmax` on a metabolic map | `response.fatmax` |
+| `response.inputs.body_mass` on a metabolic map | not published; `response.vo2max_relative` on the VO2 map |
+| `status.capabilities["dailies"]` | `status.capabilities["wellness"]` |
+
+An app registered before the platform release keeps working with `data:read` and `data:write`
+for six months; see the platform changelog.
+
+**Migration prompt.** Paste this into your coding agent:
+
+```text
+Upgrade this codebase to sweatstack 0.95, which replaces the data:read and data:write scope
+bundles with per-category scopes. The upgrade table is the "Upgrading" section of the 0.95.0
+entry in https://github.com/SweatStack/sweatstack-python/blob/main/CHANGELOG.md
+(also at https://docs.sweatstack.no/learn/python/upgrading/). Read it first.
+
+Find every place the app requests or grants scopes (Client.login(), oauth.authorization_url(),
+sweatstack.fastapi.configure(scopes=...), StreamlitAuth(scopes=...) and SWEATSTACK_SCOPES,
+teams.authorize(scopes=...)) and:
+
+1. Replace data:read and data:write with the categories the app uses: activities, wellness,
+   reproductive_health, workouts and sharing, each as :read or :write. Start from
+   sweatstack.constants.DEFAULT_SCOPE (openid profile email activities:read offline_access)
+   and add to it. Do not keep the old bundles.
+2. Where the app calls userinfo(), request openid, plus profile and email for the claims it
+   shows.
+3. On the metabolic maps, read response.<marker> instead of response.markers.<marker>, drop
+   any use of response.inputs, and read status.capabilities["wellness"] where the app read
+   ["dailies"].
+
+Then run the code and the tests. A category the app forgot surfaces as SweatStackAuthError
+on the first call that needs it; add that category, not a bundle.
+```
+<!-- --8<-- [end:upgrading-0-95] -->
+
+
 ## [0.94.0] - 2026-10-12
 
 A client's tokens come from one source. Upgrade every app that other people sign in to.

{sweatstack-0.94.0 → sweatstack-0.95.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: sweatstack
-Version: 0.94.0
+Version: 0.95.0
 Summary: The official Python client for SweatStack
 Project-URL: Homepage, https://sweatstack.no
 Project-URL: Documentation, https://docs.sweatstack.no/learn/python/

sweatstack-0.95.0/plans/011_user_agent_on_every_request.md

@@ -0,0 +1,228 @@
+# Plan 011: Every request the SDK makes carries its User-Agent
+
+Requests made through `Client` identify themselves as `python-sweatstack/<version>`. The four
+token calls in the FastAPI and Streamlit integrations do not: each is a bare `httpx.post`, so it
+goes out as `python-httpx/<version>`, the library default. Seen from the server, an integrator's
+logins, refreshes and delegations look like an unknown httpx script, not like the SDK at a known
+version. That makes three things harder than they should be: telling an integrator which SDK
+version they run, tying a token-endpoint failure to an SDK release, and knowing when an old
+release has stopped being used.
+
+The fix is one constant, one function and one guard. **Constant:** the header string has one
+home, next to `__version__`. **Function:** every request that does not go through the client's
+pool goes through `_transport.post`, which adds the header. **Guard:** a test fails on any
+request made with `httpx` directly from anywhere else, so the next bare call is caught at
+`make check`, not in the server's logs.
+
+Proposed 2026-10-13. Ships in the next release, under *Fixed*, next to the scope work already under
+`[Unreleased]`; no public surface changes.
+
+> **Public repository.** This file is published with the code. It describes the SDK by its own
+> source and the server by its public contract. It cites no app, no version in use, no counts
+> and no time window from server logs; those are customer behaviour and stay out (AGENTS.md,
+> "Public repository").
+
+
+## As built (2026-10-13)
+
+Sections 2 to 5 shipped as designed, with three refinements:
+
+- **`__version__` is public at the package root.** `client.py` no longer defines or imports
+  it; `sweatstack.__version__` re-exports it from `constants.py`, which is where Python users
+  look for it. Nothing in the repository read it from `client.py`. Listed under *Added*.
+- **The guard also catches `from httpx import post`.** D5 named attribute calls only; the test
+  flags a `from httpx import ...` of any request-making name too, so the rule cannot be dodged
+  by changing the import style.
+- **The callback test runs the real route.** It mounts the router with `instrument`, sets the
+  state cookie that `create_state` mints and follows the handler through to the session
+  redirect, so a change to the state check or the exchange would surface here.
+
+
+## 1. The problem, verified
+
+### 1.1 What the header is for
+
+The server reads `User-Agent` to attribute traffic to an SDK release. The client has sent
+`python-sweatstack/<version>` since the pooled connection landed; every call that goes through
+`Client._request` carries it, including the client's own token exchange and refresh. The value
+comes from `importlib.metadata.version("sweatstack")`, with `"unknown"` as the fallback when
+the package is not installed.
+
+### 1.2 Where it is missing
+
+On `main` at 0.94.0, four requests bypass the pool. Each is a bare `httpx.post` with no
+`User-Agent`:
+
+| Call site | Endpoint | When it runs |
+|---|---|---|
+| `fastapi/dependencies.py`, `_refresh_access_token` | `POST /api/v1/oauth/token` (`refresh_token`) | Every request whose session token is about to expire |
+| `fastapi/routes.py`, the `/callback` route | `POST /api/v1/oauth/token` (`authorization_code`) | Every login |
+| `fastapi/routes.py`, `_fetch_delegated_token` | `POST /api/v1/oauth/delegated-token` | Switching to a delegated user |
+| `streamlit.py`, `StreamlitAuth._exchange_token` | `POST /api/v1/oauth/token` (`authorization_code`) | Every login |
+
+The refresh is by far the most frequent of the four: a long-running app makes one per session
+per token lifetime, which is why token traffic from the integrations is mostly anonymous today.
+
+Nothing else is affected. `client.py` builds exactly one `httpx.Client`, the pool, with the
+header set. `cli.py` fetches a local `openapi.json` with `httpx.get`; that is a developer tool
+and stays as it is. No other HTTP library is used anywhere in `src/`.
+
+### 1.3 How it got this way
+
+Release 0.65.0 had the same defect inside `Client`: a bare `httpx.post` for the token exchange
+next to a pooled client that did carry the header. The pool refactor fixed it for `Client` by
+routing the exchange through `_http_client`. The integrations were never followed up. Plan 010
+noted the Streamlit exchange as "not folded in" and left it for later; this is later.
+
+The header string is also written out twice in `client.py`, once for the pool and once in
+`_http_client`. Two copies today, no shared one, and `__version__` lives in `client.py`, which
+is the wrong place for the integrations to import from.
+
+
+## 2. Design
+
+Five decisions. Each names the alternative it rejects.
+
+**D1. One constant, one home.** `constants.py` gains
+
+```python
+from importlib.metadata import PackageNotFoundError, version
+
+try:
+    __version__ = version("sweatstack")
+except PackageNotFoundError:
+    __version__ = "unknown"
+
+USER_AGENT = f"python-sweatstack/{__version__}"
+```
+
+and `client.py` imports both names from there, so `sweatstack.client.__version__` keeps
+working. `constants.py` imports nothing from the package and every call-site module already
+imports it, so there is no cycle to manage. *Rejected:* a new `_version.py` module. One more
+file for one line, and `constants.py` is already the home for values every entry point shares.
+
+**D2. One function for requests outside the pool.** `_transport.py` gains
+
+```python
+def post(url: str, **kwargs: Any) -> httpx.Response:
+    """``httpx.post`` with the SDK's ``User-Agent``; the caller's headers win on a clash."""
+    headers = httpx.Headers({"User-Agent": USER_AGENT})
+    headers.update(kwargs.pop("headers", None) or {})
+    return httpx.post(url, headers=headers, **kwargs)
+```
+
+It adds the header and nothing else. No retry (`POST` is never retried; see
+`RETRYABLE_METHODS`), no error translation, no timeout. The four sites keep their own error
+handling and timeouts exactly as they are. *Rejected:* passing `headers={"User-Agent": ...}` at
+each site. It works, but then the guard has to prove that every multi-line call passes the
+header, which a test cannot do reliably. With a function, the guard is one rule: nobody but
+the transport talks to `httpx`.
+
+**D3. The integrations stay stateless.** They do not acquire a `Client` to make the call. They
+are deliberately thin helpers over the token endpoint, with no token pair of their own to
+manage, and a `Client` would bring the refresh lock and credential resolution of plan 010 into
+code paths that must not have them. *Rejected:* `Client(auth=False)._request(...)`; a bigger
+change than the header needs, and it pulls a user-facing object into a server hot path.
+
+**D4. The value stays `python-sweatstack/<version>`.** Identical to what the client sends, so
+the server sees one SDK, not two. *Rejected:* appending `python-httpx/<version>` or a runtime
+description, as some SDKs do. Nothing on the server reads it, and it would make the two paths
+disagree.
+
+**D5. The guard is an AST test, not a grep.** It parses every module under `src/sweatstack/`
+and fails on a call to `httpx.get`, `post`, `put`, `patch`, `delete`, `request`, `stream`,
+`Client` or `AsyncClient` outside an allow-list of three: `_transport.py` (the function above),
+`client.py` (the pool) and `cli.py` (the developer tool). *Rejected:* the regex in the first
+draft of this plan. A regex matches text, not calls, and cannot see across the lines of a call
+to check what it passes.
+
+
+## 3. Change
+
+Seven files, all small. Order matters only for the first two.
+
+1. **`constants.py`**: add `__version__` and `USER_AGENT` as in D1.
+2. **`client.py`**: drop the local `__version__` block and the `importlib.metadata` import;
+   `from .constants import DEFAULT_SCOPE, DEFAULT_URL, USER_AGENT, __version__`. Replace both
+   header literals (the pool and `_http_client`) with `USER_AGENT`.
+3. **`_transport.py`**: add `post` as in D2, importing `USER_AGENT` from `constants`.
+4. **`fastapi/dependencies.py`**: `httpx.post(...)` in `_refresh_access_token` becomes
+   `_transport.post(...)`, same arguments. The `timeout=REFRESH_HTTP_TIMEOUT` stays.
+5. **`fastapi/routes.py`**: the same substitution in the `/callback` route and in
+   `_fetch_delegated_token`. The latter keeps its `Authorization` header; the function merges it
+   under the SDK header. Both keep their `httpx.HTTPError` handling, which still applies since
+   the function raises what `httpx.post` raises. The `import httpx` stays, for the exception
+   type.
+6. **`streamlit.py`**: the same substitution in `_exchange_token`, keeping `auth=` and `data=`.
+   The `import httpx` stays, for `httpx.BasicAuth`.
+7. **`CHANGELOG.md`**: see section 5.
+
+Nothing in the body, auth, timeout or error path of any of the four calls changes. A diff of
+each site is one token: `httpx.post` to `_transport.post`, plus the import.
+
+
+## 4. Tests
+
+All offline, all under `tests/`. `make check` must pass with no silenced findings.
+
+**The function** (`tests/test_transport.py`, where the HTTP layer is tested):
+
+- `post` sends `User-Agent: python-sweatstack/<version>` and passes the URL and keyword
+  arguments through unchanged.
+- A caller's `Authorization` header survives the merge.
+- A caller's own `User-Agent` wins, so the merge rule in the docstring is true.
+
+**The guard** (`tests/test_transport.py`): the AST walk of D5. It fails with the file, line and
+call that broke the rule, so the fix is obvious from the message.
+
+**The four call sites** (new `tests/test_user_agent.py`): one test each, patching
+`httpx.post` and asserting the request's `User-Agent` equals `constants.USER_AGENT` and that
+what the site sent before is still sent (grant type, code, credentials, bearer).
+
+- `_refresh_access_token` is a function; call it directly.
+- `_fetch_delegated_token` is a function; call it directly and also assert the bearer is
+  still on the request.
+- The `/callback` route runs through `fastapi.testclient.TestClient` on an app configured as
+  in `tests/test_access_token_cache.py`, with a `state` query parameter that matches the state
+  cookie, so the handler reaches the exchange.
+- `StreamlitAuth._exchange_token` runs with the session fixtures from
+  `tests/test_streamlit_auth.py`.
+
+Patching `httpx.post` rather than injecting `httpx.MockTransport` is deliberate: a module-level
+`httpx.post` builds its own client and accepts no transport, and the function keeps that shape
+on purpose (D2).
+
+**Done when:**
+
+- The four tests above and the three function tests pass.
+- The guard passes on `main` plus this change, and fails when a bare `httpx.post` is put back
+  into any of the four sites.
+- `grep -rn "python-sweatstack/" src/` finds exactly one line, in `constants.py`.
+
+
+## 5. Release
+
+Part of the next release, with the scope work already under `[Unreleased]`. Add there:
+
+> ### Fixed
+> - Token calls from the FastAPI and Streamlit integrations (login, refresh and delegated
+>   tokens) now send the `python-sweatstack/<version>` User-Agent, like every other request
+>   the SDK makes. Before, they identified themselves as plain httpx.
+
+Not breaking: no name, parameter or behaviour visible to a caller changes, so there is no
+*Upgrading* section and nothing for `_renames`. The skill in `skills/sweatstack-python/` and the
+docs describe the public surface, which is unchanged, so neither moves.
+
+
+## 6. Seen while looking, left alone
+
+Three things this plan does not change. Each would be its own decision.
+
+- **`cli.py`** keeps its bare `httpx.get`. It talks to a developer's local server and is
+  allow-listed by the guard with a comment saying why.
+- **Timeouts differ across the four sites.** The refresh passes `REFRESH_HTTP_TIMEOUT`; the two
+  logins and the delegation use httpx's default. Whether the three should share a constant is a
+  reliability question, not a header question.
+- **Error handling differs across the four sites.** One calls `raise_for_status`, one
+  translates to the SDK's exceptions, one redirects with an error code, one raises
+  `SweatStackAuthError`. Each is right for its caller; unifying them is not this plan's job.

{sweatstack-0.94.0 → sweatstack-0.95.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "sweatstack"
-version = "0.94.0"
+version = "0.95.0"
 description = "The official Python client for SweatStack"
 readme = "README.md"
 license = "MIT"

{sweatstack-0.94.0 → sweatstack-0.95.0}/skills/sweatstack-python/api.md

@@ -105,7 +105,7 @@ client.whoami()                                               # the user this cl
 ```python
 client.portal.sessions.create("manage-integrations", return_url=None)  # user token; mint on click, never store
 
-client.oauth.userinfo()                 # OpenID claims + issue (needs the profile scope)
+client.oauth.userinfo()                 # OpenID claims + issue (needs openid; profile and email add the name and email claims)
 verifier, challenge = client.oauth.generate_pkce_params()
 client.oauth.authorization_url(client_id="YOUR_CLIENT_ID", redirect_uri="http://localhost:8000/callback", code_challenge=challenge)
 client.oauth.exchange_code("code", client_id="YOUR_CLIENT_ID", code_verifier=verifier)  # persist=True saves on this machine; never in a server

{sweatstack-0.94.0 → sweatstack-0.95.0}/skills/sweatstack-python/data-models.md

@@ -29,7 +29,7 @@ taxonomy is preserved (`is_standard` is `False`) instead of failing.
 - `Metric`: data streams such as `power`, `speed`, `heart_rate`, `cadence`, `altitude`,
   `distance`, `temperature`, `core_temperature`, `smo2`, `lactate`, `rpe`. `metric.display_name()`
   gives a readable form. Open set: unknown values from a newer server still parse.
-- `Scope`: `Scope.data_read` (`"data:read"`), `data_write`, `profile`, `openid`, `offline_access`, `admin`. Open set.
+- `Scope`: `Scope.activities_read` (`"activities:read"`), `activities_write`, `wellness_read`, `wellness_write`, `reproductive_health_read`, `reproductive_health_write`, `workouts_read`, `workouts_write`, `sharing_read`, `sharing_write`, `openid`, `profile`, `email`, `offline_access`, `admin`; `data_read` and `data_write` are the retired bundles. Open set.
 - `DailyMeasure`: `body_mass`, `body_fat_pct`, `resting_hr`, `hrv`, `sleep_duration`,
   `sleep_altitude`, `menstrual_cycle_day`. Open set.
 

{sweatstack-0.94.0 → sweatstack-0.95.0}/skills/sweatstack-python/fastapi.md

@@ -50,7 +50,7 @@ configure(
     client_secret: str = None,                # SWEATSTACK_CLIENT_SECRET
     app_url: str = None,                      # APP_URL
     session_secret: str = None,               # SWEATSTACK_SESSION_SECRET (Fernet key)
-    scopes: list[str] = ["profile", "data:read"],
+    scopes: list[str] = DEFAULT_SCOPE.split(),  # openid profile email activities:read offline_access
     cookie_secure: bool = None,               # auto-detected from app_url scheme
     cookie_max_age: int = 86400,              # session lifetime in seconds
     auth_route_prefix: str = "/auth/sweatstack",

{sweatstack-0.94.0 → sweatstack-0.95.0}/skills/sweatstack-python/streamlit.md

@@ -49,7 +49,7 @@ st.dataframe(auth.client.activities.list(output="pandas"))  # st.dataframe also
 | `SWEATSTACK_CLIENT_ID` | OAuth client ID |
 | `SWEATSTACK_CLIENT_SECRET` | OAuth client secret |
 | `SWEATSTACK_REDIRECT_URI` | OAuth callback URI |
-| `SWEATSTACK_SCOPES` | Comma-separated scopes (default: `data:read,profile`) |
+| `SWEATSTACK_SCOPES` | Comma-separated scopes (default: `sweatstack.constants.DEFAULT_SCOPE`, i.e. `openid,profile,email,activities:read,offline_access`) |
 
 ## Selector Components
 
@@ -115,7 +115,7 @@ activities = auth.client.activities.list()
 - **Never cache `auth` or `auth.client` across sessions** (`st.cache_resource`, module globals): they hold one user's tokens. Build them at the top of every run.
 - **Session state keys:** `sweatstack_api_key`, `sweatstack_refresh_token`, and in proxy mode `sweatstack_proxy_api_key`, `sweatstack_proxy_refresh_token`. Don't overwrite these; `auth.client` keeps a renewed token there.
 - **`select_user()` replaces `auth.client`** with a client delegated to the selected user (its own access and refresh token). Call `auth.switch_to_principal_user()` to go back.
-- **Scopes default to `data:read,profile`** in Streamlit — not the broader set used by `Client.authenticate()`. Add `offline_access` if you need refresh tokens in direct OAuth mode.
+- **Scopes default to `DEFAULT_SCOPE`** (`openid profile email activities:read offline_access`), the same set as `Client.authenticate()` and the FastAPI plugin. Add `wellness:read`, `reproductive_health:read`, `workouts:write` or `sharing:read` when the app uses them.
 
 ## Account Status and the Portal
 

{sweatstack-0.94.0 → sweatstack-0.95.0}/src/sweatstack/__init__.py

@@ -1,6 +1,7 @@
 from . import _renames
 from .client import *  # noqa: F403
 from .client import __all__ as _client_all
+from .constants import __version__ as __version__
 from .exceptions import (
     SweatStackAPIError,
     SweatStackAuthError,

{sweatstack-0.94.0 → sweatstack-0.95.0}/src/sweatstack/_transport.py

@@ -3,6 +3,11 @@
 The policy follows the OpenAI, Anthropic and Stripe clients, with one difference: ``POST`` is
 never retried, because the SweatStack API has no idempotency keys and a retried create could
 create twice.
+
+This module is also the only place in the package that calls ``httpx`` to make a request:
+through a client's pool, or through :func:`post` for the token calls the FastAPI and Streamlit
+integrations make without a client. Both put the SDK's ``User-Agent`` on the wire, and
+``tests/test_transport.py`` fails on a request made from anywhere else.
 """
 
 from __future__ import annotations
@@ -14,6 +19,8 @@ from typing import Any
 
 import httpx
 
+from .constants import USER_AGENT
+
 RETRY_STATUSES = frozenset({408, 429, 500, 502, 503, 504})
 """Statuses worth retrying: timeouts, rate limits and transient server errors."""
 
@@ -73,6 +80,18 @@ def wait_before_retry(
     return wait
 
 
+def post(url: str, **kwargs: Any) -> httpx.Response:
+    """``httpx.post`` with the SDK's ``User-Agent``; the caller's headers win on a clash.
+
+    For the one-off token calls the integrations make without a ``Client``. It adds the header
+    and nothing else: no retry (a ``POST`` is never retried), no error translation and no
+    timeout, so each caller keeps its own.
+    """
+    headers = httpx.Headers({"User-Agent": USER_AGENT})
+    headers.update(kwargs.pop("headers", None) or {})
+    return httpx.post(url, headers=headers, **kwargs)
+
+
 class Session:
     """One request scope on the client's shared connection pool, with its own headers.
 

{sweatstack-0.94.0 → sweatstack-0.95.0}/src/sweatstack/client.py

@@ -15,7 +15,6 @@ from datetime import date, datetime
 from enum import Enum
 from functools import cached_property, wraps
 from http.server import BaseHTTPRequestHandler, HTTPServer
-from importlib.metadata import version
 from inspect import getmembers, isfunction
 from pathlib import Path
 from typing import Any, Literal
@@ -27,7 +26,7 @@ from pydantic import SecretStr
 
 from . import _frames, _renames, _transport
 from ._frames import FrameOutput, set_output
-from .constants import DEFAULT_URL
+from .constants import DEFAULT_SCOPE, DEFAULT_URL, USER_AGENT
 from .exceptions import (
     SweatStackAPIError,
     SweatStackAuthError,
@@ -121,11 +120,6 @@ AUTH_SUCCESSFUL_RESPONSE = """<!DOCTYPE html>
 </html>"""
 OAUTH2_CLIENT_ID = "5382f68b0d254378"
 
-try:
-    __version__ = version("sweatstack")
-except ImportError:
-    __version__ = "unknown"
-
 
 def _to_secret(value: str | SecretStr | None) -> SecretStr | None:
     """Convert a string to SecretStr, or return None if value is None."""
@@ -647,7 +641,7 @@ class Client:
             client_id=OAUTH2_CLIENT_ID,
             redirect_uri=f"http://localhost:{port}",
             code_challenge=code_challenge,
-            scope="data:read data:write profile offline_access",
+            scope=DEFAULT_SCOPE,
             prompt=None,
         )
 
@@ -894,7 +888,7 @@ class Client:
             return built[1]
         pool = httpx.Client(
             base_url=url,
-            headers={"User-Agent": f"python-sweatstack/{__version__}"},
+            headers={"User-Agent": USER_AGENT},
             timeout=self.timeout,
         )
         self.__dict__["_pool_entry"] = (url, pool)
@@ -918,7 +912,7 @@ class Client:
                 For the token exchange, which authenticates with the app's own credentials in
                 the body, so a user's bearer is never sent where it is not needed.
         """
-        headers = httpx.Headers({"User-Agent": f"python-sweatstack/{__version__}"})
+        headers = httpx.Headers({"User-Agent": USER_AGENT})
         if not auth:
             token = None
         elif skip_token_check:

sweatstack-0.95.0/src/sweatstack/constants.py

@@ -0,0 +1,19 @@
+from importlib.metadata import PackageNotFoundError, version
+
+DEFAULT_URL = "https://app.sweatstack.no"
+
+try:
+    __version__ = version("sweatstack")
+except PackageNotFoundError:
+    __version__ = "unknown"
+
+# What every request the SDK makes says it is, from the connection pool and from the token
+# calls the integrations make outside it (``_transport.post``). One definition, so the server
+# sees one SDK at one version wherever a request comes from.
+USER_AGENT = f"python-sweatstack/{__version__}"
+
+# The scopes the quickstart asks for: sign in, see the name and email, read activities, keep
+# access. One constant for every entry point that carries a default, so they cannot drift.
+# Wellness, reproductive health, writes and sharing are choices to type. Declared ``str`` so
+# that ``DEFAULT_SCOPE.split()`` is a ``list[str]`` and not a ``list[LiteralString]``.
+DEFAULT_SCOPE: str = "openid profile email activities:read offline_access"

{sweatstack-0.94.0 → sweatstack-0.95.0}/src/sweatstack/fastapi/config.py

@@ -11,6 +11,7 @@ from urllib.parse import quote
 from cryptography.fernet import Fernet
 from pydantic import SecretStr
 
+from ..constants import DEFAULT_SCOPE
 from .access_token_cache import AccessTokenCache, InMemoryAccessTokenCache
 
 if TYPE_CHECKING:
@@ -89,7 +90,7 @@ def configure(
         session_secret: Fernet key(s) for cookie encryption. Can be a single key
             or a list of keys for key rotation (first encrypts, all decrypt).
             Falls back to SWEATSTACK_SESSION_SECRET env var.
-        scopes: OAuth scopes to request. Defaults to ["profile", "data:read"].
+        scopes: OAuth scopes to request. Defaults to ``DEFAULT_SCOPE`` split on spaces.
         cookie_secure: Whether to set the Secure flag on cookies. If not specified,
             auto-detected from app_url (True for https, False for http).
         cookie_max_age: Session cookie lifetime in seconds. Defaults to 86400 (24h).
@@ -151,7 +152,7 @@ def configure(
         session_secret_obj = [_to_secret(s) for s in session_secret]
 
     if scopes is None:
-        scopes = ["profile", "data:read"]
+        scopes = DEFAULT_SCOPE.split()
 
     # Normalize prefix (strip trailing slash)
     auth_route_prefix = auth_route_prefix.rstrip("/")

{sweatstack-0.94.0 → sweatstack-0.95.0}/src/sweatstack/fastapi/dependencies.py

@@ -13,6 +13,7 @@ from urllib.parse import quote
 import httpx
 from fastapi import Depends, HTTPException, Request, Response
 
+from .. import _transport
 from ..client import Client
 from ..constants import DEFAULT_URL
 from ..utils import decode_jwt_body
@@ -122,7 +123,7 @@ def _refresh_access_token(
     on ``/oauth/token``; the tuple shape exists so that a future
     server change is handled transparently.
     """
-    response = httpx.post(
+    response = _transport.post(
         f"{DEFAULT_URL}/api/v1/oauth/token",
         data={
             "grant_type": "refresh_token",

{sweatstack-0.94.0 → sweatstack-0.95.0}/src/sweatstack/fastapi/routes.py

@@ -12,6 +12,7 @@ import httpx
 from fastapi import APIRouter, FastAPI, HTTPException, Request, Response
 from fastapi.responses import RedirectResponse
 
+from .. import _transport
 from ..constants import DEFAULT_URL
 from ..exceptions import SweatStackAPIError, SweatStackConnectionError
 from ..utils import decode_jwt_body
@@ -101,7 +102,7 @@ def _fetch_delegated_token(
         body["team_id"] = team_id
 
     try:
-        response = httpx.post(
+        response = _transport.post(
             f"{DEFAULT_URL}/api/v1/oauth/delegated-token",
             headers={"Authorization": f"Bearer {principal_tokens.access_token}"},
             json=body,
@@ -211,7 +212,7 @@ def create_router() -> APIRouter:
             return error_redirect("missing_code")
 
         try:
-            token_response = httpx.post(
+            token_response = _transport.post(
                 f"{DEFAULT_URL}/api/v1/oauth/token",
                 data={
                     "grant_type": "authorization_code",