sweatstack 0.96.0__tar.gz → 0.98.0__tar.gz

{sweatstack-0.96.0 → sweatstack-0.98.0}/.github/workflows/ci.yml

@@ -12,7 +12,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        python: ["3.10", "3.11", "3.12", "3.13"]
+        python: ["3.11", "3.12", "3.13"]
         include:
           # The lock file tracks the newest pandas; this leg keeps the declared
           # lower bound (pyproject `pandas>=2.2.3`) honest.

{sweatstack-0.96.0 → sweatstack-0.98.0}/AGENTS.md

@@ -87,7 +87,7 @@ src/sweatstack/
 ├── _frames.py           # output= backends: parquet/models -> pandas/polars/arrow/bytes.
 ├── _renames.py          # Removed names -> replacement hints. Permanent; see "Breaking changes".
 ├── _transport.py        # Retry policy and the per-request Session on the client's connection pool.
-├── exceptions.py        # Public error contract. No httpx types leak.
+├── exceptions.py        # Public error contract. No HTTP-library types leak.
 ├── client.py            # Client: config, auth, delegation, transport (_request), resource attributes,
 │                        #   and the module-level interface (one shared default client).
 ├── resources/           # One module per URL segment: activities.py, traces.py, tests.py, ...
@@ -137,7 +137,7 @@ it automatically.
 - **Enum-typed params accept `Enum | str`** and route through
   `_enums_to_strings`. Don't introduce strict-enum-only parameters.
 - **Open enums stay open.** When the server documents an enum as an open
-  set (metrics, scopes, daily measures, status codes, capabilities),
+  set (metrics, scopes, daily measures, sources, status codes, capabilities),
   register it with `_open_enum(...)` in `schemas.py` so unknown values
   parse as pseudo-members. Leave closed sets strict.
 - **Never retry a request the server can't safely repeat.** `_transport.RETRYABLE_METHODS`
@@ -233,8 +233,8 @@ Both kinds take `output` as a keyword-only parameter and carry `@overload` stubs
 `Literal` values (clone the neighbours); `tests/typing/output_types.py` pins them.
 
 **Query parameters** are only sent when the caller supplied a non-default value. Repeatable
-ones go through `self._wire(value)` (R8). Always pass `.value` for enums into `httpx` params:
-`httpx` calls `str()`, which gives `"TraceResolution.linked"`, not `"linked"`.
+ones go through `self._wire(value)` (R8). Always pass `.value` for enums into `httpx2` params:
+`httpx2` calls `str()`, which gives `"TraceResolution.linked"`, not `"linked"`.
 
 
 ## Full-replace `replace` methods
@@ -309,7 +309,7 @@ construct fails the suite, not a user's notebook.
 ## Exceptions
 
 The hierarchy in `sweatstack/exceptions.py` is the **public** error
-contract — consumers should never need to import `httpx`.
+contract — consumers should never need to import `httpx2`.
 
 ```
 SweatStackError

{sweatstack-0.96.0 → sweatstack-0.98.0}/CHANGELOG.md

@@ -11,6 +11,52 @@ for a coding agent, are in `UPGRADING.md` next to this file and at
 https://docs.sweatstack.no/learn/python/upgrading/.
 
 
+## [0.98.0] - 2026-10-30
+
+### Added
+
+- `SWEATSTACK_CLIENT_ID` and `SWEATSTACK_CLIENT_SECRET` name the app that issued
+  `SWEATSTACK_API_KEY` and `SWEATSTACK_REFRESH_TOKEN`, so a client that takes its tokens from the
+  environment renews them with that app. Before, it renewed with the SDK's own client, which
+  SweatStack refuses for a token issued to another app: tokens your app hands to a notebook, a
+  job or a sandbox stopped working once the access token expired. Set the secret only if your app
+  exchanged the sign-in code with it. The variables never apply to tokens saved by
+  `authenticate()` or passed to `Client`, and `client_id=` and `client_secret=` given to `Client`
+  always win.
+
+### Changed
+
+- If your environment sets `SWEATSTACK_CLIENT_ID` for the Streamlit or FastAPI helper and also
+  holds a `SWEATSTACK_REFRESH_TOKEN` that `authenticate()` issued, a plain `Client()` there now
+  renews that token with your app, which SweatStack refuses: the renewal fails once the access
+  token expires, with an error that says why. Unset `SWEATSTACK_CLIENT_ID` and
+  `SWEATSTACK_CLIENT_SECRET` for that process, or pass them to the helper as `client_id=` and
+  `client_secret=` instead.
+- `DailySource` is an open enum, like `Metric` and `DailyMeasure`: a `source` this version does
+  not know (on a daily, a marker or a max effort) becomes a `DailySource` with that value instead
+  of failing the whole response, so a new source on SweatStack never breaks this version.
+
+### Fixed
+
+- Polars output works in the browser (Pyodide, as in JupyterLite). Pyodide's Polars has no
+  Parquet reader, so every time series and mean-max call raised an `AttributeError`; the client
+  now reads through pyarrow there, and `sweatstack[polars]` installs pyarrow on Pyodide.
+
+
+## [0.97.0] - 2026-10-22
+
+### Changed
+
+- Requires Python 3.11 or later. On Python 3.10, pip and uv keep installing 0.96.
+- The SDK sends its requests with [`httpx2`](https://github.com/pydantic/httpx2), the maintained
+  continuation of `httpx`. Calling the SDK is unchanged, and errors are still the `SweatStack*`
+  exceptions.
+- HTTPS certificates are checked against the operating system's trust store instead of the
+  `certifi` bundle that `httpx` shipped. A root certificate installed on the machine, such as a
+  company proxy's, is now trusted. A Linux image without a CA bundle (the `ca-certificates`
+  package) can no longer connect; install it, or point `SSL_CERT_FILE` at a bundle.
+
+
 ## [0.96.0] - 2026-10-16
 
 ### Added

{sweatstack-0.96.0 → sweatstack-0.98.0}/DEVELOPMENT.md

@@ -17,7 +17,7 @@ uv run python -c "..."      # ad-hoc scripts
 uv run generate-response-models   # regenerate OpenAPI schemas (see below)
 ```
 
-Python ≥ 3.10 is supported; develop against the version pinned in
+Python ≥ 3.11 is supported; develop against the version pinned in
 `.python-version`.
 
 

{sweatstack-0.96.0 → sweatstack-0.98.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: sweatstack
-Version: 0.96.0
+Version: 0.98.0
 Summary: The official Python client for SweatStack
 Project-URL: Homepage, https://sweatstack.no
 Project-URL: Documentation, https://docs.sweatstack.no/learn/python/
@@ -16,14 +16,13 @@ Classifier: Development Status :: 4 - Beta
 Classifier: Intended Audience :: Developers
 Classifier: License :: OSI Approved :: MIT License
 Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
-Requires-Python: >=3.10
+Requires-Python: >=3.11
 Requires-Dist: email-validator>=2.2.0
-Requires-Dist: httpx>=0.28.1
+Requires-Dist: httpx2>=2.16.0
 Requires-Dist: open-sport-taxonomy[pydantic]>=0.10.0
 Requires-Dist: platformdirs>=4.0.0
 Requires-Dist: pydantic>=2.10.5
@@ -37,6 +36,7 @@ Requires-Dist: pandas>=2.2.3; extra == 'pandas'
 Requires-Dist: pyarrow>=20.0.0; extra == 'pandas'
 Provides-Extra: polars
 Requires-Dist: polars>=1.30; extra == 'polars'
+Requires-Dist: pyarrow>=20.0.0; (sys_platform == 'emscripten') and extra == 'polars'
 Provides-Extra: streamlit
 Requires-Dist: pandas>=2.2.3; extra == 'streamlit'
 Requires-Dist: pyarrow>=20.0.0; extra == 'streamlit'

{sweatstack-0.96.0 → sweatstack-0.98.0}/examples/send_webhook.py

@@ -1,7 +1,7 @@
 #!/usr/bin/env python3
 # /// script
 # dependencies = [
-#   "httpx",
+#   "httpx2",
 # ]
 # ///
 """
@@ -32,9 +32,9 @@ import hmac
 import json
 import sys
 import time
-from datetime import datetime, timezone
+from datetime import UTC, datetime
 
-import httpx
+import httpx2
 
 
 def create_signature(payload: bytes, secret: str, timestamp: int) -> str:
@@ -55,14 +55,14 @@ def send_webhook(
     resource_id: str,
     secret: str,
     verbose: bool = False,
-) -> httpx.Response:
+) -> httpx2.Response:
     """Send a webhook to the specified URL."""
     # Create payload
     payload = {
         "user_id": user_id,
         "event_type": event_type,
         "resource_id": resource_id,
-        "timestamp": datetime.now(timezone.utc).isoformat(),
+        "timestamp": datetime.now(UTC).isoformat(),
     }
 
     payload_bytes = json.dumps(payload).encode()
@@ -79,7 +79,7 @@ def send_webhook(
         print(f"{'=' * 60}\n")
 
     # Send request
-    response = httpx.post(
+    response = httpx2.post(
         url,
         content=payload_bytes,
         headers={
@@ -176,10 +176,10 @@ Examples:
             if args.verbose and response.headers:
                 print(f"  Response headers: {dict(response.headers)}")
 
-        except httpx.ConnectError:
+        except httpx2.ConnectError:
             print(f"✗ Connection failed - is the server running at {args.url}?")
             sys.exit(1)
-        except httpx.TimeoutException:
+        except httpx2.TimeoutException:
             print("✗ Request timed out")
             sys.exit(1)
         except Exception as e:

{sweatstack-0.96.0 → sweatstack-0.98.0}/pyproject.toml

@@ -1,20 +1,19 @@
 [project]
 name = "sweatstack"
-version = "0.96.0"
+version = "0.98.0"
 description = "The official Python client for SweatStack"
 readme = "README.md"
 license = "MIT"
 authors = [
     { name = "Aart Goossens", email = "aart@sweatstack.no" }
 ]
-requires-python = ">=3.10"
+requires-python = ">=3.11"
 keywords = ["sweatstack", "sports", "fitness", "api", "client"]
 classifiers = [
     "Development Status :: 4 - Beta",
     "Intended Audience :: Developers",
     "License :: OSI Approved :: MIT License",
     "Programming Language :: Python :: 3",
-    "Programming Language :: Python :: 3.10",
     "Programming Language :: Python :: 3.11",
     "Programming Language :: Python :: 3.12",
     "Programming Language :: Python :: 3.13",
@@ -24,7 +23,7 @@ classifiers = [
 # consumers and anyone who only needs the models. CI's bare-install job keeps it so.
 dependencies = [
     "email-validator>=2.2.0",
-    "httpx>=0.28.1",
+    "httpx2>=2.16.0",
     "open-sport-taxonomy[pydantic]>=0.10.0",
     "platformdirs>=4.0.0",
     "pydantic>=2.10.5",
@@ -54,6 +53,8 @@ polars = [
     # >=1.30 verified: reads the server's float16 columns (as Float32 before Float16
     # support landed, as Float16 after; the client casts to Float32 either way).
     "polars>=1.30",
+    # Pyodide's Polars has no Parquet reader; the client reads through pyarrow there.
+    "pyarrow>=20.0.0; sys_platform == 'emscripten'",
 ]
 streamlit = [
     "sweatstack[pandas]",
@@ -91,7 +92,7 @@ evals = [
 
 [tool.ruff]
 line-length = 100
-target-version = "py310"
+target-version = "py311"
 extend-exclude = ["src/sweatstack/openapi_schemas.py"]
 
 [tool.ruff.lint]

{sweatstack-0.96.0 → sweatstack-0.98.0}/skills/sweatstack-python/SKILL.md

@@ -88,7 +88,8 @@ pandas (`summary.power.mean`) and structs in Polars (`.unnest("summary")`).
 ## Authentication
 
 - Scripts and notebooks: `client.authenticate()` (browser once, tokens saved on the machine).
-- Headless: set `SWEATSTACK_API_KEY` (and `SWEATSTACK_REFRESH_TOKEN` for refresh); no
+- Headless: set `SWEATSTACK_API_KEY` (and `SWEATSTACK_REFRESH_TOKEN` for refresh, with
+  `SWEATSTACK_CLIENT_ID` and `SWEATSTACK_CLIENT_SECRET` when your own app issued them); no
   `authenticate()` call.
 - Apps where other people sign in: the Streamlit or FastAPI helper, see
   [streamlit.md](streamlit.md) and [fastapi.md](fastapi.md). In your own server, build one
@@ -98,7 +99,7 @@ pandas (`summary.power.mean`) and structs in Polars (`.unnest("summary")`).
 
 ## Errors
 
-Everything derives from `SweatStackError`; never import `httpx`. `SweatStackAPIError` (has
+Everything derives from `SweatStackError`; never import `httpx2`. `SweatStackAPIError` (has
 `status_code`, `url`, `method`, `request_id`, `body`) splits into `SweatStackAuthError` (401,
 403), `SweatStackNotFoundError` (404), `SweatStackRateLimitError` (429, `retry_after`),
 `SweatStackBadRequestError` (other 4xx) and `SweatStackServerError` (5xx). Also

{sweatstack-0.96.0 → sweatstack-0.98.0}/skills/sweatstack-python/api.md

@@ -124,7 +124,8 @@ GET, PUT and DELETE are retried (connection errors, timeouts, 408, 429, 5xx) up
 `max_retries` times; POST never is. Use `max_retries=0` inside web requests.
 
 The access and refresh token come from one source: the arguments, else `SWEATSTACK_API_KEY`
-and `SWEATSTACK_REFRESH_TOKEN`, else the tokens `authenticate()` saved on this machine. A
+and `SWEATSTACK_REFRESH_TOKEN` (renewed by the app in `SWEATSTACK_CLIENT_ID` and
+`SWEATSTACK_CLIENT_SECRET`, if set), else the tokens `authenticate()` saved on this machine. A
 client given only an access token cannot renew it and raises `SweatStackTokenRefreshError` on
 expiry. In a server, build each user's client from that user's tokens with
 `ambient_credentials=False`: it then never reads or writes the machine's tokens.

{sweatstack-0.96.0 → sweatstack-0.98.0}/skills/sweatstack-python/data-models.md

@@ -48,7 +48,8 @@ taxonomy is preserved (`is_standard` is `False`) instead of failing.
   `end_local`, `results` (`TestResults`: thresholds `lt1`, `lt2`, `vt1`, `vt2`, `mlss`, `fatmax`
   as `Marker`s, plus `vo2max`, `critical_power`, `w_prime`, ...), `tags`, `created_by`;
   `TestDetails` adds the resolved `traces` and overlapping `activities`.
-- **DailyResponse**: `date`, `value`, `status`, `source`.
+- **DailyResponse**: `date`, `value`, `status`, `source` (`DailySource`, an open set: `manual`,
+  `garmin_connect`, ...; markers and max efforts carry it too).
 - **UserSummary** (`users.list()`): `id`, `first_name`, `last_name`, `display_name`, `scopes`,
   `is_managed`.
 - **UserResponse** (`users.create()`, `retrieve()`, `update()`): `id`, `first_name`,

{sweatstack-0.96.0 → sweatstack-0.98.0}/src/sweatstack/_frames.py

@@ -20,9 +20,10 @@ package imports without any of them (enforced by CI's bare-install job).
 from __future__ import annotations
 
 import json
+import sys
 import warnings
 from collections.abc import Sequence
-from datetime import datetime, timezone
+from datetime import UTC, datetime
 from enum import Enum
 from functools import cache
 from importlib import import_module
@@ -185,15 +186,22 @@ def parquet_to_pandas(content: bytes) -> pd.DataFrame:
 
 def parquet_to_polars(content: bytes) -> pl.DataFrame:
     """Parquet bytes to a Polars DataFrame with the wire dtypes, except
-    Float16 -> Float32 (Polars supports few operations on Float16)."""
+    Float16 -> Float32 (Polars supports few operations on Float16).
+
+    In the browser (Pyodide), Polars is built without its Parquet reader, so the bytes go
+    through pyarrow, which Pyodide ships, and ``pl.from_arrow``."""
     pl = require("polars")
 
-    df = pl.read_parquet(BytesIO(content))
+    if sys.platform == "emscripten":
+        df = pl.from_arrow(parquet_to_arrow(content))
+    else:
+        df = pl.read_parquet(BytesIO(content))
+        metadata = pl.read_parquet_metadata(BytesIO(content))
+        df = df.select(_index_columns_first(df.columns, metadata.get("pandas")))
     float16 = getattr(pl, "Float16", None)  # older Polars already reads float16 as Float32
     if float16 is not None:
         df = df.cast({name: pl.Float32 for name, dtype in df.schema.items() if dtype == float16})
-    metadata = pl.read_parquet_metadata(BytesIO(content))
-    return df.select(_index_columns_first(df.columns, metadata.get("pandas")))
+    return df
 
 
 def parquet_to_arrow(content: bytes) -> Any:
@@ -489,7 +497,7 @@ def _plain_value(value: Any, node: FieldType) -> Any:
     if node == "string":
         return value if isinstance(value, str) else str(value)  # Sport and other value objects
     if node == "datetime" and isinstance(value, datetime) and value.tzinfo is None:
-        return value.replace(tzinfo=timezone.utc)  # naive value in a UTC column
+        return value.replace(tzinfo=UTC)  # naive value in a UTC column
     if node == "naive_datetime" and isinstance(value, datetime) and value.tzinfo is not None:
-        return value.astimezone(timezone.utc).replace(tzinfo=None)
+        return value.astimezone(UTC).replace(tzinfo=None)
     return value  # date, timedelta, bool, int, float, datetime already matching

{sweatstack-0.96.0 → sweatstack-0.98.0}/src/sweatstack/_transport.py

@@ -4,7 +4,7 @@ The policy follows the OpenAI, Anthropic and Stripe clients, with one difference
 never retried, because the SweatStack API has no idempotency keys and a retried create could
 create twice.
 
-This module is also the only place in the package that calls ``httpx`` to make a request:
+This module is also the only place in the package that calls ``httpx2`` to make a request:
 through a client's pool, or through :func:`post` for the token calls the FastAPI and Streamlit
 integrations make without a client. Both put the SDK's ``User-Agent`` on the wire, and
 ``tests/test_transport.py`` fails on a request made from anywhere else.
@@ -17,7 +17,7 @@ from collections.abc import Iterator
 from contextlib import contextmanager
 from typing import Any
 
-import httpx
+import httpx2
 
 from .constants import USER_AGENT
 
@@ -42,7 +42,7 @@ def backoff(attempt: int) -> float:
     return min(0.5 * 2**attempt * random.uniform(0.75, 1.25), MAX_BACKOFF)
 
 
-def retry_after(response: httpx.Response) -> float | None:
+def retry_after(response: httpx2.Response) -> float | None:
     """The response's ``Retry-After`` in seconds, if it sent one as a number."""
     try:
         return float(response.headers["retry-after"])
@@ -55,7 +55,7 @@ def wait_before_retry(
     attempt: int,
     max_retries: int,
     waited: float,
-    response: httpx.Response | None = None,
+    response: httpx2.Response | None = None,
 ) -> float | None:
     """How long to wait before retrying, or ``None`` to stop.
 
@@ -80,16 +80,16 @@ def wait_before_retry(
     return wait
 
 
-def post(url: str, **kwargs: Any) -> httpx.Response:
-    """``httpx.post`` with the SDK's ``User-Agent``; the caller's headers win on a clash.
+def post(url: str, **kwargs: Any) -> httpx2.Response:
+    """``httpx2.post`` with the SDK's ``User-Agent``; the caller's headers win on a clash.
 
     For the one-off token calls the integrations make without a ``Client``. It adds the header
     and nothing else: no retry (a ``POST`` is never retried), no error translation and no
     timeout, so each caller keeps its own.
     """
-    headers = httpx.Headers({"User-Agent": USER_AGENT})
+    headers = httpx2.Headers({"User-Agent": USER_AGENT})
     headers.update(kwargs.pop("headers", None) or {})
-    return httpx.post(url, headers=headers, **kwargs)
+    return httpx2.post(url, headers=headers, **kwargs)
 
 
 class Session:
@@ -100,29 +100,29 @@ class Session:
     endpoints must never see it.
     """
 
-    def __init__(self, http: httpx.Client, headers: httpx.Headers, timeout: float) -> None:
+    def __init__(self, http: httpx2.Client, headers: httpx2.Headers, timeout: float) -> None:
         self._http = http
         self.headers = headers
         self._timeout = timeout
 
-    def request(self, method: str, url: str, **kwargs: Any) -> httpx.Response:
+    def request(self, method: str, url: str, **kwargs: Any) -> httpx2.Response:
         return self._http.request(method, url, headers=self.headers, **kwargs)
 
-    def get(self, url: str, **kwargs: Any) -> httpx.Response:
+    def get(self, url: str, **kwargs: Any) -> httpx2.Response:
         return self.request("GET", url, **kwargs)
 
-    def post(self, url: str, **kwargs: Any) -> httpx.Response:
+    def post(self, url: str, **kwargs: Any) -> httpx2.Response:
         return self.request("POST", url, **kwargs)
 
-    def put(self, url: str, **kwargs: Any) -> httpx.Response:
+    def put(self, url: str, **kwargs: Any) -> httpx2.Response:
         return self.request("PUT", url, **kwargs)
 
-    def delete(self, url: str, **kwargs: Any) -> httpx.Response:
+    def delete(self, url: str, **kwargs: Any) -> httpx2.Response:
         return self.request("DELETE", url, **kwargs)
 
     @contextmanager
-    def stream(self, method: str, url: str, **kwargs: Any) -> Iterator[httpx.Response]:
+    def stream(self, method: str, url: str, **kwargs: Any) -> Iterator[httpx2.Response]:
         """A streaming request. No read timeout: a stream may stay quiet for a while."""
-        timeout = httpx.Timeout(self._timeout, read=None)
+        timeout = httpx2.Timeout(self._timeout, read=None)
         with self._http.stream(method, url, headers=self.headers, timeout=timeout, **kwargs) as r:
             yield r

{sweatstack-0.96.0 → sweatstack-0.98.0}/src/sweatstack/cli.py

@@ -2,7 +2,7 @@ import ast
 import re
 from pathlib import Path
 
-import httpx
+import httpx2
 from datamodel_code_generator import DataModelType, InputFileType, generate
 
 
@@ -95,7 +95,7 @@ def _restore_naive_local_datetimes(path: Path) -> None:
 
 
 def generate_response_models():
-    response = httpx.get("http://localhost:8080/openapi.json")
+    response = httpx2.get("http://localhost:8080/openapi.json")
     response.raise_for_status()
     output_directory = Path(__file__).parent
     output = Path(output_directory / "openapi_schemas.py")