sweatstack 0.97.0__tar.gz → 0.98.0__tar.gz

{sweatstack-0.97.0 → sweatstack-0.98.0}/AGENTS.md

@@ -137,7 +137,7 @@ it automatically.
 - **Enum-typed params accept `Enum | str`** and route through
   `_enums_to_strings`. Don't introduce strict-enum-only parameters.
 - **Open enums stay open.** When the server documents an enum as an open
-  set (metrics, scopes, daily measures, status codes, capabilities),
+  set (metrics, scopes, daily measures, sources, status codes, capabilities),
   register it with `_open_enum(...)` in `schemas.py` so unknown values
   parse as pseudo-members. Leave closed sets strict.
 - **Never retry a request the server can't safely repeat.** `_transport.RETRYABLE_METHODS`

{sweatstack-0.97.0 → sweatstack-0.98.0}/CHANGELOG.md

@@ -11,6 +11,38 @@ for a coding agent, are in `UPGRADING.md` next to this file and at
 https://docs.sweatstack.no/learn/python/upgrading/.
 
 
+## [0.98.0] - 2026-10-30
+
+### Added
+
+- `SWEATSTACK_CLIENT_ID` and `SWEATSTACK_CLIENT_SECRET` name the app that issued
+  `SWEATSTACK_API_KEY` and `SWEATSTACK_REFRESH_TOKEN`, so a client that takes its tokens from the
+  environment renews them with that app. Before, it renewed with the SDK's own client, which
+  SweatStack refuses for a token issued to another app: tokens your app hands to a notebook, a
+  job or a sandbox stopped working once the access token expired. Set the secret only if your app
+  exchanged the sign-in code with it. The variables never apply to tokens saved by
+  `authenticate()` or passed to `Client`, and `client_id=` and `client_secret=` given to `Client`
+  always win.
+
+### Changed
+
+- If your environment sets `SWEATSTACK_CLIENT_ID` for the Streamlit or FastAPI helper and also
+  holds a `SWEATSTACK_REFRESH_TOKEN` that `authenticate()` issued, a plain `Client()` there now
+  renews that token with your app, which SweatStack refuses: the renewal fails once the access
+  token expires, with an error that says why. Unset `SWEATSTACK_CLIENT_ID` and
+  `SWEATSTACK_CLIENT_SECRET` for that process, or pass them to the helper as `client_id=` and
+  `client_secret=` instead.
+- `DailySource` is an open enum, like `Metric` and `DailyMeasure`: a `source` this version does
+  not know (on a daily, a marker or a max effort) becomes a `DailySource` with that value instead
+  of failing the whole response, so a new source on SweatStack never breaks this version.
+
+### Fixed
+
+- Polars output works in the browser (Pyodide, as in JupyterLite). Pyodide's Polars has no
+  Parquet reader, so every time series and mean-max call raised an `AttributeError`; the client
+  now reads through pyarrow there, and `sweatstack[polars]` installs pyarrow on Pyodide.
+
+
 ## [0.97.0] - 2026-10-22
 
 ### Changed

{sweatstack-0.97.0 → sweatstack-0.98.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: sweatstack
-Version: 0.97.0
+Version: 0.98.0
 Summary: The official Python client for SweatStack
 Project-URL: Homepage, https://sweatstack.no
 Project-URL: Documentation, https://docs.sweatstack.no/learn/python/
@@ -36,6 +36,7 @@ Requires-Dist: pandas>=2.2.3; extra == 'pandas'
 Requires-Dist: pyarrow>=20.0.0; extra == 'pandas'
 Provides-Extra: polars
 Requires-Dist: polars>=1.30; extra == 'polars'
+Requires-Dist: pyarrow>=20.0.0; (sys_platform == 'emscripten') and extra == 'polars'
 Provides-Extra: streamlit
 Requires-Dist: pandas>=2.2.3; extra == 'streamlit'
 Requires-Dist: pyarrow>=20.0.0; extra == 'streamlit'

{sweatstack-0.97.0 → sweatstack-0.98.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "sweatstack"
-version = "0.97.0"
+version = "0.98.0"
 description = "The official Python client for SweatStack"
 readme = "README.md"
 license = "MIT"
@@ -53,6 +53,8 @@ polars = [
     # >=1.30 verified: reads the server's float16 columns (as Float32 before Float16
     # support landed, as Float16 after; the client casts to Float32 either way).
     "polars>=1.30",
+    # Pyodide's Polars has no Parquet reader; the client reads through pyarrow there.
+    "pyarrow>=20.0.0; sys_platform == 'emscripten'",
 ]
 streamlit = [
     "sweatstack[pandas]",

{sweatstack-0.97.0 → sweatstack-0.98.0}/skills/sweatstack-python/SKILL.md

@@ -88,7 +88,8 @@ pandas (`summary.power.mean`) and structs in Polars (`.unnest("summary")`).
 ## Authentication
 
 - Scripts and notebooks: `client.authenticate()` (browser once, tokens saved on the machine).
-- Headless: set `SWEATSTACK_API_KEY` (and `SWEATSTACK_REFRESH_TOKEN` for refresh); no
+- Headless: set `SWEATSTACK_API_KEY` (and `SWEATSTACK_REFRESH_TOKEN` for refresh, with
+  `SWEATSTACK_CLIENT_ID` and `SWEATSTACK_CLIENT_SECRET` when your own app issued them); no
   `authenticate()` call.
 - Apps where other people sign in: the Streamlit or FastAPI helper, see
   [streamlit.md](streamlit.md) and [fastapi.md](fastapi.md). In your own server, build one

{sweatstack-0.97.0 → sweatstack-0.98.0}/skills/sweatstack-python/api.md

@@ -124,7 +124,8 @@ GET, PUT and DELETE are retried (connection errors, timeouts, 408, 429, 5xx) up
 `max_retries` times; POST never is. Use `max_retries=0` inside web requests.
 
 The access and refresh token come from one source: the arguments, else `SWEATSTACK_API_KEY`
-and `SWEATSTACK_REFRESH_TOKEN`, else the tokens `authenticate()` saved on this machine. A
+and `SWEATSTACK_REFRESH_TOKEN` (renewed by the app in `SWEATSTACK_CLIENT_ID` and
+`SWEATSTACK_CLIENT_SECRET`, if set), else the tokens `authenticate()` saved on this machine. A
 client given only an access token cannot renew it and raises `SweatStackTokenRefreshError` on
 expiry. In a server, build each user's client from that user's tokens with
 `ambient_credentials=False`: it then never reads or writes the machine's tokens.

{sweatstack-0.97.0 → sweatstack-0.98.0}/skills/sweatstack-python/data-models.md

@@ -48,7 +48,8 @@ taxonomy is preserved (`is_standard` is `False`) instead of failing.
   `end_local`, `results` (`TestResults`: thresholds `lt1`, `lt2`, `vt1`, `vt2`, `mlss`, `fatmax`
   as `Marker`s, plus `vo2max`, `critical_power`, `w_prime`, ...), `tags`, `created_by`;
   `TestDetails` adds the resolved `traces` and overlapping `activities`.
-- **DailyResponse**: `date`, `value`, `status`, `source`.
+- **DailyResponse**: `date`, `value`, `status`, `source` (`DailySource`, an open set: `manual`,
+  `garmin_connect`, ...; markers and max efforts carry it too).
 - **UserSummary** (`users.list()`): `id`, `first_name`, `last_name`, `display_name`, `scopes`,
   `is_managed`.
 - **UserResponse** (`users.create()`, `retrieve()`, `update()`): `id`, `first_name`,

{sweatstack-0.97.0 → sweatstack-0.98.0}/src/sweatstack/_frames.py

@@ -20,6 +20,7 @@ package imports without any of them (enforced by CI's bare-install job).
 from __future__ import annotations
 
 import json
+import sys
 import warnings
 from collections.abc import Sequence
 from datetime import UTC, datetime
@@ -185,15 +186,22 @@ def parquet_to_pandas(content: bytes) -> pd.DataFrame:
 
 def parquet_to_polars(content: bytes) -> pl.DataFrame:
     """Parquet bytes to a Polars DataFrame with the wire dtypes, except
-    Float16 -> Float32 (Polars supports few operations on Float16)."""
+    Float16 -> Float32 (Polars supports few operations on Float16).
+
+    In the browser (Pyodide), Polars is built without its Parquet reader, so the bytes go
+    through pyarrow, which Pyodide ships, and ``pl.from_arrow``."""
     pl = require("polars")
 
-    df = pl.read_parquet(BytesIO(content))
+    if sys.platform == "emscripten":
+        df = pl.from_arrow(parquet_to_arrow(content))
+    else:
+        df = pl.read_parquet(BytesIO(content))
+        metadata = pl.read_parquet_metadata(BytesIO(content))
+        df = df.select(_index_columns_first(df.columns, metadata.get("pandas")))
     float16 = getattr(pl, "Float16", None)  # older Polars already reads float16 as Float32
     if float16 is not None:
         df = df.cast({name: pl.Float32 for name, dtype in df.schema.items() if dtype == float16})
-    metadata = pl.read_parquet_metadata(BytesIO(content))
-    return df.select(_index_columns_first(df.columns, metadata.get("pandas")))
+    return df
 
 
 def parquet_to_arrow(content: bytes) -> Any:

{sweatstack-0.97.0 → sweatstack-0.98.0}/src/sweatstack/client.py

@@ -59,6 +59,7 @@ from .schemas import (
     CapabilityStatus,
     DailyMeasure,
     DailyResponse,
+    DailySource,
     IssueStatus,
     Marker,
     Metric,
@@ -178,6 +179,12 @@ class Client:
     ambient_credentials: bool = True
     _api_key: SecretStr | None = None
     _refresh_token: SecretStr | None = None
+    # The app credentials given to the client; see ``_app`` for the ones a refresh uses.
+    _client_id: str | None = None
+    _client_secret: SecretStr | None = None
+    # The app that issued a refresh token loaded from the environment, as SWEATSTACK_CLIENT_ID
+    # and SWEATSTACK_CLIENT_SECRET name it. Cleared when a refresh token is set from elsewhere.
+    _environment_app: tuple[str, SecretStr | None] | None = None
     # Whether this client's tokens live in the token file, so a refresh is written back there.
     # Set by loading them from the file or by saving them to it; never by giving tokens directly.
     _file_backed: bool = False
@@ -215,13 +222,18 @@ class Client:
         ``SweatStackTokenRefreshError`` rather than renew with a refresh token from elsewhere.
         Only a client whose tokens came from the saved file writes a renewed token back to it.
 
+        Only the app a refresh token was issued to can renew it. That is the ``client_id``
+        and ``client_secret`` given here; else, for tokens from the environment, the app in
+        ``SWEATSTACK_CLIENT_ID`` and ``SWEATSTACK_CLIENT_SECRET``; else the SDK's own client,
+        which ``authenticate()`` signs in with.
+
         Args:
             api_key: Optional API access token. If not provided, will check environment or storage.
             refresh_token: Optional refresh token for automatic token renewal.
             url: Optional SweatStack instance URL. Defaults to production.
             streamlit_compatible: Set to True when using in Streamlit apps.
-            client_id: Optional OAuth client ID. Defaults to the public client ID.
-            client_secret: Optional OAuth client secret for confidential clients.
+            client_id: The client ID of the app the tokens were issued to.
+            client_secret: That app's client secret, if it exchanged the sign-in code with one.
             skip_token_expiry_check: If True, skip JWT expiry validation and use the token as-is.
                 Use this when token lifecycle is managed externally (e.g. by a proxy).
             output: Default container for every method that returns a collection:
@@ -270,7 +282,7 @@ class Client:
         self.streamlit_compatible = streamlit_compatible
         self.skip_token_expiry_check = skip_token_expiry_check
         self.output = _frames.check_frame_output(output)
-        self.client_id = client_id or OAUTH2_CLIENT_ID
+        self._client_id = client_id or None
         self.timeout = timeout
         self.max_retries = max_retries
         self.ambient_credentials = ambient_credentials
@@ -362,6 +374,13 @@ class Client:
     # sources, so a client given only an access token never renews with a refresh token that
     # another client saved on this machine, and a bare client in a server never becomes the
     # user who refreshed last. Only a file-backed client writes the file.
+    #
+    # A refresh token can only be renewed by the app it was issued to, with that app's secret
+    # if it has one. The file holds what authenticate() saved, issued to the SDK's own client.
+    # A pair in the environment may come from any app, so that app travels with it as
+    # SWEATSTACK_CLIENT_ID and SWEATSTACK_CLIENT_SECRET. It belongs to that refresh token: it
+    # never applies to a pair from elsewhere, and is dropped when the refresh token is replaced
+    # (a new sign-in). App credentials given to the client always win.
 
     def _resolve_credentials(self) -> tuple[str | None, str | None]:
         """The access token and the refresh token, as a pair from one source.
@@ -381,6 +400,8 @@ class Client:
                     self._api_key = _to_secret(access_token)
                     self._refresh_token = _to_secret(refresh_token)
                     self._file_backed = file_backed
+                    if not file_backed:
+                        self._environment_app = self._load_environment_app()
                     break
         return (
             self._api_key.get_secret_value() if self._api_key is not None else None,
@@ -391,29 +412,61 @@ class Client:
     def _load_environment_tokens() -> tuple[str | None, str | None]:
         return os.getenv("SWEATSTACK_API_KEY"), os.getenv("SWEATSTACK_REFRESH_TOKEN")
 
+    @staticmethod
+    def _load_environment_app() -> tuple[str, SecretStr | None] | None:
+        client_id = os.getenv("SWEATSTACK_CLIENT_ID")
+        if not client_id:
+            return None
+        return client_id, _to_secret(os.getenv("SWEATSTACK_CLIENT_SECRET") or None)
+
+    def _app(self) -> tuple[str, SecretStr | None]:
+        """The client ID and secret of the app that renews this client's tokens.
+
+        A given client ID wins, and a given secret too. Otherwise a pair from the environment
+        is renewed by the app the environment names, and any other pair by the SDK's own
+        client, which has no secret.
+        """
+        self._resolve_credentials()
+        if (app := self._renewing_environment_app()) is not None:
+            client_id, client_secret = app
+            return client_id, self._client_secret or client_secret
+        return self._client_id or OAUTH2_CLIENT_ID, self._client_secret
+
+    def _renewing_environment_app(self) -> tuple[str, SecretStr | None] | None:
+        """The environment's app, when it is the one that renews this client's tokens."""
+        return self._environment_app if self._client_id is None else None
+
     def _do_token_refresh(self, refresh_token: str) -> TokenResponse:
         """Exchange the refresh token for a new access token.
 
         Raises:
             SweatStackTokenRefreshError: If the refresh request fails.
         """
+        client_id, client_secret = self._app()
         with self._http_client(skip_token_check=True) as client:
             response = client.post(
                 "/api/v1/oauth/token",
                 data={
                     "grant_type": "refresh_token",
                     "refresh_token": refresh_token,
-                    "client_id": self.client_id,
-                    "client_secret": self._client_secret.get_secret_value()
-                    if self._client_secret
-                    else None,
+                    "client_id": client_id,
+                    "client_secret": client_secret.get_secret_value() if client_secret else None,
                 },
             )
 
             try:
                 self._raise_for_status(response)
             except SweatStackAPIError as e:
-                raise SweatStackTokenRefreshError(f"Token refresh request failed: {e}") from e
+                message = f"Token refresh request failed: {e}"
+                refused = isinstance(e, (SweatStackAuthError, SweatStackBadRequestError))
+                if refused and self._renewing_environment_app() is not None:
+                    message += (
+                        " The tokens came from the environment, so they were renewed with the "
+                        f"app in SWEATSTACK_CLIENT_ID ({client_id}), which works only for tokens "
+                        "that app issued. If authenticate() issued them, unset "
+                        "SWEATSTACK_CLIENT_ID and SWEATSTACK_CLIENT_SECRET for this process."
+                    )
+                raise SweatStackTokenRefreshError(message) from e
 
             return TokenResponse.model_validate(response.json())
 
@@ -495,15 +548,28 @@ class Client:
     @refresh_token.setter
     def refresh_token(self, value: str | SecretStr | None):
         self._refresh_token = _to_secret(value)
+        self._environment_app = None  # that app issued the environment's token, not this one
+
+    @property
+    def client_id(self) -> str:
+        """The client ID of the app that renews this client's tokens.
+
+        See ``Client`` for which app that is.
+        """
+        return self._app()[0]
+
+    @client_id.setter
+    def client_id(self, value: str | None):
+        self._client_id = value or None
 
     @property
     def client_secret(self) -> SecretStr | None:
-        """The OAuth client secret for confidential clients.
+        """The client secret of the app that renews this client's tokens, if it has one.
 
         Returns a SecretStr to prevent accidental logging of the secret.
         Use .get_secret_value() to get the actual secret string.
         """
-        return self._client_secret
+        return self._app()[1]
 
     @client_secret.setter
     def client_secret(self, value: str | SecretStr | None):
@@ -580,7 +646,9 @@ class Client:
         sign-in on this machine. Opens the browser for a SweatStack sign-in only when none are
         found, or when ``force=True``.
 
-        In headless environments, set the environment variables instead of calling this.
+        In headless environments, set the environment variables instead of calling this, with
+        ``SWEATSTACK_CLIENT_ID`` and ``SWEATSTACK_CLIENT_SECRET`` when your own app issued the
+        tokens.
 
         Args:
             force: Sign in again even if credentials exist.
@@ -732,14 +800,18 @@ class Client:
         return self._with_tokens(tokens)
 
     def _with_tokens(self, tokens: dict[str, Any]) -> Client:
-        """A new client with these tokens and this client's settings."""
+        """A new client with these tokens and this client's settings.
+
+        The tokens were issued to this client's app, so the new client renews them with it.
+        """
+        client_id, client_secret = self._app()
         return self.__class__(
             api_key=tokens["access_token"],
             refresh_token=tokens["refresh_token"],
             url=self._url,
             streamlit_compatible=self.streamlit_compatible,
-            client_id=self.client_id,
-            client_secret=self._client_secret,
+            client_id=client_id,
+            client_secret=client_secret,
             output=self.output,
             timeout=self.timeout,
             max_retries=self.max_retries,
@@ -1151,6 +1223,7 @@ __all__ = sorted(
         "CapabilityStatus",
         "DailyMeasure",
         "DailyResponse",
+        "DailySource",
         "IssueStatus",
         "Marker",
         "Metric",

{sweatstack-0.97.0 → sweatstack-0.98.0}/src/sweatstack/schemas.py

@@ -30,6 +30,7 @@ from .openapi_schemas import (
     CapabilityStatus,
     DailyMeasure,
     DailyResponse,
+    DailySource,
     IssueStatus,
     Marker,
     Metric,
@@ -56,11 +57,11 @@ from .openapi_schemas import (
 def _open_enum(enum_cls: type[Enum]) -> None:
     """Let ``enum_cls`` accept values the bundled schema does not know yet.
 
-    The server treats some enums as open sets (new metrics, scopes, daily measures, status
-    codes, capabilities and Portal destinations appear without notice). An unknown value
-    becomes a pseudo-member with ``.value`` and ``.name`` set to the string, cached so repeated
-    lookups return the same object, instead of a validation error that would break the client
-    until it is updated. Closed enums (``CapabilityStatus``, ...) are left strict on purpose:
+    The server treats some enums as open sets (new metrics, scopes, daily measures, sources of a
+    value, status codes, capabilities and Portal destinations appear without notice). An unknown
+    value becomes a pseudo-member with ``.value`` and ``.name`` set to the string, cached so
+    repeated lookups return the same object, instead of a validation error that would break the
+    client until it is updated. Closed enums (``CapabilityStatus``, ...) are left strict on purpose:
     the server promises those never grow, or a value the client does not know is not something
     it should act on.
     """
@@ -76,7 +77,15 @@ def _open_enum(enum_cls: type[Enum]) -> None:
     enum_cls._missing_ = _missing_  # ty: ignore[invalid-assignment]  # patched onto a generated enum
 
 
-for _open in (Metric, Scope, DailyMeasure, StatusIssueCode, Capability, PortalDestination):
+for _open in (
+    Metric,
+    Scope,
+    DailyMeasure,
+    DailySource,
+    StatusIssueCode,
+    Capability,
+    PortalDestination,
+):
     _open_enum(_open)
 
 

{sweatstack-0.97.0 → sweatstack-0.98.0}/tests/test_credentials.py

@@ -12,10 +12,12 @@ import threading
 import time
 from types import SimpleNamespace
 from unittest.mock import patch
+from urllib.parse import parse_qs
 
+import httpx2
 import pytest
 
-from sweatstack.client import Client
+from sweatstack.client import OAUTH2_CLIENT_ID, Client
 from sweatstack.exceptions import SweatStackTokenRefreshError
 from sweatstack.schemas import TokenResponse
 
@@ -259,3 +261,148 @@ class TestResolution:
         import sweatstack
 
         assert sweatstack.client._default_client.ambient_credentials is True
+
+
+class TestApp:
+    """Only the app a refresh token was issued to can renew it, with that app's secret.
+
+    What a refresh sends is read off the wire, so these pin the request the server sees.
+    """
+
+    @pytest.fixture
+    def renewed_by(self, monkeypatch):
+        """The ``(client_id, client_secret)`` of every refresh request, answered offline."""
+        sent: list[tuple[str, str | None]] = []
+
+        def token_endpoint(request: httpx2.Request) -> httpx2.Response:
+            form = parse_qs(request.content.decode())
+            sent.append((form["client_id"][0], form.get("client_secret", [None])[0]))
+            owner = OWNERS[form["refresh_token"][0]]
+            return httpx2.Response(200, json={"access_token": jwt(owner, 900), "expires_in": 900})
+
+        pool = httpx2.Client(base_url=URL, transport=httpx2.MockTransport(token_endpoint))
+        monkeypatch.setattr(Client, "_pool", lambda self: pool)
+        return sent
+
+    @pytest.fixture
+    def answer(self, monkeypatch):
+        """Makes the token endpoint answer every refresh request with an error status."""
+
+        def answer_with(status: int) -> None:
+            def token_endpoint(request: httpx2.Request) -> httpx2.Response:
+                return httpx2.Response(status, json={"error": "invalid_grant"})
+
+            pool = httpx2.Client(base_url=URL, transport=httpx2.MockTransport(token_endpoint))
+            monkeypatch.setattr(Client, "_pool", lambda self: pool)
+
+        return answer_with
+
+    @pytest.fixture
+    def environment_pair(self, monkeypatch):
+        monkeypatch.setenv("SWEATSTACK_API_KEY", jwt("user_a", -60))
+        monkeypatch.setenv("SWEATSTACK_REFRESH_TOKEN", "refresh_a")
+
+    @pytest.fixture
+    def environment_app(self, monkeypatch):
+        monkeypatch.setenv("SWEATSTACK_CLIENT_ID", "app_123")
+        monkeypatch.setenv("SWEATSTACK_CLIENT_SECRET", "secret_123")
+
+    def test_an_environment_pair_is_renewed_by_the_environment_app(
+        self, renewed_by, environment_pair, environment_app
+    ):
+        client = Client(url=URL)
+        assert client.client_id == "app_123"  # before any request, too
+        assert acts_as(client) == "user_a"
+        assert renewed_by == [("app_123", "secret_123")]
+
+    def test_a_public_environment_app_sends_no_secret(
+        self, renewed_by, environment_pair, monkeypatch
+    ):
+        monkeypatch.setenv("SWEATSTACK_CLIENT_ID", "app_123")
+        assert acts_as(Client(url=URL)) == "user_a"
+        assert renewed_by == [("app_123", None)]
+
+    def test_without_an_environment_app_the_sdk_client_renews(self, renewed_by, environment_pair):
+        assert acts_as(Client(url=URL)) == "user_a"
+        assert renewed_by == [(OAUTH2_CLIENT_ID, None)]
+
+    def test_a_secret_without_a_client_id_is_ignored(
+        self, renewed_by, environment_pair, monkeypatch
+    ):
+        monkeypatch.setenv("SWEATSTACK_CLIENT_SECRET", "secret_123")
+        assert acts_as(Client(url=URL)) == "user_a"
+        assert renewed_by == [(OAUTH2_CLIENT_ID, None)]
+
+    def test_a_given_app_wins_and_never_takes_the_environment_secret(
+        self, renewed_by, environment_pair, environment_app
+    ):
+        assert acts_as(Client(url=URL, client_id="app_456")) == "user_a"
+        assert renewed_by == [("app_456", None)]
+
+    def test_a_given_secret_wins(self, renewed_by, environment_pair, environment_app):
+        assert acts_as(Client(url=URL, client_secret="secret_456")) == "user_a"
+        assert renewed_by == [("app_123", "secret_456")]
+
+    def test_it_never_applies_to_the_saved_pair(self, renewed_by, token_file, environment_app):
+        write_token_file(token_file, jwt("user_a", -60), "refresh_a")  # from authenticate()
+        assert acts_as(Client(url=URL)) == "user_a"
+        assert renewed_by == [(OAUTH2_CLIENT_ID, None)]
+
+    def test_it_never_applies_to_given_tokens(self, renewed_by, environment_app):
+        assert acts_as(Client(jwt("user_a", -60), refresh_token="refresh_a", url=URL)) == "user_a"
+        assert renewed_by == [(OAUTH2_CLIENT_ID, None)]
+
+    def test_a_new_sign_in_drops_it(self, renewed_by, environment_pair, environment_app):
+        client = Client(url=URL)
+        assert acts_as(client) == "user_a"
+        # What authenticate(force=True) does: tokens issued to the SDK's own client.
+        client.api_key, client.refresh_token = jwt("user_b", -60), "refresh_b"
+        assert acts_as(client) == "user_b"
+        assert renewed_by == [("app_123", "secret_123"), (OAUTH2_CLIENT_ID, None)]
+
+    def test_a_new_access_token_keeps_it(self, renewed_by, environment_pair, environment_app):
+        client = Client(url=URL)
+        assert acts_as(client) == "user_a"
+        client.api_key = jwt("user_a", -60)  # the refresh token is still the environment's
+        assert acts_as(client) == "user_a"
+        assert renewed_by == [("app_123", "secret_123")] * 2
+
+    def test_a_derived_client_keeps_it(self, renewed_by, environment_pair, environment_app):
+        derived = Client(url=URL)._with_tokens(
+            {"access_token": jwt("user_b", -60), "refresh_token": "refresh_b"}
+        )
+        assert acts_as(derived) == "user_b"
+        assert renewed_by == [("app_123", "secret_123")]
+
+    def test_the_module_level_client_picks_it_up(
+        self, renewed_by, environment_pair, environment_app, monkeypatch
+    ):
+        import sweatstack
+
+        client = sweatstack.client._default_client
+        monkeypatch.setattr(client, "url", URL)
+        for name in ("_api_key", "_refresh_token", "_client_id", "_environment_app"):
+            monkeypatch.setattr(client, name, None)
+        assert acts_as(client) == "user_a"
+        assert renewed_by == [("app_123", "secret_123")]
+
+    @pytest.mark.parametrize("status", [400, 401])
+    def test_a_refusal_says_the_environment_app_renewed(
+        self, answer, environment_pair, environment_app, status
+    ):
+        answer(status)
+        with pytest.raises(SweatStackTokenRefreshError, match=r"SWEATSTACK_CLIENT_ID \(app_123\)"):
+            _ = Client(url=URL).api_key
+
+    @pytest.mark.parametrize(
+        ("status", "client_id"),
+        [(503, None), (400, "app_456")],
+        ids=["an outage", "a given app"],
+    )
+    def test_other_failures_do_not_mention_it(
+        self, answer, environment_pair, environment_app, status, client_id
+    ):
+        answer(status)
+        with pytest.raises(SweatStackTokenRefreshError) as raised:
+            _ = Client(url=URL, client_id=client_id).api_key
+        assert "SWEATSTACK_CLIENT_ID" not in str(raised.value)

{sweatstack-0.97.0 → sweatstack-0.98.0}/tests/test_dailies.py

@@ -9,8 +9,8 @@ from datetime import date
 import pandas as pd
 import pytest
 
-from sweatstack import DailyMeasure, DailyResponse, _frames
-from sweatstack.openapi_schemas import DailySource, DailyStatus
+from sweatstack import DailyMeasure, DailyResponse, DailySource, _frames
+from sweatstack.openapi_schemas import DailyStatus, MarkerRowResponse, MaxEffortRowResponse
 
 # ---------------------------------------------------------------------------
 # Fixtures
@@ -127,3 +127,48 @@ class TestSchemaRoundTrip:
             restored = DailyResponse.model_validate(payload)
             assert restored.source is None
             assert restored.status is DailyStatus(status)
+
+
+@pytest.mark.parametrize(
+    "model, row",
+    [
+        (DailyResponse, {"date": "2026-03-10", "value": 82.5, "status": "stored"}),
+        (
+            MarkerRowResponse,
+            {
+                "id": "m1",
+                "sport": "cycling",
+                "marker": "second_threshold",
+                "metric": "power",
+                "value": 280.0,
+                "date": "2026-03-10",
+                "provenance": "declared",
+                "pinned": False,
+                "application_id": None,
+                "activity_id": None,
+            },
+        ),
+        (
+            MaxEffortRowResponse,
+            {
+                "id": "e1",
+                "sport": "cycling",
+                "metric": "power",
+                "duration": 300,
+                "distance": None,
+                "value": 350.0,
+                "date": "2026-03-10",
+                "provenance": "measured",
+                "title": None,
+                "application_id": None,
+                "activity_id": None,
+            },
+        ),
+    ],
+    ids=["daily", "marker", "max_effort"],
+)
+def test_source_is_an_open_set(model, row):
+    # `DailySource` is opened in schemas.py (`_open_enum`): the API may add `source` values.
+    assert model.model_validate({**row, "source": "manual"}).source is DailySource.manual
+    added_later = model.model_validate({**row, "source": "a_source_added_later"}).source
+    assert isinstance(added_later, DailySource) and added_later.value == "a_source_added_later"

{sweatstack-0.97.0 → sweatstack-0.98.0}/tests/test_output.py

@@ -14,6 +14,7 @@ import pandas as pd
 import polars as pl
 import pyarrow as pa
 import pytest
+from polars.testing import assert_frame_equal
 
 import sweatstack
 from sweatstack import _frames
@@ -349,3 +350,24 @@ class TestPropagation:
             selected = auth.select_activity()
         assert selected.id == "a1"
         assert auth.client.activities.list.call_args.kwargs["output"] == "models"
+
+
+# ---------------------------------------------------------------------------
+# Polars in the browser
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.parametrize("content", [_mean_max_with_index(), _mean_max_without_index()])
+def test_polars_in_pyodide_reads_through_arrow_with_the_same_result(monkeypatch, content):
+    """Pyodide's Polars has no Parquet reader; the pyarrow route must give the same frame."""
+    expected = _frames.parquet_to_polars(content)
+
+    def no_parquet_reader(*args, **kwargs):
+        raise AttributeError(
+            "type object 'builtins.PyLazyFrame' has no attribute 'new_from_parquet'"
+        )
+
+    monkeypatch.setattr(pl, "read_parquet", no_parquet_reader)
+    monkeypatch.setattr(pl, "read_parquet_metadata", no_parquet_reader)
+    monkeypatch.setattr(_frames.sys, "platform", "emscripten")
+    assert_frame_equal(_frames.parquet_to_polars(content), expected)

{sweatstack-0.97.0 → sweatstack-0.98.0}/uv.lock

@@ -2356,7 +2356,7 @@ wheels = [
 
 [[package]]
 name = "sweatstack"
-version = "0.97.0"
+version = "0.98.0"
 source = { editable = "." }
 dependencies = [
     { name = "email-validator" },
@@ -2380,6 +2380,7 @@ pandas = [
 ]
 polars = [
     { name = "polars" },
+    { name = "pyarrow", marker = "sys_platform == 'emscripten'" },
 ]
 streamlit = [
     { name = "pandas" },
@@ -2415,6 +2416,7 @@ requires-dist = [
     { name = "pandas", marker = "extra == 'pandas'", specifier = ">=2.2.3" },
     { name = "platformdirs", specifier = ">=4.0.0" },
     { name = "polars", marker = "extra == 'polars'", specifier = ">=1.30" },
+    { name = "pyarrow", marker = "sys_platform == 'emscripten' and extra == 'polars'", specifier = ">=20.0.0" },
     { name = "pyarrow", marker = "extra == 'arrow'", specifier = ">=20.0.0" },
     { name = "pydantic", specifier = ">=2.10.5" },
     { name = "streamlit", marker = "extra == 'streamlit'", specifier = ">=1.42.0" },