querysource 5.1.4__tar.gz → 5.1.5__tar.gz

querysource-5.1.5/.agents/plugins/parrot/mcp_config.json

@@ -0,0 +1,34 @@
+{
+  "mcpServers": {
+    "parrot-bounded-source": {
+      "command": "/home/jesuslara/proyectos/querysource/.venv/bin/parrot",
+      "args": [
+        "mcp-local",
+        "bounded-source",
+        "--config",
+        "/home/jesuslara/proyectos/querysource/.parrot/mcp-toolkits.yaml"
+      ],
+      "cwd": "/home/jesuslara/proyectos/querysource"
+    },
+    "parrot-memory": {
+      "command": "/home/jesuslara/proyectos/querysource/.venv/bin/parrot",
+      "args": [
+        "mcp-local",
+        "memory",
+        "--config",
+        "/home/jesuslara/proyectos/querysource/.parrot/mcp-toolkits.yaml"
+      ],
+      "cwd": "/home/jesuslara/proyectos/querysource"
+    },
+    "parrot-sdd-coder": {
+      "command": "/home/jesuslara/proyectos/querysource/.venv/bin/parrot",
+      "args": [
+        "mcp-local",
+        "sdd-coder",
+        "--config",
+        "/home/jesuslara/proyectos/querysource/.parrot/mcp-toolkits.yaml"
+      ],
+      "cwd": "/home/jesuslara/proyectos/querysource"
+    }
+  }
+}

querysource-5.1.5/CLAUDE.md

@@ -0,0 +1,80 @@
+<!-- parrot:wiki:begin -->
+## Codebase Knowledge Graph (LLM Wiki)
+
+This repository maintains a machine-first knowledge graph of the
+codebase (pages + typed edges over a local SQLite plane, built by
+`wikitoolkit build`). For ANY question about the codebase — where
+something lives, how modules relate, what a subsystem does — you MUST
+run a scoped wiki query FIRST, before Grep/Glob/Read or any shell
+search (`grep`/`rg`/`find`/`cat` via Bash):
+
+- `wikitoolkit query "<question>"` — token-budgeted, ranked page
+  stubs for a scoped question. ALWAYS start here.
+- `wikitoolkit page <id>` — read one page in full (file summaries,
+  API outlines, content). Use the ids returned by `query`.
+- `wikitoolkit related <id>` — follow typed edges (`contains`,
+  `references`) to neighbouring files/modules.
+- `wikitoolkit status` — plane statistics and staleness.
+- `wikitoolkit build` — refresh the graph after large changes
+  (a git post-commit hook may already keep it fresh).
+
+These same operations are also exposed as native MCP tools —
+`wiki_query`, `wiki_page`, `wiki_related`, `wiki_remember`, `wiki_note`,
+`wiki_status` — via the `wikitoolkit` MCP stdio server registered in
+this repo's `.mcp.json` (FEAT-403). If they appear in your tool list,
+prefer calling them directly; they have equal standing with Grep/Read
+at tool-selection time instead of competing via a Bash-invoked CLI.
+
+**Symbol lookup and blast radius (FEAT-498).** For a specific
+function/class/method — not a general question — prefer the structural
+tools over `wiki_query`: `wikitoolkit symbols lookup <name>`
+(`wiki_symbol_lookup` MCP tool) finds it by name/qualname directly;
+`wikitoolkit symbols outline <file>` (`wiki_code_outline`) lists a
+file's symbols before you read the whole thing; `wikitoolkit symbols
+blast <symbol>` (`wiki_blast_radius`) shows every symbol that
+transitively calls/extends/implements it — run this BEFORE editing a
+widely-used function or class to see what you might break.
+
+**Query discipline** (avoids the two most common ways the wiki
+"fails" — which are usually caller error, not missing coverage):
+
+1. **Query for the *thing*, not for your *hypothesis* about it.** The
+   ranking is lexical — extra concept words steer it toward those
+   concepts. To locate a class or feature, name the symbol/module/
+   subsystem you want (`"attestation model service"`), not your theory
+   about where it might live.
+2. **Follow the thread before falling back.** If a result scores low
+   or names a parent module, resolve it with `wikitoolkit page <id>`
+   or `wikitoolkit related <id>` — one hop usually lands the real
+   page. Do NOT jump to grep just because the first `query` didn't
+   rank the exact page first.
+
+Only fall back to Grep/Glob/Read (or shell search) once a clean query
+*and* a page/related follow-up have genuinely come up empty — and say
+so before you do. Consider `wikitoolkit build` if results look stale.
+
+**Saving knowledge (persistent memory).** The wiki is also your
+durable memory — what you save here survives this session and is
+found by future `wikitoolkit query` calls ("the agent forgets, the
+graph does not"). When you learn a durable fact, make a decision, or
+extract a lesson worth keeping, SAVE it:
+
+- `wikitoolkit remember "<fact>" --category [note|decision|lesson|concept]
+  [--title "<short title>"] [--link <page_id> --rel <relation>]` —
+  file new knowledge (idempotent: same title+category updates the
+  existing memory). Link it to the pages it is about.
+- `wikitoolkit note <page_id> "<text>"` — append an attributed,
+  dated note to an existing page.
+- `wikitoolkit link <src_id> <dst_id> --rel <relation>` — connect
+  two pages with a typed, asserted edge.
+- `wikitoolkit memories` — list saved memories;
+  `wikitoolkit audit` — the attributed write log.
+
+Save selectively: durable decisions, gotchas, and cross-file
+relationships — not session chatter. Every write is attributed and
+auditable.
+
+The `/parrotwiki` command wraps these (e.g. `/parrotwiki query how
+does ingest work`, `/parrotwiki remember <fact>`, `/parrotwiki --wiki`
+to export a human-readable markdown wiki).
+<!-- parrot:wiki:end -->

{querysource-5.1.4 → querysource-5.1.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: querysource
-Version: 5.1.4
+Version: 5.1.5
 Summary: Aiohttp web service for querying several databases easily
 Author-email: Jesus Lara <jesuslarag@gmail.com>
 License: BSD-3-Clause
@@ -109,12 +109,24 @@ Provides-Extra: vectors
 Requires-Dist: gensim>=4.4.0; extra == "vectors"
 Provides-Extra: geo
 Requires-Dist: timezonefinder; extra == "geo"
+Provides-Extra: onedrive
+Requires-Dist: msgraph-sdk>=1.0; extra == "onedrive"
+Requires-Dist: azure-identity>=1.0; extra == "onedrive"
+Requires-Dist: httpx>=0.24; extra == "onedrive"
 Provides-Extra: sharepoint
 Requires-Dist: msgraph-sdk>=1.0; extra == "sharepoint"
 Requires-Dist: azure-identity>=1.0; extra == "sharepoint"
 Requires-Dist: httpx>=0.24; extra == "sharepoint"
 Provides-Extra: s3
-Requires-Dist: aioboto3>=12.0; extra == "s3"
+Requires-Dist: aioboto3>=15; extra == "s3"
+Requires-Dist: s3fs>=2026.9; extra == "s3"
+Provides-Extra: parquet
+Requires-Dist: pyarrow>=25; extra == "parquet"
+Requires-Dist: fsspec>=2026.7; extra == "parquet"
+Provides-Extra: gcs
+Requires-Dist: gcsfs>=2026.8; extra == "gcs"
+Provides-Extra: parquet-all
+Requires-Dist: querysource[gcs,parquet,s3]; extra == "parquet-all"
 Provides-Extra: dev
 Requires-Dist: pytest>=5.4.0; extra == "dev"
 Requires-Dist: coverage; extra == "dev"

querysource-5.1.5/generated/OneDriveSource.json

@@ -0,0 +1,124 @@
+{
+  "name": "OneDriveSource",
+  "category": "Sources",
+  "description": "Download one CSV/Excel file from OneDrive.",
+  "usage": "Modes: ``auth: app`` (default) with ``user`` + path, or ``url``; ``auth: delegated`` (the requesting / run-as user's own drive via a linked ``onedrive`` identity) with path or ``url``.",
+  "attributes": [
+    {
+      "name": "auth",
+      "type": "Any",
+      "default": "app",
+      "required": false,
+      "description": ""
+    },
+    {
+      "name": "user",
+      "type": "Any",
+      "default": "",
+      "required": false,
+      "description": ""
+    },
+    {
+      "name": "url",
+      "type": "Any",
+      "default": "",
+      "required": false,
+      "description": ""
+    },
+    {
+      "name": "credentials.client_id",
+      "type": "Any",
+      "default": "ONEDRIVE_APP_ID",
+      "required": false,
+      "description": ""
+    },
+    {
+      "name": "credentials.client_secret",
+      "type": "Any",
+      "default": "ONEDRIVE_APP_SECRET",
+      "required": false,
+      "description": ""
+    },
+    {
+      "name": "credentials.tenant_id",
+      "type": "Any",
+      "default": "ONEDRIVE_TENANT_ID",
+      "required": false,
+      "description": ""
+    },
+    {
+      "name": "source.filename",
+      "type": "Any",
+      "default": "",
+      "required": false,
+      "description": ""
+    },
+    {
+      "name": "source.directory",
+      "type": "Any",
+      "default": "",
+      "required": false,
+      "description": ""
+    },
+    {
+      "name": "source.sheet_name",
+      "type": "Any",
+      "default": 0,
+      "required": false,
+      "description": ""
+    },
+    {
+      "name": "source.pd_args",
+      "type": "Any",
+      "default": {},
+      "required": false,
+      "description": ""
+    },
+    {
+      "name": "source.url",
+      "type": "Any",
+      "default": "",
+      "required": false,
+      "description": ""
+    },
+    {
+      "name": "source.masks",
+      "type": "Any",
+      "default": {},
+      "required": false,
+      "description": ""
+    }
+  ],
+  "json_schema": {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "type": "object",
+    "title": "OneDriveSource",
+    "properties": {
+      "auth": {},
+      "user": {},
+      "url": {},
+      "credentials": {
+        "type": "object",
+        "properties": {
+          "client_id": {},
+          "client_secret": {},
+          "tenant_id": {}
+        }
+      },
+      "source": {
+        "type": "object",
+        "properties": {
+          "filename": {},
+          "directory": {},
+          "sheet_name": {},
+          "pd_args": {},
+          "url": {},
+          "masks": {}
+        }
+      }
+    },
+    "required": []
+  },
+  "example": "",
+  "icon": "database"
+}

querysource-5.1.5/generated/ParquetFileSource.json

@@ -0,0 +1,34 @@
+{
+  "name": "ParquetFileSource",
+  "category": "Sources",
+  "description": "Read Parquet from the local filesystem (a file, directory or glob).",
+  "usage": "",
+  "attributes": [
+    {
+      "name": "source.path",
+      "type": "Any",
+      "default": null,
+      "required": true,
+      "description": ""
+    }
+  ],
+  "json_schema": {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "type": "object",
+    "title": "ParquetFileSource",
+    "properties": {
+      "source": {
+        "type": "object",
+        "properties": {
+          "path": {}
+        },
+        "required": [
+          "path"
+        ]
+      }
+    },
+    "required": []
+  },
+  "example": "{\n  \"source\": {\n    \"path\": \"/data/sales/{filedate}/*.parquet\"\n  },\n  \"masks\": {\n    \"{filedate}\": [\n      \"today\",\n      {\n        \"mask\": \"%Y%m%d\"\n      }\n    ]\n  },\n  \"columns\": [\n    \"store_id\",\n    \"amount\"\n  ],\n  \"filters\": [\n    [\n      \"amount\",\n      \">=\",\n      100\n    ]\n  ],\n  \"partitioning\": \"hive\"\n}",
+  "icon": "database"
+}

querysource-5.1.5/generated/ParquetGCSSource.json

@@ -0,0 +1,25 @@
+{
+  "name": "ParquetGCSSource",
+  "category": "Sources",
+  "description": "Read Parquet from Google Cloud Storage via gcsfs.",
+  "usage": "Token precedence: explicit ``credentials.token`` \u2192 ``GOOGLE_CREDENTIALS_FILE`` \u2192 ``BIGQUERY_CREDENTIALS`` \u2192 ``google_default`` (Application Default Credentials).",
+  "attributes": [
+    {"name": "credentials.bucket", "type": "Any", "default": null, "required": true, "description": ""},
+    {"name": "credentials.project", "type": "Any", "default": null, "required": false, "description": ""},
+    {"name": "credentials.token", "type": "Any", "default": null, "required": false, "description": ""},
+    {"name": "source.directory", "type": "Any", "default": "", "required": false, "description": ""},
+    {"name": "source.file", "type": "Any", "default": "", "required": false, "description": ""}
+  ],
+  "json_schema": {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "type": "object",
+    "title": "ParquetGCSSource",
+    "properties": {
+      "credentials": {"type": "object", "properties": {"bucket": {}, "project": {}, "token": {}}, "required": ["bucket"]},
+      "source": {"type": "object", "properties": {"directory": {}, "file": {}}}
+    },
+    "required": []
+  },
+  "example": "",
+  "icon": "database"
+}

querysource-5.1.5/generated/ParquetS3Source.json

@@ -0,0 +1,29 @@
+{
+  "name": "ParquetS3Source",
+  "category": "Sources",
+  "description": "Read Parquet from AWS S3 or an S3-compatible endpoint via s3fs.",
+  "usage": "Credential values may be navconfig variable names. Names that stay unresolved are ignored, so s3fs falls back to the ambient AWS credential chain (as S3Source does).",
+  "attributes": [
+    {"name": "credentials.bucket", "type": "Any", "default": "AWS_S3_BUCKET", "required": false, "description": ""},
+    {"name": "credentials.region_name", "type": "Any", "default": "AWS_REGION_NAME", "required": false, "description": ""},
+    {"name": "credentials.aws_key", "type": "Any", "default": "AWS_ACCESS_KEY_ID", "required": false, "description": ""},
+    {"name": "credentials.aws_secret", "type": "Any", "default": "AWS_SECRET_ACCESS_KEY", "required": false, "description": ""},
+    {"name": "credentials.profile", "type": "Any", "default": null, "required": false, "description": ""},
+    {"name": "credentials.anon", "type": "Any", "default": false, "required": false, "description": ""},
+    {"name": "credentials.endpoint_url", "type": "Any", "default": null, "required": false, "description": ""},
+    {"name": "source.directory", "type": "Any", "default": "", "required": false, "description": ""},
+    {"name": "source.file", "type": "Any", "default": "", "required": false, "description": ""}
+  ],
+  "json_schema": {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "type": "object",
+    "title": "ParquetS3Source",
+    "properties": {
+      "credentials": {"type": "object", "properties": {"bucket": {}, "region_name": {}, "aws_key": {}, "aws_secret": {}, "profile": {}, "anon": {}, "endpoint_url": {}}},
+      "source": {"type": "object", "properties": {"directory": {}, "file": {}}}
+    },
+    "required": []
+  },
+  "example": "",
+  "icon": "database"
+}

{querysource-5.1.4 → querysource-5.1.5}/generated/Query.json

@@ -52,6 +52,20 @@
       "default": null,
       "required": false,
       "description": "Tenant owner for this query. If omitted, inherits from parent or uses the configured default store. If explicitly ``null``, uses the legacy store. If a string, selects that exact tenant from the allowlist. Examples: ``null`` (legacy), ``client_a`` (explicit tenant)."
+    },
+    {
+      "name": "pre-hook",
+      "type": "str",
+      "default": null,
+      "required": false,
+      "description": "SQL (a string or a list of strings) run BEFORE this query's retrieval, isolated on the write (DB*) credentials in its own transaction \u2014 never on, or in a transaction shared with, the read. PostgreSQL ``queries`` entries only (slug on the ``db``/``pg`` provider, or raw ``driver`` ``pg``/``postgres``/``postgresql`` without ``datasource``); requires the ``datasource:use`` grant on ``pg_admin``. Guarded: DROP, TRUNCATE, ALTER \u2026 DROP, DO, GRANT/REVOKE, role DDL, COPY \u2026 PROGRAM and transaction control are rejected. If it fails the query is not read. Never accepted from request conditions."
+    },
+    {
+      "name": "post-hook",
+      "type": "str",
+      "default": null,
+      "required": false,
+      "description": "SQL (a string or a list of strings) run AFTER this query's retrieval, isolated on the write (DB*) credentials in its own transaction \u2014 never on, or in a transaction shared with, the read. It runs after a successful OR empty (no data / 204) retrieval, but NOT after a failed one; an empty result is still reported as \"no data\". PostgreSQL ``queries`` entries only (slug on the ``db``/``pg`` provider, or raw ``driver`` ``pg``/``postgres``/``postgresql`` without ``datasource``); requires the ``datasource:use`` grant on ``pg_admin``. Guarded: DROP, TRUNCATE, ALTER \u2026 DROP, DO, GRANT/REVOKE, role DDL, COPY \u2026 PROGRAM and transaction control are rejected. Never accepted from request conditions."
     }
   ],
   "json_schema": {
@@ -88,6 +102,14 @@
         "type": "string",
         "description": "Tenant owner for this query. If omitted, inherits from parent or uses the configured default store. If explicitly ``null``, uses the legacy store. If a string, selects that exact tenant from the allowlist. Examples: ``null`` (legacy), ``client_a`` (explicit tenant).",
         "default": null
+      },
+      "pre-hook": {
+        "type": "string",
+        "description": "SQL (a string or a list of strings) run BEFORE this query's retrieval, isolated on the write (DB*) credentials in its own transaction \u2014 never on, or in a transaction shared with, the read. PostgreSQL ``queries`` entries only (slug on the ``db``/``pg`` provider, or raw ``driver`` ``pg``/``postgres``/``postgresql`` without ``datasource``); requires the ``datasource:use`` grant on ``pg_admin``. Guarded: DROP, TRUNCATE, ALTER \u2026 DROP, DO, GRANT/REVOKE, role DDL, COPY \u2026 PROGRAM and transaction control are rejected. If it fails the query is not read. Never accepted from request conditions."
+      },
+      "post-hook": {
+        "type": "string",
+        "description": "SQL (a string or a list of strings) run AFTER this query's retrieval, isolated on the write (DB*) credentials in its own transaction \u2014 never on, or in a transaction shared with, the read. It runs after a successful OR empty (no data / 204) retrieval, but NOT after a failed one; an empty result is still reported as \"no data\". PostgreSQL ``queries`` entries only (slug on the ``db``/``pg`` provider, or raw ``driver`` ``pg``/``postgres``/``postgresql`` without ``datasource``); requires the ``datasource:use`` grant on ``pg_admin``. Guarded: DROP, TRUNCATE, ALTER \u2026 DROP, DO, GRANT/REVOKE, role DDL, COPY \u2026 PROGRAM and transaction control are rejected. Never accepted from request conditions."
       }
     },
     "oneOf": [

{querysource-5.1.4 → querysource-5.1.5}/pyproject.toml

@@ -148,6 +148,12 @@ geo = [
     "timezonefinder",
 ]
 
+onedrive = [
+    "msgraph-sdk>=1.0",
+    "azure-identity>=1.0",
+    "httpx>=0.24",
+]
+
 sharepoint = [
     "msgraph-sdk>=1.0",
     "azure-identity>=1.0",
@@ -155,7 +161,21 @@ sharepoint = [
 ]
 
 s3 = [
-    "aioboto3>=12.0",
+    "aioboto3>=15",
+    "s3fs>=2026.9",
+]
+
+parquet = [
+    "pyarrow>=25",
+    "fsspec>=2026.7",
+]
+
+gcs = [
+    "gcsfs>=2026.8",
+]
+
+parquet-all = [
+    "querysource[parquet,s3,gcs]",
 ]
 
 dev = [
@@ -293,6 +313,8 @@ known-first-party = ["querysource"]
 # producing ModuleNotFoundError: No module named '<pkg>.<native>' at import.
 [tool.uv]
 link-mode = "copy"
+# FEAT-158: asyncdb[boto3] pins aiobotocore==2.15.2 and aioboto3==13.2.0, which conflict with s3fs>=2026.9.
+override-dependencies = ["aiobotocore>=2.25,<2.26", "aioboto3>=15"]
 
 [tool.uv.sources]
 # navigator-auth = { path = "../../navigator/navigator-auth", editable = true }

{querysource-5.1.4 → querysource-5.1.5}/querysource/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '5.1.4'
-__version_tuple__ = version_tuple = (5, 1, 4)
+__version__ = version = '5.1.5'
+__version_tuple__ = version_tuple = (5, 1, 5)
 
-__commit_id__ = commit_id = 'g257352bd5'
+__commit_id__ = commit_id = 'g463584aa4'

querysource-5.1.5/querysource/auth/identity_tokens.py

@@ -0,0 +1,151 @@
+"""Delegated identity-token resolution for MultiQS sources (FEAT-159)."""
+from __future__ import annotations
+
+import logging
+from dataclasses import dataclass
+from datetime import datetime, timezone
+from typing import Any, Optional
+
+from aiohttp import web
+
+from ..exceptions import QueryException
+
+logger = logging.getLogger(__name__)
+
+ONEDRIVE_PROVIDER: str = "onedrive"
+IDENTITY_LINK_PATH: str = "/api/v1/user/identities/link/{provider}"
+
+
+class DelegatedIdentityError(QueryException):
+    """No usable linked identity for a delegated source."""
+
+    default_code: int = 409
+    code: int = 409
+
+    def __init__(self, message: str, *, provider: str, user_id: Optional[int], reason: str) -> None:
+        super().__init__(message)
+        self.provider = provider
+        self.user_id = user_id
+        self.reason = reason
+        self.link_url = IDENTITY_LINK_PATH.format(provider=provider)
+
+
+@dataclass(frozen=True)
+class DelegatedToken:
+    """Resolved delegated access token and its optional expiry."""
+
+    access_token: str
+    expires_at: Optional[datetime]
+
+
+def user_id_from_session(session: Any) -> Optional[int]:
+    """Numeric user id from session[AUTH_SESSION_OBJECT]['user_id'] or session['user_id']."""
+    try:
+        from navigator_auth.conf import AUTH_SESSION_OBJECT
+    except ImportError:
+        AUTH_SESSION_OBJECT = "session"
+
+    if session is None or not hasattr(session, "get"):
+        return None
+    try:
+        session_data = session.get(AUTH_SESSION_OBJECT, {}) or {}
+        value = session_data.get("user_id") if hasattr(session_data, "get") else None
+        if value is None:
+            value = session.get("user_id")
+        if value is None or isinstance(value, bool):
+            return None
+        return int(value)
+    except (TypeError, ValueError, AttributeError):
+        return None
+
+
+def identity_provider(auth: Any) -> Any | None:
+    """auth.identity_provider (navigator-auth >=0.29.0) else auth._idp, else None."""
+    if auth is None:
+        return None
+    return getattr(auth, "identity_provider", None) or getattr(auth, "_idp", None)
+
+
+@dataclass(frozen=True)
+class SourceIdentityContext:
+    """Identity inputs carried from a request or scheduler invocation."""
+
+    user_id: Optional[int]
+    session: Any | None = None
+    auth: Any | None = None
+    origin: str = "request"
+
+    @classmethod
+    def from_request(cls, request: web.Request, session: Any) -> SourceIdentityContext:
+        return cls(
+            user_id=user_id_from_session(session),
+            session=session,
+            auth=request.app.get("auth") if request is not None else None,
+            origin="request",
+        )
+
+    @classmethod
+    def for_scheduler(cls, run_as_user_id: Optional[int], auth: Any) -> SourceIdentityContext:
+        return cls(user_id=run_as_user_id, session=None, auth=auth, origin="scheduler")
+
+
+def _identity_error(provider: str, user_id: Optional[int], reason: str, message: str) -> DelegatedIdentityError:
+    """Build the stable public error shape for delegated identity failures."""
+    logger.warning("Delegated identity resolution failed: user_id=%s provider=%s reason=%s", user_id, provider, reason)
+    return DelegatedIdentityError(message, provider=provider, user_id=user_id, reason=reason)
+
+
+async def resolve_delegated_token(
+    context: SourceIdentityContext | None, provider: str = ONEDRIVE_PROVIDER
+) -> DelegatedToken:
+    """Resolve an access token on the caller's loop (vault -> IdP -> re-cache)."""
+    user_id = context.user_id if context is not None else None
+    if user_id is None:
+        raise _identity_error(provider, user_id, "no_user", "A user identity is required.")
+
+    try:
+        from navigator_auth.conf import IDENTITY_REFRESH_LEEWAY
+        from navigator_auth.exceptions import AuthException, ConfigError, UserNotFound
+        from navigator_auth.identity.store import cache_credential, cached_credential
+        from navigator_auth.identity.types import TokenResponse
+    except ImportError as exc:
+        raise _identity_error(provider, user_id, "auth_unavailable", "Identity authentication is unavailable.") from exc
+
+    if context.session is not None:
+        credential = await cached_credential(context.session, provider)
+        if credential:
+            try:
+                token = TokenResponse.from_credential(credential)
+                if not token.is_expiring(IDENTITY_REFRESH_LEEWAY):
+                    expires_at = token.expires_at
+                    if expires_at is not None and expires_at.tzinfo is None:
+                        expires_at = expires_at.replace(tzinfo=timezone.utc)
+                    return DelegatedToken(access_token=token.access_token, expires_at=expires_at)
+            except (KeyError, TypeError, ValueError):
+                pass
+
+    idp = identity_provider(context.auth)
+    if idp is None:
+        raise _identity_error(provider, user_id, "auth_unavailable", "Identity authentication is unavailable.")
+    try:
+        credential = await idp.get_user_identity_credential(user_id, provider, auto_refresh=True)
+    except UserNotFound as exc:
+        raise _identity_error(provider, user_id, "not_linked", "No linked identity was found.") from exc
+    except (ConfigError, AuthException) as exc:
+        raise _identity_error(provider, user_id, "refresh_failed", "The linked identity could not be refreshed.") from exc
+
+    try:
+        token = TokenResponse.from_credential(credential)
+    except (KeyError, TypeError, ValueError) as exc:
+        raise _identity_error(provider, user_id, "refresh_failed", "The linked identity returned an invalid token.") from exc
+
+    if context.session is not None:
+        try:
+            await cache_credential(context.session, provider, credential)
+        except Exception:
+            logger.warning("Delegated identity cache failed: user_id=%s provider=%s reason=%s", user_id, provider, "refresh_failed")
+
+    expires_at = token.expires_at
+    if expires_at is not None and expires_at.tzinfo is None:
+        expires_at = expires_at.replace(tzinfo=timezone.utc)
+    return DelegatedToken(access_token=token.access_token, expires_at=expires_at)