@demicodes/provider-claude-code 0.1.0 → 0.2.0

package/README.md

@@ -5,8 +5,28 @@ and `listClaudeCodeModels()`.
 
 ```ts
 import { createClaudeCodeProvider, listClaudeCodeModels } from '@demicodes/provider-claude-code'
+
+const provider = createClaudeCodeProvider()
+// provider.auth, provider.quota, provider.credentials (multi-account pool by default)
 ```
 
+## Auth and credentials
+
+- Default material: `CLAUDE_CODE_OAUTH_TOKEN` or macOS Keychain (`Claude Code-credentials`).
+- Multi-credential pool under `$DEMI_HOME/credentials/claude-code/`; active token is
+  injected into the CLI child as `CLAUDE_CODE_OAUTH_TOKEN`.
+- Lifecycle: `beginLogin` → `claude auth login` → `importDefault` / `add` → `setActive`.
+- Changing active credential forces a cold restart of a long-lived CLI process.
+
+See [docs/provider-global-credentials.md](../../docs/provider-global-credentials.md).
+
+## Quota
+
+- **probe** (cost: `free`): `GET /api/oauth/usage` with the active OAuth token.
+- **observe**: stream-json `rate_limits` bodies (and unified rate-limit headers when present).
+
+See [docs/provider-quota.md](../../docs/provider-quota.md).
+
 > Diagnostics: the transport writes a raw request/response wire log (including
 > prompts) to `$TMPDIR/demi-claude-wire` by default. Disable with
 > `DEMI_CLAUDE_WIRE_LOG=0`. See [SECURITY](../../SECURITY.md).

package/dist/index.d.mts

@@ -1,5 +1,5 @@
-import { ModelPolicy, Provider, ProviderModelList } from "@demicodes/provider";
-
+import { ModelPolicy, Provider, ProviderAuthState, ProviderCredentials, ProviderModelList, ProviderQuota, ProviderQuotaProbeResult } from "@demicodes/provider";
+import { FileCredentialPool } from "@demicodes/provider/credentials-pool";
 //#region src/models.d.ts
 interface ClaudeCodeModelCatalogOptions {
   fetch?: ModelCatalogFetch;
@@ -10,12 +10,60 @@ interface ClaudeCodeModelCatalogOptions {
 type ModelCatalogFetch = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
 declare function listClaudeCodeModels(options?: ClaudeCodeModelCatalogOptions): Promise<ProviderModelList>;
 //#endregion
+//#region src/oauth.d.ts
+interface ClaudeCodeOAuthAccess {
+  accessToken: string;
+  subscriptionType?: string | null;
+  rateLimitTier?: string | null;
+}
+/**
+ * Resolve Claude Code consumer OAuth access for quota APIs.
+ * Order: options env CLAUDE_CODE_OAUTH_TOKEN, then macOS Keychain "Claude Code-credentials".
+ * Prefer injecting {@link ClaudeCodeAuthStore} when multi-credential is enabled.
+ */
+declare function resolveClaudeCodeOAuthAccess(): Promise<ClaudeCodeOAuthAccess | null>;
+//#endregion
+//#region src/auth.d.ts
+interface ClaudeCodeAuthStore {
+  status(): Promise<ProviderAuthState>;
+  resolveAccess(options?: {
+    forceRefresh?: boolean;
+  }): Promise<ClaudeCodeOAuthAccess>;
+}
+interface FileClaudeCodeAuthStoreOptions {
+  /** Optional path to oauth.json (pool entry). */
+  oauthFile?: string;
+  /** Prefer this token over env/keychain when set (tests / static). */
+  accessToken?: string | null;
+}
+/**
+ * Resolves Claude OAuth: explicit token → oauth file → CLAUDE_CODE_OAUTH_TOKEN → keychain.
+ */
+declare class FileClaudeCodeAuthStore implements ClaudeCodeAuthStore {
+  private readonly oauthFile;
+  private readonly accessToken;
+  constructor(options?: FileClaudeCodeAuthStoreOptions);
+  status(): Promise<ProviderAuthState>;
+  resolveAccess(): Promise<ClaudeCodeOAuthAccess>;
+}
+declare class StaticClaudeCodeAuthStore implements ClaudeCodeAuthStore {
+  private readonly access;
+  constructor(access: ClaudeCodeOAuthAccess);
+  status(): Promise<ProviderAuthState>;
+  resolveAccess(): Promise<ClaudeCodeOAuthAccess>;
+}
+//#endregion
 //#region src/provider.d.ts
 interface ClaudeCodeProviderOptions {
   id?: string;
   displayName?: string;
   claudePath?: string;
   models?: ModelPolicy;
+  /** Demi state root for credential pool (`$DEMI_HOME` / `~/.demi`). */
+  stateDir?: string;
+  /** When true (default), attach multi-credential pool + global switch. */
+  credentials?: boolean;
+  authStore?: ClaudeCodeAuthStore;
 }
 declare function createClaudeCodeProvider(options?: ClaudeCodeProviderOptions): Provider;
 //#endregion
@@ -27,4 +75,41 @@ declare function createClaudeCodeProvider(options?: ClaudeCodeProviderOptions):
  */
 declare function resolveWireLogDir(): string | null;
 //#endregion
-export { type ClaudeCodeModelCatalogOptions, type ClaudeCodeProviderOptions, createClaudeCodeProvider, listClaudeCodeModels, resolveWireLogDir };
+//#region src/quota.d.ts
+interface ClaudeCodeQuotaOptions {
+  providerId?: string;
+  /** Override token resolution (tests / custom stores). */
+  resolveAccess?: () => Promise<ClaudeCodeOAuthAccess | null>;
+  fetch?: (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
+  usageUrl?: string;
+}
+/**
+ * Active probe: GET /api/oauth/usage (Claude.ai consumer plan windows).
+ * Observation: anthropic-ratelimit-unified-* response headers.
+ */
+declare function createClaudeCodeQuota(options?: ClaudeCodeQuotaOptions): ProviderQuota;
+/** Claude CLI stream-json / status envelopes that embed `rate_limits`. */
+declare function observeClaudeStreamBody(body: unknown): ProviderQuotaProbeResult | null;
+declare function mapClaudeUsagePayload(payload: unknown, access?: ClaudeCodeOAuthAccess | null): ProviderQuotaProbeResult;
+/** Map anthropic-ratelimit-unified-* headers into a coarse snapshot. */
+declare function observeClaudeRateLimitHeaders(headers: Headers | undefined): ProviderQuotaProbeResult | null;
+//#endregion
+//#region src/credentials.d.ts
+declare class PoolAwareClaudeCodeAuthStore implements ClaudeCodeAuthStore {
+  private readonly pool;
+  constructor(pool: FileCredentialPool);
+  status(): Promise<import("@demicodes/provider").ProviderAuthState>;
+  resolveAccess(): Promise<ClaudeCodeOAuthAccess>;
+  private currentStore;
+}
+declare function openClaudeCodeCredentialPool(options?: {
+  stateDir?: string;
+}): FileCredentialPool;
+declare function createClaudeCodeCredentials(pool: FileCredentialPool, authStore: ClaudeCodeAuthStore, options?: {
+  loginCommand?: string;
+  loginArgs?: string[];
+  quota?: ProviderQuota | null;
+  onActiveChange?: () => void;
+}): ProviderCredentials;
+//#endregion
+export { type ClaudeCodeAuthStore, type ClaudeCodeModelCatalogOptions, type ClaudeCodeOAuthAccess, type ClaudeCodeProviderOptions, type ClaudeCodeQuotaOptions, FileClaudeCodeAuthStore, PoolAwareClaudeCodeAuthStore, StaticClaudeCodeAuthStore, createClaudeCodeCredentials, createClaudeCodeProvider, createClaudeCodeQuota, listClaudeCodeModels, mapClaudeUsagePayload, observeClaudeRateLimitHeaders, observeClaudeStreamBody, openClaudeCodeCredentialPool, resolveClaudeCodeOAuthAccess, resolveWireLogDir };

package/dist/index.mjs

@@ -1,13 +1,16 @@
 import { errorMessage, isRecord, nonEmptyString, numberOrNull, stringOrNull } from "@demicodes/utils";
-import { randomUUID } from "node:crypto";
-import { applyModelPolicy, defineProvider } from "@demicodes/provider";
+import { createHash, randomUUID } from "node:crypto";
+import { applyModelPolicy, clampUsedPercent, createProviderQuota, defineProvider, numberHeader, severityFromUsedPercent, toolResultContentToText, unixSecondsToIso } from "@demicodes/provider";
+import { execFile, spawn } from "node:child_process";
+import { readFile } from "node:fs/promises";
+import { promisify } from "node:util";
+import process$1 from "node:process";
+import { FileCredentialPool, credentialIdFromIdentity, runVendorLoginCommand } from "@demicodes/provider/credentials-pool";
 import { Buffer as Buffer$1 } from "node:buffer";
-import { spawn } from "node:child_process";
 import { appendFileSync, mkdirSync, statSync } from "node:fs";
 import { createInterface } from "node:readline";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import process$1 from "node:process";
 //#region src/models.ts
 const DEFAULT_MODELS_DEV_URL = "https://models.dev/api.json";
 const DEFAULT_MINIMUM_MODEL_VERSION = "4.6";
@@ -94,7 +97,8 @@ const CLAUDE_FAMILY_RANK = {
 	haiku: 2
 };
 function claudeFamilyRank(id) {
-	return CLAUDE_FAMILY_RANK[id.slice(7).split("-")[0] ?? ""] ?? 3;
+	const family = id.slice(7).split("-")[0] ?? "";
+	return CLAUDE_FAMILY_RANK[family] ?? 3;
 }
 /** Canonical catalog order: flagship family first (Opus > Sonnet > Haiku > others), newest version first. */
 function compareClaudeModels(a, b) {
@@ -196,6 +200,235 @@ function reasoningEfforts(value) {
 	return efforts.length > 0 ? efforts : [];
 }
 //#endregion
+//#region src/auth.ts
+const execFileAsync = promisify(execFile);
+/**
+* Resolves Claude OAuth: explicit token → oauth file → CLAUDE_CODE_OAUTH_TOKEN → keychain.
+*/
+var FileClaudeCodeAuthStore = class {
+	oauthFile;
+	accessToken;
+	constructor(options = {}) {
+		this.oauthFile = options.oauthFile ?? null;
+		this.accessToken = nonEmptyString(options.accessToken) ?? null;
+	}
+	async status() {
+		try {
+			return {
+				status: "authenticated",
+				accountLabel: nonEmptyString((await this.resolveAccess()).subscriptionType) ?? "Claude Code"
+			};
+		} catch (error) {
+			if (error instanceof ClaudeCodeAuthError && error.code === "auth_missing") return {
+				status: "unauthenticated",
+				message: error.message
+			};
+			return {
+				status: "error",
+				message: error instanceof Error ? error.message : String(error)
+			};
+		}
+	}
+	async resolveAccess() {
+		if (this.accessToken) return { accessToken: this.accessToken };
+		if (this.oauthFile) try {
+			const raw = JSON.parse(await readFile(this.oauthFile, "utf8"));
+			if (!isRecord(raw)) throw new ClaudeCodeAuthError("auth_invalid", `Invalid OAuth file: ${this.oauthFile}`);
+			const accessToken = nonEmptyString(raw.accessToken) ?? nonEmptyString(raw.access_token);
+			if (!accessToken) throw new ClaudeCodeAuthError("auth_missing", `No accessToken in ${this.oauthFile}`);
+			return {
+				accessToken,
+				subscriptionType: nonEmptyString(raw.subscriptionType) ?? null,
+				rateLimitTier: nonEmptyString(raw.rateLimitTier) ?? null
+			};
+		} catch (error) {
+			if (error instanceof ClaudeCodeAuthError) throw error;
+			throw new ClaudeCodeAuthError("auth_missing", `Failed to read Claude OAuth file ${this.oauthFile}: ${error instanceof Error ? error.message : String(error)}`);
+		}
+		const fromEnv = nonEmptyString(process$1.env.CLAUDE_CODE_OAUTH_TOKEN);
+		if (fromEnv) return { accessToken: fromEnv };
+		if (process$1.platform === "darwin") try {
+			const { stdout } = await execFileAsync("security", [
+				"find-generic-password",
+				"-s",
+				"Claude Code-credentials",
+				"-w"
+			], {
+				encoding: "utf8",
+				timeout: 5e3
+			});
+			const parsed = JSON.parse(stdout.trim());
+			if (!isRecord(parsed)) throw new ClaudeCodeAuthError("auth_missing", "Claude Code keychain item is not a JSON object");
+			const oauth = isRecord(parsed.claudeAiOauth) ? parsed.claudeAiOauth : null;
+			if (!oauth) throw new ClaudeCodeAuthError("auth_missing", "Claude Code keychain missing claudeAiOauth");
+			const accessToken = nonEmptyString(oauth.accessToken);
+			if (!accessToken) throw new ClaudeCodeAuthError("auth_missing", "Claude Code keychain missing accessToken");
+			return {
+				accessToken,
+				subscriptionType: nonEmptyString(oauth.subscriptionType) ?? null,
+				rateLimitTier: nonEmptyString(oauth.rateLimitTier) ?? null
+			};
+		} catch (error) {
+			if (error instanceof ClaudeCodeAuthError) throw error;
+		}
+		throw new ClaudeCodeAuthError("auth_missing", "Claude Code OAuth access token not found (set CLAUDE_CODE_OAUTH_TOKEN or log in with Claude Code)");
+	}
+};
+var StaticClaudeCodeAuthStore = class {
+	access;
+	constructor(access) {
+		this.access = access;
+	}
+	async status() {
+		return {
+			status: "authenticated",
+			accountLabel: nonEmptyString(this.access.subscriptionType) ?? "Claude Code"
+		};
+	}
+	async resolveAccess() {
+		return this.access;
+	}
+};
+var ClaudeCodeAuthError = class extends Error {
+	code;
+	constructor(code, message) {
+		super(message);
+		this.code = code;
+		this.name = "ClaudeCodeAuthError";
+	}
+};
+//#endregion
+//#region src/credentials.ts
+var PoolAwareClaudeCodeAuthStore = class {
+	pool;
+	constructor(pool) {
+		this.pool = pool;
+	}
+	async status() {
+		return this.currentStore().then((s) => s.status());
+	}
+	async resolveAccess() {
+		return this.currentStore().then((s) => s.resolveAccess());
+	}
+	async currentStore() {
+		await this.pool.ensureActivePointer();
+		const activeId = await this.pool.getActiveId();
+		if (activeId) return new FileClaudeCodeAuthStore({ oauthFile: this.pool.secretPath(activeId) });
+		return new FileClaudeCodeAuthStore();
+	}
+};
+function openClaudeCodeCredentialPool(options = {}) {
+	return new FileCredentialPool({
+		stateDir: options.stateDir,
+		providerKey: "claude-code",
+		secretFileName: "oauth.json"
+	});
+}
+function createClaudeCodeCredentials(pool, authStore, options = {}) {
+	const loginCommand = options.loginCommand ?? "claude";
+	const loginArgs = options.loginArgs ?? ["auth", "login"];
+	const capability = () => ({
+		mode: "supported",
+		canBeginLogin: true,
+		canImportDefault: true,
+		canAdd: true,
+		multi: true
+	});
+	const getActive = async () => {
+		await pool.ensureActivePointer();
+		return {
+			credentialId: await pool.getActiveId(),
+			status: await authStore.status()
+		};
+	};
+	const setActive = async (credentialId) => {
+		await pool.setActiveId(credentialId);
+		options.quota?.clearLatest?.();
+		options.onActiveChange?.();
+		return getActive();
+	};
+	const importAccess = async (access, source) => {
+		const token = nonEmptyString(access.accessToken);
+		if (!token) throw new ClaudeCodeAuthError("auth_missing", "No Claude access token to import");
+		const identityKey = nonEmptyString(access.subscriptionType) != null ? `token:${createHash("sha256").update(token).digest("hex").slice(0, 16)}:${access.subscriptionType}` : `token:${createHash("sha256").update(token).digest("hex").slice(0, 16)}`;
+		const label = nonEmptyString(access.subscriptionType) ?? `claude-${identityKey.slice(-8)}`;
+		const id = (await pool.findByIdentityKey(identityKey))?.id ?? credentialIdFromIdentity(identityKey, label);
+		const meta = {
+			id,
+			label,
+			detail: nonEmptyString(access.rateLimitTier) ?? null,
+			updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+			source,
+			identityKey
+		};
+		const secret = {
+			accessToken: token,
+			subscriptionType: access.subscriptionType ?? null,
+			rateLimitTier: access.rateLimitTier ?? null
+		};
+		await pool.writeEntry(meta, `${JSON.stringify(secret, null, 2)}\n`);
+		if (!await pool.getActiveId()) await pool.setActiveId(id);
+		options.quota?.clearLatest?.();
+		options.onActiveChange?.();
+		return {
+			id: meta.id,
+			label: meta.label,
+			detail: meta.detail,
+			updatedAt: meta.updatedAt
+		};
+	};
+	return {
+		capability,
+		list: () => pool.list(),
+		getActive,
+		setActive,
+		beginLogin: async (loginOptions) => {
+			const result = await runVendorLoginCommand(loginCommand, loginArgs, { signal: loginOptions?.signal });
+			if (result.status === "completed") return { status: "completed" };
+			if (result.status === "cancelled") return { status: "cancelled" };
+			if (result.status === "unavailable") return {
+				status: "unavailable",
+				message: result.message ?? "Login unavailable"
+			};
+			return {
+				status: "failed",
+				message: result.message ?? "Login failed"
+			};
+		},
+		importDefault: async () => {
+			const vendor = new FileClaudeCodeAuthStore();
+			let access;
+			try {
+				access = await vendor.resolveAccess();
+			} catch {
+				throw new ClaudeCodeAuthError("auth_missing", "No Claude Code OAuth to import. Run claude auth login or beginLogin first.");
+			}
+			return importAccess(access, "vendor:default");
+		},
+		add: async (input) => {
+			if (typeof input.accessToken === "string") return importAccess({
+				accessToken: input.accessToken,
+				subscriptionType: typeof input.subscriptionType === "string" ? input.subscriptionType : null,
+				rateLimitTier: typeof input.rateLimitTier === "string" ? input.rateLimitTier : null
+			}, "add:accessToken");
+			if (isRecord(input.oauth) && typeof input.oauth.accessToken === "string") {
+				const oauth = input.oauth;
+				return importAccess({
+					accessToken: oauth.accessToken,
+					subscriptionType: typeof oauth.subscriptionType === "string" ? oauth.subscriptionType : null,
+					rateLimitTier: typeof oauth.rateLimitTier === "string" ? oauth.rateLimitTier : null
+				}, "add:oauth");
+			}
+			throw new Error("Claude credentials.add expects accessToken or oauth.accessToken");
+		},
+		remove: async (credentialId) => {
+			await pool.remove(credentialId);
+			options.quota?.clearLatest?.();
+			options.onActiveChange?.();
+		}
+	};
+}
+//#endregion
 //#region src/jsonl.ts
 /**
 * Builds the input messages used to prime a *fresh* Claude CLI process with prior
@@ -273,7 +506,7 @@ function renderToolUseText(toolName, input) {
 	return `[Earlier in this conversation I called the tool ${toolName} with input: ${safeJson(input)}.`;
 }
 function renderToolResultText(toolName, item) {
-	const body = toolResultToText(item.output);
+	const body = toolResultContentToText(item.output);
 	const suffix = toolName ? ` from ${toolName}` : "";
 	return item.isError ? `It returned an error${suffix}: ${body}]` : `It returned${suffix}: ${body}]`;
 }
@@ -338,6 +571,10 @@ function userContentToClaude(content) {
 			type: "image",
 			source: imageSourceToClaude(block.source)
 		};
+		if (block.type === "video") return {
+			type: "text",
+			text: "[video]"
+		};
 		if (block.type === "document") return documentSourceToClaude(block.source);
 		return {
 			type: "text",
@@ -370,11 +607,30 @@ function assistantItemToClaudeContent(item) {
 	};
 }
 function toolResultToClaudeContent(item) {
+	const hasImage = item.output.some((block) => block.type !== "text");
 	return {
 		type: "tool_result",
 		tool_use_id: item.toolUseId,
 		is_error: item.isError,
-		content: toolResultToText(item.output)
+		content: hasImage ? item.output.map(toolResultBlockToClaude) : toolResultContentToText(item.output)
+	};
+}
+function toolResultBlockToClaude(block) {
+	if (block.type === "text") return {
+		type: "text",
+		text: block.text
+	};
+	if (block.type === "video") return {
+		type: "text",
+		text: `[video:${block.source.mediaType}]`
+	};
+	return {
+		type: "image",
+		source: {
+			type: "base64",
+			media_type: block.source.mediaType,
+			data: block.source.data
+		}
 	};
 }
 function imageSourceToClaude(source) {
@@ -399,9 +655,6 @@ function documentSourceToClaude(source) {
 		title: source.fileName
 	};
 }
-function toolResultToText(output) {
-	return output.map((block) => block.type === "text" ? block.text : `[image:${block.source.mediaType}]`).join("\n");
-}
 function bytesToBase64(data) {
 	return Buffer$1.from(data.buffer, data.byteOffset, data.byteLength).toString("base64");
 }
@@ -604,6 +857,157 @@ function stripMcpToolPrefix(name) {
 	return /^mcp__[^_]+__(.+)$/.exec(name)?.[1] ?? name;
 }
 //#endregion
+//#region src/oauth.ts
+/**
+* Resolve Claude Code consumer OAuth access for quota APIs.
+* Order: options env CLAUDE_CODE_OAUTH_TOKEN, then macOS Keychain "Claude Code-credentials".
+* Prefer injecting {@link ClaudeCodeAuthStore} when multi-credential is enabled.
+*/
+async function resolveClaudeCodeOAuthAccess() {
+	try {
+		return await new FileClaudeCodeAuthStore().resolveAccess();
+	} catch {
+		return null;
+	}
+}
+//#endregion
+//#region src/quota.ts
+const DEFAULT_USAGE_URL = "https://api.anthropic.com/api/oauth/usage";
+const DEFAULT_OAUTH_BETA = "oauth-2025-04-20";
+/**
+* Active probe: GET /api/oauth/usage (Claude.ai consumer plan windows).
+* Observation: anthropic-ratelimit-unified-* response headers.
+*/
+function createClaudeCodeQuota(options = {}) {
+	const providerId = options.providerId ?? "claude-code";
+	const fetchImpl = options.fetch ?? fetch;
+	const usageUrl = options.usageUrl ?? DEFAULT_USAGE_URL;
+	const resolveAccess = options.resolveAccess ?? resolveClaudeCodeOAuthAccess;
+	return createProviderQuota({
+		providerId,
+		canProbe: true,
+		canObserve: true,
+		probeCost: "free",
+		staleAfterMs: 6e4,
+		probe: async ({ signal } = {}) => {
+			const access = await resolveAccess();
+			if (!access?.accessToken) throw new Error("Claude Code OAuth access token not found (set CLAUDE_CODE_OAUTH_TOKEN or log in with Claude Code)");
+			const headers = new Headers({
+				authorization: `Bearer ${access.accessToken}`,
+				"anthropic-beta": DEFAULT_OAUTH_BETA,
+				accept: "application/json",
+				"user-agent": "demi-provider-claude-code"
+			});
+			const response = await fetchImpl(usageUrl, {
+				method: "GET",
+				headers,
+				signal
+			});
+			if (!response.ok) {
+				const body = await response.text().catch(() => "");
+				throw new Error(`Claude usage request failed (${response.status}): ${body.slice(0, 200)}`);
+			}
+			return mapClaudeUsagePayload(await response.json(), access);
+		},
+		observe: ({ headers, body }) => {
+			if (headers) {
+				const fromHeaders = observeClaudeRateLimitHeaders(headers);
+				if (fromHeaders) return fromHeaders;
+			}
+			if (body !== void 0) return observeClaudeStreamBody(body);
+			return null;
+		}
+	});
+}
+/** Claude CLI stream-json / status envelopes that embed `rate_limits`. */
+function observeClaudeStreamBody(body) {
+	if (!isRecord(body)) return null;
+	const rateLimits = isRecord(body.rate_limits) ? body.rate_limits : isRecord(body.message) && isRecord(body.message.rate_limits) ? body.message.rate_limits : null;
+	if (!rateLimits) return null;
+	const partial = mapClaudeUsagePayload(rateLimits);
+	return partial.windows.length > 0 ? {
+		windows: partial.windows,
+		raw: rateLimits
+	} : null;
+}
+function mapClaudeUsagePayload(payload, access) {
+	const record = isRecord(payload) ? payload : {};
+	const windows = [];
+	pushWindow(windows, "five_hour", "5h session", record.five_hour);
+	pushWindow(windows, "seven_day", "7d all models", record.seven_day);
+	pushWindow(windows, "seven_day_sonnet", "7d Sonnet", record.seven_day_sonnet);
+	pushWindow(windows, "seven_day_opus", "7d Opus", record.seven_day_opus);
+	if (Array.isArray(record.limits)) for (const item of record.limits) {
+		if (!isRecord(item)) continue;
+		const kind = typeof item.kind === "string" ? item.kind : null;
+		if (!kind) continue;
+		if (kind === "session" || kind === "weekly_all") continue;
+		const percent = clampUsedPercent(typeof item.percent === "number" ? item.percent : null);
+		const scopeLabel = isRecord(item.scope) && isRecord(item.scope.model) && typeof item.scope.model.display_name === "string" ? item.scope.model.display_name : void 0;
+		windows.push({
+			id: `limit:${kind}${scopeLabel ? `:${scopeLabel}` : ""}`,
+			label: scopeLabel ? `${kind} (${scopeLabel})` : kind,
+			usedPercent: percent,
+			unit: "percent",
+			resetsAt: unixSecondsToIso(item.resets_at) ?? stringOrNull(item.resets_at),
+			severity: item.severity === "critical" || item.severity === "warning" || item.severity === "normal" ? item.severity : severityFromUsedPercent(percent),
+			scope: scopeLabel ? {
+				kind: "model",
+				label: scopeLabel
+			} : { kind }
+		});
+	}
+	const planId = access?.subscriptionType ?? null;
+	return {
+		plan: planId ? {
+			id: planId,
+			label: planId,
+			raw: access?.rateLimitTier ?? planId
+		} : null,
+		accountLabel: null,
+		windows,
+		raw: payload
+	};
+}
+/** Map anthropic-ratelimit-unified-* headers into a coarse snapshot. */
+function observeClaudeRateLimitHeaders(headers) {
+	if (!headers) return null;
+	const status = headers.get("anthropic-ratelimit-unified-status");
+	const reset = headers.get("anthropic-ratelimit-unified-reset");
+	const claim = headers.get("anthropic-ratelimit-unified-representative-claim");
+	const overageUtil = headers.get("anthropic-ratelimit-unified-overage-period-channel-utilization");
+	if (!status && !reset && !claim && !overageUtil) return null;
+	const usedPercent = clampUsedPercent(numberHeader(headers, "anthropic-ratelimit-unified-overage-period-channel-utilization"));
+	return {
+		windows: [{
+			id: "unified",
+			label: claim ?? "Unified rate limit",
+			usedPercent,
+			unit: "percent",
+			resetsAt: unixSecondsToIso(reset),
+			severity: status === "rejected" || status === "allowed_warning" ? status === "rejected" ? "critical" : "warning" : severityFromUsedPercent(usedPercent)
+		}],
+		raw: {
+			status,
+			reset,
+			claim,
+			overageUtil
+		}
+	};
+}
+function pushWindow(windows, id, label, value) {
+	if (!isRecord(value)) return;
+	const usedPercent = clampUsedPercent(typeof value.utilization === "number" ? value.utilization : typeof value.used_percentage === "number" ? value.used_percentage : null);
+	windows.push({
+		id,
+		label,
+		usedPercent,
+		unit: "percent",
+		resetsAt: unixSecondsToIso(value.resets_at) ?? stringOrNull(value.resets_at),
+		severity: severityFromUsedPercent(usedPercent)
+	});
+}
+//#endregion
 //#region src/cli.ts
 function buildClaudeArgs(params) {
 	const args = [
@@ -630,13 +1034,15 @@ function buildClaudeArgs(params) {
 	if (params.thinkingEffort) args.push("--effort", params.thinkingEffort);
 	return args;
 }
-function buildClaudeEnv(base = process.env) {
+function buildClaudeEnv(base = process.env, options = {}) {
 	const env = {
 		...base,
 		DISABLE_AUTO_COMPACT: "1",
 		MAX_MCP_OUTPUT_TOKENS: "1000000"
 	};
 	delete env.CLAUDECODE;
+	const token = options.oauthAccessToken?.trim();
+	if (token) env.CLAUDE_CODE_OAUTH_TOKEN = token;
 	return env;
 }
 //#endregion
@@ -683,13 +1089,19 @@ function resolveSpawnCwd(cwd) {
 	try {
 		if (statSync(cwd).isDirectory()) return cwd;
 	} catch {}
-	return process.cwd();
+	return process$1.cwd();
 }
 var ClaudeCliTransportFactory = class {
 	claudePath;
+	resolveOAuthAccessToken;
 	constructor(options = {}) {
-		if (typeof options === "string") this.claudePath = options;
-		else this.claudePath = options.claudePath ?? "claude";
+		if (typeof options === "string") {
+			this.claudePath = options;
+			this.resolveOAuthAccessToken = null;
+		} else {
+			this.claudePath = options.claudePath ?? "claude";
+			this.resolveOAuthAccessToken = options.resolveOAuthAccessToken ?? null;
+		}
 	}
 	async start(request) {
 		const args = buildClaudeArgsForRequest(request);
@@ -701,9 +1113,10 @@ var ClaudeCliTransportFactory = class {
 			cwd: request.cwd,
 			args
 		});
+		const oauthAccessToken = this.resolveOAuthAccessToken ? await this.resolveOAuthAccessToken() : null;
 		return new ChildProcessClaudeTransport(spawn(this.claudePath, args, {
 			cwd: resolveSpawnCwd(request.cwd),
-			env: buildClaudeEnv(),
+			env: buildClaudeEnv(process$1.env, { oauthAccessToken }),
 			stdio: [
 				"pipe",
 				"pipe",
@@ -791,9 +1204,27 @@ function thinkingEffort(thinking) {
 //#region src/provider.ts
 var ClaudeCodeProvider = class {
 	transportFactory;
+	quota;
+	getActiveCredentialId;
 	active = null;
 	constructor(options = {}) {
-		this.transportFactory = options.transportFactory ?? new ClaudeCliTransportFactory({ claudePath: options.claudePath });
+		this.transportFactory = options.transportFactory ?? new ClaudeCliTransportFactory({
+			claudePath: options.claudePath,
+			resolveOAuthAccessToken: options.authStore ? async () => {
+				try {
+					return (await options.authStore.resolveAccess()).accessToken;
+				} catch {
+					return null;
+				}
+			} : void 0
+		});
+		this.quota = options.quota ?? null;
+		this.getActiveCredentialId = options.getActiveCredentialId ?? null;
+	}
+	observeQuotaFromMessage(message) {
+		try {
+			this.quota?.observeResponse?.({ body: message });
+		} catch {}
 	}
 	async *run(request) {
 		let active = null;
@@ -837,6 +1268,7 @@ var ClaudeCodeProvider = class {
 					return;
 				}
 				const raw = next.value;
+				this.observeQuotaFromMessage(raw);
 				const mapped = mapClaudeStdoutMessage(raw, {
 					ignoreAssistantContent: active.hasStreamed && isMessageType(raw, "assistant"),
 					ignoreAssistantToolUse: active.sdkMcpEnabled
@@ -894,17 +1326,18 @@ var ClaudeCodeProvider = class {
 	* the session changed, or the transcript was rewritten underneath us (compaction).
 	*/
 	async ensureActiveForRequest(request) {
+		const credentialId = this.getActiveCredentialId ? await this.getActiveCredentialId() : null;
 		const existing = this.active;
-		if (existing && existing.sessionId === request.sessionId && existing.modelId === request.modelId && existing.thinkingSig === thinkingSignature(request)) {
+		if (existing && existing.sessionId === request.sessionId && existing.modelId === request.modelId && existing.thinkingSig === thinkingSignature(request) && existing.credentialId === credentialId) {
 			if (existing.pendingControlRequest !== null || existing.pendingToolUseIds.length > 0 || !itemsDiverged(existing, request.items)) {
 				await this.sendContinuation(existing, request);
 				return existing;
 			}
 		}
 		if (existing) await this.disposeActive(existing);
-		return this.coldStart(request);
+		return this.coldStart(request, credentialId);
 	}
-	async coldStart(request) {
+	async coldStart(request, credentialId) {
 		const transport = await this.transportFactory.start(request);
 		const active = {
 			transport,
@@ -917,6 +1350,7 @@ var ClaudeCodeProvider = class {
 			sessionId: request.sessionId,
 			modelId: request.modelId,
 			thinkingSig: thinkingSignature(request),
+			credentialId,
 			sentUserMessageCount: 0,
 			firstUserSig: null
 		};
@@ -1095,14 +1529,32 @@ var ClaudeCodeProvider = class {
 function createClaudeCodeProvider(options = {}) {
 	const id = options.id ?? "claude-code";
 	const displayName = options.displayName ?? "Claude Code";
-	const runtimeOptions = { claudePath: options.claudePath };
+	const enableCredentials = options.credentials ?? options.authStore === void 0;
+	const pool = !options.authStore && enableCredentials ? openClaudeCodeCredentialPool({ stateDir: options.stateDir }) : null;
+	const authStore = options.authStore ?? (pool ? new PoolAwareClaudeCodeAuthStore(pool) : new FileClaudeCodeAuthStore());
+	const quota = createClaudeCodeQuota({
+		providerId: id,
+		resolveAccess: async () => {
+			try {
+				return await authStore.resolveAccess();
+			} catch {
+				return null;
+			}
+		}
+	});
+	const credentialsApi = pool ? createClaudeCodeCredentials(pool, authStore, { quota }) : void 0;
+	const runtimeOptions = {
+		claudePath: options.claudePath,
+		quota,
+		authStore,
+		getActiveCredentialId: pool ? () => pool.getActiveId() : void 0
+	};
 	return defineProvider({
 		id,
 		displayName,
-		auth: { status: () => ({
-			status: "unknown",
-			message: "Auth is checked when a Claude Code request runs"
-		}) },
+		auth: { status: () => authStore.status() },
+		quota,
+		...credentialsApi ? { credentials: credentialsApi } : {},
 		state: () => ({
 			status: "unknown",
 			message: "Runtime is checked when a Claude Code request runs"
@@ -1120,18 +1572,19 @@ function isControlResponseFor(value, requestId) {
 	if (!isRecord(value) || value.type !== "control_response" || !isRecord(value.response)) return false;
 	return value.response.request_id === requestId && value.response.subtype === "success";
 }
-function toolResultContentToText(output) {
-	return output.map((block) => block.type === "text" ? block.text : `[image:${block.source.mediaType}]`).join("\n");
-}
 function toolResultContentToMcp(output) {
 	return output.map((block) => {
 		if (block.type === "text") return {
 			type: "text",
 			text: block.text
 		};
+		if (block.type === "video") return {
+			type: "text",
+			text: `[video:${block.source.mediaType}]`
+		};
 		return {
 			type: "image",
-			data: Buffer.from(block.source.data).toString("base64"),
+			data: block.source.data,
 			mimeType: block.source.mediaType
 		};
 	});
@@ -1163,4 +1616,4 @@ function itemsDiverged(active, items) {
 	return false;
 }
 //#endregion
-export { createClaudeCodeProvider, listClaudeCodeModels, resolveWireLogDir };
+export { FileClaudeCodeAuthStore, PoolAwareClaudeCodeAuthStore, StaticClaudeCodeAuthStore, createClaudeCodeCredentials, createClaudeCodeProvider, createClaudeCodeQuota, listClaudeCodeModels, mapClaudeUsagePayload, observeClaudeRateLimitHeaders, observeClaudeStreamBody, openClaudeCodeCredentialPool, resolveClaudeCodeOAuthAccess, resolveWireLogDir };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@demicodes/provider-claude-code",
   "description": "Claude Code provider adapter for Demi.",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "private": false,
   "type": "module",
   "exports": {
@@ -12,13 +12,13 @@
     }
   },
   "dependencies": {
-    "@demicodes/core": "workspace:*",
-    "@demicodes/provider": "workspace:*",
-    "@demicodes/utils": "workspace:*"
+    "@demicodes/core": "0.2.0",
+    "@demicodes/provider": "0.2.0",
+    "@demicodes/utils": "0.2.0"
   },
   "devDependencies": {
-    "@demicodes/agent": "workspace:*",
-    "@demicodes/shell": "workspace:*"
+    "@demicodes/agent": "0.2.0",
+    "@demicodes/shell": "0.2.0"
   },
   "license": "Apache-2.0",
   "main": "./dist/index.mjs",