@demicodes/provider-claude-code 0.10.3 → 0.11.0

package/README.md

@@ -5,8 +5,38 @@ and `listClaudeCodeModels()`.
 
 ```ts
 import { createClaudeCodeProvider, listClaudeCodeModels } from '@demicodes/provider-claude-code'
+
+const provider = createClaudeCodeProvider()
+// provider.auth, provider.quota, provider.credentials (multi-account pool by default)
 ```
 
+## Auth and credentials
+
+- Default material: `CLAUDE_CODE_OAUTH_TOKEN` or macOS Keychain (`Claude Code-credentials`).
+- Multi-credential pool under `$DEMI_HOME/credentials/claude-code/`; active token is
+  injected into the CLI child as `CLAUDE_CODE_OAUTH_TOKEN`.
+- Lifecycle: `beginLogin` → `claude auth login` → `importDefault` / `add` → `setActive`.
+- Changing active credential forces a cold restart of a long-lived CLI process.
+
+See [docs/provider-global-credentials.md](../../docs/provider-global-credentials.md).
+
+## Quota
+
+- **probe** (cost: `free`): `GET /api/oauth/usage` with the active OAuth token.
+- **observe**: stream-json `rate_limits` bodies (and unified rate-limit headers when present).
+
+See [docs/provider-quota.md](../../docs/provider-quota.md).
+
+## Tool-call batches
+
+Claude Code's SDK-MCP control channel can hold later `tools/call` callbacks until
+the preceding callback receives a result, even when the model emitted several
+`tool_use` blocks in one response. The provider preserves the model's original
+batch and tool-use IDs for the host scheduler, then matches the completed
+results to SDK-MCP callbacks as the CLI releases them.
+
+See [docs/tool-call-concurrency.md](../../docs/tool-call-concurrency.md).
+
 > Diagnostics: the transport writes a raw request/response wire log (including
 > prompts) to `$TMPDIR/demi-claude-wire` by default. Disable with
 > `DEMI_CLAUDE_WIRE_LOG=0`. See [SECURITY](../../SECURITY.md).

package/dist/index.d.mts

@@ -1,5 +1,5 @@
-import { ModelPolicy, Provider, ProviderModelList, ProviderQuota, ProviderQuotaProbeResult } from "@demicodes/provider";
-
+import { ModelPolicy, Provider, ProviderAuthState, ProviderCredentials, ProviderModelList, ProviderQuota, ProviderQuotaProbeResult } from "@demicodes/provider";
+import { FileCredentialPool } from "@demicodes/provider/credentials-pool";
 //#region src/models.d.ts
 interface ClaudeCodeModelCatalogOptions {
   fetch?: ModelCatalogFetch;
@@ -10,12 +10,74 @@ interface ClaudeCodeModelCatalogOptions {
 type ModelCatalogFetch = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
 declare function listClaudeCodeModels(options?: ClaudeCodeModelCatalogOptions): Promise<ProviderModelList>;
 //#endregion
+//#region src/oauth.d.ts
+/**
+ * Where a resolved token came from. Callers that inject the token into a
+ * spawned CLI must skip `keychain`: that token is the CLI's own short-lived
+ * credential, and injecting it via CLAUDE_CODE_OAUTH_TOKEN disables the CLI's
+ * refresh flow — the run starts 401ing as soon as the token expires. Owned
+ * sources (static/file/env) are the caller's responsibility and inject as-is.
+ */
+type ClaudeCodeOAuthSource = 'static' | 'file' | 'env' | 'keychain';
+interface ClaudeCodeOAuthAccess {
+  accessToken: string;
+  source: ClaudeCodeOAuthSource;
+  subscriptionType?: string | null;
+  rateLimitTier?: string | null;
+}
+/**
+ * Resolve Claude Code consumer OAuth access for quota APIs.
+ * Order: options env CLAUDE_CODE_OAUTH_TOKEN, then macOS Keychain "Claude Code-credentials".
+ * Prefer injecting {@link ClaudeCodeAuthStore} when multi-credential is enabled.
+ */
+declare function resolveClaudeCodeOAuthAccess(): Promise<ClaudeCodeOAuthAccess | null>;
+//#endregion
+//#region src/auth.d.ts
+interface ClaudeCodeAuthStore {
+  status(): Promise<ProviderAuthState>;
+  resolveAccess(options?: {
+    forceRefresh?: boolean;
+  }): Promise<ClaudeCodeOAuthAccess>;
+}
+/** Renews a pool oauth secret (wired to `refreshClaudeCodeSecret`; injectable in tests). */
+type ClaudeCodeSecretRefresh = (secret: Record<string, unknown>) => Promise<Record<string, unknown>>;
+interface FileClaudeCodeAuthStoreOptions {
+  /** Optional path to oauth.json (pool entry). */
+  oauthFile?: string;
+  /** Prefer this token over env/keychain when set (tests / static). */
+  accessToken?: string | null;
+  /** Renews the oauth file when its access token nears expiry. */
+  refresh?: ClaudeCodeSecretRefresh;
+}
+/**
+ * Resolves Claude OAuth: explicit token → oauth file → CLAUDE_CODE_OAUTH_TOKEN → keychain.
+ */
+declare class FileClaudeCodeAuthStore implements ClaudeCodeAuthStore {
+  private readonly oauthFile;
+  private readonly accessToken;
+  private readonly refresh;
+  constructor(options?: FileClaudeCodeAuthStoreOptions);
+  status(): Promise<ProviderAuthState>;
+  resolveAccess(): Promise<ClaudeCodeOAuthAccess>;
+}
+declare class StaticClaudeCodeAuthStore implements ClaudeCodeAuthStore {
+  private readonly access;
+  constructor(access: ClaudeCodeOAuthAccess);
+  status(): Promise<ProviderAuthState>;
+  resolveAccess(): Promise<ClaudeCodeOAuthAccess>;
+}
+//#endregion
 //#region src/provider.d.ts
 interface ClaudeCodeProviderOptions {
   id?: string;
   displayName?: string;
   claudePath?: string;
   models?: ModelPolicy;
+  /** Demi state root for credential pool (`$DEMI_HOME` / `~/.demi`). */
+  stateDir?: string;
+  /** When true (default), attach multi-credential pool + global switch. */
+  credentials?: boolean;
+  authStore?: ClaudeCodeAuthStore;
 }
 declare function createClaudeCodeProvider(options?: ClaudeCodeProviderOptions): Provider;
 //#endregion
@@ -27,18 +89,6 @@ declare function createClaudeCodeProvider(options?: ClaudeCodeProviderOptions):
  */
 declare function resolveWireLogDir(): string | null;
 //#endregion
-//#region src/oauth.d.ts
-interface ClaudeCodeOAuthAccess {
-  accessToken: string;
-  subscriptionType?: string | null;
-  rateLimitTier?: string | null;
-}
-/**
- * Resolve Claude Code consumer OAuth access for quota APIs.
- * Order: options env CLAUDE_CODE_OAUTH_TOKEN, then macOS Keychain "Claude Code-credentials".
- */
-declare function resolveClaudeCodeOAuthAccess(): Promise<ClaudeCodeOAuthAccess | null>;
-//#endregion
 //#region src/quota.d.ts
 interface ClaudeCodeQuotaOptions {
   providerId?: string;
@@ -58,4 +108,56 @@ declare function mapClaudeUsagePayload(payload: unknown, access?: ClaudeCodeOAut
 /** Map anthropic-ratelimit-unified-* headers into a coarse snapshot. */
 declare function observeClaudeRateLimitHeaders(headers: Headers | undefined): ProviderQuotaProbeResult | null;
 //#endregion
-export { type ClaudeCodeModelCatalogOptions, type ClaudeCodeOAuthAccess, type ClaudeCodeProviderOptions, type ClaudeCodeQuotaOptions, createClaudeCodeProvider, createClaudeCodeQuota, listClaudeCodeModels, mapClaudeUsagePayload, observeClaudeRateLimitHeaders, observeClaudeStreamBody, resolveClaudeCodeOAuthAccess, resolveWireLogDir };
+//#region src/credentials.d.ts
+declare class PoolAwareClaudeCodeAuthStore implements ClaudeCodeAuthStore {
+  private readonly pool;
+  constructor(pool: FileCredentialPool);
+  status(): Promise<import("@demicodes/provider").ProviderAuthState>;
+  resolveAccess(): Promise<ClaudeCodeOAuthAccess>;
+  private currentStore;
+}
+declare function openClaudeCodeCredentialPool(options?: {
+  stateDir?: string;
+}): FileCredentialPool;
+declare function createClaudeCodeCredentials(pool: FileCredentialPool, authStore: ClaudeCodeAuthStore, options?: {
+  quota?: ProviderQuota | null;
+  onActiveChange?: () => void;
+  /** Injectable fetch for the OAuth login flow (tests). */
+  loginFetch?: typeof fetch;
+}): ProviderCredentials;
+//#endregion
+//#region src/login.d.ts
+/** Pool-entry oauth.json shape (demi-owned; refreshable when refreshToken present). */
+interface ClaudeCodeOAuthSecret {
+  accessToken: string;
+  refreshToken?: string | null;
+  /** ISO-8601 access token expiry. */
+  expiresAt?: string | null;
+  scopes?: string[] | null;
+  subscriptionType?: string | null;
+  rateLimitTier?: string | null;
+  emailAddress?: string | null;
+  [key: string]: unknown;
+}
+interface ClaudeCodeLoginOptions {
+  signal?: AbortSignal;
+  /** Fires once with the authorize URL; the flow then waits on promptForCode. */
+  onPending?: (pending: {
+    verificationUrl: string;
+    requiresCodeInput: true;
+  }) => void;
+  /** Collects the "code#state" string the vendor page shows after approval. */
+  promptForCode: () => Promise<string>;
+  fetch?: typeof fetch;
+  consoleBase?: string;
+}
+/** Runs the copy-back OAuth flow and returns a refreshable pool secret. */
+declare function runClaudeCodeLogin(options: ClaudeCodeLoginOptions): Promise<ClaudeCodeOAuthSecret>;
+/** Refreshes a pool secret in place; returns the renewed secret. */
+declare function refreshClaudeCodeSecret(secret: ClaudeCodeOAuthSecret, options?: {
+  fetch?: typeof fetch;
+  consoleBase?: string;
+  signal?: AbortSignal;
+}): Promise<ClaudeCodeOAuthSecret>;
+//#endregion
+export { type ClaudeCodeAuthStore, type ClaudeCodeLoginOptions, type ClaudeCodeModelCatalogOptions, type ClaudeCodeOAuthAccess, type ClaudeCodeOAuthSecret, type ClaudeCodeProviderOptions, type ClaudeCodeQuotaOptions, FileClaudeCodeAuthStore, PoolAwareClaudeCodeAuthStore, StaticClaudeCodeAuthStore, createClaudeCodeCredentials, createClaudeCodeProvider, createClaudeCodeQuota, listClaudeCodeModels, mapClaudeUsagePayload, observeClaudeRateLimitHeaders, observeClaudeStreamBody, openClaudeCodeCredentialPool, refreshClaudeCodeSecret, resolveClaudeCodeOAuthAccess, resolveWireLogDir, runClaudeCodeLogin };

package/dist/index.mjs

@@ -1,10 +1,12 @@
-import { errorMessage, isRecord, nonEmptyString, numberOrNull, stringOrNull } from "@demicodes/utils";
-import { randomUUID } from "node:crypto";
-import { applyModelPolicy, clampUsedPercent, createProviderQuota, defineProvider, severityFromUsedPercent, unixSecondsToIso } from "@demicodes/provider";
-import { Buffer as Buffer$1 } from "node:buffer";
+import { abortable, errorMessage, isRecord, nonEmptyString, numberOrNull, stringOrNull } from "@demicodes/utils";
+import { createHash, randomBytes, randomUUID } from "node:crypto";
+import { applyModelPolicy, clampUsedPercent, createProviderQuota, defineProvider, numberHeader, severityFromUsedPercent, toolResultContentToText, unixSecondsToIso } from "@demicodes/provider";
 import { execFile, spawn } from "node:child_process";
+import { readFile, writeFile } from "node:fs/promises";
 import { promisify } from "node:util";
 import process$1 from "node:process";
+import { FileCredentialPool, credentialIdFromIdentity } from "@demicodes/provider/credentials-pool";
+import { Buffer as Buffer$1 } from "node:buffer";
 import { appendFileSync, mkdirSync, statSync } from "node:fs";
 import { createInterface } from "node:readline";
 import { tmpdir } from "node:os";
@@ -12,7 +14,7 @@ import { join } from "node:path";
 //#region src/models.ts
 const DEFAULT_MODELS_DEV_URL = "https://models.dev/api.json";
 const DEFAULT_MINIMUM_MODEL_VERSION = "4.6";
-const MODELS_DEV_CACHE_TTL_MS = 1440 * 60 * 1e3;
+const MODELS_DEV_CACHE_TTL_MS = 864e5;
 let memoryCache = null;
 async function listClaudeCodeModels(options = {}) {
 	const fetchImpl = options.fetch ?? fetch;
@@ -95,7 +97,8 @@ const CLAUDE_FAMILY_RANK = {
 	haiku: 2
 };
 function claudeFamilyRank(id) {
-	return CLAUDE_FAMILY_RANK[id.slice(7).split("-")[0] ?? ""] ?? 3;
+	const family = id.slice(7).split("-")[0] ?? "";
+	return CLAUDE_FAMILY_RANK[family] ?? 3;
 }
 /** Canonical catalog order: flagship family first (Opus > Sonnet > Haiku > others), newest version first. */
 function compareClaudeModels(a, b) {
@@ -197,6 +200,378 @@ function reasoningEfforts(value) {
 	return efforts.length > 0 ? efforts : [];
 }
 //#endregion
+//#region src/auth.ts
+const execFileAsync = promisify(execFile);
+const OAUTH_EXPIRY_SKEW_MS = 3e5;
+/**
+* Resolves Claude OAuth: explicit token → oauth file → CLAUDE_CODE_OAUTH_TOKEN → keychain.
+*/
+var FileClaudeCodeAuthStore = class {
+	oauthFile;
+	accessToken;
+	refresh;
+	constructor(options = {}) {
+		this.oauthFile = options.oauthFile ?? null;
+		this.accessToken = nonEmptyString(options.accessToken) ?? null;
+		this.refresh = options.refresh ?? null;
+	}
+	async status() {
+		try {
+			const access = await this.resolveAccess();
+			return {
+				status: "authenticated",
+				accountLabel: nonEmptyString(access.subscriptionType) ?? "Claude Code"
+			};
+		} catch (error) {
+			if (error instanceof ClaudeCodeAuthError && error.code === "auth_missing") return {
+				status: "unauthenticated",
+				message: error.message
+			};
+			return {
+				status: "error",
+				message: error instanceof Error ? error.message : String(error)
+			};
+		}
+	}
+	async resolveAccess() {
+		if (this.accessToken) return {
+			accessToken: this.accessToken,
+			source: "static"
+		};
+		if (this.oauthFile) try {
+			let raw = JSON.parse(await readFile(this.oauthFile, "utf8"));
+			if (!isRecord(raw)) throw new ClaudeCodeAuthError("auth_invalid", `Invalid OAuth file: ${this.oauthFile}`);
+			const expiresAt = nonEmptyString(raw.expiresAt);
+			if (expiresAt !== void 0 && Date.parse(expiresAt) - Date.now() < OAUTH_EXPIRY_SKEW_MS && nonEmptyString(raw.refreshToken) && this.refresh) {
+				raw = await this.refresh(raw);
+				await writeFile(this.oauthFile, `${JSON.stringify(raw, null, 2)}\n`);
+			}
+			if (!isRecord(raw)) throw new ClaudeCodeAuthError("auth_invalid", `Invalid OAuth file: ${this.oauthFile}`);
+			const accessToken = nonEmptyString(raw.accessToken) ?? nonEmptyString(raw.access_token);
+			if (!accessToken) throw new ClaudeCodeAuthError("auth_missing", `No accessToken in ${this.oauthFile}`);
+			return {
+				accessToken,
+				source: "file",
+				subscriptionType: nonEmptyString(raw.subscriptionType) ?? null,
+				rateLimitTier: nonEmptyString(raw.rateLimitTier) ?? null
+			};
+		} catch (error) {
+			if (error instanceof ClaudeCodeAuthError) throw error;
+			throw new ClaudeCodeAuthError("auth_missing", `Failed to read Claude OAuth file ${this.oauthFile}: ${error instanceof Error ? error.message : String(error)}`);
+		}
+		const fromEnv = nonEmptyString(process$1.env.CLAUDE_CODE_OAUTH_TOKEN);
+		if (fromEnv) return {
+			accessToken: fromEnv,
+			source: "env"
+		};
+		if (process$1.platform === "darwin") try {
+			const { stdout } = await execFileAsync("security", [
+				"find-generic-password",
+				"-s",
+				"Claude Code-credentials",
+				"-w"
+			], {
+				encoding: "utf8",
+				timeout: 5e3
+			});
+			const parsed = JSON.parse(stdout.trim());
+			if (!isRecord(parsed)) throw new ClaudeCodeAuthError("auth_missing", "Claude Code keychain item is not a JSON object");
+			const oauth = isRecord(parsed.claudeAiOauth) ? parsed.claudeAiOauth : null;
+			if (!oauth) throw new ClaudeCodeAuthError("auth_missing", "Claude Code keychain missing claudeAiOauth");
+			const accessToken = nonEmptyString(oauth.accessToken);
+			if (!accessToken) throw new ClaudeCodeAuthError("auth_missing", "Claude Code keychain missing accessToken");
+			return {
+				accessToken,
+				source: "keychain",
+				subscriptionType: nonEmptyString(oauth.subscriptionType) ?? null,
+				rateLimitTier: nonEmptyString(oauth.rateLimitTier) ?? null
+			};
+		} catch (error) {
+			if (error instanceof ClaudeCodeAuthError) throw error;
+		}
+		throw new ClaudeCodeAuthError("auth_missing", "Claude Code OAuth access token not found (set CLAUDE_CODE_OAUTH_TOKEN or log in with Claude Code)");
+	}
+};
+var StaticClaudeCodeAuthStore = class {
+	access;
+	constructor(access) {
+		this.access = access;
+	}
+	async status() {
+		return {
+			status: "authenticated",
+			accountLabel: nonEmptyString(this.access.subscriptionType) ?? "Claude Code"
+		};
+	}
+	async resolveAccess() {
+		return this.access;
+	}
+};
+var ClaudeCodeAuthError = class extends Error {
+	code;
+	constructor(code, message) {
+		super(message);
+		this.code = code;
+		this.name = "ClaudeCodeAuthError";
+	}
+};
+//#endregion
+//#region src/login.ts
+const CLAUDE_AUTHORIZE_URL = "https://claude.ai/oauth/authorize";
+const CLAUDE_CONSOLE_BASE = "https://console.anthropic.com";
+const CLAUDE_CODE_CLIENT_ID = "9d1c250a-e61b-44d9-88ed-5944d1962f5e";
+const CLAUDE_LOGIN_SCOPE = "org:create_api_key user:profile user:inference";
+function tokenEndpoint(consoleBase) {
+	return `${consoleBase.replace(/\/+$/, "")}/v1/oauth/token`;
+}
+async function requestTokens(fetchImpl, consoleBase, body, signal) {
+	const response = await fetchImpl(tokenEndpoint(consoleBase), {
+		method: "POST",
+		headers: { "content-type": "application/json" },
+		body: JSON.stringify(body),
+		signal
+	});
+	if (!response.ok) throw new ClaudeCodeAuthError("auth_invalid", `Claude OAuth token request failed with HTTP ${response.status}`);
+	const parsed = await response.json().catch(() => null);
+	if (!isRecord(parsed)) throw new ClaudeCodeAuthError("auth_invalid", "Claude OAuth token response is not a JSON object");
+	const accessToken = nonEmptyString(parsed.access_token);
+	if (!accessToken) throw new ClaudeCodeAuthError("auth_invalid", "Claude OAuth token response is missing access_token");
+	const expiresIn = Number(parsed.expires_in);
+	const account = isRecord(parsed.account) ? parsed.account : {};
+	return {
+		accessToken,
+		refreshToken: nonEmptyString(parsed.refresh_token) ?? null,
+		expiresAt: Number.isFinite(expiresIn) && expiresIn > 0 ? new Date(Date.now() + expiresIn * 1e3).toISOString() : null,
+		scopes: typeof parsed.scope === "string" ? parsed.scope.split(" ").filter(Boolean) : null,
+		subscriptionType: nonEmptyString(parsed.subscription_type) ?? nonEmptyString(account.subscription_type) ?? null,
+		...nonEmptyString(account.email_address) ? { emailAddress: nonEmptyString(account.email_address) } : {}
+	};
+}
+/** Runs the copy-back OAuth flow and returns a refreshable pool secret. */
+async function runClaudeCodeLogin(options) {
+	const fetchImpl = options.fetch ?? fetch;
+	const consoleBase = options.consoleBase ?? CLAUDE_CONSOLE_BASE;
+	const verifier = randomBytes(32).toString("base64url");
+	const challenge = createHash("sha256").update(verifier).digest("base64url");
+	const state = randomBytes(32).toString("base64url");
+	const redirectUri = `${consoleBase.replace(/\/+$/, "")}/oauth/code/callback`;
+	const params = new URLSearchParams({
+		code: "true",
+		client_id: CLAUDE_CODE_CLIENT_ID,
+		response_type: "code",
+		redirect_uri: redirectUri,
+		scope: CLAUDE_LOGIN_SCOPE,
+		code_challenge: challenge,
+		code_challenge_method: "S256",
+		state
+	});
+	options.onPending?.({
+		verificationUrl: `${CLAUDE_AUTHORIZE_URL}?${params.toString()}`,
+		requiresCodeInput: true
+	});
+	const pasted = (await options.promptForCode()).trim();
+	if (!pasted) throw new ClaudeCodeAuthError("auth_invalid", "Empty authorization code");
+	const [code, returnedState] = pasted.split("#");
+	if (!nonEmptyString(code)) throw new ClaudeCodeAuthError("auth_invalid", "Authorization code is missing the code part");
+	if (returnedState && returnedState !== state) throw new ClaudeCodeAuthError("auth_invalid", "Authorization code state mismatch — copy the full string from the callback page");
+	return requestTokens(fetchImpl, consoleBase, {
+		grant_type: "authorization_code",
+		code,
+		state: returnedState ?? state,
+		client_id: CLAUDE_CODE_CLIENT_ID,
+		redirect_uri: redirectUri,
+		code_verifier: verifier
+	}, options.signal);
+}
+/** Refreshes a pool secret in place; returns the renewed secret. */
+async function refreshClaudeCodeSecret(secret, options = {}) {
+	const refreshToken = nonEmptyString(secret.refreshToken);
+	if (!refreshToken) throw new ClaudeCodeAuthError("auth_missing", "Claude OAuth secret has no refreshToken to renew with");
+	const renewed = await requestTokens(options.fetch ?? fetch, options.consoleBase ?? CLAUDE_CONSOLE_BASE, {
+		grant_type: "refresh_token",
+		refresh_token: refreshToken,
+		client_id: CLAUDE_CODE_CLIENT_ID
+	}, options.signal);
+	return {
+		...secret,
+		accessToken: renewed.accessToken,
+		refreshToken: renewed.refreshToken ?? refreshToken,
+		expiresAt: renewed.expiresAt ?? secret.expiresAt ?? null,
+		scopes: renewed.scopes ?? secret.scopes ?? null,
+		subscriptionType: renewed.subscriptionType ?? secret.subscriptionType ?? null,
+		...nonEmptyString(renewed.emailAddress) ? { emailAddress: renewed.emailAddress } : {}
+	};
+}
+//#endregion
+//#region src/credentials.ts
+var PoolAwareClaudeCodeAuthStore = class {
+	pool;
+	constructor(pool) {
+		this.pool = pool;
+	}
+	async status() {
+		return this.currentStore().then((s) => s.status());
+	}
+	async resolveAccess() {
+		return this.currentStore().then((s) => s.resolveAccess());
+	}
+	async currentStore() {
+		await this.pool.ensureActivePointer();
+		const activeId = await this.pool.getActiveId();
+		if (activeId) return new FileClaudeCodeAuthStore({
+			oauthFile: this.pool.secretPath(activeId),
+			refresh: (secret) => refreshClaudeCodeSecret(secret)
+		});
+		return new FileClaudeCodeAuthStore();
+	}
+};
+function openClaudeCodeCredentialPool(options = {}) {
+	return new FileCredentialPool({
+		stateDir: options.stateDir,
+		providerKey: "claude-code",
+		secretFileName: "oauth.json"
+	});
+}
+function createClaudeCodeCredentials(pool, authStore, options = {}) {
+	const capability = () => ({
+		mode: "supported",
+		canBeginLogin: true,
+		canImportDefault: true,
+		canAdd: true,
+		multi: true
+	});
+	const getActive = async () => {
+		await pool.ensureActivePointer();
+		return {
+			credentialId: await pool.getActiveId(),
+			status: await authStore.status()
+		};
+	};
+	const setActive = async (credentialId) => {
+		await pool.setActiveId(credentialId);
+		options.quota?.clearLatest?.();
+		options.onActiveChange?.();
+		return getActive();
+	};
+	const importAccess = async (access, source) => {
+		const token = nonEmptyString(access.accessToken);
+		if (!token) throw new ClaudeCodeAuthError("auth_missing", "No Claude access token to import");
+		const identityKey = nonEmptyString(access.subscriptionType) != null ? `token:${createHash("sha256").update(token).digest("hex").slice(0, 16)}:${access.subscriptionType}` : `token:${createHash("sha256").update(token).digest("hex").slice(0, 16)}`;
+		const label = nonEmptyString(access.subscriptionType) ?? `claude-${identityKey.slice(-8)}`;
+		const id = (await pool.findByIdentityKey(identityKey))?.id ?? credentialIdFromIdentity(identityKey, label);
+		const meta = {
+			id,
+			label,
+			detail: nonEmptyString(access.rateLimitTier) ?? null,
+			updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+			source,
+			identityKey
+		};
+		const secret = {
+			accessToken: token,
+			subscriptionType: access.subscriptionType ?? null,
+			rateLimitTier: access.rateLimitTier ?? null
+		};
+		await pool.writeEntry(meta, `${JSON.stringify(secret, null, 2)}\n`);
+		if (!await pool.getActiveId()) await pool.setActiveId(id);
+		options.quota?.clearLatest?.();
+		options.onActiveChange?.();
+		return {
+			id: meta.id,
+			label: meta.label,
+			detail: meta.detail,
+			updatedAt: meta.updatedAt
+		};
+	};
+	const importSecret = async (secret, source) => {
+		const email = nonEmptyString(secret.emailAddress);
+		const identityKey = email ? `email:${email}` : `token:${createHash("sha256").update(secret.accessToken).digest("hex").slice(0, 16)}`;
+		const label = email ?? nonEmptyString(secret.subscriptionType) ?? `claude-${identityKey.slice(-8)}`;
+		const id = (await pool.findByIdentityKey(identityKey))?.id ?? credentialIdFromIdentity(identityKey, label);
+		const meta = {
+			id,
+			label,
+			detail: nonEmptyString(secret.subscriptionType) ?? nonEmptyString(secret.rateLimitTier) ?? null,
+			updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+			source,
+			identityKey
+		};
+		await pool.writeEntry(meta, `${JSON.stringify(secret, null, 2)}\n`);
+		if (!await pool.getActiveId()) await pool.setActiveId(id);
+		options.quota?.clearLatest?.();
+		options.onActiveChange?.();
+		return {
+			id: meta.id,
+			label: meta.label,
+			detail: meta.detail,
+			updatedAt: meta.updatedAt
+		};
+	};
+	return {
+		capability,
+		list: () => pool.list(),
+		getActive,
+		setActive,
+		beginLogin: async (loginOptions) => {
+			if (!loginOptions?.promptForCode) return {
+				status: "unavailable",
+				message: "Claude login requires promptForCode to collect the pasted authorization code"
+			};
+			try {
+				const secret = await runClaudeCodeLogin({
+					signal: loginOptions.signal,
+					onPending: loginOptions.onPending,
+					promptForCode: loginOptions.promptForCode,
+					fetch: options.loginFetch
+				});
+				return {
+					status: "completed",
+					credentialId: (await importSecret(secret, "login:oauth")).id
+				};
+			} catch (error) {
+				if (loginOptions.signal?.aborted) return { status: "cancelled" };
+				return {
+					status: "failed",
+					message: errorMessage(error)
+				};
+			}
+		},
+		importDefault: async () => {
+			const vendor = new FileClaudeCodeAuthStore();
+			let access;
+			try {
+				access = await vendor.resolveAccess();
+			} catch {
+				throw new ClaudeCodeAuthError("auth_missing", "No Claude Code OAuth to import. Run claude auth login or beginLogin first.");
+			}
+			return importAccess(access, "vendor:default");
+		},
+		add: async (input) => {
+			if (typeof input.accessToken === "string") return importAccess({
+				accessToken: input.accessToken,
+				source: "static",
+				subscriptionType: typeof input.subscriptionType === "string" ? input.subscriptionType : null,
+				rateLimitTier: typeof input.rateLimitTier === "string" ? input.rateLimitTier : null
+			}, "add:accessToken");
+			if (isRecord(input.oauth) && typeof input.oauth.accessToken === "string") {
+				const oauth = input.oauth;
+				return importAccess({
+					accessToken: oauth.accessToken,
+					source: "static",
+					subscriptionType: typeof oauth.subscriptionType === "string" ? oauth.subscriptionType : null,
+					rateLimitTier: typeof oauth.rateLimitTier === "string" ? oauth.rateLimitTier : null
+				}, "add:oauth");
+			}
+			throw new Error("Claude credentials.add expects accessToken or oauth.accessToken");
+		},
+		remove: async (credentialId) => {
+			await pool.remove(credentialId);
+			options.quota?.clearLatest?.();
+			options.onActiveChange?.();
+		}
+	};
+}
+//#endregion
 //#region src/jsonl.ts
 /**
 * Builds the input messages used to prime a *fresh* Claude CLI process with prior
@@ -260,12 +635,10 @@ function coldStartInputMessages(items) {
 				text: renderToolUseText(item.toolName, item.input)
 			}]);
 			break;
-		case "tool_result":
-			append("assistant", [{
-				type: "text",
-				text: renderToolResultText(toolNames.get(item.toolUseId), item)
-			}]);
-			break;
+		case "tool_result": append("assistant", [{
+			type: "text",
+			text: renderToolResultText(toolNames.get(item.toolUseId), item)
+		}]);
 	}
 	flush();
 	return messages;
@@ -274,7 +647,7 @@ function renderToolUseText(toolName, input) {
 	return `[Earlier in this conversation I called the tool ${toolName} with input: ${safeJson(input)}.`;
 }
 function renderToolResultText(toolName, item) {
-	const body = toolResultToText(item.output);
+	const body = toolResultContentToText(item.output);
 	const suffix = toolName ? ` from ${toolName}` : "";
 	return item.isError ? `It returned an error${suffix}: ${body}]` : `It returned${suffix}: ${body}]`;
 }
@@ -339,6 +712,10 @@ function userContentToClaude(content) {
 			type: "image",
 			source: imageSourceToClaude(block.source)
 		};
+		if (block.type === "video") return {
+			type: "text",
+			text: "[video]"
+		};
 		if (block.type === "document") return documentSourceToClaude(block.source);
 		return {
 			type: "text",
@@ -371,11 +748,30 @@ function assistantItemToClaudeContent(item) {
 	};
 }
 function toolResultToClaudeContent(item) {
+	const hasImage = item.output.some((block) => block.type !== "text");
 	return {
 		type: "tool_result",
 		tool_use_id: item.toolUseId,
 		is_error: item.isError,
-		content: toolResultToText(item.output)
+		content: hasImage ? item.output.map(toolResultBlockToClaude) : toolResultContentToText(item.output)
+	};
+}
+function toolResultBlockToClaude(block) {
+	if (block.type === "text") return {
+		type: "text",
+		text: block.text
+	};
+	if (block.type === "video") return {
+		type: "text",
+		text: `[video:${block.source.mediaType}]`
+	};
+	return {
+		type: "image",
+		source: {
+			type: "base64",
+			media_type: block.source.mediaType,
+			data: block.source.data
+		}
 	};
 }
 function imageSourceToClaude(source) {
@@ -400,9 +796,6 @@ function documentSourceToClaude(source) {
 		title: source.fileName
 	};
 }
-function toolResultToText(output) {
-	return output.map((block) => block.type === "text" ? block.text : `[image:${block.source.mediaType}]`).join("\n");
-}
 function bytesToBase64(data) {
 	return Buffer$1.from(data.buffer, data.byteOffset, data.byteLength).toString("base64");
 }
@@ -411,6 +804,28 @@ function toolNameToClaude(name) {
 	return `mcp__main__${name}`;
 }
 //#endregion
+//#region src/oauth.ts
+/**
+* The token to inject into a spawned CLI as CLAUDE_CODE_OAUTH_TOKEN, or null
+* to let the CLI authenticate itself. Keychain-sourced tokens are never
+* injected — see {@link ClaudeCodeOAuthSource}.
+*/
+function injectableCliToken(access) {
+	return access.source === "keychain" ? null : access.accessToken;
+}
+/**
+* Resolve Claude Code consumer OAuth access for quota APIs.
+* Order: options env CLAUDE_CODE_OAUTH_TOKEN, then macOS Keychain "Claude Code-credentials".
+* Prefer injecting {@link ClaudeCodeAuthStore} when multi-credential is enabled.
+*/
+async function resolveClaudeCodeOAuthAccess() {
+	try {
+		return await new FileClaudeCodeAuthStore().resolveAccess();
+	} catch {
+		return null;
+	}
+}
+//#endregion
 //#region src/output.ts
 function mapClaudeStdoutMessage(message, options = {}) {
 	const events = [];
@@ -418,7 +833,7 @@ function mapClaudeStdoutMessage(message, options = {}) {
 		events,
 		terminal: false
 	};
-	if (message.type === "assistant" && isRecord(message.message) && !options.ignoreAssistantContent) events.push(...mapContentArray(message.message.content, options));
+	if (message.type === "assistant" && isRecord(message.message)) events.push(...mapContentArray(message.message.content, options));
 	if (message.type === "stream_event" && isRecord(message.event)) events.push(...mapStreamEvent(message.event));
 	if (message.type === "control_request") {
 		const request = parseControlRequest(message);
@@ -439,7 +854,7 @@ function mapClaudeStdoutMessage(message, options = {}) {
 		}
 		events.push({
 			type: "response",
-			usage: mapUsage(message.usage)
+			usage: mapResultUsage(message.usage)
 		});
 		return {
 			events,
@@ -476,11 +891,11 @@ function mapContentArray(content, options) {
 	const events = [];
 	for (const block of content) {
 		if (!isRecord(block)) continue;
-		if (block.type === "text") events.push({
+		if (block.type === "text" && !options.ignoreAssistantContent) events.push({
 			type: "text_delta",
 			text: String(block.text ?? "")
 		});
-		else if (block.type === "thinking") {
+		else if (block.type === "thinking" && !options.ignoreAssistantContent) {
 			events.push({ type: "thinking_start" });
 			events.push({
 				type: "thinking_delta",
@@ -490,7 +905,7 @@ function mapContentArray(content, options) {
 				type: "thinking_signature",
 				signature: block.signature
 			});
-		} else if (block.type === "redacted_thinking") events.push({
+		} else if (block.type === "redacted_thinking" && !options.ignoreAssistantContent) events.push({
 			type: "redacted_thinking",
 			data: String(block.data ?? "")
 		});
@@ -554,6 +969,7 @@ function parseControlRequest(message) {
 			outerRequestId: message.request_id,
 			serverName: request.server_name,
 			id,
+			toolUseId: sdkMcpToolUseId(inner.params),
 			method,
 			params: inner.params
 		};
@@ -568,6 +984,26 @@ function parseControlRequest(message) {
 		params: message.params
 	};
 }
+function sdkMcpToolUseId(params) {
+	if (!isRecord(params) || !isRecord(params._meta)) return void 0;
+	const value = params._meta["claudecode/toolUseId"];
+	return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+/**
+* Usage for the response event from a `result` message. The top-level
+* `result.usage` sums every API call the CLI made within the turn (initial call
+* plus one per tool result), so its input/cache counts can exceed the context
+* window itself and must not be reported as request usage. `usage.iterations`
+* lists the per-call usage; the last entry is the final request — the one the
+* response contract requires.
+*/
+function mapResultUsage(usage) {
+	if (isRecord(usage) && Array.isArray(usage.iterations)) {
+		const last = usage.iterations[usage.iterations.length - 1];
+		if (isRecord(last)) return mapUsage(last);
+	}
+	return mapUsage(usage);
+}
 function mapUsage(usage) {
 	if (!isRecord(usage)) return {
 		inputTokens: 0,
@@ -605,42 +1041,6 @@ function stripMcpToolPrefix(name) {
 	return /^mcp__[^_]+__(.+)$/.exec(name)?.[1] ?? name;
 }
 //#endregion
-//#region src/oauth.ts
-const execFileAsync = promisify(execFile);
-/**
-* Resolve Claude Code consumer OAuth access for quota APIs.
-* Order: options env CLAUDE_CODE_OAUTH_TOKEN, then macOS Keychain "Claude Code-credentials".
-*/
-async function resolveClaudeCodeOAuthAccess() {
-	const fromEnv = nonEmptyString(process$1.env.CLAUDE_CODE_OAUTH_TOKEN);
-	if (fromEnv) return { accessToken: fromEnv };
-	if (process$1.platform === "darwin") try {
-		const { stdout } = await execFileAsync("security", [
-			"find-generic-password",
-			"-s",
-			"Claude Code-credentials",
-			"-w"
-		], {
-			encoding: "utf8",
-			timeout: 5e3
-		});
-		const parsed = JSON.parse(stdout.trim());
-		if (!isRecord(parsed)) return null;
-		const oauth = isRecord(parsed.claudeAiOauth) ? parsed.claudeAiOauth : null;
-		if (!oauth) return null;
-		const accessToken = nonEmptyString(oauth.accessToken);
-		if (!accessToken) return null;
-		return {
-			accessToken,
-			subscriptionType: nonEmptyString(oauth.subscriptionType) ?? null,
-			rateLimitTier: nonEmptyString(oauth.rateLimitTier) ?? null
-		};
-	} catch {
-		return null;
-	}
-	return null;
-}
-//#endregion
 //#region src/quota.ts
 const DEFAULT_USAGE_URL = "https://api.anthropic.com/api/oauth/usage";
 const DEFAULT_OAUTH_BETA = "oauth-2025-04-20";
@@ -662,14 +1062,15 @@ function createClaudeCodeQuota(options = {}) {
 		probe: async ({ signal } = {}) => {
 			const access = await resolveAccess();
 			if (!access?.accessToken) throw new Error("Claude Code OAuth access token not found (set CLAUDE_CODE_OAUTH_TOKEN or log in with Claude Code)");
+			const headers = new Headers({
+				authorization: `Bearer ${access.accessToken}`,
+				"anthropic-beta": DEFAULT_OAUTH_BETA,
+				accept: "application/json",
+				"user-agent": "demi-provider-claude-code"
+			});
 			const response = await fetchImpl(usageUrl, {
 				method: "GET",
-				headers: new Headers({
-					authorization: `Bearer ${access.accessToken}`,
-					"anthropic-beta": DEFAULT_OAUTH_BETA,
-					accept: "application/json",
-					"user-agent": "demi-provider-claude-code"
-				}),
+				headers,
 				signal
 			});
 			if (!response.ok) {
@@ -746,7 +1147,7 @@ function observeClaudeRateLimitHeaders(headers) {
 	const claim = headers.get("anthropic-ratelimit-unified-representative-claim");
 	const overageUtil = headers.get("anthropic-ratelimit-unified-overage-period-channel-utilization");
 	if (!status && !reset && !claim && !overageUtil) return null;
-	const usedPercent = clampUsedPercent(overageUtil != null ? Number(overageUtil) : null);
+	const usedPercent = clampUsedPercent(numberHeader(headers, "anthropic-ratelimit-unified-overage-period-channel-utilization"));
 	return {
 		windows: [{
 			id: "unified",
@@ -803,13 +1204,15 @@ function buildClaudeArgs(params) {
 	if (params.thinkingEffort) args.push("--effort", params.thinkingEffort);
 	return args;
 }
-function buildClaudeEnv(base = process.env) {
+function buildClaudeEnv(base = process.env, options = {}) {
 	const env = {
 		...base,
 		DISABLE_AUTO_COMPACT: "1",
 		MAX_MCP_OUTPUT_TOKENS: "1000000"
 	};
 	delete env.CLAUDECODE;
+	const token = options.oauthAccessToken?.trim();
+	if (token) env.CLAUDE_CODE_OAUTH_TOKEN = token;
 	return env;
 }
 //#endregion
@@ -835,7 +1238,8 @@ function createClaudeWireLog(sessionId) {
 	} catch {
 		return NULL_WIRE_LOG;
 	}
-	const path = join(dir, `claude-${sessionId.replace(/[^a-zA-Z0-9_-]/g, "_") || "session"}.jsonl`);
+	const safeSession = sessionId.replace(/[^a-zA-Z0-9_-]/g, "_") || "session";
+	const path = join(dir, `claude-${safeSession}.jsonl`);
 	return {
 		path,
 		record(direction, data) {
@@ -856,13 +1260,19 @@ function resolveSpawnCwd(cwd) {
 	try {
 		if (statSync(cwd).isDirectory()) return cwd;
 	} catch {}
-	return process.cwd();
+	return process$1.cwd();
 }
 var ClaudeCliTransportFactory = class {
 	claudePath;
+	resolveOAuthAccessToken;
 	constructor(options = {}) {
-		if (typeof options === "string") this.claudePath = options;
-		else this.claudePath = options.claudePath ?? "claude";
+		if (typeof options === "string") {
+			this.claudePath = options;
+			this.resolveOAuthAccessToken = null;
+		} else {
+			this.claudePath = options.claudePath ?? "claude";
+			this.resolveOAuthAccessToken = options.resolveOAuthAccessToken ?? null;
+		}
 	}
 	async start(request) {
 		const args = buildClaudeArgsForRequest(request);
@@ -874,9 +1284,10 @@ var ClaudeCliTransportFactory = class {
 			cwd: request.cwd,
 			args
 		});
+		const oauthAccessToken = this.resolveOAuthAccessToken ? await this.resolveOAuthAccessToken() : null;
 		return new ChildProcessClaudeTransport(spawn(this.claudePath, args, {
 			cwd: resolveSpawnCwd(request.cwd),
-			env: buildClaudeEnv(),
+			env: buildClaudeEnv(process$1.env, { oauthAccessToken }),
 			stdio: [
 				"pipe",
 				"pipe",
@@ -962,13 +1373,32 @@ function thinkingEffort(thinking) {
 }
 //#endregion
 //#region src/provider.ts
-var ClaudeCodeProvider = class {
+var ClaudeCodeProvider = class ClaudeCodeProvider {
+	cloneOptions;
 	transportFactory;
 	quota;
+	getActiveCredentialId;
 	active = null;
 	constructor(options = {}) {
-		this.transportFactory = options.transportFactory ?? new ClaudeCliTransportFactory({ claudePath: options.claudePath });
+		this.cloneOptions = options;
+		this.transportFactory = options.transportFactory ?? new ClaudeCliTransportFactory({
+			claudePath: options.claudePath,
+			resolveOAuthAccessToken: options.authStore ? async () => {
+				try {
+					return injectableCliToken(await options.authStore.resolveAccess());
+				} catch {
+					return null;
+				}
+			} : void 0
+		});
 		this.quota = options.quota ?? null;
+		this.getActiveCredentialId = options.getActiveCredentialId ?? null;
+	}
+	clone() {
+		return new ClaudeCodeProvider({
+			...this.cloneOptions,
+			transportFactory: this.transportFactory
+		});
 	}
 	observeQuotaFromMessage(message) {
 		try {
@@ -1018,21 +1448,50 @@ var ClaudeCodeProvider = class {
 				}
 				const raw = next.value;
 				this.observeQuotaFromMessage(raw);
-				const mapped = mapClaudeStdoutMessage(raw, {
-					ignoreAssistantContent: active.hasStreamed && isMessageType(raw, "assistant"),
-					ignoreAssistantToolUse: active.sdkMcpEnabled
-				});
+				const mapped = mapClaudeStdoutMessage(raw, { ignoreAssistantContent: active.hasStreamed && isMessageType(raw, "assistant") });
 				if (isMessageType(raw, "stream_event")) active.hasStreamed = true;
 				if (mapped.controlRequest) {
-					if (await this.handleControlRequest(active, mapped.controlRequest, request) === "tool-call") {
+					const handled = await this.handleControlRequest(active, mapped.controlRequest, request);
+					if (handled === "tool-call") {
 						const event = active.pendingControlRequest ? controlRequestToToolCall(active.pendingControlRequest) : null;
 						keepActiveForContinuation = true;
 						if (event) yield event;
 						return;
 					}
+					if (handled === "sdk-tool-call") {
+						const pending = active.pendingSdkControlRequests.get(mapped.controlRequest.toolUseId ?? "");
+						const event = pending ? controlRequestToToolCall(pending) : null;
+						if (event?.type === "tool_call_requested") {
+							active.pendingSdkToolCalls = [event];
+							keepActiveForContinuation = true;
+							yield event;
+						}
+						return;
+					}
 					continue;
 				}
 				const toolUseIds = mapped.events.filter(isToolCallRequested).map((event) => event.toolUseId);
+				if (active.sdkMcpEnabled) {
+					for (const event of mapped.events) {
+						if (event.type === "tool_call_requested") {
+							active.collectingSdkToolCalls.set(event.toolUseId, event);
+							continue;
+						}
+						yield event;
+					}
+					if (isStreamMessageStop(raw) && active.collectingSdkToolCalls.size > 0) {
+						active.pendingSdkToolCalls = [...active.collectingSdkToolCalls.values()];
+						active.collectingSdkToolCalls.clear();
+						keepActiveForContinuation = true;
+						for (const event of active.pendingSdkToolCalls) yield event;
+						return;
+					}
+					if (mapped.terminal) {
+						keepActiveForContinuation = true;
+						return;
+					}
+					continue;
+				}
 				if (toolUseIds.length > 0) active.pendingToolUseIds = toolUseIds;
 				for (const event of mapped.events) {
 					if (event.type === "tool_call_requested") keepActiveForContinuation = true;
@@ -1075,22 +1534,26 @@ var ClaudeCodeProvider = class {
 	* the session changed, or the transcript was rewritten underneath us (compaction).
 	*/
 	async ensureActiveForRequest(request) {
+		const credentialId = this.getActiveCredentialId ? await this.getActiveCredentialId() : null;
 		const existing = this.active;
-		if (existing && existing.sessionId === request.sessionId && existing.modelId === request.modelId && existing.thinkingSig === thinkingSignature(request)) {
-			if (existing.pendingControlRequest !== null || existing.pendingToolUseIds.length > 0 || !itemsDiverged(existing, request.items)) {
+		if (existing && existing.sessionId === request.sessionId && existing.modelId === request.modelId && existing.thinkingSig === thinkingSignature(request) && existing.credentialId === credentialId) {
+			if (existing.pendingControlRequest !== null || existing.pendingSdkToolCalls.length > 0 || existing.pendingToolUseIds.length > 0 || !itemsDiverged(existing, request.items)) {
 				await this.sendContinuation(existing, request);
 				return existing;
 			}
 		}
 		if (existing) await this.disposeActive(existing);
-		return this.coldStart(request);
+		return this.coldStart(request, credentialId);
 	}
-	async coldStart(request) {
+	async coldStart(request, credentialId) {
 		const transport = await this.transportFactory.start(request);
 		const active = {
 			transport,
 			iterator: transport.messages()[Symbol.asyncIterator](),
 			pendingControlRequest: null,
+			pendingSdkControlRequests: /* @__PURE__ */ new Map(),
+			pendingSdkToolCalls: [],
+			collectingSdkToolCalls: /* @__PURE__ */ new Map(),
 			pendingToolUseIds: [],
 			bufferedMessages: [],
 			sdkMcpEnabled: request.tools.length > 0,
@@ -1098,6 +1561,7 @@ var ClaudeCodeProvider = class {
 			sessionId: request.sessionId,
 			modelId: request.modelId,
 			thinkingSig: thinkingSignature(request),
+			credentialId,
 			sentUserMessageCount: 0,
 			firstUserSig: null
 		};
@@ -1114,6 +1578,10 @@ var ClaudeCodeProvider = class {
 			await this.writeToolResults(request, active.pendingControlRequest);
 			active.pendingControlRequest = null;
 		}
+		if (active.pendingSdkToolCalls.length > 0) {
+			await this.writeSdkMcpToolResults(active, request);
+			active.pendingSdkToolCalls = [];
+		}
 		if (active.pendingToolUseIds.length > 0) {
 			await this.writeToolResultMessages(request, active.pendingToolUseIds);
 			active.pendingToolUseIds = [];
@@ -1167,6 +1635,15 @@ var ClaudeCodeProvider = class {
 				await this.writeControlError(active, request, "Invalid tools/call request");
 				return "handled";
 			}
+			if (request.protocol === "sdk-mcp") {
+				request.toolUseId ??= `mcp-control-${randomUUID()}`;
+				const normalized = {
+					...request,
+					toolUseId: request.toolUseId
+				};
+				active.pendingSdkControlRequests.set(normalized.toolUseId, normalized);
+				return active.hasStreamed ? "handled" : "sdk-tool-call";
+			}
 			active.pendingControlRequest = {
 				...request,
 				toolUseId: `mcp-control-${randomUUID()}`
@@ -1176,6 +1653,38 @@ var ClaudeCodeProvider = class {
 		await this.writeControlError(active, request, `Unsupported method: ${request.method}`);
 		return "handled";
 	}
+	async writeSdkMcpToolResults(active, request) {
+		const results = new Map(request.items.filter((item) => item.type === "tool_result").map((item) => [item.toolUseId, item]));
+		const expected = active.pendingSdkToolCalls.map((event) => event.toolUseId);
+		const missing = expected.filter((toolUseId) => !results.has(toolUseId));
+		if (missing.length > 0) throw new Error(`Claude Code provider missing tool_result for SDK MCP tool_use ${missing.join(", ")}`);
+		const remaining = new Set(expected);
+		while (remaining.size > 0) {
+			let responded = false;
+			for (const toolUseId of remaining) {
+				const controlRequest = active.pendingSdkControlRequests.get(toolUseId);
+				if (!controlRequest) continue;
+				await this.writeToolResults(request, controlRequest);
+				active.pendingSdkControlRequests.delete(toolUseId);
+				remaining.delete(toolUseId);
+				responded = true;
+			}
+			if (remaining.size === 0) return;
+			if (responded) continue;
+			const next = await abortable(active.iterator.next(), request.cancel);
+			if (next.done) throw new Error(`Claude Code exited before requesting SDK MCP tool result for ${[...remaining].join(", ")}`);
+			this.observeQuotaFromMessage(next.value);
+			const mapped = mapClaudeStdoutMessage(next.value, {
+				ignoreAssistantContent: true,
+				ignoreAssistantToolUse: true
+			});
+			if (mapped.controlRequest) {
+				if (await this.handleControlRequest(active, mapped.controlRequest, request) === "tool-call") throw new Error("Claude Code emitted a legacy tool call while awaiting SDK MCP results");
+				continue;
+			}
+			active.bufferedMessages.push(next.value);
+		}
+	}
 	async writeToolResults(request, controlRequest) {
 		if (!this.active) throw new Error("No active Claude transport");
 		const expectedToolUseId = controlRequest.toolUseId ?? String(controlRequest.id);
@@ -1276,25 +1785,39 @@ var ClaudeCodeProvider = class {
 function createClaudeCodeProvider(options = {}) {
 	const id = options.id ?? "claude-code";
 	const displayName = options.displayName ?? "Claude Code";
-	const quota = createClaudeCodeQuota({ providerId: id });
+	const enableCredentials = options.credentials ?? options.authStore === void 0;
+	const pool = !options.authStore && enableCredentials ? openClaudeCodeCredentialPool({ stateDir: options.stateDir }) : null;
+	const authStore = options.authStore ?? (pool ? new PoolAwareClaudeCodeAuthStore(pool) : new FileClaudeCodeAuthStore());
+	const quota = createClaudeCodeQuota({
+		providerId: id,
+		resolveAccess: async () => {
+			try {
+				return await authStore.resolveAccess();
+			} catch {
+				return null;
+			}
+		}
+	});
+	const credentialsApi = pool ? createClaudeCodeCredentials(pool, authStore, { quota }) : void 0;
 	const runtimeOptions = {
 		claudePath: options.claudePath,
-		quota
+		quota,
+		authStore,
+		getActiveCredentialId: pool ? () => pool.getActiveId() : void 0
 	};
 	return defineProvider({
 		id,
 		displayName,
-		auth: { status: () => ({
-			status: "unknown",
-			message: "Auth is checked when a Claude Code request runs"
-		}) },
+		auth: { status: () => authStore.status() },
 		quota,
+		...credentialsApi ? { credentials: credentialsApi } : {},
 		state: () => ({
 			status: "unknown",
 			message: "Runtime is checked when a Claude Code request runs"
 		}),
 		listModels: async () => {
-			return applyModelPolicy(await listClaudeCodeModels(), id, options.models);
+			const catalog = await listClaudeCodeModels();
+			return applyModelPolicy(catalog, id, options.models);
 		},
 		createRuntime: () => new ClaudeCodeProvider(runtimeOptions)
 	});
@@ -1306,18 +1829,19 @@ function isControlResponseFor(value, requestId) {
 	if (!isRecord(value) || value.type !== "control_response" || !isRecord(value.response)) return false;
 	return value.response.request_id === requestId && value.response.subtype === "success";
 }
-function toolResultContentToText(output) {
-	return output.map((block) => block.type === "text" ? block.text : `[image:${block.source.mediaType}]`).join("\n");
-}
 function toolResultContentToMcp(output) {
 	return output.map((block) => {
 		if (block.type === "text") return {
 			type: "text",
 			text: block.text
 		};
+		if (block.type === "video") return {
+			type: "text",
+			text: `[video:${block.source.mediaType}]`
+		};
 		return {
 			type: "image",
-			data: Buffer.from(block.source.data).toString("base64"),
+			data: block.source.data,
 			mimeType: block.source.mediaType
 		};
 	});
@@ -1325,6 +1849,9 @@ function toolResultContentToMcp(output) {
 function isMessageType(value, type) {
 	return isRecord(value) && value.type === type;
 }
+function isStreamMessageStop(value) {
+	return isRecord(value) && value.type === "stream_event" && isRecord(value.event) && value.event.type === "message_stop";
+}
 function thinkingSignature(request) {
 	return JSON.stringify(request.thinking ?? null);
 }
@@ -1349,4 +1876,4 @@ function itemsDiverged(active, items) {
 	return false;
 }
 //#endregion
-export { createClaudeCodeProvider, createClaudeCodeQuota, listClaudeCodeModels, mapClaudeUsagePayload, observeClaudeRateLimitHeaders, observeClaudeStreamBody, resolveClaudeCodeOAuthAccess, resolveWireLogDir };
+export { FileClaudeCodeAuthStore, PoolAwareClaudeCodeAuthStore, StaticClaudeCodeAuthStore, createClaudeCodeCredentials, createClaudeCodeProvider, createClaudeCodeQuota, listClaudeCodeModels, mapClaudeUsagePayload, observeClaudeRateLimitHeaders, observeClaudeStreamBody, openClaudeCodeCredentialPool, refreshClaudeCodeSecret, resolveClaudeCodeOAuthAccess, resolveWireLogDir, runClaudeCodeLogin };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@demicodes/provider-claude-code",
   "description": "Claude Code provider adapter for Demi.",
-  "version": "0.10.3",
+  "version": "0.11.0",
   "private": false,
   "type": "module",
   "exports": {
@@ -11,13 +11,13 @@
     }
   },
   "dependencies": {
-    "@demicodes/core": "^0.10.3",
-    "@demicodes/provider": "^0.10.3",
-    "@demicodes/utils": "^0.10.3"
+    "@demicodes/core": "^0.11.0",
+    "@demicodes/provider": "^0.11.0",
+    "@demicodes/utils": "^0.11.0"
   },
   "devDependencies": {
-    "@demicodes/agent": "^0.10.3",
-    "@demicodes/shell": "^0.10.3"
+    "@demicodes/agent": "^0.11.0",
+    "@demicodes/shell": "^0.11.0"
   },
   "license": "Apache-2.0",
   "main": "./dist/index.mjs",